IPsec

Problem

We want IP packets to cross an untrusted network without outsiders reading or modifying them. The protection should happen at the IP layer, independent of whether the application uses HTTP, SQL or something else.

Solution — IPsec

IPsec authenticates and can encrypt IP traffic between endpoints. Authenticates means checking that a packet came from the expected VPN peer and was unchanged in transit. The sender adds a cryptographic authentication tag using a shared secret key. The receiver checks that tag; an invalid tag causes the packet to be rejected.

Original IP traffic
       ↓
   IPsec protection
       ↓
Untrusted Internet
       ↓
   remove protection
       ↓
Original traffic

While IPsec protects IP packets between devices or networks, Transport Layer Security (TLS) protects connections between applications, such as a browser and a website. They can work together: an HTTPS connection protected by TLS can travel through a VPN protected by IPsec.

Core idea: IPsec provides security directly at the network layer.