4 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SGSN-to-GGSN (Gn) and GGSN-to-PDN (Gi) Interface Chapter 10 only transport of information. All security aspects are an end-to-end responsibility, not a network responsibility. Nonetheless, wireless carriers will be asked to offer technical support to corporate clients who can build and manage their own end-to-end VPN solutions or outsource to third par- ties. In a robust SPI implementation, the corporation's tasks would include Distribute client software to remote corporate citizens needing secure wireless access Manage internal security systems: AAA server, real-time intrusion detection system Manage multiple service level agreements (SLAs) with service providers VPN-IPSec End-to-End with PKI Voluntary-based W-VPN access depicts the session flow of IPSec in an end- to-end service context, as shown in Figure 10-8. Use of a trusted third-party Certificate Authority (CA) with its PKI is exposed. This solution might uti- lize a manufacturer's access router or managed firewall products (Lucent, Cisco, Nortel, and SO on) based on IPSec techniques and compatible with the industry's RADIUS and PKI products. The GPRS operator may provide portions of the PKI. Although its role in providing the VPN might seem limited, the operator can play an important role to reduce security risks associated with the SPI voluntary tunnels. Although the remote user can have a secure path to the corporate intranet, the user's device may still be accessible from the larger, insecure Internet. If that device were compromised, the security of the corporation would be Wireless Figure 10-8 VPN- - IPSec end-to- Firewall Users Server packet data network Internet Intranet any ISP Compulsory Tunnel Server Virtual Private Network (VPN) Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given