ericssonhistory.com

work and for protecting traffic over the airlink. However, for a communication systemto use crypto-based security mechanisms,these mechanisms must be packaged intoprotocols and supported by key distributionprotocols or key infrastructures. Furthermore,the security mechanisms must nothinder usability. Obviously, the user of thecommunication system must also set up anduse the communication equipment correctly.In practice, however, this is a problem—misconfigurations often leave big holes inthe security system.It is difficult to build efficient and practicalsecurity systems. In particular, becauseof its size and availability to the public, theInternet constitutes a major security challenge.Notwithstanding, several protocolsand system architectures have been designedto protect IP traffic.ScenariosIn an all-IP world, users will have IP connectivityeverywhere (Figure 1): at home,they will connect via residential local areanetworks (LAN); at work, they will connectvia the corporate intranet; they will also beable to connect at public kiosks or Internetcafes and at hotels; and while on the road,they will be able to connect over the air (mobileInternet). The roaming experience thatthe cellular phone industry has given itsusers will also apply to IP users when, forexample, they temporarily use a foreign domainto access the Internet. Furthermore,thanks to wireless communications, userswill enjoy always-connected service (alwaysconnected, always online). Users will thusexperience seamless IP services when movingacross wireless and fixed access. The servicesthemselves will span across differentnetworks, allocating along their paths variousresources, such as proxies, mobilityagents, and brokers.Throughout this article, we use the termadministrative domain to denote an IP serviceprovider—either an operator or Internet serviceprovider (ISP). In the all-IP world, boththe user's IP device and the administrativedomain need to protect their resources frompotential attacks, since hostile mobile hostsin any domain might attack other mobilehosts or network nodes or abuse resources.To prevent this from happening, serviceproviders need a mechanism for regulatingaccess to their domains and for getting paid.The most straightforward mechanism forregulating access consists of building trustFigure 1An all-IP world In which IP is run over all kinds of access network—wireless or wireline aswell as core networks and intranets.relationships: each user, host, and service isassigned an Internet identity and associatedcredentials. In this way, any actor can beidentified and authorized to use a tesource.Service providers can then allocate resourcesto authenticated users and charge for theirusage. Roaming agreements between administrativedomains allow users to visit anduse foreign network resources. Arrangementsof this kind imply a certain amountof trust between administrative domains;that is, they must exchange information ontheir subscribers, in order to authorize andallocate resources.In an important business scenario, the administrativedomain is a corporate networkto which employees can connect when awayfrom the office. In this case, two separatemodels of trust relationships can be adoptedto provide secure remote access to the corporateintranet via the Internet.• The corporate domain signs an agreementwith a service provider that handles securetunnels between remote employees andthe corporate network.• If the enterprise can solely trust its employees,then only end-to-end security isacceptable, in which case employees musthandle secure tunnels from their IP devicesto the corporate intranet.Ericsson Review No. 2, 2000 97