VPN Technologies Research Articles

Survey On A Comprehensive Examination of VPN Technologies and Performance Evaluation

Survey On A Comprehensive Examination of VPN Technologies and Performance Evaluation

WAYS OF THE ASTERISK SOFTWARE PBX PROTECTION

Network protection of the Asterisk software PBX widely used in modern info-communication networks is considered. This particular telephone exchange is used to set up telephone communications at the Moscow Technical University of Communications and Informatics. When connecting this software telephone exchange to IP networks, it is necessary to provide its protection to prevent it from being attacked by intruders. The Asterisk IP PBX has powerful protection tools. If properly applied, they can make the protection more reliable than that of some hardware IP PBXs. The protection system can be built in different ways. The most popular ones are the following types of protection: the iptables utility, the development of a proper network design involving the use of VLAN and VPN technologies, the utilization of Fail2Ban log file analyzer. Protection can also be implemented by means of DialPlan and developing a proper configuration of the Asterisk IP PBX.

Development of a project to create a protected corporate network using VPN technologies

This article discusses the currently relevant problem of choosing software products in the conditions of blocking Internet resources. A large number of foreign companies have temporarily ceased cooperation with Russian clients. Only a few have done this “softly” for users of their resources: with the distribution of warnings and the possibility of transferring the database to other sites or withdrawing money from previously purchased software maintenance subscriptions. The question remains acute: what difficulties have arisen for Russian business? And what are the alternatives to choosing VPN technologies in the face of blocking resources on the Internet? The purpose of the presented work is to analyze software products, namely corporate VPN. Based on the analysis carried out, recommendations were made for choosing remote access systems.

Automated VPN configuration using DevOps

Enterprise networks are becoming increasingly sophisticated and large in scale due to the critical need for interconnectivity. For the interconnection of sites, VPN technology is essential. Indeed, this technology allows a partially or completely meshed connection between the various sites in a secure way. IPsec is one of the most widely deployed VPN technologies due to its many advantages, including data confidentiality, integrity and authentication. However, implementing this technology requires considerable technical expertise given the diversity of gateway manufacturers that a company may have, advanced engineering given the set of technical parameters that a VPN tunnel may have for its proper functioning, and caution when setting up a large-scale network given that a simple error may prevent the creation of tunnels. Taking these limitations into account, the automation of IT infrastructures has become indispensable, known as DevOps, which promotes continuous communication, collaboration, integration, visibility and transparency between the teams responsible for application development (Dev) and those responsible for IT operations (Ops). With infrastructure automation, networks are becoming easier to manage, diagnose and configure. This paper proposes a new architecture that automates the deployment of VPN tunnels via a web-based graphical interface. This architecture is adapted with a variety of equipment manufacturers and delivers configurations generated via an SSH channel in an automatic way.

Цифровой авторитаризм: концептуальные основания и модель легитимации

One of the important effects of digital transformation is the expansion of digi­tal authoritarianism, which causes a noticeable transformation at all levels (global, national, local) in different socio-political systems. The article defines the concept, philosophical foundations, and model of legitimation of digital and network authoritarianism. The author substantiates the thesis that intel­ligent technical systems in autocracies support, first of all, the inviolability of the regime on the basis of control over big data, exploitation of sado­masochistic tendencies in society, propaganda through new media and social networks, mechanisms of instrumental and pragmatic consent. Together, these tools create a specific interface of the digital world the emblems of which are passivity and fear, and the installation is a blind belief that what is happening is the norm. It is suggested that as a result of the expansion of authoritarianism in cyberspace, many citizens are forced to independently protect themselves and their property by digital means such as VPN technologies and “onion rout­ing” or using a Hidden Network (Darknet). The digital confrontation between ordinary users and the ruling class (for example, in the form of street protests organized through social networks and messengers) intensifies at the intersec­tion of virtual and material realities. Reflection on these phenomena allows us to give well-founded answers to the questions about the nature and direction of digital transformation in the sphere of state and law, to make reasonable forecasts, to help the public understand the grounds and methods of controlling influence by which the government is held, which programs the consciousness and behavior of citizens.

The Problem of Cyber Espionage in the International Humanitarian Law

INTRODUCTION. The article analyses the problem of cyber espionage in the context of armed conflict in cyberspace. The relevance of this research, as part of the problem of international humanitarian law applying in cyberspace, is confirmed by the rapid development of cyber technologies that can be used during armed conflict, as well as the availability of the Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations.MATERIALS AND METHODS. The main sources of this research are the provisions of the Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations, the rules of Additional Protocol I of June 08, 1977 to the Geneva Convention of August 12, 1949, the rules of the Hague Regulations on the Laws and Customs of War on Land of 1907, and the rules of custom- ary international humanitarian law. The methodology consists of the principles used in legal research, as well as general scientific and special methods of legal research (system and formal legal methods).RESEARCH RESULTS. The provisions of the Tallinn Manual on cyber espionage were examined for compliance with the relevant provisions of Additional Protocol I of June 08, 1977 to the Geneva Convention of August 12, 1949, the Hague Regulations on the Laws and Customs of War on Land of 1907, and the rules of customary international humanitarian law, as well as the problems that may arise in the process of possible practical application of this provision of the Tallinn Manual.DISCUSSION AND CONCLUSIONS. It is noted that the provisions of the Tallinn Manual 2.0 on cyber espionage are based on the relevant rules of international law. In fact, the relevant provision of the Tallinn Manual is completely copied from the relevant rules of IHL. However, based on the results of this research, the author comes to the conclusion that such blind copying does not take into account the specifics of cyberspace and leads to the following problems in the possible practical application of this provision of the Tallinn Manual: firstly, due to the anonymity of users, it will be difficult to distinguish between a cyber intelligence officer and a cyber spy in practice. Secondly, due to the difficulties in establishing clear state borders in cyberspace, including due to the use of blockchain and VPN technologies, in practice it is impossible to reliably establish whether secret information was collected on the territory of the enemy, which, in turn, leads to difficulties in qualifying such an act as cyber espionage. Finally, in the context of modern armed conflicts, espionage has ceased to be a phenomenon exclusively of international armed conflicts, and therefore it is likely that cyber espionage can be carried out not only in the context of an international armed conflict, but also in the context of a non-international armed conflict. Based on the results of this research, suggestions were made to develop state practice on this issue. It is desirable that States raise the discussion of the above issues at the UN General Assembly, which would help to identify the main trends in the development of such practices. Only And only after the practice of States on this issue becomes more obvious, the question of developing an appropriate international treaty, preferably within the UN, can be raised.

Research on Remote Measurement System Based on Computer Network

Rapid development in computer network and automated measurement technologies makes it possible to build a remote measurement system. This paper starts with the requirement of this system. Meanwhile, several different software implementation schemes and network security schemes, which are based on identity authentication and encryption technology, are proposed. In addition, a remote measurement system applying LXI and VPN technologies is implemented and tested. The results indicate that the requirements of both bandwidth and transmission latency can be met easily. The application of this technique is very promising considering the flexibility, cost reduction and other benefits it brings.

P4-MACsec: Dynamic Topology Monitoring and Data Layer Protection With MACsec in P4-Based SDN

We propose P4-MACsec to protect network links between P4 switches through automated deployment of MACsec, a widespread IEEE standard for securing Layer 2 infrastructures. It is supported by switches and routers from major manufacturers and has only little performance limitations compared to VPN technologies such as IPsec. P4-MACsec introduces a data plane implementation of MACsec including AES-GCM encryption and decryption directly on P4 switches. P4-MACsec features a two-tier control plane structure where local controllers running on the P4 switches interact with a central controller. We propose a novel secure link discovery mechanism that leverages protected LLDP frames and the two-tier control plane structure for secure and efficient management of a global link map. Automated deployment of MACsec creates secure channel, generates keying material, and configures the P4 switches for each detected link between two P4 switches. It detects link changes and performs rekeying to provide a secure, configuration-free operation of MACsec. In this paper, we review the technological background of P4-MACsec and explain its architecture. To demonstrate the feasibility of P4-MACsec, we implement it on the BMv2 P4 software switch and validate the prototype through experiments. We evaluate its performance through experiments that focus on TCP throughput and round-trip time. We publish the prototype and experiment setups on Github.

Principles of Formation of a Vehicle’s Remote Diagnostics

Complex of remote diagnostics and control of an automobile’s nodes enables to remotely control the state of vehicle’s nodes and diagnose malfunctions; control ecological norms and compliance with traffic regulations. Its implementation will allow diagnostics of intermittent malfunctions due to application of the proposed methods of remote diagnostics of an automobile’s nodes as well as to reduce terms of diagnostics significantly due to application of intellectual system of malfunctions detection and due to possibility to control parameters in real time mode. Implementation of the complex will cut unforeseen idle time of vehicles due to preventive control of the tendencies in nodes parameters changes, and due to executing modern repair or replacement of nodes and units. The complex grants safe local and remote access to data and reports by using WebPortal and VPN technologies with possibility to appoint personal right to every user. Due to application of the elaborated methods and the complex that implements it, one can achieve high rate of economic efficiency due to collection of statistic information under conditions of actual exploitation, diagnostics of emerging malfunctions of various difficulty degrees, and making necessary corrections in the structure of an automobile’s nodes prior to serial production launch.

Anonymity communication VPN and Tor: a comparative study

VPN and Tor is a technology based on anonymity communication. These two technologies have their advantage and disadvantage. The objective of this paper is to find the difference between VPN and Tor technologies by comparing their security of communication on the public network based on the CIA triad concept. The comparative study in this paper is based on the survey method. At last, the result of this paper is a recommendation on when to use a VPN and Tor to secure communication

VISUAL TEACHING TECHNOLOGY IN IT SYSTEMS FOR THE “MILLENNIAL GENERATION”

This publication presents the ongoing development of visual teaching technology in IT systems, which can be used for e-learning for the “Millennial Generation”. The analysis of different models of teaching making use of visual messages, leads to the conclusion that systems more advanced in VPN technologies possess substantial educational qualities. These systems include TightVPN, UltraVNC, OpenVPN, RealVNC or Radmin and ComodoUNITE as well as TeamViewer.

Virtual private network technologies in real-time geophysical data collection systems

Some results of designing a system for online collection of data from terrestrial recorders of global satellite navigation systems are presented. The specific features of applying VPN technologies in geophysical data collection systems in real-time mode are discussed. Two of the most popular software VPN implementations are analyzed for comparison: SSTP, available for Microsoft Windows, and the free OpenVPN package. It is shown that both variants have commensurable performance. In unstable channels with low throughput, SSTP ensures a higher capacity, and OpenVPN is more stable and better resistant to discontinuous decreases in throughput.

Design and Implementation of a Control System for Sludge Dehydration Based on S7-1200 PLC

The sludge dehydration plays a very important role in the modern sewage treatment process. In this paper the process of the sludge dehydration and the design of the control system are introduced, in which the control system consists of process control layer and remote access layer. Process control layer is realized using Siemens S7-1200 PLC and a wireless route is added for remote accessing which utilizes Ethernet and VPN technologies. The functions of the system are described, and the key points of design and implementation methods are presented. The application of this system shows that the cost of sludge treatment is reduced and the reliability of equipment is improved.

Network-based virtual personal overlay networks using programmable virtual routers

This article explores the use and adaptation of well established VPN technologies to dynamically network at run time devices and services in personal networks. Virtual personal overlay networks are envisaged as an extension of the basic VPN concept to network PN nodes in a secure manner. User managed and provider provisioned-based overlays are analyzed in terms of scalability, management complexity, and security to select the most appropriate VPON deployment and management framework. The dynamic nature of PNs calls for highly flexible self-configuring and self-adaptive VPON architectures. Programmable edge routers and dynamic tunneling mechanisms can be combined to meet the requirements set by PNs. The virtual router model is used in the provider edge to ease the dynamic deployment and management of VPONs. Results of an implementation and a performance evaluation of the VR concept based on open software routers are reported.

다중 VPN 환경에서의 분산 Perimeter defence 모델에 관한 연구

본 논문에서는 다중 VPN을 수용하는 대규모 네트워크에서 인터넷 액세스를 지원할 때, 보안 정책에 따라 신뢰구역(Trust zone)의 불확실한 경계설정으로 발생할 수 있는 보안 문제를 해결하기 위한 적응방안을 제시하였다. 관련연구로 기존 적용모델과 다중 VPN 네트워크에서의 보안 위협을 분석하고, 외부 네트워크로부터의 보호를 위해 신뢰구역 분리와 분산 정책 적용을 고려한 시뮬레이션을 수행하였다. 시뮬레이션을 통해 다중 VPN 수용과 인터넷 액세스에 의한 신뢰구간의 불확실한 경계는 신뢰되지 않은 경계로부터의 분산 계층적인 Perimeter defence 정책 적용을 통해서 개별 VPN간의 신뢰구간을 축소할 수 있었고, 하위 개별 사이트로부터의 적용보다 정책 적용횟수가 줄어 전송 지연에 영향을 줄일 수 있었다. This paper analyzed the proper methods to solve the security problems of establishing trust zone which is changed by security policy in large scale networks containing multiple VPNs. Therefore, we surveyed the vulnerability of VPN technologies, it analyzed various models suitable for trust zone. By simulations of various models, we Propose the cascade perimeter defence policy model having the neit as such an efficient transit cost and the strictly isolation for trust tone. This model can protect the trust zone from the public network by dividing the trust Tone according to each VPN group and it shows the better transit performance by cascading the position of perimeter defence policy.