HP Armada 110s Wireless Security - Page 18

to the Internet Engineering Task Force IETF for approval as a standard. Northern Telecom Inc.

Get HP Armada 110s - Notebook PC PDF manuals and user guides View all HP Armada 110s manuals
Add to My Manuals
Save this manual to your list of manuals

Page 18 highlights

Wireless Security White Paper 18 Several VPN protocols are available. They include the Point-to-Point Tunneling Protocol (PPTP) from Microsoft, the Layer Two Tunneling Protocol (L2TP), the Layer Two Forwarding protocol (L2F) from Cisco Systems, and the Internet Protocol Security protocol (IPSec). The PPTP protocol lets corporations extend their corporate network through private "tunnels" over the public Internet. In effect, the corporation converts a wide area network (the Internet) into a single large local area network. By making secure use of the public network, the corporation no longer has to lease its own lines for wide-area communication. This is the definition of a virtual private network. L2TP is an extension of PPTP that is used by an internet service provider (ISP) to enable VPNs over the Internet. L2TP merges the best features of PPTP and L2F. Its two main components are the L2TP Access Concentrator (LAC), a device that physically terminates a call, and the L2TP Network Server (LNS), a device that terminates and possibly authenticates the Point-to-Point Protocol (PPP) stream. L2F is a technology that, according to developer Cisco Systems, will enhance the ability of service providers to build Virtual Private Dial-Up Networks (VPDNs). Cisco has submitted L2F to the Internet Engineering Task Force (IETF) for approval as a standard. Northern Telecom Inc. and Shiva Corporation have announced their support for L2F. IPSec is a developing standard for security that operates at the network or packet-processing layer of network communication. By contrast, earlier security schemes inserted security at the application layer of the communications model. IPSec offers strong encryption, but degrades the performance of the computer it runs on because of the high CPU overhead associated with the encryption and decryption algorithms. The greater speeds of new generations of processors will reduce the toll that IPSec takes on machine performance. IPSec is especially well suited for implementing VPNs and for remote user access through dial-up connection to private networks. IPSec supports two encryption modes: Transport and Tunnel. Transport mode encrypts only the data portion (payload) of each packet, but leaves the header untouched. The more secure Tunnel mode encrypts both the header and the payload. On the receiving side, an IPSec-compliant device decrypts each packet. With IPSec, the sending and receiving devices share a secret key, also known as a symmetric key. These keys can be exchanged via public key cryptography. This exchange takes place through a protocol known as Internet Security Association and Key Management Protocol/Oakley (ISAKMP/Oakley), (now also known as Internet Key Exchange - IKE), which allows the receiver to use public and private keys and authenticate the sender with digital certificates. IPSec also has the advantage that security arrangements can be handled without requiring changes to the computers of individual users. Cisco Systems has been prominent in proposing IPSec as a standard, and includes IPSec support in its network routers. VPN software is often never turned on. A further difficulty is that many mobile devices simply do not support VPNs at this time. Additionally, VPNs were not designed with wireless networks in mind, and are therefore more prone to failure due to unreliability and low bandwidth. Both the mobile device and the server must support a common VPN protocol. Frequently, the mobile device does not have VPN client software installed. If it does have such software, the device is still likely to be limited in the VPN protocols that it supports.

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
Wireless Security White Paper
18
Several VPN protocols are available. They include the Point-to-Point Tunneling Protocol (PPTP)
from Microsoft, the Layer Two Tunneling Protocol (L2TP), the Layer Two Forwarding protocol
(L2F) from Cisco Systems, and the Internet Protocol Security protocol (IPSec).
The PPTP protocol lets corporations extend their corporate network through private "tunnels"
over the public Internet. In effect, the corporation converts a wide area network (the Internet) into
a single large local area network. By making secure use of the public network, the corporation no
longer has to lease its own lines for wide-area communication. This is the definition of a virtual
private network.
L2TP is an extension of PPTP that is used by an internet service provider (ISP) to enable VPNs
over the Internet. L2TP merges the best features of PPTP and L2F. Its two main components are
the L2TP Access Concentrator (LAC), a device that physically terminates a call, and the L2TP
Network Server (LNS), a device that terminates and possibly authenticates the Point-to-Point
Protocol (PPP) stream.
L2F is a technology that, according to developer Cisco Systems, will enhance the ability of
service providers to build Virtual Private Dial-Up Networks (VPDNs). Cisco has submitted L2F
to the Internet Engineering Task Force (IETF) for approval as a standard. Northern Telecom Inc.
and Shiva Corporation have announced their support for L2F.
IPSec is a developing standard for security that operates at the network or packet-processing layer
of network communication. By contrast, earlier security schemes inserted security at the
application layer of the communications model. IPSec offers strong encryption, but degrades the
performance of the computer it runs on because of the high CPU overhead associated with the
encryption and decryption algorithms. The greater speeds of new generations of processors will
reduce the toll that IPSec takes on machine performance.
IPSec is especially well suited for implementing VPNs and for remote user access through dial-up
connection to private networks. IPSec supports two encryption modes: Transport and Tunnel.
Transport mode encrypts only the data portion (payload) of each packet, but leaves the header
untouched. The more secure Tunnel mode encrypts both the header and the payload. On the
receiving side, an IPSec-compliant device decrypts each packet.
With IPSec, the sending and receiving devices share a secret key, also known as a symmetric key.
These keys can be exchanged via public key cryptography. This exchange takes place through a
protocol known as Internet Security Association and Key Management Protocol/Oakley
(ISAKMP/Oakley)
,
(now also known as
Internet Key Exchange – IKE),
which allows the
receiver to use public and private keys and authenticate the sender with digital certificates. IPSec
also has the advantage that security arrangements can be handled without requiring changes to the
computers of individual users. Cisco Systems has been prominent in proposing IPSec as a
standard, and includes IPSec support in its network routers.
VPN software is often never turned on. A further difficulty is that many mobile devices simply do
not support VPNs at this time. Additionally, VPNs were not designed with wireless networks in
mind, and are therefore more prone to failure due to unreliability and low bandwidth. Both the
mobile device and the server must support a common VPN protocol. Frequently, the mobile
device does not have VPN client software installed. If it does have such software, the device is
still likely to be limited in the VPN protocols that it supports.