nd-user equipment (fixed net- work node or mobile equipment) registers itself to the VPN SCF [23]. After that, the 6 Services in Fixed and Mobile Ultra-Broadband VPN services control functions VPN services control functions e-NAF e-MCF e-RACF Transport control functions Transport control functions Enterprise network Next generation network (NGN) Control e-MCF - enterprise mobility control functions NACF - Network attachment control functions e-NAF - enterprise network attachment functions RACF - Resource and admission control functions e-RACF - enterprise RACF VPN - Virtual private network MMCF - Mobility management and control functions VTF - VPN transport functions Figure 6.6 VPN framework architecture in NGN. RACF/e-RACF enforces QoS for the VPN tunnels by using VPN transport functions in the NGN. When the user deregisters from the VPN service, the VPN SCF initiates to RACF/e-RACE release of the QoS for that VPN tunnel. 6.6 QoS for Internet Access Service and Over-the-Top Data Services In the terminology used by telecom operators for their Internet access service, "data" includes all Internet-based services that are provided through the public Internet access, which is based on the network neutrality principle and served by using the best-effort approach (that is, the network does its best effort to deliver every IP packet, without particular QoS guarantees per packet of per flow). Other terminology which is widely used for services provided over public Internet access is OTT. OTT services (i.e. data services) include video, audio, and other multimedia data services (e.g. Web services, email) over the public Internet networks. Both "data" and "OTT" are used interchange- ably in this book. What belongs to the OTT (i.e. data) service space? It includes all services that telecom operators simply charge as data, which is in fact Internet traffic (not managed IP traffic). OTT services include but are not limited to FTP over the public Internet, email over the public Internet, Web services over the public Internet, 