Secure Socket Layer a.k.a SSL

SSL is one method of data encryption in a communication made by Netscape Communications Corporation. As described in the SSL Protocol Internet Draft (The SSL Protocol, Version 3.0 by ALAN O. Freier and Paul C. Kocher, can you open the http://home.netscape.com/eng/ssl3/ssl-toc.html.

SSL is a layered protocol. In each layers, consisting of a long data, descriptions and content. SSL retrieve data to be sent, broken into blocks of order, then compressed, if necessary, apply the MAC, encrypted, and the results delivered. At the destination, data is decrypted, verified, decompress, and reassembled. The result is sent to the client on it. (free translation).

SSL will encrypt only data that is sent via http. How SSL walking can be described as follows:

* At the time the connection started to walk, the client and server create and share a secret key, which is used to encrypt data to be communicated. Although the session between the client and the server diintip other parties, but the data seem difficult to read because it is encrypted.
* SSL support public key cryptography, so the server can authenticate with the method commonly known as RSA and Digital Signature Standard (DSS).
* SSL may verify the integrity of the current session by using a digest algorithm such as MD5 and SHA. This avoids a session hijacking.

Read More...

Remote Accees Servers a.k.a RAS

Remote Access Server (RAS) is the gateway used to access a server located in a particular domain name is positioned behind the RAS using public telephone network access Switch Telephone Network (PSTN).

Read More...

VPN over IPsec vs SSL

In years gone by if a remote office needed to connect with a central computer or network at company headquarters it meant installing dedicated leased lines between the locations. These dedicated leased lines provided relatively fast and secure communications between the sites, but they were very costly.

To accommodate mobile users companies would have to set up dedicated dial-in remote access servers (RAS). The RAS would have a modem, or many modems, and the company would have to have a phone line running to each modem. The mobile users could connect to the network this way, but the speed was painstakingly slow and made it difficult to do much productive work.

With the advent of the Internet much of that has changed. If a web of servers and network connections already exists, interconnecting computers around the globe, then why should a company spend money and create administrative headaches by implementing dedicated leased lines and dial-in modem banks. Why not just use the Internet?

Well, the first challenge is that you need to be able to choose who gets to see what information. If you simply open up the whole network to the Internet it would be virtually impossible to implement an effective means of keeping unauthorized users from gaining access to the corporate network. Companies spend tons of money to build firewalls and other network security measures aimed specifically at ensuring that nobody from the public Internet can get into the internal network.

How do you reconcile wanting to block the public Internet from accessing the internal network with wanting your remote users to utilize the public Internet as a means of connecting to the internal network? You implement a Virtual Private Network (VPN). A VPN creates a virtual “tunnel” connecting the two endpoints. The traffic within the VPN tunnel is encrypted so that other users of the public Internet can not readily view intercepted communications.

By implementing a VPN, a company can provide access to the internal private network to clients around the world at any location with access to the public Internet. It erases the administrative and financial headaches associated with a traditional leased line wide-area network (WAN) and allows remote and mobile users to be more productive. Best of all, if properly implemented, it does so without impacting the security and integrity of the computer systems and data on the private company network.

Traditional VPN’s rely on IPSec (Internet Protocol Security) to tunnel between the two endpoints. IPSec works on the Network Layer of the OSI Model- securing all data that travels between the two endpoints without an association to any specific application. When connected on an IPSec VPN the client computer is “virtually” a full member of the corporate network- able to see and potentially access the entire network.

The majority of IPSec VPN solutions require third-party hardware and / or software. In order to access an IPSec VPN, the workstation or device in question must have an IPSec client software application installed. This is both a pro and a con.

The pro is that it provides an extra layer of security if the client machine is required not only to be running the right VPN client software to connect to your IPSec VPN, but also must have it properly configured. These are additional hurdles that an unauthorized user would have to get over before gaining access to your network.

The con is that it can be a financial burden to maintain the licenses for the client software and a nightmare for tech support to install and configure the client software on all remote machines- especially if they can’t be on site physically to configure the software themselves.

It is this con which is generally touted as one of the largest pros for the rival SSL (Secure Sockets Layer) VPN solutions. SSL is a common protocol and most web browsers have SSL capabilities built in. Therefore almost every computer in the world is already equipped with the necessary “client software” to connect to an SSL VPN.

Another pro of SSL VPN’s is that they allow more precise access control. First of all they provide tunnels to specific applications rather than to the entire corporate LAN. So, users on SSL VPN connections can only access the applications that they are configured to access rather than the whole network. Second, it is easier to provide different access rights to different users and have more granular control over user access.

A con of SSL VPN’s though is that you are accessing the application(s) through a web browser which means that they really only work for web-based applications. It is possible to web-enable other applications so that they can be accessed through SSL VPN’s, however doing so adds to the complexity of the solution and eliminates some of the pros.

Having direct access only to the web-enabled SSL applications also means that users don’t have access to network resources such as printers or centralized storage and are unable to use the VPN for file sharing or file backups.

SSL VPN’s have been gaining in prevalence and popularity; however they are not the right solution for every instance. Likewise, IPSec VPN’s are not suited for every instance either. Vendors are continuing to develop ways to expand the functionality of the SSL VPN and it is a technology that you should watch closely if you are in the market for a secure remote networking solution. For now, it is important to carefully consider the needs of your remote users and weigh the pros and cons of each solution to determine what works best for you.

source: about.com

Read More...

IPSec

Rapid growth of the Internet makes everyone in the world can communicate with each other easily and quickly. At first the security is not the purpose of the design TCP / IP. Only after the year 1995 where the Internet becomes public consumption and trade traffic through the Internet people began to realize the importance of the Internet network security. For Internet users who require privacy in communicating course there are the problems that arise in everyday situations, such as a company that will send important documents to branch offices via inter net requires a situation where the safe path through the observation of the other party, modification package data by other parties or spoofing.

One solution of the problems above is to use IPSEC.
IPSEC is a standard created by the Internet Engineering Task Force (IETF) that allows for secure data transmission in data communication lines that are not protected like the Internet safely.

IPSEC works at the network layer, protecting and mengotentifikasi IP packet communication between the host and works well on IPv6 and IPv4 traffic.
IPSEC is actually a feature that is owned by IPv6 but by some developers applied to the IPv4.
IPSEC has 4 fruit elements, namely:

1. AH (authentication header)
2. ESP (encasulapting security payload)
3. IPcomp (IP payload compression)
4. IKE (Internet key exchange)

In general, IPSEC services provided are:
1. Confidentiality of data, the data sender can encrypt data packet prior to transmit data.
2. Data Integrity, the recipient can authenticate packet sent by the sender to ensure that data is not plowed during transmission.
3. Data Origin Authentication, the recipient can autehenticate origin of IPSEC packet is sent.
4. Anti-Replay, the receiver can detect and reject packets that have been hijacked.

The end result of the final project courses EL-695 Information Systems Security This is a review mechanism of the workings of the IPSEC and the use of the Internet in this case the author will use a VPN (Virtual Private Network) as a case study.


keywords: vpn ip secs

Read More...

Virtual Private Network a.k.a VPN

Virtual Private Network (VPN) is a solution to a private connection over a public network. With a VPN, we can create a network within the network or so-called tunnel. VPN solutions have several kinds, such as:

• IPSEC, VPN solutions via IP Secure Protocol. Solutions that have been standardized, but the most difficult to configure. Security level is quite good but the implementation is complex. Applications that use open source based on the Open / Free Swan.
• PPPT, early versions of VPN solutions. VPN solution with standard features built a network where the point to point like you do on the internet dial up at home. At the time of dial up internet service provider there will be built Point to point tunnel through the telephone network. OpenSource applications that use PPPT is PopTop.
• VPN with SSL, a VPN solution by applying the protocol Secure Socket Layer (SSL) encryption tunnel network built. This solution begins with OpenVPN application.

The advantages of VPN are:

• Connecting branch offices through public networks. With the company's VPN does not need to build their own networks. Simply connect to the Internet for example public networks. At present almost all the company's office must have Internet access. With a budget could save demikin connections to the branches.
• Mobile working, with a VPN so the employee can be connected directly with a private office network. Then the employee can perform the job can be done from the front of the computer without having to be in the office. This is a virtual office solution in the days of high mobility today.
• Securing your network. However, this solution is less secure. Because to connect does not require authentication. So that if users know the company's VPN settings so he can connect to corporate networks, but must login. Examples of VPN telkomsel only by changing the name of APN in network settings so he can be directly connected to the network with the APN name. By installing the VPN again in semi-public VPN networks are the network will be safer because before entering into the office network users must create a tunnel once the VPN and login to the new server can be connected with the office network.
• Mengamankan jaringan wireless. Jaringan wireless merupakan jaringan publik yang bisa diakses oleh siapa saja yang berada dijangkauan wireless tersebut. Walaupun wireless juga memiliki pengaman seperti WEP, WPA, WPA2 namun jaringan wireless masih saja bisa ditembus. Dengan menggunakan VPN maka user yang terhubung ke wireless harus membuat tunnel dulu dengan login ke VPN server baru bisa menggunakan resource jaringan seperti akses internet dan sebagainya.

Dari beberapa solusi yang ada saat ini yang paling banyak digunakan adalah solusi VPN dengan SSL yaitu dengan OpenVPN sebagai aplikasinya. Selain gratis karena open source juga memiliki kemudahan implementasi. Saya lebih memilih menggunakan OpenVPN karena kemudahan implementasinya serta bersifat multiplatform dapat dijalankan pada Linux ataupun Windows.

keywords: vpn solutions, what is vpn, vpn is, about vpn

Read More...