A
Glossary of Terms
188
EAP/SIM
Extensible
Authentication
Protocol/Subscriber
Identity
Module;
utilizing
IKEv2.
Encryption
A
security
mechanism
used
for
the
transformation
of
data
from
an
intelligible
form
(plaintext)
into
an
unintelligible
form
(ciphertext),
to
provide
confidentiality.
The
inverse
transformation
process
is
called
decryption.
End
entity
A
human
user
or
an
application
to
whom
a
certificate
is
issued.
The
end
entity
has
also
the
private
key
counterpart
of
the
public
key
in
the
certificate.
ESP
Encapsulating
Security
Payload.
An
upper
level
IP
header
that
denotes
that
the
contents
of
the
payload
are
encrypted
and
possibly
also
otherwise
protected.
An
ESP
may
appear
after
the
IP
header,
after
an
ESP
header
or
theoretically
also
elsewhere
within
an
IP
packet.
An
ESP
only
protects
the
contents
of
the
payload,
not
any
associated
header.
Therefore
it
is
possible,
for
example,
to
change
any
field
in
the
header
of
the
IP
packet
carrying
an
ESP
without
causing
a
security
violation.
The
contents
of
the
ESP
header
are
unknown
to
anyone
not
possessing
information
about
the
transformation
and
SA
needed
to
recover
the
protected
data.
An
ESP
may
also
contain
integrity
protection.
The
ESP
protocol
is
defined
in
RFC
2406.
Firewall
A
node
located
on
the
perimeter
of
an
administrative
domain
that
implements
the
security
policy
of
the
domain.
A
firewall
usually
performs
address
and
port
‐
based
packet
filtering
and
usually
has
proxy
servers
for
e
‐
and
other
services.
GAN
Generic
Access
Network.
GGSN
Gateway
GPRS
Support
Node.
Gigabit
Ethernet
A
family
of
IEEE
802.3
standards
capable
of
transmitting
data
at
1
Gbps
(1000
Mbps).
See
1000BaseT.
GRE
Generic
Routing
Encapsulation.
A
tunneling
protocol
which
encapsulates
the
private
network
data
and
protocol
information
within
the
public
network
transmission
units
so
that
the
private
network
protocol
information
appears
to
the
public
network
as
data.
HA
High
Availability
provides
a
redundant,
state
‐
synchronized
security
gateway
hardware
configuration.
This
means
that
the
state
of
the
active
unit,
such
as
the
flow
cache
and
other
vital
information,
is
continuously
copied
to
the
inactive
unit.
When
the
cluster
fails
over
to
the
inactive
unit,
it
knows
which
flows
are
active,
and
communication
may
continue
to
flow
uninterrupted.
