Search

In the near future, commercially accessible quantum computers are anticipated to revolutionize the world as we know it. These advanced machines are predicted to render traditional cryptographic security measures, deeply ingrained in contemporary communication, obsolete. While symmetric cryptography methods like AES can withstand quantum assaults if key sizes are doubled compared to current standards, asymmetric cryptographic techniques, such as RSA, are vulnerable to compromise. Consequently, there is a pressing need to transition towards post-quantum cryptography (PQC) principles in order to safeguard our privacy effectively. A challenge is to include PQC into existing protocols and thus into the existing communication structure. In this work, we report on the first experimental IPsec tunnel secured by the PQC algorithms Falcon, Dilithium, and Kyber. We deploy our IPsec tunnel in two scenarios. The first scenario represents a high-performance data center environment where many machines are interconnected via high-speed networks. We achieve an IPsec tunnel with an AES-256 GCM encrypted east–west throughput of 100 Gbit/s line rate. The second scenario shows an IPsec tunnel between a wireless NVIDIA Jetson and the cloud that achieves a 0.486 Gbit/s AES-256 GCM encrypted north–south throughput. This case represents a mobile device that communicates securely with applications running in the cloud. [ABSTRACT FROM AUTHOR]

Nowadays, some of the most well-deployed infrastructures are Virtual Private Networks (VPNs) and Overlay Networks (ONs). They consist of hardware and software components designed to build private/secure channels, typically over the Internet. They are currently among the most reliable technologies for achieving this objective. VPNs are well-established and can be patched to address security vulnerabilities, while overlay networks represent the next-generation solution for secure communication. In this paper, for both VPNs and ONs, we analyze some important network performance components (RTT and bandwidth) while varying the type of overlay networks utilized for interconnecting traffic between two or more hosts (in the same data center, in different data centers in the same building, or over the Internet). These networks establish connections between KVM (Kernel-based Virtual Machine) instances rather than the typical Docker/LXC/Podman containers. The first analysis aims to assess network performance as it is, without any overlay channels. Meanwhile, the second establishes various channels without encryption and the final analysis encapsulates overlay traffic via IPsec (Transport mode), where encrypted channels like VTI are not already available for use. A deep set of traffic simulation campaigns shows the obtained performance. [ABSTRACT FROM AUTHOR]

As an emerging technology that combines both digital and physical realms, access to information technology has expanded (IoT) the Internet of Things. The Internet of Things, as it becomes more pervasive, will overshadow human life as much as possible. Some of the major challenges associated with the development of this phenomenon have been the issue of security, which is needed in all its layers and even specifically in individual layers. According to the structure and applications of the Internet of Things, as well as the threats and challenges in cyberspace, we first examine security needs and then, by examining some methods of securing the Internet of Things, we propose a method according to the approaches discussed. [ABSTRACT FROM AUTHOR]

The data transmission of the heaven and the earth integrated network based on IP(Internet Protocol) technology is vulnerable to illegal attacks. The traditional network security device based on IPSec(Internet Protocol Security) is designed by connecting a single host to both internal and external network processing units, which has the risk of unauthorized users directly accessing the protected intranet through the extranet. A new scheme for a network security device based on a red-black isolation architecture is proposed. The scheme adopts the design concept of red-black partition and VPN technology based on IPSec framework under Linux. It implements the validity verification of the transmitted data based on the "quintuple" security and security rules and the encapsulation and decapsulation transformation of the IPSec ESP protocol in the red zone, and implements the public network sending and receiving of the ESP encapsulated and encrypted data in the black zone. In this scheme, the security service module implements dynamic switching of encryption algorithms and encryption and decryption of ESP encapsulated data according to external instructions, and uses the security service module as a data exchange channel between the red and black zones to achieve isolation between the internal and external networks and effectively ensure Intranet security. The experimental results show that the network security device based on red-black isolation architecture has the advantages of strong anti-attack capability, replaceable encryption algorithm, and encryption rate of 1 024 bytes packet length greater than 50 Mbit·s-1 under 100 megabit bandwidth. [ABSTRACT FROM AUTHOR]

Nowadays, some of the most well-deployed infrastructures are Virtual Private Networks (VPNs) and Overlay Networks (ONs). They consist of hardware and software components designed to build private/secure channels, typically over the Internet. They are currently among the most reliable technologies for achieving this objective. VPNs are well-established and can be patched to address security vulnerabilities, while overlay networks represent the next-generation solution for secure communication. In this paper, for both VPNs and ONs, we analyze some important network performance components (RTT and bandwidth) while varying the type of overlay networks utilized for interconnecting traffic between two or more hosts (in the same data center, in different data centers in the same building, or over the Internet). These networks establish connections between KVM (Kernel-based Virtual Machine) instances rather than the typical Docker/LXC/Podman containers. The first analysis aims to assess network performance as it is, without any overlay channels. Meanwhile, the second establishes various channels without encryption and the final analysis encapsulates overlay traffic via IPsec (Transport mode), where encrypted channels like VTI are not already available for use. A deep set of traffic simulation campaigns shows the obtained performance.

This article deals with the potential of digitalization to improve participants' skills in the agri-food market. The topic of improving technical mechanisms and software technologies aimed at the qualitative development of e-education in Russia is being updated. The problems of providing the agri-food market with skilled personnel are analyzed. The problems of terminological uncertainty concerning the concepts of digitalization and distance education in computer sciences (informatics), information sciences, and other related scientific fields that have a negative impact on the overall wide turnover of scientific research, are touched upon. The authors propose a single generalized nonhierarchical technological model of the organization of e-education, schematically describing a set of software technologies in the form of a cloud telecommunications system. Particularly, it is recommended to use multicasting technologies and adaptive network means of signal delivery to promote educational content in the form of internet television. The basic integrative network tools and protocols for the specific organization of electronic educational activities via internet television are technically annotated. The conclusions briefly and conceptually reflect the course of the research, as well as the logic of the material analyzed by the authors, summarizing the research work done and to provide some recommendations for the operation of multicasting technology in the form of internet television in Russia. [ABSTRACT FROM AUTHOR]

In the ever-evolving digital era, integration of onpremise server infrastructure with cloud servers has become an important focus for many companies. The problem faced is regarding connections that use public IP addresses directly, which are often vulnerable to various security risks and cyber threats. Therefore, this research aims to identify and overcome the main problems that arise in this integration. With a better understanding of these challenges, developers and organizations can improve the security of their hybrid server infrastructure. The research methodology uses Mikrotik IPsec and VPN Tunnel IKEv2 on Google Cloud services. This approach is utilized to increase connection security between onpremise servers and cloud servers. First, the author configures Mikrotik IPsec on the onpremise server and sets up the IKEv2 VPN Tunnel on Google Cloud services. Next, the author carried out practical tests by sending data between the two infrastructures and monitoring the security and stability of the connection. With these steps, we can evaluate the effectiveness of security solutions implemented in a hybrid server environment. The research results show that this approach is successful in securing the connection between the two infrastructures, reducing potential risks such as sniffing, port scanning attacks, brute force, DDOS, and other cyber threats. Moreover, during practical trials, the connection remained stable and performed optimally, demonstrating the effectiveness of the proposed solution in improving the security of hybrid server infrastructure. These results can provide concrete evidence that using Mikrotik IPsec and VPN Tunnel IKEv2 on Google Cloud services can be an effective step in securing communications between onpremise servers and cloud servers. Thus, this research provides valuable guidance for developers and organizations looking to implement similar solutions. [ABSTRACT FROM AUTHOR]

El espacio de direcciones IPv4 está a punto de llegar a su límite y podría colapsar, para corregir este evento muchos proponen que las redes existentes deberán realizar la migración definitiva a IPv6, tomando como referencia que este protocolo permitirá un mayor espacio de direcciones IP, brindando nuevas oportunidades y corrigiendo los problemas existentes en el protocolo de la versión anterior. Sin embargo, debido al aumento de la sobrecarga en IPv6 y su interacción con routers de borde y sistemas operativos que alojan este protocolo de comunicación, se pueden ocasionar evidentemente problemas de rendimiento en la red. El presente artículo se basa en una investigación cuantitativa utilizando un método que permite analizar el rendimiento de redes basadas en IPv6 con IPSec haciendo uso de la simulación con GNS3, con dicha herramienta compara resultados con tres escenarios típicos de implementación en relación a la topología original del presente trabajo, su evaluación determina la diferencia de rendimiento entre escenarios cuando se genera tráfico de una red a otra y se obtiene de entre ellos el un escenario con mejor estabilidad y rendimiento utilizando una metodología experimental, con lo que logramos constatar que su escenario homólogo con utilización de túneles en más óptimo en relación al propuesto en esta investigación, tomando en consideración que las métricas analizadas son ancho de banda, latencia y jitter.

The Internet of Things (IoT) has rapidly grown in recent years, making it an integral part of many areas of our lives. Many IoT networks require high data throughput and low latency, allowing for real-time communication and data transmission, enabling improved efficiency, cost savings, and enhanced decision-making capabilities in various industries such as manufacturing, healthcare, transportation, and smart cities. However, with the increasing amount of data being transmitted, the security of high-speed IoT networks becomes a critical concern. In this paper, we proposed a hardware architecture for Ascon, a NIST Lightweight cryptography standard to enable high-throughput, low-latency security services in IPSec protocols. Results show that the ESP protocol can achieve a maximum throughput of 8.806 Gbps and a minimum latency of 427ns for only 2812 Slice. This ESP core together with the proposed Ascon implementation can be used in IoT gateways to provide security services for high-speed, low-latency IoT networks.

In this paper, we propose a novel, collaborative distributed platform to discover the presence, or analyse the configuration, of what we call semi-active elements. By doing so, we revisit the ideas initially proposed in [1, 2] with the Netalyzr tool and in [3] with Inmap-t. Our contributions lie in a simplified and more powerful design that enables the platform to be used for a variety of tasks, such as conformance verification, security testing, network configuration understanding, etc. The specifications, design and implementation choices of the platform are presented and discussed. Two use cases are revealed to illustrate how the platform can be used. We welcome any interest shown by others in deploying our tool in different environments, and encourage any subsequent collaboration in improving its expressiveness.

Virtual private network (VPN) represents an HW/SW infrastructure that implements private and confidential communication channels that usually travel through the Internet. VPN is currently one of the most reliable technologies to achieve this goal, also because being a consolidated technology, it is possible to apply appropriate patches to remedy any security holes. In this paper we analyze the performances of open source firmware OpenWrt 21.x compared with a server-side operating system (Debian 11 x64) and Mikrotik 7.x, also virtualized, and different types of clients (Windows 10/11, iOS 15, Android 11, OpenWrt 21.x, Debian 11 x64 and Mikrotik 7.x), observing the performance of the network according to the current implementation of the various protocols and algorithms of VPN tunnel examined on what are the most recent HW and SW for deployment in outdoor locations with poor network connectivity. Specifically, operating systems provide different performance metric values for various combinations of configuration variables. The first pursued goal is to find the algorithms to guarantee a data transmission/encryption ratio as efficiently as possible. The second goal is to research the algorithms capable of guaranteeing the widest spectrum of compatibility with the current infrastructures that support VPN technology, to obtain a connection system secure for geographically scattered IoT networks spread over difficult-to-manage areas such as suburban or rural environments. The third goal is to be able to use open firmware on constrained routers that provide compatibility with different VPN protocols. [ABSTRACT FROM AUTHOR]

In this paper, we propose a novel, collaborative distributed platform to discover the presence, or analyse the configuration, of what we call semi-active elements. By doing so, we revisit the ideas initially proposed in [1, 2] with the Netalyzr tool and in [3] with Inmap-t. Our contributions lie in a simplified and more powerful design that enables the platform to be used for a variety of tasks, such as conformance verification, security testing, network configuration understanding, etc. The specifications, design and implementation choices of the platform are presented and discussed. Two use cases are revealed to illustrate how the platform can be used. We welcome any interest shown by others in deploying our tool in different environments, and encourage any subsequent collaboration in improving its expressiveness. [ABSTRACT FROM AUTHOR]

The introduction of IPsec into software-defined networking (SDN) can secure communication in an SDN southbound interface, i.e., communication between the controllers and the switches. However, due to the static configuration of IPsec cryptographic algorithms, the invocation of these algorithms cannot dynamically self-adapt to traffic fluctuations in SDN southbound communication. To address the contradiction between link security and communication performance incurred by IPsec encryption, an evaluation model to find a trade-off between communication performance and link security is presented in this paper. An invocation mechanism based on the Free-to-Add (FTA) method is also proposed to optimize the invocation mode of cryptographic algorithms in traditional IPsec. Based on the real-time network status and the impact of the IPsec encryption process on the network latency and throughput, a feedback-based scheduling scheme is designed to enable the IPsec algorithms in use to be flexibly replaced and synchronously switched, and two policies are applied to determinate the appropriate encryption algorithm(s). The validity and effectiveness of the FTA-based mechanism are verified and evaluated on an SDN/OpenFlow platform in which IPsec security gateways are deployed. The feedback-based scheduling scheme is evaluated in terms of packet processing latency, distribution of optional encryption intensity, and the hit rate of encryption intensity.

In this work, we present P4-IPsec, a concept for IPsec in software-defined networks (SDN) using P4 programmable data planes. The prototype implementation features ESP in tunnel mode and supports different cipher suites. P4-capable switches are programmed to serve as IPsec tunnel endpoints. We also provide a client agent to configure tunnel endpoints on Linux hosts so that site-to-site and host-to-site application scenarios can be supported which are the base for virtual private networks (VPNs). While traditional VPNs require complex key exchange protocols like IKE to set up and renew tunnel endpoints, P4-IPsec benefits from an SDN controller to accomplish these tasks. One goal of this experimental work is to investigate how well P4-IPsec can be implemented on existing P4 switches. We present a prototype for the BMv2 P4 software switch, evaluate its performance, and publish its source code on GitHub [1]. We explain why we could not provide a useful implementation with the NetFPGA SUME board. For the Edgecore Wedge 100BF-32X Tofino-based switch, we presented two prototype implementations to cope with a missing crypto unit. As another contribution of this paper, we provide technological background of P4 and IPsec and give a comprehensive review of security applications in P4, IPsec in SDN, and IPsec data plane implementations. According to our knowledge, P4-IPsec is the first implementation of IPsec for P4-based SDN.

The transmission control protocol (TCP) is an internet protocol used to send data across networks. When encrypted data are sent across networks, additional overhead is incurred. The data to be secured through encryption must be transformed from plain text to Ciphertext, resulting in data size increase. In this paper, the overhead effect of data encryption on TCP throughput across an internet protocol security (IPSec) network was investigated. In particular, we compared the additional data sizes of encrypted data to that of non-encrypted data, and their speed during transmission, respectively, using the iPerf3 simulator. Specifically, a comparative analysis between the actual transfer time of encrypted and non-encrypted data was investigated. The result showed that transmission times vary for different data sizes that were secured through encryption. Encrypted data had higher transfer time across the network. Additionally, the transfer time across the network was found to be consistent as data size increased with non-encrypted data. Encrypted data, on the other hand, were found to have inconsistent increase in data size with the same set of data sizes due to padding resulting in higher transfer time across thenetwork.

Virtual private network (VPN) represents an HW/SW infrastructure that implements private and confidential communication channels that usually travel through the Internet. VPN is currently one of the most reliable technologies to achieve this goal, also because being a consolidated technology, it is possible to apply appropriate patches to remedy any security holes. In this paper we analyze the performances of open source firmware OpenWrt 21.x compared with a server-side operating system (Debian 11 x64) and Mikrotik 7.x, also virtualized, and different types of clients (Windows 10/11, iOS 15, Android 11, OpenWrt 21.x, Debian 11 x64 and Mikrotik 7.x), observing the performance of the network according to the current implementation of the various protocols and algorithms of VPN tunnel examined on what are the most recent HW and SW for deployment in outdoor locations with poor network connectivity. Specifically, operating systems provide different performance metric values for various combinations of configuration variables. The first pursued goal is to find the algorithms to guarantee a data transmission/encryption ratio as efficiently as possible. The second goal is to research the algorithms capable of guaranteeing the widest spectrum of compatibility with the current infrastructures that support VPN technology, to obtain a connection system secure for geographically scattered IoT networks spread over difficult-to-manage areas such as suburban or rural environments. The third goal is to be able to use open firmware on constrained routers that provide compatibility with different VPN protocols.

Current vehicles are increasingly dependent on Electronic Control Units (ECUs) that control virtually every system of the vehicle. To enable advanced features automotive embedded systems are opening to external world, which raises security concerns. At the same time these innovative systems require more complex software and higher bandwidth for information exchange. Thanks to its bandwidth, payload size, and openness, Ethernet is a candidate technology for future in-vehicle architectures. This paper deals with design of a novel approach to secure In-vehicle Systems by taking advantage of Ethernet/IP technology and proven security mechanisms from TCP/IP model. Main goal is to design an efficient solution that meets requirements for latency without requiring high amounts of processing power and provides secure exchange of control messages. The work is mainly focused on the widespread Controller Area Network (CAN). The presented solution is based on encapsulation of CAN frames into UDP datagrams with added authenticity, integrity, and (if required) confidentiality of communication using IPsec protocol in transport mode. This creates a "secure tunnel across backbone Ethernet network in a vehicle. Next part of the paper presents extensive tests in simulation that are based on our previous experiments on hardware, in order to evaluate the characteristics of the designed security extension. The results indicate that using IPsec is a viable solution for securing in-vehicle communications. [ABSTRACT FROM AUTHOR]