e user to the remote switch of the destination network. This tunnel may be encrypted using IPSec, if the communication between the GPRS PLMN and the destination network is performed over an insecure network. As the security is ensured on an end-to-end basis between the mobile sta- tion and the intranet by the Intranet Protocol, no specific security protocol exists between GGSN and the intranet. User authentication and the encryption of user data are done within the Intranet Protocol and this pro- tocol can also carry out private IP addresses allocated by the intranet. The basic principles of the transparent mode are The GPRS operator allocates a static or dynamic public address to the mobile station static using the DHCP local server. The ISP/intranet using RADIUS performs the authentication and authorization. Figure 10-16 Transparent mode. Server PCUSN Internet Radius PDP Context Activation Public IP @ for MS VPN Tunnel Dial Up Private IP @ for MS Public IP Public IP Private IP Private IP of MS of CES of MS of server Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SGSN-to-GGSN (Gn) and GGSN-to-PDN (Gi) Interface Chapter 10 The Intranet Protocol running between the user and the ISP/intranet provides end-to-end security. A second (internal) IP address may be assigned to the user by the destination network. Nontransparent Access In the following example, the GGSN provides an interconnection to the intranet, as shown in Figure 10-17. In nontransparent GPRS access, the GGSN facilitates the user access to the ISP or the intranet. The mobile sta- tion is allocated a private static or dynamic IP address belonging to the ISP or intranet; the GGSN has to send a query to the ISP/intranet RADIUS/DHCP server. The authentication and authorization are per- formed by the GGSN on the RADIUS server belonging to the destination network. A tunnel is created fr