orms user authentication, and optionally accounting and IP address assignment. It can be located in the packet core network, in the service network and in corporate networks. Firewall - protects a service network from unauthorized users. They often work in combination with security gateways utilized for VPN tunnels. Proxies - hides internal IP addresses from users and applications external to the service network, thus performing a very important security function, and caches web contents to minimize response times for common web/WAP pages. Security gateway - a device that handles IPsec tunnelling and security, often used for building IP VPNs. Network address translation (NAT) - performs address translation, a feature that enables the use of private IP addresses within the UMTS domain. Dynamic host configuration protocol (DHCP) - provides configuration parameters to Internet hosts. Domain name system (DNS) - one of the most fundamental Internet services. IP addresses are not easy to remember by humans, and therefore logical names are used instead. These logical names are translated into IP addresses by a DNS. Certificate servers - A Certificate Authority (CA) issues certificates. In order to gen- erate keys and issue certificates, a certificate server (certificate management system) is needed. Network access server (NAS) - a tunnelling server for L2TP and IPSec. It is primarily used for accessing a service network over the Internet and from dial-up accesses. User authentication and IP address assignment - in addition to the GSM/UMTS authen- tication procedures (USIM - core network), a service network authentication of the user should be considered. This authentication guarantees that the current possessor of the user equipment is allowed to access a service network. Policy and multicast servers. 9.11 EXAMPLES OF SERVICE IMPLEMENTATION 9.11.1 FEDERATED APPLICATIONS Federated applications are built upon cooperating local and distributed services across the Internet. See Figure 9.14. Let us exemplify, using listening