There are two common approaches for user applications in wireless devices: WAP (Wireless Application Protocol), and applications based on the two standard component approaches, J2ME and .NET.

The latter include standard object-oriented applications or applications using Web services. Middleware software supports wireless applications at both the client and server sides. Devices using Bluetooth can use Java or .NET.

WAP

WAP is a thin-client (micro browser) development protocol specifically designed for development of user applications. WAP uses WML (Wireless Markup Language) and WMLScript to develop applications that can be interpreted at the browser and accessed at the server using HTTP (HyperText Transfer Protocol).

WAP requires a gateway to the wired Internet, and cannot store and process data locally. WAP uses WTLS (Wireless Transport Layer Security) [Ash01]. This protocol provides confidentiality, integrity, and authentication and uses RSA cryptography, but can also use Elliptic Curve Cryptography.

It is based on the IETF SSL/TLS (Internet Engineering Task Force Secure Socket Layer and Transport Layer Security) protocols. WTLS provides security for communications between the WAP wireless device and the WAP gateway (discussed later).

Current WAP devices use Class 2 WTLS, which enforces server-side authentication using public key certificates similar to the SSL/TLS protocols. Future Class 3 devices will also allow client-side authentication using certificates. This level will use a WAP Identity Module (WIM), with mandatory support for RSA public keys and optional support for ECC.

Web Services

A Web service is a component or set of functions accessible through the Web that can be incorporated into an application. Web services expose an XML (eXtensive Markup Language) interface, can be registered and located through a registry, communicate using XML messages using standard Web protocols, and support loosely coupled connections between systems.

Web services represent the latest approach to distribution and are considered an important technology for business integration and collaboration. Wireless devices can access Web services using SOAP (Simple Object Access Protocol). Web services are still not widely used in portable devices.

The limited processing power of portable devices and the lack of network reliability are serious obstacles for a full implementation. Using appropriate gateway middleware, it is however possible for portable devices to access Web services. There are several toolkits that simplify the process of building applications using Web services.

For example, Java-based client systems can use Sun ONE and kSOAP, while server-side systems can be built with Sun or IBM toolkits. There are similar tools for .NET-based systems. In addition to the specific designs used, security also depends on the security of these component platforms.

The richness of Web services brings along a new set of security problems. All the attacks that are possible in wired systems are also possible in wireless systems using Web services, e.g., viruses, buffer overflow attacks, message interception, denial of service, etc.

Web services introduce several extra layers in the system architecture and we have to consider the unique security problems of these layers. Since these are layers that run on top of the platform layers, the security of the platforms is still fundamental for the security of the complete system.

Wireless systems using Web services have to face, in addition, the general vulnerabilities of wireless networks and may also add new security problems to these networks although this aspect has not been explored in detail.

There is also a variety of standards for Web services security and a designer of wireless devices should follow at least the most important ones to be able to have a credibly secure system.

On the other hand, the extra layers bring more flexibility and fineness for security; for example, encryption can be applied at the XML element level and authorization can be applied to specific operations in a Web service interface.

This greater security precision allows applying policies in a finer and more flexible way. WAP applications have fewer security risks compared to Web services. On the other hand, their functionality is considerably lower.

Personalized Information

An important mobile application aspect is the delivery of personalized information to subscribers. Using specialized interfaces, users are able to select services offered by some companies; for example, lists of stores who have sales, stock market alerts, etc. Some of these services may be location-dependent, e.g., lists of nearby restaurants.

Clearly, the companies that provide these services need to control access to their customer information, which in addition to the usual information about credit and Social Security Numbers now includes a privacy aspect (the company is able to track the client movements).

Access Control to Sensitive Information in or through the Device

The portable device may contain files that need to be restricted in access and it is the function of its operating system to perform this control. Control of types of access is important; for example, a user may play a song, but she may not copy it. This type of control can complement other types of digital rights management.

When portable devices need to access corporate databases, some type of Role-Based Access Control (RBAC) is necessary where users can access specific data related to applications such as banking, shopping, health, navigation, and surveillance.

Management and enforcement of application and institution constraints can be performed following PMI (Privilege Management Infrastructure). PMI is a standard of International Telecommunication Union ITU X.509.

Viruses and Other Malware

With increase in functions, the typical problems of larger systems are also appearing in portable devices. One of these problems is attacks by viruses. The first portable virus to appear was Liberty, followed shortly by Phage.

The WML script language used by WAP can also be a source of possible attacks. The devices do not distinguish between script code from the phone or downloaded from potentially insecure sites, all of it executes with the same rights.

An infected device can be used to launch denial of service attacks on other devices or the network. Similarly to wired systems, up-to-date antivirus programs are needed. Companies such as Symantec, McAfee, and Trend Micro have specialized products for handheld devices.

Downloaded Contents

Downloaded contents may include malicious software Another issue is the control of unauthorized copying of downloaded contents, such as music, wallpaper, and games. This is a problem of digital rights management.

Location Detection

Location detection is a problem unique to mobile devices. The actual location of the device should be kept hidden in some cases for privacy or for strategic reasons. It is possible to control access to VLANs (Virtual Local Area Networks) by associating users with access points. There are products that can keep track of users and access points and use this information for network administration.

Operating System Security

Portable devices have evolved from having ad hoc supervisors to standard operating systems. Some systems use the Java run-time system as supervisor. High-end cell phones run complete operating systems such as Palm OS or Microsoft Windows CE, and provide IP networking capabilities for Web browsing, e-mail, and instant messaging.

Some typical security features include:

• unique device identifier — this can be provided and can be accessed by an application.
• A kernel configuration with enhanced protection — this allows using the protected kernel mode, instead of the full-kernel mode, while running threads to prevent accessing certain physical memory.
• Digital authentication in the dial-up boot loader — the dial-up boot loader is a program in ROM used to upgrade the OS image file (NK.bin) using flash memory or a remote server. The OS image file should be signed using digital encryption to verify its integrity before it is downloaded.

Smartphone is a Windows CE-based cellular phone that comes bundled with a set of applications, such as address book, e-mail, and calendar. The provider that sells the Smartphone can limit the devices’ ability to load and run programs. A locked cell phone either restricts unsigned applications or does not run them at all.

Depending on the provider, an encryption key may be needed to run the application, but cell phone codes have been successfully cracked. It is clear that, similar to larger systems, the operating system is fundamental for security.

Because many of the security flaws of Microsoft’s operating systems come from their general approach to systems design, one should watch out for similar problems in their small OSs.

The utilities of the OS are the main culprit in the attacks that have happened in wired systems and it is important to have utilities with strong security. For example, some products attempt to improve the security of e-mail systems.