Scribd Logo
Upload

Welcome to Scribd!

  • 39 views

    Information and Network Security: Topic Name:-Combining Security Associations

    Uploaded by

    Mohini Chorat
    The document discusses combining security associations (SAs) in IPsec. There are two main ways to combine SAs: transport adjacency, which applies multiple security protocols to the same packet without tunneling, allowing one level of nesting; and iterated tunneling, which applies multiple layers of security protocols through IP tunneling, allowing multiple levels of nesting. The document outlines four basic combinations of SAs that must be supported between hosts or gateways, including applying AH or ESP in transport mode alone or together, or nested inside an AH or ESP SA in tunnel mode.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    Information and Network Security: Topic Name:-Combining Security Associations

    Uploaded by

    Mohini Chorat
    39 views5 pages
    The document discusses combining security associations (SAs) in IPsec. There are two main ways to combine SAs: transport adjacency, which applies multiple security protocols to the same packet without tunneling, allowing one level of nesting; and iterated tunneling, which applies multiple layers of security protocols through IP tunneling, allowing multiple levels of nesting. The document outlines four basic combinations of SAs that must be supported between hosts or gateways, including applying AH or ESP in transport mode alone or together, or nested inside an AH or ESP SA in tunnel mode.

    Original Title

    Ins

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses combining security associations (SAs) in IPsec. There are two main ways to combine SAs: transport adjacency, which applies multiple security protocols to the same packet without tunneling, allowing one level of nesting; and iterated tunneling, which applies multiple layers of security protocols through IP tunneling, allowing multiple levels of nesting. The document outlines four basic combinations of SAs that must be supported between hosts or gateways, including applying AH or ESP in transport mode alone or together, or nested inside an AH or ESP SA in tunnel mode.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    39 views5 pages

    Information and Network Security: Topic Name:-Combining Security Associations

    Uploaded by

    Mohini Chorat
    The document discusses combining security associations (SAs) in IPsec. There are two main ways to combine SAs: transport adjacency, which applies multiple security protocols to the same packet without tunneling, allowing one level of nesting; and iterated tunneling, which applies multiple layers of security protocols through IP tunneling, allowing multiple levels of nesting. The document outlines four basic combinations of SAs that must be supported between hosts or gateways, including applying AH or ESP in transport mode alone or together, or nested inside an AH or ESP SA in tunnel mode.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 5

    INFORMATION AND NETWORK SECURITY

    TOPIC NAME:-COMBINING SECURITY ASSOCIATIONS

    Name:-Mohini Chorat
    class:-Tycs
    Roll No:-217504
    INTRODUCTION

    An individual SA can implement either the AH or ESP protocol but not both.
    Sometimes a particular traffic flow will call for the services provided by both AH
    and ESP. Further, a particular traffic flow may require IPsec services between hosts
    and, for that same flow, separate services between security gateways, such as fire-
    walls. In all of these cases, multiple SAs must be employed for the same traffic flow
    to achieve the desired IPsec services. The term security association bundle refers to
    a sequence of SAs through which traffic must be processed to provide a desired set
    of IPsec services. The SAs in a bundle may terminate at different endpoints or at
    the same endpoints.
    Security associations may be combined into bundles in two ways:

    • Transport adjacency: Refers to applying more than one security protocol to the same IP packet
    without invoking tunneling. This approach to combining AH and ESP allows for only one level of
    combination; further nesting yields no added benefit since the processing is performed at one IPsec
    instance: the (ultimate) destination.

    • Iterated tunneling: Refers to the application of multiple layers of security protocols effected through
    IP tunneling. This approach allows for multiple levels of nesting, since each tunnel can originate or
    terminate at a different IPsec site along the path.
    The two approaches can be combined, for example, by having a transport SA
     between hosts travel part of the way through a tunnel SA between security g
    ateways. One interesting issue that arises when considering SA bundles is
    the order in which authentication and encryption may be applied between a g
    iven pair of endpoints and the ways of doing so. We examine that issue next. 
    Then we look at combinations of SAs that involve at least one tunnel.
    Basic Combinations of Security Associations

    The IPsec Architecture document lists four examples of combinations of SAs that must be
    supported by compliant IPsec hosts (e.g., workstation, server) or security gateways (e.g. firewall,
    router). The lower part of each case in the figure represents the physical connectivity of the
    elements; the upper part represents logical connectivity via one or more nested SAs. Each SA can
    be either AH or ESP. For host-to-host SAs, the mode may be either transport or tunnel; otherwise it
    must be tunnel mode.

    Case 1. All security is provided between end systems that implement IPsec. For any two end systems to communicate via an SA, they must share
    the appropri- ate secret keys. Among the possible combinations are

    a. AH in transport mode

    b. ESP in transport mode

    c. ESP followed by AH in transport mode (an ESP SA inside an AH SA)

    d. Any one of a, b, or c inside an AH or ESP in tunnel mode

    We have already discussed how these various combinations can be used to support authentication, encryption, authentication before encryption,
    and authenti- cation after encryption

    You might also like