gital certificates revocation of keys and digital certificates expiry of keys and digital certificates A consequence of the encryption is the need for keys in order to understand the message. Key handling requires what is called 'secure associations'. The PKI standard allows a single login to a system with the aid of a 'smart card'. This card contains a private key, and the public key is stored in a directory. This requires a trusted party to act as Certification Authority (CA), issuing necessary certificates (Figure 6.20). Certification authority Security gateway LDAP (lightweight directory access protocol) Figure 6.20 The need for a Certification Authority Understanding Changing Telecommunications - Building a Successful Telecom Business The protocol LDAP is used to get the public key from the directory. Once again, it is important to know you are talking to the right person, and that nobody pretends to be the LDAP directory. 6.11 CONFIDENTIALITY BY TUNNELLING There are many definitions of a tunnel: A tunnel is a safe point-to-point connection over an unsecure network, but can also be seen as an emulated connection-oriented connection over a connectionless network. Furthermore, tunnelling is an enabler for encapsulating packets (of different types such as IP, IPX) inside a common infrastructure. Even better is to regard the tunnel as an overlay network creating for example a corporate wide area network within a public IP network. Tunnelling simplifies life for the routers along the path, since they do not have to under- stand all tunnelled encapsulated protocols. Layers 2 and 3 are employed for tunnelling. Tunnelling is used for: designing and setting up a VPN remote access to companies interworking between IPv4 and IPv6 numbering supporting host mobility, such as mobile IP (RFC 2002) private numbering plan (compare VPN in PSTN/ISDN with public and private numbers) multiplexing several protocols into one link carrying other protocols than IP across the IP network creating a dedicated overlay backbone (e.g. MBON