<x:xmpmeta tsc:version="2.0.1" xmlns:x="adobe:ns:meta/" xmlns:tsc="http://www.techsmith.com/xmp/tsc/">
   <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpDM="http://ns.adobe.com/xmp/1.0/DynamicMedia/" xmlns:xmpG="http://ns.adobe.com/xap/1.0/g/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:tscDM="http://www.techsmith.com/xmp/tscDM/" xmlns:tscIQ="http://www.techsmith.com/xmp/tscIQ/" xmlns:tscHS="http://www.techsmith.com/xmp/tscHS/" xmlns:stDim="http://ns.adobe.com/xap/1.0/sType/Dimensions#" xmlns:stFnt="http://ns.adobe.com/xap/1.0/sType/Font#" xmlns:exif="http://ns.adobe.com/exif/1.0" xmlns:dc="http://purl.org/dc/elements/1.1/">
      <rdf:Description dc:date="2017-04-11 01:02:29 AM" dc:source="Camtasia,9.0.3,enu" dc:title="l_20ips2" tscDM:firstFrame="l_20ips2_First_Frame.png" tscDM:originId="2625EA67-814F-4A0C-B4C7-2902396CFF3B" tscDM:project="l_20ips2.tscproj">
         <xmpDM:duration xmpDM:scale="1/1000" xmpDM:value="4595933"/>
         <xmpDM:videoFrameSize stDim:unit="pixel" stDim:h="1080" stDim:w="1440"/>
         <tsc:langName>
            <rdf:Bag>
               <rdf:li xml:lang="en-US">English</rdf:li></rdf:Bag>
         </tsc:langName>
         <xmpDM:Tracks>
            <rdf:Bag>
               <rdf:li>
                  <rdf:Description xmpDM:trackType="ScreenText" xmpDM:frameRate="f1000" xmpDM:trackName="Screen Text">
                     <xmpDM:markers>
                        <rdf:Seq>
                           <rdf:li><rdf:Description xmpDM:name="IP Security IPSec provides Access control: User authentication Data integrity Data origin authentication Rejection of replayed packets Confidentiality (encryption) Limited" xmpDM:startTime="0" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="traffic flow confidentiality Benefits: Security at Layer 3  Applies to all transports/applications Can be implemented in Firewall/router  Security" xmpDM:startTime="0" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="to all traffic crossing the perimeter Transparent to applications and can be transparent to end users Can provide security for" xmpDM:startTime="0" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="individual users Applications: VPNs, Branch Offices, Remote Users, Extranets Ref: http://en.wikipedia.org/wiki/IPsec" xmpDM:startTime="0" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="0" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IP Security Applications" xmpDM:startTime="212000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IP Security Architecture Internet Key Exchange (IKE) IPSec Security Association Database Security Policy database" xmpDM:startTime="578400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Association Database Each host has a database of Security Associations (SAs) SA = One-way security relationship between sender &amp;" xmpDM:startTime="692367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="receiver Two-way may use different security Two SA’s required Defined by 3 parameters: Security Parameters Index (SPI) IP Destination Address" xmpDM:startTime="692367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Protocol Identifier: AH or ESP For each SA, the database contains: SPI Sequence number counter and counter overflow flag" xmpDM:startTime="692367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Anti-replay window AH Information and ESP information Lifetime of the SA Mode: Transport or tunnel or wildcard Path MTU Ref:" xmpDM:startTime="692367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="http://en.wikipedia.org/wiki/Security_association" xmpDM:startTime="692367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="692367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Policy Database Relates IP traffic to specific SAs Match subset of IP traffic to relevant SA Use selectors to" xmpDM:startTime="869767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="filter outgoing traffic to map Based on: local &amp; remote IP addresses, next layer protocol, name, local &amp; remote ports" xmpDM:startTime="869767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="869767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Processing Models a." xmpDM:startTime="1166800" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Outbound Packets b." xmpDM:startTime="1166800" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Inbound Packets" xmpDM:startTime="1166800" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel Tunnel = Encaptulation Used whenever some feature is not supported in some part of the network, e.g.," xmpDM:startTime="1381600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="multicasting, mobile IP IP Land IP Land IP Not Spoken Here IP Header Payload Non-IP Header" xmpDM:startTime="1381600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec Secure IP: A series of proposals from IETF Separate Authentication and privacy Authentication Header (AH) ensures data integrity and" xmpDM:startTime="1609000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="data origin authentication Encapsulating Security Protocol (ESP) ensures confidentiality, data origin authentication, connectionless integrity, and anti-replay service Authenticated Encrypted IP" xmpDM:startTime="1609000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Header AH ESP Original IP Header* Original Data * Optional" xmpDM:startTime="1609000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel vs." xmpDM:startTime="1704933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Transport Mode Gateway-to-gateway vs." xmpDM:startTime="1704933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="end-to-end fig17-01 j0415926 j0415800 Router Router Gateway-to-Gateway End-to-end" xmpDM:startTime="1704933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec Secure IP: A series of proposals from IETF Separate Authentication and privacy Authentication Header (AH) ensures data integrity and" xmpDM:startTime="1862100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="data origin authentication Encapsulating Security Protocol (ESP) ensures confidentiality, data origin authentication, connectionless integrity, and anti-replay service Authenticated Encrypted IP" xmpDM:startTime="1862100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Header AH ESP Original IP Header* Original Data * Optional" xmpDM:startTime="1862100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel Tunnel = Encaptulation Used whenever some feature is not supported in some part of the network, e.g.," xmpDM:startTime="1862433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="multicasting, mobile IP IP Land IP Land IP Not Spoken Here IP Header Payload Non-IP Header" xmpDM:startTime="1862433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Processing Models a." xmpDM:startTime="1862967" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Outbound Packets b." xmpDM:startTime="1862967" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Inbound Packets" xmpDM:startTime="1862967" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Policy Database Relates IP traffic to specific SAs Match subset of IP traffic to relevant SA Use selectors to" xmpDM:startTime="1863800" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="filter outgoing traffic to map Based on: local &amp; remote IP addresses, next layer protocol, name, local &amp; remote ports" xmpDM:startTime="1863800" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1863800" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Association Database Each host has a database of Security Associations (SAs) SA = One-way security relationship between sender &amp;" xmpDM:startTime="1864233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="receiver Two-way may use different security Two SA’s required Defined by 3 parameters: Security Parameters Index (SPI) IP Destination Address" xmpDM:startTime="1864233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Protocol Identifier: AH or ESP For each SA, the database contains: SPI Sequence number counter and counter overflow flag" xmpDM:startTime="1864233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Anti-replay window AH Information and ESP information Lifetime of the SA Mode: Transport or tunnel or wildcard Path MTU Ref:" xmpDM:startTime="1864233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="http://en.wikipedia.org/wiki/Security_association" xmpDM:startTime="1864233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1864233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IP Security Architecture Internet Key Exchange (IKE) IPSec Security Association Database Security Policy database" xmpDM:startTime="1864600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IP Security Applications" xmpDM:startTime="1865533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IP Security Architecture Internet Key Exchange (IKE) IPSec Security Association Database Security Policy database" xmpDM:startTime="1957000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Association Database Each host has a database of Security Associations (SAs) SA = One-way security relationship between sender &amp;" xmpDM:startTime="1957500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="receiver Two-way may use different security Two SA’s required Defined by 3 parameters: Security Parameters Index (SPI) IP Destination Address" xmpDM:startTime="1957500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Protocol Identifier: AH or ESP For each SA, the database contains: SPI Sequence number counter and counter overflow flag" xmpDM:startTime="1957500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Anti-replay window AH Information and ESP information Lifetime of the SA Mode: Transport or tunnel or wildcard Path MTU Ref:" xmpDM:startTime="1957500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="http://en.wikipedia.org/wiki/Security_association" xmpDM:startTime="1957500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1957500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Policy Database Relates IP traffic to specific SAs Match subset of IP traffic to relevant SA Use selectors to" xmpDM:startTime="1958100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="filter outgoing traffic to map Based on: local &amp; remote IP addresses, next layer protocol, name, local &amp; remote ports" xmpDM:startTime="1958100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="1958100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Processing Models a." xmpDM:startTime="1958733" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Outbound Packets b." xmpDM:startTime="1958733" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Inbound Packets" xmpDM:startTime="1958733" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel Tunnel = Encaptulation Used whenever some feature is not supported in some part of the network, e.g.," xmpDM:startTime="1959467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="multicasting, mobile IP IP Land IP Land IP Not Spoken Here IP Header Payload Non-IP Header" xmpDM:startTime="1959467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec Secure IP: A series of proposals from IETF Separate Authentication and privacy Authentication Header (AH) ensures data integrity and" xmpDM:startTime="1960133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="data origin authentication Encapsulating Security Protocol (ESP) ensures confidentiality, data origin authentication, connectionless integrity, and anti-replay service Authenticated Encrypted IP" xmpDM:startTime="1960133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Header AH ESP Original IP Header* Original Data * Optional" xmpDM:startTime="1960133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel vs." xmpDM:startTime="1969300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Transport Mode Gateway-to-gateway vs." xmpDM:startTime="1969300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="end-to-end fig17-01 j0415926 j0415800 Router Router Gateway-to-Gateway End-to-end" xmpDM:startTime="1969300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Authentication Header Next Header = TCP=6, UDP=17, IP=4, AH=51  Designed by IPv6 fans Payload Length = Length of AH" xmpDM:startTime="1974233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="in 32-bit words − 2 (for IPv4) =Length of AH in 64-bit words -1 (for IPv6) SPI = Identifies Security" xmpDM:startTime="1974233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="association (0=Local use, 1-255 reserved) Authentication data = Integrity Check Value" xmpDM:startTime="1974233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="AH ICV Computation The AH ICV is computed over: IP header fields that are either immutable in transit or that" xmpDM:startTime="2321600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="are predictable in value upon arrival at the endpoint for the AH SA, e.g.," xmpDM:startTime="2321600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="source address (immutable), destination address with source routing (mutable but predictable) The AH header (Next Header, Payload Len, Reserved, SPI," xmpDM:startTime="2321600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Sequence Number, and the Authentication Data (which is set to zero for this computation), and explicit padding bytes (if any))" xmpDM:startTime="2321600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="The upper level protocol data, which is assumed to be immutable in transit IP Header AH Header [Old IP Header]" xmpDM:startTime="2321600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IP payload ICV coverage" xmpDM:startTime="2321600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="AH Version 3 RFC4302, December 2005 (V2 in RFC2402, November 1998, V1 in RFC1826, August 1995) Uniform algorithm for Security" xmpDM:startTime="2591100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Parameter Index (SPI) for unicast and multicast Unicast: SPI alone, or SPI+protocol may be used to select SA Multicast: SPI+DA" xmpDM:startTime="2591100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="or SPI+DA+SA Extended 64-bit sequence numbers for high-speed communications Separate RFC for mandatory algorithms" xmpDM:startTime="2591100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Encapsulating Security Payload (ESP) Provides: Message content confidentiality, Data origin authentication, Connectionless integrity, Anti-replay service, Limited traffic flow confidentiality Services" xmpDM:startTime="2594133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="depend on options selected when establish Security Association (SA), net location Can use a variety of encryption &amp; authentication algorithms" xmpDM:startTime="2594133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="2594133" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="AH Version 3 RFC4302, December 2005 (V2 in RFC2402, November 1998, V1 in RFC1826, August 1995) Uniform algorithm for Security" xmpDM:startTime="2625433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Parameter Index (SPI) for unicast and multicast Unicast: SPI alone, or SPI+protocol may be used to select SA Multicast: SPI+DA" xmpDM:startTime="2625433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="or SPI+DA+SA Extended 64-bit sequence numbers for high-speed communications Separate RFC for mandatory algorithms" xmpDM:startTime="2625433" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="AH ICV Computation The AH ICV is computed over: IP header fields that are either immutable in transit or that" xmpDM:startTime="2715000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="are predictable in value upon arrival at the endpoint for the AH SA, e.g.," xmpDM:startTime="2715000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="source address (immutable), destination address with source routing (mutable but predictable) The AH header (Next Header, Payload Len, Reserved, SPI," xmpDM:startTime="2715000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Sequence Number, and the Authentication Data (which is set to zero for this computation), and explicit padding bytes (if any))" xmpDM:startTime="2715000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="The upper level protocol data, which is assumed to be immutable in transit IP Header AH Header [Old IP Header]" xmpDM:startTime="2715000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IP payload ICV coverage" xmpDM:startTime="2715000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Authentication Header Next Header = TCP=6, UDP=17, IP=4, AH=51  Designed by IPv6 fans Payload Length = Length of AH" xmpDM:startTime="2715533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="in 32-bit words − 2 (for IPv4) =Length of AH in 64-bit words -1 (for IPv6) SPI = Identifies Security" xmpDM:startTime="2715533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="association (0=Local use, 1-255 reserved) Authentication data = Integrity Check Value" xmpDM:startTime="2715533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="AH ICV Computation The AH ICV is computed over: IP header fields that are either immutable in transit or that" xmpDM:startTime="2768400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="are predictable in value upon arrival at the endpoint for the AH SA, e.g.," xmpDM:startTime="2768400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="source address (immutable), destination address with source routing (mutable but predictable) The AH header (Next Header, Payload Len, Reserved, SPI," xmpDM:startTime="2768400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Sequence Number, and the Authentication Data (which is set to zero for this computation), and explicit padding bytes (if any))" xmpDM:startTime="2768400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="The upper level protocol data, which is assumed to be immutable in transit IP Header AH Header [Old IP Header]" xmpDM:startTime="2768400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IP payload ICV coverage" xmpDM:startTime="2768400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="AH Version 3 RFC4302, December 2005 (V2 in RFC2402, November 1998, V1 in RFC1826, August 1995) Uniform algorithm for Security" xmpDM:startTime="2768867" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Parameter Index (SPI) for unicast and multicast Unicast: SPI alone, or SPI+protocol may be used to select SA Multicast: SPI+DA" xmpDM:startTime="2768867" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="or SPI+DA+SA Extended 64-bit sequence numbers for high-speed communications Separate RFC for mandatory algorithms" xmpDM:startTime="2768867" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Encapsulating Security Payload (ESP) Provides: Message content confidentiality, Data origin authentication, Connectionless integrity, Anti-replay service, Limited traffic flow confidentiality Services" xmpDM:startTime="2865000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="depend on options selected when establish Security Association (SA), net location Can use a variety of encryption &amp; authentication algorithms" xmpDM:startTime="2865000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="2865000" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Packet Payload data: IP, TCP, UDP packet Pad Length in bytes Next Header: Type of payload (TCP, UDP, …)" xmpDM:startTime="2895900" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Authentication Data: Integrity Check Value over ESP packet" xmpDM:startTime="2895900" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Encapsulating Security Payload (ESP) Provides: Message content confidentiality, Data origin authentication, Connectionless integrity, Anti-replay service, Limited traffic flow confidentiality Services" xmpDM:startTime="2984367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="depend on options selected when establish Security Association (SA), net location Can use a variety of encryption &amp; authentication algorithms" xmpDM:startTime="2984367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="2984367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Packet Payload data: IP, TCP, UDP packet Pad Length in bytes Next Header: Type of payload (TCP, UDP, …)" xmpDM:startTime="3012100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Authentication Data: Integrity Check Value over ESP packet" xmpDM:startTime="3012100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Version 3 RFC4303, December 2005 (V2 in RFC2406, November 1998, V1 in RFC1827, August 1995) Uniform algorithm for SPI" xmpDM:startTime="3228200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="for unicast and multicast Extended 64-bit sequence numbers Separate RFC for mandatory algorithms Combined Mode algorithms: Combined Confidentiality+Integrity algorithms in" xmpDM:startTime="3228200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="addition to separate confidentiality and integrity algorithms Can add extra bytes before padding for traffic flow confidentiality Can generate and" xmpDM:startTime="3228200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="discard dummy padding packets (Next header=59) Issue: No version number in the header." xmpDM:startTime="3228200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="But older versions will reject new algorithms and options" xmpDM:startTime="3228200" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Packet Payload data: IP, TCP, UDP packet Pad Length in bytes Next Header: Type of payload (TCP, UDP, …)" xmpDM:startTime="3291267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Authentication Data: Integrity Check Value over ESP packet" xmpDM:startTime="3291267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Version 3 RFC4303, December 2005 (V2 in RFC2406, November 1998, V1 in RFC1827, August 1995) Uniform algorithm for SPI" xmpDM:startTime="3317267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="for unicast and multicast Extended 64-bit sequence numbers Separate RFC for mandatory algorithms Combined Mode algorithms: Combined Confidentiality+Integrity algorithms in" xmpDM:startTime="3317267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="addition to separate confidentiality and integrity algorithms Can add extra bytes before padding for traffic flow confidentiality Can generate and" xmpDM:startTime="3317267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="discard dummy padding packets (Next header=59) Issue: No version number in the header." xmpDM:startTime="3317267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="But older versions will reject new algorithms and options" xmpDM:startTime="3317267" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Anti-Replay Service Sender initializes sequence number to 0 when a new SA is established." xmpDM:startTime="3327500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Increment for each packet Receiver then accepts packets with sequence # within window of (N –W+1)" xmpDM:startTime="3327500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations SAs can implement either AH or ESP To implement both need to combine SAs to form a" xmpDM:startTime="3328400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="security association bundle Transport adjacency: Outer AH over Inner ESP Iterated tunneling: Multiple with different end points 1." xmpDM:startTime="3328400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="All security between end-systems: AH Transport, ESP Transport, ESP inside AH transport, any one of the first 3 inside AH" xmpDM:startTime="3328400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="or ESP Tunnel 2." xmpDM:startTime="3328400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Between gateways (routers or firewalls): Single SA." xmpDM:startTime="3328400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="No nesting." xmpDM:startTime="3328400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="3." xmpDM:startTime="3328400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Case 1 inside Case 2 4." xmpDM:startTime="3328400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel between a remote host and firewall." xmpDM:startTime="3328400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="One or two SAs may be used as in Case 1." xmpDM:startTime="3328400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="3328400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations Ch16." xmpDM:startTime="3329100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combinations.pdf" xmpDM:startTime="3329100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="00156198 Mnementh BEAE7A2F:" xmpDM:startTime="3329100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec Key Management (IKE) Handles key generation &amp; distribution Typically need 2 pairs of keys 2 per direction for integrity" xmpDM:startTime="3329667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="and confidentiality Manual key management Sys admin manually configures every system Automated key management Automated system for on demand creation" xmpDM:startTime="3329667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="of keys for SA’s in large systems Oakley key exchange and ISAKMP key management IKEv2 no longer uses Oakley &amp;" xmpDM:startTime="3329667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ISAKMP terms, but basic functionality is same Ref: http://en.wikipedia.org/wiki/Internet_Key_Exchange" xmpDM:startTime="3329667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="3329667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Oakley A key determination protocol based on D-H key exchange Adds features to address weaknesses of D-H." xmpDM:startTime="3330233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="D-H has no info on identities of parties, is subject to man-in-middle attack, is computationally expensive Oakley adds Cookies to" xmpDM:startTime="3330233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="thwart DoS attacks Several groups of pre-specified global parameters Nonces to protect against replay DH public key exchange with authentication" xmpDM:startTime="3330233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="using Digital signature, Public Key Encryption, or Symmetric Key Encryption Can use arithmetic in prime fields or elliptic curve fields" xmpDM:startTime="3330233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="3330233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ISAKMP Internet Security Association and Key Management Protocol Provides framework for key management Defines procedures and packet formats to establish," xmpDM:startTime="3330700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="negotiate, modify, and delete SAs Independent of key exchange protocol, encryption algorithm, and authentication method Ref: http://en.wikipedia.org/wiki/Internet_Security_Association_and_Key_Management_Protocol" xmpDM:startTime="3330700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="3330700" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Oakley A key determination protocol based on D-H key exchange Adds features to address weaknesses of D-H." xmpDM:startTime="3332467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="D-H has no info on identities of parties, is subject to man-in-middle attack, is computationally expensive Oakley adds Cookies to" xmpDM:startTime="3332467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="thwart DoS attacks Several groups of pre-specified global parameters Nonces to protect against replay DH public key exchange with authentication" xmpDM:startTime="3332467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="using Digital signature, Public Key Encryption, or Symmetric Key Encryption Can use arithmetic in prime fields or elliptic curve fields" xmpDM:startTime="3332467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="3332467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec Key Management (IKE) Handles key generation &amp; distribution Typically need 2 pairs of keys 2 per direction for integrity" xmpDM:startTime="3332633" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="and confidentiality Manual key management Sys admin manually configures every system Automated key management Automated system for on demand creation" xmpDM:startTime="3332633" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="of keys for SA’s in large systems Oakley key exchange and ISAKMP key management IKEv2 no longer uses Oakley &amp;" xmpDM:startTime="3332633" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ISAKMP terms, but basic functionality is same Ref: http://en.wikipedia.org/wiki/Internet_Key_Exchange" xmpDM:startTime="3332633" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="3332633" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations Ch16." xmpDM:startTime="3332767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combinations.pdf" xmpDM:startTime="3332767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="00156198 Mnementh BEAE7A2F:" xmpDM:startTime="3332767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations SAs can implement either AH or ESP To implement both need to combine SAs to form a" xmpDM:startTime="3332933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="security association bundle Transport adjacency: Outer AH over Inner ESP Iterated tunneling: Multiple with different end points 1." xmpDM:startTime="3332933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="All security between end-systems: AH Transport, ESP Transport, ESP inside AH transport, any one of the first 3 inside AH" xmpDM:startTime="3332933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="or ESP Tunnel 2." xmpDM:startTime="3332933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Between gateways (routers or firewalls): Single SA." xmpDM:startTime="3332933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="No nesting." xmpDM:startTime="3332933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="3." xmpDM:startTime="3332933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Case 1 inside Case 2 4." xmpDM:startTime="3332933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel between a remote host and firewall." xmpDM:startTime="3332933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="One or two SAs may be used as in Case 1." xmpDM:startTime="3332933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="3332933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Anti-Replay Service Sender initializes sequence number to 0 when a new SA is established." xmpDM:startTime="3333100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Increment for each packet Receiver then accepts packets with sequence # within window of (N –W+1)" xmpDM:startTime="3333100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Version 3 RFC4303, December 2005 (V2 in RFC2406, November 1998, V1 in RFC1827, August 1995) Uniform algorithm for SPI" xmpDM:startTime="3333500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="for unicast and multicast Extended 64-bit sequence numbers Separate RFC for mandatory algorithms Combined Mode algorithms: Combined Confidentiality+Integrity algorithms in" xmpDM:startTime="3333500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="addition to separate confidentiality and integrity algorithms Can add extra bytes before padding for traffic flow confidentiality Can generate and" xmpDM:startTime="3333500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="discard dummy padding packets (Next header=59) Issue: No version number in the header." xmpDM:startTime="3333500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="But older versions will reject new algorithms and options" xmpDM:startTime="3333500" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Packet Payload data: IP, TCP, UDP packet Pad Length in bytes Next Header: Type of payload (TCP, UDP, …)" xmpDM:startTime="3335233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Authentication Data: Integrity Check Value over ESP packet" xmpDM:startTime="3335233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Version 3 RFC4303, December 2005 (V2 in RFC2406, November 1998, V1 in RFC1827, August 1995) Uniform algorithm for SPI" xmpDM:startTime="3505533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="for unicast and multicast Extended 64-bit sequence numbers Separate RFC for mandatory algorithms Combined Mode algorithms: Combined Confidentiality+Integrity algorithms in" xmpDM:startTime="3505533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="addition to separate confidentiality and integrity algorithms Can add extra bytes before padding for traffic flow confidentiality Can generate and" xmpDM:startTime="3505533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="discard dummy padding packets (Next header=59) Issue: No version number in the header." xmpDM:startTime="3505533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="But older versions will reject new algorithms and options" xmpDM:startTime="3505533" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Anti-Replay Service Sender initializes sequence number to 0 when a new SA is established." xmpDM:startTime="3506400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Increment for each packet Receiver then accepts packets with sequence # within window of (N –W+1)" xmpDM:startTime="3506400" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations SAs can implement either AH or ESP To implement both need to combine SAs to form a" xmpDM:startTime="3557367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="security association bundle Transport adjacency: Outer AH over Inner ESP Iterated tunneling: Multiple with different end points 1." xmpDM:startTime="3557367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="All security between end-systems: AH Transport, ESP Transport, ESP inside AH transport, any one of the first 3 inside AH" xmpDM:startTime="3557367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="or ESP Tunnel 2." xmpDM:startTime="3557367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Between gateways (routers or firewalls): Single SA." xmpDM:startTime="3557367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="No nesting." xmpDM:startTime="3557367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="3." xmpDM:startTime="3557367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Case 1 inside Case 2 4." xmpDM:startTime="3557367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel between a remote host and firewall." xmpDM:startTime="3557367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="One or two SAs may be used as in Case 1." xmpDM:startTime="3557367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="3557367" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations Ch16." xmpDM:startTime="3691800" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combinations.pdf" xmpDM:startTime="3691800" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="00156198 Mnementh BEAE7A2F:" xmpDM:startTime="3691800" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec Key Management (IKE) Handles key generation &amp; distribution Typically need 2 pairs of keys 2 per direction for integrity" xmpDM:startTime="3799100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="and confidentiality Manual key management Sys admin manually configures every system Automated key management Automated system for on demand creation" xmpDM:startTime="3799100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="of keys for SA’s in large systems Oakley key exchange and ISAKMP key management IKEv2 no longer uses Oakley &amp;" xmpDM:startTime="3799100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ISAKMP terms, but basic functionality is same Ref: http://en.wikipedia.org/wiki/Internet_Key_Exchange" xmpDM:startTime="3799100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="3799100" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations Ch16." xmpDM:startTime="3834233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combinations.pdf" xmpDM:startTime="3834233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="00156198 Mnementh BEAE7A2F:" xmpDM:startTime="3834233" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations SAs can implement either AH or ESP To implement both need to combine SAs to form a" xmpDM:startTime="3834467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="security association bundle Transport adjacency: Outer AH over Inner ESP Iterated tunneling: Multiple with different end points 1." xmpDM:startTime="3834467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="All security between end-systems: AH Transport, ESP Transport, ESP inside AH transport, any one of the first 3 inside AH" xmpDM:startTime="3834467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="or ESP Tunnel 2." xmpDM:startTime="3834467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Between gateways (routers or firewalls): Single SA." xmpDM:startTime="3834467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="No nesting." xmpDM:startTime="3834467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="3." xmpDM:startTime="3834467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Case 1 inside Case 2 4." xmpDM:startTime="3834467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel between a remote host and firewall." xmpDM:startTime="3834467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="One or two SAs may be used as in Case 1." xmpDM:startTime="3834467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="3834467" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations Ch16." xmpDM:startTime="3835300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combinations.pdf" xmpDM:startTime="3835300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="00156198 Mnementh BEAE7A2F:" xmpDM:startTime="3835300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec Key Management (IKE) Handles key generation &amp; distribution Typically need 2 pairs of keys 2 per direction for integrity" xmpDM:startTime="3851767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="and confidentiality Manual key management Sys admin manually configures every system Automated key management Automated system for on demand creation" xmpDM:startTime="3851767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="of keys for SA’s in large systems Oakley key exchange and ISAKMP key management IKEv2 no longer uses Oakley &amp;" xmpDM:startTime="3851767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ISAKMP terms, but basic functionality is same Ref: http://en.wikipedia.org/wiki/Internet_Key_Exchange" xmpDM:startTime="3851767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="3851767" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Oakley A key determination protocol based on D-H key exchange Adds features to address weaknesses of D-H." xmpDM:startTime="3932933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="D-H has no info on identities of parties, is subject to man-in-middle attack, is computationally expensive Oakley adds Cookies to" xmpDM:startTime="3932933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="thwart DoS attacks Several groups of pre-specified global parameters Nonces to protect against replay DH public key exchange with authentication" xmpDM:startTime="3932933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="using Digital signature, Public Key Encryption, or Symmetric Key Encryption Can use arithmetic in prime fields or elliptic curve fields" xmpDM:startTime="3932933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="3932933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ISAKMP Internet Security Association and Key Management Protocol Provides framework for key management Defines procedures and packet formats to establish," xmpDM:startTime="4081667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="negotiate, modify, and delete SAs Independent of key exchange protocol, encryption algorithm, and authentication method Ref: http://en.wikipedia.org/wiki/Internet_Security_Association_and_Key_Management_Protocol" xmpDM:startTime="4081667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="4081667" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Oakley A key determination protocol based on D-H key exchange Adds features to address weaknesses of D-H." xmpDM:startTime="4083033" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="D-H has no info on identities of parties, is subject to man-in-middle attack, is computationally expensive Oakley adds Cookies to" xmpDM:startTime="4083033" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="thwart DoS attacks Several groups of pre-specified global parameters Nonces to protect against replay DH public key exchange with authentication" xmpDM:startTime="4083033" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="using Digital signature, Public Key Encryption, or Symmetric Key Encryption Can use arithmetic in prime fields or elliptic curve fields" xmpDM:startTime="4083033" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="4083033" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ISAKMP Internet Security Association and Key Management Protocol Provides framework for key management Defines procedures and packet formats to establish," xmpDM:startTime="4140067" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="negotiate, modify, and delete SAs Independent of key exchange protocol, encryption algorithm, and authentication method Ref: http://en.wikipedia.org/wiki/Internet_Security_Association_and_Key_Management_Protocol" xmpDM:startTime="4140067" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="4140067" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IKEV2 Exchanges HDR = IKE Header SAx1 = Offered and Chosen algorithms, DH gro u p KEx = D -" xmpDM:startTime="4172600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="H Public key Nx = Nonces CERTREQ = Certificate Request IDx = Identity CERT = Certificate SK{ ." xmpDM:startTime="4172600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="..}" xmpDM:startTime="4172600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="= MAC and Encrypt A UTH = Authentication SAx2 = Algorithms, parameters for IPsec S A TSx = Traffic Selectors" xmpDM:startTime="4172600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="for IPsec SA N = Notify D = Delete CP = Configuration (a) Set up SA for IKE Exchanges Here" xmpDM:startTime="4172600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="are my algorithms, my DH public key, my Nonce HDR, SAi, Ni Here is my chosen algorithm, my public key," xmpDM:startTime="4172600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="my nonce, acceptable Root CAs HDR, SAr1, KEr, Nr, [CertReq] Here is my ID, Traffic selectors HDR, E(SK, {IDi, [Cert]," xmpDM:startTime="4172600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="[CertReq], IDr, AUTH, SAi2, TSi, TSr}) OK." xmpDM:startTime="4172600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Here is my certificate, traffic selector HDR, E(SK, {IDr, [Cert], AUTH, SAr2, TSi, TSr}) (b) Set up other SAs Let’s" xmpDM:startTime="4172600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="setup a new SA with this key and traffic selector HDR, E(SK, {[N], SA, Ni, [KEi], [TSi, TSr]}) OK, Here" xmpDM:startTime="4172600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="is my nonce, key, and traffic selectors HDR, E(SK, {SA, Nr, [KEr],[TSi,TSr]}) (c) Management/Error/Other Notifications Alert! Delete/Change this SA HDR," xmpDM:startTime="4172600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="E(SK, {[N], [D], [CP], …}) Alert! Delete/Change this SA HDR, E(SK, {[N], [D], [CP], …}) Initiator Responder" xmpDM:startTime="4172600" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ISAKMP Internet Security Association and Key Management Protocol Provides framework for key management Defines procedures and packet formats to establish," xmpDM:startTime="4175333" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="negotiate, modify, and delete SAs Independent of key exchange protocol, encryption algorithm, and authentication method Ref: http://en.wikipedia.org/wiki/Internet_Security_Association_and_Key_Management_Protocol" xmpDM:startTime="4175333" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="" xmpDM:startTime="4175333" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IKEV2 Exchanges HDR = IKE Header SAx1 = Offered and Chosen algorithms, DH gro u p KEx = D -" xmpDM:startTime="4197300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="H Public key Nx = Nonces CERTREQ = Certificate Request IDx = Identity CERT = Certificate SK{ ." xmpDM:startTime="4197300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="..}" xmpDM:startTime="4197300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="= MAC and Encrypt A UTH = Authentication SAx2 = Algorithms, parameters for IPsec S A TSx = Traffic Selectors" xmpDM:startTime="4197300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="for IPsec SA N = Notify D = Delete CP = Configuration (a) Set up SA for IKE Exchanges Here" xmpDM:startTime="4197300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="are my algorithms, my DH public key, my Nonce HDR, SAi, Ni Here is my chosen algorithm, my public key," xmpDM:startTime="4197300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="my nonce, acceptable Root CAs HDR, SAr1, KEr, Nr, [CertReq] Here is my ID, Traffic selectors HDR, E(SK, {IDi, [Cert]," xmpDM:startTime="4197300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="[CertReq], IDr, AUTH, SAi2, TSi, TSr}) OK." xmpDM:startTime="4197300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Here is my certificate, traffic selector HDR, E(SK, {IDr, [Cert], AUTH, SAr2, TSi, TSr}) (b) Set up other SAs Let’s" xmpDM:startTime="4197300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="setup a new SA with this key and traffic selector HDR, E(SK, {[N], SA, Ni, [KEi], [TSi, TSr]}) OK, Here" xmpDM:startTime="4197300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="is my nonce, key, and traffic selectors HDR, E(SK, {SA, Nr, [KEr],[TSi,TSr]}) (c) Management/Error/Other Notifications Alert! Delete/Change this SA HDR," xmpDM:startTime="4197300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="E(SK, {[N], [D], [CP], …}) Alert! Delete/Change this SA HDR, E(SK, {[N], [D], [CP], …}) Initiator Responder" xmpDM:startTime="4197300" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IKEv2 Exchanges (Cont) SkeySeed SK is generated by D-H exchange A Pseudo Random Function (PRF) is used with SK to" xmpDM:startTime="4577933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="generate all other keys Encryption Key + Integrity Key per side Þ Four keys/SA Traffic selectors specify the IP address" xmpDM:startTime="4577933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="range, ports, and IP protocol type for the SA Ref: C." xmpDM:startTime="4577933" xmpDM:duration="1000"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Kaufman, et al, “IKEv2,” RFC 5996, September 2010" xmpDM:startTime="4577933" xmpDM:duration="1000"/></rdf:li></rdf:Seq>
                     </xmpDM:markers>
                  </rdf:Description>
               </rdf:li>
               <rdf:li>
                  <rdf:Description xmpDM:trackType="TableOfContents" xmpDM:frameRate="f1000" xmpDM:trackName="Table of Contents">
                     <xmpDM:markers>
                        <rdf:Seq>
                           <rdf:li><rdf:Description xmpDM:name="IP Security" xmpDM:startTime="0" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="0" tscDM:imageoffset="0" tscDM:imagerect="0, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IP Security Applications" xmpDM:startTime="212000" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="1" tscDM:imageoffset="0" tscDM:imagerect="75, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IP Security Architecture" xmpDM:startTime="578400" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="2" tscDM:imageoffset="0" tscDM:imagerect="150, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Association Database" xmpDM:startTime="692367" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="3" tscDM:imageoffset="0" tscDM:imagerect="225, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Policy Database" xmpDM:startTime="869767" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="4" tscDM:imageoffset="0" tscDM:imagerect="300, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Processing Models" xmpDM:startTime="1166800" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="5" tscDM:imageoffset="0" tscDM:imagerect="375, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel" xmpDM:startTime="1381600" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="6" tscDM:imageoffset="0" tscDM:imagerect="450, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec" xmpDM:startTime="1609000" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="7" tscDM:imageoffset="0" tscDM:imagerect="525, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel vs. Transport Mode" xmpDM:startTime="1704933" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="8" tscDM:imageoffset="0" tscDM:imagerect="600, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec" xmpDM:startTime="1862100" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="9" tscDM:imageoffset="0" tscDM:imagerect="675, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel" xmpDM:startTime="1862433" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="10" tscDM:imageoffset="0" tscDM:imagerect="750, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Processing Models" xmpDM:startTime="1862967" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="11" tscDM:imageoffset="0" tscDM:imagerect="825, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Policy Database" xmpDM:startTime="1863800" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="12" tscDM:imageoffset="0" tscDM:imagerect="900, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Association Database" xmpDM:startTime="1864233" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="13" tscDM:imageoffset="0" tscDM:imagerect="975, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IP Security Architecture" xmpDM:startTime="1864600" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="14" tscDM:imageoffset="0" tscDM:imagerect="1050, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IP Security Applications" xmpDM:startTime="1865533" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="15" tscDM:imageoffset="0" tscDM:imagerect="1125, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IP Security Architecture" xmpDM:startTime="1957000" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="16" tscDM:imageoffset="0" tscDM:imagerect="1200, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Association Database" xmpDM:startTime="1957500" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="17" tscDM:imageoffset="0" tscDM:imagerect="1275, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Security Policy Database" xmpDM:startTime="1958100" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="18" tscDM:imageoffset="0" tscDM:imagerect="1350, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Processing Models" xmpDM:startTime="1958733" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="19" tscDM:imageoffset="0" tscDM:imagerect="1425, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel" xmpDM:startTime="1959467" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="20" tscDM:imageoffset="0" tscDM:imagerect="1500, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec" xmpDM:startTime="1960133" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="21" tscDM:imageoffset="0" tscDM:imagerect="1575, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Tunnel vs. Transport Mode" xmpDM:startTime="1969300" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="22" tscDM:imageoffset="0" tscDM:imagerect="1650, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Authentication Header" xmpDM:startTime="1974233" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="23" tscDM:imageoffset="0" tscDM:imagerect="1725, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="AH ICV Computation" xmpDM:startTime="2321600" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="24" tscDM:imageoffset="0" tscDM:imagerect="1800, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="AH Version 3" xmpDM:startTime="2591100" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="25" tscDM:imageoffset="0" tscDM:imagerect="1875, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Encapsulating Security Payload (ESP)" xmpDM:startTime="2594133" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="26" tscDM:imageoffset="0" tscDM:imagerect="1950, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="AH Version 3" xmpDM:startTime="2625433" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="27" tscDM:imageoffset="0" tscDM:imagerect="2025, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="AH ICV Computation" xmpDM:startTime="2715000" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="28" tscDM:imageoffset="0" tscDM:imagerect="2100, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Authentication Header" xmpDM:startTime="2715533" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="29" tscDM:imageoffset="0" tscDM:imagerect="2175, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="AH ICV Computation" xmpDM:startTime="2768400" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="30" tscDM:imageoffset="0" tscDM:imagerect="2250, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="AH Version 3" xmpDM:startTime="2768867" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="31" tscDM:imageoffset="0" tscDM:imagerect="2325, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Encapsulating Security Payload (ESP)" xmpDM:startTime="2865000" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="32" tscDM:imageoffset="0" tscDM:imagerect="2400, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Packet" xmpDM:startTime="2895900" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="33" tscDM:imageoffset="0" tscDM:imagerect="2475, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Encapsulating Security Payload (ESP)" xmpDM:startTime="2984367" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="34" tscDM:imageoffset="0" tscDM:imagerect="2550, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Packet" xmpDM:startTime="3012100" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="35" tscDM:imageoffset="0" tscDM:imagerect="2625, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Version 3" xmpDM:startTime="3228200" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="36" tscDM:imageoffset="0" tscDM:imagerect="2700, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Packet" xmpDM:startTime="3291267" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="37" tscDM:imageoffset="0" tscDM:imagerect="2775, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Version 3" xmpDM:startTime="3317267" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="38" tscDM:imageoffset="0" tscDM:imagerect="2850, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Anti-Replay Service" xmpDM:startTime="3327500" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="39" tscDM:imageoffset="0" tscDM:imagerect="2925, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations" xmpDM:startTime="3328400" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="40" tscDM:imageoffset="0" tscDM:imagerect="3000, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations" xmpDM:startTime="3329100" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="41" tscDM:imageoffset="0" tscDM:imagerect="3075, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec Key Management (IKE)" xmpDM:startTime="3329667" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="42" tscDM:imageoffset="0" tscDM:imagerect="3150, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Oakley" xmpDM:startTime="3330233" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="43" tscDM:imageoffset="0" tscDM:imagerect="3225, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ISAKMP" xmpDM:startTime="3330700" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="44" tscDM:imageoffset="0" tscDM:imagerect="3300, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Oakley" xmpDM:startTime="3332467" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="45" tscDM:imageoffset="0" tscDM:imagerect="3375, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec Key Management (IKE)" xmpDM:startTime="3332633" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="46" tscDM:imageoffset="0" tscDM:imagerect="3450, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations" xmpDM:startTime="3332767" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="47" tscDM:imageoffset="0" tscDM:imagerect="3525, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations" xmpDM:startTime="3332933" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="48" tscDM:imageoffset="0" tscDM:imagerect="3600, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Anti-Replay Service" xmpDM:startTime="3333100" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="49" tscDM:imageoffset="0" tscDM:imagerect="3675, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Version 3" xmpDM:startTime="3333500" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="50" tscDM:imageoffset="0" tscDM:imagerect="3750, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Packet" xmpDM:startTime="3335233" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="51" tscDM:imageoffset="0" tscDM:imagerect="3825, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ESP Version 3" xmpDM:startTime="3505533" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="52" tscDM:imageoffset="0" tscDM:imagerect="3900, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Anti-Replay Service" xmpDM:startTime="3506400" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="53" tscDM:imageoffset="0" tscDM:imagerect="3975, 0, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations" xmpDM:startTime="3557367" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="54" tscDM:imageoffset="0" tscDM:imagerect="50, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations" xmpDM:startTime="3691800" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="55" tscDM:imageoffset="0" tscDM:imagerect="125, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec Key Management (IKE)" xmpDM:startTime="3799100" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="56" tscDM:imageoffset="0" tscDM:imagerect="200, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations" xmpDM:startTime="3834233" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="57" tscDM:imageoffset="0" tscDM:imagerect="275, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations" xmpDM:startTime="3834467" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="58" tscDM:imageoffset="0" tscDM:imagerect="350, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Combining Security Associations" xmpDM:startTime="3835300" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="59" tscDM:imageoffset="0" tscDM:imagerect="425, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IPSec Key Management (IKE)" xmpDM:startTime="3851767" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="60" tscDM:imageoffset="0" tscDM:imagerect="500, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Oakley" xmpDM:startTime="3932933" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="61" tscDM:imageoffset="0" tscDM:imagerect="575, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ISAKMP" xmpDM:startTime="4081667" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="62" tscDM:imageoffset="0" tscDM:imagerect="650, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="Oakley" xmpDM:startTime="4083033" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="63" tscDM:imageoffset="0" tscDM:imagerect="725, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ISAKMP" xmpDM:startTime="4140067" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="64" tscDM:imageoffset="0" tscDM:imagerect="800, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IKEV2 Exchanges" xmpDM:startTime="4172600" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="65" tscDM:imageoffset="0" tscDM:imagerect="875, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="ISAKMP" xmpDM:startTime="4175333" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="66" tscDM:imageoffset="0" tscDM:imagerect="950, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IKEV2 Exchanges" xmpDM:startTime="4197300" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="67" tscDM:imageoffset="0" tscDM:imagerect="1025, 56, 75, 56"/></rdf:li><rdf:li><rdf:Description xmpDM:name="IKEv2 Exchanges (Cont)" xmpDM:startTime="4577933" tscDM:image="l_20ips2_Thumbnails.png" tscDM:imageindex="68" tscDM:imageoffset="0" tscDM:imagerect="1100, 56, 75, 56"/></rdf:li></rdf:Seq>
                     </xmpDM:markers>
                  </rdf:Description>
               </rdf:li>
            </rdf:Bag>
         </xmpDM:Tracks>
         <tscDM:controller>
            <rdf:Description xmpDM:name="tscplayer">
               <tscDM:parameters>
                  <rdf:Bag>
                     <rdf:li xmpDM:name="autohide" xmpDM:value="false"/><rdf:li xmpDM:name="autoplay" xmpDM:value="true"/><rdf:li xmpDM:name="loop" xmpDM:value="false"/><rdf:li xmpDM:name="searchable" xmpDM:value="true"/><rdf:li xmpDM:name="captionsenabled" xmpDM:value="false"/><rdf:li xmpDM:name="sidebarenabled" xmpDM:value="false"/><rdf:li xmpDM:name="unicodeenabled" xmpDM:value="false"/><rdf:li xmpDM:name="backgroundcolor" xmpDM:value="000000"/><rdf:li xmpDM:name="sidebarlocation" xmpDM:value="left"/><rdf:li xmpDM:name="endaction" xmpDM:value="stop"/><rdf:li xmpDM:name="endactionparam" xmpDM:value="true"/><rdf:li xmpDM:name="locale" xmpDM:value="en-US"/></rdf:Bag>
               </tscDM:parameters>
               <tscDM:controllerText>
                  <rdf:Bag>
                  </rdf:Bag>
               </tscDM:controllerText>
            </rdf:Description>
         </tscDM:controller>
         <tscDM:contentList>
            <rdf:Description>
               <tscDM:files>
                  <rdf:Seq>
                     <rdf:li xmpDM:name="0" xmpDM:value="l_20ips2.mp4"/><rdf:li xmpDM:name="1" xmpDM:value="l_20ips2_First_Frame.png"/><rdf:li xmpDM:name="2" xmpDM:value="l_20ips2_Thumbnails.png"/></rdf:Seq>
               </tscDM:files>
            </rdf:Description>
         </tscDM:contentList>
      </rdf:Description>
   </rdf:RDF>
</x:xmpmeta>