4

I have project involving a M2M device. The device is not capable of HTTPS but may be required to send and receive information that we would rather not be leaked out.

The device will communicate directly with a webserver, what are the possibilities of a hacker identifying the the origin of the data and intercepting any transmitted information. If it is relatively simple would a private APN be more secure.

  • 3
    Put the M2M device behind a VPN gateway. – Yohann Nov 17 '12 at 10:49
  • 1
    It's no more/less secure and than the open net. That is no security at all. And running your own APN is not simple, as it has to be on the GSM carriers' home network. – ewanm89 Nov 17 '12 at 11:16
  • 5
    Why can't the device manage SSL? – ewanm89 Nov 17 '12 at 11:40
  • 1
    Even running a private APN won't give you much additional security, since the connection is still not encrypted. – Manuel Faux Nov 17 '12 at 11:59
2

GPRS does not provide strong protection of the data. There is some cryptography applied on the wireless link between the mobile device and base station, but this cryptography has significant problems (see research on GSM and more research). Also, once the data reaches the core network, the data is transmitted in the clear, unencrypted, for the rest of the way.

Consequently, I recommend that you set up a VPN and tunnel all your traffic over the VPN. IPSec is a good tool here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.