Q15Information System Security
Question
4 marks
Discuss the architecture of IPSec.
Answer
A critical review of the IPSec architecture. Explains how the Authentication Header (AH) and Encapsulating Security Payload (ESP) protocols violently secure the OSI Network Layer across Transport and Tunnel modes.
IPSec is a massive, highly complex suite of protocols designed to mathematically secure communications at the absolute Network Layer (Layer 3) of the OSI model. Unlike SSL/TLS which only protects a single browser tab, IPSec violently intercepts every single IP packet leaving the machine and encrypts it, providing invisible, mandatory security to all applications.
- 1. Authentication Header (AH): This protocol provides absolute Data Integrity and Data Origin Authentication. It mathematically calculates a MAC (Message Authentication Code) over the entire IP packet (including the headers). It violently prevents hackers from spoofing IP addresses, but it provides ZERO Confidentiality. The data is still sent in plaintext.
- 2. Encapsulating Security Payload (ESP): The absolute workhorse of IPSec. ESP provides Data Confidentiality by aggressively encrypting the payload (using AES-256). It also provides Integrity (via hashing), but unlike AH, it does not authenticate the outermost IP header.
- Transport Mode: Used strictly for Host-to-Host communication. The ESP header is violently injected between the original IP header and the TCP payload. The original IP header remains visible so routers can move the packet, but the payload is mathematically locked.
- Tunnel Mode: The absolute foundation of Site-to-Site VPNs. The ENTIRE original IP packet (Payload + IP Header) is violently encrypted. A completely NEW outer IP header is attached. This provides absolute security because hackers cannot even see the internal IP addresses communicating inside the tunnel.