 to enterprises. No precise definition of VPN exists. A rough definition is: 'Private (mostly data) traffic utilizing a public network'. Another alternative is 'An encrypted tunnel over unreliable networks'. A third definition is: 'A Virtual Private Network is a private net- work that makes use of the public telecommunications infrastructure, maintaining privacy through the use of tunnelling protocols and security procedures'. The main idea is to create a secure path through the insecure Internet environment by using tunnelling, encryption, keys and other security enablers. Also company-customer information flow should be secure, based on suitable routines. Certainly the customer does not wish that anyone could read his conversation with the company. Yet, high security levels with cumbersome routines might scare off a company's customers. The solution is informing people of the consequences of intruders. By knowing risks, people may better accept security routines. Understanding Changing Telecommunications - Building a Successful Telecom Business 6.7 INTEGRITY AND CONFIDENTIALITY BY ACCESS CONTROL - AUTHENTICATION Authentication is one of the three As commonly found in figures showing IP-oriented networks. AAA stands for: Authentication Authorization Accounting Authentication is a control of the identity of the user, whereas authorization means allocation of rights. The last A, accounting, will not be described in this chapter as the function is related to charging and not network security. Authentication means controlling the user identity. The fundamental mechanism is that another party has to show that he knows or is able to do something that nobody else can do. Often the one who wants to verify the authenticity of somebody must challenge him and the challenged party must respond with the right answer. Such a response is to encrypt the challenge with the right key SO that the party can prove that he/she possess the key. It is very important that the challenge is truly random. If the intruder can predict the ne