ication architecture. Authenticated access is required for logging into the network element or the management application. It is also quite common to use security servers that imple- ment rules and policies for access like the Sun One Identity Server, which can control centralized access. A typical implementation would involve the interface to add, delete, or edit users. Each of the users can be associated to a group. For example there will be groups like administrator, GUI users, technicians, and SO forth, with a separate set of access permissions for each group. Permissions could be granted to specific functionalities in an application, like a user in the technicians group can only modify configura- tion management functionalities and view fault management functionality. Some applications even define deeper levels of permission where a user in a spe- cific group might be able to view and add comments to a log-in fault management functionality but will not be able to clear the log. Logs can be used to track security. The network element generates security logs for different access and usage scenarios. For example a log is generated with the log-in user details and source of the user (IP address of the user machine), when a user tries to log into a network element. Logs can also keep track of the activities performed by a user on the network element. Alarms on failed log-in attempts and unauthorized access attempts are also captured as part of security management. Functionalities like call trace and call interception is done using telecom man- agement applications. When a law enforcement agency wants to trace calls from a user, the security management application configures the network element to generate call trace records for the user. The trace records are collected from the network element, analyzed, and displayed in predetermined format. In call inter- ITU-T FCAPS ception, a call in progress between two users is intercepted for listening by a law enforcing agency. Single-sign-on (SSO) is a popular method for