I am working on a product that requires devices to exists anywhere in the world hooked up to the internet though cell modems or on WLAN lines which communicates to a server(s) that exists elsewhere in the world.
When deigning the networking portion of the program i cant figure what the best option is for securing the communication between the server and end device.
From my searches iv'e come up with two options.
Option 1: Using a host to host vpn connection between the two devices.
Pros: VPN software seems to be well tested and does not require extra programming for the network protocol. The IT department is more comfortable with it because of using software that is already tested and they comfortable with vpn.
Cons: Since my end devices are linux on OMAP platforms cross compiling the vpn software if not already done could be tricky. Dealing with firewalls and routers behind the end devices network. Setup of the connection can be tricky.
Option 2: Implementing the TLSv1 protocol in my program to deal with the encryption.
Pros: Does not require extra software to be running on the device. Only relies on the encryption libraries as a dependency. Don't have to worry about dealing with nats and firewalls because the protocol will only require one tcp port to be open.
Cons: Extra coding to the network software. IT is skeptical because our program is responsible for securing the protocol.
FYI: For implementing the TLSv1 i would use http://www.gnu.org/software/gnutls/