VeriSign develops tools for wireless roaming

Mobile users typically move among multiple networks: a wired DSL connection at home, a Wi-Fi hot spot at the airport, a landline connection at a hotel, and 3G service in between. Today, users must use a connection manager to log off one service and log on to another manually. Future smart clients, however, will be able to detect available networks and switch among them based on which networks are fastest, which are cheapest, and which are most secure for business use.

Although such switching is theoretically possible at the transport layer -- switching from Wi-Fi transport to 3G transport, for example, is much like switching between a wired network and a wireless one -- making the handoff seamless requires additional engineering, according to David Deas, vice president at SBC Labs. The biggest challenge lies in maintaining VPN connections as the network shifts.

One approach is to use Mobile IP tunneling protocol, which provides the device and VPN with fixed IP addresses but maps those addresses to intermediate ones as the device moves across networks. The VPN doesn’t see a change, so it maintains its tunnel, says Shahid Ahmed, an Accenture partner who specializes in network services. This approach, however, requires that the enterprise and carrier networks coordinate the handoff -- either through a direct connection or via a third-party aggregator -- using a device called an access gateway or home gateway.

Fortunately, VeriSign is working on a project to manage these handoffs across existing networks. Because VeriSign handles much of the voice roaming among mobile carrier networks, it’s in a good position to manage the handoff from, say, Sprint’s 3G network to a T-Mobile Wi-Fi hot spot. One downside to VeriSign’s approach, however, is that it requires all the networks to use the same VPN client, which is unlikely for enterprises, says Tom Kershaw, the company’s vice president of next-generation markets.

That’s certainly the case at H&R Block, notes the tax preparer’s lead network engineer, Kevin Oellien. He says H&R Block investigated using Sprint Nextel’s VPN client for both 3G and internal use but found that other providers, such as credit card processors, did not support the Sprint VPN.

Future client software could invisibly log off one VPN and log onto the other, allowing the use of multiple VPNs. That approach will work for data transmissions, which tend to be sent in clusters, but it could be problematic for voice and other streaming media where the dataflow is constant, Kershaw says. In the meantime, IT will need to train mobile users to log off one network before accessing another.