## 2 Virtual Private Networks in Static and Dynamic Networks
### Possible Solutions When Dealing with Mobility in VPNs  
There have been several contributions in the literature for dealing with mobility in VPNs. When the tunneling should be maintained during mobile sessions, the VPN client should be able to frequently provide adequate session information. In order to avoid this continuous data exchange between clients and servers, caching mechanisms have been proposed [18], trying to hide disconnections/reconnections of VPN tunnels at the application layer (so, transparently to the users). In fact, the authors of [19] provided a method to modify the OpenVPN in order to overcome the issue of frequent client disconnections. Their idea is based on caching the packets which have not been acknowledged, avoiding data loss, service degradations and TCP retransmission-related operations (such as slow start, etc.) which degrade the overall throughput.  
Another kind of proposal which has been introduced to overcome mobility effects in VPNs is the connection splitting, which has been implemented by several vendors, mainly Columbitech which has recently merged with Sectra Communications (Kirjatyontekijankatu 14, 00170 Helsinki, Finland) [20,21]. The proposed software solution, called Mobile VPN, provides mobile users with reliable and secure access to data and applications. The solution supports a two-factor authentication with up to 256-bit AES encryption. The core of the idea consists of splitting the connection into three subconnections: (a) a TCP/UDP connection between the application and VPN clients (installed on the mobile device), (b) a UDP connection between the VPN client and VPN server, and (c) a TCP/UDP connection between the VPN and application servers.  
In this way, the application on the mobile device is directly connected to the application server, while it is only connected to the VPN client (as illustrated in Figure 1). The VPN session between mobile client and server is setup by the Wireless Transport Layer Security (WTLS) [22].  
The authors of [23] proposed a new approach for providing mobile OpenVPN sessions to users moving between WiFi cells: the main idea consists of the autoreconfiguration of the OpenVPN tunnel \"immediately\" after mobile user handover events. This is obtained by informing the VPN server about the new VPN tunnel context after the mobile user receives the new address. In contrast to caching approaches, packet loss is not avoided, but simply minimized; the number of lost packets is directly proportional to the time taken by mobile users to complete the handover operation.  
In [24], an extension of the Secure SHell (SSH) is proposed, in order to give to the applications the possibility to continue their sessions after a brief and temporary physical disconnection from the network. The core of the idea is the possibility to resume a previously established connection, although new TCP connections need to be created after reconnection. To do so, a buffer stores the data of the previous socket, then it is copied and retransmitted after the new one has been created. In this kind of approach, a non-negligible amount of overhead is introduced when the new session keys have to be renegotiated.  
The work in [25] describes and enhances the effort given by the IETF Network Mobility working group [26]. The authors propose their Secure Network Mobility (SeNEMO) scheme  
Figure 1: An example of VPN splitting technique: split connection (solid lines) and transparent connection (dotted line).  
as an extension of the Mobile VPN of [24], introducing the Session Initiation Protocol (SIP) and implementing a new system dedicated to real-time applications over VPN. The performance of the proposed idea is validated by several analytical models and simulations.