A Framework for Ipsec Functional Architecture
Total Page：16
File Type：pdf, Size：1020Kb
University of Windsor Scholarship at UWindsor Electronic Theses and Dissertations Theses, Dissertations, and Major Papers 2005 A framework for IPSec functional architecture. Mehdi. Fahandezh University of Windsor Follow this and additional works at: https://scholar.uwindsor.ca/etd Recommended Citation Fahandezh, Mehdi., "A framework for IPSec functional architecture." (2005). Electronic Theses and Dissertations. 622. https://scholar.uwindsor.ca/etd/622 This online database contains the full-text of PhD dissertations and Masters’ theses of University of Windsor students from 1954 forward. These documents are made available for personal study and research purposes only, in accordance with the Canadian Copyright Act and the Creative Commons license—CC BY-NC-ND (Attribution, Non-Commercial, No Derivative Works). Under this license, works must always be attributed to the copyright holder (original author), cannot be used for any commercial purposes, and may not be altered. Any other use would require the permission of the copyright holder. Students may inquire about withdrawing their dissertation and/or thesis from this database. For additional inquiries, please contact the repository administrator via email ([email protected]) or by telephone at 519-253-3000ext. 3208. A Framework for IPSec Functional Architecture by Mehdi Fahandezh A Thesis Submitted to the Faculty of Graduate Studies and Research through the Department of Electrical and Computer Engineering in Partial Fulfillment of the Requirements for the Degree of Master of Science at the University of Windsor Windsor, Ontario, Canada 2005 © 2005 Mehdi Fahandezh Reproduced with permission of the copyright owner. Further reproduction prohibited without permission. Library and Bibliotheque et 1*1 Archives Canada Archives Canada Published Heritage Direction du Branch Patrimoine de I'edition 395 Wellington Street 395, rue Wellington Ottawa ON K1A 0N4 Ottawa ON K1A 0N4 Canada Canada Your file Votre reference ISBN: 0-494-09865-1 Our file Notre reference ISBN: 0-494-09865-1 NOTICE: AVIS: The author has granted a non L'auteur a accorde une licence non exclusive exclusive license allowing Library permettant a la Bibliotheque et Archives and Archives Canada to reproduce,Canada de reproduire, publier, archiver, publish, archive, preserve, conserve,sauvegarder, conserver, transmettre au public communicate to the public by par telecommunication ou par I'lnternet, preter, telecommunication or on the Internet,distribuer et vendre des theses partout dans loan, distribute and sell theses le monde, a des fins commerciales ou autres, worldwide, for commercial or non sur support microforme, papier, electronique commercial purposes, in microform,et/ou autres formats. paper, electronic and/or any other formats. The author retains copyright L'auteur conserve la propriete du droit d'auteur ownership and moral rights in et des droits moraux qui protege cette these. this thesis. Neither the thesis Ni la these ni des extraits substantiels de nor substantial extracts from it celle-ci ne doivent etre imprimes ou autrement may be printed or otherwise reproduits sans son autorisation. reproduced without the author's permission. In compliance with the Canadian Conformement a la loi canadienne Privacy Act some supporting sur la protection de la vie privee, forms may have been removed quelques formulaires secondaires from this thesis. ont ete enleves de cette these. While these forms may be includedBien que ces formulaires in the document page count, aient inclus dans la pagination, their removal does not represent il n'y aura aucun contenu manquant. any loss of content from the thesis. i * i Canada Reproduced with permission of the copyright owner. Further reproduction prohibited without permission. All Right Reserved © 2005 Mehdi Fahandezh Reproduced with permission of the copyright owner. Further reproduction prohibited without permission. ABSTRACT In today’s network, various stand-alone security services and/or proxies are used to provide different security services. These individual security systems implementing one single security function cannot address security needs of evolving networks that require secure protocol such as IPSec. In this paper, we provide a framework for implementing IPSec security functions in a well structured functional architecture. The proposed architecture is modular and allows for composing software applications from products commercially available and developed by different suppliers to implement the entire security requirements of IPSec protocol. In addition the proposed architecture is robust in the sense that it supports open standards and interfaces, and implements security functions of IPSec as an integrated solution under a unified security management system. IV Reproduced with permission of the copyright owner. Further reproduction prohibited without permission. DEDICATION I dedicate this work to my wife, Rose (Zohreh Heshmatzadeh), who supported me all the way and stands beside me. Her enthusiasms for my future have always kept me going and her prayers are always with me. Her patient is most recognized and appreciated. I also dedicate my work to my family, who always give me boundless supports, especially to my sons, Arash and Arman, to encourage them to reach for higher education and for better life. Finally, I would dedicate not only this work but also my entire success, to my beloved father. I would consider myself extremely lucky and successful if I could be half of what he was. V Reproduced with permission of the copyright owner. Further reproduction prohibited without permission. ACKNOWLEDGEMENT I would like to thank my academic advisor, Prof. Shervin Erfani, for his guidance and support, especially for letting me to use his patent on “5-Layer Security Architecture”, and lead me all the way through to achieve the novelty of “A Framework for IPSec Functional Architecture”. A special thanks to Mr. Karim Zarafshan for his active support. His encouragements were always my guiding light during the time of my Master’s Degree studies at the University of Windsor. VI Reproduced with permission of the copyright owner. Further reproduction prohibited without permission. TABLE OF CONTENTS ABSTRACT....................................................................................................................................I DEDICATION............................................................................................................................ II ACKNOWLEDGEMENTS..................................................................................................... Ill LIST OF FIGURES................................................................................................................... VII LIST OF TABLES...................................................................................................................... X LIST OF ACRONYMS............................................................................................................. XI CHAPTER I INTRODUCTION..............................................................................1 1.1 Introduction ................................................................................................................... 1 1.2 Network Security ............................................................................................... 5 1.1.1 Introduction to Network Security ......................................................... 6 1.1.2 Introduction to Security Threats ........................................................ 7 1.1.3 Common type of network A ttacks .................................................... 10 1.2 TCP / IP Overview ................................................................................................. 16 1.2.1 Introduction ..............................................................................................16 1.2.2 TCP/IP Protocol Architecture ............................................................... 16 1.3 Cryptography Tools and Techniques .....................................................................22 1.3.1 Introduction ............................................................................................. 22 1.3.2 Cryptographic ...........................................................................................22 1.3.3 Encryption Concepts and Algorithm .....................................................23 1.3.4 Hashing Concepts and Algorithms ........................................................29 1.3.5 Authentication Mechanisms...................................................................34 CHAPTER II INTERNET PROTOCOL SECURITY (IPSEC) ARCHITECTURE..38 2.1 Introduction ............................................................................................................. 38 2.2 IPSec Implementation in TCP/IP Stack ...............................................................40 2.3 The IPSec Roadmap ................................................................................................41 2.4 How IPSec Works ....................................................................................................42 2.5 IPSec Modes ..............................................................................................................44 2.6 Security Associations ...............................................................................................45 2.6.1 Security Associations (SA) Concept ......................................................45 2.6.2 Security