Vpn & Ipsec

Front 1

VPN

Back 1

Virtual Private Network. Allows secure communication between private LAN and remote hosts over an unsecured public network connection. Using the VPN, security parameters can be applied to certain types of remote communications without affecting other aspects of the network.

Front 2

Authentication

Back 2

The receiving VPN host or device can verify the source of the data; the sender is, in fact, who she says she is.

Front 3

Integrity

Back 3

The receiving VPN host or device can ensure that the data was not altered during transit.

Front 4

Generic Routing Encapsulation (GRE)
[Cisco proprietary]

Back 4

Enables a Cisco router to encapsulate a packet in an IP header. The remote router removes this header when the packet is received

Front 5

Data Confidentiality

Back 5

Because data is encrypted by one endpoint device, then is decrypted by the other endpoint device, data is seen in an unencrypted format only by those devices that should be able to do so.

Front 6

Anti-replay protection

Back 6

Protection from data, originally sent from an authorized device, being copied and retransmitted by an attacking device. With this type of attack, the attacker successfully copies the identity of the authorized device.

Front 7

Data Encryption Standard (DES)

Back 7

uses a 56 bit key to encrypt data. These keys have been know to be broken within 24hrs; sometimes as quickly as ten minutes!

Front 8

Triple Data Encryption Standard (TDES) (Also 3DES)

Back 8

Uses three 56 bit keys (168 bit total). 112 bit encryption is considered efficient. Uses symmetric encryption

Front 9

Advanced Encryption Standard (AES)

Back 9

AES can run on any Cisco router that has IPSec DES/3DES capability.

Front 10

Symmetric Encryption (secret key encryption)

Back 10

An algorithm which uses the same key to encrypt and decrypt data. Includes stream algorithms, where one bit/byte is encrypted/decrypted at a time; and block algorithms, where blocks (usually 64 bits) are encrypted/decrypted as a whole. The drawback is that using the same encryption key at both endpoints doubles the risk exposure.

Front 11

Asymmetric encryption

Back 11

Utilizes two keys for both sender and receiver. The public key encryption scheme involves a public and private key for each user. Prior to the encryption process, the public key is certified by a third party called a Certificate Authority (CA). The CA verifies both the identity of the user and the user's public key. The certificate is a combination of the user's public key and the CA's private root key.

Front 12

Diffie-Hellman (exponential key exchange)

Back 12

An algorithm that allows VPNs to comply with the IPSec requirement for dynamic key exchange

Front 13

Dynamic key exchange

Back 13

Encryption key is exchanged between endpoints over the communications channel in lieu of the keys being manually configured on each device by an administrator.

Front 14

IPSec

Back 14

Protocol suite for securing Internet Protocol communication by authenticating and encrypting each IP packet of a communication session. An end-to-end security scheme that operates at the Internet Layer of the TCP/IP model. Uses three protocols: Authentication Header (AH), Encapsulating Security Payload (ESP), and Security Associations (SA) (to which Internet Key Exchange [IKE] applies)

Front 15

Authentication Header (AH)

Back 15

Defined in RFC 2402, provides data origin authentication, integrity, and optional anti-replay protection. AH will successfully protect the IP packet's payload; but it cannot provided data confidentiality since some of the fields in the IP header are mutable during transmission (and therefore unpredictable). Less processor intensive than ESP, and may suffice when data confidentiality is not needed.

Front 16

Encapsulating Security Payload (ESP)

Back 16

Using a header and a trailer to encapsulate data, this protocol provides data origin authentication, anti-replay protection, and data confidentiality. ESP is more demanding of processor resources, and requires strong cryptography; which isn't available and/or allowed everywhere.

Front 17

IPSec Tunnel Mode

Back 17

The entire IPSec process is transparent to end hosts; specialized IPSec gateway devices handle the IPScec workload. The entire IP packet is encrypted; then this encrypted packet is placed in yet another IP packet (this is the general definition of tunneling -- packet encapsulation).

Front 18

IPSec Transport Mode

Back 18

End hosts perform the encapsulation. No new IP header is attached when transport mode is used.