Although SSL can be used within a LAN and in an intranet, it requires a security server (which function IIS fulfills) and can get in the way of applications that are working across a LAN. The answer to this is Internet Protocol Security (IPSec), which works between any two computers over a network to supply encrypted transmission of information without a security server and without getting in the way of applications. IPSec is a part of IP and works at the third (Network) layer, below any applications, and therefore seldom interferes with them.

The IPSec Process IPSec is almost totally automated, and once group policies are established for its operation, network users don't realize that their network communication is taking place securely. The process for establishing and carrying out IPSec is as follows:

1. Domain or local computer policies are established that specify what network traffic needs to be secure and how that security will be handled.
2. Based on the policies, IPSec establishes a set of filters to determine which network packets require secure transmission.
3. When IPSec receives from a sending application a series of network packets that require secure transmission, the sending computer passes this fact to the receiving computer. The two computers exchange credentials and authenticate each other according to IPSec policies.
4. Given authentication, the two computers work out an algorithm whereby each computer can generate the same private key without having to transmit the key over the network, again according to IPSec policies.
5. The sending computer uses the private key to encrypt the packets it is transmitting, digitally signs them so that the receiving computer knows who is sending the packets, and then transmits the packets.
6. The receiving computer authenticates the digital signature and then uses the key to decrypt the packets and send them on to the receiving application.

Posted by: Jack prabha at 01:42 PM | No Comments | Add Comment
Post contains 312 words, total size 2 kb.