Securing MMS

186 Pages·2009·4.23 MB·English

Securing Mobile Communication
Using Public Key Infrastructure
For Multimedia Messaging
Services (MMS)

MOHAMUD AHMED JIMALE
(WGA070020)

SUBMISSION OF DISSERTATION FOR PARTIAL FULFILLMENT OF THE
DEGREE OF MASTER OF COMPUTER SCIENCE

FACULTY OF COMPUTER SCIENCE AND INFORMATION TECHNOLOGY

UNIVERSITY MALAYA
NOVEMBER 2008
Original Literary Work Declaration

i
Abstract

Multimedia Messaging Service (MMS) enables mobile phone users to send multi-part
messages including text, images, audio and video contents to other mobile phone and
email users. MMS completes the potential of messaging, after the success of its
predecessor, SMS, and is expected to become the preferred messaging method for
mobile phone users. It was estimated that more than 5 million subscribers worldwide
used MMS in 2006, and the number of phones manufactured with MMS support
exceeded 90 % of all the phones in production in the same year. MMS-enabled phones
are expected to reach a market penetration rate of about 65%, creating about 210
million active users and up to USD 10 billion in revenue for person-to-person traffic
alone in 2008

The pervasive usage of mobile messaging services such SMS and MMS emphasizes the
necessity to protect confidential information transmitted using these services. In
addition to their potential to be applied to Mobile Commerce area, messaging services
are candidates to be used in sending governmental, corporate or personal sensitive
information. Messages are encrypted from the user mobile device to the service
provider network, but messages are unprotected while they are saved in Service
Provider network. Another concern is also raised over the data stored in the phone, if it
is lost or stolen.

The main contribution of this work (mmsPKI) is to protect MMS messages by ensuring
the authentication and non-repudiation of the communicating parities as well as the
confidentiality and the integrity of messages. This work also provides inbox protection
and remote locking features to prevent an adversary from accessing the stored messages
or communicating with other mmsPKI users. .

ii
Acknowledgments

I would like to express my deep gratitude and thankfulness to my supervisor Dr. Rosli
Salleh for his guidance, useful ideas and patience during his supervision period. I
confess I disturbed him a lot while I knew he had so many things to do. I am very
thankful to him for the environment he created and the encouragement he provided. I
am equally grateful for my previous supervisor and lecturer Mr. Badrul Annual Juma’at
for his assistance, genuine support and guidance from early stages of this dissertation
and having laid down the foundation for the success of this work.

I am grateful for the general directorate of Dahabshil Money Transfer Company and the
administrator of Banadir Regional Office for supporting me to begin and complete my
master’s degree, and enabling me to realize one major dream of my life.

I would also like to thank several colleagues, in particular, Lai Ngan Kuen for helping
me exactly at the time when I needed. I also thank all the good people in the Computer
technology lab and software counter, for their support and the way they made the
environment amicable and interesting all the time.

This work has significantly benefited from advice and consultancy of my friends from
different backgrounds and disciplines, including Dr. Najeb Abdisamed, Bilal, Aws,
Kamaludin Ahmed, Hussein Qassim, Abdiraham H. Farah, Ahmed Nageye, Mohamed
Khadar, Mohamud Aalaso, Adan Abdisamed, Nor farah, Mohamed Ali Abomhara and
many others .

Most importantly I would like to express my deepest sincerity and gratitude to my
family, who have always and unconditionally supported all my endeavors and without
iii
which this work would be meaningless if not impossible. Having such an understanding
and great family is one of the secrets behind the success of this work.

I would like to thank my Mother Habiba Sheik Ali for her endless support and prayer
for me. I hope that I could make all her efforts worthwhile.

Any weakness or shortcoming in this work is my own responsibility. Any strengths or
useful insights, on the other hand, would not have been possible without the help of
those acknowledged above, or those that have been unintentionally omitted.
iv
Contents
Original Literary Work Declaration ......................................................................................................... i
Abstract ...................................................................................................................................................... ii
Acknowledgments ..................................................................................................................................... iii
Contents ...................................................................................................................................................... v
List of Tables ............................................................................................................................................ xii
Abbreviations .......................................................................................................................................... xiii
I- Introduction ............................................................................................................................................ 1
1.1. Background ...................................................................................................................................... 1
1.2. Problem Definition ........................................................................................................................... 6
1.3. Research Question ............................................................................................................................ 7
1.4. Motivation of the study .................................................................................................................... 8
1.5. Objectives of the study. .................................................................................................................... 9
1.6. Significance of the Study ............................................................................................................... 10
1.7. Organization of the study .............................................................................................................. 10
II- Literature Review ............................................................................................................................... 12
2.1. MMS overview ............................................................................................................................... 12
2.1.1. MMS architecture .............................................................................................................. 13
(a) MMS User Agent (MMS UA) ...................................................................................... 15
(b) MMS Relay/Server (MMS Center): ............................................................................. 15
(c) MMS Data Store: .......................................................................................................... 16
2.1.2. MMS Message Format ....................................................................................................... 16
2.1.3. Sending & receiving MMS ................................................................................................ 18
2.1.4. MMS enablers .................................................................................................................... 20
(a)Availability and penetration of MMS phones ................................................................ 20
(b) Device interoperability ................................................................................................. 20
(c) Service inter-working: .................................................................................................. 21
(d) Ease of use .................................................................................................................... 21
(e) Added value for the end-user ........................................................................................ 21
2.1.5. MMS on the Market ........................................................................................................... 22
2.1.6. MMS Applications ............................................................................................................. 23
(a) Person-to-Person Applications ...................................................................................... 23
(b) Machine-to-Person Applications .................................................................................. 23
(c) Ancillary applications ................................................................................................... 24
2.1.7. MMS Legacy Devices Support .......................................................................................... 24
2.1.8. MMS SMIL ....................................................................................................................... 24
2.1.9. MMS Standards ................................................................................................................. 26
2.1.10. MMS Features.................................................................................................................. 29
(a) Address Hiding ............................................................................................................. 29
(b) Delayed Retrieval ......................................................................................................... 31
(c) Delivery Report............................................................................................................. 31
(d) Read Report .................................................................................................................. 32
v
(e) Terminal Capability Negotiation .................................................................................. 32
(f) Forwarding without prior Retrieval ............................................................................... 32
(g) Support for Streaming................................................................................................... 33
(h) Flexible Charging ......................................................................................................... 33
2.1.11. MMS Interfaces ............................................................................................................... 34
(a) MM1 Interface .............................................................................................................. 34
(b) MM2 Interface .............................................................................................................. 35
(c) MM3 Interface .............................................................................................................. 35
(d) MM4 Interface .............................................................................................................. 36
(e) MM5 Interface .............................................................................................................. 36
(f) MM6 Interface............................................................................................................... 36
(g) MM7 Interface .............................................................................................................. 37
(h) MM8 Interface .............................................................................................................. 37
(i) MM9 Interface ............................................................................................................... 37
(j) MM10 Interface ............................................................................................................. 37
(k) MM11 Interface ............................................................................................................ 38
2.1.12. Securing MMS Messages ................................................................................................ 39
2.2.1. Cryptography Overview .............................................................................................................. 40
2.2.2. Secret key (or symmetric) cryptography ............................................................................ 41
(a) Advanced Encryption Standard (AES) ......................................................................... 42
(b) RC4 ............................................................................................................................... 43
2.2.3. Public Key (or Asymmetric) Cryptography ....................................................................... 43
(a) RSA............................................................................................................................... 45
(b) Diffie-Hellman.............................................................................................................. 45
Applications for Public-Key Cryptosystems ...................................................................... 46
2.2.4. Hash Functions .................................................................................................................. 47
2.2.5. Combining Symmetric and Asymmetric techniques (Hybrid Encryption) ........................ 48
The Role of the Session Key in the Hybrid Encryption ..................................................... 49
2.2.6. Digital Signatures .............................................................................................................. 50
(a) Direct Digital Signatures............................................................................................... 50
(b) Arbitrated Digital Signature ......................................................................................... 51
2.2.7. Public Key Infrastructure (PKI) ......................................................................................... 51
PKI components ................................................................................................................. 52
(a) Public key certificate..................................................................................................... 53
(b) Certificate Revocation List (CRL) ................................................................................ 53
(c) Certification Authority (CA) ......................................................................................... 53
(d) Registration Authority (RA) ......................................................................................... 54
(e) Repository ..................................................................................................................... 55
(f) Archive .......................................................................................................................... 55
2.2.8. Using cryptography to Secure MMS ................................................................................. 55
2.3. Mobile Applications Development platforms ................................................................................ 56
2.3.1. Java 2 Micro Edition (J2ME) ............................................................................................. 56
vi
(a) Configurations .............................................................................................................. 57
(b) Profiles .......................................................................................................................... 57
(c) Optional Packages ......................................................................................................... 58
(d) Wireless Messaging API............................................................................................... 58
(e) MIDlets ......................................................................................................................... 58
(f) Multimedia Messaging with WMA 2.0 ......................................................................... 59
2.3.2. Wireless Messaging API (WMA) Security ........................................................................ 60
2.4. Related Work .................................................................................................................................. 61
III- Methodology ...................................................................................................................................... 65
3.1. System Description......................................................................................................................... 65
3.1.1. Authentication .................................................................................................................... 67
3.1.2. Confidentiality ................................................................................................................... 68
(a) Protecting the session Key ............................................................................................ 69
(b) Why RC4? .................................................................................................................... 69
(c) Why RSA? .................................................................................................................... 70
3.1.3. Integrity .............................................................................................................................. 70
3.1.5. Key Generation and distribution ........................................................................................ 72
3.1.6. Certificate Generation ........................................................................................................ 73
3.2. Mobile development environments ................................................................................................ 78
3.2.1. Why Java Micro Edition (J2ME)? ..................................................................................... 78
3.3. System Architecture ....................................................................................................................... 78
3.3.1. Multimedia Messaging with WMA 2.0 ............................................................................. 80
3.3.2. Working with Multipart Messages ..................................................................................... 80
(a) Managing Addresses ..................................................................................................... 81
(b) Content ID and Content Location ................................................................................. 82
(c) Creating multipart messages ......................................................................................... 82
(d) Sending multipart messages ......................................................................................... 83
(e) Receiving multipart messages ....................................................................................... 84
(f) Responding to incoming connections with push registry .............................................. 84
3.4. Development Methodology ............................................................................................................ 86
3.5. Requirements .................................................................................................................................. 87
3.5.1. Hardware requirements: ..................................................................................................... 87
3.5.2. Software requirement ......................................................................................................... 87
(a) The Sun Java2ME (Micro Edition) Wireless Toolkit ................................................... 87
(b) The Legion of the Bouncy Castle Java Cryptographic APIs ........................................ 88
(c) ProGuard obfuscator .................................................................................................... 88
(d) Microsoft SQL server ................................................................................................... 88
(e) ASP.net ........................................................................................................................ 89
(f) Apache Tom Cat ........................................................................................................... 89
(g) Internet Information Services (IIS) .............................................................................. 89
(h) PC Suite ....................................................................................................................... 90
(i) NetBeans IDE mobility pack ......................................................................................... 90
vii
3.6. System Installations ............................................................................................................................ 91
3.6.1. Through USB ..................................................................................................................... 91
3.6.2. OTA (Over the Air provisioning) ...................................................................................... 91
IV-Analysis and Design............................................................................................................................ 92
4.1. System Analysis ............................................................................................................................. 92
4.1.1. Current MMS Status .......................................................................................................... 92
4.1.2. Security Needs of Current MMS ....................................................................................... 92
4.1.3. Solving security needs ....................................................................................................... 93
(a) PKI ................................................................................................................................ 94
(b) Other security features .................................................................................................. 94
(1) Inbox Protection ..................................................................................................................... 94
(2) Remote Locking ..................................................................................................................... 94
(3) Ability To Communicate Only With Other Mmspki Users ................................................... 95
4.1.4. mmsPKI requirements ....................................................................................................... 95
(a) Functional Requirements .............................................................................................. 95
(i) Send/Receive MMS ............................................................................................. 95
(ii) Encryption/Decryption ........................................................................................ 95
(iii) Digital Signature & Hashing .............................................................................. 95
(iv) Authentication .................................................................................................... 96
(v) Key Management ................................................................................................ 96
(vi) Certificate management ..................................................................................... 96
(vii) Remote Locking ................................................................................................ 96
(viii) Inbox protection ............................................................................................... 97
(b) Non-functional requirements ........................................................................................ 97
(a) Reliability ..................................................................................................................... 97
(b) Portability ..................................................................................................................... 97
(c) User Friendly ................................................................................................................ 97
(e) Expendability ................................................................................................................ 97
4.2. System Design ................................................................................................................................ 98
4.2.1. The Messaging and Encryption component ....................................................................... 98
(a) Messaging sub-component ............................................................................................ 98
(b) Encryption/Decryption Sub-component ....................................................................... 99
4.2.2. The Certification and Registration ..................................................................................... 99
(a) Certification Sub-component ........................................................................................ 99
(b) Registration sub-components ........................................................................................ 99
V- Implementation and Testing ............................................................................................................ 104
5.1. Implementation and Testing environment .................................................................................... 104
5.1.1. Testing on J2Me Simulators ............................................................................................ 105
5.1.2. Testing on the real device ................................................................................................ 106
5.2. mmsPKI Installation ..................................................................................................................... 106
5.2.1. Installing with PC Suite using USB cable........................................................................ 106
5.2.2. OTA Installation .............................................................................................................. 108
viii
5.3. Initial settings ............................................................................................................................... 109
5.3.1. Lock value ....................................................................................................................... 109
5.3.2. Owner phone setup .......................................................................................................... 110
5.3.4. Key Generation and Certificate Request .......................................................................... 111
(a) From the client side ..................................................................................................... 111
(b) Server response ........................................................................................................... 113
5.3.5. Acquire the certificates of other users. ............................................................................. 115
(a) From the client side ..................................................................................................... 115
(b) From the server side: .................................................................................................. 117
5.4. The address Book ......................................................................................................................... 117
5.5. Sending and receiving secure MMS ............................................................................................. 118
5.5.1. Composing, encrypting and signing MMS messages ...................................................... 118
5.5.2. Generating the random session Key ................................................................................. 120
5.5.3. Receiving, decrypting, and signature-verifying messages ............................................... 120
(a) Message Notification .................................................................................................. 120
(b) Receiving the Message ............................................................................................... 121
(c) Unsuccessful receive ................................................................................................... 122
(d) Saving the Message .................................................................................................... 123
(e) Opening MMS Messages ............................................................................................ 123
5.5.4. Remote locking Feature ................................................................................................... 124
5.5.5. Inbox protection ............................................................................................................... 124
VI-Conclusion & Future work .............................................................................................................. 126
6.1. Accomplishment of objectives ..................................................................................................... 126
6.2. Future work .................................................................................................................................. 128
Refrences ................................................................................................................................................. 130
Appendix A: Encryption /Decryption in mmsPKI using Hybrid technique. .................................. 135
Appendix B: The lockPhone() method in mmsPKI MIDlet ............................................................. 137
Appendix C: The setOwnerPhone() method in mmsPKI MIDlet .................................................... 138
Appendix D: The requestCertificate() method in mmsPKI MIDlet ................................................ 139
Appendix E: The CAservelet class ....................................................................................................... 142
Appendix F: The acquirePeerCertificate() method in mmsPKI MIDlet ......................................... 145
Appendix G: The Contact class in mmsPKI MIDlet ........................................................................... 148
Appendix H: The SendMMS() method in mmsSender class .............................................................. 150
Appendix I: The mmsCrypto class ....................................................................................................... 154
Appendix J: The receiveGUI() method ................................................................................................ 160
Appendix K: The receiveGUI() method ............................................................................................... 161
Appendix L: The SaveMMS() method in mmsPKI MIDlet ............................................................... 165
Appendix M: The openMMS() method in mmsPKI .......................................................................... 168

ix