What does Virtual Private Network mean?
A virtual private network
) is a secure network that uses primarily public telecommunication infrastructures, such as the Internet, to provide remote offices or traveling users an access to a central organizational network.
VPNs typically require remote users of the network to be authenticated, and often secure data with firewall and encryption technologies to prevent disclosure of private information to unauthorized parties.
There are two types of VPNs; remote access VPNs and site to site VPNs. Remote access VPNs are for individual users who are not in a fixed location - remote or roaming users like salespeople. Site to site VPNs are for multiple users in a fixed location - like regional offices.
VPNs may serve any network functionality that is found on any network, such as sharing of data and access to network resources, printers, databases, websites, etc. A VPN user typically experiences the central network in a manner that is identical to being connected directly to the central network. VPN technology via the public Internet has replaced the need to requisition and maintain expensive dedicated leased-line telecommunication circuits once typical in wide-area network installations.
Virtual private network technology reduces costs because it does not need physical leased lines to connect remote users to an Intranet.
History and status
Virtual private networks have existed for many years in the form of frame relay based private networks. IP-VPNs have become more prevalent in the communications industry due to significant cost reductions, increased bandwidth, and security. These IP based VPNs will ultimately find their way into almost every network based communications activity that occurs whether it be via cellular to cellular, satellite, site-to-site, or inside corporate local area networks.
Types of VPN
VPN systems can be classified by:
- the protocols used to tunnel the traffic
- the tunnel's termination point, i.e., customer edge or network-provider edge
- whether they offer site-to-site or remote-access connectivity
- the levels of security provided
- the OSI layer they present to the connecting network, such as Layer 2 circuits or Layer 3 network connectivity
The following sections discuss some classification schemes.
Secure VPNs use cryptographic tunneling protocols to provide:
- confidentiality by blocking intercepts and packet sniffing, allowing sender authentication to block identity spoofing
- message integrity by preventing message alteration
Secure VPN protocols include the following:
- IPsec (Internet Protocol Security) was developed by the Internet Engineering Task Force (IETF), and was initially developed for IPv6, which requires it. This standards-based security protocol is also widely used with IPv4. Layer 2 Tunneling Protocol frequently runs over IPsec. Its design meets most security goals: authentication, integrity, and confidentiality. IPsec functions by summarizing an IP packet in conjunction with a surrounding packet, and encrypting the outcome.
- Transport Layer Security (SSL/TLS) can tunnel an entire network's traffic, as it does in the OpenVPN project, or secure an individual connection. A number of vendors provide remote access VPN capabilities through SSL. An SSL VPN can connect from locations where IPsec runs into trouble with Network Address Translation and firewall rules.
- Datagram Transport Layer Security (DTLS), is used in Cisco AnyConnect VPN, to solve the issues SSL/TLS has with tunneling over UDP.
- Microsoft Point-to-Point Encryption (MPPE) works with their Point-to-Point Tunneling Protocol and in several compatible implementations on other platforms.
- Microsoft's Secure Socket Tunneling Protocol (SSTP), introduced in Windows Server 2008 and in Windows Vista Service Pack 1. SSTP tunnels Point-to-Point Protocol (PPP) or Layer 2 Tunneling Protocol traffic through an SSL 3.0 channel.
- MPVPN (Multi Path Virtual Private Network). Ragula Systems Development Company owns the registered trademark "MPVPN".
- Secure Shell (SSH) VPN - OpenSSH offers VPN tunneling (distinct from port forwarding) to secure remote connections to a network or inter-network links. OpenSSH server provides a limited number of concurrent tunnels and the VPN feature itself does not support personal authentication.
Tunnel endpoints must authenticate before secure VPN tunnels can be established.
User-created remote access VPNs may use passwords, biometrics, two-factor authentication or other cryptographic methods.
Network-to-network tunnels often use passwords or digital certificates, as they permanently store the key to allow the tunnel to establish automatically and without intervention from the user.
Trusted delivery networks
Trusted VPNs do not use cryptographic tunneling, and instead rely on the security of a single provider's network to protect the traffic.
- Multi-Protocol Label Switching (MPLS) is often used to overlay VPNs, often with quality-of-service control over a trusted delivery network.
- Layer 2 Tunneling Protocol (L2TP) which is a standards-based replacement, and a compromise taking the good features from each, for two proprietary VPN protocols: Cisco's Layer 2 Forwarding (L2F) (obsolete as of 2009) and Microsoft's Point-to-Point Tunneling Protocol (PPTP).
From the security standpoint, VPNs either trust the underlying delivery network, or must enforce security with mechanisms in the VPN itself. Unless the trusted delivery network runs among physically secure sites only, both trusted and secure models need an authentication mechanism for users to gain access to the VPN.