IPSec overhead in wireline and wireless networks for Web and email applications

Abstract

This research focuses on developing a set of secure communication network testbeds and using them to measure the overhead of IP Security (IPSec) for email and web applications. The network testbeds are implemented using both wireline and wireless technologies. The testing involves a combination of authentication algorithms such as Hashed Message Authentication Code-Message Digest 5 (HMAC-MD5) and Hashed Message Authentication Code-Secure Hash Algorithm 1 (HMAC-SHA1), implemented through different authentication protocols such as ESP and AH, and used in conjunction with the Triple Digital Encryption Standard (3DES). The research examines the overhead using no encryption and no authentication, authentication and no encryption, and authentication and encryption. A variety of different sizes of compressed and uncompressed files, are considered when measuring the overhead.The testbed realizes security using IPSec to secure the connection between different nodes. The email protocol that is used is the Simple Mail Transfer Protocol (SMTP) and the web protocol considered is the Hyper Text Transfer Protocol (HTTP). The key metrics considered are the network load in bytes, the number of packets, and the transfer time.This research emphasizes the importance of using HTTP to access files than using SMTP. Use of HTTP requires fewer packets, lower network loads, and lower transfer times than SMTP. It is demonstrated that this difference, which occurs regardless of security, is magnified by the use of authentication and encryption. The results also indicate the value of using compressed files for file transfers. Compressed and uncompressed files require the same transfer time, network load and number of packets since FreeS/WAN IPSec does not carry any form of compression on the data before passing it to the data link layer. Both authentication algorithms, HMAC-MD5 and HMAC-SHA1, result in about the same network load and number of packets. However, HMAC-SHA1 results in a higher transfer time than HMAC-MD5 because of SHA1's higher computational requirements. ESP authentication and ESP encryption reduce the network load for small files only, compared to ESP encryption and AH authentication. ESP authentication could not be compared with AH authentication, since the FreeS/WAN IPSec implementation used in the study does not support ESP authentication without using encryption. In a wireless environment, using IPSec does not increase the network load and the number of transactions, when compared to a wireline environment. Also, the effect of security on transfer time is higher compared to a wireline environment, even though that increase is overshadowed by the high transfer time percentage increase due to the wireless medium.iii

IPSec: Performance Analysis and Enhancements

“…IPSec was the focus of work in [14], where the authors examined the ESP and AH encapsulation overheads. However, a comprehensive picture of IPSec overheads was not presented because the performance penalty associated with the IKE process was not examined.…”

LIPS: A lightweight permit system for packet source origin accountability

“…Due to the rigid requirement of pre-existing credentials, they are difficult to deploy. In the meantime, they all bear heavy overheads [7,8] in Security Association (SA) management, heavy cryptographic check, and maintaining per-flow states. Similarly, the visa protocols [9] use encryption and data signatures to authenticate a flow of packets.…”

LIPS: Lightweight Internet Permit System for Stopping Unwanted Packets

“…Note that not all hosts will be allowed to access H 2 . A security policy at H 2 is checked to determine if H 2 accepts this permit request 4 . If it does, it generates an access permit (H 2 's DAP for H 1 ), containing a secure hash value generated based on a secret hash key of H 2 and a plain hash message about H 1 (e.g., H 1 's IP address).…”

“…They require a shared key to be established between access control servers on a per-source-destination basis. Similarly, IPsec and VPNs establish shared keys to secure end-to-end communications with known overheads [4]. Several traceback schemes were proposed to track down attacking sources, such as IP traceback.…”