With the help of the Internet today we can communicate with anyone from anyplace to access all types of data with a high level of QoS. This mobility is available for legitimate users, as well as for illegitimate ones, for this reason we need extra data security. A solution for QoS and data confidentiality is Virtual Private Network (VPN); ways, in which we can reduce operational costs, grow productivity, simplify network topology and extend the area of connectivity. Video data packets must arrive with a constant and low delay at the same rate in order to have e real time transmission. This paper presents an analysis of different protocols used and the way that video data packets are encapsulated and encrypted for a high level of QoS in a VPN connection

Graur, Adrian

Lavric, Alexandru

Potorac, Alin Dan

Simion, Daniel

Ursuleanu, Mihai Florentin

With the help of the Internet today we can communicate with anyone from anyplaceÂ to access all types of data with a high level of QoS. This mobility is available forÂ legitimate users, as well as for illegitimate ones, for this reason we need extra dataÂ security. A solution for QoS and data confidentiality is Virtual Private NetworkÂ (VPN); ways, in which we can reduce operational costs, grow productivity, simplifyÂ network topology and extend the area of connectivity. Video data packets mustÂ arrive with a constant and low delay at the same rate in order to have e real timeÂ transmission. This paper presents an analysis of different protocols used and the wayÂ that video data packets are encapsulated and encrypted for a high level of QoS in aÂ VPN connection

Agora University Editing House: Journals

INT J COMPUT COMMUN, ISSN 1841-98368(1):136-145, February, 2013.Eﬃciency Consideration for Data Packets Encryption withinWireless VPN Tunneling for Video StreamingD. Simion, M.F. Ursuleanu, A. Graur, A.D. Potorac, A. LavricDaniel Simion, Mihai Florentin UrsuleanuAdrian Graur, Alin Dan Potorac, Alexandru Lavric"Stefan cel Mare" University of SuceavaUniversitatii Street, No.13, RO-720229, Suceava, RomaniaE-mail: dasimion@eed.usv.ro, mursuleanu@stud.usv.radriang@eed.usv.ro, alinp@eed.usv.ro, lavric@eed.usv.roAbstract:With the help of the Internet today we can communicate with anyone from anyplaceto access all types of data with a high level of QoS. This mobility is available forlegitimate users, as well as for illegitimate ones, for this reason we need extra datasecurity. A solution for QoS and data conﬁdentiality is Virtual Private Network(VPN); ways, in which we can reduce operational costs, grow productivity, simplifynetwork topology and extend the area of connectivity. Video data packets mustarrive with a constant and low delay at the same rate in order to have e real timetransmission. This paper presents an analysis of diﬀerent protocols used and the waythat video data packets are encapsulated and encrypted for a high level of QoS in aVPN connection.Keywords: encryption, IPSec, L2TP, VPN, videostreaming, wireless tunneling.1 IntroductionSending video streams in IP networks is not a trivial problem even more so if we do iton a wireless network. In the wireless standard 802.11 for each carried data packet, timingintervals and additional overheads are mandatory. Often attacks of this sort compromise thenetwork availability of the application. Data integrity and conﬁdentiality can be compromisedby unauthorized external access, for example hackers who can modify data content and databases.The following research is a part of a bigger project that aims the optimization of data com-munication. The main focuses of the research are towards technologies like video streaming,VoD, VoIP, and IPTV.Virtual Private Network (VPN) is used to avoid DoS (Denial of Service) attacks, eavesdrop-ping, masquerade and traﬃc analysis; to reduce operational costs and to increase productivity;to simplify network topology and extend the geographical connectivity area without adding othercosts.VPN security solution oﬀers two major advantages: network scalability and a low imple-mentation cost. The client doesn’t have to rent other networks to cover all of the company’slocations; he can connect them through a local connection to any licensed ISP (Internet ServiceProvider), at the rate required by that provider.Also, the client doesn’t need remote access servers. In order to connect two locations, acompany will use a single dedicated line (see Figure 1), but as the number of work points willmultiply so will the connection costs will grow. For example a company which will have 4 workpoint will need 6 dedicated lines to interconnect them; for 6 work points a company will use15 dedicated lines for interconnections fact that will inﬂuence negatively the QoS of the videostream transmission.Copyright c 2006-2013 by CCC PublicationsEﬃciency Consideration for Data Packets Encryption within Wireless VPN Tunneling forVideo Streaming 1372 Virtual Private Network TunnelingVPN is a private and secure connection [1] between two or more networks or computers whoshare protected data, using a single secure channel between the endpoints, over a public datanetwork (for example WAN) or through the Internet. Tunneling represents the ability to makecircuit oriented connections in WAN topologies oriented on packets. This process is the maintechnical concept of VPN.Figure 1: Virtual Private Network Tunneling conceptUnlike packet oriented protocols, like IP, which can send data packets on diﬀerent routes toa common destination; a tunnel represents a dedicated virtual circuit between two endpointsof a communication network. Since this process takes place over a shared network and tunnel-ing can be implemented on a medium technological level, VPN is economically eﬃcient; withimplementation costs between packets based communications and leased line communications.VPN was created not to replace the other security mechanisms of the IEEE 802.11 standard,but to complete them.The main modes of use supported by VPN are: LAN-to-LAN internetworking; Controlled access within an intranet; Internet remote access client connections.Protocols based on the OSI model (for data link layer and network layer) have been imple-mented in VPN tunneling. In order to send data on layer 2 VPN uses frames and on layer 3VPN uses packets for data sending.In Figure 2 can be seen a representation of VPN protocols on OSI Model.Point-to-Point Tunneling Protocol (PPTP) encapsulates PPP frames for transmissionover IP internet works in IP datagrams. For tunnel maintenance a TCP connection is used inPPTP, in order to encapsulate PPP frames in tunnelled data is used a modiﬁed version of GRE(Generic Routing Encapsulation). The content encapsulated with PPP frames can be compressedor encrypted (view Figure 3).H = HGRE +HPPP +HIP (1)Layer Two Tunneling Protocol (L2TP) encapsulates PPP frames, encrypted and/orcompressed, which can be sent over X.25, ATM, Frame Relay or IP networks [2]. For a secureenabled tunnel L2TP protocol can be combined with IPSec. L2TP tunneled data uses UDP tosend L2TP encapsulated PPP frames (view Figure 4).138 D. Simion, M.F. Ursuleanu, A. Graur, A.D. Potorac, A. LavricFigure 2: VPN protocols on OSI ModelFigure 3: PPTP Tunnel Data Frame FormatFigure 4: L2TP Tunnel Data Frame FormatEﬃciency Consideration for Data Packets Encryption within Wireless VPN Tunneling forVideo Streaming 139H = HIP +HUDP +HL2TP +HPPP (2)Internet Protocol Security (IPSec) is a collection of multiple related protocols. It canbe used as a complete VPN protocol solution or simply as the encryption scheme within L2TPor PPTP. IPSec ESP (Encapsulating Security Payload) encrypts the L2TP packet. Known to bethe strongest authentication and encryption method IPSec works at layer 3 of the OSI networkmodel.An alternative to IPSec are SSL VPN’s, they operate at a higher layer level than IPSecand it oﬀers network administrators a greater control access to diﬀerent network resources.SSL (Secure Socket Layer) enables secure transactions of data and relies on several securitymeasures like private or public key and digital certiﬁcates [3]. Using SSL security encryption ina WLAN environment forces a mobile wireless equipment to authenticate itself before any datatransactions.Figure 5: L2TP/IPSec Tunnel Data Frame FormatH = HIP +HESP +HUDP +HL2TP +HPPP (3)Due to the standardization of tunneling protocols they become vulnerable to any ﬁrewallstopping and blocking at any level. VPN uses encrypting routers to ensure unauthorized accessto the data that is being sent in a communication transmission; also limiting third parties dataaccess to the network connection.There are lots of encryptions type’s algorithms. In most algorithms, the original data isencrypted using a certain encryption key. Only the receiver computer or the recipient user candecrypt the message using a speciﬁc decryption key. SSL, DES and PGP are some encryptionalgorithms that create or change these keys. Authentication and encryption used in VPN dependon implementation. Implementations like PPTP use the RC4 algorithm on 40/56/128 bits, whileL2TP and IPSec can use a wide range on encryption algorithms, like AES on 128/192/256 bits,DES on 56 bits and 3DES on 168 bits.In VPN PPTP encryption is weak, sending distributed passwords in clear. Unlike PPTP,L2TP utilizes server-client digital certiﬁcates based ok PKI (Public Key Infrastructure). Somesolutions of IPSec have the option of using pre-shared keys or PKI digital certiﬁcates [4].When considering a secure wireless VPN connection:HSEC = H +HSOH (4)where, HSOH are security overheads; we have to take in account supplementary overheads (20Bytes for WPA TKIP, 8 Bytes for WEP, 16 Bytes for WPA CCMP) [5,6].3 Practical ApproachThis practical approach has tried to evaluate the theoretical approach presented before, in astable environment (without electromagnetic pollution). Certain measurements were made using140 D. Simion, M.F. Ursuleanu, A. Graur, A.D. Potorac, A. Lavricdiﬀerent communication scenarios.In the ﬁrst scenario, we have sent a video stream with 1.164 GB of data through ourprivate VPN, which uses PPTP encryption protocol, between two clients (n=1, where n is thenumber of clients); one has an Ethernet connection to the VPN server and the other has awireless connection.Figure 6: LAN-WLAN VPN ConnectionsFor the ﬁrst scenario the results have been achieved in interval 2.008 Mbps - 10.036 Mbps(see Figure 7).Figure 7: Minimum and Maximum values for LAN-WLAN VPN connectionIn Figure 8 can be seen a network report for the ﬁrst scenario, LAN-WLAN VPN connection.Excluding IP overheads for PPTP, we have achieved an overhead length between 26 and 32Bytes [7].For an average upload speed of 5,398 Mbps we have 674,75 KB/s (Ups = 674.75KB/s).We have an upload rate (Upr) of:Upr =UpsMTU(5)where, MTU is Maximum Transmission Unit or maximum eﬃciency for the IP packet.Normally, without PPTP VPN tunneling protocol, according to equation (5), we have anupload rate of 449.83 packets/s:Eﬃciency Consideration for Data Packets Encryption within Wireless VPN Tunneling forVideo Streaming 141Figure 8: Network report for LAN-WLAN VPN connectionUpr =UpsMTU + PPTPoverheads(6)Using equation (6), for a maximum PPTP overheads length (32Bytes) used for VPN tunnel-ing, the packet rate will decrease at 440.43 packets/s.At a maximum IP packet size (1.5KB) we have a loss of 32 bytes equaling 2.09% of bandwidthlost.For encapsulating 1.5KB IP packet into L2TP, the packet becomes 1.54KB (1.5KB +0.04KBof UDP, IP and L2TP headers). Sending packets of data over Ethernet is a job that’s requiresfragmentation of the initial data into 1.5KB of data. So, the packet will be fragmented.The ﬁrst fragment has 1.5KB of data (1.46KB from the original IP packet and 0.04KB fromL2TP encapsulation).The second will have 0.06KB (0.02KB from IP overhead and last 0.04KB from the originalIP packet). From the whole packet, only the ﬁrst fragment of the packet will contains the L2TPheader. The second fragment of the data packet has only IP header. Careless of the L2TP clienttype (LNS or LAC), the peer will assemble the two packet fragments back into original 1.54KBsize.Upr =UpsMTU + L2TPoverheads(7)When we used L2TP VPN protocol the packet rate has decreased at 438.15 packets/s, incomparison with the case when we used PPTP VPN protocol, as concluded from (7).At a maximum IP packet size (1,5KB) we have a loss of 60Bytes equalling 3.89% of bandwidthlost. When we used IPSec VPN protocol encapsulation the packet rate has decreased at 433.64packet/s.142 D. Simion, M.F. Ursuleanu, A. Graur, A.D. Potorac, A. LavricUpr =UpsMTU + IPSecoverheads(8)In this case we have a 76Bytes loss (about 4.88% of all bandwidth), at a maximum IP packetsize (1.5KB) (see Figure 9).Figure 9: Bandwidth loss when using VPN Tunneling ProtocolsIn infrastructure wireless LANs with one access point (AP), the data frames do not traveldirectly among clients. Wireless clients send the data frame to the AP and then the AP resendthe payload content of the original data frame, packed in a new data frame, to the receivingclient. The AP bandwidth, and the radio space, is shared between the AP radio clients and theuser available bandwidth is thus split among those clients [8].In the second scenario, we have sent a video stream through our private VPN, which usesPPTP encryption protocol, between two wireless clients ( n=2, where n is the number of wirelessclients) (see Figure 10).The link utilization factor is reﬂected in the eﬃciency of the communication channel. Thiscan be viewed as the ratio between the total times that the channel is busy and the time forsending the data payload. The channel eﬃciency is the rapport between payloads (the usefulbits of information) and the all the bits sent. For the ideal channel, the eﬃciency is:Ef =L(L+H)(9)where, Ef is channel eﬃciency, L is the number of useful data bits and H is the overheads bits.Figure 10: WLAN-WLAN VPN ConnectionsFor the second scenario the results have been achieved in interval 1.857 Mbps - 14.326 Mbps(see Figure 11).Eﬃciency Consideration for Data Packets Encryption within Wireless VPN Tunneling forVideo Streaming 143Each packet has 8L useful bits. The determination of the total number of successful sentpayload bits is made using the formula S * N * 8L, and the number of total transmitted bits canbe calculated using the relation N * 8 * (L + H).Figure 11: Min and Max values for WLAN-WLAN VPN connectionSupposing that in a unit of time are passed though the VPN channel N packets of data, anda part of them are successfully received by the another VPN client, the channel eﬃciency (Ef0),is (10):Ef0 =N  8L  (1  p)8(L H)N  8  (L+H) =LL+H (1  p)8(L+H) (10)where, p is bit error probability.The maximum size of one data packet sent on wireless environment is over 50% larger thanthe maximum packet size sent on the Ethernet networks. The maximum size of one data packet,in ideal condition, sent unencrypted on wireless environment is 2.304KB.For the ideal VPN wireless channel, with one wireless VPN client, the eﬃciency is (11):Ef =NwLw +HV PN(11)where, Nw is the number of frames in a unit of time, Lw is the number of useful data bits inwireless medium and HV PN is the VPN overheads.In a simple wireless video streaming, if no error occurs, the eﬃciency is (12):Ef =NwLw(12)From our scenarios we have found that the 7.54% from the maximum data packet unit isresponsible for wireless VPN data packaging and 4.64% from the maximum data packet unit isresponsible for wireless data packaging (see Figure 12).In VPN the bandwidth reservation can be a challenge because of the unknown load distribu-tion in a point-to-point connection [9].As argued in [10], IPSec security encapsulation in VPN shows the performance in terms ofaverage added overhead.144 D. Simion, M.F. Ursuleanu, A. Graur, A.D. Potorac, A. LavricFigure 12: Overheads contribution in Wireless and Wireless VPN environment4 Conclusions and Future WorksThis paper evaluates the data communication eﬃciency for continuous data streaming anddiﬀerent scenarios in a wireless environment using a VPN solution. The results of the researchwould be considered as a base for the implementation of new solutions in the ﬁeld of datastreaming using heterogeneous communications medium and technologies.Using wireless environment instead of Ethernet solution for sending video streaming datapackets we lose approximately 34.89% from whole packet sent. When we used VPN for videostreaming we also lose 2.9% from the packet sent. The biggest WLANs have about 100 nodes.A way in which we can extend them is by using VPN Tunneling.With WiMAX and LTE technologies VPN video data transmission speeds will increase, bothincluding "best-eﬀort" and priority based QoS scalable solutions. Considering that only 2.09% of the packet size is lost through VPN encapsulation is a price worth paying for a secureconnection between two work points.We conclude that we have achieved better speeds in aWLAN-WLAN video streaming scenariowhen we used PPTP tunneling protocol in given conditions compared to L2TP and IPSec VPNtunneling protocols.In our next papers we will present a study on WiMax and LTE on video packet framesstructure for downlink and uplink with a speciﬁc simulating software. We will simulate wirelessVPN communication network with the two technologies, WiMax and LTE, on high performancehardware to obtain maximum speeds for data transfer. Future papers will analyze the eﬀects ofWiMax and/or LTE on live video streams, IPTV streams and multimedia.AcknowledgementsThis paper was supported by the project "Knowledge provocation and development throughdoctoral research PRO-DOCT - Contract no. POSDRU/88/1.5/S/52946", project co-fundedfrom European Social Fund through Sectoral Operational Program Human Resources 2007-2013 and by the project "Improvement of the doctoral studies quality in engineering science fordevelopment of the knowledge based society - QDOC" contract no. POSDRU/107/1.5/S/78534,project co-funded by the European Social Fund through the Sectorial Operational ProgramHuman Resources 2007-2013.Eﬃciency Consideration for Data Packets Encryption within Wireless VPN Tunneling forVideo Streaming 145Bibliography[1] Shihyon P., Bradley M., D’Amours D., William J. McIver Jr., Characterizing the Impacts ofVPN Security Models on Streaming Video, Communication Networks and Services ResearchConference (CNSR), Montreal, QC, Canada, ISBN:978-1-4244-6248-3, pp. 152 - 159, 2010.[2] Townsley W., Valencia A., Rubens A., Pall G., Zom G., Palter B., Layer two tunnelingprotocol (L2TP), RFC 2661, 1999.[3] Hamzel K., Pall G., Verthein W., Taarud J., Little W, Zom G., Point-to-point tunnelingprotocol (PPTP), RFC 2637, 1999.[4] Prasad A.R., Prasad N.R., 802.11 WLANs and IP networking: Security, QoS and mobility,Boston: Artech House, ISBN 1-58053-789-8, 2005.[5] Potorac A.D., Considerations on VoIP Throughput in 802.11 Networks, Advances in Electricaland Computer Engineering - AECE, ISSN: 1582-7445 e-ISSN: 1844-7600, 9(3):45-50, 2009.[6] Khan M.A.U., Khan T.M., Khan R.B., Kiyani A., Khan M.A. Noise Characterization inWeb Cameras using Independent Component Analysis, INT J COMPUT COMMUN, ISSN1841-9836, 7(2):302-311, 2012.[7] Hossein B., The Internet encyclopedia, ISBN 0-417-22201-1, vol.3:425-428, 2004.[8] Potorac A.D., Coca E. QoS Consideration for 802.11 Networks, European Conference onthe Use of Modern Information and Communication Technologies - ECUMICT 2006, Ghent,Belgium, 30-31 March 2006, ISBN 9-08082-552-2, pp. 45-50, 2006.[9] Volner R., Smrz V., Virtual Private Networks - Based Home System, Electronics and Elec-trical Engineering - Kaunas: Technologija, ISSN 1392-1215, 8(96):62-64, 2009.[10] Berioli M., Trtta F. IP mobility support for IPsec-based virtual private networks: An ar-chitectural solution, 3rd IEEEGlobal Telecommunications Conference - GLOBECOM ’03,Conference Publications, ISBN: 0-7803-7974-8, 3:1532 - 1536, 2003.

Efficiency Consideration for Data Packets Encryption within Wireless VPN Tunneling for Video Streaming

http://univagora.ro/jour/index.php/ijccc/article/view/177/pdf_8

Efficiency Consideration for Data Packets Encryption within Wireless VPN Tunneling for Video Streaming

Abstract

Similar works

Full text

Available Versions

Agora University Editing House: Journals