Tese de mestrado integrado. Engenharia Electrotécnica e de Computadores (Major Telecomunicações). Faculdade de Engenharia. Universidade do Porto. 2010

Dans cette thèse, nous présentons une approache dynamique et facilement administrable basée sur la technologie des réseaux privés virtuels IP, connus sous le nom "IP Virtual Private<br />Networks" (IPVPNs). Avec cette approche les machines terminales, les serveurs et/ou des routeurs de bordure s'organisent automatiquement en une topologie de recouvrement grâce<br />à laquelle des données sont diffusées. Cette approche est une solution centralisée, où tout, y compris la gestion des services d'adminstration comme l'adhésion au groupe et la création de topologie VPN, est de la responsabilité d'un centre d'opérations du système, appelé le "Network Operation System" (NOS).<br />Nous utilisons notre approache pour établir un service alternatif de communication de groupe qui déplace le support de multipoint depuis les routeurs vers les extrémités. Nous appliquons<br />cette approache au moyen d'un nouveau protocole IVGMP (Internet Virtual Group Management Protocol) pour réaliser un VPN supportant la diffusion multipoint sur des réseaux de transport IPV4.<br />Nous étudions ensuite l'utilisation d'un nouveau protocole HBM qui fournit un service de distribution multipoint au niveau applicatif afin d'établir un service entièrement sécurisé mais efficace de communication de groupe entre plusieurs sites avec l'aide de notre approche VPN. Nous montrons que HBM et notre approche sont naturellement complementaires et conduisent au concept de réseau privé virtuel routé (VPRN).<br />La deuxième contribution concerne les services web sécurisés. Nous définissons aussi un modèle d'architecture hybride qui s'applique aux Services Web. Nous montrons comment ce modèle correspond bien à la nature dynamique des services web, offre un service d'administration facilement intégrable, et améliore grandement la sécurité des services web grâce à l'utilisation de VPNs. La troisième contribution de ce travail concerne des techniques de partage de charge et d'amélioration de performances, telle l'addition de liens virtuels redandants qui évitent la<br />partition de la topologie en cas de panne d'une passerelle VPN.<br />Nous concluons ce travail avec une discussion de différents applications de notre approche IPVPN, en particulier des services qui peuvent être fournis moyennant quelques modifications.

Since the introduction of networks, they have been used amongst home users, companies and organizations and most damage on the network is due to inappropriate security configurations. To secure networks, a protocol suite can be used to encrypt and authenticate all IP packets of a session. Therefore, this report will include the advantages and possible solution of some techniques used to offer increased network security such as scalability and data confidentiality. Captures of traffic sent using the two security techniques, IPSec/VPN and GRE-Tunnel will be monitored. The objective behind this project is to configure a network with these two different tunneling techniques and compare the security and network performance. The report also describes the security problems encountered by networks such as the ignorance of network users, vulnerabilities and the security of the devices.IPSecis a standard security protocol solution for TCP/IP, and it provides security through authentication, encryption and data integrity. GRE encapsulates packets and create a logical hub-and spoke topology of virtual point-to-point connections. The Jperf-tool is used to measure network performance and show specific details while another tool, Wireshark is used to analyze the information captured during transmission of data sent using IPSEC and GRE. The comparison further finds that IPSec-tunnel technique makes data transfers very secure but causes network performance disadvantages in comparison to a GRE solution.

Denna rapport har i syfte att öka förståelsen om hur man kan öka säkerheten på ett företag som använder sig av mobila klienter. Att arbeta på distans blir allt vanligare, och med de så ställs allt högre krav på tekniken som tillhandahåller möjligheterna för detta. När ny teknik utvecklas kommer ofta säkerheten i andra hand, det man fokuserar på är funktionaliteten. Frågorna man då ställer sig och vilket läsaren kommer skaffa sig mer kunskap om under rapprotens gång är: Hur skall en klient kunna hållas uppdaterad när den är utanför företagets väggar? Hur skall kommunikation kunna ske med företaget på ett enkelt sätt, samtidigt som det också ska vara säkert? Det kommer visa sig att administratören inte är den pusselbiten i säkerheten på ett företag. Företaget kan ha en mycket gedigen och bra säkerhetspolicy, men med en användare som handskas vårdslöst med sina användaruppgifter så spelar inte denna någon roll. / The aim of this paper is to give new information on how to increase the security at a company that uses mobile clients. Tele-work and E-work is becoming more common, therefore, the technology used must have the utmost reliability. In general, when technology is being developed, the primary focus is on the functionality of the product and less on the aspect of security. Key questions that will be raised and answered are: How should a mobile client be kept up to date with a company’s current software updates? How can this type of communication be achieved in a simple and secure way? Furthermore, the paper will illustrate that the success rate of all levels of security in a company does not depend solely on the administrator. Without the proper use of the security policy by the user, its reliability decreases.

Susipažinti su telekomunikacijų sritimi, sukurti jai paslaugą. Paslauga veikia „Mobicents“ JSLEE platformoje. Realizuota paslauga – VPN (angl. Virtual private numbering). Vartotojas savo ilgam numeriui (pvz. 5866694112234) gali nusistatyti trumpą (pvz. 555). Skambinant trumpu numeriu, paslauga suranda siekiamo adresato tikrąjį numerį ir su juo sujungia. Atlikti tyrimai ir matavimai įvertinti paslaugos tobulinimo galimybes, jos įtaką platformos darbui. / During course of this project we developed an telecommunications service - virtual private numbering. It allows users to create, manage and be accessible by short numbers. At first we analysed telecommunication field, then - possible platforms for SIP based service and chose open source JSLEE certified „Mobicents“. In next step, there were formulated requirements, designed architecture, developed and tested service. After that, we investigated possibilities to improve service execution parameters and it's current use of resources, influence to platform. Lastly investigation were checked by experiments.

This paper compares two technologies, Public Key Infrastructure (PKI) and Virtual Private Network (VPN). PKI and VPN are two approaches currently in use to resolve the problem of securing data in computer networks. Making this comparison difficult is the lack of available data. Additionally, an organization will make their decision based on circumstances unique to their information security needs. Therefore, this paper will illustrate a method using a utility function and the Analytic Hierarchy Process (AHP) to determine which technology is better under a hypothetical set of circumstances. This paper will explain each technology, establish parameters for a hypothetical comparison, and discuss the capabilities and limitations of both technologies. / Master of Arts

Abstract The rapid growth of e-business in past few years has improved companies efficiency and revenue growth. E-business applications such as e-commerce, remote access has enabled companies to manage processes, lower operating costs and increased customer satisfaction. Also the need rises for the scalable networks that accommodate voice, video, and data traffic. With the increased dependability of networks the security issues are raised and networks become more and more vulnerable to different types of security threats. To overcome security issues different security technologies are in action by vendors and technologists. Also for the survival of many businesses to allow open access to network resources, today’s networks are designed with the requirement of availability to the Internet and public networks, therefore, information confidentiality is the major issue in these networks to ensure that the network resources and user data are as secure as possible. With the requirement of network security, concept of Virtual private network was established. A Virtual Private Network (VPN) can be defined as a network in which connectivity between multiple customers’ sites is deployed on a shared network with the same security as a private network. Different VPN technologies and protocols architectures are available in market among are MPLS VPN architecture, IPSec VPN architecture, and SSL VPN architecture. Like With the introduction of Multiprotocol Label Switching (MPLS), which combines the benefits of Layer 2 switching and Layer 3 routing, it became possible to construct a technology that combines the benefits of an overlay VPN with the benefits of peer-to-peer VPN implementation in which routing is simple. MPLS/VPN is a new and simple technology, which provides simpler to routing and also makes number of topologies easy to implement which are otherwise difficult to implement. All architectures have benefits and drawbacks, also each of them can be implemented separately or in combination of other according to customer security requirement and performance of the network.

Dagens företag vill ge anställda möjlighet att jobba hemifrån eller på resande fot. En vanlig lösning för att möjliggöra detta är virtual private network (VPN). VPN ger en användare tillgång till interna resurser på företaget från ett externt nät, exempelvis via Internet. Detta gör att användare kan komma åt de interna resurserna på ett säkert sätt. Vilken VPN-teknik är då att föredra för att få en så snabb, säker och pålitlig anslutning som möjligt? Detta examensarbete tar upp olika VPN-tekniker. Vi beskriver vanliga VPN-protokoll som L2TP, IPSec och PPTP. Hur användare autentiseras på ett säkert och smidigt sätt samt metoder att göra sin VPN-anslutning säker. Vi redovisar också den lösning vi har implementerat hos Confidence, för vilka arbetet utfördes. Problemen med att använda de produkter som redan fanns på företaget beskrivs. Förslag på lösningar ges för att lösa dessa problem i framtida arbeten. / Companies of today want to give their employees the opportunity to work from home or while they travel. A common solution to accomplish this is to implement a VPN over top of the existing network. Using VPN gives the employees access to the company’s local area network from outside, via the internet. The VPN provides a secure channel for these employees to connect to the local services attached to the company’s network that they need to reach. Which VPN technology is most suitable to deliver a secure, fast, and reliable connection to theses employees? In this thesis examines we are taking a closer look at different VPN solutions. We describe different VPN-protocols like L2TP, IPSec and PPTP. How to authenticate users in a secure and flexible way and also methods used to make the VPN-connection secure. Lastly we will show the solution we have implemented at the company Confidence, for whom we made the solution. The difficulties in using existing products with the company’s infrastructure are described. Suggestions are offered for future work to address these problems.

<p> </p><p>Syftet med denna undersökning är att ta reda på vilken mjukvarubaserad fjärranslutningslösning som passar för ett mindre företag, då de har mindre ekonomiska tillgångar än ett större företag behöver de vara mer noggranna med sina produktval. Arbetet är utfört med litteraturstudier och en enkätundersökning till ett tiotal mindre företag, samt en laborationsmiljö där tester av de olika fjärranslutningslösningarnas egenskaper har utförts.</p><p>Område valdes då ämnet fjärranslutning knappt behandlads under utbildningstiden, och fördjupar sig därför inom området.</p><p>Resultatet visar vad mindre företag anser vara de viktigaste egenskaperna med en fjärranslutningslösning. Även de värden som uppkom vid tester i laborationsmiljön kommer att presenteras i resultatet. De samlade resultaten kommer sedan visa på vilken mjukvarubaserad lösning som passar bäst för ett mindre företag.</p><p> </p> / <p><p>The purpose of this survey is to figure out which software based remote access solution that fits a smaller company, hence they have less economy assets than a larger company they need to be more thorough with their products of choice. The work is performed with literature studies and a survey of a dozen smaller companies, and also a laboratory environment where properties of the different remote access solutions are performed.</p><p>This area was chosen because the subject of remote access scarcely was treated during our education, and become engrossed in this area.</p><p>The result shows what the companies consider to be the most important properties with a remote access and also the products results from the tests. Also the values that occurred during testing in a laboratory environment will be presented in the results. The combined results will then show which software-based solution that is best suited for a small company.</p></p>

Syftet med denna undersökning är att ta reda på vilken mjukvarubaserad fjärranslutningslösning som passar för ett mindre företag, då de har mindre ekonomiska tillgångar än ett större företag behöver de vara mer noggranna med sina produktval. Arbetet är utfört med litteraturstudier och en enkätundersökning till ett tiotal mindre företag, samt en laborationsmiljö där tester av de olika fjärranslutningslösningarnas egenskaper har utförts. Område valdes då ämnet fjärranslutning knappt behandlads under utbildningstiden, och fördjupar sig därför inom området. Resultatet visar vad mindre företag anser vara de viktigaste egenskaperna med en fjärranslutningslösning. Även de värden som uppkom vid tester i laborationsmiljön kommer att presenteras i resultatet. De samlade resultaten kommer sedan visa på vilken mjukvarubaserad lösning som passar bäst för ett mindre företag. / The purpose of this survey is to figure out which software based remote access solution that fits a smaller company, hence they have less economy assets than a larger company they need to be more thorough with their products of choice. The work is performed with literature studies and a survey of a dozen smaller companies, and also a laboratory environment where properties of the different remote access solutions are performed. This area was chosen because the subject of remote access scarcely was treated during our education, and become engrossed in this area. The result shows what the companies consider to be the most important properties with a remote access and also the products results from the tests. Also the values that occurred during testing in a laboratory environment will be presented in the results. The combined results will then show which software-based solution that is best suited for a small company.