The IMS: IP Multimedia Concepts And Services, Second Edition

22.1. Introduction

Internet Protocol Security (IPsec) provides for various security services on the IP layer, in IPv4 as well as IPv6, thus offering protection for protocols in upper layers. IPsec is typically used to secure communications between hosts and security gateways. The set of security services that IPsec provides includes:

• access control;

• data integrity protection;

• data origin authentication;

• anti-replay protection;

• confidentiality;

• limited traffic flow confidentiality.

IPsec can operate in two modes: tunnel mode and transport mode. Transport mode is mainly used to provide security services for upper layer protocols. Tunnel mode is typically used to tunnel IP traffic between two security gateways. The difference is that in transport mode IPsec offers limited protection to IP headers, whereas in tunnel mode the full IP datagram is protected. More specifically, in the case of an Encapsulated Security Payload (ESP) there are no security services provided for the IP headers that precede the ESP header, whereas an Authentication Header (AH) does extend protection to some parts of the IP header.

The components of the IPsec security architecture [RFC2401] are:

• Security protocols – the AH [RFC2402] and the ESP [RFC2406].

• Security associations – definition of the Security Policy Database (SPD) and the Security Association Database (SAD), as well as the management and usage of security associations.

• Key management – the distribution of cryptographic keys for use with the security protocols ...