er) or ESP (Encapsulating Security Payload) extensions of the IPv4 or IPv6 header. To secure a two-directional communication between two end points, a security association (SA) pair is required. The IKEv2 (Internet Key Exchange version 2) protocol dynamically ensures the creation of the security association. A security association contains the following parameters: - the authentication algorithm and the key in order to generate the AH extension; - the encryption algorithm and the key in order to generate the ESP extension; - the authentication algorithm and the key in order to generate the ESP extension, if this service is used; - the lifetime of the security association; - the encapsulation mode (tunnel or transport). Wi-Fi Integration to the 4G Mobile Network, First Edition. André Perez. C ISTE Ltd 2018. Published by ISTE Ltd and John Wiley & Sons, Inc. 126 Wi-Fi Integration to the 4G Mobile Network The IPSec mechanism defines the following three databases: - security policy database (SPD): this defines the security policy to be applied to input and output traffic for a host or a security gateway; - security association database (SAD): this contains the parameters applied to a security association; - peer authorization database (PAD): this provides a link between the IKEv2 protocol and the SPD. The selector is the mechanism enabling identification at the source of the security association to be applied to traffic. The selector uses the following fields: - Protocol (IPv4) or Next Header (IPv6) and source or destination address of the IP headers; - source or destination port of the TCP (Transmission Control Protocol) or UDP (User Datagram Protocol) headers. For an outgoing packet, the selector consults the SPD that defines the process to be applied to the packet: - BYPASS: the packet is transmitted without a security service; - DISCARD: the packet is discarded; - PROTECT: the security service is applied to the packet. If the security association is not established, then the IKE protocol is invoked. If the securit