Secure network communication using IPSec

Abstract: In this paper, secure communication between many computers connected by an untrusted network is discussed. IPsec solves this by sending data with added authentication by public key cryptography and optional encryption. One problem that occurs when many hosts are involved is how to define, distribute and enforce a policy for secure communication in the network. A tool to generate IPsec configuration files was developed. By grouping hosts by the services they provide, security policies can be defined for each service instead of on a host-by-host basis. The grouping and policy is then used to generate IPsec configurations to set up point-to-point connections between each pair of hosts that should be able to communicate securely. Some testing with regards to performance and stability is done. There were several stability issues during testing, showing the difficulty in configuring IPsec correctly. However, later configuration updates have fixed these issues, making IPsec stable enough for trial use in production with careful monitoring.