Define endpoint & node

In particular, the present document specifies technical characteristics and methods of assessment for:

1. Software that operates as a VPN client or end-point

1. Software that operates as a VPN client or endpoint

2. Software that operates as a node within a mesh VPN network

3. Software that operates as a VPN server

4. Remote data processing, specifically VPN server software performing the logical server role, and associated software used for such VPN products

> NOTE: See Article 2, point (1), of Regulation (EU) 2019/881 [\[i.9\]](#_ref_i.9)

**node**

: member of a VPN topology

**exit node**

: VPN server software which routes packets to and from their intended destination

**endpoint**

: node or component within a node at the end of a VPN connection that decrypts and encrypts, rather than merely routing data

> NOTE: In VPNs, endpoint is typically used to refer to client devices. In mesh networks, this could be any node.

**Personal Data**

: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;”

### 4.2.3 VPN client

For the purpose of the current document, a VPN client is a software application responsible for connecting a single end-point (such as a computing device or home router) to VPN servers, VPN gateways, or peer nodes. A VPN client typically uses authentication credentials provided by the manufacturer or administrator and input by the user to establish secure tunnel(s).

For the purpose of the current document, a VPN client is a software application responsible for connecting a single endpoint (such as a computing device or home router) to VPN servers, VPN gateways, or peer nodes. A VPN client typically uses authentication credentials provided by the manufacturer or administrator and input by the user to establish secure tunnel(s).

After establishing a tunnel, the VPN client changes configuration of the host device operating system to facilitate connections to the private network—this can include changes to DNS configuration, firewall rules, routing table, etc. This configuration is tailored to the end-user, and may be based on a combination of local user or administrator preferences and policies configured by the VPN manufacturer. A VPN client could have an option to perform traffic validation prior to sending the data through the established secure tunnel [\[i.13\]](#_ref_i.13).

Table { seq tab }: VPN product functions

| Asset                                          | Compromise impacts            | Value  |

|-------------------------------------------------|-------------------------------|--------|

| Authentication/access control of VPN end-points | Authentication/access control | High   |

|------------------------------------------------|-------------------------------|--------|

| Authentication/access control of VPN endpoints | Authentication/access control | High   |

| Authentication/access control of VPN servers   | Authentication/access control | High   |

| Encryption of network traffic                  | Confidentiality               | High   |

| Privacy protection                             | Confidentiality               | High   |

### B.1.3 Digital assets

| Asset                     | Compromise impacts                           | Value        |

|----------------------------|-----------------------------------------------|--------------|

|---------------------------|----------------------------------------------|--------------|

| VPN server applications   | Everything                                   | Astronomical |

| VPN end-point applications | All end-point assets, some VPN network assets | High         |

| VPN endpoint applications | All endpoint assets, some VPN network assets | High         |

### B.1.4 Human-associated assets

See [clause B.4.2](#b.4.2-security-analysis-methodology) for the definition of risk factor levels.

### B.2.2 RF-CFG: End-point configuration

### B.2.2 RF-CFG: Endpoint configuration

Description: Complexity of end-point configuration.

Description: Complexity of endpoint configuration.

Rationale: More complex end-point configuration increases the likelihood of compromise via accidental misconfiguration.

Rationale: More complex endpoint configuration increases the likelihood of compromise via accidental misconfiguration.

* **[CFG-0]** End-point requires no configuration

* **[CFG-1]** End-point requires simple configuration, such as selecting an established VPN protocol or selecting a region to which to connect

* **[CFG-2]** End-point requires configuration by a skilled administrator

* **[CFG-0]** Endpoint requires no configuration

* **[CFG-1]** Endpoint requires simple configuration, such as selecting an established VPN protocol or selecting a region to which to connect

* **[CFG-2]** Endpoint requires configuration by a skilled administrator

### B.2.3 RF-AUT: Account management and authentication of end-points

### B.2.3 RF-AUT: Account management and authentication of endpoints

Description: Type of account management and authentication for end-points

Description: Type of account management and authentication for endpoints

Rationale: The type of account management and authentication changes the likelihood and impact of threats targeting authentication.