an encrypted session is established between the two locations. The user authentication mechanism gives the authorized user of the VPN system access to the sys- tem, while preventing the attacker from accessing the system. Some of the common user authentication schemes are Operating system username/password S/Key (one-time) password Remote Access Dial-In User Server (RADIUS) authentication scheme Strong two-factor, token-based scheme The strongest user authentication schemes available on the market are two-factor authentication schemes. These require two elements to verify a user's identity: a physical element in his or her possession (a hardware electronic token) and a code that is memorized (a PIN number). Some Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SGSN-to-GGSN (Gn) and GGSN-to-PDN (Gi) Interface Chapter 10 cutting-edge solutions are beginning to use biometric mechanisms such as fingerprints, voiceprints, and retinal scans. However, these are still rela- tively unproven. When evaluating VPN solutions, it is important to consider a solution that has both data authentication and user authentication mechanisms. Currently, many VPN solutions provide only one form of authentication. Because of this, VPN solution providers that only support one of the two authentication mechanisms typically refer to authentication generically, without qualification of whether they support data authentication, user authentication, or both. A complete VPN solution supports both data authentication (also known as the digital signature process or data integrity) as well as user authentication (the process of verifying VPN user identity). Various cryptographic techniques can be used to ensure the data privacy of information transmitted over an unsecured channel such as the Internet, as in the case of a VPN. The transmission mode used in the VPN solution dete