Choosing Security Solutions That Use Public Key Technology

Security with IP Security

Windows 2000 incorporates a suite of protocols called IP Security (IPSec). IPSec is based on standards that were developed by the IP Security Protocol (IPSEC) working group of the IETF. IPSec operates at the IP network and TCP/UDP transport levels and is transparent to the operating system and applications. IPSec provides end-to-end security between sending and receiving computers on IP networks. IPSec can be configured to perform one or more of the following security functions:

Authenticates the sender of IP data packets on the basis of Kerberos authentication, digital certificates, or a shared secret key (password).
Ensures the integrity of the IP data packets that are transmitted over the network.
Encrypts all data that is sent over the network for full confidentiality.
Hides the originating IP addresses from observation while they are en route.

For Kerberos clients, you usually configure IPSec security policy to authenticate clients on the basis of Kerberos authentication. However, you can also configure IPSec policy to use digital certificates for authenticating non-Kerberos clients (for example, business partner clients on your extranet). Certificates provide the strongest security for authenticating non-Kerberos clients for IPSec communication. The use of shared secrets (passwords) for authentication provides relatively weak security and, thus, is not generally used except when necessary to test IPSec or when necessary to provide interoperability with some third-party IPSec clients. You can configure IPSec security policy for each domain or for each local computer by defining a list of rules and filters that are to be applied to regulate secure communication with specific IPSec clients.

You can deploy Certificate Services to issue IPSec authentication certificates, or you can obtain certificate services from third parties. You must configure IPSec security policy to specify the CAs that you trust and that are to issue the IPSec certificates for authentication. For example, you might deploy Certificate Services to provide IPSec certificates to non-Windows 2000–based clients in your organization and configure IPSec security policy to trust certificates that are issued by appropriate CAs. You might also choose to trust certificates that are issued by third-party CAs (for example, the CA for a business partner) for IPSec communications with computers on an extranet.

For more information about IPSec, see "Internet Protocol Security" in the Microsoft® Windows® 2000 Server Resource Kit TCP/IP Core Networking Guide.