Avaya Configuring IP Security Services Manuel d'utilisateur télécharger pdf (Page 29)

Overview of IPsec

304111-B Rev 00

1-11

Security Associations

A security association (SA) is a relationship in which two peers share the

necessary information to securely protect and unprotect data. An IPsec SA is

uniquely identified by an IP destination address, security parameter index (SPI),

and security protocol identifier (for example, ESP in tunnel mode).

An IPsec policy determines which packets will be handled. An IPsec SA specifies

which IPsec security service (for example, confidentiality) IPsec will apply to the

packets. You can apply one or more IPsec security services.

SAs themselves must be created and shared in a secure manner. There are two

ways of achieving this: by using the automated security negotiation process

provided by the Internet Key Exchange (IKE) protocol; or by manually

configuring the sending and receiving devices with a shared secret. A shared

secret is a unique security identifier.

Automated Security Associations Using Internet Key Exchange (IKE)

Internet Key Exchange (IKE) is an automated protocol to establish security

associations over the Internet. (IKE is also referred to as the Internet Security

Association Key Management Protocol with Oakley Key Determination, or

ISAKMP/Oakley.) IKE handles negotiating, establishing, modifying, and deleting

security associations.

To set up these security associations, IKE itself must create a confidential, secure

connection between the sender and receiver. Authentication is accomplished with

one or more of the following:

• Pre-shared keys: These are set up ahead of time at each node in a transaction.

• Public key cryptography: Using the RSA public key algorithm, each

member of a transaction authenticates itself to the other using the other

member’s public key to encrypt an authentication value.

• Digital signature: Each member of a transaction sends a digital signature to

the other. The signatures are authenticated using the member’s public key,

obtained via an X.509 digital certificate.

The BayRS implementation of IKE uses pre-shared keys only.

1 2 ... 24 25 26 27 28 29 30 31 32 33 34 ... 99 100

Pas de commentaire

Avaya Configuring IP Security Services Manuel d'utilisateur Page 29