Girlich, Franz

Grey, Michael

Roßberg, Michael

Schäfer, Günter

Trapp, Markus

Digitale Bibliothek Thüringen

   „Im Rahmen der hochschulweiten Open-Access-Strategie für die Zweitveröffentlichung identifiziert durch die Universitätsbibliothek Ilmenau.“ “Within the academic Open Access Strategy identified for deposition by Ilmenau University Library.” „Dieser Beitrag ist mit Zustimmung des Rechteinhabers aufgrund einer (DFG-geförderten) Allianz- bzw. Nationallizenz frei zugänglich.“  „This publication is with permission of the rights owner freely accessible due to an Alliance licence and a national licence (funded by the DFG, German Research Foundation) respectively.”   Roßberg, Michael; Grey, Michael; Trapp, Markus; Girlich, Franz; Schäfer, Günter: Automatic VPN-Configuration with SOLID URN: urn:nbn:de:gbv:ilm1-2015210350 Published OpenAccess: January 2015 Original published in: Praxis der Informationsverarbeitung und Kommunikation : PIK. - Berlin : de Gruyter (ISSN 1865-8342). - 36 (2013) 1, S. 42. DOI: 10.1515/pik-2012-0147 URL: http://dx.doi.org/10.1515/pik-2012-0147 [Visited: 2015-01-20]  Michael Rossberg*, Michael Grey, Markus Trapp, Franz Girlich and Guenter SchaeferAutomatic VPN-Configuration with SOLID*Michael Rossberg: E-Mail: michael.rossberg@tu-ilmenau.deMichael Grey: E-Mail: michael.grey@tu-ilmenau.deMarkus Trapp: E-Mail: markus.trapp@tu-ilmenau.deFranz Girlich: E-Mail: franz.girlich@tu-ilmenau.deGuenter Schaefer: E-Mail: guenter.schaefer@tu-ilmenau.deA secure communication between company sites and gov-ernment agencies is often realized by virtual private net-works (VPNs), connecting internal networks over untrust-worthy networks, e.g., the Internet. Devices behind VPNgateways transparently exchange information over crypto-graphic tunnels. The deployed protocol assures the reali-zation of confidentiality, integrity, and authentication.Usually, theaccess toVPNs isorganizedby full-meshedtopologies or hub-and-spoke architectures. The latterscheme is more common, as the VPN configuration is oftenstill done manually and it allows for dynamic participantsin a VPN. If hub-and-spoke architectures are infeasible forbottleneck and availability reasons, two reasons speakagainst a manual configuration: setup as well as mainte-nance are time- and cost-intensive and the potential forsecurity-relevant errors increases significantly. Thus, sev-eral approaches for the self-configuration of VPN emerged[2].However,most dependoncentral entities. Furthermore,none addresses tunnel-in-tunnel configurations, which arerequired for advanced mobility support and Denial-of-Ser-vice-resistant topologies. None of the systems assures thesame level of security as a proper manual configuration.Incontrast,SecureOverLayfor IPsecDiscovery (SOLID)[3] employs a self-maintaining VPN with distinct mechan-isms for discovery, routing, and topology control. Espe-cially the latter is important as the setup of VPN tunnels israther resource- and time-intensive (several seconds pertunnel if smartcardsareused). Toefficiently search for gate-ways within the VPN despite a low number of proactivelyestablished tunnels, SOLID deploys well-understood con-ceptsofpeer-topeeroverlays [4], [1] in IPsec infrastructures.BasicApproach: SOLID’s topology control establishestwo IPsec associations to create a ring structure. As gate-ways are ordered by their inner IP addresses, packet desti-nations can be looked up easily. Additional cross connec-tions assure a lookup in Ο(log n) steps. At first glance, thisdoes not differ much from Chord (apart from security ser-vices). However, network addresses (i.e., the keys) are nothashed due to variable subnet masks, and samples of theaddress space areused toplan cross connections.Complex Topologies: To allow nested topologies,where gateways communicate over other gateways, SOLIDembeds the ring in more complex transport networks bydeploying tunnel-in-tunnel connections. In contrast to reg-ular routingmechanisms no broadcast is used to find indir-ect paths. If a connection is to be established, it will beroutedusing the existingoverlay topology first, i.e., thewaythe search took. This path is optimized later by local infor-mation, leading to optimal paths in common networks.DoS resistance: The distributed self-configuration al-lows to tolerate node failures and even react to them, e.g.,data can be rerouted over other gateways. To prevent DoSattacks on importantVPNparts administratorsmay further-more separate them from less important ones.Prototype and simulations (cmp. Fig. 1) verify that theavailability of VPN can be increased – without sacrificingconventional security objectives – by performing a distrib-uted self-configuration, with means to recover from networkpartitions, to separate important VPN parts from less im-portant, and to plan proactive backup paths. It is alsopossible to reintegrate participants over different IP ad-dresses quickly.Fig. 1: SOLID operating environment: OMNeT++ simulation (left), VPNvisualization &monitoring (middle), and Linux embedded system(right).1 B. Ford. Unmanaged Internet Protocol: Taming the Edge NetworkManagement Crisis. In 2ndWorkshop on Hot Topics in Networks,2003.2 M. Rossberg and G. Schaefer. A Survey on Automatic Configura-tion of Virtual Private Networks. Computer Networks, 55: 1684–1699, 2011.3 M. Rossberg, G. Schaefer, and T. Strufe. Distributed AutomaticConfiguration of Complex IPsec-infrastructures. Journal of Net-work and SystemsManagement, 18(3): 300–326, 2010.4 I. Stoica, R. Morris, D. Karger, M. F. Kaashoek, and H. Balakrish-nan. Chord: A scalable peer-to-peer lookup service for internetapplications. ACM SIGCOMM, 31(4): 149–160, 2001.DOI 10.1515/pik-2012-0147 PIK 2013; 36(1): 42–42Bereitgestellt von | Universitätsbibliothek IlmenauAngemeldetHeruntergeladen am | 20.01.15 12:01

Automatic VPN-Configuration with SOLID

https://www.db-thueringen.de/servlets/MCRFileNodeServlet/dbt_derivate_00031265/ilm1-2015210350.pdf

Automatic VPN-Configuration with SOLID

Abstract

Similar works

Full text

Available Versions

Digitale Bibliothek Thüringen