Post by darioJames, thanks for your responses.
I will try to explain better the problem. I have limited knowledge on
this protocol.
OK, then, some fundamentals are in order.
PPP is a means to convert a bidirectional serial connection between
two machines into a point-to-point network interface. That's
essentially all that it does. Anything else that you need is up to
you and the systems that you choose. And if you don't actually need a
network interface, then you probably don't want PPP.
Post by darioUntil now authentication between the two peer was ensured by enabled
CHAP username and password.
Confidentiality was ensured by physical access mode (GSM
point-to-point) and by calling line identification (CLI).
PPP neither knows nor cares about GSM. This is your issue to work
out, not something that PPP can dictate. If your evaluation of the
security of GPRS is such that you consider it to be inferior to GSM (I
frankly don't know, and such a topic would be wildly off-topic for
this newsgroup), then you have two choices:
- don't use GPRS because it doesn't supply the features you need.
- evaluate mechanisms you can add that give you the additional
security you need (possibly some combination of PPP authentication
and/or encryption, and/or network layer mechanisms).
You must decide on your own whether GPRS solves the problems you have,
and then make appropriate choices. This isn't something PPP can
resolve for you.
Post by darioSorry for the question but, if we had not needed of authentication,
does the PPP would have been really necessary? I ask this because
Sure. PPP provides you with a network interface. I'm assuming you're
using PPP because you want to have a network interface.
If you're not using it for that reason, then I don't follow.
Post by darioactually on another serial application I send a "custom" protocol
on the GSM channel without need of PPP. After the 'CONNECT 9600' I
send and receive the packet normally...no PPP is used (in this case I
"Packet?" If you don't have PPP, then all you have is a raw,
byte-oriented interface. There are no "packets."
An alternative (older, less capable) technology that provides packet
framing on serial lines is called "SLIP." It might or might not do
what you're asking.
There are also non-networking technologies possible here, including
the sorts of ASCII-based framing often used with credit card
processing protocols, and some ISO and ITU-T protocols.
Post by dariothink I do not entirely understood as stated by the RFC "PPP provides
a method for transmitting datagrams over serial point-to-point
links").
It transforms a link that's fundamentally bit (or byte) oriented into
one that frames packets.
Equivalently: it turns a serial interface into a network interface.
Post by darioNow we would want to change technology: GPRS.
Fine. It's just a serial port as far as PPP is concerned. It's not a
change.
Post by darioPost by James CarlsonI'm not sure why you're asking this. Why wouldn't you just negotiate
PPP as you've always done, and just change the dialing sequence for
the new phone? Why would it require some sort of complex PPP-restart
and "compatibility" mechanism?
The dial-up ATD*99# is done with the GPRS operator, not with my
company.
So, by ATD*99# I do not authenticate A at my RAS company, but only,
connect A at the APN.
"APN?"
Post by darioI still need to authenticate A in my company in
the old mode, with the USER and PASSWORD embedded in A. I hope it is
explained why I ask to re-start the PPP/CHAP...after the 'CONNECT' on
the GPRS net. Obviously I know that by GPRS we will lost
confidentiality on the "public internet", but this is a problem we
solve on the next step (I think to use compulsory VPN, but if you could
give me a suggestion..), now we are in test phase.
I am having a hard time deciphering that, but let me make a guess.
With GSM, you were dialing into a point that you considered "secure"
(some gateway you controlled) but with GPRS you're dialing into a
public Internet access site.
Is that correct? In this case, you're not talking about anything that
really has much to do with PPP or even GSM or GPRS. It's all about
the number you're dialing.
If you need to go over the public Internet, then you need to take that
into consideration in your security evaluation. Personally, I'd
*NEVER* have trusted a GSM connection into a gateway that I
controlled -- it's still possible for the telephone company itself to
be compromised, and there's no reason to take that risk. But it's
your system, so you do as you want.
If going unencrypted over the Internet isn't something you can live
with, then you'll need to pick a suitable security mechanism. This is
*FAR* outside the bounds of what PPP does. PPP just gives you a
network link.
I'd suggest investigating IPsec, Kerberos, SSH, and SSL/TLS. These
are basic security mechanisms that work in slightly different ways,
and that can be used on the Internet.
Good luck. I don't think there are any PPP questions remaining here.
If you need to know about security on the Internet, you need another
newsgroup.
Post by darioAs above, an ancestral doubt.. if we had not needed of authentication,
why the PPP would have been need if GPRS is not a point-to-point
connection?
PPP works only on point-to-point connections. It's right there in the
name.
I'm not sure what you're asking about here.
--
James Carlson, KISS Network <***@sun.com>
Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677