Enterprise J2ME Developing Mobile Java Applications [Electronic resources] نسخه متنی

6.6 Secure HTTP

Both basic and digest HTTP authentication schemes discussed above are weak security measures. They only authenticate users but do not protect the communication content. They do not prevent crackers from intercepting or even tampering with the communication data. For complete point-to-point HTTP security, we need the HTTPS protocol that is based on secure underlying transport protocols such as the Secure Socket Layer (SSL) and the Transport Layer Security (TLS). Compared with thin client solutions where security is provided by the fixed infrastructure, direct HTTPS connections allow more flexible security schemes. For example, the communication parties can decide what to encrypt, the level of encryption and how often the session key should be changed based on their business needs. In addition, by eliminating the middleman, HTTPS smart clients avoid the single point of failure and hence they are not affected by infrastructure level security holes. The discovery of security weaknesses in WAP gateways and WiFi access points has made this an important concern. Figure 6.1 illustrates the difference between HTTPS end-to-end solutions and WAP thin client solutions.

6.6.1 HTTPS Support in the MIDP

Support for HTTPS is mandatory in the MIDP v2.0 but optional in the MIDP v1.0. To establish an HTTPS connection, all you need to do is pass an https://-style URL string to the Connector.open() factory method.

On an HTTPS-enabled MIDP v1.0 device, a normal HttpConnection object will be returned. You can open input and output streams as usual. But the underlying data are properly encrypted. The entire process is transparent to developers.

On a MIDP v2.0 device, an HttpsConnection object will be returned. Interface HttpsConnection extends HttpConnection with two more methods: getPort() and getSecurityInfo(). The getSecurityInfo() method returns a SecurityInfo object, which can be used to obtain further information on cipher and server certificate.

For mobile security schemes beyond the point-to-point connections, please refer to Part VI of this book.