 and the routers physically segregate access to and from the packets, as well as to and from the network nodes, according to strict policy and membership tables. These must be main- tained for each VPN. This is an added-value function that carriers can offer to customers. The analy- sis of the potential vulnerabilities of MPLS routers or MPLS-based VPN schemes has nothing to do with our discussion; this topic would fall under the category of information security SO we will not elaborate on it here. The second of these two techniques, however, does fall squarely on our lap. We discuss it in the section "IPsec" later in the chapter. Conducting Secure Electronic Transactions With the arrival of established cryptographic techniques, several new applications such as e-commerce have appeared during the last decade. People can now safely engage in actual financial transactions with a web-based server remotely over the Internet (or a similar network) using a bidirectionally authenticated and fully encrypted link that is set up for this purpose between the server and a work- station/PC. Browsing software allows the easy use of the link. The user obtains remote access to menus, services, or the possibility of safe and discrete data entry into online forms as if business was being directly conducted at a brokerage house or a bank. People can now safely make payments or transfer funds from one account to another. They can browse online catalogs before they decide to purchase securely on the spot. They can also download sensitive material that is available online with restricted access without having to establish a special VPN first. Secure Socket Layer (SSL) has Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SECURITY COPROCESSORS 362 NETWORK PROCESSORS become the de facto standard protocol that devices and servers use to set up secure sessions that ena