A Repeater Encryption Unit for IPv4 and IPv6

Abstract

IPsec is a powerful mechanism for protecting network communications. However, it is often viewed as difficult to use due to the elaborate configuration that is needed to ensure correct (and secure) operation. In this paper, we seek to answer the question of how to build IPsec VPNs without affecting the network assets. We exploit "repeater-encryption", which is similar to the IPsec bump-in-the-wire mode of operation. Our IPsec encryption unit works at Layer-2 of the network stack and does not encrypt control packets that are used for routing, address resolution and resource reservation. Although this is fairly straightforward for IPv4 networks, IPv6 introduces several new features and messages that complicate the operation of such a box. We report our findings of implementing transparent, repeater-based IPsec protection for IPv4 and IPv6. Our approach requires no configuration changes to other devices in the network, making it an attractive mechanism for security network traffic. We discuss the features of our IPsec encryption unit and show how it adapts to IPv4 and IPv6 networks. We also implement our approach on the OpenBSD IPsec stack to demonstrate its feasibility. We show that our transparent IPsec box can easily support speeds in excess of 100 Mbps