Identifying How WAP Can Be Used For Secure mBusiness

Identifying How WAP Can Be Used For Secure M-Business 3rd Wireless eBusiness Security Forum Barcelona. January 29-30, 2002

Contents ,[object Object],[object Object],[object Object],[object Object]

WAP - Wireless Application Protocol ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],‘ Internet world‘ Wireless network ‘ Telephony world’ PSTN WAP gateway HTTP TCP/IP Web services

(R)evolution with WAP-NG ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

WAP Generation 1 and 2 Stacks Bearer WDP WTLS WTP WSP Subnet IP TCP HTTP WSP WTP WTLS WDP Bearer Mobile device WAP gateway Web server TLS IP Subnet Mobile device WAP proxy Subnet TCP* TLS Subnet IP TCP* Subnet IP TCP Web server Generation 1: own protocol stack and presentation language Generation 2: alignment with Internet and WWW standards HTTP* IP TCP TLS HTTP Subnet IP TCP TLS HTTP HTTP* HTTP Remark: WAP 2.0 also supports transport proxies and IP routers as intermediate entities. WML over HTTP WBXML over WSP

Classification of the Considered IT-Security Technologies ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Public key infrastructure Entity identifier Public key Application technologies Infrastructure Application Entity Private key G o a l Security token

Timeline of WAP Security Specifications WAP 1.2 WAP 1.1 WAP 1.0 Dec. 99 Jun. 99 Apr. 98 WTLS (April, 98) WTLS (Feb., 99) Approved specification releases: WMLSCrypt (Nov., 99) WIM (Nov., 99) WTLS (Nov., 99) WAP 1.2.1 WTLS (Feb., 00) Jun. 00 Jul. 01 WMLSCrypt (Nov., 99) WIM (Feb., 00) WTLS (Apr., 01) WMLSCrypt (Jun., 01) WIM (Jul., 01) WAP 2.0 WPKI (Apr., 01) TLS (Apr., 01) E2ESec (Jun., 01) WAPCert (May, 01)

Since WAP 1.0 WTLS - Wireless TLS WAP generation 1 stack Session Layer (WSP) Transaction Layer (WTP) Application Layer (WAE) Bearer Transport Layer (WDP) Security Layer (WTLS) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

WTLS Limitations WTLS span 1 4 3 2 5 6 7 8 Mobile device Base station Web server ,[object Object],[object Object],[object Object],[object Object],[object Object],Dial-in server WAP gateway Dial-in server WAP gateway WAP gateway navigation:

WAP Gateway Out- vs. Insourcing Mobile device WAP gateway Web server ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Enterprises supporting Web-based accesses to Intranet resources via publically reachable https-servers in the DMZ have several options to accomodate WAP gateways in order to supply WAP-based resource accesses: Backend services

Since WAP 1.2 WMLScript Crypto (Aka: WMLSCrypt) ,[object Object],[object Object],[object Object],[object Object],[object Object],Sample WMLScript source: Sample GUI:

Since WAP 1.2 WIM - Wireless Identity Module ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],WIM service primitives PKCS#15 interpreter (AID: WAP-WIM) ISO 7816 MF AID: WAP-WIM ICC application Security objects DF(PKCS15) Reference system WIM application WIM EF(Certificate) EF(Private key) EF(Certificate ID)

ICC-Based WIM Implementation Options with Respect to SIM ,[object Object],[object Object],[object Object],SIM plus WIM via external reader SIM plus WIM via internal secondary reader (‘dual-slot’) ,[object Object],[object Object],Integrated SIM/WIM card ,[object Object],[object Object],SIM plus WIM via internal secondary reader (‘dual-chip’) ,[object Object],[object Object]

Since WAP 2.0 WPKI and WAPCert ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Since WAP 2.0 TLS - Transport Layer Security ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Bearer Security Layer (SSL/TLS) Application Layer (e.g. HTTP) Network Layer (IP) Internet stack Transport Layer (TCP)

Future WAP Security Features Under Construction ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

A Vision PTDs - Personal Trusted Devices ,[object Object],[object Object],[object Object],[object Object],[object Object]

IT-Strategy Challenges ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Application Technologies WAP Security Integration 1 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Infrastructure Technologies WAP Security Integration 2 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Conclusions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Abbreviations 3GPP Third-Generation Partner Project AID Application ID ASN Abstract Syntax Notation CDMA Code Division Multiple Access cHTML compact HTML CMS Cryptographic Message Syntax DF Dedicated File DMZ De-Militarized Zone E2E End-to-End EF Elementary File GPRS General Packet Radio Service GSM Global System for Mobile Communications HTML HyperText Markup Language HTTP HyperText Transfer Protocol HTTP* Wireless profiled HTTP(interoperable with HTTP) https HTTP over SSL/TLS ICC Integrated Circuits Card ID Identifier IETF Internet Engineering Task Force IP Internet Protocol ISO International Standards Organization IT Information Technology MeT Mobile electronic Transactions MF Master File NTT Nippon Telegraph and Telephone OCSP Online Certificate Status Protocol PDA Personal Digital Assistant PKCS Public Key Cryptography Standards PKI Public Key Infrastructure PKIX PKI-X.509 PSTN Public Switched Telephone Network PTD Personal Trusted Device RFC Request For Comment SCONT Signed Content SCP Smart Card Platform SIM Subscriber Identity Module SSL Secure Sockets Layer TCP Transmission Control Protocol TCP* Wireless profiled TCP(interoperable with TCP) TDMA Time Division Multiple Access TLS Transport Layer Security UMTS Universal Mobile Telecommunications System USIM Universal SIM W3C World Wide Web Consortium WAP Wireless Application Protocol WAP-NG WAP Next Generation WBXML Wireless Binary XML WDP Wireless Datagram Protocol WIM Wireless Identity Module WML Wireless Markup Language WMLScript WML Script WPKI Wireless PKI WSP Wireless Session Protocol WTLS Wireless TLS WTP Wireless Transaction Protocol WWW World Wide Web XHTML eXtensible HTML XKMS XML Key Management Specification XML eXtensible Markup Language XMLDSig XML Digital Signatures XMLEnc XML Encryption

References and Further Reading ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Author Information Dr. Oliver Pfaff Siemens AG Information and Communication Networks Charles-De-Gaulle-Str. 2 D-81730 Munich E-Mail: oliver.pfaff@icn.siemens.de Telephone: +49.89.722.53227 Mobile: +49.172.8250805

Identifying How WAP Can Be Used For Secure mBusiness

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (18)

Similaire à Identifying How WAP Can Be Used For Secure mBusiness

Similaire à Identifying How WAP Can Be Used For Secure mBusiness (20)

Plus de Oliver Pfaff

Plus de Oliver Pfaff (17)

Dernier

Dernier (20)

Identifying How WAP Can Be Used For Secure mBusiness