Gesicherte Kommunikation ueber offene und ungesicherte Netze, sichere Einbindung mobiler Clients in eigene Netze, end-to-end Verschluesselung im IP-Datenverkehr.

Dagens företag vill ge anställda möjlighet att jobba hemifrån eller på resande fot. En vanlig lösning för att möjliggöra detta är virtual private network (VPN). VPN ger en användare tillgång till interna resurser på företaget från ett externt nät, exempelvis via Internet. Detta gör att användare kan komma åt de interna resurserna på ett säkert sätt. Vilken VPN-teknik är då att föredra för att få en så snabb, säker och pålitlig anslutning som möjligt? Detta examensarbete tar upp olika VPN-tekniker. Vi beskriver vanliga VPN-protokoll som L2TP, IPSec och PPTP. Hur användare autentiseras på ett säkert och smidigt sätt samt metoder att göra sin VPN-anslutning säker. Vi redovisar också den lösning vi har implementerat hos Confidence, för vilka arbetet utfördes. Problemen med att använda de produkter som redan fanns på företaget beskrivs. Förslag på lösningar ges för att lösa dessa problem i framtida arbeten. / Companies of today want to give their employees the opportunity to work from home or while they travel. A common solution to accomplish this is to implement a VPN over top of the existing network. Using VPN gives the employees access to the company’s local area network from outside, via the internet. The VPN provides a secure channel for these employees to connect to the local services attached to the company’s network that they need to reach. Which VPN technology is most suitable to deliver a secure, fast, and reliable connection to theses employees? In this thesis examines we are taking a closer look at different VPN solutions. We describe different VPN-protocols like L2TP, IPSec and PPTP. How to authenticate users in a secure and flexible way and also methods used to make the VPN-connection secure. Lastly we will show the solution we have implemented at the company Confidence, for whom we made the solution. The difficulties in using existing products with the company’s infrastructure are described. Suggestions are offered for future work to address these problems.

IP security (IPsec) is commonly used for protection in Virtual Private Networks (VPN). It is also used for the protection of traffic between nodes in third generation (3G) mobile networks. The main duty of telecommunication operators is to assure the quality of service and availability of the network for their users. Therefore knowledge of threats that could affect these requirements is of relevance. Denial of Service (DoS) and other attacks could constitute serious threats in 3G networks and, if successful, they could lead to financial and reputation damage for the telecommunication operator. One of the goals of each telecommunications vendor is to produce equipment and software in such a way as to reduce the risk of successful attacks upon networks built using their equipment and software. This master’s thesis aims to identify the classes of attacks that could affect the regular operation of an IPsec-protected network. Therefore, the IPsec protocol and its possible weaknesses are explained. As practical demonstration of these ideas, an Intrusion Detection Analyzer prototype for an Ericsson Ethernet Interface board was developed to detect anomalous IPsec-protected traffic. / IP security (IPsec) is commonly used for protection in Virtual Private Networks (VPN). It is also used for the protection of traffic between nodes in third generation (3G) mobile networks. The main duty of telecommunication operators is to assure the quality of service and availability of the network for their users. Therefore knowledge of threats that could affect these requirements is of relevance. Denial of Service (DoS) and other attacks could constitute serious threats in 3G networks and, if successful, they could lead to financial and reputation damage for the telecommunication operator. One of the goals of each telecommunications vendor is to produce equipment and software in such a way as to reduce the risk of successful attacks upon networks built using their equipment and software. This master’s thesis aims to identify the classes of attacks that could affect the regular operation of an IPsec-protected network. Therefore, the IPsec protocol and its possible weaknesses are explained. As practical demonstration of these ideas, an Intrusion Detection Analyzer prototype for an Ericsson Ethernet Interface board was developed to detect anomalous IPsec-protected traffic.

<p> </p><p>Syftet med denna undersökning är att ta reda på vilken mjukvarubaserad fjärranslutningslösning som passar för ett mindre företag, då de har mindre ekonomiska tillgångar än ett större företag behöver de vara mer noggranna med sina produktval. Arbetet är utfört med litteraturstudier och en enkätundersökning till ett tiotal mindre företag, samt en laborationsmiljö där tester av de olika fjärranslutningslösningarnas egenskaper har utförts.</p><p>Område valdes då ämnet fjärranslutning knappt behandlads under utbildningstiden, och fördjupar sig därför inom området.</p><p>Resultatet visar vad mindre företag anser vara de viktigaste egenskaperna med en fjärranslutningslösning. Även de värden som uppkom vid tester i laborationsmiljön kommer att presenteras i resultatet. De samlade resultaten kommer sedan visa på vilken mjukvarubaserad lösning som passar bäst för ett mindre företag.</p><p> </p> / <p><p>The purpose of this survey is to figure out which software based remote access solution that fits a smaller company, hence they have less economy assets than a larger company they need to be more thorough with their products of choice. The work is performed with literature studies and a survey of a dozen smaller companies, and also a laboratory environment where properties of the different remote access solutions are performed.</p><p>This area was chosen because the subject of remote access scarcely was treated during our education, and become engrossed in this area.</p><p>The result shows what the companies consider to be the most important properties with a remote access and also the products results from the tests. Also the values that occurred during testing in a laboratory environment will be presented in the results. The combined results will then show which software-based solution that is best suited for a small company.</p></p>

Syftet med denna undersökning är att ta reda på vilken mjukvarubaserad fjärranslutningslösning som passar för ett mindre företag, då de har mindre ekonomiska tillgångar än ett större företag behöver de vara mer noggranna med sina produktval. Arbetet är utfört med litteraturstudier och en enkätundersökning till ett tiotal mindre företag, samt en laborationsmiljö där tester av de olika fjärranslutningslösningarnas egenskaper har utförts. Område valdes då ämnet fjärranslutning knappt behandlads under utbildningstiden, och fördjupar sig därför inom området. Resultatet visar vad mindre företag anser vara de viktigaste egenskaperna med en fjärranslutningslösning. Även de värden som uppkom vid tester i laborationsmiljön kommer att presenteras i resultatet. De samlade resultaten kommer sedan visa på vilken mjukvarubaserad lösning som passar bäst för ett mindre företag. / The purpose of this survey is to figure out which software based remote access solution that fits a smaller company, hence they have less economy assets than a larger company they need to be more thorough with their products of choice. The work is performed with literature studies and a survey of a dozen smaller companies, and also a laboratory environment where properties of the different remote access solutions are performed. This area was chosen because the subject of remote access scarcely was treated during our education, and become engrossed in this area. The result shows what the companies consider to be the most important properties with a remote access and also the products results from the tests. Also the values that occurred during testing in a laboratory environment will be presented in the results. The combined results will then show which software-based solution that is best suited for a small company.

De nombreux mécanismes de sécurité ont été proposés pour les réseaux fixes et mobiles. Bien que ces mécanismes aient pu répondre à un ensemble d'exigences de sécurité, ils demeurent uniquement efficaces dans un contexte spécifique lié aux hypothèses et aux exigences restrictives qui ont été émises lors de la conception. Dans un premier temps, nous définissons une liste d'exigences en sécurité qui permet d'analyser les solutions de sécurité les plus déployées. Dans un second temps, nous proposons d'étendre le protocole SSL/TLS avec de nouveaux services. SSL/TLS est une solution de sécurité générique et transparente aux applications. Ainsi, il ne couvre pas les besoins spécifiques à certaines classes d'application telles que les applications de paiement sur Internet. Notre propositions d'intégrer le protocole d'échange des clés ISAKMP avec SSL/TLS permet de fournir, entre autres, la protection d'identité des utilisateurs et l'unification des associations de sécurité. Afin d'étendre l'utilisation de SSL/TLS vers les systèmes de paiement sur Internet, nous intégrons un module générique pour la génération d'une preuve de non répudiation dans le protocole SSL/TLS. Par ailleurs, toutes ces propositions restent, cernées par le problème d'interopérabilité avec les anciennes versions de chaque protocole. Ce qui rend la satisfaction de tous les besoins à travers un des protocoles existants irréalisables. Pour cela, nous proposons finalement de concevoir et de valider un nouveau protocole de sécurité qui intègre nativement l'évolution des protocoles de sécurité des échanges et des réseaux d'une manière performante. Nous avons appelé ce protocole SEP (Secure and Extensible Protocol)

<p>Nowadays, VoIP is getting more and more popular. It helps company to reduce cost, extends service to remote area, produce more service opportunities, etc. Besides these advantages, VoIP also put forward security problems.</p><p>In this paper, we introduce the popular protocols in VoIP and their security mechanisms, by introducing threats to VoIP, we point out the vulnerabilities with the security mechanisms of each VoIP protocol, and give recommendation for each VoIP protocol. In the conclusion part, we evaluate the vulnerabilities of each protocol, and point out in the future, with better protocol architecture, enhanced security policies, VoIP will has a brighter future.</p>

IP Multimedia Subsystem (IMS) is the next generation of telecommunication systems. The system is based on an IP network and uses technologies from the Internet. The IMS system is designed to evolve from a telephone system into a general information and communication system. It is meant to include television, Video on Demand (VoD), interactive services etc, etc. It is designed to simplify the implementation of newservices in telecom networks. This report investigates security aspects of VoD services when merging an IP Television (IPTV) system with IMS. The investigation covers security functions in IMS, transitionsolutions for authentication of the Set-Top-Box (STB) in IMS, and identifies problems inthe integration of IPTV and IMS. The report concludes that IMS has good solid Authentication, Authorization, and Accounting (AAA) functions that will provide security and billing functionality. One problemis found in the media control between the STB and the streaming server. This interface lacked specification at the time of investigation, and some problems have been identified. These problems have to be solved before a system can be brought into service and beregarded as secure.

Along with the computers networks emerges the possibility of managing remotely the intelligent organizations although the safe change of information has become a problem to the institutions which transport structured data through nets of computers. One of the largest challenges is the search for safe and economically viable solutions. Protocols of safety, cryptographic algorithms, safe means of communication are essential items so that the information can travel in environmentals free of external interferences. One of the alternatives is the Virtual Private Networks. In this work, the main prominences of this technology will be presented using the protocol IPSec with the purpose of presenting a more atractive tool to the organizations due to its safety and economical viability. / Com as redes de computadores, surge também a possibilidade de administrar remotamente as organizações inteligentes, no entanto a troca de informações segura tornou-se um problema para as instituições que trafegam dados estruturados através das redes de computadores. Um dos maiores desafios é a busca de soluções economicamente viáveis e ao mesmo tempo seguras. Protocolos de segurança, algoritmos criptográficos meios de comunicação seguros, são itens essenciais para que a informação possa trafegar em ambientes livres de interferências externas. Uma das soluções é a Rede Virtual Privada. Neste trabalho, serão apresentados os principais destaques desta tecnologia, utilizando o protocolo IPSec, com o propósito de apresentar mais uma solução atrativa para as organizações, pois trata-se de uma solução economicamente viável e segura.

This Master's thesis is focused on the IPv6 protocol implementation in a business environment. The thesis theoretically describes parts of the protocol which are then used in a real environment with respect to maximal compatibility and security. The thesis deals with hardware components, router configuration on FreeBSD OS, and switch configuration with RouterOS. The thesis also proposes how to monitor the network.