Wireless servers and gateways can take advantage of a new Wireless Transport Layer Security (WTLS) mini-certificates issuance service. VeriSign Inc. of Mountain View, Calif., is deploying the service. The company also is working with Motorola, Nokia, and Phone.com to ensure issuance services so these vendors' products operate smoothly. And before the end of the year, VeriSign will be introducing a short-lived certificate.
This is an important development, since wireless Internet access is growing. By 2003, there will be a billion digital wireless phones. Increasing numbers of Internet-capable phones are being deployed. So are other mobile wireless data products, such as wireless-capable PDAs and new-generation, two-way pagers. In fact, wireless Internet clients will outnumber their wired counterparts by 2004.
The wireless Internet is similar to the wired Internet. By its nature, though, it's severely limited when it comes to bandwidth, memory resources, and battery life. These factors warrant some technology changes, compared to the wired Internet. The goals in wireless are smaller and simpler, but it remains essential to minimize change. By doing so, designers can maximize the opportunities for technology reuse and interoperability between the wired and wireless environments.
Wireless gateways are operated by wireless network-service providers. The gateways provide links between Wireless Application Protocol (WAP) environments and wired (http/HTML) environments. Gateways perform content translation. They also may conduct security intermediary functions, such as bridging a WAP/WTLS protection environment on the wireless side with an http/HTML protection on the wired side.
A certificate revocation capability is essential in e-commerce applications. If a server is compromised or decommissioned, users cannot unwittingly continue to execute what appear to be valid, secured transactions with a rogue server. That's one reason why the mini-certificate format is so important for servers and gateways. These mini-certificates need to be transmitted over the air to wireless clients. At the same time, they must be processed by those resource-limited clients.
A Governing Body Mini-certificates are governed by WAP, a standard that targets the presentation and delivery of information and telephony services on mobile phones and other wireless terminals. It was developed by the WAP Forum, a consortium of wireless handset manufacturers, service providers, infrastructure providers, and software developers. Version 1.1 of WAP was frozen in 1999. Handset and infrastructure products implementing this specification are now being shipped.The most significant WAP specification is the WTLS protocol. It's closely related to Secure Socket Layer (SSL), the primary protocol in use today to secure the wired world. WTLS uses two types of certificates for the public key infrastructure (PKI).
The WTLS Server certificate authenticates a WTLS server to a WTLS client and provides a basis for establishing a key to encrypt a client-server session. Its two formats are X.509 certificates—as in SSL—and WTLS mini-certificates. The latter is functionally similar to X.509, but it is smaller and simpler to facilitate its processing in resource-constrained handsets. The mini-certificate is mandatory, and the X.509 certificate is optional.
Handset-To-Server Authentication The second type, the WTLS Client Certificate, is defined as part of WAP1.2. It's used to authenticate a WTLS client (handset) to a WTLS server. The WAP1.2 specification also defines an interesting PKI-based function that is not part of WTLS. Known as the WML2 Script Test Function, it lets a WAP client digitally sign a transaction. This feature is suitable for applications that require nonrepudiable signatures from clients.VeriSign will introduce a short-lived certificate by the end of the year. Presently, a server or gateway is authenticated once in a long-term credential period, which is typically one year. It's authenticated with the expectation that the one server/gateway key-pair will be used throughout the period. Instead of a one-year validity certificate, the certificate authority can issue a VeriSign short-lived certificate for the public key—with a lifetime of, say, 25 hours—every day throughout that year.
The server or gateway picks up its short-lived certificate daily and uses it for client sessions established that day. If the certification authority wishes to revoke the server or gateway (e.g., due to compromise of its private key), it simply ceases issuing further short-lived certificates. Clients no longer will be presented with a currently valid certificate. The server, then, no longer will be considered authenticated.
For more information, see "Secure Wireless E-Commerce with PKI from VeriSign" at www.VeriSign.com.