 users enter the token-generated number. These numbers are generated by a combination of factory-set matching numbers in the user's device and a central server Broadband and Wide Area Network Services set to an external clock. To be authenticated, the number the user enters must match that generated by the central computer. Token identification is used with both IPsec and SSL. It provides a second layer of authentication at logon in addition to the password. If a person's password is stolen, the hacker will not be able to access the network without the token. Authentication refers to the requirement that users prove to computer systems that they are authorized to log on to the network. VPN Aggregation Some organizations that support hundreds or even thousands of remote access employ- ees worldwide use network aggregators to manage their remote access. Network aggre- gators are also referred to as virtual network operators. A network aggregator makes agreements with carriers worldwide, including those at hotels and airports, SO that customers have Wi-Fi wireless, cellular, and landline access, all through one provider. The virtual network operator runs a clearinghouse that performs billing settlements. In essence, the aggregator pays network operators a fee and bills the corporation, which receives only one bill. Users receive the aggregator's client software which establishes a session with the aggregator when it is activated. The aggregator passes the transmission on to the corporate firewall and security server after authenticating the user and checking that she has up-to-date firewall and virus-protection software. Using an aggregator means the enterprise does not need to make agreements with multiple carriers and Wi-Fi operators for worldwide remote access. In addition, aggre- gators supply another level of security. Some companies use aggregators for people who work from home as well as those who travel. Large carriers as well as independent companies supply aggregation services. Protecting against Malicious