A virtual private network (VPN) is a private data network, that carries traffic between remote sites. One of the most popular VPN applications is the "intranet/extranet VPN", which establishes network layer connections between remote intranet sites, using various tunneling protocols, to create an IP overlay network. IPSec, which is very prevalent in the industry, is one of these tunneling protocols that not only provide encapsulation/decapsulation but encryption/decryption and hashing, However, an IPSec tunnel often fails to be established due to the management complexity. The paper proposes a new concept of authority to alleviate the management overhead by reducing the number of tunnels. The problem of tunnel minimization is first formalized under three conditions - no constraint, a tunnel path length constraint and a tunnel relay degree constraint - and is then solved using graphical models and the zero-one integer programming algorithm. The effect of tunnel minimization is also investigated, and at most 90% of the tunnels are found to be reducible in a general enterprise VPN.
[1]
Dan Harkins,et al.
The Internet Key Exchange (IKE)
,
1998,
RFC.
[2]
Glen Zorn,et al.
Point-to-Point Tunneling Protocol (PPTP)
,
1999,
RFC.
[3]
Ronald L. Rivest,et al.
Introduction to Algorithms, Second Edition
,
2001
.
[4]
Randall J. Atkinson,et al.
IP Encapsulating Security Payload (ESP)
,
1995,
RFC.
[5]
Glen Zorn,et al.
Layer Two Tunneling Protocol "L2TP"
,
1999,
RFC.
[6]
Stephen T. Kent,et al.
IP Authentication Header
,
1995,
RFC.
[7]
Reuven Cohen,et al.
On the cost of virtual private networks
,
2000,
TNET.
[8]
Randall J. Atkinson,et al.
Security Architecture for the Internet Protocol
,
1995,
RFC.
[9]
Hugo Krawczyk,et al.
A Security Architecture for the Internet Protocol
,
1999,
IBM Syst. J..
[10]
E. W. Beth,et al.
Proof by Contradiction
,
1970
.