3

I'm developing an Android application. My application is using a web service to retrieve information in JSON format which is then displayed on the app's view.

The requirement is that my client doesn't want any of their information being transferred over the internet. I'm therefore required to tailor the app to retrieve my data through a virtual private network. The idea is that the information fetched cannot not be accessed by any device which is not connected to the specific VPN.

How can I accomplish this task? Any point outs will be greatly appreciated.

  • 2
    Use an internal webservice, unavailable from internet, then any vpn solution on company smartphones will do, linking the smartphone to company internal network. The app will be useless without the VPN credentials. Obviously your app need to handle the case of unavailable webservice and not hang forever retrying. – Tensibai Aug 26 '16 at 7:49
  • Does your app handle the VPN connection? Or does your client have another setup to handle this? – feral_fenrir Aug 26 '16 at 9:36
  • feral_fenrir my app doesn't handle vpn connection, my client has their own vpn setup, i am required to tailor my app to the client's vpn. – Gordon Android Javalist Aug 26 '16 at 9:59
  • Tensibai i was thinking of the same solution. Let me try it out. – Gordon Android Javalist Aug 26 '16 at 10:02
  • 1
    No - you don't "tailor your app" this constraint is exclusively about the infrastructure configuration. The infrastructure configuration is not visible to the application, therefore no "tailoring" is even possible. – symcbean Aug 26 '16 at 11:35
1

I think this way:

  • Put the Server Application on local IP address in clients network
  • Make it dedicated network like 10.1.2.0/24 where only this service resides
  • In the VPN server, there should be rule which users can access this network, so some can access all network, some only this service
  • In the android app you can make detection if 10·1.2.0/24 is reachable, in particular, I'd check the route to it via /proc/net/route which is fast, application non-blocking check. You can use also library which can parse this file.
  • It may be that VPN would setup gateway to all sub-networks in 10.0.0.0/8 so that you may need to do some parsing and subnet calculation so that you can handle further VPN changes
  • Once your application assumes there's VPN connection, you can do the call to JSON API but since this is VPN the timeout might need to be increased, and because of that it may need to be non-blocking
  • Since establishing connections via VPN is slower especially on 3G / LTE networks, you might want to keep persistent connection, so this have to be configured on the HTTP client you use and on the server (like tomcat / httpd keep-alive timeouts). You can test persistent connections as well non-persistent to see what performs better. Keep-alive sometimes is "persistent connection", sometimes is "TCP keep alive", so look in docs what is what, both may be used.
  • You can monitor for VPN disconnection same way as looking for connection, so in case of disconnection you can make non-intrusive status change on the APP GUI
  • The server APP may need to allow only certain Subnets so you might need to firewall it so that not everyone can use it

This is quite difficult problem if you need to handle both VPN connection and HTTP sockets. I'd be careful with retries and keep the monitoring of the route every 1s.

  • Thank you for the input. After intensive research and proper problem definition by my client i finally got a solution. The aim was to prevent any unknown user from accessing the app data, therefore i wrote java code detecting whether a request is being made from a private network, after i get this data i counter check the dns and if it matches the client vpn, then i provide access, else i restrict the user. I have tested and it works perfectly this far. I am also open to better suggestions or improvements. – Gordon Android Javalist Sep 23 '16 at 13:55
0

A slightly more out of the box approach is to look at per-app-vpn through the use of tools like an MDM server (MobileIron comes to mind). If the customer already has an MDM server managing their Android devices, then they would be able to apply the VPN configuration to the device alongside deploying the app. This would allow the OS to force a VPN anytime the application makes ANY network connection. I don't believe any coding change is needed on your part since the OS would manage the connections of the app to ensure it always used the VPN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.