Browser Security - Sony Ericsson P900 White Paper

Browser, M-Services and MeT

Browser Security

World Wide Web
The P900 supports the TLS/SSL to provide a secure encrypted link between the browser and the website.
This method is commonly used for secure transactions on the WWW. An icon in the display indicates when
a secure connection is in use.
WAP Security
When using certain WAP services the user may want a secure connection between the phone and the WAP
gateway, for example when using banking services. An icon in the display indicates when a secure
connection is used. The P900 is based on the WAP 2.0 specifications where security functionality is
specified with a technology called Wireless Transport Layer Security (WTLS) and WAP TLS Profile.
The WAP protocols that handle the connection, its transport and its security are structured in protocol layers.
The security is handled by the WTLS layer operating above the transport protocol layer. There are three
WTLS classes that define the levels of security for a WTLS connection:
•
WTLS class 1 involves encryption with no authentication.
•
WTLS class 2 involves encryption with server authentication.
•
WTLS class 3 involves encryption with both server and client authentication
Server authentication
Client authentication
A Wireless Identity Module (WIM) can contain both trusted and client certificates, private keys and
algorithms needed for WTLS handshaking, encryption/decryption and digital signature generation. The WIM
module can be placed on a SIM card and will then be referred to as a SWIM card.
Certificates
To use secure connections, the user needs to have certificates saved in the phone. User certificates can be
downloaded. There are two types of certificates:
Certificate authority
The user may organize bookmarks into user-defined folders, for example
creating a folder of sports bookmarks and a folder of transport bookmarks.
It is also possible to view a list of all signed documents (see MeT example
above) and access incoming WAP Push messages.
Requires a server certificate stored at the server side and a trusted
certificate stored at the client side.
Requires a client certificate stored at the client side and a trusted certificate
stored at the server side.
A certificate used to verify that a WAP site is genuine. If the phone has a
stored certificate of a certain type, it means the user can trust all WAP
gateways which present a certificate that can be verified by the trusted
certificate. Certificates can be preinstalled in the phone, pre-installed in the
68
P900/P908 White Paper, December 2003
LZT 108 6643 R1G