ứng dụng khách hàng sẽ gửi các máy chủ tên của máy và số lượng các cổng mà người dùng muốn kết nối. Các máy chủ SOCKS thực sự làm cho các kết nối với máy chủ từ xa và sau đó minh bạch di chuyển dữ liệu qua lại giữa ứng dụng và máy tính từ xa. Người sử dụng không có ý tưởng rằng các máy chủ SOCKS là ngay cả trong vòng lặp | Security Technologies client application sends the server the name of the machine and the port number to which the user wants to connect. The SOCKS server actually makes the connection with the remote host and then transparently moves data back and forth between the application and the remote machine. The user has no idea that the SOCKS server is even in the loop see Figure 2-21 . Figure 2-21 The SOCKS Security Model The difficulty with using SOCKS is that somebody has to replace the network system calls with the SOCKS versions this process is generally referred to as SOCKS-ification or SOCKS-ifying an application . Fortunately most of the common network applications such as Telnet FTP finger and whois have already been SOCKS-ified and many vendors are now including SOCKS support in commercial applications. Network Layer Security Network layer security pertains to security services at the IP layer of the TCP IP protocol stack. Many years of work have produced a set of standards from the IETF that collectively define how to secure services at the IP Network layer. The IP Security Protocol Suite The IP Security IPsec protocol suite comprises a set of standards used to provide privacy and authentication services at the IP layer. The current ratified IPsec standards include four algorithm-independent base specifications RFC 2401 the IP Security Architecture defines the overall architecture and specifies elements common to both the IP Authentication Header AH and the IP Encapsulating Security Payload ESP . A RFC 2402 the IP Authentication Header AH defines an algorithm-independent mechanism for providing exportable cryptographic authentication without encryption to IPv4 and IPv6 packets. RFC 2406 the IP Encapsulating Security Payload ESP defines an algorithm-independent mechanism for providing encryption to IPv4 and IPv6 packets. RFC 2408 the Internet Security Association and Key Management Protocol ISAKMP defines procedures and packet formats to establish negotiate .
