Huawei MU509-b Guida utente

HUAWEI MU509-b HSDPA LGA Module

V100R003

SSL Application Guide

Issue

Date

2014-10-10

No part of this manual may be reproduced or transmitted in any form or by any means without prior written

consent of Huawei Technologies Co., Ltd. and its affiliates ("Huawei").

The product described in this manual may include copyrighted software of Huawei and possible licensors.

Customers shall not in any manner reproduce, distribute, modify, decompile, disassemble, decrypt, extract,

reverse engineer, lease, assign, or sublicense the said software, unless such restrictions are prohibited by

applicable laws or such actions are approved by respective copyright holders.

Trademarks and Permissions

, , and are trademarks or registered trademarks of Huawei Technologies Co., Ltd.

Other trademarks, product, service and company names mentioned may be the property of their respective

owners.

Notice

Some features of the product and its accessories described herein rely on the software installed, capacities

and settings of local network, and therefore may not be activated or may be limited by local network

operators or network service providers.

Thus, the descriptions herein may not exactly match the product or its accessories which you purchase.

Huawei reserves the right to change or modify any information or specifications contained in this manual

without prior notice and without any liability.

DISCLAIMER

ALL CONTENTS OF THIS MANUAL ARE PROVIDED “AS IS”. EXCEPT AS REQUIRED BY APPLICABLE

LAWS, NO WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT

LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

PURPOSE, ARE MADE IN RELATION TO THE ACCURACY, RELIABILITY OR CONTENTS OF THIS

MANUAL.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL HUAWEI BE

LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT, OR CONSEQUENTIAL DAMAGES, OR LOSS OF

PROFITS, BUSINESS, REVENUE, DATA, GOODWILL SAVINGS OR ANTICIPATED SAVINGS

REGARDLESS OF WHETHER SUCH LOSSES ARE FORSEEABLE OR NOT.

THE MAXIMUM LIABILITY (THIS LIMITATION SHALL NOT APPLY TO LIABILITY FOR PERSONAL

INJURY TO THE EXTENT APPLICABLE LAW PROHIBITS SUCH A LIMITATION) OF HUAWEI ARISING

FROM THE USE OF THE PRODUCT DESCRIBED IN THIS MANUAL SHALL BE LIMITED TO THE

AMOUNT PAID BY CUSTOMERS FOR THE PURCHASE OF THIS PRODUCT.

Import and Export Regulations

Customers shall comply with all applicable export or import laws and regulations and be responsible to

obtain all necessary governmental permits and licenses in order to export, re-export or import the product

mentioned in this manual including the software and technical data therein.

To better understand how we protect your personal information, please see the privacy policy at

http://consumer.huawei.com/privacy-policy.

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

About This Document

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

About This Document

Revision History

Document

Version

Date

Chapter

Descriptions

2014-10-10

Creation

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Contents

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

Contents

1 Introduction....................................................................................................................................5

1.1 Scope ............................................................................................................................................... 5

1.2 Audience........................................................................................................................................... 5

1.3 CyaSSL ............................................................................................................................................ 5

2 Preliminary Operations................................................................................................................6

2.1 IP Configuration................................................................................................................................ 6

2.2 Configuring or Activating Context..................................................................................................... 6

2.3 SSL................................................................................................................................................... 7

2.3.1 Cipher Suites........................................................................................................................... 8

2.3.2 Certificates............................................................................................................................... 8

3 Configure SSL................................................................................................................................9

3.1 Initialize SSL Library......................................................................................................................... 9

3.2 Enable Secure CyaSSL Channel..................................................................................................... 9

3.3 Configure CyaSSL Socket.............................................................................................................. 10

3.4 Manage Certificate ......................................................................................................................... 10

4 Work with SSL.............................................................................................................................18

4.1 Open a Secure Socket................................................................................................................... 18

4.2 Socket Connection Status.............................................................................................................. 19

4.3 Exchange Data Through a Secure Socket..................................................................................... 20

4.3.1 Transmit Data ........................................................................................................................ 20

4.3.2 Receive Data......................................................................................................................... 20

4.4 Close Socket.................................................................................................................................. 21

5 SSL AT Commands.....................................................................................................................22

6 SSL Error Codes...........................................................................................................................23

Abbreviations

............................................................................................................................24

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Introduction

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

1 Introduction

1.1 Scope

This document provides the description of the set of Secure Socket Layer (SSL)AT

commands related to the SSL protocol.

1.2 Audience

This document is intended for people who are about to develop applicationsusing

secure sockets.

The reader is expected to have knowledgein wireless technologyas well as inAT

commands.A basic knowledge of SSL and Transport Layer Security (TLS) security

protocol is also needed. For protocol details, refer to RFC 2246; The TLS Protocol

Version 1.0.

For details about certificates,refer to RFC 2459; X509v3.

1.3 CyaSSL

CyaSSL library is the third party SSL library for building security functionality into

embedded devices with minimal footprint and supports SSL 3.0, TLS 1.0, TLS 1.1 and

TLS 1.2 standards. With the help of CyaSSL service layer, application protocols such

as HTTPS and Lightweight DirectoryAccess Protocol (LDAP) can be designed to

transmit data over a secure connection.

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Preliminary Operations

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

2 Preliminary Operations

Before initializing a secure socket and transmitting data over the secure channel,

certain preliminary operations need to be performed which are mentioned below.

2.1 IP Configuration

CyaSSLrequires IP configurations to be done to access the secure server over which

data can be transmitted.

2.2 Configuring or Activating Context

Before working withAT commands for establishing secure connection using SSL, the

activation of a PDP context is needed.

First of all, context parameters have to be set. They consist in a set of information

identifying the internet entry point interface provided by the ISP. This can be done

using theAT+CGDCONT command:

AT+CGDCONT[=<cid>[,<PDP_type>[,<APN>[,<PDP_addr>[,<d_comp>[,<h_com

p>]]]]]]

Where:

<cid>: the PDP Context Identifier, a numeric parameter which specifies a

particular PDP context definition.

<PDP_type>: string value. It indicates the type of the packet switching protocol.

"IP": IP protocol

"PPP": Point-to-Point protocol

<APN>: theAccess Point Name, a string that represents logical name used to

select GGSN or external packet data network.

To unlock password protected PIN, use AT+CPIN=<PIN>.

<PDP_addr>: string value. It indicates the address of MSl.

<d_comp>: a numerical value, controlling the compression of PDP data.

0: No compression

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Preliminary Operations

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

1: Compression

2: V.42bi (reserved, not supported currently)

If no <d_comp> is included, it is equivalent to the effect that the <d_comp> is 0.

<h_comp>: a numerical value, controlling the compression of PDP header.

0: No compression

1: Compression

2: RFC1144 (applicable for SNDCP only) (reserved, not supported currently)

3: RFC2507 (reserved, not supported currently)

Other values are reserved.

If no <h_comp> is included, it is equivalent to the effect that the <h_comp> is 0.

Example

To configureAPN:

AT+CGDCONT=1,"IP","mhahuawei1.com"

To check the APN settings:

AT+CGDCONT?

+CGDCONT: 1,"IP","mhahuawei1.com","",0,0

To get the signal strength:

AT+CSQ

+CSQ: 28,99

31 is the strongest, 0 is the weakest, and 99 for none.

To get the registered network:

AT+COPS?

+COPS: 0,0,"Terminal MHANet",2

2.3 SSL

SSL is a cryptographic protocol used over the internet to provide secure data

communication in client server architecture. Examples are HTTP (HTTPS)

connection between web browsers and web servers; SMTP (SMTPS) connection

between SMTP client and server; FTP (FTPS) connection between FTP client and

server.

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Preliminary Operations

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

2.3.1 Cipher Suites

The cipher suite represents the set of algorithms which are used to negotiate the

security settings for a network connection using the SSL network protocol. It includes

a public key algorithm (used for sharing the secret key during the handshake), an

encryption algorithm (used for encrypting the message stream) and a hash algorithm

(used for generating message digests).

The supported cipher suites are listed below:

Value

Cipher_suites

All supported Ciphers

TLS_RSA_WITH_RC4_128_SHA

TLS_RSA_WITH_RC4_128_MD5

TLS_RSA_WITH_NULL_SHA

TLS_RSA_WITH_NULL_SHA256

TLS_RSA_WITH_AES_256_CBC_SHA

TLS_RSA_WITH_AES_128_CBC_SHA

TLS_RSA_WITH_AES_128_CBC_SHA256

TLS_RSA_WITH_AES_256_CBC_SHA256

TLS_RSA_WITH_3DES_EDE_CBC_SHA

TLS_DHE_RSA_WITH_AES_256_CBC_SHA

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

TLS_DHE_RSA_WITH_AES_128_CBC_SHA256

TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

SSL_RSA_WITH_RC4_128_SHA

SSL_RSA_WITH_RC4_128_MD5

2.3.2 Certificates

The SSL module allows the storage of client and server certificate. The certificates

should be in PEM format. Certificates can be stored usingAT commands also.

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Configure SSL

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

3 Configure SSL

Before opening an SSL socket and exchanging data through secure or normal socket,

the following steps need to be performed:

Initialize SSL library

Enable secure CyaSSL channel

Configure secure socket

Manage certificate

3.1 Initialize SSL Library

Before opening a secure socket and exchanging data through it, the CyaSSL library

needs to be initialized. Once SSL service task is created, CyaSSL library is

initialized internally and a CyaSSL context is created.

3.2 Enable Secure CyaSSL Channel

The first step to be done in order to exchange data through an SSL socket is to

enable the secure socket.

This can be done using theAT commandAT^SSLEN:

AT^SSLEN=<SSL_id>,<Enable>[,<Encode_ok>]

Where:

<SSL_id>: must be set to 1, for security socket ID available.

<Enable>: indicates the desired status. 0 indicates to disable socket; 1 indicates

to enable socket.

<Encode_ok>: indicates encode type for AT^SSLRX andAT^SSLTX commands

(optional, it will take the value as 1 by default).

Without entering this command, any attempt to set SSL parameters by means of

an SSL command fails.

Example

Enable SSL socket 1:

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Configure SSL

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

AT^SSLEN=1,1

3.3 Configure CyaSSL Socket

CyaSSLsocket parameters can be configured using the AT command AT^SSLCFG.

AT^SSLCFG=<SSL_id>,<TimeOut>[,cipher_suit>,security_level>]

Where:

<SSL_id>: must be set to 1, for security socket ID available.

<TimeOut>: indicates default maximum blocking timeout. Time out may range

from 1s to 60s.

<cipher_suit>: set the value to 0; all the available cipher suites supported by

CyaSSLare proposed to the server. It is responsibility of the remote server to

select one of them. Supported ciphers are mentioned in section 2.3.1 .

<security_level>: the authentication mode.

0: SSL verify none: no authentication,no security data is needed at all.

1: Server authenticationmode: CA Certificate storage is needed (the most

common case).

2: Server or Client authentication mode: CA Certificate (server), Certificate (client)

and Private Key (client) are needed.

Example

CyaSSLsocket configuration:

AT^SSLCFG=1,60,0,1

3.4 Manage Certificate

Certificate management can be done using the AT commandAT^SSLMNG.

AT^SSLMNG=<SSL_id>,<data_type>,<action>,<file_name>,[<package_id>,<tota

l_no_of_packages>,<cert_info>],[<password>]

Where:

<SSL_id>: shouldbe set to 1 for secure socket.

<data_type>: identifies the certificate/keyto be stored.

0: Certificateof the client (module).

1: Root CA certificate of the remote server, it is used to authenticatethe remote

server. It is needed when <security_level> parameter ofAT^SSLCFG command

is set to 1 or 2.

2: RSA private key of the client (module). Storing of certificates or private keys

are required if the Server or Client authentication mode has been configured.

Refer to <security_level> option in section 3.3 .

Indice

Altri manuali Huawei Unità di controllo

Huawei

Huawei ME909u-523 Istruzioni per l'installazione

Huawei

Huawei MU709s-2 Istruzioni per l'installazione

Huawei

Huawei SmartAX MA5811S-AE08 Manuale utente

Huawei

Huawei MU736 HSPA+ M.2 Istruzioni per l'installazione

Huawei

Huawei RRU3269 Manuale utente

Huawei

Huawei UPS5000-E-200K-SM Manuale utente

Huawei

Huawei ME936 Istruzioni per l'installazione

Huawei

Huawei ME909u-523 Istruzioni per l'installazione

Huawei

Huawei MU509 Series Istruzioni per l'installazione

Huawei

Huawei ME936 Istruzioni per l'installazione

Huawei

Huawei V100R001C00 Manuale utente

Huawei

Huawei SmartLogger2000-10-C-JP Manuale utente

Huawei

Huawei BBU3900 Guida

Huawei

Huawei EM770U Manuale utente

Huawei

Huawei MU609 Guida utente

Huawei

Huawei SmartLogger2000 series Manuale utente

Huawei

Huawei MU509 Series Istruzioni per l'installazione

Huawei

Huawei ME919Bs-567bN Manuale utente

Huawei

Huawei ME906V Manuale utente

Huawei

Huawei CX116 Guida di riferimento rapido

Huawei

Huawei ME906E Manuale utente

Huawei

Huawei EM770 Manuale utente

Huawei

Huawei ME906E Istruzioni per l'installazione

Huawei

Huawei SmartAX MA5600T Guida

Manuali Unità di controllo popolari di altre marche

Festo

Festo Compact Performance CP-FB6-E Manuale elenco delle parti

Elo TouchSystems

Elo TouchSystems DMS-SA19P-EXTME Manuale utente

JS Automation

JS Automation MPC3034A Manuale utente

JAUDT

JAUDT SW GII 6406 Series Guida rapida

Spektrum

Spektrum Air Module System Manuale utente

BOC Edwards

BOC Edwards Q Series Manuale utente

KHADAS

KHADAS BT Magic Manuale utente

Etherma

Etherma eNEXHO-IL Manuale utente

PMFoundations

PMFoundations Attenuverter Manuale utente

GEA

GEA VARIVENT Manuale utente

Walther Systemtechnik

Walther Systemtechnik VMS-05 Manuale utente

Altronix

Altronix LINQ8PD Istruzioni per il montaggio

Eaton

Eaton Powerware Series Manuale utente

WAGO

WAGO 750-407/040-000 Manuale utente

Sony

Sony CCU-590 Manuale utente

Graco

Graco 25D614 Manuale utente

Task Force Tips

Task Force Tips YE-RF-900 Manuale di programmazione

Shini

Shini SPV-U Series Manuale utente