Virtual private network |
A Virtual Private Network, or VPN, is a private communications network usually used within a company, or by several different companies or organizations, to communicate over a public network. VPN message traffic is carried on public networking infrastructure (e.g. the Internet) using standard (often insecure) protocols, or over a service provider s network providing VPN service guarded by well defined Service Layer Agreement (SLA) between the VPN customer and the VPN service provider.
= Authentication mechanism =
Generally, a firewall (networking) sits between a remote user s workstation or client and the host network or server. The firewall may pass authentication data to an authentication service in a host network. A known trusted person with privileged access, sometimes only using trusted devices, can be allowed to access resources not available to general users. That s why the user feels that the network is private, even though it is not.
Many VPN client programs can be configured to require that all IP traffic must pass through the tunnel while the VPN is active, for better security. From the user s perspective, this means that while the VPN client is active all access outside their employer s secure network must pass through the same firewall as would be the case while physically connected to the office ethernet. This reduces the risk that an attacker might gain access to the secured network by attacking the employee s laptop: to other computers on the employee s home network, or on the public internet, it is as though the machine running the VPN client simply does not exist. Such security is important because other computers local to the network on which the client computer is operating may be untrusted or partially trusted. Even with a home network that is protected from the outside internet by a firewall, people who share a home may be simultaneously working for different employers over their respective VPN connections from the shared home network. Each employer would therefore want to ensure their proprietary data is kept secure, even if another computer in the local network gets infected with malware. And if a travelling employee uses a VPN client from a Wi-Fi access point in a public place, such security is even more important.
= Types of VPNs =
Secure VPNs use cryptographic tunneling protocols to provide the necessary confidentiality (preventing Intercept), sender authentication (preventing Identity#Digital identity Spoofing attack), and message Integrity#Cryptography (preventing message alteration) to achieve the privacy intended. When properly chosen, implemented, and used, such techniques can provide secure communications over unsecured networks.
Because such choice, implementation, and use are not trivial, there are many insecure VPN schemes on the market.
Secure VPN technologies may also be used to enhance security as a security overlay within dedicated networking infrastructures.
Secure VPN protocols include the following:
Some large Internet service providers now offer managed VPN service for business customers who want the security and convenience of a VPN but prefer not to undertake administering a VPN server themselves. In addition to providing remote workers with secure access to their employer s internal network, sometimes other security and management services are included as part of the package, such as keeping anti-virus and anti-spyware programs updated on each client s computer.
Trusted VPNs do not use cryptographic tunneling, and instead rely on the security of a single provider s network to protect the traffic. Multi-protocol label switching (MPLS) is commonly used to build trusted VPNs. Other protocols for trusted VPNs include:
= Characteristics in application =
A well-designed VPN can greatly benefit a company. For example, it can:
However, since VPNs extend the mother network by such an extent (almost every employee) and with such ease (no dedicated lines to hire), there are certain security implications that have to receive special attention:
= Tunneling =
Tunneling, also known as port forwarding, is the transmission of data intended for use only within a private, usually corporate network through a public network in such a way that the routing nodes in the public network are unaware that the transmission is part of a private network. Tunneling is generally done by encapsulating the private network data and protocol information within the public network transmission units so that the private network protocol information appears to the public network as data. Tunneling allows the use of the Internet, which is a public network, to convey data on behalf of a private network.
= External links =
|
|