y use IP addresses that conflict with normal Internet assignments through the use of private IP addresses as described in RFC1918, for example. This scenario may be viable for corporations seeking to lower the cost of their internal security systems, while avoiding full trust in their wireless carrier. Or, the wireless carrier can offer to provide this PKI as a value- added service, perhaps including wireless e-commerce transaction services for horizontal services/markets. Multiple VPN Gateway Architecture Multiple VPN gateway architectures may also be used in a GPRS backbone system. In this example, each VPN can be defined by filtering rules in managed firewall, as shown in Figure 10-11. The previous example sug- gests a trusted GPRS Home Location Register (HLR) lookup as the means Corporation Z Figure 10-10 PKI 3rd Party Compulsory Authentication tunneling with VPN. Server Private Corporate Station Firewall Application & Router Corporation Y Internet (any ISP) Private Corporate Authentication Firewall Application Server Security & Router Firewall Mgt. Server & Router Corp. X Security Zone Mr. Grey, APN Corp.x Mr. Black, APN = Corp. y Mr. Bland, APN = Corp. Z Corporation Corp. Y Security Zone GPRS HLR Corp. Z Security Zone Tunnel Private Corporate Firewall Application Virtual Private Network (VPN) & Routel Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SGSN-to-GGSN (Gn) and GGSN-to-PDN (Gi) Interface SGSN-to-GGSN (G) and GGSN-to-PDN (G) Interface Wireless Figure 10-11 Multiple VPN Clients gateway architecture. Carrier's Packet Internet Intranet Data Network (any ISP) GTP Connection Firewall Security GPRS Tunnel Server Virtual Private Network (VPN) to authenticate a mobile subscriber to a VPN group and be given access behind its corporate firewall. Putting a GGSN at or behind the corporate firewall provides GTP tun- neling over the Internet