Mobile VPNs: Enabling On-the-Go Workforces

After years of anticipation and a boost from high-speed wireless broadband, the business use of mobile handheld devices is finally taking off. Gartner Inc. predicts that two out of three workers will be using mobile enterprise applications by the end of the year. However, delivering secure remote access to mobile workforces is not easy. Conventional remote-access VPNs based on IPSec, SSL and L2TP enable secure access from stationary laptops, but often disappoint mobile users who require on-the-go access from handheld devices. A recent study by mobile software maker Action Engine Corp. found that many mobile users are frustrated by slow application response. Three out of four simply abandon mobile application sessions after just two connect attempts. Between productivity losses and help desk calls, this dissatisfaction is generating renewed interest in mobile VPNs.Overcoming Slow NetworksMobile VPNs were created years ago to secure communication over painfully spotty and slow radio networks. Wi-Fi and 3G networks are now much faster, but today’s mobile users still encounter many of the same old problems, from coverage gaps and handoff delays to roaming disruption and broken sessions. Today’s mobile VPNs add capabilities designed to solve these problems, while using authenticated, encrypted tunnels much like conventional remote access VPNs. "A mobile VPN is specifically designed to provide a very efficient work environment for people who are on the move as a component of their job function, and who need access throughout the day," explained John Knopf, senior project manager at mobile VPN provider NetMotion Wireless Inc. "We see a big distinction between mobile and remote. IPSec and SSL work wonderfully for remote users, but a truly mobile user requires a different solution."Here are the capabilities that differentiate mobile VPNs from their conventional counterparts:Network independence: Mobile VPNs operate over just about any kind of public or private, wired or wireless network, including dial-up, residential broadband connections, Ethernet LANs, Wi-Fi hotspots, wireless WANs (e.g., HSDPA; EvDO), satellite networks and non-IP radio networks (e.g., Data-TAC and Mobitex). Network transparency: Mobile VPN users spend little or no time dealing with the specifics of these disparate networks – the connection is simply up or down, and the mobile VPN always delivers the same degree of security, the same application interface, and the same user experience. Network persistence: Conventional VPN users lose their connections and IP addresses every time they roam onto a different network. To avoid this pain, the virtual (or home) IP address of each mobile VPN client remains the same when the physical (or "in care of") IP address changes. By communicating through this persistent IP address, clients can avoid network connection reset and re-authentication. Transparent suspend/resume: When end-point devices go to "sleep" to conserve battery life, the mobile VPN server maintains enough information about the devices and clients that the devices can awaken and resume network communication without disrupting the VPN tunnel. Application persistence: When mobile VPN devices pass through coverage gaps that last minutes or hours, the mobile VPN server queues undeliverable application messages, resending them when the device later regains coverage. Some applications still may time out when using a mobile VPN, but many can survive frequent or lengthy disruptions – even the swapping of adapters in devices with a single card slot. Wireless optimization: Some mobile VPNs optimize TCP/IP’s notoriously chatty performance by adjusting to each link’s characteristics. For example, IBM Corp.’s WebSphere Everyplace Connection Manager (WECM) can compress data sent over GPRS by up to 67%. Policy-based roaming among multiple networks: Mobile VPNs manage the use of multiple links with roaming policies. For example, policies built into ipUnplugged AB’s mobile VPNs can use signal strength thresholds to trigger wireless roaming; Columbitech AB’s VPNs use speed, pricing and preferences to select and log the device into the best available network. The ability to manage multiple links is critical, as most laptops now ship with Ethernet and Wi-Fi, and most smartphones ship with 3G and Bluetooth. Network-aware rules: Like conventional VPNs, mobile VPNs enforce security policies. But mobile VPN rules also can incorporate network characteristics – for example, disabling encryption when connected to a trusted network, blocking file transfer over a low-bandwidth or high-tariff WAN, or automating Wi-Fi hotspot login before VPN tunnel establishment. According to Asa Holmstrom, president of Columbitech, persistence is the primary reason customers choose a mobile VPN. "The user does not have to reconnect or log in again," he said. "As soon as coverage is resumed, he can continue right where he left off.""We think of mobile VPN as an always-on service," said Gregory Singh, CEO of ipUnplugged. "For example, with applications like VoIP, if you are moving between different networks, that’s when we see real demand for fast seamless roaming. Who wants to lose a VoIP call because they have to log into the network again? That’s just not going to work for real-time applications."NetMotion’s Knopf argues that mobile VPNs must actually improve application performance. "We have many customers who tried to support their mobile deployments with IPSec or SSL, but found their performance degraded significantly – up to 40% with IPSec," he said. "With you should at least have no degradation. We have seen two to five times improvement over low-speed wireless or dial up. Even over EvDO and HSDPA, we can do quite a bit to improve through put performance."Nuts And BoltsTo succeed, mobile VPNs must improve the mobile user’s experience while delivering many of the same security capabilities offered by IPSec and SSL VPNs. These security systems implement a variety of authentication and encryption algorithms. Among mobile VPNs, AES support and FIPS 140-2 certification is growing but not yet universal. Most can interface with RADIUS, LDAP and Active Directory servers to reuse corporate network logons and enable single sign-on. Several also support client-side certificates, tokens, biometrics (e.g., Columbitech) or their own PKI (e.g., Nokia Corp.).Mobile VPNs also may play a role in mobile device security policy enforcement. For example, Columbitech, IBM, ipUnplugged and NetMotion can quarantine a user account or device when a handheld is lost or stolen. IBM and ipUnplugged can check mobile devices for required applications at connect time to mandate use of a firewall or antivirus software.When it comes to mobility, the value of standard protocol compliance is hotly debated. Ecutel Systems Inc., IBM, ipUnplugged and Nokia mobile VPN clients and servers all buckle a standard mobile IP implementation onto a standard IPSec implementation, making it possible to integrate them with compatible third-party IPSec clients and gateways. In contrast, Columbitech, NetMotion, Padcom Inc. (now merged with NetMotion) and Radio IP Software Inc. use proprietary transport layer protocols to improve wireless performance. They perform essentially the same functions as Mobile IP and IPSec – tunnelling, encryption, and authentication – but they implement these functions using non-standard protocols.Enterprise RFPs that mandate standard protocols overlook the potential merits of proprietary alternatives. In its January 2006 market study, The 451 Group concluded, "The advantage of using standards proprietary protocols from a pure technology perspective is unclear."From a capex standpoint, however, standards can help to leverage existing investments in IPSec remote access. For example, Nokia’s mobile VPN client can be used with Nokia, Check Point Software Technologies Ltd., or Cisco Systems Inc. IPSec gateways. The ipUnplugged Roaming Client is compatible with Alcatel-Lucent, Cisco, Juniper Networks Inc. and Check Point. While running IPSec under a proprietary transport-layer mobility protocol may be technically possible, doing so would add complexity without gaining value. After all, why encrypt a second time with IPSec?Like IPSec VPNs, mobile VPNs require installed client software. But mobile VPN vendors have learned from the market success of SSL VPNs, and most provide a Web portal from which mobile users can download a near-zero-config mobile VPN client and activate a default VPN connection. Centrally defined policies (and future updates) are then pushed to the mobile devices. Nokia and Columbitech can even auto-generate and install client certificates, used to strongly authenticate all future connections.Default VPN policies are usually coarse – for example, granting a pre-defined Windows Group access to the entire network attached to the mobile VPN server. This lets you get a simple VPN up and running quickly. However, most companies will want to apply new policies at the group, user, or even device level. Filter granularity ranges from subnet/port (in mobile IP VPNs) to application content (in some transport-layer VPNs). For example, NetMotion policies can permit or deny traffic based on hotspot SSID and application command, but controlling mobile access with this granularity requires purchase of an advanced policy management module.Streamlining client installation and policy configuration is only part of the battle. Mobile VPN clients also must run efficiently on a wide variety of portable and handheld devices, each of which can pose its own unique hardware, OS and interface challenges. Most mobile VPNs support Windows32 and Windows CE, but there are a dozen versions of WinCE and hundreds of hardware platforms that run WinCE. For example, readily available Windows Mobile 5 PDA mobile VPN clients do not run on Windows Mobile 5 smartphones (now supported by NetMotion and Columbitech). Palm Inc. and Symbian Software Ltd. clients are harder to find. In fact, IBM is the only vendor that now supports devices in all four major mobile platform categories.Workforces with specialized mobile devices (e.g., barcode scanners, point-of-sale terminals) may be satisfied through custom client development. For example, 15 wireless device manufacturers have used Columbitech’s SDK to port its WVPN to at least 150 different devices running DOS, Wind River Systems Inc.’s VxWorks and other embedded operating systems, according to the company. Mobile VPNs insulate applications from network differences, but those who want their applications to control network connections can do so by using an SDK.The platform is also an important consideration on the back end. Ecutel, ipUnplugged and Nokia sell mobile VPN server appliances; others are sold only as software. According to ipUnplugged’s Singh, many customers prefer to install mobile VPN software on their own off-the-shelf servers. "We’re moving to being a pure software vendor so that our resellers and customers can choose which platform they want."Most mobile VPN servers can run on Windows 2000/2003 and/or Linux, except for IBM, which requires AIX or Solaris. Server capacity, reliability, and scalability are critical. Several mobile VPN product architectures split the back end, letting you distribute data functions across several servers while centralizing certain control functions (e.g., provisioning, policy storage, activity logging). Companies with large workforces or high-speed LANs should look for a mobile VPN that supports server pools, load balancing and fail-over.Vendors supply metrics to assist with capacity planning, but sizing can be tough when mobile user traffic is highly variable. To better understand your own needs, conduct a mobile VPN field trial with a representative mix of devices, networks and mobile applications.Learn By ExampleOne way to more fully understand the potential of mobile VPNs is to examine how other companies have used them to meet their own business needs. Mobile VPN adoption is minimal in comparison to conventional remote access VPNs. But thousands of companies have successfully deployed mobile VPNs – in many cases, after a conventional VPN failed to satisfy mobile workforce needs. Mobile VPNs are frequently used to improve the usability and performance of field service automation applications. For example, more than 1,200 Carlsberg Brewery delivery trucks use GPRS to communicate delivery receipts, order changes and provide other status information to back-office systems. Drivers use Columbitech WVPN to remain logged into Carlsberg’s SAP AG enterprise resource planning (ERP) system as they roam through and between GPRS coverage areas. Wireless optimizations permit larger volumes of data to be sent over GPRS, and switching seamlessly to Wi-Fi enables high-speed access whenever a truck pulls into a Carlsberg depot. The company used Columbitech’s SDK to integrate WVPN into Carlsberg’s Smart Route application, making the mobile VPN invisible to drivers.Jacksonville Electric Authority (JEA), a Florida utility, used NetMotion Mobility XL to provide more than 400 field workers with secure mobile access to dispatch data, CRM tools and electrical service delivery applications. When JEA tried to use IPSec, they found that workers were spending 20 to 30 minutes logging into the network and connecting to applications. Repeating this over and over again while roaming throughout an 840-square-mile service region proved frustrating and wasteful. JEA wanted to deploy a mobile VPN to improve workers’ productivity and their ability to respond quickly to problems. JEA chose NetMotion because it satisfied their application and high availability needs, keeping workers connected securely and reliably while roaming between networks.Many companies use mobile VPNs to secure in-house networks, smoothing over both the coverage gaps that break IPSec VPNs and the support issues with handheld device clients. For example, the retail industry is Columbitech’s largest market. "They want the same security environment in all stores, and the same security for all devices – wireless printers, scales, point-of-sale devices," said Holmstrom. "Some of those systems run Windows CE, but many are proprietary and it has been challenging to create VPN clients for all of them." Columbitech’s focus on this vertical market is evident in its partnership with Symbol Technologies (acquired by Motorola last year), which resells WVPN in its AirBEAM Safe product line.ConclusionThese examples illustrate how companies have applied Mobile VPNs to insulate users and applications from coverage gaps, support suspended devices, optimize the use of limited bandwidth and streamline network roaming – solving the most basic problems that impede mobile communication over conventional VPNs. Mobile VPNs support a broad mix of IP-based applications, but session persistence cannot make lengthy outages invisible to real-time applications like streaming media or in-progress VoIP calls. If mobile VPNs sound like a fit for your workforce, conduct a field trial to set realistic expectations about the benefits and limitations. Lisa Phifer is VP of Core Competence Inc. (www.corecom.com), a network security consulting film specializing in emerging technologies, including wireless communication and virtual private networking. She can be reached at lisa@corecom.com. This article is reprinted by permission of Business Communications Review (www.bcr.com).

Mobile VPNs: Enabling On-the-Go Workforces

News | 02/01/2007 5:00 am EST

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us