Skip Headers

Oracle9iAS Wireless Developer's Guide
Release 2 (9.0.2)

Part Number A90485-02
Go To Documentation Library
Home
Go To Product List
Solution Area
Go To Table Of Contents
Contents
Go To Index
Index

Go to previous page Go to next page

1
Introduction

This document provides an overview of Oracle9iAS Wireless. Each section of this document presents a different topic. These sections include:

1.1 Overview

Oracle9iAS Wirelessenables enterprises to deliver any content or application to any device with any protocol across any wireless network.

Using Wireless, you need only write an application once to have it run on any type of device. Wireless adapts information from any content source into an open XML format and then transforms the content into any markup language supported by any wireless device. Additionally, Wireless includes many advanced services such as location-based services, secure mobile commerce, and push services via SMS, WAP-Push and e-mail.

1.2 Wireless Internet Components

There are many infrastructure components that work together to make the wireless Internet function. The components include:

Wireless Devices and Microbrowsers

The user accesses the Internet using a Wireless Internet device - this device typically runs a microbrowser. (This is analogous in the fixed Internet world to a personal computer running a standard Internet browser). Wireless devices also include in-car systems and voice technology to access information from a traditional phone.

Wireless Markup Language

Each Wireless Device also speaks a language called a markup language - the markup language specifies how information should be presented on the device. Common Markup Languages include VoiceXML, WML, and HDML.

Protocols

Protocol is the method that is used to deliver the content data to the devices.

1.2.1 The Wireless Network

Wireless separates the concerns of the wireless network from developers, greatly simplifying the development and management of wireless applications.

1.2.1.1 Networks

Networks are the underlying infrastructure that is used by the wireless carriers. A large factor of networks is the bandwidth and the connection type. For example, 2.5G and third generation networks will provide high-speed access and always-on capabilities.

1.2.1.2 Wireless Gateways

Wireless Devices speak a variety of protocols such as WAP (Wireless Access Protocol), SMS (Short Messaging Service), Voice and others. The Wireless Gateway translates the wireless protocol request to the standard HTTP protocol. Note that Wireless Protocols are more efficient over the Wireless Networks than the standard HTTP protocol - this is one of the primary reasons that Wireless Internet clients do not speak HTTP directly.

1.2.1.3 Wireless Services

Wireless Services have a wide variety of forms including database information, personalization, alerts, and location services. The large number of content sources adds to the complexity of having a manageable way to deliver each application to every type of device in the most optimized fashion.

1.2.1.4 Application Servers

Application servers have come into play to increase the efficiency of application development, deployment, and management. The Wireless Application Server connects the wireless content source over the wireless network to the wireless Gateway or Device. To do so, it adapts the content from the content source, personalizes it for individual users, and converts (or transforms) it to the specific markup language spoken by the wireless device being used.

1.3 Developing Mobile Internet Applications

Wireless application development is typically constrained by limitations in user input, device display form factor, and the several different wireless device standards currently in use.

1.3.1 User Input Limitations

The keypads of cellular phones limit the user's ability to enter lengthy alphanumeric strings. The limited data entry capability makes cellular phones and other hand-held devices better suited to carry out specific inquiries and transactions rather than for Internet surfing.

1.3.1.1 Device Display Form Factor

The screen size and display capability of devices vary tremendously - since the Internet is likely to be accessed from a variety of different devices, it is not practical to optimize every application for every single device available. The requirements that these two limitations place on a Wireless Platform are twofold: first, the platform must be able to exploit device-specific functionality such as voice browsing which make it easier to navigate through Internet services from a wireless device; and second, the platform must provide ways to find and execute Internet services quickly and effectively by personalizing services and content to make them relevant to individual users. The user experience is far richer and more effective when the Wireless Platform supports a variety of personalization facilities such as allowing users to personalize which services they see, to see different information based on the device they are using, and to see different information based on the geographic location they are accessing the Internet from.

1.3.2 Myriad Wireless Device Standards

Even though wireless Internet standards are emerging, there are still diverse standards supported by wireless devices. Each device speaks a different wireless protocol and supports a variety of different Wireless Markup Languages - these different standards preclude a developer from writing every application to individually support every single device available. As a result, as companies must choose a software platform that will radically simplify how they develop and deploy mobile portals and Internet applications.

To enable cross-platform support, a wireless Internet software platform must meet two requirements:

1.3.2.1 Support a Broad Variety of Devices and Protocols

First, the wireless software platform should be able to support a broad variety of wireless devices, each of which supports a different markup language, a different microbrowser, and a different communication protocol. Most Wireless Platforms support only the WAP Protocol and as a result, applications built to such a platform cannot be accessed from an i-Mode, Voice, SMS or a Blackberry device.

1.3.2.2 Write Applications Once and Deliver Them Anywhere

Web site developers must develop a Web site for each wireless type of device. Because of the increasing variety of wireless devices, such an application development paradigm does not scale; a developer must be able to develop a Web site once and have the software platform deliver it to any wireless device.

1.3.3 Heterogeneous Sources of Content

In addition to wireless devices, application development and deployment can also be complicated by the fact that the wireless Internet does not require that content or applications be specific to it.

1.3.3.1 Leveraging Existing Content

To leverage existing Internet content and e-Business applications for the wireless environment, the software platform must be able to easily re-use any Internet content or application, no matter how it was originally built to a wireless device. This requires the platform to be able to "adapt" content from a variety of repositories whether it comes from an Internet web site, from an e-Mail server, or from a database. Additionally, the wireless platform must also be able to adapt any Internet content whether the application has been built using Java, Visual Basic, PERL, PL/SQL, PHP, server-side scripting, or any other web site development language.

The wireless software platform must be able to support web sites or Internet applications that are developed specifically for the wireless Internet. It must provide a seamless set of facilities to develop such web sites using open standards such as Java and XML.

1.3.3.2 Application Performance and Scalability Requirements

A Wireless Internet Platform must also be able to meet scalability requirements in three ways:

1.3.3.2.1 Support a Large Numbers of Users

Since Wireless Carriers and Portals support Millions of subscribers, the Wireless Internet Platform must provide facilities to centrally manage these users, their security and access control privileges, and their ability to personalize services.

1.3.3.2.2 Support a Large Number of Concurrent Sessions

Additionally, users who access the Internet from wireless devices typically have relatively long- lived conversational interactions with a number of different web services, in addition users desire always-on capabilities for fast notification of messages. Due to the limited bandwidth on the wireless network and the lack of support for "cookies" in most wireless gateways, it is not possible to push the user's session state from the server to the client. As a result, a wireless Internet platform must be able to manage user sessions and maintain session state in a highly scalable fashion.

1.3.3.2.3 Support a Large Volumes of Content

Finally, since wireless users access large volumes of content which needs to be delivered very efficiently to their client, the Wireless platform must be able to use caching and share data facilities to serve large volumes of content efficiently.

1.3.3.3 Evolving Wireless Internet Market Requirements

Wireless Internet users want to send messages, browse information and services, carry out wireless commerce transactions and run complicated business applications. Most wireless software platforms only address a small set of requirements requiring users to choose one wireless software infrastructure for messaging, another to browse content, and yet another for mobile commerce. It is critical that a wireless platform must seamlessly integrate facilities for wireless messaging, content browsing, voice access, mobile commerce and business applications to allow developers to combine these facilities in building state-of-the-art applications and portals.

1.3.3.4 Evolving Wireless Standards

Wireless standards are evolving rapidly. At the network level standards such as CDMA, GSM, TDMA, iDEN, SMS, i-Mode, GPRS, and UMTS are all evolving; at the device level, standards such as VoxML and VoiceXML promise to change how the wireless Internet is used. As a result of these differences, a wireless Internet Platform must meet two requirements: first, it must be current with wireless standards such as i- Mode, WAP, SMS, GPRS, 3G and others; and second, it must support open industry standards such as XML, XHTML, Java Servlets, Java Server Pages for application development. Wireless address these issues making a complete wireless solution for businesses.

1.4 Oracle9iAS WirelessArchitecture

Wireless is the mobile component of the Oracle9iApplication Server, an integrated suite for internet-enabling your applications and portals. Oracle9iAS sits on the Oracle9i Database, which is used as the secure repository for all the components. Oracle9iAS runs the Oracle e-Business suite as well as partner applications.

The Oracle9iAS is Oracle's comprehensive and integrated application server. It runs any Web site, portal, or Internet application and makes your Web site and all your applications accessible from any browser or mobile device. You can deliver tailored 1:1 customer experiences through real-time personalization and satisfy demands for current business information using Oracle9iAS integrated business intelligence services. You can simplify your management tasks by using the single management console provided with Oracle9iAS.

Wireless simplifies wireless development and deployment by providing the ability to deliver any content with any device, any protocol and across any Wireless Network with the core. Wireless leverages open standards such as XML, Apache and J2EE, to deliver a high performance, scalable wireless infrastructure.

1.4.1 Mobile Services

Built on Wireless are Mobile Services such as PIM (Personal Information Management), Email, and Location Based Services that simplify wireless enabling applications and portals. These are reusable application components that increase the time to market of mobile applications. The services can be configured out of the box or extended for custom abilities.

1.4.2 Processing a Request for a Wireless Service

Wireless processes a request for a wireless service as follows:

  1. Sending a Wireless Request

  2. Recognizing and Authenticating the Wireless Device

  3. Establishing the Wireless Session

  4. Translating the request over the Internet

  5. Connecting to the Application Server

  6. Recognizing the User's Information

  7. Processing the Wireless Request

1.4.2.1 Sending a Wireless Request

A user invokes a Wireless service from a wireless Internet device by dialing the telephone number for the appropriate service provider. The microbrowser on the wireless device sends a request to the wireless network base station. The request can be sent over a variety of different protocols, such as SMS or WAP, depending on the kind of device being used. These protocols are packet-based protocols that have been optimized to function over a wireless network with limited bandwidth and intermittent connectivity. These make these protocols more efficient over the existing wireless network than the standard Internet HTTP protocol.

1.4.2.2 Recognizing and Authenticating the Wireless Device

When the wireless network's base station receives the request, it requests the mobile device to identify itself in order to proceed with authentication. Once the WAP Gateway and Wireless Application Server have established a session, the WAP Gateway passes information about the specific web request to the Wireless Application Server. The message header encodes information such as the user's identity, the device the user is accessing the Internet with, the geographical location of the user, and the specific web address or service that the user is accessing. This information is used by the Wireless Application Server to personalize the interaction with the customer.

1.4.2.3 Establishing the Wireless Session

Once authentication is successful, the service provider accepts the call and establishes a connection with the mobile device. The request is sent from the base station over the wireless network using the Wireless Transport Protocol (WTP). The wireless operator's Gateway receives the request.

1.4.2.4 Translating the request over the Internet

A gateway converts the request from the cellular network protocol into the standard Internet HTTP protocol before the request is passed from the Wireless network to the traditional Internet. (The cellular network protocol is not the standard Internet protocol). For WAP- enabled devices, a WAP gateway converts WTP to HTTP. The gateway not only maps the message from one protocol to another, but also knows how to pass the message from the Wireless network to the traditional Internet infrastructure. Other gateways include Voice gateways and SMS gateways.

1.4.2.5 Connecting to the Application Server

After the Gateway converts the wireless request (which is defined by a specific phone number) to a URL for a specific web site, the message is sent as a standard Internet request to the Wireless Application Server that sits at the specific URL or web address being accessed. The Application Server and Gateway then authenticate to each other and establish a session.

1.4.2.6 Recognizing the User's Information

Once the Gateway and Wireless Application Server have established a session, the Gateway passes information about the specific Web request to the Wireless Application Server. The message header encodes such information as the user's identity, the device with which the user is accesses the Internet, the geographical location of the user, and the specific Web address or service that the user accesses. This information is used by the Wireless Application Server to personalize the interaction with the user.

1.4.2.7 Processing the Wireless Request

When the Wireless Application Server receives the content request it processes it in three steps in which the content request is adapted to the content from the wireless application being accessed, customized for the user, and transformed to the specific device being used

Many wireless application servers are limited both in the range of content they can adapt and in the variety of devices to which they can render content. Typically, wireless application servers render content only to devices that speak WAP, WML and HDML. Not only can Wireless be a WAP server, but, through its usage of XML, it can translate any source content to any format for any device.

1.5 Oracle9iAS WirelessCore and Services

Wireless simplifies wireless development and deployment by providing the ability to deliver any content to any device, with any protocol and across any wireless network with the Oracle9iAS Wireless core. Oracle9iAS Wireless includes a set of wireless services such as PIM (and Email), Push, and Location Based Services that enhance application abilities and leverage traits. Wireless leverages open standards such as XML, Apache and J2EE, to deliver a high performance and scalable wireless infrastructure.

1.5.1 The Core

The Wireless core is the framework that gives application developers independence from the underlying networks, protocols, devices, gateways and other wireless complexities. The core normalizes the wireless complexities to one protocol and one language, HTTP and XML. Wireless is based on open J2EE, Apache, and XML standards for easy integration with existing and future technologies.

To render an application to any device, a developer needs to create any application, which outputs XML, and then point the Wireless core to the application with a URL. The core automatically eliminates the complexities associated wireless technologies. The application can then be accessed by any device or voice, at the same time taking advantage of individual device's features.

1.5.1.1 Adapters

Wireless uses only one main protocol adapter, the HTTP Adapter, to create a mobile application from any HTTP and XML server. Wireless ships with HTTP and OC4J (J2EE) Protocol Adapters. The core, using the protocol adapters, fetches the application XML content and prepares it for device adaptation. The HTTP adapter supports the HTTP protocol and retrieves content from applications over HTTP. The OC4J (J2EE) adapter fetches content from Java Servlet and JSP based applications running within the same J2EE container (OC4J) as Wireless.

1.5.1.2 XML Application Framework

The XML application framework is based on XML and HTTP. This provides simplicity and power to application developers. Advanced HTTP/XML APIs, service linking, location awareness, and context information give developers the ability to quickly develop applications with maximum efficiency. Each application created in the XML application framework is be multi-channel to be accessed wirelessly through push, offline, and voice.

1.5.1.3 Device and Network Adaptation

Device and network adaptation automatically transform and optimize the application content to any device and network. As a result, devices that access the content retrieve optimized data. Supported devices include two-way pagers for asynchronous services (SMTP/SMS), all WAP devices, Voice access through regular phone lines, PDA devices.

1.5.1.4 Runtime APIs

The Wireless runtime uses the Oracle9i database as the repository for storing persistent application objects. Runtime APIs provide the functionality to manipulate the platform's persistent data objects stored in the Oracle9i Database repository. The Wireless APIs can customize the runtime behavior of the server. For example, the APIs can provide a different authentication scheme or a customized device identification mechanism. Wireless also provides an extension framework, which allows for plug-in of additional logic, such as logging or system monitoring that does not change the runtime behavior.

1.5.1.5 Wireless Webtools

Wireless provides a complete web-based tool to manage your wireless business. The Service Designer is used by developers to manage the applications, the Content Manager is used to manage the end user's view, the User Manager controls the users, groups and access control and the System Manager monitors the servers and performance.

1.5.1.6 Customization

Customization and personalization make applications manageable by understanding visitors' needs based on their roles and preferences. For example, customization enables information to be presented specifically to the needs of a user, whether the user is a customer, supplier, or an employee.

The advanced customization service includes alerts and data feeds. Alerts are in a publish-subscribe model and can be event-based or time-based. Event-based alerts can be based on changing events: a change in a stock price, a change in a time of a meeting, or a decrease in inventory. Time-based alerts can be based on a timed event. For example, reoccurring meetings, and appointments.

The alerts monitor and retrieve content through data feeds. Data feed content can be in multiple formats, including delimited files (CSV), HTML, or XML. The data feed can be transferred through HTTP, Local File, FTP, SQL and other applications

1.5.1.7 Push/SMS Service

Push/SMS Service provides comprehensive support for messaging. The push/SMS Service is built on a scalable message delivery architecture that can handle large volumes of messages to many different types of devices. It also provides several ways to manage and track your messages, including status of message delivered. The Push/SMS Service allows you to add your own business logic to it, to allow generating billing and routing of messages. The open architecture allows integrating into the user and device preferences of the Wireless platform. You can create distribution lists of recipients of push messages. Recipients receive messages on the device of their choice, without having to write device-specific applications.

Transport

The transport system offers a unified messaging interface to send and receive messages using any communication protocol, such as SMTP and SMS. It also features an open protocol architecture so that the system can be easily extended to support any other existing or new protocols in the future. The APIs to access the transport system are in the Java programming language.

The Push Web Service offers similar functionality to the messaging capability of the transport system. However it is set up as a SOAP-based Web Service, hence it is accessible over the network instead of requiring coding against the Java APIs that come with Wireless. By using Wireless, messaging applications can be built independently of locale relative to the Wireless installation itself. The transport system is available to anyone with an Wireless instance that the Push Web Service can access remotely. The Push/SMS Service offers a comprehensive, powerful and flexible mechanism for building messaging applications.

1.5.1.8 Transcoding

The Wireless transcoding service allows applications developed for a particular device or markup to be reformatted for other devices, including voice. Wireless supports a content adaptation service and a translator service. These services increase time to market and decrease development efforts with code reuse.

The Web Content adaptation service allows to you to quickly extend your existing legacy Web application to any wireless device. Wireless can connect any Web resource, like an HTML page, and acquire content for reformatting. The content is transformed to the Wireless XML format and then rendered to the requesting device' markup language. Web integration beans provides an abstraction and masks the complex nature of input and output elements involved in Web service transactions.

The WML translator delivers existing WML (WAP) applications to non-WML devices. The goal of the WML transcoding service is to provide a simple way for companies with existing WAP services to break the barrier of device-specific applications. The most commonly used wireless language is WML. It follows XML standards, having a Document Type Definition (DTD) that all WML documents follow. WML has different syntax and behavior from other device specific languages such as HDML. Wireless translates the WML into XML as a common language for wireless devices that hide the device-dependent complexity. The Wireless XML schema defines the basic structures that exist in WML. The structures are then rendered into any mobile device and even in voice. The translation process retains all formatting from original application.

1.5.1.9 Offline Management

Offline Management is used in cases where mobile connectivity is nonexistent or low. This gives your users the ability to use applications without any network access. When Internet connection is available again, the device user can synchronize to update the server with the new information. Oracle9iLite provides this ability.

Oracle9iLite is an integrated set of technologies that provide critical infrastructure for developing, deploying, and managing offline mobile applications. Oracle9iLite provides necessary framework businesses need to extend the enterprise applications to all of today's popular mobile platforms: Palm OS, Symbian EPOC, Microsoft Windows CE, and Microsoft Windows 95/98/NT/2000.

1.5.1.10 Location Based Services

Location-based services greatly improve mobile applications by making them easier to use and providing quick access to timely and critical information. Companies that take advantage of location-based technologies can greatly enhance the value of their applications. Wireless location-based Service not only reduces the number of inputs and lowers the time required to obtain information, but also derives improved efficiencies, enabling access to information that is immediately relevant to users, such as maps, driving directions, traffic reports, or nearby businesses and services.

The performance and capability requirements expected for wireless location-based service can easily approach that of a top internet portal--that is, millions of queries on a daily basis, hundreds of concurrent transactions, and millisecond query-response times. When you build on Oracle9i, Oracle Spatial, and Wireless, you have the assurance that your location-based services solution will be scalable, reliable, and secure. In particular, it will be able to handle the unique storage and CPU-intensive processing inherent in location queries (street routing, proximity searches, and map rendering).

Wireless location services include:

Geo-coding

Automatic and Manual Mobile Positioning, Routing and Navigation

Mapping

Users can input their location or have their location automatically detected. In order to be automatically detected, Oracle9iAS Wireless easily integrates with vendors.

Privacy and the security of privacy-related information are important concerns in a location acquisition system. The location services provide a privacy management component that allows users to view and edit their privacy settings, to enable and disable the positioning operation on themselves, and to authorize one or more people (a mobile community) to obtain positioning information on them within certain time frames. All capabilities are accessible through public APIs.

1.5.2 Mobile PIM and Email

The Personal Information Management (PIM) Service modules are based on standard protocols, allowing a simple integration into existing environments. The Mobile Email client gives access, from any mobile devices, to any IMAP or POP3 server. This includes such servers as Microsoft Exchange and Lotus Domino. The Mobile Directory client connects to any LDAP directory server. The Mobile Calendar client integrates natively with Exchange and Lotus Servers, and through published interfaces, they enable customization to support any calendar server.

The PIM solution has a single "Universal UI", used across all back-ends. The idea is to have PIM business objects between the UI and the backend implementation, so that the same UI can be used for different backends. The same "Universal UI" can be reused or any new backends that may hit the market.

1.5.3 m-Commerce and Billing

The Wireless m-Commerce Service is a set of modules that securely stores user profiles, supplies information authorized by users for third party applications, and interfaces with on-line payment mechanisms to complete transactions. It also translates existing WML applications into Mobile-XML, and uses Formfiller to map forms and spare your customers from the frustration of typing in mobile devices.

The m-Commerce Service is automatically installed along with Oracle9iAS Wireless. No extra installation is necessary.

1.5.4 Mobile Studio

The Mobile Studio is an online environment for quickly building, testing and deploying wireless applications. It lets any developer, systems integrator or independent software vendor quickly develop mobile applications that are immediately accessible from all devices. This unique, next generation development environment allows companies to benefit from faster time to market, increased productivity, and a dramatically simplified testing cycle, while providing access to the latest mobile applications and tools. The Studio enables you to focus on your business logic, which is your core competency, rather than on device complexity.

The Studio's build-test-deploy model presents a hosted approach to developing dynamic content. You do not download any software or tools to start using the Studio; instead you access the Studio Web site, register, and log in. Once authenticated, you can access the reusable modules, examples, documentation, runtime information, and other resources.

You can customize the Studio by rebranding and by moving functions around to the desired positions.

1.5.5 Security

Secure wireless access to banks, enterprises, m-Commerce applications, or any other source of sensitive data is a primary concern for enterprises, carriers and application developers. However, with an ever-expanding and evolving labyrinth of wireless infrastructure (mobile devices, protocols, carriers, providers, and accompanying hardware) the problem of security simply cannot be solved in one homogeneous way. Depending on your applications, Wireless supports many techniques to satisfy your end-to-end security requirements. Wireless is built on open standards that support integration with standard security technology and third-party systems.

Oracle builds security models designed to meet the sophisticated security needs for applications such as banking, e-commerce, self-service, and CRM as well as those extending enterprise office applications to a mobile work force. Wireless utilizes such encryption technology as Wireless Transport Layer Security (WTLS), Secure Sockets Layer (SSL), Virtual Private Networks (VPN), and Public Key Infrastructure (PKI) to deliver solid end-to-end security across the Internet and the wireless network. All information, such as mWallet data and user profile data, is encrypted and stored in the secure Oracle9i Database.

Security-related issues may be generally classified into the following categories:

Table 1-1 Security-related Issues
Issue Description

Privacy

Ensures that only the sender and the intended recipient can read the contents of a message (such as credit card numbers, account numbers).

Encryption and decryption

Allows two communicating parties to scramble and unscramble information they send to each other via special keys only they possess. In transit, this information is scrambled and unintelligible to any eavesdropper.

Integrity

Ensures that information is not tampered with in transit to the recipient.

Digital Signatures

Using an encrypted one-way hash algorithm, it is possible to detect at the receiving end, even if a single character has been changed. The values of the hash are unique for the hashed message, and the hash values will not expose the message since the hash is one way only.

Authentication

Ensures that all parties are who they claim to be such that there is no spoofing (no party masquerades as a legitimate entity) and misrepresentation (misleading purpose)

Digital Certificates

The process of confidently confirming the identity of one party by another party. Typically, a client communicates with a server and both client and server can be authenticated through passwords (name and password pairs) or certificates (proof of ID from an authorized source)

Non-repudiation

Ensures that a party to a genuine transaction cannot falsely deny their participation

Digital Certificates and Signatures

These are either password based or certificate based and act as proof that a designated party commissioned the transaction.

Wireless security can be illustrated by a WAP network's enforcing end-to-end security. The issues underlying WAP network security are:

Wireless Network Security: From the wireless device to the WAP gateway, a WAP 1.2 compliant network speaks the WTLS (Wireless Transport Layer Security) protocol. WTLS is a close relative of SSL and uses two kinds of certificates to manage encryption and authentication - WTLS server certificates (defined as part of WAP 1.1) are used to authenticate a WTLS server to a WTLS client and to provide a basis for establishing a key to encrypt (a handset); and WTLS client certificates (defined as part of WAP 1.2) are used to authenticate a WTLS client to a WTLS server. Both types of certificates are like standard SSL certificates except that two different certificate formats are defined - X.509 certificates (as in SSL) and WTLS mini-certificates which are functionally similar but are smaller and simpler than X.509 to facilitate processing in a resource constrained handset environment. Additionally, the mini-certificates also implement certification revocation methods that are more efficient over the wireless network than the traditional OCSP protocol.

Gateway to Wireless Application Server Security: A wireless gateway typically performs a security intermediary function such as bridging a WAP/WTLS protection environment on the wireless side with a HTTP/SSL protection environment on the wired side.

Encryption and User Authentication: When a wireless request is sent over the Wireless Network, the following steps occur:

  1. The Carrier authenticates that the user is a valid wireless network user before completing the call and letting the user access the network.

  2. If the user is a valid user, the call is completed and the WAP Gateway receives the WAP request. The gateway and the client then perform a standard WTLS handshake that both encrypts the communication and authenticates the gateway to the handset and vice versa.

  3. The Gateway opens a HTTP session to the Oracle9iAS Wireless and conducts a standard SSL handshake with it - this authenticates the Gateway to the Oracle9iAS Wireless server and vice versa.

  4. The user then accesses his or her personal portal and carries out a standard username and password based login; note that if both communication over the wireless network and between the wireless gateway and Oracle9iAS Wireless are secure (i.e. if the wireless network supports WTLS) then the username and password combination is not passed in the clear.

  5. The user then accesses a web service. The wireless service either accepts the user's identity passed to it through the Wireless adapter as a bind variable or can ask the user to re-authenticate them again using a username and password.

In addition to network security, application security is necessary to ensure that the wireless applications protect the integrity of the user's information and the data center's information. Wireless supports application-level security with SSL and WTLS. In addition, Wireless uses a secure ACL (Access Control List) to ensure that the appropriate user is mapped to the desired information. Wireless is built on open standards that allow for easy integration with existing security systems to offer end-to-end mobile security.


Go to previous page Go to next page
Oracle
Copyright © 2002 Oracle Corporation.

All Rights Reserved.
Go To Documentation Library
Home
Go To Product List
Solution Area
Go To Table Of Contents
Contents
Go To Index
Index