In this post, we explain all the little details and nuances about VPNs, APNs and Fixed IP features and their exact meanings.
After reading the post, you shouldn't have any further confusion between the different variants of APN and VPN deployment models available.
This newest blog post continues on the topic of APN and VPN technology, which we have explored earlier.
From the above-mentioned blog post, we know that APN stands for Access Point Name. It is the name of a gateway and point of entry onto the Internet (IP network) from a mobile network.
Also, we already know that there are several variants of APNs in everyday use. These are:
Public APN is the default option that is associated with all SIM subscriptions of a given service provider. These default settings allow all users access to the Internet without any additional steps in IoT device reconfiguration.
Private APN, also called Corporate APN, is used to access a specific network. Here, the SIM subscription must be provisioned on this specific APN gateway, and APN settings have to be updated in the IoT device.
The picture below illustrates the traffic flow in a typical use case of a Private APN.
Here, the traffic flows directly from the IoT device via the mobile network to the customer's private network, where it terminates. This traffic does not travel across the Internet.
Private APN offers more security than Public APN, which uses the Internet. Only SIM subscriptions that are authorised by the customer may be provisioned onto an APN gateway. Private APN is not accessible to any other subscriber since it is a private network that can only be accessed by the customer's SIM subscriptions.
The last variant, Custom APN is a de-facto Public APN with an alias, set up according to the customer organisation’s requirements, masking a generic name assigned by a service provider.
As per its name, Private APN gives more control over how to secure and configure the data connection.
There are several benefits of using Private APN for customers, including:
The Private APN solution offers truly secure mobile connectivity, comparable to the level of protection applied in private networks that allow sending customer organisation's data traffic within a closed and private group of hosts.
VPN stands for Virtual Private Network. It is a layer of security for Internet access from an IoT device. It allows for the data exchange to remain confidential via encryption and decryption mechanisms. It is crucial when a device remains connected to the Internet via a public network, including Public APN.
A VPN is set up as a site-to-site connection. It creates a so-called VPN tunnel, which is stretched between two endpoints. One end, the Software VPN Client, is running on an IoT device, and the VPN Server on the other side, which is usually the organisation's back-end server or specialised hardware firewall or router.
These two endpoints add headers to the original packet, with these headers including fields that allow the VPN devices to make the traffic secure. The VPN devices also encrypt the original IP packet, meaning that the original packet's contents are indecipherable to anyone who happens to see a copy of the packet as it is transmitted over the Internet.
The picture below illustrates the VPN tunnel concept.
For creating a VPN tunnel on the IoT device side, there is a need to assign an IP address. This IP address is assigned by use of an APN gateway via APN settings applied on the IoT device. It enables connections directly to the device through a VPN tunnel and extends this private and secure network to the IoT devices.
Specialised mobile VPN solutions are used for IoT devices where an endpoint of the VPN is not fixed to a single IP address, but instead roams across various data networks without dropping the secure VPN session or losing application sessions.
Here, Mobile VPN tunnels are not tied to physical IP addresses and instead each tunnel is bound to a logical IP address. That logical IP address is assigned to the IoT device (being a device in motion) no matter where it may roam. Applications running on the device and inside the customer organisation’s network communicate through that one logical IP address, remaining unaware of the user's motion and the different physical IP addresses and data network transitions.
VPNs provide the same security features as private networks, while still sending data over a network that is open to other participants, such as the Internet. Compared to a private network, the Internet does not provide a secure environment that protects the privacy of a customer organisation's data.
The main benefits of using VPNs are security-related features:
From the more practical side, using a VPN allows setting up a connection from the server to the IoT device. Without a VPN, different firewalls or Network Address Translation (NAT) can prevent connecting to the device, and moreover such a connection can only be initiated from the IoT device itself.
And last but not least, a VPN protects against unwanted connections from other users trying to reach the IoT device. Only the SIM subscriptions provisioned with the VPN can connect to the customer organisation's applications. Outside SIM subscriptions and users can not access the configured VPN tunnel.
There are two types of IP addressing - fixed IP address, also called static IP address, and dynamic IP address.
Dynamic IP addresses are assigned automatically based on preconfigured settings in the network and dedicated DHCP servers (dynamic host configuration protocols), which manage a pool of IP addresses available for use.
Fixed IP addresses remain static and don't change over time. Their use allows for opening two-way communication between the IoT device and the customer organisation's servers. In other words, it ensures remote access to the IoT device to retrieve information when needed, and without having to wait for the device to send its data back to the server. Since it is a fixed IP address assigned to the IoT device, the IP address to reach the device is already known.
The illustration below shows the difference between both types.
Also, there are several variants of Fixed IP:
There are several benefits of using a Fixed IP:
In the next blog post, we’re going to learn about real-life deployments for APNs, VPNs and Fixed IPs. Together with a guide to finding the best solution for every IoT company.In order to learn more about security in IoT in more general terms, we have written a thorough article about it available here.
If you have any questions, don't hesitate to reach us at hacking@1oT.com.
If you’re interested in how to get your IoT devices connected to cellular networks, contact our sales team and we’ll find the best solution for you.