Virtual private network
Introduction
VPNisaremoteaccesstechnology,whichissimplytouseapublicnetworktosetupaprivatenetwork.Forexample,anemployeeofacompanytravelstoanotherplace,andhewantstoaccesstheserverresourcesofthecompany'sintranet.Thistypeofaccessisremoteaccess.
Inthetraditionalenterprisenetworkconfiguration,tocarryoutremoteaccess,thetraditionalmethodistorentaDDN(digitaldatanetwork)dedicatedlineorframerelay.Suchacommunicationschemewillinevitablyleadtohighnetworkcommunicationandmaintenancecosts.Formobileusers(mobileofficeworkers)andremoteindividualusers,theygenerallyenterthecorporateLANthroughadial-upline(Internet),butthiswillinevitablybringsecurityrisks.
Fornon-localemployeestoaccessintranetresources,thesolutiontousingVPNistosetupaVPNserverintheintranet.Afterthenon-localemployeesconnecttotheInternetlocally,theyconnecttotheVPNserverthroughtheInternet,andthenenterthecorporateintranetthroughtheVPNserver.Inordertoensuredatasecurity,thecommunicationdatabetweentheVPNserverandtheclientisencrypted.Withdataencryption,itcanbeconsideredthatdataissafelytransmittedonadedicateddatalink,justlikeadedicatednetworkissetup,butinfactVPNusesapubliclinkontheInternet,soVPNiscalledVirtualprivatenetwork,inessence,usesencryptiontechnologytoencapsulateadatacommunicationtunnelonthepublicnetwork.WithVPNtechnology,userscanuseVPNtoaccessinternalnetworkresourceswhethertheyareonabusinesstriporworkathomeaslongastheycanaccesstheInternet.ThisiswhyVPNsaresowidelyusedinenterprises.
Workingprinciple
Usually,theVPNgatewayadoptsadualnetworkcardstructure,andtheexternalnetworkcardusesthepublicnetworkIPtoaccesstheInternet.
TerminalAofnetworkone(assumedtobethepublicinternet)accessesterminalBofnetworktwo(assumedtobethecompany'sintranet),andthedestinationaddressoftheaccesspacketsentbyitisTheinternalIPaddressofterminalB.
TheVPNgatewayofnetworkonechecksitstargetaddresswhenitreceivestheaccessdatapacketsentbyterminalA.Ifthetargetaddressbelongstotheaddressofnetworktwo,thedataThepackageisencapsulated,andtheencapsulationmethodisdifferentaccordingtotheVPNtechnologyused.Atthesametime,theVPNgatewaywillconstructanewVPNdatapacketandusetheencapsulatedoriginaldatapacketastheloadoftheVPNdatapacket.ThedestinationaddressoftheVPNdatapacketisTheexternaladdressoftheVPNgatewayofnetworktwo.
TheVPNgatewayofnetworkonesendstheVPNdatapackettotheInternet.SincethedestinationaddressoftheVPNdatapacketistheexternaladdressoftheVPNgatewayofnetworktwo,thedatapacketwillbeTherouteintheInternetiscorrectlysenttotheVPNgatewayofnetworktwo.
TheVPNgatewayofnetworktwochecksthereceiveddatapacket.IfitisfoundthatthedatapacketissentfromtheVPNgatewayofnetworkone,itcanbedeterminedthatthedatapacketisVPNdatapacket,andunpackthedatapacket.TheprocessofunpackingismainlytostriptheheaderoftheVPNdatapacket,andthenreversethedatapackettorestoretheoriginaldatapacket.
TheVPNgatewayofnetworktwosendstherestoredoriginaldatapackettothetargetterminalB.SincethetargetaddressoftheoriginaldatapacketistheIPofterminalB,thedatapacketcanItissenttoterminalBcorrectly.FromtheperspectiveofterminalB,thedatapacketitreceivesisthesameastheonedirectlysentfromterminalA.
TheprocessingprocessofthedatapacketreturningfromterminalBtoterminalAisthesameastheaboveprocess,sothattheterminalsinthetwonetworkscancommunicatewitheachother.
Throughtheabovedescription,wecanfindthatwhentheVPNgatewayprocessesthedatapacket,therearetwoparametersthatareveryimportantforVPNcommunication:thedestinationaddressoftheoriginaldatapacket(VPNtargetAddress)andtheremoteVPNgatewayaddress.AccordingtotheVPNdestinationaddress,theVPNgatewaycandeterminewhichdatapacketsareprocessedbyVPN.Generally,thedatapacketsthatdonotneedtobeprocessedcanbedirectlyforwardedtothehigher-levelrouting;theremoteVPNgatewayaddressspecifiesthedestinationoftheprocessedVPNdatapacket.Address,thatis,theVPNgatewayaddressattheotherendoftheVPNtunnel.Sincenetworkcommunicationistwo-way,duringVPNcommunication,theVPNgatewaysatbothendsofthetunnelmustknowtheVPNtargetaddressandthecorrespondingremoteVPNgatewayaddress.
Workingprocess
ThebasicprocessingprocessofVPNisasfollows:
①ItisnecessarytoprotectthehostfromsendingplaintextinformationtootherVPNdevices.
②TheVPNdevicedetermineswhethertoencryptdataordirectlytransmitdataaccordingtotherulessetbythenetworkadministrator.
③Forthedatathatneedstobeencrypted,theVPNdeviceencryptstheentiredatapacket(includingthedatatobetransmitted,thesourceIPaddressandthedestinationIPaddress)andattachesthedatasignature,plusanewdataheader(IncludingthesecurityinformationandsomeinitializationparametersrequiredbythedestinationVPNdevice)Re-encapsulation.
④Transmittheencapsulateddatapacketonthepublicnetworkthroughthetunnel.
⑤AfterthedatapacketarrivesatthedestinationVPNdevice,itisunsealed,andafterthedigitalsignatureisverified,thedatapacketisdecrypted.
Classificationstandards
Accordingtodifferentclassificationstandards,VPNscanbeclassifiedaccordingtoseveralstandards:
ClassifiedbyVPNprotocol
TherearethreemainVPNtunnelingprotocols,PPTP,L2TPandIPSec.Amongthem,PPTPandL2TPworkinthesecondlayeroftheOSImodel,whichisalsocalledthesecondlayertunnelingprotocol;IPSecisthethirdlayertunnelingprotocol.
ClassifiedbyVPNapplication
(1)AccessVPN(remoteaccessVPN):clienttogateway,usingpublicnetworkasbackbonenetworktotransmitVPNdatatrafficbetweendevices；
(2)IntranetVPN(IntranetVPN):gatewaytogateway,connectingresourcesfromthesamecompanythroughthecompany’snetworkarchitecture;
(3)ExtranetVPN(extranetVPN)VPN):ItformsanExtranetwithapartner'scorporatenetwork,whichconnectstheresourcesofonecompanywithanothercompany.
Classifiedaccordingtothetypeofequipmentused
NetworkequipmentprovidershavedevelopeddifferentVPNnetworkequipmentaccordingtotheneedsofdifferentcustomers,mainlyswitches,routersandfirewalls:
(1)RouterVPN:ItiseasiertodeployrouterVPN,justaddVPNserviceontherouter;
(2)SwitchVPN:mainlyusedforconnectinguserswithfewerusersVPNnetwork;
Dividedaccordingtotheimplementationprinciple
(1)OverlappingVPN:ThisVPNrequiresuserstoestablishVPNlinksbetweenendnodes,mainlyincluding:GRE,L2TP,IPSecAndmanyothertechnologies.
(2)Peer-to-peerVPN:ThenetworkoperatorcompletestheestablishmentofVPNchannelsonthebackbonenetwork,whichmainlyincludesMPLSandVPNtechnologies.
Implementationmethods
TherearemanywaystoimplementVPN,thefollowingfourarecommonlyused:
1.VPNserver:Inalargelocalareanetwork,VPNcanberealizedbybuildingaVPNserverinthenetworkcenter.
2.SoftwareVPN:VPNcanberealizedthroughdedicatedsoftware.
3.HardwareVPN:VPNcanberealizedthroughdedicatedhardware.
4.IntegratedVPN:Somehardwaredevices,suchasrouters,firewalls,etc.,allcontainVPNfunctions,butgenerallyhardwaredeviceswithVPNfunctionsareusuallymoreexpensivethanthosewithoutthisfunction.
AdvantagesandDisadvantages
Advantages
VPNenablesmobileemployees,remoteemployees,businesspartnersandotherstotakeadvantageoflocallyavailablehigh-speedBroadbandnetworkconnection(suchasDSL,cableTVorWiFinetwork)toconnecttothecorporatenetwork.Inaddition,high-speedbroadbandInternetconnectionsprovideacost-effectivewaytoconnecttoremoteoffices.
Awell-designedbroadbandVPNismodularandupgradeable.VPNallowsuserstouseaveryeasytosetupInternetinfrastructure,allowingnewuserstoquicklyandeasilyaddtothenetwork.Thiscapabilitymeansthatcompaniescanprovidealargeamountofcapacityandapplicationswithoutaddingadditionalinfrastructure.
VPNcanprovideahighlevelofsecurity,usingadvancedencryptionandidentificationprotocolstoprotectdatafrompryingeyes,andpreventdatathievesandotherunauthorizedusersfromaccessingthisdata.
Fullcontrol,virtualprivatenetworkallowsuserstousethefacilitiesandservicesoftheISP,whilefullycontrollingtheirownnetwork.UsersonlyusethenetworkresourcesprovidedbytheISP,andcanmanageothersecuritysettingsandnetworkmanagementchangesbythemselves.Youcanalsoestablishavirtualprivatenetworkwithintheenterprise.
Disadvantages
EnterprisescannotdirectlycontrolthereliabilityandperformanceofInternet-basedVPNs.OrganizationsmustrelyonInternetserviceprovidersthatprovideVPNstoensuretheoperationoftheservice.Thisfactormakesitveryimportantforcompaniestosignaservice-levelagreementwithanInternetserviceprovider,tosignanagreementthatguaranteesvariousperformanceindicators.
ItisnoteasyforenterprisestocreateanddeployVPNcircuits.Thistechnologyrequiresahigh-levelunderstandingofnetworkandsecurityissues,andrequirescarefulplanningandconfiguration.Therefore,itisagoodideatochooseanInternetserviceprovidertoberesponsibleformostthingsrunningaVPN.
VPNproductsandsolutionsofdifferentvendorsarealwaysincompatible,becausemanyvendorsareunwillingorunabletocomplywithVPNtechnicalstandards.Therefore,themixeduseofproductsfromdifferentmanufacturersmaycausetechnicalproblems.Ontheotherhand,usingequipmentfromonesuppliermayincreasecosts.
Whenusingwirelessdevices,VPNhassecurityrisks.Roamingbetweenaccesspointsisparticularlyproblematic.Whenusersroambetweenaccesspoints,anysolutionthatusesadvancedencryptiontechnologymaybecompromised.
Relevantlaws,regulationsandpolicies
InApril2003,theMinistryofInformationIndustryissuedthe"TelecomAtthesametime,thevirtualprivatenetworkserviceisseparatedfromthebasictelecommunicationserviceandbecomesanindependentvalue-addedtelecommunicationserviceclassification.Butthe"virtualprivatenetwork"concepthereisdifferentfromtheVPNbusinessintheindustry.Theinterpretationofthisclassificationinthenew"TelecomServiceClassificationCatalogue"is:DomesticInternetVirtualPrivateNetworkService(IP-VPN)referstooperatorswhousetheirownorleasedpublicInternetnetworkresourcesandadoptTCP/IPprotocoltoprovidedomesticTheusercustomizestheserviceoftheInternetclosedusergroupnetwork.Theexplanationofthisclassificationemphasizestwocharacteristics,oneistheuseofInternetnetworkresources,andtheotheristheuseofTCP/IP.Thisexplanationcorrespondstothemarketconditionsatthattime.Atthattime,thefocuswasonIPSecVPNbasedontheInternet.AlthoughtheexplanationcanbasicallycovertheSSLVPNmodelthatemergedlater,itdidnotfocusonMPLSVPN.
InJanuary2006,theMinistryofInformationIndustryissuedthe"AnnouncementonTwoValue-AddedTelecommunicationsServicesandDomesticMulti-partyCommunicationServices",officiallyopeningthe"DomesticInternetVirtualPrivateNetworkService"and"OnlineDataProcessingandTransactionProcessing"Business"twovalue-addedtelecommunicationsservices,theabovetwovalue-addedtelecommunicationsserviceshavebeenconvertedfromcommercialtrialstoformalcommercialuse.
In2013,theMinistryofIndustryandInformationTechnologypublishedthe"TelecomBusinessClassificationCatalog(DraftforComment)"andstilldidnotmakeanychangestothis.
OnJanuary27,2015,theMinistryofIndustryandInformationTechnologyrespondedtotheVPNblockedincident,statingthatsomebadinformationshouldbemanagedinaccordancewithChineselaws.TheMinistryofIndustryandInformationTechnologypreviouslyissuedregulationsthatcompaniesprovidingVPNservicesinChinamustregister,otherwisetheywill"notbeprotectedbyChineselaws."
InJanuary2017,theMinistryofIndustryandInformationTechnologyissuedthe"NoticeonCleaningupandRegulatingtheInternetNetworkStructureServiceMarket."ThecompetentauthorityapprovesthatenterprisesandindividualswithoutinternationalcommunicationbusinessqualificationsrentinternationaldedicatedlinesorVPNstoconductcross-bordertelecommunicationsbusinessoperationsinviolationofregulations.Theseregulationsaremainlytocleanupthosewhoareoperatingwithoutalicenseanddonotmeetthestandards,andwillnothaveanyimpactonenterprisesandindividualsthatcomplywithlawsandregulations.
RegardingtheissueofVPN,WenKu,DirectoroftheInformationandCommunicationDevelopmentDepartmentoftheMinistryofIndustryandInformationTechnology,addedthatoperatingrelatedbusinessesinChinashouldapplyforlicensesinaccordancewithChineselawsandregulations.Thisisactuallythecaseinmanycountriesaroundtheworld.Didthis.ThisisdoneintheUnitedStates,Europe,andAsia,andthemanagementmethodsofeachcountryarenotthesame.AlotofworkhasbeendoneinChina'sthreemajoroperatorstoprovideservicestothepeople,andtheInternetspeedhasbeencontinuouslyimproved,andgoodresultshavebeenachieved.
WenKusaidthat,especiallyinthedigitaleconomy,thestreetsandlanes,especiallythesharedbicyclesonthesideofthesubwayentrance,etc.,showthatthenetworkcoverageisverycomplete,andtheapplicationisbecomingmoreandmoreextensive.Atthesametime,wewillalsopayattentiontosomeoftheneedsofthepeople.However,spreadingharmfulorevenviolentandterroristinformationthroughtheInternetisnotallowedbyChineselaw.
Latest: Scientific decision
