Keywords

1 Introduction

Individuals who use the Internet are highly exposed to social media exploitation where they are victims of attacks. Due to the various attack and vulnerability that data are exposed to when been transmitted from a sender to a receiver, a protection mechanism ought to be provided to address several safety assaults on statistics transmission through the Internet. There are different attacks over the Internet, such as the denial-of-service attack which makes the network service unavailable by flooding network traffic to the target which exhausts the processing power of the target [1, 2]; information has been changed either accidentally or by malicious attack affects the integrity of the data or creates false information. Eavesdropping on data containing confidential information, such as the location, keys and even passwords of the node, can be redirected to another location. Many security mechanisms have been reviewed to protect data integrity, confidentiality, availability, authenticity and non-repudiation. Cell users want to get entry to assets from their company or domestic network in an efficient but relaxed manner which is done with the help virtual private network (VPN) connections. VPN is a virtual connection routed through the Internet on a public network, from the sender’s private network to the receiver. VPN aims to initiate a secure communication path among different networks. It is usually created across the public network [3]. VPN tunnels are used to maintain the privacy of statistics shared over the physical network connection protecting packet-level encryption, consequently making it very hard to become aware of the programs strolling through these VPN services [4].

Authors in [5] showed that a current survey indicated that almost 50% of agencies would adopt the preceding idea by 2025. VPN provides privacy which prevents intermediated users from eavesdropping, altering or deleting the data, authentication which validates that the packet sent by the authorized sender, checks that the data is not altered and prevent intermediate users from copying and resending the information. A VPN tunnel is created for the information to be secured over the physical community connection, maintaining packet-stage encryption, making it very hard to discover the software passing through the VPN offerings. This paper focuses on secure communication using a VPN.

VPNs continue to develop with an increasing number of options that is frequently used in both big and small organization. They also have an advantage of flexibility, connectivity and security at cheap cost. Organizational gains from VPN are reduction in cost and increases in scalability and productivity without compromising the security [6]. This study covers the simulation, evaluation and verification with the help of a packet tracer simulator.

The main aim of the present work is to design a simple system that uses a VPN to secure wireless communication. The following are the main objectives of the presented work.

  1. 1.

    To show how to protect data from being attack over the Internet.

  2. 2.

    To enable communication to be kept private between only the receiver and sender.

  3. 3.

    To show how VPN is over other security mechanisms such as firewall defense.

A brief knowledge of the work is given in this section. Section 2 presented related works in the field of secured communication. Section 3 outlines the method that is used for design and implementation and results. Section 4 describes the conclusion and future work.

2 Related Works

We have reviewed the related works in several databases. The summary of all those important and selected studies is given in Table 1.

Table 1 Summary of the literature review
Full size table

There are several other related works [8, 23, 24] available in the literature but due to limitation of work, we are not providing details.

3 Methodology and Results

CISCO packet tracer is used for the design and the simulation of the proposed network using VPN. Only the authorized user will be able to communicate with the other network. The routers will be configured with advance encryption standard to protect data and privacy, Hash-sha tool for IP security authentication, ISAKMP protocol to ensure that two hosts agree on how to build a security association.

3.1 Design and Implementation

Any device connected to the Internet has an IP address which is a sequence of number; a VPN will mask the IP address. An IP address identifies address and location, and a VPN erases IP address from been detected, encrypts your data and keeps your activities private but they do reduce the speed due to the extra security.

For a system to have a working VPN, the following must be configured.

  1. 1.

    Access-list to permit corresponding traffic that will go over the tunnel.

  2. 2.

    ISAKMP policy and ISAKMP key. It is used to set up key authentication and tunnel.

  3. 3.

    IP sec transform-set. It provides authentication and integrity.

  4. 4.

    Crypto map. The crypto map should be applied to the interface.

VPN tunnel must have a security license on the router. The encryption algorithm that was used is the advanced encryption standard (AES) with a key of 256, to protect data and ensure privacy. The IPsec message integrity used is the HMAC-SHA which defines the key size to support different encryption key size. The pre-shared authentication key was used to require VPN devices on each end to configure with the identical mystery key.

Figure 1 shows a conceptual diagram of the VPN network within an organization with all configured interfaces. If the interfaces are not connected to an IP address, there cannot be any form of communication, secured or not secured. This IP address is a unique identifier that indicates the location of a device and governs the way data is sent over the Internet. In the fig above, router 3 interface is having an IP address of 209.165.100.2 and 209.165.200.2, router 4 209.168.100.1 and 192.168.1.1 and router 5 209.165.100.2 and 192.168.3.1

Fig. 1
figure 1

Theoretical diagram of a VPN network

Full size image

Figure 2 shows that the router does not have a security license. Without this security license VPN encryption, secure collaborative encryption, dynamic multipoint VPN is impossible. The securityk9 can be checked by using the “show version” command in the privilege mode. The security license has been configured and shown in Figs. 3 and 4

Fig. 2
figure 2

Router without security license

Full size image
Fig. 3
figure 3

Configuration of the security license

Full size image
Fig. 4
figure 4

Router with security license

Full size image

Figure 5 shows the access-list configuration. The access-list grants permission to allow traffic from one network to the other through the tunnel. The access-list only allow listed IP addresses to communicate across the tunnel.

Fig. 5
figure 5

Access-list

Full size image

The policy and key enable the router to utilize IP security as showed in Fig. 6. Every ISAKMP coverage is assigned a unique precedence number among 1 and 10,000. The coverage with precedence number 1 is considered the highest priority policy.

Fig. 6
figure 6

ISAKM policy and ISAKM key

Full size image

Figure 7 shows the IP sec transform-set configuration, which verifies authentication and integrity. A transform set is a merger of an IP sec transforms designed to enact a particular protection coverage for data traffic

Fig. 7
figure 7

IPsec transform-set

Full size image

Figure 8, shows the crypto mapping configuration. A crypto map is a configuration entity that select data flow that needs security processing. A crypto map must be named. In the configuration above, the crypto map name is “IPSEC-MAP”. Figure 9 shows interface of the crypto map.

Fig. 8
figure 8

Crypto map

Full size image
Fig. 9
figure 9

The interfaces applied to the crypto map

Full size image

3.2 Result and Discussion

When using the real-time mode to check for the communication process, it is observed that laptop 2 could communicate with laptop 3 without router three been aware of the network; this process is seen using the simulation mode as shown in Fig. 10. Information about the VPN is checked from the inbound PDU details; it is noticed that router 3 had no idea about router 4 and router 5 but they are pinging across router 3 because of the VPN. From the simulation result below, only the source IP address 192.168.1.10 and the destination IP addresses 192.168.3.10 are seen, but the path through which the packet goes through is not recognized.

Fig. 10
figure 10

Simulation result

Full size image

4 Conclusion and Future Work

This paper presented a VPN architecture within an organization that proposed solution to secure traffic through authentication, authorization, payload encryption and privacy protection. Simulation result on cisco packet tracer verifies that they provide secured traffic communication. This paper proposed a simple VPN solution that can be used in an organization. They also have the advantage of flexibility, connectivity and security at cheap cost. Organizational gains from VPN are increased in the scalability and productivity. Future work can be carried out by using other simulation packages order than cisco packet tracer for a simple VPN connection within an organization, and also, the model can also be expanded by using VPN connections across multiple countries.