Principles Digital Communication System & Computer Networks (Charles River Media Computer Engineering)

24.6 VIRTUAL PRIVATE NETWORKS

If an organization has many offices, these offices are connected through a private network wherein the organization builds its own infrastructure for wide area networking. For example, if an organization has offices spread throughout the country, it can develop its own corporate network, perhaps using VSATs with a hub at the corporate headquarters. Such a network provides the necessary security and is fully within the administrative control of the organization. Since it is a dedicated network, the network can be optimized for the requirements of the organization. However, this approach has many disadvantages, which are as follows:

• High installation and maintenance costs: The cost of training the employees and having a dedicated workforce, particularly when the core business of the organization is not communications, is enormous. For instance, a pharmaceutical company does not like to keep a large workforce to maintain its communication network—their business is pharmaceuticals, not computer networks!

• Lack of flexibility and scalability: When new sites have to be added (when a new branch is opened) or when a new customer is to be provided access to the organization's information, additional network equipment has to be installed. Also, the operational costs go up.

• The recurring communication costs will be high as the organization has to pay for the communication facilities on a monthly or yearly basis.

A virtual private network (VPN) is a network of corporate sites using the existing infrastructure of the Internet. VPN provides a cost-effective solution as compared to having a dedicated corporate network.

With the Internet having spread itself globally, an alternative approach to interconnecting corporate sites is through virtual private networks (VPNs). A VPN can be defined as a network of corporate sites using the open, distributed infrastructure of the Internet. The VPN has many advantages:

• It is economical because the Internet's existing infrastructure will be used. The organization need not invest in costly communication equipment. In addition, the recurring expenditure also will be less—the expenditure will be based on the usage.

• Minimal training costs: there is no need for special training for users, because the Internet tools will be extensively used, and users are already familiar with the technology.

• Increased flexibility and scalability: expansion of the network or reconfiguration of the sites will be easier.

• Minimal maintenance costs: there is no need for a dedicated team of professionals for maintenance of the network because the Internet service provider will take care of maintenance issues.

• Value added service provisioning: employees, suppliers, and customers can be provided with access to the intranet/extranet resources very easily. Mobility can be supported very easily—an employee on the move can always be in touch with the corporate office.

• On-demand bandwidth: as the communication requirements vary from time to time, the ISP can provide on-demand bandwidth, so there is no need to decide on the capacities of the communication system at the beginning.

However, the TCP/IP architecture does not take care of two important issues: security and performance. In VPNs, these two issues need to be addressed to provide a communication facility that is comparable to that of a dedicated network, but with additional functionality and flexibility. Lots of work is presently being carried out on performance issues. For providing security, a number of protocols have been defined, which are discussed in the next section.

The advantages of a virtual private network are low infrastructure costs, flexibility, expandability at low incremental cost, low maintenance cost, and availability of on-demand bandwidth.

24.6.1 VPN Security Requirements

To provide secure communications in a VPN, the following are the requirements:

• Authentication: to ensure that the originator of data is genuine.

• Access control: to restrict unauthorized entry to access the network.

• Confidentiality: to ensure that data is received by the intended recipient only.

• Data integrity: to ensure that the data is not tampered/modified while it is traveling on the public Internet.

For authentication and access control, a number of mechanisms are available, such as password-based systems, Challenge Handshake Authentication Protocol (CHAP), Remote Authentication Dial-in User Service (RADIUS), and digital certificates. Encryption is used to achieve confidentiality.

Authentication, access control, confidentiality, and data integrity are the main issues related to security in virtual private networks. Security products need to implement these features.

24.6.2 VPN Architecture and Protocols

A simplified VPN architecture is shown in Figure 24.4. Each corporate LAN will be connected to the ISP's point of presence (PoP). In VPN, permanent links are not maintained between two end points—the links are created dynamically based on the requirement. When leased lines are used to interconnect sites, these connections are dedicated to the traffic from a single corporate customer; this is called tunneling. To extend the concept of tunneling to the Internet-based VPN, protocols are defined to create tunnels. Tunneling allows senders to encapsulate their data in the IP packets that hide the underlying routing and switching infrastructure of the Internet. These packets can be encrypted to achieve end-to-end confidentiality. The concept of tunneling is illustrated in Figure 24.5. Even though network A and network B are interconnected through a large internet, a virtual link is created between the two routers.

Figure 24.4: Virtual private network.

Figure 24.5: Tunneling.

If a host on network A wants to send data to a host on network B, the host will send each packet (containing the destination address of the host on network B) to router P. Router P will create an IP datagram that will have the source address P and destination address Q, and the data portion will be the packet sent by the host on network A. This IP datagram will reach router Q in the normal fashion. Router Q will take out the encapsulated packet, obtain the destination address of the host on network B, and then forward it to the host. This encapsulation of the IP datagram is equivalent to creating a tunnel between router P and router Q.

To provide security in a VPN, IP Security (IPSec) protocol is used extensively.

IPSecurity (IPSec): IPSec is a layer 3 protocol. IPSec is the outcome of work on IPv6, but it can be used on IPv4 as well. It allows the sender (a client or a router) to authenticate and/or encrypt each IP packet. IPSec can be used in two modes.

IPSec is a layer 3 protocol used in VPNs to provide security. IPSec works in two modes: transport mode and tunnel mode. In transport mode, only the transport layer segment is encrypted. In tunnel mode, the entire IP packet including header is encrypted.

Transport mode: In this mode, only the transport layer segment of the IP packet is encrypted.

Tunnel mode: In this mode, the entire IP packet including the header is encrypted. Hence, this mode gives better protection because the source and destination addresses can be decoded only when the encryption key is available.

IPSec is considered the best protocol for VPN implementation because it provides a complete solution for providing the required security. IPSec is based on standard encryption mechanisms such as:

• Data Encryption Standard (DES) for encryption.

• Digital certificates for validating public keys.

• Key exchange using both manual and the Internet Key Exchange (IKE) automatic method.

However, at this time security remains a major issue for VPNs; commercial security products are very costly. Standards are evolving for various aspects of security and, in the future VPNs will provide the most cost-effective means of corporate networking.

Summary

The wired Internet, within a span of about 30 years, has become an excellent platform for a wide variety of services such as e-mail, file transfer, remote login, and the World Wide Web. Interesting applications such as audio/video broadcasting, audio/video conferencing, Web-based learning, and e-commerce are being supported, which makes the Internet a global marketplace and a global learning center. Though the present mechanism of accessing the Internet through dial-up or leased lines limits the access speed, with the availability of very high speed digital subscriber lines (VDSL), speeds up to nearly 50Mbps can be achieved in due course.

Major corporations can now use the Internet infrastructure to build virtual private networks (VPNs), which result in major cost savings. However, security is a major issue to be tackled for VPNs to become widespread.

References

• M.D. Nava and C. Del-Toso. "A Short Overview of the VDSL System Requirements". IEEE Communications Magazine, Vol. 40, No. 12, December 2002.

• http://www.techonline.com Web site for online learning on hardware-oriented topics.

• http://www.webCT.com Portal for e-learning.

• http://www.w3.org Web site of the World Wide Web Consortium.

Questions

1. Explain the architecture of the public Internet.

2. Explain the Domain Name System.

3. What are the advantages of a virtual private network? How is the security aspect addressed in VPNs?

4. Explain the concept of tunneling.

5. List the various services and applications supported by the Internet.

Exercises

Answers

Projects

1. Develop an intranet for your department/organization. Any authorized user of the LAN should be able to access the information provided on the intranet. The user has to log in to the intranet and access a home page. The home page should contain the links for a syllabus, examination schedules, information about the professors, information about the project, works done by earlier batch students, and so on.

2. Develop an e-learning portal. The portal should contain the lecture material, study material for a few topics (such as compiler design and database management system) and also an online examination using objective (multiple choice) tests.

3. Prepare a technical report on the various digital subscriber line technologies.