Transport layer

At the transport level, using the protocol SSL / TLS or the Secure the Socket Layer / Transport Layer Security , which implements the encryption and authentication IU forward traffic levels of the receiver and transmitter . SSL / TLS can be used to protect TCP traffic , can not be used to protect UDP traffic . For the operation of a free vpn firefox veepn on the basis of SSL / TLS is not necessary to the implementation of a special program to provide Mr. Ia as how each browser and mail client is equipped with these protocols . Due to the fact that SSL / TLS is implemented at the transport layer , a secure connection is established " end -to- end" .

The header is divided into two parts , separated by a data field 
 

The first part , called the proper header ESP , is formed by two fields ( SPI and SN ), purpose of which is similar eponymous fields protocol AH , and located in front of the field data .

The rest of the ESP service fields , called the ESP trailer , are located at the end of the packet .

Two field trailer - the next title and DATA 's authentication - similar to the fields header AH . Field data authentication is absent if when establishing a secure association made the decision not to use the opportunities the protocol ESP for ensuring integrity . In addition to these fields, the trailer contains two additional fields - placeholder and placeholder length .

AH and ESP protocols can protect data in two modes

in transport - transfer carried out with the original the IP - s agolovkami ;

in tunneling - source package is placed in the new the IP - n Aketi and gear and being with new titles .

Application of the or another mode depends on the requirements imposed to protect data , and also from the role that is played in the network node that terminates a protected channel . Thus , a node may be a host (end node ) or gateway (interm diate node ). Accordingly , there are three schemes for using the IPSec protocol :

host - host ;

gateway - gateway ;

host - gateway .

Protokol AN

Features protocols AH and ESP partially overlap : protokol AN is responsible only for ensuring the integrity and Auth fication data , n rotokol ESP can encrypt data and except that , to perform the function protocol AH (in abbreviated form ). ESP can support encryption and authentication / integrity functions in any combination , that is, either the entire group of functions , or only authentication / integrity , or only encryption .

IKE or of Internet Key the Exchange - exchange of keys Internet - solves the auxiliary task automatically provision end- points of the protected channel of secret keys required for operation protocol authentication and encryption of data .