Dynamic network-based secure VPN deployment in GPRS

A dynamic network-based virtual private network (VPN) deployment, which is established between the general packet radio services (GPRS) border gateway and a corporate intranet gateway, is presented and analyzed. By relying on a sequence of concatenated protection mechanisms (GPRS ciphering and VPN deployment), it is possible to provide secure remote access to mobile users without requiring an extra tunnel overhead on the radio link or the implementation of computationally intense encryption algorithms in the mobile station. The VPN functionality is based on IPsec. For VPN initialization and key agreement procedures, an Internet key exchange (IKE) protocol proxy scheme is proposed, which enables the mobile user to initiate a VPN, while shifting complex key negotiation to the network infrastructure. The required enhancements for security service provision can be integrated in the existing network infrastructure, and therefore, the proposed security scheme can be used as an add-on feature of the GPRS.