Towards Better Key Exchange Performance in IPSec-Based VPNs

摘要

Virtual Private Networks (VPNs) provide an inexpensive and scalable solution for the transfer of sensitive data through an unsecured network by creating a "tunnel" from sender to receiver. One of the most popular protocols for creating VPNs is the IPSec protocol suite, where secure key negotiation and exchange must be done first, before any encryption of data can take place. This article examines the latest VPN technologies focusing on one of the factors that have an effect on VPN performance and scalability, namely security key management. A new aggregation key exchange approach compatible to current technologies is proposed for improving the key exchange performance in large VPN systems. The new approach represents a trade-off between performance and security. A simulation model based on the Network Simulator (ns) was developed for this new approach. Simulation experiments for various scenarios were conducted and their results were compared to the traditional key exchange scheme.