Q19Information Security Systems

SSL/TLS operates at the Application/Transport layer (securing only a specific browser session). IPSec is a massive suite of protocols operating at the absolute Network Layer (Layer 3) of the OSI model. Its mathematical goal is to violently encrypt and authenticate EVERY SINGLE IP PACKET leaving a computer or router, providing invisible, mandatory security to all higher-level applications.

IPSec executes its security using two highly distinct mathematical architectures:

• Authentication Header (AH): Focuses strictly on Integrity and Authentication. It mathematically hashes the entire IP packet (including the IP headers) and attaches a cryptographic signature. It absolutely prevents spoofing and tampering, but provides ZERO confidentiality. The data payload is sent in plain text.
• Encapsulating Security Payload (ESP): The workhorse of IPSec. It violently encrypts the data payload using AES-256 (Confidentiality) and mathematically hashes it (Integrity). However, standard ESP does not authenticate the outermost IP headers.

IPSec can execute its cryptographic protocols in two distinct architectural modes:

Transport Mode (End-to-End Security)

Utilized for securing a direct connection between two specific computers (Host-to-Host).

• Mechanism: The ESP header is aggressively injected directly between the original IP Header and the TCP payload. Only the TCP payload is mathematically encrypted.
• Execution: The original IP Header remains completely intact and visible. The internet routers can read the source and destination IPs to route the packet normally.
• Demerit: Hackers can execute Traffic Analysis. They cannot read the data, but they can see that the CEO's IP address is constantly talking to the Swiss Bank's IP address.

Tunnel Mode (Site-to-Site VPN Security)

The absolute foundation of corporate VPNs, linking a Branch Office router to the HQ router over the public internet.

• Mechanism: The absolute entire original IP packet (Payload + Original IP Header) is violently encrypted by the branch router.
• Execution: The router then generates a brand NEW, completely distinct public IP Header and wraps it around the encrypted blob. The new IP header simply lists the branch router as the source and the HQ router as the destination.
• Merit: Absolute catastrophic defeat of Traffic Analysis. Hackers see massive encrypted traffic flowing between two routers, but they have absolutely zero mathematical ability to see the internal IPs of the actual computers communicating inside the tunnel.