Huawei MU509-b Guide de l'utilisateur

HUAWEI MU509-b HSDPA LGA Module

V100R003

SSL Application Guide

Issue

Date

2014-10-10

No part of this manual may be reproduced or transmitted in any form or by any means without prior written

consent of Huawei Technologies Co., Ltd. and its affiliates ("Huawei").

The product described in this manual may include copyrighted software of Huawei and possible licensors.

Customers shall not in any manner reproduce, distribute, modify, decompile, disassemble, decrypt, extract,

reverse engineer, lease, assign, or sublicense the said software, unless such restrictions are prohibited by

applicable laws or such actions are approved by respective copyright holders.

Trademarks and Permissions

, , and are trademarks or registered trademarks of Huawei Technologies Co., Ltd.

Other trademarks, product, service and company names mentioned may be the property of their respective

owners.

Notice

Some features of the product and its accessories described herein rely on the software installed, capacities

and settings of local network, and therefore may not be activated or may be limited by local network

operators or network service providers.

Thus, the descriptions herein may not exactly match the product or its accessories which you purchase.

Huawei reserves the right to change or modify any information or specifications contained in this manual

without prior notice and without any liability.

DISCLAIMER

ALL CONTENTS OF THIS MANUAL ARE PROVIDED “AS IS”. EXCEPT AS REQUIRED BY APPLICABLE

LAWS, NO WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT

LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

PURPOSE, ARE MADE IN RELATION TO THE ACCURACY, RELIABILITY OR CONTENTS OF THIS

MANUAL.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL HUAWEI BE

LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT, OR CONSEQUENTIAL DAMAGES, OR LOSS OF

PROFITS, BUSINESS, REVENUE, DATA, GOODWILL SAVINGS OR ANTICIPATED SAVINGS

REGARDLESS OF WHETHER SUCH LOSSES ARE FORSEEABLE OR NOT.

THE MAXIMUM LIABILITY (THIS LIMITATION SHALL NOT APPLY TO LIABILITY FOR PERSONAL

INJURY TO THE EXTENT APPLICABLE LAW PROHIBITS SUCH A LIMITATION) OF HUAWEI ARISING

FROM THE USE OF THE PRODUCT DESCRIBED IN THIS MANUAL SHALL BE LIMITED TO THE

AMOUNT PAID BY CUSTOMERS FOR THE PURCHASE OF THIS PRODUCT.

Import and Export Regulations

Customers shall comply with all applicable export or import laws and regulations and be responsible to

obtain all necessary governmental permits and licenses in order to export, re-export or import the product

mentioned in this manual including the software and technical data therein.

To better understand how we protect your personal information, please see the privacy policy at

http://consumer.huawei.com/privacy-policy.

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

About This Document

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

About This Document

Revision History

Document

Version

Date

Chapter

Descriptions

2014-10-10

Creation

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Contents

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

Contents

1 Introduction....................................................................................................................................5

1.1 Scope ............................................................................................................................................... 5

1.2 Audience........................................................................................................................................... 5

1.3 CyaSSL ............................................................................................................................................ 5

2 Preliminary Operations................................................................................................................6

2.1 IP Configuration................................................................................................................................ 6

2.2 Configuring or Activating Context..................................................................................................... 6

2.3 SSL................................................................................................................................................... 7

2.3.1 Cipher Suites........................................................................................................................... 8

2.3.2 Certificates............................................................................................................................... 8

3 Configure SSL................................................................................................................................9

3.1 Initialize SSL Library......................................................................................................................... 9

3.2 Enable Secure CyaSSL Channel..................................................................................................... 9

3.3 Configure CyaSSL Socket.............................................................................................................. 10

3.4 Manage Certificate ......................................................................................................................... 10

4 Work with SSL.............................................................................................................................18

4.1 Open a Secure Socket................................................................................................................... 18

4.2 Socket Connection Status.............................................................................................................. 19

4.3 Exchange Data Through a Secure Socket..................................................................................... 20

4.3.1 Transmit Data ........................................................................................................................ 20

4.3.2 Receive Data......................................................................................................................... 20

4.4 Close Socket.................................................................................................................................. 21

5 SSL AT Commands.....................................................................................................................22

6 SSL Error Codes...........................................................................................................................23

Abbreviations

............................................................................................................................24

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Introduction

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

1 Introduction

1.1 Scope

This document provides the description of the set of Secure Socket Layer (SSL)AT

commands related to the SSL protocol.

1.2 Audience

This document is intended for people who are about to develop applicationsusing

secure sockets.

The reader is expected to have knowledgein wireless technologyas well as inAT

commands.A basic knowledge of SSL and Transport Layer Security (TLS) security

protocol is also needed. For protocol details, refer to RFC 2246; The TLS Protocol

Version 1.0.

For details about certificates,refer to RFC 2459; X509v3.

1.3 CyaSSL

CyaSSL library is the third party SSL library for building security functionality into

embedded devices with minimal footprint and supports SSL 3.0, TLS 1.0, TLS 1.1 and

TLS 1.2 standards. With the help of CyaSSL service layer, application protocols such

as HTTPS and Lightweight DirectoryAccess Protocol (LDAP) can be designed to

transmit data over a secure connection.

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Preliminary Operations

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

2 Preliminary Operations

Before initializing a secure socket and transmitting data over the secure channel,

certain preliminary operations need to be performed which are mentioned below.

2.1 IP Configuration

CyaSSLrequires IP configurations to be done to access the secure server over which

data can be transmitted.

2.2 Configuring or Activating Context

Before working withAT commands for establishing secure connection using SSL, the

activation of a PDP context is needed.

First of all, context parameters have to be set. They consist in a set of information

identifying the internet entry point interface provided by the ISP. This can be done

using theAT+CGDCONT command:

AT+CGDCONT[=<cid>[,<PDP_type>[,<APN>[,<PDP_addr>[,<d_comp>[,<h_com

p>]]]]]]

Where:

<cid>: the PDP Context Identifier, a numeric parameter which specifies a

particular PDP context definition.

<PDP_type>: string value. It indicates the type of the packet switching protocol.

"IP": IP protocol

"PPP": Point-to-Point protocol

<APN>: theAccess Point Name, a string that represents logical name used to

select GGSN or external packet data network.

To unlock password protected PIN, use AT+CPIN=<PIN>.

<PDP_addr>: string value. It indicates the address of MSl.

<d_comp>: a numerical value, controlling the compression of PDP data.

0: No compression

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Preliminary Operations

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

1: Compression

2: V.42bi (reserved, not supported currently)

If no <d_comp> is included, it is equivalent to the effect that the <d_comp> is 0.

<h_comp>: a numerical value, controlling the compression of PDP header.

0: No compression

1: Compression

2: RFC1144 (applicable for SNDCP only) (reserved, not supported currently)

3: RFC2507 (reserved, not supported currently)

Other values are reserved.

If no <h_comp> is included, it is equivalent to the effect that the <h_comp> is 0.

Example

To configureAPN:

AT+CGDCONT=1,"IP","mhahuawei1.com"

To check the APN settings:

AT+CGDCONT?

+CGDCONT: 1,"IP","mhahuawei1.com","",0,0

To get the signal strength:

AT+CSQ

+CSQ: 28,99

31 is the strongest, 0 is the weakest, and 99 for none.

To get the registered network:

AT+COPS?

+COPS: 0,0,"Terminal MHANet",2

2.3 SSL

SSL is a cryptographic protocol used over the internet to provide secure data

communication in client server architecture. Examples are HTTP (HTTPS)

connection between web browsers and web servers; SMTP (SMTPS) connection

between SMTP client and server; FTP (FTPS) connection between FTP client and

server.

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Preliminary Operations

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

2.3.1 Cipher Suites

The cipher suite represents the set of algorithms which are used to negotiate the

security settings for a network connection using the SSL network protocol. It includes

a public key algorithm (used for sharing the secret key during the handshake), an

encryption algorithm (used for encrypting the message stream) and a hash algorithm

(used for generating message digests).

The supported cipher suites are listed below:

Value

Cipher_suites

All supported Ciphers

TLS_RSA_WITH_RC4_128_SHA

TLS_RSA_WITH_RC4_128_MD5

TLS_RSA_WITH_NULL_SHA

TLS_RSA_WITH_NULL_SHA256

TLS_RSA_WITH_AES_256_CBC_SHA

TLS_RSA_WITH_AES_128_CBC_SHA

TLS_RSA_WITH_AES_128_CBC_SHA256

TLS_RSA_WITH_AES_256_CBC_SHA256

TLS_RSA_WITH_3DES_EDE_CBC_SHA

TLS_DHE_RSA_WITH_AES_256_CBC_SHA

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

TLS_DHE_RSA_WITH_AES_128_CBC_SHA256

TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

SSL_RSA_WITH_RC4_128_SHA

SSL_RSA_WITH_RC4_128_MD5

2.3.2 Certificates

The SSL module allows the storage of client and server certificate. The certificates

should be in PEM format. Certificates can be stored usingAT commands also.

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Configure SSL

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

3 Configure SSL

Before opening an SSL socket and exchanging data through secure or normal socket,

the following steps need to be performed:

Initialize SSL library

Enable secure CyaSSL channel

Configure secure socket

Manage certificate

3.1 Initialize SSL Library

Before opening a secure socket and exchanging data through it, the CyaSSL library

needs to be initialized. Once SSL service task is created, CyaSSL library is

initialized internally and a CyaSSL context is created.

3.2 Enable Secure CyaSSL Channel

The first step to be done in order to exchange data through an SSL socket is to

enable the secure socket.

This can be done using theAT commandAT^SSLEN:

AT^SSLEN=<SSL_id>,<Enable>[,<Encode_ok>]

Where:

<SSL_id>: must be set to 1, for security socket ID available.

<Enable>: indicates the desired status. 0 indicates to disable socket; 1 indicates

to enable socket.

<Encode_ok>: indicates encode type for AT^SSLRX andAT^SSLTX commands

(optional, it will take the value as 1 by default).

Without entering this command, any attempt to set SSL parameters by means of

an SSL command fails.

Example

Enable SSL socket 1:

HUAWEI MU509-b HSDPA LGA Module

SSLApplication Guide

Configure SSL

Issue 01 (2014-10-10)

Huawei Proprietary and Confidential

AT^SSLEN=1,1

3.3 Configure CyaSSL Socket

CyaSSLsocket parameters can be configured using the AT command AT^SSLCFG.

AT^SSLCFG=<SSL_id>,<TimeOut>[,cipher_suit>,security_level>]

Where:

<SSL_id>: must be set to 1, for security socket ID available.

<TimeOut>: indicates default maximum blocking timeout. Time out may range

from 1s to 60s.

<cipher_suit>: set the value to 0; all the available cipher suites supported by

CyaSSLare proposed to the server. It is responsibility of the remote server to

select one of them. Supported ciphers are mentioned in section 2.3.1 .

<security_level>: the authentication mode.

0: SSL verify none: no authentication,no security data is needed at all.

1: Server authenticationmode: CA Certificate storage is needed (the most

common case).

2: Server or Client authentication mode: CA Certificate (server), Certificate (client)

and Private Key (client) are needed.

Example

CyaSSLsocket configuration:

AT^SSLCFG=1,60,0,1

3.4 Manage Certificate

Certificate management can be done using the AT commandAT^SSLMNG.

AT^SSLMNG=<SSL_id>,<data_type>,<action>,<file_name>,[<package_id>,<tota

l_no_of_packages>,<cert_info>],[<password>]

Where:

<SSL_id>: shouldbe set to 1 for secure socket.

<data_type>: identifies the certificate/keyto be stored.

0: Certificateof the client (module).

1: Root CA certificate of the remote server, it is used to authenticatethe remote

server. It is needed when <security_level> parameter ofAT^SSLCFG command

is set to 1 or 2.

2: RSA private key of the client (module). Storing of certificates or private keys

are required if the Server or Client authentication mode has been configured.

Refer to <security_level> option in section 3.3 .

Table des matières

Autres manuels Huawei Unité de contrôle

Huawei

Huawei MU736 HSPA+ M.2 Instructions d'installation

Huawei

Huawei MU509 Series Instructions d'installation

Huawei

Huawei ME909u-521 Instructions d'installation

Huawei

Huawei MU203 Manuel utilisateur

Huawei

Huawei UPS5000-E-400K-SMS Manuel utilisateur

Huawei

Huawei SmartLi-ESM-24020P1 Manuel utilisateur

Huawei

Huawei ME919Bs-567bN Manuel utilisateur

Huawei

Huawei EM770 Manuel utilisateur

Huawei

Huawei RRU3269 Manuel utilisateur

Huawei

Huawei SmartLogger2000-10-C-JP Manuel utilisateur

Huawei

Huawei ICD OPS D Series Manuel utilisateur

Huawei

Huawei MU509 Series Manuel utilisateur

Huawei

Huawei UPS5000-H-1200K-NT Manuel utilisateur

Huawei

Huawei RRU5303 Manuel utilisateur

Huawei

Huawei MU509-65 Instructions d'installation

Huawei

Huawei ME909s-120 Instructions d'installation

Huawei

Huawei PLC CCO01A Manuel utilisateur

Huawei

Huawei SmartAX MA5612 Manuel d'utilisation

Huawei

Huawei EM660C EVDO Manuel utilisateur

Huawei

Huawei MU609 Guide de l'utilisateur

Huawei

Huawei MC509 Instructions d'installation

Huawei

Huawei SmartLogger2000 series Manuel utilisateur

Huawei

Huawei MU509 Series Manuel utilisateur

Huawei

Huawei CX320 Manuel utilisateur

Manuels Unité de contrôle populaires d'autres marques

Festo

Festo Compact Performance CP-FB6-E Manuel de la liste des pièces

Elo TouchSystems

Elo TouchSystems DMS-SA19P-EXTME Manuel utilisateur

JS Automation

JS Automation MPC3034A Manuel utilisateur

JAUDT

JAUDT SW GII 6406 Series Guide rapide

Spektrum

Spektrum Air Module System Manuel utilisateur

BOC Edwards

BOC Edwards Q Series Manuel utilisateur

KHADAS

KHADAS BT Magic Manuel utilisateur

Etherma

Etherma eNEXHO-IL Manuel utilisateur

PMFoundations

PMFoundations Attenuverter Manuel utilisateur

GEA

GEA VARIVENT Manuel utilisateur

Walther Systemtechnik

Walther Systemtechnik VMS-05 Manuel utilisateur

Altronix

Altronix LINQ8PD Instructions de montage

Eaton

Eaton Powerware Series Manuel utilisateur

WAGO

WAGO 750-407/040-000 Manuel utilisateur

Sony

Sony CCU-590 Manuel utilisateur

Graco

Graco 25D614 Manuel utilisateur

Task Force Tips

Task Force Tips YE-RF-900 Manuel de programmation

Shini

Shini SPV-U Series Manuel utilisateur