 reducing the role of packet filtering Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SGSN-to-GGSN (Gn) and GGSN-to-PDN (Gi) Interface Chapter 10 for further refining after IPSec has encrypted the packet. Moreover, because IPSec's authentication and encryption protocols can be applied simultane- ously to a given packet, strong access control can be enforced even when the data itself is encrypted. Authentication IPSec has two major drafts: the AH and ESP. They are defined as follows: AH Is used to provide connectionless integrity and data origin authentication for an entire IP datagram (hereafter referred to as authentication). ESP Provides authentication and encryption for IP datagrams with the encryption algorithm used determined by the user. In ESP authentication, the actual message digest is now inserted at the end of the packet (whereas in AH the digest is inside the authentication). AH provides data integrity only and ESP, formerly encryption only, now provides both encryption and data integrity. The difference between AH data integrity and ESP data integrity is the scope of the data being authen- ticated. AH authenticates the entire packet, whereas ESP doesn't authenticate the outer IP header. In ESP authentication, the actual message digest is now inserted at the end of the packet, whereas in AH, the digest is inside the AH. The IPSec standard dictates that prior to any data transfer occurring, a Security Association (SA) must be negotiated between the two VPN nodes (gateways or clients). The SA contains all the information required for exe- cution of various network security services such as the IP-layer services (header authentication and payload encapsulation), transport- or applica- tion-layer services, and self-protection of negotiation traffic. These formats provide a consistent framework for transferring key and authentication