Low cost electronic communications may be realized through use of preexisting, open networks, in particular the Internet. A private network may utilize the existing Internet infrastructure to reduce the cost of implementing and maintaining hardware and software to establish networked communication for a group of private users.
Virtual private networks (“VPN”) entail one approach to use of the Internet, or other publicly available network, as an alternative to expensive, dedicated communications networks. A VPN may utilize packet-switched communications in a software-defined, secure network that resides within a larger, publicly switched network. A telecommunications provider provides access to the public network for members of the VPN. Thus, the VPN shares the public network for communications traffic. In effect, the cost of building and maintaining the public network is shared by the many users of the network.
VPNs are particularly cost effective, for example, for highly mobile workforces and smaller companies. A telecommunications company can provide the network, or preexisting networks, such as the telephone network or the Internet, can be utilized via the use of tunneling software to interface to private components of the network.
Such private networks inherently expose themselves to security risks. The Internet is an intentionally open, unsecured communication environment. It is designed to be available to the general public, businesses, government agencies and non-profit organizations. This openness leaves the network vulnerable to attacks, and those private networks that use the Internet for communications similarly expose themselves to attack via the Internet.
In contrast to the needs of the Internet, a private network must generally limit access. The private network must protect itself form security risks, as well as limit access to private resources as needed. Such restrictions help to maintain the integrity of data.
Private networks, e.g. intranets or extranets, that are implemented with Internet-based interconnections typically use a number of approaches to protect the private components of the network from public access. Protection mechanisms include features such as firewalls, access lists, host and application layer security, and other tools to limit access via the Internet to intranet resources.
Internet-based communications employ well-established, widely known communication protocols, resulting in well-known weaknesses. These weaknesses may be exploited for illicit access to private networks utilizing the Internet for some, or all, of their communications. While equipment and software vendors attempt to standardize their Internet targeted products, deficiencies in the standardization process create further weaknesses that arise due to differing implementations by various vendors.
Moreover, increasing the size of a private network generally increases opportunities to exploit that network. A larger network not only presents more avenues for attack, but also presents greater difficulty in tracking access privileges, updating security procedures, and preserving synchronization between security procedures.
Numerous techniques that exploit network deficiencies have evolved. These techniques include hijacking of a host address, spoofing an address and denial-of-service attacks. In the last of these, the perpetrator generally attempts to shut down a network resource, such as a host, by flooding the resource with messages.
Various systems have evolved to protect network communications. Commonly, encryption techniques are employed to hide the contents of network communications traffic. Some methods mask the real Internet Protocol (“IP”) address of source and destination hosts by “tunneling” through hardware gateways. Tunneling systems generally, however, can reveal true addresses between gateways. Existing systems also typically fail to guard against denial-of-service attacks.
Further, existing systems may fail to mask communication traffic patterns. Systems that provide some masking of traffic typically are unsuitable for packet-switched, networked environments.
Some techniques protect against denial-of-service attacks by deploying redundant copies of critical data that reside on servers. Implementations typically employ either majority voting on fully replicated data servers or distributed encoded redundant data across physical servers. Synchronizing the data on the redundant servers is a complex task. Further, the IP addresses of the servers are fully exposed, as is the profile of data traffic. Unless the number of replicated servers is sufficiently large, their collective ability to withstand denial-of-service attacks is limited.
Moreover, data assurance methods typically do not provide security, and may even decrease network security. For example, applying channel coding to message bits and blocks does not provide any data assurance during failure of a route or path. Neither do existing methods of data encryption and authentication provide data assurance when data packets are lost due to interception or jamming.
Traditional methods of providing data security against eavesdropping (such as keyed encryption) grew out of point-to-point or single user communication channel models. Most communications now take place over networks and require improved methods of assurance and security.