Internet Protocol security architecture
- See also: communications security
Both Internet Protocol version 4 and Internet Protocol version 6 can run more securely if features of the Internet Protocol security architecture (IPSec)[1] are enabled. IPv6 security can use these features in a way more integrated with regular packet processing than can IPv4, but the basic mechanisms are common.
IPv6 has two optional headers, authentication header and encapsulating security payload. The Authentication Header (AH) offers communications security#atomic integrity and data origin commmunications security#sender authentication, with optional features, which provide certain aspects of communications security#sequential integrity.[2]
The Encapsulating Security Payload (ESP) protocol offers the same set of services, and also offers content confidentiality.[3] ESP is almost always used in addition to AH, but AH alone can provide some useful functions. ESP, with its confidentiality features enabled, provides limited traffic flow confidentiality, also called protection against traffic analysis. Traffic analysis is not always a threat; the relevant security policy must show a need for it.
Both AH and ESP offer mechanism access control, enforced through the distribution of cryptographic keys and the management of traffic flows as dictated by the Security Policy Database. This Database is outside the protocol proper and part of the security infrastructure.
References
- ↑ S. Kent, K. Seo. (December 2005), Security Architecture for the Internet Protocol, RFC4301
- ↑ Kent, S. (December 2005), IP Authentication Header, RFC4302
- ↑ Kent, S. (December 2005), IP Encapsulating Security Payload (ESP), RFC4303