VPN & Remote Working - Computerphile

oh hello

hello yes i can see you

so uh it's going to be a bit obvious

already but

steve you

apart from the fact that you've frozen

and turned into a load of garbled uh

mess suggesting i might need to turn the

video off what are we talking about

today

it's a bit of a different type of day as

you can see i'm not at the university

i'm working from home like most people

in the world so we're going to record a

computer file sean is at home with his

house we're socially distancing i'm at

my house i've got my camera out i'm

sitting in my dining room and we're

going to talk about working from home

one of the things that i've been doing

over the last week is i've been using

software like microsoft teams to

communicate with my students and things

everything now at the university of

nottingham is being done online and i

thought it'd be interesting to spend a

few computer files talking about the

technology that people are using to work

from home we'll do a series of videos on

these sort of things while we're all

locked down and we'll explore some in

sort of overview and others will go down

into the details of some of the

nitty-gritty stuff and i thought the

first one to start with would be to look

at what people are using to connect to

their work networks which is virtual

private networks there's two uses of

vpns it's a sort of use that people use

it at home perhaps and there's a sort of

use that people use in the business

world where they're trying to connect to

their corporate network so they can use

resources that exist on that corporate

network and it's that latter view that

we're going to talk about today the

technology you used to do both from when

using at home to sort of protect your

traffic if you're on a hostile network

and when you're the business world is

the same but the emphasis is slightly

different we're going to talk about it

from the business world emphasis because

of the current situations i think the

place decides to think about how people

use their computers and networks in a

business and then we can extrapolate

from that the problem that we need to

solve with a virtual private network and

then how the technology works

from that so i'm going to draw a little

diagram

i don't have any computer listing paper

here

but i have the next best thing i have my

ipad

with computer listing paper

on it and we'll draw on that and

hopefully the screen capture will work

and you'll be able to see what i'm doing

let's have a think about what a typical

corporate network would be we would have

some computers that people would use

and these would sort of be networked

together let's just have a couple it

would be a small office and they're all

connected to a single network and

alongside that there might be servers

that you'd use so there might be for

example

a file server which contains some secret

information we'll call this the files

and we might have a database which has

got some information on and on a normal

corporate network you can access that

quite easily the machines can send

packets out over the network to the file

server and access it and things are

generally secure you may have some

permissions set up so only the right

people can access the right services and

so on but these days that network is

going to be connected via

some sort of router to the internet and

if i can draw a cloud picture that will

be the internet and so those machines

can also access the internet via the

router and the router can act as a

firewall so that people can't get into

it from the outside and that all works

absolutely fine the problem comes is if

we have a person sitting out in a cafe

or working from home who wants to access

those same resources we need to provide

access to those resources without making

them insecure now some of these you

could secure and put directly out on the

web there's no problem doing that but

some of them may be devices that you

don't want accessible out on the wide

internet what we want to be able to do

is to have the person who's sitting here

on the outside be able to access as if

they were directly connected to that

network but of course they're not in the

physical premises so we can't just run a

cable to them

so how do we get around this well

what you could do at one point was you

could buy a dedicated connection from

your telecoms company and they would run

a wire from your business premises to

say the person's home and you could

connect them down where you'd have a

direct cable that ran across the whole

thing

the other thing you could do is use a

dial up modem and the person would ring

over the telephone network and connect

to it that way you'd have remote access

by that but

that requires specific resources

requires a dialogue modem it requires a

direct connection being put into place

what would be great is if someone could

just sit on the internet and access

those resources from wherever they are

but with the same level as access as if

they had a physical connection to the

network and this is what a virtual

private network is trying to solve now

how does that work well we need to think

about how the computer is actually

communicating over the local network and

then we can extrapolate out from that to

see how the data gets sent over a

virtual private network so let me bring

up a new sheet of virtual paper this is

an interesting experience doing a

computer file this way it's very

different from doing it with shawn in

the room so let's think about it we've

got a machine on the local network and

we've got a file server so it's trying

to access files through that now in the

way that modern networks work

particularly ip networks we take the

data we're trying to send and we break

it down into a series of chunks

which we call packets and we send

a series of chunks out over the network

but those chunks don't go as pure data

over the network we need to sort of wrap

them up so that when they get to the

other end they can be sort of unwrapped

and put back together in the right order

because depending on how the network's

configured depending on how complicated

the network is they may get take

different routes to get to the point so

there's various things generally would

have the data in a packet and then on

top of that we put a series of headers

that tell us things so on a standard

network these days you'd have a tcp

header there that would tell it with the

order that these packets need to go in

and then you'd have an ip header

put in front of that which would tell it

where it's going where it's come from

and then these days the local network

will almost certainly be ethernet and

that whole lot

will be put inside an ethernet packet

and so we'll have an ethernet header at

the top and then that can be sent either

directly to the machine that wants it or

to a machine that can pass it on to the

machine that wants it over the company's

local network so that's how we send data

over the local network

but we can actually do the same thing if

we had a direct connection rather than

having

the machine put it directly on the local

network we'd have another machine which

was connected to the local network and

connected to the direct connection and

it would give an ip address to the

remote machine remember this is a

physical direct connection either by a

dial up modem link or

a physical lease line from the telecoms

company and then it wouldn't put the

ethernet header on the front of that

there

so the internet header would disappear

but it would wrap it up in some other

form of header so the usual one that was

used on these lines was a

ppp a point-to-point protocol packet

header same thing we take the data wrap

it up in the tcp header wrap it up into

an ip header and then send it out using

ppp over the direct connection between

the two machines so that's how we can do

it there but what if we want to do this

with someone who's just sitting on the

internet

well we can do basically a very similar

thing

we give the remote machine an ip address

as if it was on our network but rather

than sending that packet directly

to the machines over the internet what

it does it takes that wrapped up ip

package and it wraps the whole lot up as

another

packet so it has a udp header here

that's another

way things communicate over the internet

and there's a reason why it uses udp

over tcp which we might cover in a later

video and then that gets wrapped up as

another ip packet

but this time rather than saying wait

once you go on the local network this is

going from the remote machines address

on the internet to a gateway server

on the that's running at the company

so that then gets sent

over the internet to the right machine

to the gateway server and then the

header can be removed the udp header to

leave the original ip packet

that was sent by the machine and the

same thing can happen in reverse but

there's a couple of issues one we're

sending data out over the internet so we

need to make sure that that data is

protected from being altered as someone

is sending it and also that someone

can't read the secret information that

might be in that data and we can do that

using cryptography we can use hashing to

hash the data that's in there and then

say whether it's been changed or not so

we can sign that hash in the same way

that mike's talked about in other videos

and we can also

use cryptography to encrypt the data so

that it can't be snooped on as it

travels over the internet so that's

relatively straightforward that gives us

the private part and we get the virtual

part because we're sending it

over the internet over a virtual link

that we've created just using a standard

internet connection you have to set up

your corporate network so that it knows

that i packets going to this particular

ip address need to go out

over a virtual private network link and

so we can send it out

over there and also you need to make

sure that the machine the remote machine

is sending packets that are going to

that machine over the virtual network

and so on there's actually two ways you

can get the remote machine to send

packets you can either

um just send the ones that are going to

that network there and let everything

else go out over the internet and that

works fine

you get good browsing speed but you

might also be using services on the

internet that you don't want people to

know about if you're working on

you might be accessing resources that

could compromise your business integrity

and so on and so you can also set it up

and this is what people use at home if

they're using a vpn to protect their

connection so that all your traffic is

sent over the virtual private network

and then it appears as if it's leaving

from the business network where it's

coming out of with their ip addresses

even though actually the machine is in a

different location and so the data is

con

encrypted and sent over that to the

destination and then sent on from there

as if you were connected to that network

and so it's not proxied it's as

literally as if your machine is

connected to that network of course the

problem you have here is if you're

sending all your data out

over the virtual private network you

need to make sure

that the virtual private network date

traffic itself isn't sent out over the

virtual private network otherwise it

wouldn't get there and the operating

system can usually take care of this

because the connection to the virtual

private network is created

before you start sending data over the

virtual private network so it can still

track where it needs to root that

information over the internet the only

other thing you need is some way to

authenticate who the person using the

network is and this is usually done when

you start up the connection so whereas

with a normal network connection these

days if you connect to wi-fi you connect

to ethernet you're immediately connected

to the network there may be some access

controls there to um say whether you can

actually use it and send things anywhere

but the technology immediately connects

to you with a virtual private network

you have to set that connection up you

need to set up that virtual connection

with the server at the company end

and the client at the

remote end is configuring the details so

that they know where the ip address is

where to send those wrapped up packets

back over the network i understand

what's being achieved there but does

this run into any problems at all

obviously it's blockable you could see

the vpn traffic going over and you can

just sort of stop those packets being

sent and so on um you shouldn't if the

encryption's good and actually setting

up all the encryption making it's right

is quite difficult there's a lot of sort

of commercial home use vpns where

actually if you're not careful it can be

set up so it's virtually not encrypted

at all the other thing to say from that

point of view is that it's still

possible to see

what people are doing even if they can't

see actually the data they're

transferring i mean certain activities

that you might do over the internet have

specific patterns that data is

transferred in and so you can infer from

the way the packets over the vpn are

going what's actually happening there so

it's not

a true

hidden things you could still see some

things for example the difference

between a sort of video conferencing

call like this and a web page you'd be

able to say looks like they're video

conferencing

looks like their sort of web page you

wouldn't have full detail but you could

sort of infer that from the way the

traffic is sort of being

transferred and things

the other thing is of course from more

practical point of view it will add

latency to your connection because

you've got to send the packet to the vpn

server and then out to its destination

um

it'll add latency depending on how bad

the network is where you are that might

actually be faster because if your

business has got a faster connection

that might be a more direct

route than you going directly if you

follow

and of course because each packet has to

be slightly smaller to fit the extra

headers in there then you will

run slightly slower than the maximum

speed you could transfer but that's

marginally less so

there are swings and roundabouts direct

connection and so on is always going to

be faster but this gives you a lot of

peace of mind it means you can have

access as if you were sitting on your

corporate network

if this is our data path with our

columns by sharing bytes around the

different columns when we combine it

with the mixed column step which we'll

do in a minute you'll see that actually

we're mixing everything up so within

just a couple of rounds we can either

make the computer processor faster or we

can have multiple cores each working on

part of the problem at the same speed