ed way. The layering does not normally cater for the distribution dimension, but the view is very common. Security measures can be introduced at all levels in an IP stack. In Figure 6.12 a simple two-dimensional security view is provided. It is not possible to manage with protection at one single layer. A further protection measure, apart from access protection, is the partitioning of networks into zones. Figures 6.12 and 6.13 give examples of protection enablers at various layers. In Figure 6.12 the measures could be: For the application layer: encryption of transmitted user data, proxy filtering. For the network user: all types of access control to the network. See AAA below. For the control layer: control of individual and general security measures at the con- nectivity level, such as tunnelling. For the connectivity layer: tunnelling, filtering. Among the missing standards in Figure 6.13 are PGP (pretty good privacy, see also Section 6.9.1) at the application level and link layer encryption. Link layer encryption could for example be used for leased lines and frame relay or ATM WANs. Terminal Security layering, example Server Other network(s) Browsers, encryption Applications proxy filtering Content Attack Network user Authentication, authorization, name resolution, charging Attack Communication control Session establishment with e2e security Attack Connectivity Filtering, tunneling Attack User information flow Figure 6.12 A two-dimensional view Understanding Changing Telecommunications - Building a Successful Telecom Business (Remote access) HTTP, etc. WSP, etc. Term, etc. HTTP, FTP etc. See tunneling TLS/SSL See integrity IP security Figure 6.13 A layered view with four protection methods indicated Encryption, in order to achieve confidentiality protection, can be used at all layers. Regarding protection at the link and physical layers, solutions are normally not continuous end to end, because of the link-by-link architecture. In GSM, for example, the physical layer is encrypted between the mobile and the b