1 WAP Overview CSCI – Independent Study Fall 2002 Yasir Zahur Presentation No 1

2 Agenda  Background / Motivation  Architectural Overview  Protocol Layers  Push Technology  Current WAP Status  Security Limitations

3 Lessons from the World Wide Web  WWW Limitations 1. Requires at least some computer skills 2. If you don’t already own a computer, entrance costs are relatively high  However it would be foolish on the other extreme to ignore the Internet as a mean of data transportation

4 Wireless Industry Before 1998 (Some serious problems)  Handheld mobile devices could access network based content but the technologies were incompatible  Not much use of existing Internet infrastructure  No single global standard for data access for all handheld mobile devices

5 Searching for the answer…  Omnipoint issues a tender for the definition of a common standard for the supply of mobile information services, early 1997  WAP Forum founded by Ericsson, Nokia, Motorola and Phone.com. Importance of a common technical base was realized Strong belief that existing technology did not meet the needs of the market

6 Searching for the answer…(cont)  Work started June, 1997  Architecture published September, 1997  Membership opened in January, 1998  Draft specifications published January, 1998  WAP 1.0 available April 30, 1998

7 What is WAP? WAP is an effort, with broad industry support, to define a standard for communicating Internet – type information to devices that have roughly the same form factor and processing power as the average mobile telephone.

8 What sort of devices is WAP designed for?  Primarily includes mobile phones, pagers and PDAs  Low bandwidth and high latency environments  Unpredictable stability and availability  Limited processing power and battery life  Less memory (ROM and RAM)  Smaller displays

9 WAP Architectural Objectives  Create global wireless protocol specifications that work across differing wireless technologies  Facilitate network-operator and third party service provisioning  Define a layered, scalable and extensible architecture  Bring Internet/Intranet information and advanced data services to wireless terminals  Optimize for efficient use of device resources

10 WAP Architectural Objectives (cont)  Provide support for secure applications and communication  Embrace and extend existing standards where possible  Optimize for efficient use of device resources  Optimize for narrowband bearers with potentially high latency  Enable personalization and customization of the device, the content delivered to it and presentation of the content

11 The World – Wide Web Model  WWW standards specify many mechanisms to build a general purpose application environment including: Standard naming model Content typing Standard content formats Standard protocols

12 The World – Wide Web Model (cont)

13 The WAP Model  Based on WWW programming model stable architecture ability to embrace and enhance existing tools including web-servers, XML tools etc  Enhancements Push technology Telephony Support (WTA)

14 The WAP Model (cont)  Components that enable communication between mobile terminals and network servers include: Standard naming model Content typing Standard content formats Standard communication protocols

15 The WAP Model (cont) Based on Version 30-Apr-1998

16 WAP Proxy  WAP Architectural specification (version 12- July-2001) specifies the term WAP Proxy.  WAP utilizes proxy technology to optimize and enhance the connection between wireless domain and WWW. WAP proxy provides various functions including:

17 WAP Proxy (cont) Protocol Gateway: Protocol Gateway: Translates requests from a wireless protocol stack to the WWW protocols. Also performs DNS look up Content Encoders and Decoders: Content Encoders and Decoders: Translate WAP content into a compact format due to slow underlying wireless link and vice versa User Agent Profile Management: User Agent Profile Management: Enable personalization and customization of the device Caching proxy: Caching proxy: Improves perceived performance and network utilization by maintaining a cache of frequently accessed resources

18 WAP Client  Primarily include wireless phones, PDAs and pagers  Beginning to support more memory, faster processing power and longer battery life  Contains a user agent or a mini-browser that implements WAE specification and can execute any WAP compliant application.  Available in thousands of different models and types. A WAP compliant application written once can reach and be executed on all of theses devices

19 Application Servers  Real power of WAP lies in the fact that it leverages existing Internet infrastructure to extend reach of applications to millions of users with wireless devices  Application servers typically consist of three tiers: Web Server Web Server; understands HTTP protocol and responds to HTTP requests from the clients. E.g. Apache, iPlanet, Microsoft IIS etc Application Server Application Server; encodes elements like personalization, commerce, security and data persistence logic. E.g. iPlanet, WebLogic etc Database Server Database Server; used for persistence storage of application data. E.g. Oracle, Sybase, Informix etc

20 The WAP Model Based on Version 12-July-2001

21 Supporting Servers

22 Typical WAP Network

23 WAP Architecture (protocols) Based on Version 30-Apr-1998

24 Comparison between Web and WAP Architectures

25 WAP Architecture (protocols) Based on Version 12-July-2001

26 Bearer Networks  WAP specification is air-interface independent  WAP specification is intended to sit on top of existing bearer channel standards so that any bearer standard can be used with the WAP protocols to implement complete product solutions  WAP operates over different bearer services including short message, circuit-switched data and packet data  Since bearers offer service of varying throughput, delays and error rate, WAP protocols are designed to compensate for or tolerate these varying level of services

27 Bearer Networks (cont)  Some of the common bearers are: SMS (Short Message Service) SMS (Short Message Service); stateless and one of the slowest bearers. Each SMS message is broken down into a short message of maximum 160 characters, no session maintenance CSD (Circuit Switched Data) CSD (Circuit Switched Data); uses circuit switching to establish connection with WAP gateway at around 9600bps; much faster than SMS USSD (Unstructured supplementary Services Data) USSD (Unstructured supplementary Services Data); messages of maximum 182 characters; session based GPRS (General Packet Radio Service) GPRS (General Packet Radio Service); one of the fastest bearers; uses packet based data transmission with speeds of up to kbps

28 Transport Services Layer  Offers set of consistent services to upper layer protocols and maps those services to available bearer services.  Transport services include: Datagrams; Datagrams; provides a connectionless, unreliable datagram service where each datagram is routed independently. WDP and UDP are the two protocols used. WDP is replaced by UDP when used over an IP network layer i.e WDP over IP is UDP/IP Connections Connections; provides data transport service in which communications proceed in three phases: connection establishment, two way reliable data transfer and connection release. TCP (usually profiled) is used to provide connection transport service

29 Transfer Services  Provides for structured transfer of information  Transfer services include: Hypermedia Transfer Hypermedia Transfer: WSP and WTP provide the hypermedia transfer service over secure and non-secure datagram transports. HTTP provides same service over secure and non-secure connection oriented transports Streaming Streaming: provides a mean for transferring isochronous data such as audio and video Message Transfer Message Transfer: provides mean to transfer asynchronous multimedia messages like or instant messages

30 Wireless Transaction Protocol (WTP) Based on Version 30-Apr-1998  Three classes of transaction service Unreliable one-way requests, Reliable one-way requests, Reliable two-way request-reply transactions  Use of unique transaction identifiers, acknowledgements, duplicate removal and retransmissions  PDU concatenation and delayed acknowledgment to reduce the number of messages sent  Optional user to user reliability – WTP triggers the confirmation of each received message  Asynchronous transactions

31 Session Services  Provide for the establishment of shared state between network elements that span multiple network requests or data transfers. It includes: Capability Negotiation Capability Negotiation; includes specifications for describing, transmitting and managing capabilities and preference information about the client, user and network elements Push-OTA Push-OTA; provides for network initiated transactions to be delivered to wireless devices Sync Sync; provides for synchronization of replicated data Cookies Cookies; allows applications to establish state on the client or proxy that survives multiple hypermedia transfer transactions

32 Wireless Session Protocol (WSP) Based on Version 30-Apr-1998  Provides WAE with a consistent interface for two session services: Connection oriented service over WTP Connectionless service over secure and non-secure WDP  Long lived session state  Common facility for reliable and unreliable data push  HTTP/1.1 functionality and semantics in a compact over- the-air encoding  Provides for session suspend/resume

33 Application Framework  Primary objective is to establish an interoperable environment that will allow operators and service providers to build applications and services that can reach a wide variety of different wireless platforms in an efficient and useful manner. It includes: WAE/WTA User-Agent WAE/WTA User-Agent; WAE is a micro-browser environment containing WML, XHTML, WML Script, WTA, WTAI all optimized for handheld devices Content Formats Content Formats; WAE includes support for color, audio, video, images, phone book records, animation etc

34 Application Framework (cont) Push Push; provides a general mechanism for the network to initiate the transmission of data to applications resident on WAP devices Multimedia Messaging; Multimedia Message Service (MMS) provides for the transfer and processing of multimedia messages such as and instant messages to WAP devices

35 Security Services  Privacy  Privacy; to ensure that communication is private and cannot be understood by any eavesdropper  Authentication  Authentication; to establish the authenticity of parties to the communication  Integrity  Integrity; to ensure that communication is unchanged and uncorrupted  Non-Repudiation  Non-Repudiation; to ensure that parties cannot deny that communication took place  Some examples include Authentication, Cryptographic Libraries, Identity, PKI, Secure Transport and Secure Bearer

36 Service Discovery  Services are found at many layers. These include: External Functionality Interface (EFI); allows applications to discover what external functions/services are available on the device Provisioning; allows a device to be provisioned with the parameters necessary to access network services Navigation Discovery; allows a device to discover new network services Service Lookup; provides for the discovery of a service’s parameters through a directory lookup by name

37 WAP 1.x Gateway

38 WAP HTTP Proxy with Profiled TCP and HTTP wireless profiled versions are interoperable with TCP and HTTP

39 Direct Access wireless optimizations as defined by the Wireless Profiles for TCP and HTTP may not be available

40 Dual Stack Support useful when a device needs to interoperate with both old and new WAP servers

41 Push Architecture  Normal client–server model is ‘pull’ technology. E.g. browsing the world wide web  In ‘push’ technology, there is no explicit request from the client before the server transmits its contents. E.g. SMS  Extremely beneficial for time and location based services. E.g. to get traffic alerts up ahead on the highway, weather alerts, listing of nearby restaurants etc

42 Pull vs. Push

43 The Push Framework

44 The Push Framework (cont) PPG usually needs WAP Gateway to communicate with cellular network

45 Push Initiator (PI)  Responsible for generating the message to be pushed and passing it on to PPG.  Messages are all XML based  Commonly HTTP Post mechanism is used for communication between PI and PPG  Responsible for authenticating itself with the PPG usually using X.509 based digital client certificates  Also responsible for managing the workflow of the push messages

46 Push Proxy Gateway (PPG)  Acts as access point for content pushes from Internet to the mobile network  PI identification and authentication  Parsing of and error detection in push content  Translates client address provided by PI into a format understood by mobile network  Store the content if client is currently unavailable  Notify PI about final outcome of push a submission  Protocol conversion

47 Push Access Protocol (PAP)  XML based communication protocol by which a PI pushes content to mobile network addressing its PPG  Can be transported over virtually any protocol that allows MIME types to be transported over the Internet  Supports following operations: Push Submission (PI to PPG) Result Notification (PPG to PI) Push Cancellation (PI to PPG) Push Replacement (PI to PPG) Status Query (PI to PPG) Client Capabilities Query (PI to PPG)

48 Push Over-The-Air Protocol  Responsible for transporting content from the PPG to the client and its user agents  Provides both connectionless (mandatory) and connection-oriented (optional) services  Connectionless service relies upon WSP  Connection-oriented service may be provided in conjunction with WSP (OTA-WSP) and HTTP (OTA-HTTP)

49 Current Successes  Over 18 million WAP users (Cahners-In-Stat / Gartner Dataquest / Strategis, eTforecasts)  Close to 200 carriers deployed or in final testing (Mobile Lifestreams)  50 million WAP-enabled handsets shipped worldwide (International Data Corp)  Tens of thousands of developers creating apps and content (WAP Forum)  12,000 WAP sites from 100+ countries (Cellmania.com)  7.8 million WAP-readable pages (Pinpoint Networks

50 Consumer Successes  Sprint “wireless Web” users reached 1.3 M in 1Q01  Telesp Celular - 323,000 out of 623,000 subscribers with WAP-enabled phone accessed WAP services (EYO2000)  Digital Bridges – 30 Million hits on WAP game site from 1 Million games played in a six month period

51 The Survey FACTS  Survey of 500+ users in Scandinavia: 61% of WAP users 61% of WAP users: satisfied with their WAP experience (Strand Consult)  Survey of 250 users in UK (on all networks) 71% of WAP users 71% of WAP users: WAP is meeting or exceeding expectations (Teleconomy)

52 WAP 2.0 Launched July 31, 2001  What the Developers see: XHTML (fully backwards compatible) TCP  Supported User Features: Color Graphics Animation Large File Downloading Location-Smart Services Pop-up/Context Sensitive Menus Data Synchronization with Desktop PIM

53 WAP Roadmap

54 Secure From Day One  Security meets most extreme demands End-to-end encryption Supports PKI (new in 2.0) Secure proxies in handset and gateway Transactions are as secure as PC sites

55 A Secure Foundation For Wireless Commerce  Transactions demanding security already happening over WAP Banking (Citicorp, Deutche, Allied Irish Bank, Schwab) Finance (Abbey National and Halifax Bank mortgages online) M-Commerce (Amazon.com, MySimon)  Basing their future mobile commerce plans on WAP: Certicom, VeriSign, Entrust.com

56 Security Loop Holes A generic m-commerce transaction using WAP

57 Security Loop Holes (cont) Security zones showing standard security services (WTLS and TSL)

58 Security Loop Holes (cont)  Data flows between WAP device and application server through WAP gateway  All TSL/SSL encrypted content is decrypted at the WAP gateway before being re-encrypted using WTLS for transmission over wireless network and vice versa  Thus data exists in the memory of gateway for a brief period of time in human-readable plain text format……….SECURITY RISK  Conversion between WTLS and TLS is one of the most controversial features of the WAP gateway because it violates the concept of end-to- end security between the WAP client and the application or content server

59 Proposed Solutions  Host the gateway within the secure intranet of application server  However users need to configure their WAP devices to communicate with the new gateway  Application level security on top of WAP  Introduce security at a software layer above WAP and consider WAP merely as a potential insecure communication means.  Security is solely taken care of by means of dedicated software running at two ends i.e. mobile phone and web server  No use of WAP security features neutralizes most of optimizations offered by WAP gateway including data conversion and compression to accommodate for the limited bandwidth

60 Proposed Solutions (cont)  Enabling Internet on the Mobile Device Proposed by WAP Forum for WAP 2.0 Re-design the WAP protocol to not to use a gateway Employ the existing Internet standards, including TCP for entire wired and wireless part of a connection Disregarding WAP gateway makes it possible to attain same high level of security for an m-commerce transaction as an e-commerce transaction on ordinary web using end-to-end encryption However this change will cause compatibility problems and will neutralize optimizations offered by WAP gateway

61 Proposed Solutions (cont) Hosting the gateway within the secure intranet of application server

62 Proposed Solutions (cont) Application Level Security on Top of WAP

63 Bibliography [1] Technical specifications and presentations by Scott Goldman [2] Damon Hougland, Khurram Zafar essential WAP FOR WEB PROFESSIONALS. Upper Saddle River (NJ): Prentice Hall ; 234 p. [3] Wei Meng, Soo Mee, Karli Watson, Ted Wugofski Beginning WAP, WML & WMLScript. Birmigham (UK): Wrox Press; 650p [4] Niels Christian Juul and Niels Jorgensen “Security Limitations in the WAP Architecture” Position Paper [5] Presentation by Bruce Martin [6] Presentation by Owen Sullivan