1/7/2020
`
`The TCP/IP Guide - IPSec Security Associations and the Security Association Database (SAD); Security Policies and the Security Policy …
`
`-30%
`
`Hot
`
`-50%
`
`-30%
`
`-30%
`
`-30%
`
`-30%
`
`Ch
`Tod
`Des
`De
`
`NOTE: Using software to mass-download the site degrades the server and is prohibited.
`If you want to read The TCP/IP Guide offline, please consider licensing it. Thank you.
`
`The Book
`is Here...
`and Now
`On Sale!
`
` The TCP/IP Guide
` 9 TCP/IP Lower-Layer (Interface, Internet and Transport) Protocols (OSI Layers 2, 3 and 4)
` 9 TCP/IP Internet Layer (OSI Network Layer) Protocols
` 9 Internet Protocol (IP/IPv4, IPng/IPv6) and IP-Related Protocols (IP NAT, IPSec, Mobile IP)
` 9 IP Security (IPSec) Protocols
`
`Get The TCP/IP Guide
`for your own computer.
`The TCP/IP Guide
`
`Search
`
`Custom Search
`
`Network Diagram
`
`Free VPN
`
`
`
`L E G A LL E G A L
`
`
`
`CLOSECLOSE
`
`Drivers whoDrivers who
`
`
`switch toswitch to
`
`Allstate canAllstate can
`
`save $356.save $356.
`
`IPSec Modes: Transport and Tunnel
`
`1 2
`
`IPSec Authentication Heade
`
`IPSec Security Associations and the Security Association Database (SAD); Security Policies
`Security Policy Database (SPD); Selectors; the Security Parameter Index (SPI)
`(Page 1 of 2)
`
`Woah, there sure is a lot of "security" stuff in that topic title. Those items are all closely related, and important to understand before w
`looking at the core IPSec protocols themselves. These constructs are used to guide the operation of IPSec in a general way and also
`exchanges between devices. They control how IPSec works and ensure that each datagram coming into or leaving an IPSec-capabl
`properly treated.
`
`Where to start… where to start. J Let's begin by considering the problem of how to apply security in a device that may be handling m
`exchanges of datagrams with others. There is overhead involved in providing security, so we do not want to do it for every message
`or out. Some types of messages may need more security, others less. Also, exchanges with certain devices may require different pro
`others.
`
`Security Policies, Security Associations and Associated Databases
`
`To manage all of this complexity, IPSec is equipped with a flexible, powerful way of specifying how different types of datagrams shou
`To understand how this works, we must first define two important logical concepts:
`Security Policies: A security policy is a rule that is programmed into the IPSec implementation that tells it how to process diffe
`datagrams received by the device. For example, security policies are used to decide if a particular packet needs to be processe
`not; those that do not bypass AH and ESP entirely. If security is required, the security policy provides general guidelines for how
`provided, and if necessary, links to more specific detail.
`
`Security policies for a device are stored in the device's Security Policy Database (SPD).
`
`Security Associations: A Security Association (SA) is a set of security information that describes a particular kind of secure c
`between one device and another. You can consider it a "contract", if you will, that specifies the particular security mechanisms t
`for secure communications between the two.
`
`A device's security associations are contained in its Security Association Database (SAD).
`
`
`
`Quote NowQuote Now
`
`It's often hard to distinguish the SPD and the SAD, since they are similar in concept. The main difference between them is that secur
`are general while security associations are more specific. To determine what to do with a particular datagram, a device first checks th
`security policies in the SPD may reference a particular security association in the SAD. If so, the device will look up that security ass
`use it for processing the datagram.
`
`IPSec Modes: Transport and Tunnel
`
`1 2
`
`IPSec Authentication Heade
`
`If you find The TCP/IP Guide useful, please consider making a small Paypal donation to help the site, using one of the buttons below. You can also donate a custom amount using
`button (not less than $1 please, or PayPal gets most/all of your money!) In lieu of a larger donation, you may wish to consider purchasing a download license of The TCP/IP Guid
`
`www.tcpipguide.com/free/t_IPSecSecurityAssociationsandtheSecurityAssociation.htm
`
`1/2
`
`MPH Technologies Oy, Exhibit 2004
`Page 2004 - 1
`IPR2019-00821, Apple Inc. v. MPH Technologies Oy
`
`

`

`1/7/2020
`
`Donate $2
`
`The TCP/IP Guide - IPSec Security Associations and the Security Association Database (SAD); Security Policies and the Security Policy …
`support!
`
`Donate $5
`
`Donate $10 Donate $20 Donate $30 Donate: $
`
`Home - Table Of Contents - Contact Us
`
`The TCP/IP Guide (http://www.TCPIPGuide.com)
`Version 3.0 - Version Date: September 20, 2005
`
`© Copyright 2001-2005 Charles M. Kozierok. All Rights Reserved.
`Not responsible for any loss resulting from the use of this site.
`
`www.tcpipguide.com/free/t_IPSecSecurityAssociationsandtheSecurityAssociation.htm
`
`2/2
`
`MPH Technologies Oy, Exhibit 2004
`Page 2004 - 2
`IPR2019-00821, Apple Inc. v. MPH Technologies Oy
`
`