VPN software aims to safeguard handheld devices

HAYWARD, CALIF. - Certicom and its allies say they can help companies looking to secure communications between wireless PDAs and corporate networks.

Certicom is shipping movianVPN, software that runs on wireless handhelds to connect with VPN servers installed at large corporate sites. Some Cisco and all Nortel Networks dial-up VPN servers support movianVPN, and Certicom says it is talking to other vendors.

Other VPN software clients for wireless devices require their own servers, such as V-One's AirSmartGate, says Barney Dewey, an analyst with Andrew Seybold's Outlook.

The company acknowledges it is working on improvements that security-minded end users will want, such as support for Remote Authentication Dial-In User Service and security tokens. Current authentication consists of user name and password. Certicom is working to get server vendors to support its lightweight elliptic curve cryptography (ECC), which saps less processing power than the commonly used Diffie-Hellman method for determining encryption keys. That will improve response time over the network.

One beta user says the current movianVPN lets his healthcare company evaluate corporate uses of wireless PDAs and how well they meet security requirements. "We want to assess technologies in the real world," says Jim Sanderson, senior systems engineer at Catholic Healthcare West in Phoenix.

Sanderson says five clients are being distributed among executives to figure out who at Catholic Healthcare might best use the devices and what the implications of that use would be. Healthcare computer security is subject to federal rules that are still being defined in an effort to maintain patient privacy. So it is important to evaluate whether PDAs at the end of VPNs can be made secure, he says.

Users of PDAs with movianVPN click on an icon to initiate a VPN connection. The movianVPN software automates connecting to the user's ISP and then linking to the corporate VPN server.

The user types in a password, and software at both ends generates encryption keys. When a VPN session is established, the PDA screen messages the user.

Establishing the VPN session can take 10 seconds to 1 minute, Certicom says, depending on the power of the processor in the PDA. That is in addition to the time it takes to connect to the ISP. Some PDAs are so slow that servers may time out waiting for a response, Certicom says.

So far, Certicom's client supports a rudimentary IP Security/Internet Key Exchange VPN session. Other vendors, such as Nortel, are working with Certicom to enhance these connections.

Firms other than Certicom are working on similar software but have not announced products, says Jon Cordova, a security analyst with Infonetics Research, who has been briefed by these companies with the agreement not to spill the details.

Anyone can download movianVPN free from Certicom's Web site. If customers want support for movianVPN, it costs $30 per client per year, with discounts for bulk buys.

The software supports Casio Casiopeia, Compaq iPAQ and Aero, HP Jornada 540 and 680, NEC MobilePro and Palm III, V and Vx handhelds.

On the server side, it supports Cisco VPN 3000 Concentrators and all Nortel Contivity equipment, as well as VPN gear from Alcatel, Check Point, Radguard and Symantec.

Certicom: www.certicom.com

Contact Senior Editor Tim Greene

Other recent articles by Greene