Karl,
I would recommend reading through the following whitepaper: ArcGIS Secure Mobile Implementation Patterns. The VPN approach is one of the patterns that the paper discusses.
Let me know if you find the information that you need in that document.
Thanks,
Matt Ballard
Thanks!
Thank you very much Matt. This is an excellent start.