Enhanced VPNs: Next-Gen Strategies - Internet/Web/Online Service Information

Telecommunications, Sept, 2000 by Skip Taylor

Enhanced VPN providers don't supply the VPN infrastructure: They manage groups of networks to ensure optimal network performance for their customers.

Having made it through birth and infancy, the VPN market is poised to enter a more mature period of growth and development. This new era promises to deliver innovative levels of operational efficiency to companies that use VPNs and untold opportunities for service providers that help companies implement enhanced VPN strategies.

Enhanced VPN services can build on the secure connectivity many companies enjoy over shared IP services and introduce the functionality and performance characteristics typically associated with dedicated private corporate networks. VPNs will provide the infrastructure that finally allows orporations not in the information technology and communications business to focus on core business activities and put the burden of supporting the increasingly dynamic network on the shoulders of a new generation of service suppliers--enhanced VPN providers.

Enhanced VPN providers support this novel enviromnent by maintaining an "agnostic" attitude toward network connectivity providers. Rather than supplying the actual VPN infrastructure, enhanced VPN providers use and carefully manage groups of networks to ensure redundancy and optimal performance. This eliminates the need for enterprise users to put their eggs in a single network basket- which elevates the risk--or manage multiple SLAs with contingency carriers-- which elevates the cost.

Enhanced VPNs are also poised to play a critical role in integrating nontraditional devices such as PDAs and wireless devices into the corporate network. These VPNs can work over nontraditional access routes such as cable and DSL to connect users to the enterprise network. In response to merger and acquisition activity and corporate expansion, companies depend on an increasingly mobile and personal device-oriented workforce to accomplish mission-critical activities. VPNs will be required to seamlessly accommodate multimedia traffic from a wide array of devices into a variety of locations. Enhanced VPN providers ensure that data is properly routed, prioritized and securely delivered over a heterogeneous networking environment. Ideally, this is accomplished by leveraging directory infrastructures within the network to help enforce the enterprise's user policy.

Moreover, enhanced VPN providers capture mindshare of both enterprise users and the full spectrum of communication carriers because the concept capitalizes on standards and outsourcing trends that are driving the technology economy.

Security and Standards

The IETF (Internet Engineering Task Force) continues to make the Internet more robust and viable for mission-critical corporate traffic. In addition, the industry has made tremendous progress in information assurance by hardening the security of VPN networks. A consensus is building around technologies such as:

* Kerberos, a network authentication protocol designed to provide strong authentication for client/server applications by using secret-key cryptography The Kerberos protocol uses tough cryptography requiring a client to prove its identity to a server (and vice versa) across an unsecure network connection. After a client and server have used Kerberos to prove their identities, they can encrypt all their communications to assure privacy and data integrity.

* Public key infrastructure, which uses a pair of keys (one private, one public) to protect encrypted information over a network. Information encrypted using the public key can only be retrieved using the complementary private key. With this system all users' public keys can be published in open directories, facilitating communication between all parties. In addition to encryption, the public and private keys can be used to create and verify digital signatures. These can be appended to messages to authenticate the message and sender.

* IPSec, a developing security standard at the network or packet-processing layer. Earlier approaches inserted security at the application layer. IPSec will be especially useful for implementing VPNs and for remote user access to private networks. With IPSec, security arrangements can be handled without requiring changes to individual user computers.

Outsourcing

With progress being made on the standards and security fronts, enterprises are feeling increasingly comfortable with outsourcing many IT and telecom functions to trusted technology partners. According to Infonetics Research, this trend appears to be as appealing to Fortune 1000 corporations as it is to small and medium-size enterprises.

Recent Infonetics research reveals that 57 percent of large, 55 percent of medium, and 51 percent of small organizations plan to deploy some sort of VPN by 2002 (see Figure 1). Voice/data convergence promises to drive the bulk of VPN growth, as 56 percent of large organizations plan to use voice over ATM, voice over frame relay or voIP to integrate traffic types on the WAN by 2002 (21 percent plan to implement these strategies in 2000). The reasons for these trends are fairly straightforward.