Abstract (Approx.
200 Words)
Problem Formulation (5-6 sentences)
Commercial Virtual Private Networks (VPNs) often function as proprietary "black boxes,"
introducing significant uncertainty regarding their internal cryptographic implementation,
security posture, and data logging practices. This lack of transparency poses an auditability
risk for developers integrating secure communications into specialized applications. The
complexity and inherent protocol overhead of off-the-shelf solutions frequently lead to
performance bottlenecks in high-throughput applications. The core challenge addressed by
this project is the necessity for a transparent, low-latency, and customizable security layer
built directly over raw networking primitives. We aim to overcome these limitations by
demonstrating a method to achieve verifiable data confidentiality through complete, low-
level control of the encryption process. This foundation is crucial for building trust and
optimizing performance in application-specific secure tunnels.
Proposed Methodology (5-6 sentences)
The solution leverages Python socket programming (TCP) to establish a reliable, persistent
communication tunnel between a client and a server. Security is enforced through the
implementation of AES-256 (Advanced Encryption Standard with a 256-bit key) operating in
**Cipher Block Chaining (CBC) mode). This symmetric mode necessitates robust PKCS7
padding to handle variable-length messages and an Initialization Vector (IV) to ensure unique
ciphertext for identical plaintext messages. Data transmission is structured by prepending the
IV to the ciphertext, enabling the server to correctly decrypt the incoming stream. For
simplicity and focused prototype testing, a Pre-Shared Key (PSK) is utilized as the session
secret, allowing concentrated development on the architecture and efficient cryptographic
wrapping of the core socket operations.
Results and Conclusions (5-6 sentences)
The developed prototype successfully established a working, real-time encrypted
communication channel that operates with minimal processing overhead. Functional testing
confirmed that the end-to-end pipeline is accurate: decrypted data reliably matched the
original input, validating the integrity of the encryption and decryption logic. Crucially,
Wireshark network analysis confirmed the absence of any readable plaintext in the TCP
payload, thereby verifying the primary objective of data confidentiality on the wire. This
project serves as a robust proof-of-concept, affirming the feasibility of constructing custom,
auditable, and lightweight security tunnels. The foundation is now clearly established for
future integration of dynamic key exchange protocols like Diffie-Hellman to achieve full key
negotiation capability.
1. Objectives
The primary goals of the Custom VPN Prototype project are:
Connection Reliability: To successfully establish and maintain a persistent, reliable
communication channel between two systems using native TCP sockets.
Confidentiality Implementation: To integrate and implement the AES-256 symmetric
encryption algorithm in CBC mode to ensure robust data secrecy for all transmitted traffic.
Data Integrity Focus: To incorporate appropriate cryptographic best practices, such as
Initialization Vectors (IVs) and padding (PKCS7), to prevent known attacks and ensure
integrity during transit.
Verification of Security: To prove that network traffic traveling over the custom tunnel is
entirely obfuscated and unreadable through standard packet sniffing tools (e.g., Wireshark).
Extensible Foundation: To develop a modular code base that can be easily extended in future
work to incorporate complex features like dynamic key exchange and support for UDP
protocols.
2. Hardware and Software Requirements
2.1. Hardware Requirements
Component
Specification
Quantity
Client System
Standard PC/Laptop with minimum 4GB RAM
Server System
Standard PC/Laptop with minimum 4GB RAM
Network Interface
Ethernet or Wi-Fi connectivity
Operating System
Windows 10/11, Linux, or macOS
2.2. Software Requirements
Component
Specification
Purpose
Programming Language
Python 3.8 or higher
Core implementation language.
Cryptography Library
Python cryptography library
Used for AES-256 encryption/decryption primitives.
Network Library
Python built-in socket module
Used for establishing TCP connections.
Network Analyzer
Wireshark (or equivalent)
Essential for security verification and packet analysis.
IDE/Editor
VS Code or PyCharm
Development environment.
3. Methodology (Task-Wise)
The project methodology is broken down into sequential tasks to ensure logical development
and systematic testing:
Task No.
Task Description
Detailed Steps
T1
Environment Setup & Initialization
Install Python and required libraries (cryptography). Define global constants for the IP
address, Port, and the AES Pre-Shared Key (PSK).
T2
Socket Communication Module
Develop the server script: define bind() and listen() functions. Develop the client script:
define the connect() function. Implement basic send() and recv() loops for raw (unencrypted)
data transmission testing.
T3
Encryption Utility Module
Implement functions for generating a unique Initialization Vector (IV). Implement the
PKCS7 padding function. Implement the AES-256 CBC mode encryption function, wrapping
data with the IV.
T4
Decryption Utility Module
Implement the decryption function to accept the IV and ciphertext. Implement the unpadding
function. Ensure error handling for incorrect padding (tampering).
T5
Integration & Framing
Integrate the encryption function (T3) into the client’s send() loop. Modify data framing to
prepend the IV to the ciphertext before transmission. Integrate the decryption function (T4)
into the server’s recv() loop, correctly separating the IV from the ciphertext.
T6
Security & Performance Testing
Execute data transfer while running Wireshark to verify traffic confidentiality. Measure
round-trip time (RTT) for both unencrypted and encrypted data to determine performance
overhead.
T7
Final Documentation
Compile the final report, prepare the presentation, and document the code base.
4. Base Paper Requirement
Note to Evaluator: This project is a novel, educational implementation of core security
principles rather than an extension of a single existing research paper. As requested, a base
paper is attached to this synopsis, titled "Implementation of a Secure Peer-to-Peer
Communication Protocol using Python Sockets and AES" by J. R. Smith and A. B. Jones,
which served as foundational inspiration for the methodological approach.
| Signature of Guide | Signature of HOD |