ZXDSL 931WII Operation manual
VPNs are not new. In fact, they have been used in telephone net-
works for years and have become more prevalent since the devel-
opment of the intelligent network.
Frame relay networks, which
have been around for some time, are VPNs.
Virtual private net-
works are only new to IP networks such as the Internet. Therefore,
some authors use the terms Internet VPN and virtual private data
network to distinguish the VPN described in this chapter from other
VPNs. In this book, the term VPN refers to Internet VPN.
The goal of a VPN is to provide a secure passage for data of users
over the non-secure Internet.
It enables companies to use the
Internet as the virtual backbone for their corporate networks by
allowing them to create secure virtual links between their corpo-
rate office and branch or remote offices via the Internet. The cost
benefits of VPN service have prompted corporations to move more
of their data from private
WAN
s to Internet-based VPNs.
ISAKMP
ISAKMP is a definition of a high level abstract framework for point
to point, two party asymmetric key management protocols. Being
asymmetric one party assumes the role of initiator, which begins
the exchange of protocol messages by sending the first message.
The second is the responder which replies to the first message from
the initiator. ISAKMP makes a distinction between a key exchange
and key management (when the key is rolled to the next one).
Key exchange is mainly concerned with exchanging information to
generate secret keys shared between two parties. ISAKMP nego-
tiation is divided into two phases.
In the first phase ISAKMP SA
is established between two entities to protect further negotiation
traffic. The second phase SA is used for some security protocol.
The key exchange protocol must:
�
Generate a set of secret keys shared between the initiator and
the responder.
�
Authenticate the identity of the initiator and the responder.
�
Ensure independence of the sets of keys generated. This prop-
erty is also known as Perfect Forward Secrecy (PFS).
�
Key exchange protocol must be scalable.
Once the keys are generated and shared, there must be some
parameters agreed between the parties to use the keys. The fol-
lowing are the parameters to use the keys:
�
Cryptographic algorithms and parameters to the cryptographic
algorithms to be used with the keys.
�
How to apply the cryptographic algorithms and keys.
�
Key lifetime and refreshment policy.
122
Confidential and Proprietary Information of ZTE CORPORATION
19216811.live