Abstract

Virtual private networks (VPN) have been used within and between many organizations for some time now. When the term VPN is used, many people immediately think of an IPsec siteto-site or remote-access VPN providing private connectivity between or into organizations. Although both of these methods are valid types of VPN connectivity, there are also many other technologies that because of their use and function can be characterized as a VPN type or method, including the following: Virtual local area networks (VLAN) are common VPN type that achieve the privacy and segmentation of networks by means of a tag or encapsulation method applied to network data. Multiprotocol Label Switching (MPLS) VPNs operate by appending multiple labels to a data packet to provide private connectivity throughout or between networks across a WAN. Generic routing encryption (GRE) or IP-in-IP tunneling methods create a private connection between devices by appending header information to an assembled packet for the information of a point-to-point tunnel. Legacy VPN types that were commonly used to provide WAN connectivity between organizations (for example, X.25, Frame Relay, and ATM).

This list of VPN types above is not exhaustive, but it does give us a good idea about the various roles VPNs play. Put simply, VPNs provide private connectivity between devices operating over a shared infrastructure and can generally be categorized in two types: those that offer both privacy through various isolation methods (VLANs, MPLS VPNs), and those that offer both privacy and security (IPsec/Secure Socket Layer [SSL] VPNs). The security provided for VPNs is achieved by implementation of cryptographic protocols (for example, IPsec, SSL, and Transport Layer Security [TLS], to name a few). This project focuses on the VPN methods that both provide privacy and security between both remote sites and remote users and a central site. VPNs of this sort provide three 1 basic benefits: Authentication: This can be achieved through the use of usernames and passwords, preshared keys (PSK), one-time passwords (OTP) or tokens, public key infrastructure (PKI) and digital certificates, or a combination of these. The primary purpose of authentication is to make sure you are who you say you are. Confidentiality: Provided by encrypting user data before transmission through the established VPN tunnel with the aim of preventing any data that may be captured by any attacker. Integrity: Provides a mean to ensure data has not been tampered with along the path between the source and destination (for example, by an attacker attempting to perform a man-in-themiddle attack).

Although the process of encrypting (and therefore, hiding) data is often assumed with VPN operation, all functions just listed are optional and are carried out by a specific protocol.

Antireplay: The sending device can add sequence numbers to each packet sent through the VPN tunnel and thus allow the receiving end to determine whether, in an effort to overcome the security measures provided by the VPN, a packet has been duplicated.