IP security (IPSec)

IP Sec (Internet Protocol Security) is an Internet Engineering Task Force (IETF) standard suite of protocols between two communication points across the IP network that provide data authentication, integrity, and confidentiality. It also defines the encrypted, decrypted, and authenticated packets. The protocols needed for secure key exchange and key management are defined in it.

What is IP Security?

IPSec refers to a collection of communication rules or protocols used to establish secure network connections. Internet Protocol (IP) is the common standard that controls how data is transmitted across the internet. IPSec enhances the protocol’s security by introducing encryption and authentication. For example, it encrypts data at the source and then decrypts it at the destination. It also verifies the source of the data.

Uses of IP Security

IPsec can be used to do the following things:

• To encrypt application layer data.
• To provide security for routers sending routing data across the public internet.
• To provide authentication without encryption, like to authenticate that the data originates from a known sender.
• To protect network data by setting up circuits using IPsec tunneling in which all data being sent between the two endpoints is encrypted, as with a Virtual Private Network(VPN) connection.

What is IPSec Encyrption?

IPSec encryption is a software function that encrypts data to protect it from unauthorized access. An encryption key encrypts data, which must be decrypted. IPSec supports a variety of encryption algorithms, including AES, Blowfish, Triple DES, ChaCha, and DES-CBC. IPSec combines asymmetric and symmetric encryption to provide both speed and security during data transmission. In asymmetric encryption, the encryption key is made public, while the decryption key remains private. Symmetric encryption employs the same public key to encrypt and decrypts data. IPSec builds a secure connection using asymmetric encryption and then switches to symmetric encryption to speed up data transmission.

Components of IP Security

It has the following components:

• Encapsulating Security Payload (ESP)
• Authentication Header (AH)
• Internet Key Exchange (IKE)

1. Encapsulating Security Payload (ESP): It provides data integrity, encryption, authentication, and anti-replay. It also provides authentication for payload.

2. Authentication Header (AH): It also provides data integrity, authentication, and anti-replay and it does not provide encryption. The anti-replay protection protects against the unauthorized transmission of packets. It does not protect data confidentiality.

IP Header

3. Internet Key Exchange (IKE): It is a network security protocol designed to dynamically exchange encryption keys and find a way over Security Association (SA) between 2 devices. The Security Association (SA) establishes shared security attributes between 2 network entities to support secure communication. The Key Management Protocol (ISAKMP) and Internet Security Association provides a framework for authentication and key exchange. ISAKMP tells how the setup of the Security Associations (SAs) and how direct connections between two hosts are using IPsec. Internet Key Exchange (IKE) provides message content protection and also an open frame for implementing standard algorithms such as SHA and MD5. The algorithm’s IP sec users produce a unique identifier for each packet. This identifier then allows a device to determine whether a packet has been correct or not. Packets that are not authorized are discarded and not given to the receiver. 

Packets in Internet Protocol

IP Security Architecture

IPSec (IP Security) architecture uses two protocols to secure the traffic or data flow. These protocols are ESP (Encapsulation Security Payload) and AH (Authentication Header). IPSec Architecture includes protocols, algorithms, DOI, and Key Management. All these components are very important in order to provide the three main services:

• Confidentiality
• Authenticity
• Integrity

IP Security Architecture

Working on IP Security

• The host checks if the packet should be transmitted using IPsec or not. This packet traffic triggers the security policy for itself. This is done when the system sending the packet applies appropriate encryption. The incoming packets are also checked by the host that they are encrypted properly or not.
• Then IKE Phase 1 starts in which the 2 hosts( using IPsec ) authenticate themselves to each other to start a secure channel. It has 2 modes. The Main mode provides greater security and the Aggressive mode which enables the host to establish an IPsec circuit more quickly.
• The channel created in the last step is then used to securely negotiate the way the IP circuit will encrypt data across the IP circuit.
• Now, the IKE Phase 2 is conducted over the secure channel in which the two hosts negotiate the type of cryptographic algorithms to use on the session and agree on secret keying material to be used with those algorithms.
• Then the data is exchanged across the newly created IPsec encrypted tunnel. These packets are encrypted and decrypted by the hosts using IPsec SAs.
• When the communication between the hosts is completed or the session times out then the IPsec tunnel is terminated by discarding the keys by both hosts.

What are IPSec modes?

• Tunnel: The IPSec tunnel mode is appropriate for sending data over public networks because it improves data security against unauthorised parties. The computer encrypts all data, including the payload and header, and adds a new header to it.
• Transport: IPSec transport mode encrypts only the data packet’s payload while leaving the IP header unchanged. The unencrypted packet header enables routers to determine the destination address of each data packet. As a result, IPSec transport is utilized in a closed and trusted network, such as to secure a direct link between two computers.

Features of IPSec

• Authentication: IPSec provides authentication of IP packets using digital signatures or shared secrets. This helps ensure that the packets are not tampered with or forged.
• Confidentiality: IPSec provides confidentiality by encrypting IP packets, preventing eavesdropping on the network traffic.
• Integrity: IPSec provides integrity by ensuring that IP packets have not been modified or corrupted during transmission.
• Key management: IPSec provides key management services, including key exchange and key revocation, to ensure that cryptographic keys are securely managed.
• Tunneling: IPSec supports tunneling, allowing IP packets to be encapsulated within another protocol, such as GRE (Generic Routing Encapsulation) or L2TP (Layer 2 Tunneling Protocol).
• Flexibility: IPSec can be configured to provide security for a wide range of network topologies, including point-to-point, site-to-site, and remote access connections.
• Interoperability: IPSec is an open standard protocol, which means that it is supported by a wide range of vendors and can be used in heterogeneous environments.

What is IPSec VPN?

VPN, or virtual private network, is a networking software that enables users to browse the internet anonymously and securely. An IPSec VPN is a type of VPN software that uses the IPSec protocol to establish encrypted tunnels over the internet. It offers end-to-end encryption, which means that data is broken down at the computer and then collected at the receiving server.

Advantages of IPSec

• Strong security: IPSec provides strong cryptographic security services that help protect sensitive data and ensure network privacy and integrity.
• Wide compatibility: IPSec is an open standard protocol that is widely supported by vendors and can be used in heterogeneous environments.
• Flexibility: IPSec can be configured to provide security for a wide range of network topologies, including point-to-point, site-to-site, and remote access connections.
• Scalability: IPSec can be used to secure large-scale networks and can be scaled up or down as needed.
• Improved network performance: IPSec can help improve network performance by reducing network congestion and improving network efficiency.

Disadvantages of IPSec

• Configuration complexity: IPSec can be complex to configure and requires specialized knowledge and skills.
• Compatibility issues: IPSec can have compatibility issues with some network devices and applications, which can lead to interoperability problems.
• Performance impact: IPSec can impact network performance due to the overhead of encryption and decryption of IP packets.
• Key management: IPSec requires effective key management to ensure the security of the cryptographic keys used for encryption and authentication.
• Limited protection: IPSec only provides protection for IP traffic, and other protocols such as ICMP, DNS, and routing protocols may still be vulnerable to attacks.

Conclusion

IPSec (Internet Protocol Security) is an essential set of protocols that ensures secure IP communications via data authentication, integrity, and confidentiality. It works with both IPv4 and IPv6, encrypting data at the source and decrypting it at the destination. IPSec, which is widely used to secure application data, routing information, and VPN connections, provides robust security, interoperability, and scalability. Despite its benefits, IPSec can be difficult to configure and may have an impact on network performance. Understanding the IPSec components and encryption methods is critical for efficiently protecting network connections.

Frequently Asked Questions on IPSec – FAQs

What port does IPsec use?

IPsec usually uses port 500.

Is IPsec TCP or UDP?

IPSec is UDP.

Is IPSec IPv4 or IPv6?

IPSec is compatible with both IPv4 and IPv6.

What layer is IPSec?

IPsec is a layer 3 OSI model that provides end-to-end security at the internet layer.