\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={Design and Implementation of Mobility for Virtual Private Network Users},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2013-01-15 (revised: 15 January 2013)}
\def\TheID{\makeatother }
\def\TheDate{2013-01-15}
\title{Design and Implementation of Mobility for Virtual Private Network Users}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Md. Hashmathur  Rehman}

             \affil[1]{  MobileIron Softwares india pvt ltd}

\renewcommand\Authands{ and }

\date{\small \em Received: 13 December 2012 Accepted: 31 December 2012 Published: 15 January 2013}

\maketitle


\begin{abstract}
        


Virtual Private Network framework provides Confidentiality, Integrity, Availability, Authentication and Anti- Replay services to the packets travelling through the shared medium like Internet. With the latest Advancement in the technology, Internet is available to the users thru all means like Wireless networks, GPRS, Satellite. When the VPN user roams or switches from one network to other, the IP address gets changed and VPN connection is tear down. The user has to again initiate the VPN connection whenever the network is switched. This paper present outcome of research project aimed at solving the mobility problems faced by roaming VPN users.

\end{abstract}


\keywords{VPN, IPsec, AH, ESP, authentication algorithms, encryption algorithms.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
P packets doesn't have any security when they travel through shared medium like internet. It needs security services like Confidentiality, Integrity, Authentication \hyperref[b5]{[6,}\hyperref[b6]{7]}. Confidentiality is provided by encryption algorithms like DES, 3DES, AES. Integrity is provided by Hash Algorithms like MD5, SHA-1, SHA-2. Authentication is provided by preshared key mechanism or by using public key infrastructure like RSA (Rivest Shamir-Adleman) \hyperref[b7]{[8,}\hyperref[b10]{12]}. These services are provided by maintaining shared state between the source and the destination of an IP datagram.\par
The protocol to establish this state dynamically is "Internet Key Exchange (IKE)" \hyperref[b0]{[1,}\hyperref[b1]{2]}. IKE performs mutual authentication between two parties and establishes an IKE security association (SA) that includes shared secret information that can be used to efficiently establish SAs for Encapsulating Security Payload [ESP] or Authentication Header [AH] and a set of cryptographic algorithms to be used by the SAs to protect the traffic that they carry \hyperref[b0]{[1,}\hyperref[b1]{2]}. II. 
\section[{VPNS, IKEV2}]{VPNS, IKEV2}\par
All IKE communications consist of pairs of messages: a request and are sponse. The pair is called an "exchange" and is sometimes called a "request/response pair" \hyperref[b0]{[1]}. The first exchanges of messages establishing an IKE SA are called the IKE\textunderscore SA\textunderscore INIT and IKE\textunderscore AUTH exchanges; subsequent IKE exchanges are called the CREATE\textunderscore CHILD\textunderscore SA or INFORMATIONAL exchanges \hyperref[b1]{[2]}. In the common case, there is a single Author : MobileIron Softwares India Pvt. E-mail : ltdhashmath@gmail.com IKE\textunderscore SA\textunderscore INIT exchange and a single IKE\textunderscore AUTH exchange (a total of four messages) to establish the IKE SA and the first Child SA.\par
The first exchange of an IKE session, IKE\textunderscore SA\textunderscore INIT, negotiates security parameters for the IKE SA, sends nonces and sends Diffie-Hellman values \hyperref[b1]{[2]}.\par
The second exchange, IKE\textunderscore AUTH, transmits identities, proves knowledge of the secrets corresponding to the two identities and sets up an SA for the first (and often only) AH or ESP Child SA (unless there is failure setting up the AH or ESP Child SA, in which case the IKE SA is still established without the Child SA) \hyperref[b1]{[2]}.\par
The types of subsequent exchanges are CREATE\textunderscore CHILD\textunderscore SA (which creates a Child SA) and INFORMATIONAL (which deletes an SA, reports error conditions, or does other housekeeping) \hyperref[b1]{[2]}. Every request requires are sponse. An INFORMATIONAL request with no payloads (other than the empty Encrypted payload required by the syntax) is commonly used as a check for liveness. These subsequent exchanges cannot be used until the initial exchanges have completed  {\ref [}  ii. Endpoint-to-Endpoint Transport Mode In this scenario, both endpoints of the IP connection implement IPsec, as required of hosts in  {\ref [IPSECARCH]}. Transport mode will commonly be used with no inner IP header. A single pair of addresses will be negotiated for packets to be protected by this SA. The seend points MAY implement application-layer access controls based on the IPsec authenticated identities of the participants \hyperref[b1]{[2]}.\par
iii. Endpoint to Security Gateway in Tunnel Mode In this scenario, a protected endpoint (typically a portable roaming computer) connects back to its corporate network through an IPsec-protected tunnel. The packets will use tunnel mode. On each packet from the protected endpoint, the outer IP header will contain the source IP address associated with its current location (i.e., the address that will get traffic routed to the endpoint directly), while the inner IP header will contain the source IP address assigned by the security gateway (i.e., the address that will get traffic routed to the security gateway for forwarding to the endpoint). The outer destination address will always be that of the security gateway while the inner destination address will be the ultimate destination for the packet \hyperref[b1]{[2]}. 
\section[{b) Cryptographic Algorithm Negotiation}]{b) Cryptographic Algorithm Negotiation}\par
The payload type known as "SA" indicates a proposal for a set of choices of IPsec protocols (IKE, ESP, or AH) for the SA as well as cryptographic algorithms associated with each protocol \hyperref[b7]{[8,}\hyperref[b8]{9]}.\par
An SA payload consists of one or more proposals. Each proposal includes one protocol. Each protocol contains one or more transforms --each specifying a cryptographic algorithm. Each transform contains zero or more attributes (attributes are needed only if the Transform ID does not completely specify the cryptographic algorithm) \hyperref[b1]{[2,}\hyperref[b7]{8]}.\par
This hierarchical structure was designed to efficiently encode proposals for cryptographic suites when the number of supported suites is large because multiple values are acceptable for multiple transforms. The responder MUST choose a single suite, which may be any subset of the SA proposal following the rules below \hyperref[b8]{[9]}.\par
Each proposal contains one protocol. If a proposal is accepted, the SA response MUST contain the same protocol. The responder MUST accept a single proposal or reject them all and return an error. The error is given in a notification of type NO\textunderscore PROPOSAL\textunderscore CHOSEN \hyperref[b1]{[2,}\hyperref[b8]{9]}.\par
Each IPsec protocol proposal contains one or more transforms. Each transform contains a Transform Type. The accepted cryptographic suite MUST contain exactly one transform of each type included in the proposal \hyperref[b1]{[2]}. For example: if an ESP proposal includes transforms ENCR\textunderscore 3DES, ENCR\textunderscore AES w/key size 128, ENCR\textunderscore AES w/key size 256, AUTH\textunderscore HMAC\textunderscore MD5, and AUTH\textunderscore HMAC\textunderscore SHA, the accepted suite MUST contain one of the ENCR\textunderscore  transforms and one of the AUTH\textunderscore  transforms. Thus, six combinations are acceptable \hyperref[b1]{[2,}\hyperref[b7]{8]}.\par
If an initiator proposes both normal ciphers with integrity protection as well as combined-mode ciphers, then two proposals are needed. One of the proposals includes the normal ciphers with the integrity algorithms for them and the other proposal includes all the combined-mode ciphers without the integrity algorithms (because combined-mode ciphers are not allowed to have any integrity algorithm other than "none") \hyperref[b1]{[2,}\hyperref[b7]{8]}.\par
c) The Initial Exchanges Communication using IKE always begins with IKE\textunderscore SA\textunderscore INIT and IKE\textunderscore AUTH exchanges (known in IKEv1 as Phase 1). These initial exchanges normally consist of four messages, though in some scenarios that number can grow. All communications using IKE consist of request/ response pairs. We'll describe the base exchange first, followed by variations. The first pair of messages (IKE\textunderscore SA\textunderscore INIT) negotiates cryptographic algorithms, exchange nonces, and do a Diffie-Hellman exchange \hyperref[b1]{[2]}.\par
The second pair of messages (IKE\textunderscore AUTH) authenticate the previous messages, exchange identities and certificates and establish the first Child SA. Parts of these messages are encrypted and integrity protected with keys established through the IKE\textunderscore SA\textunderscore INIT exchange, so the identities are hidden from eavesdroppers and all fields in all the messages are authenticated. All messages following the initial exchange are cryptographically protected using the cryptographic algorithms and keys negotiated in the IKE\textunderscore SA\textunderscore INIT exchange \hyperref[b1]{[2]}.\par
All subsequent messages include an Encrypted payload, even if they are referred to in the text as "empty". For the CREATE\textunderscore CHILD\textunderscore SA, IKE\textunderscore AUTH, or INFORMATIONAL exchanges, the message following the header is encrypted and the message including the header is integrity protected using the cryptographic algorithms negotiated for the IKE SA \hyperref[b1]{[2]}.\par
Every IKE message contains a Message ID as part of its fixed header. This Message ID is used to match up requests and responses and to identify retransmissions of messages \hyperref[b1]{[2]}.\par
In the following descriptions, the payloads contained in the message are indicated by names as listed below.\par
HDR contains the Security Parameter Indexes (SPIs), version numbers, and flags of various sorts. The SAi1 payload states the cryptographic algorithms the initiator supports for the IKE SA. The KE payload sends the initiator's Diffie-Hellman value. Ni is the initiator's nonce \hyperref[b1]{[2]}.\par
The responder chooses a cryptographic suite from the initiator's offered choices and expresses that choice in the SAr1 payload, completes the Diffie-Hellman exchange with the KEr payload, and sendsits nonce in the Nr payload \hyperref[b1]{[2]}. 
\section[{d) The CREATE\textunderscore CHILD\textunderscore SA Exchange}]{d) The CREATE\textunderscore CHILD\textunderscore SA Exchange}\par
The CREATE\textunderscore CHILD\textunderscore SA exchange is used to create new Child SAs and to rekey both IKE SAs and Child SAs. This exchange consists of a single request/response pair and some of its function was referred to as a Phase 2 exchange in IKEv1. It MAY be initiated by either end of the IKE SA after the initial exchanges are completed \hyperref[b1]{[2]}.\par
Either endpoint may initiate a CREATE\textunderscore CHILD\textunderscore SA exchange, so in this section the term initiator refers to the endpoint initiating this exchange \hyperref[b1]{[2]}. If a CREATE\textunderscore CHILD\textunderscore SA exchange includes a KEi payload, at least one of the SA offers MUST include the Diffie-Hellman group of the KEi. The Diffie-Hellman group of the Kei MUST be an element of the group the initiator expects the responder to accept (additional Diffie-Hellman groups can be proposed). If the responder selects a proposal using a different Diffie-Hellman group (other than NONE), the responder MUST reject the request and indicate its preferred Diffie-Hellman group in the INVALID\textunderscore KE\textunderscore PAYLOAD Notify payload. There are two octets of data associated with this notification: the accepted Diffie-Hellman group number in big endian order. In the case of such a rejection, the CREATE\textunderscore CHILD\textunderscore SA exchange fails, and the initiator will probably retry the exchange with a Diffie-Hellman proposal and KEi in the group that the responder gave in the INVALID\textunderscore KE\textunderscore PAYLOAD Notify payload \hyperref[b1]{[2]}.\par
The responder sends a NO\textunderscore ADDITIONAL\textunderscore SAS notification to indicate that a CREATE\textunderscore CHILD\textunderscore SA request is unacceptable because the responder is unwilling to accept any more Child SAs on this IKE SA. This notification can also be used to reject IKE SA rekey. Some minimal implementations may only accept a single Child SA setup in the context of an initial IKE exchange and reject any subsequent attempts to add more \hyperref[b1]{[2]}. 
\section[{i. Creating New Child SAs with the CREATE\textunderscore  CHILD\textunderscore SA Exchange}]{i. Creating New Child SAs with the CREATE\textunderscore  CHILD\textunderscore SA Exchange}\par
A Child SA may be created by sending a CREATE\textunderscore CHILD\textunderscore SA request. The CREATE\textunderscore CHILD\textunderscore SA request for creating a new Child SA is:\par
The initiator sends SA offer(s) in the SA payload, a nonce in the Ni payload, optionally a Diffie-Hellman value in the Kei payload, and the proposed Traffic Selectors for the proposed Child SA in the TSiand TSr payloads \hyperref[b1]{[2]}.\par
The CREATE\textunderscore CHILD\textunderscore SA response for creating a new Child SA is:\par
The responder replies (using the same Message ID to respond) with the accepted offer in an SA payload, and a Diffie-Hellman value in the KEr   {\ref ---------------------------------------}   {\ref -----------------------------------------------------------------}   {\ref ------------------------------------------------------------------<--HDR}   {\ref -----------------------------------------------------------------}   {\ref ------------------------------------------------------------------<} payload if KEi was included in the request and the selected cryptographic suite includes that group \hyperref[b1]{[2]}.\par
The Traffic Selectors for traffic to be sent on that SA are specified in the TS payloads in the response, which may be a subset of what the initiator of the Child SA proposed \hyperref[b1]{[2]}. 
\section[{III.}]{III.}\par
IKEV2 MOBILITY (MOBIKE)   IKEv2 is used for performing mutual authentication, as well as establishing and maintaining IPsec Security Associations (SAs) \hyperref[b1]{[2,}\hyperref[b2]{3]}. In the base IKEv2 protocol [IKEv2], the IKE SAs and tunnel mode IPsec SAs are created implicitly between the IP addresses that are used when the IKE\textunderscore SA is established. These IP addresses are then used as the outer (tunnel header) addresses for tunnel mode IPsec packets (transport mode IPsec SAs are beyond the scope of this document). Currently, it is not possible to change addresses after the IKE\textunderscore SA has been created \hyperref[b2]{[3]}.\par
There are scenarios where these IP addresses might change. One example is mobility: a host changes its point of network attachment and receives a new IP address \hyperref[b2]{[3]}. Another example is a multi-homing host that would like to change to a different interface if, for instance, the currently used interface stops working for some reason.\par
The main scenario for MOBIKE is enabling a remote access VPN user to move from one address to another without reestablishing all security associations with the VPN gateway \hyperref[b2]{[3]}. For instance, a user could start from fixed Ethernet in the office and then disconnect the laptop and move to the office's wireless LAN. When the user leaves the office, the laptop could start using General Packet Radio Service (GPRS); when the user arrives home, the laptop could switch to the home wireless LAN. MOBIKE updates only the outer (tunnel header) addresses of IPsec SAs, and the addresses and other traffic selectors used inside the tunnel stay unchanged. Thus, mobility can be(mostly) invisible to applications and their connections using the VPN \hyperref[b1]{[2,}\hyperref[b2]{3]}. MOBIKE allows both parties to have several addresses and there are up to N*M pairs of IP addresses that could potentially be used. MOBIKE solves this problem by taking a simple approach: the party that initiated the IKE\textunderscore SA (the "client" in a remote access VPN scenario) is responsible for deciding which address pair is used for the IPsec SAs and for collecting the information it needs to make this decision (such as determining which address pairs work or do not work). The other party (the "gateway" in a remote access VPN scenario) simply tells the initiator what addresses it has, but does not update the IPsec SAs until it receives a message from the initiator to do so. This approach applies to the addresses in the IPsec SAs; in the IKE\textunderscore SA case, the exchange initiator can decide which addresses are used \hyperref[b2]{[3]}.\par
A simple MOBIKE exchange in a mobile scenario is illustrated below.The notation is based on [IKEv2] \hyperref[b2]{[3]}.\par
Step 1 : Is the normal IKE\textunderscore INIT exchange \hyperref[b1]{[2,}\hyperref[b2]{3]}.\par
Step 2 : The peers inform each other that they support MOBIKE \hyperref[b2]{[3]}.\par
Step 3 : The initiator notices a change in its own address and informs the responder about this by sending an INFORMATIONAL request containing the UPDATE\textunderscore  SA\textunderscore ADDRESSES notification \hyperref[b2]{[3]}. The request is sent using the new IP address. At this point, it also starts to use the new address as a source address in its own outgoing ESP traffic. Upon receiving the UPDATE\textunderscore  SA\textunderscore ADDRESSES notification, the responder records the new address and, if it is required by policy, performs a return rout ability check of the address \hyperref[b2]{[3]}.\par
When this check (step 4) completes, the responder starts to use the new address as the destination for its outgoing ESP traffic. 
\section[{a) Protocol Exchanges i. Initial IKE Exchange}]{a) Protocol Exchanges i. Initial IKE Exchange}\par
The initiator is responsible for finding a working pair of addresses so that the initial IKE exchange can be carried out. Any information from MOBIKE extensions will only be available later, when the exchange has progressed far enough. Exactly how the addresses used for the initial exchange are discovered is beyond the scope of this specification; typical sources of information include local configuration and DNS \hyperref[b2]{[3]}. If either or both of the peers have multiple addresses, some combinations may not work. Thus, the initiator SHOULD try various source and destination address combinations when retransmitting the IKE\textunderscore SA\textunderscore INIT request \hyperref[b2]{[3]}.\par
ii. Signaling Support for MOBIKE Implementations that wish to use MOBIKE for a particular IKE\textunderscore SA MUST include a MOBIKE\textunderscore  SUPPORTED notification in the IKE\textunderscore AUTH exchange (in case of multiple IKE\textunderscore AUTH exchanges, in the message containing the SA payload) \hyperref[b2]{[3]}. 
\section[{iii. Initial Tunnel Header Addresses}]{iii. Initial Tunnel Header Addresses}\par
When an IPsec SA is created, the tunnel header IP addresses (and port, if doing UDP encapsulation) are taken from the IKE\textunderscore SA, not the IP header of the IKEv2 message requesting the IPsec SA. The addresses in the IKE\textunderscore SA are initialized from the IP header of the first IKE\textunderscore AUTH request \hyperref[b2]{[3]}. anges, in the message containing the SA payload). Here "ADDITIONAL\textunderscore *\textunderscore ADDRESS" means either an ADDITIONAL\textunderscore IP4\textunderscore ADDRESS or an ADDITIONAL\textunderscore IP 6\textunderscore ADDRESS notification \hyperref[b2]{[3]}. 
\section[{v. Changing Addresses in IPsec SAs}]{v. Changing Addresses in IPsec SAs}\par
In MOBIKE, the initiator decides what addresses are used in the IPsec SAs. That is, the responder does not normally update any IPsec SAs without receiving an explicit UPDATE\textunderscore SA\textunderscore ADDRESSES request from the initiator. (As described below, the responder can, however, update the IKE\textunderscore SA in some circumstances.)\par
IV. 
\section[{Conclusions}]{Conclusions}\par
The main goals of this research project are to maintain the security offered by usual IKEv2 procedures and to counter mobility-related threats in an appropriate manner. This section describes new security considerations introduced by MOBIKE. 1. Traffic Selector Authorization. \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-2.png}
\caption{\label{fig_0}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{1}\includegraphics[]{image-3.png}
\caption{\label{fig_1}Figure 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2}\includegraphics[]{image-4.png}
\caption{\label{fig_2}Figure 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3}\includegraphics[]{image-5.png}
\caption{\label{fig_3}Figure 3 :}\end{figure}
       			\footnote{© 2013 Global Journals Inc. (US)} 			\footnote{© 2013 Global Journals Inc. (US) Global Journal of Computer Science and Technology} 		 		\backmatter  			  				\begin{bibitemlist}{1}
\bibitem[Security]{b10}\label{b10} 	 		\textit{},  		 			Security 		.  		 \url{http://www.rsa.com}  		 	 
\bibitem[Ferguson and Schneider ()]{b8}\label{b8} 	 		\textit{},  		 			N Ferguson 		,  		 			B Schneider 		.  	 	 		\textit{Practical Cryptography. Indianapolis}  		2003. Wiley.  	 
\bibitem[Ferguson et al. ()]{b9}\label{b9} 	 		\textit{},  		 			N Ferguson 		,  		 			B Schneider 		,  		 			T Kohno 		.  		 \url{http://www.iana.org/assignments/ikev2-parameters}  	 	 		\textit{Cryptography Engineering. Indianapolis}  		2010. Wiley.  (11) .  	 	 (IKEv2 Parameters, RFC4306, available at) 
\bibitem[Schneider ()]{b7}\label{b7} 	 		\textit{Applied Cryptography: Protocols, Algorithms, and Source Code in C. Indianapolis},  		 			B Schneider 		.  		1996. Wiley.  	 
\bibitem[Bollapragada et al. ()]{b6}\label{b6} 	 		 			V Bollapragada 		,  		 			M Khalid 		,  		 			S Wainner 		.  		\textit{IPSec VPN Design. Indianapolis},  				2005. Cisco Press.  	 
\bibitem[Frankel]{b3}\label{b3} 	 		‘Guide to IPsec VPNs: Recommendations of the National Institute of Standards and Technology’.  		 			S Frankel 		.  		 \url{http://www.nist.gov}  	 	 		\textit{NIST Special Publication}  		p. .  	 
\bibitem[IKEv2 Mobility and Multihoming Protocol (MOBIKE)]{b2}\label{b2} 	 		 \url{http://tools.ietf.org/html/rfc4555}  		\textit{IKEv2 Mobility and Multihoming Protocol (MOBIKE)},  				 	 
\bibitem[Uskov]{b4}\label{b4} 	 		‘Information Security of Mobile VPN: Conceptual Models and Design Methodology’.  		 			A Uskov 		.  	 	 		\textit{Proc. 2012 IEEE international conference on Electro/Information Technology EIT-2012. Indianapolis, IN; catalog number: CFP12EITCDR},  				 (2012 IEEE international conference on Electro/Information Technology EIT-2012. Indianapolis, IN; catalog number: CFP12EITCDR)  		 	 
\bibitem[Internet Key Exchange Protocol Version 2 (IKEv2) IKEv2, RFC 5996]{b1}\label{b1} 	 		\textit{Internet Key Exchange Protocol Version 2 (IKEv2) IKEv2, RFC 5996},  		 \url{https://tools.ietf.org/html/rfc5996}  		 	 
\bibitem[Carmouche ()]{b5}\label{b5} 	 		\textit{IPsec Virtual Private Network Fundamentals},  		 			J Carmouche 		.  		2007. Indianapolis, IN: Cisco Press.  	 
\bibitem[Ikev1]{b0}\label{b0} 	 		\textit{The Internet Key Exchange (IKE) RFC 2409},  		 			Ikev1 		.  		 \url{//tools.ietf.org/html/rfc2409}  		 	 
\end{bibitemlist}
 			 		 	 
\end{document}
