Uma ukhathazekile ngokuphepha kwedatha yakho uma uxhuma kwi-inthanethi kusuka ku-Windows, kuvamile ukudideka ngemibono efana ne -TLS, i-SSL, i-VPN, i-OpenVPN, kanye ne-IPsec . Uma uqala ukubheka, zibonakala zifana (zonke "zibethela" okuthile), kodwa empeleni, zixazulula izinkinga ezahlukene futhi zisetshenziswa ezingqimbeni ezahlukene zokuxhumana.
Ngaphambi kokuthi usheshe ukufaka uhlelo lokusebenza lwe-VPN noma uphazamise izilungiselelo ezithuthukisiwe zesiphequluli sakho, kungumqondo omuhle ukuqonda kahle ukuthi iyini i-TLS, iyini i-VPN, yiziphi izinqubo ezifana ne-SSL noma i-IPsec , futhi, ngaphezu kwakho konke, yiziphi izimo okufanele uzisebenzise kuzo ku-PC yakho ye-Windows. Ake sibheke ngokuthula, kodwa ngaphandle kwamagama obuchwepheshe angadingekile.
Iyini i-TLS futhi ihluke kanjani ku-SSL?
Uma uzwa "ngesitifiketi se-SSL," "iwebhusayithi evikelekile," noma ubona isithonjana se-padlock kusiphequluli sakho, okusetshenziswayo namuhla yi- TLS (Transport Layer Security) , iphrothokholi ejwayelekile ebethela idatha phakathi kwedivayisi yakho neseva ku-inthanethi. I-SSL yayiyisandulelo sayo, kodwa manje isibhekwa njengengaphephile futhi isisusiwe ezinhlelweni zesimanje.
Singasho ukuthi i-TLS iyiphrothokholi yokubethela ungqimba lokuthutha , eqinisekisa ukuthi idatha ehamba phakathi kweklayenti neseva ayikwazi ukufundwa noma ukuphathwa kabi kalula ngabantu besithathu. Yenza izinto ezimbili ezibalulekile: ivikela ubumfihlo bedatha futhi iqinisekisa ukuthi ayishintshwanga endleleni.
I-SSL ne-TLS bezinezinguqulo ezahlukene eminyakeni edlule. Kodwa-ke, i-SSL yaphelelwa yisikhathi kudala. Eqinisweni, ibilokhu ingasebenzi kuziphequluli nezinsizakalo ezithembekile. Abanye abahlinzeki basabhekisela "ezitifiketi ze-SSL" ngenxa yomkhuba, yize empeleni ziyizitifiketi ze-TLS futhi zisebenzisa izinguqulo zesimanje zephrothokholi kuphela.
Indlela i-TLS esebenza ngayo: ukubethela, ukuxhawulana, kanye nezitifiketi
Ukuze uxhumano lwe-TLS lusebenze (isibonelo, uma ufinyelela iwebhusayithi ene-HTTPS), inqubo ezenzakalelayo ebizwa ngokuthi i-TLS handshake yenzeka phakathi kwesiphequluli sakho neseva . Isobala kuwe, kodwa iyisisekelo sayo yonke ukuphepha.
Phakathi nalokhu kuxhawulana, iklayenti neseva bashintshana ngolwazi ukuze bakhethe ama-algorithms okubethela, baqinisekise omunye nomunye, futhi bakhiqize okhiye besikhashana abazosetshenziswa kuphela kuleso sikhathi. Lokhu kuxoxisana kusekelwe ekubethelweni kokhiye womphakathi kanye nezitifiketi zedijithali ezikhishwe yiziphathimandla zesitifiketi (ama-CA).
Izitifiketi zivumela isiphequluli sakho ukuqinisekisa ubunikazi beseva. Zihlanganisa igama lesizinda, ukhiye womphakathi, umkhiphi wesitifiketi, umnikazi, izinsuku zokusebenza, kanye nolunye ulwazi olufana nezizinda ezingaphansi kanye nokusetshenziswa okuvunyelwe. Ngaphandle kwesitifiketi esivumelekile, isiphequluli sakho sizobonisa izixwayiso zokuphepha.
Ngokuphathelene nokuphepha, i-TLS ihlanganisa izinsika ezintathu eziyisisekelo:
- Ukufakazela ubuqiniso (yazi ukuthi ukhuluma nobani).
- Ubumfihlo (ukuthi akekho ofunda idatha).
- Ubuqotho (ukuqinisekisa ukuthi okuqukethwe akukashintshwa). Lokhu kufezwa ngokuhlanganiswa kwama-algorithms okubethela alinganayo, imisebenzi ye-hash, kanye namakhodi okuqinisekisa umlayezo (i-MAC noma i-HMAC).
Izinguqulo ze-TLS: kusukela ku-1.0 kuya ku-1.3
Ngokuhamba kwesikhathi, i-TLS iye yathuthuka ukuze ilungise ubuthakathaka futhi ithuthukise ukusebenza. Izinguqulo ze-TLS 1.0 kanye ne-1.1 zakhishwa ngo-1999 nango-2006 ngokulandelana, futhi manje sezibhekwa njengeziphelelwe yisikhathi futhi ezisengozini. Ngakho-ke, iziphequluli zanamuhla azisawasekeli.
Inguqulo esakazeke kakhulu okwamanje yi -TLS 1.2 , eyakhishwa ngo-2008. Ihlala iqinile kakhulu futhi ifakiwe kumaseva nezinsizakalo eziningi. Noma kunjalo, sekunconywa kakade ukushintshela ku-TLS 1.3 ezindaweni ezintsha noma lapho ubuyekeza isevisi.
Nge -TLS 1.3 , eyakhishwa ngo-2018, le phrothokholi yenziwe lula futhi ama-algorithm abuthakathaka asuswa. Ukusebenza kwathuthukiswa futhi ngokunciphisa inani lezinyathelo zokuxhawulana, futhi izidingo zokuphepha zaqiniswa. Ngaphezu kwalokho, ama-cipher esimanje njenge-AES-GCM kanye ne-ChaCha20-Poly1305 ayasekelwa, futhi ukuhlanganiswa kwesikhathi esizayo kwama-algorithms e-post-quantum kwenziwa lula.
Iphuzu elibalulekile ukuthi i-TLS 1.3 ayisahambisani ne-SSL , okuvimbela ukuhlaselwa kwehliswa lapho umhlaseli ephoqa ukusetshenziswa kwezinguqulo ezindala, ezingavikelekile, njengoba kwenzekile ngobuthakathaka bohlobo lwe-POODLE.
Umehluko obalulekile phakathi kwe-SSL ne-TLS
Nakuba ngokomqondo i-SSL ne-TLS zenza into efanayo, kunezici zobuchwepheshe ezenza umehluko omkhulu. I-TLS ithuthukisa i-SSL endala ezindaweni eziningana, kokubili ngokuphepha nokusebenza , yingakho isibe yindinganiso yamanje.
- Inqubo yokuxhawulanaI-TLS yethula izindlela ezisheshayo nezisebenza kahle, inciphisa ukubambezeleka uma kuqhathaniswa nokuxhawulana kwe-SSL, okwakungalungiswanga kahle futhi kwajeziswa isikhathi sokulayisha amakhasi ewebhu kakhudlwana.
- Ukuqinisekiswa nobuqothoI-SSL ithembele kakhulu kuma-algorithms aphukile noma abuthakathaka manje, njenge-MD5, kuyilapho i-TLS isebenzisa i-HMAC enemisebenzi enamandla ye-hash kanye nama-cipher suites anamuhla. Lokhu kunciphisa kakhulu ingozi yokuhlaselwa ngumuntu ophakathi nendawo.
- Izexwayiso zamaphuthaEzinguqulweni ezindala, izexwayiso eziningi zithunyelwe ngombhalo ocacile, into elungiswa yi-TLS 1.3 ngokubethela yonke imiyalezo yezexwayiso uma uxhumano selusunguliwe, ukuze umhlaseli angakwazi ukukhipha ulwazi mayelana nokuziphatha kweseshini.
- Ama-suites e-CipherI-TLS ikhetha futhi iphoqelele ukubethela okunamandla, ilahla izinketho ezibuthakathaka ezizuzwe njengefa ku-SSL. Lokhu kunciphisa umkhawulo wephutha lapho kulungiselelwa kabi iseva futhi kugcina izinga lokuphepha elihambisanayo.
Ingabe i-HTTPS isebenzisa i-SSL noma i-TLS ngempela?
Sekuyiminyaka i-HTTPS ibizwa ngokuthi "i-HTTP phezu kwe-SSL," kodwa ngo-2026 cishe ayikho iwebhusayithi eqotho esekela i-SSL . Okusetshenziswa kabanzi manje yi-HTTPS phezu kwe-TLS 1.2 kanye, ngokuya ngokuqhubekayo, phezu kwe-TLS 1.3.
Amawebhusayithi angaphansi kuka-1% asasekela i-SSL ngandlela thile, kuyilapho cishe wonke esebenza ne-TLS 1.2 futhi iningi lawo lisekela ne-TLS 1.3. Ezingeni lomsebenzisi, ubona kuphela i-padlock kanye ne-“https://”, kodwa ngemuva kwezigcawu le protocol yokuphepha iyasebenza.
Uma ufaka iwebhusayithi bese uthayipha inombolo yekhadi lakho, iziqinisekiso, noma idatha yomuntu siqu, i-TLS ibhala ngemfihlo lokho kuxhumana ukuze, noma ngabe othile uvimba ithrafikhi kunethiwekhi, abone idatha engaqondakali kuphela.
Ngaphezu kokubethela, isiphequluli senza uchungechunge lokuhlola okuphelele kwesitifiketi sewebhusayithi: ubuqotho besiginesha, usuku lokuphelelwa yisikhathi, ukuhoxiswa okungenzeka (nge-OCSP), ukufaneleka komkhiphi, ukuxhumana nesizinda, ukusetshenziswa okuvunyelwe, kanye nemikhawulo yenqubomgomo, phakathi kokunye. Noma yikuphi ukwehluleka okubalulekile kulolu chungechunge kuholela ekuvinjelweni kwesixwayiso noma kokuxhumeka.
Ngenxa yale nqubo yokuqinisekisa, isiphequluli sisungula uxhumano oluphephile lwe-HTTPS kuphela uma zonke izimo zihlangatshezwa. Uma kukhona okubonakala kungafanele, uzobona imiyalezo efana nokuthi "isayithi alivikelekile," izitifiketi eziphelelwe yisikhathi, noma izexwayiso ezifanayo okungafanele zinganakwa.
Izitifiketi ze-SSL/TLS: Ziyini nokuthi Ziyini Izinhlobo Ezikhona
Izitifiketi ezivumela i-HTTPS kanye nokunye ukuxhumana okuphephile zisekelwe kungqalasizinda yokhiye womphakathi (i-PKI) . Igunya lesitifiketi (i-CA) likhipha isitifiketi ngemuva kokuqinisekisa idatha ethile yomfakisicelo bese lisayina ngokhiye walo oyimfihlo.
Isitifiketi sihlanganisa izinto ezifana ne- Common Name (CN) kanye nesandiso se-Subject Alternative Name (SAN) ukuvikela izizinda eziningi noma ama-subdomain ngesitifiketi esisodwa. Siphinde sichaze uhlobo lokuqinisekisa, isikhathi sokuqinisekisa, kanye nokhiye womphakathi ohlobene.
Kunezindlela eziningana zokuqinisekisa:
- Izitifiketi ze-DV (Domain Validation). Baqinisekisa kuphela ukuthi umfakisicelo ulawula isizinda.
- Izitifiketi ze-OV (Ukuqinisekiswa Kwenhlangano)Futhi baqinisekisa ukuthi inkampani ikhona.
- Izitifiketi ze-EV (Extended Validation). Basebenzisa inqubo yokuqinisekisa eqinile ebhizinisini, yize inkomba yabo ebonakalayo isetshenziswa kancane kancane kuziphequluli.
Kukhona nezitifiketi ezikhethekile njengezitifiketi ze -wildcard , ezivikela isizinda kanye nazo zonke izizinda zaso ezingaphansi kwezinga eliphezulu, noma izitifiketi ze-SAN, ezenzelwe ukumboza amagama amaningi ahlukene (ezifanele ezindaweni eziyinkimbinkimbi zezinkampani).
Uma kwakhiwa isitifiketi, kuqala kudalwe Isicelo Sokusayina Isitifiketi (CSR) , esiqukethe ukhiye womphakathi weseva kanye nedatha yobunikazi. Lesi sicelo sithunyelwa kwi-Certificate Authority (CA), okuthi, ngemva kokuqinisekisa ulwazi, ikhiphe isitifiketi esisayiniwe sokufakwa kuseva.
Iyini i-VPN futhi yini eyixazululayo i-TLS engambozi?
Nakuba i-TLS ivikela ukuxhumana okuthile (isibonelo, phakathi kwesiphequluli sakho newebhusayithi), i-VPN ivikela yonke ithrafikhi yenethiwekhi kusuka kudivayisi yakho noma engxenyeni yenethiwekhi . Ngamanye amazwi, isebenza "njengomhubhe obethelwe" odlula kuwo wonke ithrafikhi yakho ngaphambi kokufinyelela ku-inthanethi.
Ngobuchwepheshe, i-VPN iyinethiwekhi yangasese ebonakalayo esebenza kunethiwekhi yomphakathi (i-inthanethi). Ihlanganisa futhi ibethele amaphakethe edatha ukuze, ngaphandle, kubonakale sengathi konke kuhamba phakathi kwekhompyutha yakho neseva ye-VPN, yize empeleni idluliselwa kumasevisi amaningi ahlukene.
Lokhu kuvumela ukusetshenziswa okuningana okuthakazelisayo: ukufihla ikheli lakho langempela le-IP ngemuva kwe-IP yeseva ye-VPN, ukufinyelela kude izinsiza zangaphakathi zenkampani noma inethiwekhi yasekhaya, ukudlula imikhawulo ye-geo, kanye nokuqinisa ukuphepha lapho uxhuma kumanethiwekhi omphakathi we-WiFi angathembekile.
Ngokungafani ne-TLS, ehlotshaniswa nezinqubo ezithile ezifana ne-HTTPS noma i-FTPS, i-VPN isebenza ezingqimbeni eziphansi ze-network stack (ezingeni le-IP noma ngisho nesixhumanisi), ngakho-ke "isonga" cishe konke okwenziwa yikhompyutha yakho ngaphandle kokuthi izinhlelo zokusebenza zidinga ukwazi.
Ku-Windows, ungasebenzisa amaklayenti e-VPN akhelwe ngaphakathi (ngokwesibonelo, i-IPsec) noma izinhlelo zokusebenza zezinkampani zangaphandle ezisebenzisa amaphrothokholi afana ne -OpenVPN, i-WireGuard, noma ezinye ezizimele . Ngayinye inezinzuzo zayo, kodwa zonke zabelana ngomqondo wokudala umhubhe obethelwe kuseva ekude.
Umehluko phakathi kwe-SSL/TLS VPN kanye ne-IPsec VPN
Ngaphakathi kwezwe lama-VPN, kunemindeni emibili eyinhloko okufanele ihlukaniswe: ama-VPN e-SSL/TLS kanye nama-VPN asekelwe ku-IPsec . Womabili ahlinzeka ngomhubhe obethelwe, kodwa enza kanjalo ngezendlalelo nangobuchwepheshe obuhlukene.
Ama-VPN e-SSL/TLS (avame ukubizwa ngokuthi “i-SSL VPN”) akhiwe phezu kwe-TLS, iphrothokholi efanayo esetshenziswa kwi-HTTPS. Amaphrothokholi adumile njenge- OpenVPN asebenza ngale ndlela: adala umhubhe obethelwe ovame ukusebenzisa i-TCP noma i-UDP port 443, okwenza kube lula ukudlula ama-firewall nama-proxies.
Kulolu hlobo lwe-VPN, ukuqinisekiswa nokubethela kuncike ezitifiketi ze-X.509, okhiye bomphakathi nabangasese, kanye namapharamitha afana ne -Diffie-Hellman ukuze kushintshwe okhiye okuphephile. Kuyisisombululo esiguquguqukayo kakhulu, esiwusizo kakhulu ekufinyeleleni okude ngabasebenzisi ngabanye kusuka ku-Windows, macOS, noma kumadivayisi eselula.
Ngakolunye uhlangothi, ama-IPsec VPN asebenzisa iphrothokholi ye -IPsec (Internet Protocol Security) , esebenza ngqo ezingeni lenethiwekhi (isendlalelo 3). I-IPsec inikeza ubuqiniso, ubuqotho, kanye nokubethela kumaphakethe e-IP ngezindlela ezahlukene kanye nama-algorithms.
Ama-VPN e-IPsec avame kakhulu ezindaweni zezinkampani ukuxhuma wonke amanethiwekhi (i-Net-to-Net) noma ukusebenzisa izixazululo zokufinyelela kude ezihlanganiswe ohlelweni lokusebenza, njengoba i-Windows ibilokhu ifaka ukwesekwa kwe-IPsec iminyaka.
Imithethonqubo nezindinganiso ezisekela ukusetshenziswa kwe-VPN ne-TLS
Kokubili ama-TLS nama-VPN akuzona nje izincomo zobuchwepheshe; ezimweni eziningi, kuyisidingo sokuthobela imithethonqubo yokuvikela idatha kanye nezindinganiso zokuphepha. Eqinisweni, izinhlaka eziningi zomthetho zikhuluma ngazo ngokucacile noma ngokungaqondile.
Ku-European Union, i -GDPR igcizelela ukuthi idatha yomuntu siqu kumele ivikelwe ngezinyathelo zobuchwepheshe ezifanele, okuhlanganisa nokubethela. Ukusetshenziswa kwe-TLS kwezokuxhumana kwewebhu kanye nama-VPN ukuze kufinyelelwe kude ezinhlelweni eziqukethe idatha ebucayi kuhambisana kahle nale ndlela.
Emkhakheni wezokunakekelwa kwempilo, imithethonqubo efana ne -HIPAA (e-United States) idinga ukuvikelwa kobumfihlo bolwazi lwezokwelapha, okusho ukuthi empeleni kusho ukubhala ngemfihlo idatha ngesikhathi sokuthutha usebenzisa i-TLS futhi kuvame ukufaka ukufinyelela kwangaphakathi nge-VPN.
Ezinye izindinganiso ezifana ne-PCI-DSS, ehloselwe ukuphathwa kwedatha yamakhadi esikweletu, ngokusobala zidinga ukusetshenziswa kokubethela okuqinile kwezokuxhumana kanye nokufinyelela okukude kokuphatha, okuvame ukuhunyushwa kube yi-HTTPS ephephile kanye nama-VPN ahlelwe kahle.
Imininingwane eminingi yobuchwepheshe yezinkontileka zomphakathi noma zangasese idinga ngokusobala ukusetshenziswa kwe-TLS 1.2 noma ngaphezulu kanye ne-IPsec noma i-SSL/TLS VPN ukuqinisekisa ukuphepha kokuxhumana phakathi kwamasayithi nabasebenzisi , okubonisa ukuthi lobu buchwepheshe sebuvele buyindinganiso yangempela.
Uyisebenzisa nini i-TLS futhi uyisebenzisa nini i-VPN ku-Windows?
Ku-PC ye-Windows, ama-TLS nama-VPN awancintisani; kunalokho, ayaphelelisana. Ukukhetha kuncike enkingeni ofuna ukuyixazulula, ngakho-ke kubalulekile ukuqonda ukuthi ubuchwepheshe ngabunye bunikezani ekusetshenzisweni kwansuku zonke.
Uma ufuna nje ukuphequlula i-inthanethi ngokuphephile, ukufaka amaphasiwedi, noma ukukhokha ngekhadi kwiwebhusayithi, isiphequluli sakho sidinga ukusungula ukuxhumana kwe-HTTPS okusekelwe ku-TLS . Awudingi i-VPN ukuze ubuke iwebhusayithi ephephile, inqobo nje uma isayithi lihlelwe kahle.
Ngakolunye uhlangothi, uma udinga ukuxhuma usekhaya kunethiwekhi yangaphakathi yenkampani yakho, ukufinyelela amafolda abiwe, noma ukusebenzisa amaphrinta ehhovisi, khona-ke sikhuluma ngesimo esivamile sokusetshenziswa kwe-VPN ku-Windows . Umhubhe we-VPN uzokunikeza ikheli le-IP langaphakathi kanye nemizila eya kulezo zinsiza.
Esinye isizathu sokucabangela i-VPN yilapho uvame ukuxhuma ku -Wi-Fi yomphakathi (amakhefi, amahhotela, izikhumulo zezindiza). Nakuba amawebhusayithi amaningi esebenzisa i-HTTPS, amanye amasevisi nezinhlelo zokusebenza azibeki ngemfihlo yonke ithrafikhi yazo, futhi i-VPN inganikeza isendlalelo esengeziwe sokuvikela kuzo zonke ezinye izixhumanisi zakho.
Okokugcina, uma umgomo wakho uwukushintsha indawo yakho ebonakalayo (isibonelo, ukufinyelela okuqukethwe okuvinjelwe izwe), i-TLS ngeke ikusize nhlobo. Uma kunjalo, udinga i-VPN yezentengiselwano enamaseva esifundeni osithandayo, ngoba i-VPN ifihla ikheli lakho langempela le-IP ngemuva kwekheli le-IP leseva ekude.
Indlela yokusetha ama-SSL/TLS VPN nge-OpenVPN (ukubuka konke)
I-OpenVPN ingenye yezindlela zokusebenzisa i-VPN ezaziwa kakhulu futhi ezisetshenziswa kakhulu, ikakhulukazi ezindaweni ze-Linux, futhi ihlanganiswe namakhasimende amaningi e-Windows. Ithembele kuzitifiketi ze-OpenSSL kanye ne-X.509 ukuze isebenzise ukubethela kwe-SSL/TLS.
Kulo modeli, igunya lesitifiketi sangaphakathi elincane (i-CA) livame ukusethwa kuqala kusetshenziswa amathuluzi afana ne-easy-RSA. Ukusuka lapho, kukhiqizwa izitifiketi zeseva ye-VPN kanye neklayenti ngalinye, kanye namapharamitha e-Diffie-Hellman adingekayo ekushintsheni okhiye.
Amafayela ajwayelekile afaka isitifiketi se-CA (isb., ca.crt ), isitifiketi seseva kanye nokhiye waso wangasese (server.crt, server.key), amapharamitha e-DH (dh.pem), kanye, kumsebenzisi ngamunye, isitifiketi sakhe kanye nepheya lokhiye (client.crt, client.key).
Ngasohlangothini lweseva, i-OpenVPN ilungiselelwe ukudala isikhombikubona esibonakalayo (ukushintsha noma ukuthepha), ukuchaza inethiwekhi ye-VPN, ukucacisa indlela eya kufayela ngalinye lesitifiketi, nokuvumela noma ukukhubaza umzila phakathi kwamanethiwekhi . Ukucushwa kuyashintsha kancane kuye ngokuthi kusetshenziswa imodi yomzila (umhubhe we-IP) noma imodi yomzila.
Kuklayenti le-Windows, isofthiwe ye-OpenVPN iyafakwa, izitifiketi ezidingekayo zikopishwa ezindaweni ezifanele, bese kusetshenziswa ifayela lokucushwa elichaza ikheli le-IP leseva noma isizinda, imbobo, uhlobo lwesixhumi (tun/tap), kanye nendawo yesitifiketi . Uma uxhumano selumisiwe, uma konke kulungile, kudalwa isixhumi esibonakalayo senethiwekhi, futhi ithrafikhi idluliselwa emhubheni.
Ukuqonda ukuthi ingxenye ngayinye (i-TLS, i-SSL yakudala, i-SSL/TLS VPN, i-IPsec) yenzani nokuthi ingena kanjani kwisitayela sakho sokuxhumeka kwe-Windows kukuvumela ukuthi wenze izinqumo ezingcono kakhulu: ukuthi uthembele nini ku- padlock yesiphequluli , ukuthi umise nini i-tunnel ye-VPN, nokuthi ungazilungiselela kanjani zombili ukuze ulinganisele ukuphepha, ukusebenza, kanye nokuhambisana nemithetho ngaphandle kokwenza izinto zibe nzima kakhulu.