digital certificate based on secure encryption. Then there are threats from physical damage. A third threat comes from the service network, which could control network resources via the API interfaces. Therefore an authorization/authentication procedure protecting the network is provided in the service network (application)-control interface. A similar protection is required in the user-service network (application) interface. As mentioned in the introduction, integrity targets are supported by the separation and protection of resources. In order to control the security, network security partitioning into zones should be used for large networks. The borders might be points where protection method changes, for example from L2 tunnelling to L3 tunnelling. Possible border con- trol elements for security inspection are firewalls, filtering routers or IPsec end points. Packet filtering towards backbone and ISP/corporate, as well as downlink/uplink address screening, is found in GPRS edge nodes. When applied to a large company the main idea looks like Figure 6.14. Numbering - DNS Protection DNS is, as explained earlier in this chapter, a very vital part of an IP network. DNS Security sees to it that the client gets an answer from the correct DNS server, that the answer is related to the query and that no changes have been made to the answer by an intruder. Understanding Changing Telecommunications - Building a Successful Telecom Business Department Department Internet Firewalls Corporate backbone Firewalls Department Department Figure 6.14 Network partitioning into zones Security Needs and Solutions for the Business Sector For economical reasons the protection level is different between different services. Ser- vices with the highest security requirements are e-commerce and computer networking, such as remote access, LAN interconnect, extranets between enterprises and links between enterprises and application service providers. Ultimately, Internet VPNs will be the global means of business communication just as the voi