VPN Report

As is with most three-letter computer acronyms, “VPN” is initially enigmatic to the virgin viewer. It stands for Virtual Private Networks and its primary purpose lies in the realm of network security. With the advent of the Internet, public data telecommunication has become cost-effective and efficient. However, it is a challenge to harness the inexpensive use of the Internet’s infrastructure while keeping security a top priority. Keep the diagram below in mind while learning about VPNs so that it is clear as to what is being left behind and replaced with the spread of VPNs. Traditional Connectivity (Gartner Consulting) What is a VPN? Virtual Private Network is a type of private network and uses public telecommunication, such as the Internet, instead of leased lines to communicate. By the simplest definition, a network consists of two computers connected by a physical medium. However, networks can be implemented privately or publicly. VPNs use the Internet as the medium and create a secure “tunnel”, which will be explained in further detail later. It is an inexpensive form of Wide Area Networks (WANs) and companies most commonly use private networks for employees who work at home or at another location so they can remotely access the organization. Businesses look into VPNs because of the higher level of cost savings and flexibility that VPNs provide over traditional dedicated leased lines or frame-relay circuits. The most essential characteristic to businesses is that the implementation of VPNs reduces costs tremendously. The growth of telecommuters increases the cost for modem banks, remote-access servers, and phone charges. However, these workers can connect to their company’s network by dialing into the POP of a local ISP, thus reducing long distance charges, costs of installing and maintaining the banks of modems at corporate sites, and costs of leasing or building dedicated lines. The specific implementation discussed - Remote Access VPNs - uses specialized software on a client computer to initiate encryption and tunneling. It can also depend on the service provider. The software employs encryption protocols such as IPSec, L2TP, PPTP, and SOCKS to allow the 1 service provider to be a secured transporter for the data. Businesses can also outsource to service providers to provide VPN configurations (Dennis). How VPNs Work – Brief When making a VPN connection, there are two connections. The first connection is made to the Internet Service Provider. In connecting to the service provider, TCP/IP (Transmission Control Protocol/Internet Protocol) and PPP (Point-to-Point Protocol) are used to communicate to the ISP. The remote user is assigned an IP address by the ISP. The user logs into the company login. This second connection establishes the VPN connection and a tunnel are created with the use of PPTP (for example) after the user is authorized. The IP datagrams containing encapsulated PPP packets are sent. In normal connections, the company’s firewall does not allow PPP packets from entering the network; thus, Internet users are not able to access a private network. However, VPN services allow users who meet security criteria are admitted. The VPN server disassembles the packet and transfers the packet to the destination computer located in the private network. Take notice to the diagram below. It represents one type of implementation of a VPN – a Remote Access VPN. Remote Access VPN (Gartner Consulting) Four Main Components There are four main components of Internet-based VPNs are the following: the Internet, security gateways, security policy servers, and certificate authorities. The Internet is the WAN backbone. Security gateways sit between public and private networks to block intruders. They create tunneling and provide encryption capabilities. It uses the security policy servers to determine which traffic is authorized. Certification authorities verify the security keys shared between sites. 2 First, private networks will be discussed. An organization makes its own TCP/IP Internet, separate from the global Internet. Routers are used to link networks at each site and leased circuits are used to link two different sites. Businesses are always looking for ways to reduce cost. The maintenance set up and leased circuits are costly. Although common carriers (ISPs) might charge less for Frame Relay or an Asynchronous Transfer Mode (ATM) private virtual circuit (PVC), the least costly solution is eliminating all circuits and using the global Internet instead. In addition to companies not having to invest in telecommunication infrastructure, they can reduce cost by outsourcing network services to service providers. They also reduce long distance telephone charges. Critical Functions to Ensure Security VPNs need to provide the following four critical functions to ensure security for data: Authentication – validates that the data was sent from the sender. Access control – prevents unauthorized users from accessing the network. Confidentiality – prevents the data to be read or copied as the data is being transported. Data Integrity – ensures that the data has not been altered. These functions are met through two techniques: tunneling and encryption. A tunnel is a virtual point-to-point connection made through a public network (Gavaldo). Once there is a connection, information can be exchanged on this virtual link. In addition, tunneling allows senders to encapsulate packets their IP packets, which the encapsulation prevents data from being altered. Encryption Encryption is a method of “scrambling” data before transmitting it onto the Internet (Gavaldo). A VPN encrypts each outgoing datagram. Encryption protects encapsulated data packets from outsiders. An encryption key is needed to decode the datagram. There is a key exchange in order for the receiver to decode the datagram by using the public key encryption technique. Only addresses in the outer datagram header are visible (source address is the IP address of the router at one end of the tunnel, and the destination address is the IP address of the router at the other end of the tunnel). In addition, a technique called digital signature is used to authenticate the sender to make sure it is not an imposter. Tunneling Tunnels can consist of two types of end points: An individual computer LAN with a security gateway (might be a router or firewall) 3 In designing VPN, two combinations of these end points are considered. The first combination is LAN-to-LAN tunneling, in which a security gateway is the interface between the tunnel and the private LAN. Users on both LANs use the tunnel transparently. This tunneling combination is most often seen in communication in corporate intranets where, for example, a regional office may need to securely exchange data with branch offices. The second combination is client-toLAN tunneling. This is for users who are accessing corporate network from a remote location. The client, who is the mobile user, creates the tunnel by executing VPN client software on his computer (Dennis). Encrypted Inner Datagram Datagram Header Outer Datagram Data Area Figure 1 (Comer) The purpose of encapsulation is to transport the datagrams from one machine to machine. VPNs use the IP-in-IP encapsulation. Further, encapsulation in VPN is different because the original datagram is encrypted before it is placed in the data area of another datagram. Site 1 Site 2 Internet R1 R3 R2 R4 Figure 2 (Comer) The sending host forwards the datagram to router 2 which will forward it to router 1. Router 1 will be sending it to router 3. Router 1 will encrypt the datagram and encapsulate it in the data area of an outer datagram with destination router 3. Router 1 then forwards the outer datagram through the local ISP and across the Internet. The datagram arrives at router 3, which recognizes that it as tunneled from router 1. Router 3 decrypts the data area to produce the original datagram. Router 3 recognizes that it is to be forwarded to router 4 and sends the datagram. Valid IP Address Site 1 R1 Valid IP Address Internet R2 Site 2 Figure 3 (Redrawn from Comer) 4 In VPNs, one globally valid IP address is needed at each site of tunneling. One is assigned from router to the Internet and the other from router 2 to the Internet. Protocols Commonly Used These protocols are a set of communication rules that allows creating private, secured tunnels through the Internet. Four different protocols became popular as a result of VPN: PPTP, L2TP, Ipsec, and SOCKS. PPTP is Point-to-Point Tunneling Protocol, uses multi-protocol to access a corporate network over the Internet. It is vulnerable to attacks since it does not have encryptions or authentications. L2TP, Layer 2 Tunneling Protocol, is a protocol created by Cisco. It exists at the data link layer (layer 2) in the OSI model. It also supports non-IP clients and define an encryption standard, so it can support non-Internet based VPNs. IPsec, Internet Protocol Security is a collection of authentications and encryption protocols designed by the Internet Engineering Task Force. It was designed to improve the security of IP-based networks. IPsec is the most favored by VPN vendors. It is most commonly used with VPN as it hides IP addresses. SOCKS is a circuit-level proxy protocol. It provides more security than IPsec, but can be used with IPsec since it can enforce the user-level and application-level access control; IPsec secures the underlying network transport. However, PPTP, L2TP, and IPsec are the most common protocols used. Flow of Encapsulation and Encryption If a business decides to implement a VPN, it must first lease a high-speed circuit from an ISP or common carrier that supports the preferred access rate and access technology for each location. Since it would be too costly to have VPN hardware on the sender or client’s side, the VPN hardware usually resides with the ISP. Take the scenario of an employee accessing secure files on a corporate network. When a client sends a message, each packet of information is encoded with no VPN protocols. Once the packet reaches the ISP’s access server, the packet is sent to a VPN device. The device encapsulates or surrounds the existing packet that already has Application layer, Transport layer, Network layer, and Hardware layer frames encapsulating the primary message. In this scenario, it is assumed that the message is a file being sent through a dial-up connection, using FTP (File Transfer Protocol), to the corporation’s file server. Thus, the application layer adds a FTP segment, transport layer adds a TCP (Transmission Control Protocol) segment, network layer frame adds an IP (Internet Protocol) segment, and the data link layer frame adds a PPP (Point-to-Point Protocol) segment, respectively. In this example, it is also assumed that L2TP is used to encrypt the data. Once the packet reaches the ISP, the VPN device attaches the L2TP segment to the existing frame. At this point, the packet must be surrounded with the destination VPN device’s address. 5 Since this example uses IP as the network layer to identify the destination, an additional IP segment is added onto the packet. Finally, a segment indicating the type of high-speed medium used is attached. This could be a frame for a T1, T3, or OC circuit, each of which has its own data link protocol. At this point, the Internet comes into play in that the newly encrypted packet is sent over the Internet to the corporate office’s FTP server. In effect, a tunnel is created since the process simulates a private packet-switched network. However, before the FTP server can understand the message, the packets must be decrypted by the destination VPN device. The device strips the high-speed medium’s data link frame off the packet and the IP frame to determine whether or not the IP address matches its own. Then the device strips off the VPN protocol frame. Thus, upon removing L2TP from the packet, the packet is now decrypted and can be read by the FTP server. The FTP server follows the same process the client computer originally used, but in reverse. The file the client sent is now stored on the server (Dennis). Tt It is essential to note that in this scenario, since a dial-up line is used, the employee’s side does not necessarily have to have VPN software on its side; POTS (Plain Old Telephone Service) gives a private, dedicated connection between the client’s home and the ISP. If the client had used a cable modem or DSL service to establish a VPN connection between their side and the corporation’s servers, the employee would have to have a VPN client installed in the form of software. This would create a hybrid VPN connection in that the employee would have VPN software installed and the ISP would have VPN hardware. However, using software will inevitably slow the performance of the VPN connection. This will be discussed in the next section. 6 VPN Device Types and their Attributes A VPN can be implemented in three ways – Firewall-based, hardware-based, or software-based. Firewall based VPNs focus on the security aspects of Firewalls. In general, firewalls provide filters to block certain network traffic, ultimately denying certain sources from entering an intranet. Firewall-based VPNs also perform network address translation, provide strong authentication, and offer real-time alarms and extensive logging of activity. Apparently, most commercial firewall vendors “harden” the host operating system by stripping the OS system kernel of dangerous and unnecessary services. In effect, this bolsters the security of the VPN server. Often, the VPN firewalls are routers as well, thus serving as a dual-purpose hardware device. Furthermore, this is a cost-effective solution since there is no need for a separate, standalone router. Hardware-based VPNs are usually encrypting routers in that they encrypt outgoing data and decrypt incoming data. They are often designed as plug-and-play devices, thus attributing both security and ease-of-use to them. The big plus is that they provide the highest network throughput of all VPN systems. However, that positive attribute comes with hefty price tag, generally making it the most expensive VPN solution. Another negative is that they are not as flexible as Software-based systems. Software-based VPNs are ideally suited for environments in which the two end points of the VPN communication are not controlled by the same organization. For example, client support or business partnerships would find this flavor of VPNs especially fitting. Another scenario in which software-based VPNs might be applied is when different firewalls are implemented within the same organization. The nature of software provides programming to normalize itself for diverse operating environments. However, these systems experience lower performance than hardware-based VPNs leaving Software-based VPNs the solution only when efficiency is not a heavy requirement. Furthermore, the benefit of versatility comes with its drawbacks. To be implemented, an IT staff is required to be familiar with the host operating system, the application itself, and appropriate security mechanisms (i.e. – PPTP or L2TP). Some software VPN systems require changes to routing tables and network addressing schemes. The latter can significantly lower productivity in labor and increase labor costs. Thus, the attributes businesses must consider when determining a type of VPN device to use are the following: cost, efficiency, flexibility, and functionality. Firewall-based VPNs offer the most functionality; hardware-based VPNs offer the highest efficiency; Software-based VPNs offer the most flexibility and lowest cost. Implementations of a VPN 7 With the beginning of affordable broadband technologies, small and medium sized businesses can now use the Internet and Virtual Private Networking to bypass expensive, traditional WAN and remote access connections. With VPN solutions a company can tap into the benefits of remote access without the high cost and complex technical infrastructure. Here are some examples of typical VPN applications: Site-to-Site VPNs extend the classic Wide Area Networks by providing large-scale encryption between multiple fixed sites such as remote offices and central offices, over a public network, such as the Internet. VPNs do not inherently change private WAN requirements, such as support for multiple protocols, high reliability, and extensive scalability, but instead meet these requirements more cost-effectively and with greater flexibility. The LAN-to-LAN VPN application sends network traffic over the branch office Internet connection, instead of relying on dedicated leased line connections. This can save thousands of dollars in line costs and reduce overall hardware and management expenses. The intranet VPN is a type of site-to-site network that “provides virtual circuits between organization offices over the Internet” (Dennis 209). The extranet VPN is also a type of site-tosite network that links various businesses in a particular supply chain, both vertically and horizontally. Finally, the most talked about throughout these discussions is the access VPN that enables employees to access an organization’s networks from a remote location. A macro view of the new VPN connectivity (Dennis) Advantages & Disadvantages Virtual Private Networks (VPN) promise two main advantages – cost savings and scalability. In the cost savings category, VPNs lower costs by eliminating the need for expensive longdistance leased lines. A VPN needs only a relatively short dedicated connection to the Internet Service Provider (ISP). The connection could be either a local leased line such as that from a local carrier in a Publicly Switched Telephone Network (PSTN) or a broadband connection, i.e. DSL. Another way VPNs reduce cost is by reducing the long-distance telephone charges for remote access. As discussed earlier, VPN clients only need to dial up to the nearest ISP’s Access Point. VPNs can also reduce costs by transferring the support burden to the service providers. The cost of support is less since public provider’s cost is shared amongst many customers. 8 Finally, VPNs save a company the operational costs for equipment previously used to support remote users. A company using a VPN can get rid of its modem pools, remote access servers and other WAN equipment and simply use its existing Internet installation. In the context of scalability, as organizations grow, the cost of leased lines begins to increase exponentially. With the traditional WAN, when organizations acquire new offices, the cost begins to multiply; mathematicians call this phenomenon a “combinational explosion.” Therefore, traditional WAN’s limit the flexibility of growth. VPNs that utilize the Internet avoid this problem by simply tapping into an almost universally available network for which the infrastructure has already been constructed. VPNs enable corporations to utilize simple Internet infrastructure within ISPs and devices that allow for the easy addition of new users. Therefore, corporations are able to add large amounts of capacity without adding significant infrastructure. How compatible are VPNs? With Broadband Technology – VPNs allow mobile workers, telecommuters and day extenders to take advantage of high speed, broadband connectivity, such as DSL and Cable, when gaining access to their corporate networks, providing workers significant flexibility and efficiency. Furthermore, high-speed broadband connections provide a cost-effective solution for connecting remote offices. With such great advantages one can easily forget about the “weak spots” in the VPN model, but they are important to point out. First of all, VPNs require an in-dept understanding of public network security issues and proper deployment of precautions. Another disadvantage is the availability and performance of an organization’s wide-area VPN, especially over the Internet, depends on factors largely outside of their control. Furthermore, the technologies from different vendors may not work well together due to immature standards. Finally, VPNs need to accommodate protocols other than IP and existing internal network technology. These factors are known as the “hidden costs” of a VPN solution. Remote Access VPN Remote Access VPNs permit secure, encrypted connections between mobile or remote users and their corporate networks via a third-party network, such as a service provider. The client-to-LAN VPN application sends remote user traffic over the user’s Internet connection. The advantage is that the remote user can make a local call to an Internet Service Provider, as opposed to a long distance call to the corporate remote access server. This solution is ideal for a telecommuter or mobile sales people. At the same time, VPN allows mobile workers, telecommuters and day extenders to take advantage of broadband connectivity. Cases in which Businesses use VPNs Anyone may implement a Virtual Private Network. However, the need for it is where the difference comes in. Many businesses have remote users, mobile employees, or business partners that would have to connect to the company network or access resources, information, or just perform any type of communication. To do this securely, so that information cannot be viewed 9 by outside sources, a Virtual Private Network (VPN) would be ideal. This new technology opens up a need for both small and large-scale businesses in regards to network security. Some of the industries that may be using VPN include: • • • • • Healthcare: To be able to privately transfer confidential patient information within the medical facilities and the health care providers. Manufacturing: To be able to track inventory of supplies and allow the suppliers to view this and allow clients to purchase online. Retail: Availability to securely transfer sales data or customer information between stores and the headquarters. Banking/Financial: Enables account information to be transferred safely within departments and branches. General Businesses: Communication between distant employees can be securely exchanged. These are just some of the various industries that may use VPN. Some key findings found by Gartner Consulting on some companies was that: 90% was using VPNs to provide remote access for employees working out of their homes, 79% was using it for remote access for employees while they were traveling, 63% was using it for site-to-site connectivity between offices, and 50% reported using it to provide access to network for business partners/customers. Many companies are now realizing the improvements it’s experiencing in areas besides security and costs, such as employee productivity and communications with employees and customers. From the Dallas Business Journal, “The average U.S. multinational corporation with 100 remote users can save up to $1.8 million dollars over five years by using the internet in lieu of traditional dialup remote access” CVS Corporation, a pharmaceutical company, is an example of one of many businesses that has begun using VPN. They enhanced and converted their already existing frame relay network to an IP VPN. This IP VPN will continue to use their current IP-Enabled Frame Relay Service. This change has helped by improving overall customer service and reducing expenses in security. AT&T states, “This network-based IP VPN provides an evolution path for AT&T frame relay and ATM customers who want the reliability, security, and performance of frame relay along with the flexibility of an IP VPN.” Thus, CVS did not have to give up anything but only enhanced what they already had. CVS has recently implemented new web-based applications that will further involve their new VPN tactics. They are slowly changing their structure in different phases to allow mitigation of the new service. AT&T’s IP VPN has set a standard in network technologies, which is the main reason CVS has a longstanding history and contract with them. Their VPN will not only bring security, efficiency, and reliability, it will also help secure future and long-term capacity of the new IP enabled Frame Relay Service. Open Reach Inc. VPN services is another example of a VPN that helps reduce costs and perform positively for a company’s network. This type of a VPN runs on an “overlay” basis performing above 3rd party Internet service providers. The difference between this and Frame Relay Service that they were using previously would be the 168-bit encryption that it supports. This allows VPN access and configuration through the web. Frame Relay Services uses private lines for security companies such as ITW Foilmark, a manufacturer of stamping foils for the design and 10 packaging industries, saved an estimated $50,000 last year by switching to Open Reach Inc. It also helps to secure business functions such as remote location orders, running reports, and most recently internet/intranet communications which did not have 168-bit encryptions with the Frame Relay Service. This VPN service also allows “as needed connections” which companies set up then close down for rare yet important communications such as monthly reports to corporate offices. Companies such as ITW Foilmark can set up “two-way trust relationships” helping the company to establish access to internal business units and its related companies. Nebo Systems, Inc., which provides EDI services for exchange of medical claims information between healthcare providers and insurance companies, is another company using Open Reach VPN services. “Nebo manages 5 to 6 million transactions a month for 600 sites,” which many of those sites have transactions running over VPN services. (Source: InternetWeek.com) Another company using the VPN technology is the alcoholic beverage producer, Bacardi & Co. Ltd. Bacardi & Co. has implemented a 21-country, 44-location virtual private network provided by Equant, to enable the connection of mobile employees into the corporate network. Equant’s VPN service is based on multi-protocol label switching technology (MPLS), which allows businesses to create extranets with suppliers and customers. (Source: InternetWeek.com) From Future Computing Solutions, Inc.’s (FCSI) website, a case study was done on a Hispanic Cheese manufacturing company in the United States who had approached FCSI to begin VPN services. Before implementing a VPN, the remote employees had to dial into a modem bank in the main office, thus, incurring long distance charges. As for the local employees, they were using local ISPs by using 56K dial-ups and cable modem. After installing VPN, the company saved a huge amount of money and the security of data exchange between employees increased. These are just a few of many various companies that are implementing a Virtual Private Network. The number of businesses using VPN will continue to grow as VPNs are enhanced to fit the needs of different companies. We should expect a positive outlook for VPNs in the future. The Future of VPNs Where do we see Virtual Private Networks going in the future? As far as its appeal to the public it varies substantially. Questions arise of whether businesses need to switch or implement a VPN due to a decrease in the costs of long distance or leased lines. At this point, why would the company want to switch its network when expenses have gone down? Also, companies may worry whether or not their current networks are application friendly if they were to switch to a VPN. If not, factors to consider would be additional costs of the conversion, and if it would be worth the expenses. Furthermore, as VPNs are growing, they are becoming more complex, thus, increasing costs for training. All these lead to hidden costs for the VPN technology, which may hinder the success of a VPN. However, we should expect VPNs to strengthen its standards and products and correct its flaws to avoid these uncertainties. Despite all the doubts, VPN will continue to grow and improve to make VPN dominant in the market; thus, giving companies no choice but to switch. VPN providers along with Internet providers continue to view different aspects possible to be able to make any necessary improvements, and also help VPN clients be comfortable with the new technology. As stated in InformationWeek.com, “…GTE Internetworking, incumbent providers such as Bell Atlantic 11 Corp. and MCI WorldCom…have stepped in to help companies handle VPN activation, security, and management” (By: Terry Sweeney). A case from Internetweek.com speaks of a VPN provider, Equant NV, enhancing their IP VPN by adding a service designed for video traffic, which is directed at large enterprises “that are cutting back on business travel but still want employees to interact regularly with distant colleagues.” Furthermore, as the VPN market becomes larger, more applications will be created along with more VPN providers and new types of VPN. For instance, The University of Rochester is using a VPN provided by Information Technology Services (ITS). Some developments expected in the future by ITS include the following: • • • Developing a software to allow users to change their VPN password automatically. Using an Open Transport-based interface instead of a separate application. Allow more control to local support organizations over VPN so they can create new accounts and be able to reset passwords. The future should also expect networks to converge to create an integrated VPN to fit the many different industries that will soon enter the market. Since majority of VPN users are currently large companies, smaller companies should begin to join the trend due to the increasing variety of VPNs to choose from. Also, designing improved protocols will also improve VPNs. The flexibility and performance of VPNs would then improve also by reducing protocol or data traffic in the tunnels, and customizing the ISP to work more closely with individual business needs since system reliability is dependent on these ISPs. Customer Premises Customer Premises Frame Relay Frame Relay Today IP MPLS ATM Ethernet Multi-service Access Layer - VPN based Future With all these improvements in mind, we should expect a considerably rapid growth of the market for VPN in the future. “The world market for VPN applications and associated services is expected to increase by 275% from 12.8 billion dollars to 48 billion dollars, for the period from 2001 to 2005”. 12