MIDP 2.0 签名MIDlet开发者指南（2.0版）

下载需积分: 9 | PDF格式 | 1.11MB | 更新于2025-01-09 | 14 浏览量 | 举报

"MIDP_2_0_Signed_MIDlet_Developers_Guide(2.0版本）"是一份详细的开发指南，针对的是Java™ 2.0版本的MIDlets（移动设备应用小程序），特别是对于那些需要签名的MIDlet开发者而言。这份文档基于早期发布的MIDP2.0教程——"Signed MIDlets Tutorial"，发布于2006年10月31日的Forum Nokia网站上，网址为<http://www.forum.nokia.com/>。该指南的主要目标是帮助开发者理解和实施MIDP 2.0规范中的签名机制，确保MIDlets在兼容的移动设备上安全运行，并且符合严格的软件发行要求。随着文档结构的统一以及对部分内容的更新，作者还添加了代码注释，以增强读者的理解和实践指导。版权方面，所有内容由Nokia Corporation持有，强调了Java、Nokia Connecting People等商标所有权，同时提醒读者，文档中的信息不带有任何形式的保证，包括但不限于商品质量保证、特定用途适用性或由建议、规格或样品产生的其他任何保证。此外，文档中的信息被认为是初步的，可能包含技术性错误或遗漏，因此读者在使用时应自行评估并谨慎处理。在阅读这份指南时，开发者可以了解到如何创建和安装签名的MIDlets，如何处理安全证书，以及如何确保应用程序免受恶意代码的攻击。它还会覆盖MIDP 2.0的API和安全性特性，如SecureElement（安全元件）的使用，这对于开发那些涉及敏感数据的应用至关重要。 MIDP_2_0_Signed_MIDlet_Developers_Guide v2.0 是一个实用的资源，为MIDlet开发者提供了在移动平台上构建安全、合规应用程序的必要知识和步骤，尤其是在一个日益重视数据安全和用户隐私的移动环境中。

1 About this document

This document is a tutorial on how to create signed MIDlet suites, following the recommendations of MIDP

version 2.0 at

http://jcp.org/aboutJava/communityprocess/final/jsr118/index.html and the Java™

Technology for the Wireless Industry at http://www.jcp.org/en/jsr/detail?id=185 specifications.

The new security model introduced in MIDP 2.0 is relevant to MIDlet developers who need to use functions

or APIs that are considered sensitive. These are, for example, APIs for network connections, messaging,

and Push functionality. In addition, MIDP optional packages may contain additional restricted APIs.

Intended audience

This document is intended for MIDP developers, as well as Java™ EE and Java SE developers wishing to

develop mobile Java applications or services. The reader should be familiar with MIDP 2.0 (especially the

LCDUI API) before attempting to understand this example.

Scope

Knowledge of public-key encryption and digital signatures is recommended before reading this document

(Public-Key Cryptography Standards, RSA at http://www.rsasecurity.com/rsalabs/pkcs/index.html), as well

as their usage in the Java language (X.509 Certificates and Certificate Revocation Lists (CRLs) at http://

www.java.sun.com/j2se/1.4.1/docs/guide/security/cert3.html). The document concentrates on providing

practical advice and real-world cases about MIDlet signing.

This document assumes a good knowledge of application and service development and the Java

programming language. Furthermore, it assumes familiarity with enterprise application development.

However, previous knowledge of developing for the mobile environment is not necessary.

This document focuses on signed MIDlets and therefore explaining the Java technology is out of the scope

of this documentation. For information on Java technology, see Java Technology web site at http://

java.sun.com/ and Java Mobility Development Center at http://developers.sun.com/techtopics/mobility/.

For additional information on MIDP tools and documentation, see Forum Nokia, Mobile Java section at

http://www.forum.nokia.com/java.

Forum.Nokia.com

MIDP 2.0: Signed MIDlet Developer's Guide 6

2 MIDP security features

One of the main benefits of MIDP is the openness of the platform, which enables anybody to write software

that can run on MIDP devices. MIDlet suites can be downloaded from the network in an anonymous fashion,

and as such, there are some security and privacy issues that the user may be concerned about: Can a MIDlet

read private data and send it to an unknown server? Can it make unauthorized calls that cost money to the

user? Can rogue programs run on the device and potentially cause problems?

Besides the Java language safety features, such as garbage collection and array bounds checking, the MIDP

specification adds some additional safety measures. In MIDP version 2.0, the security model allows MIDlets

access APIs that are considered sensitive. For example, making an HTTP connection is one of such sensitive

operations because it may involve monetary costs for the user. MIDP 2.0 includes the concept of trusted

and

untrusted

MIDlets.

• An

untrusted

MIDlet suite has limited access to restricted APIs, requiring user approval depending on

the security policy of the device.

• A

trusted

MIDlet suite can acquire some permissions automatically depending on the security policy.

Permissions are used to protect APIs that are sensitive and require authorization. The MIDP 2.0

implementation has to check whether a MIDlet suite has acquired the necessary permission before invoking

the API. Permissions have names starting with the package name in the same way as Java™ Standard Edition

(Java SE™) platform permissions. For instance, the permission to make an HTTP connection is called

javax.microedition.io.Connector.http. For available permissions, see the class or package

documentation of the protected API.

2.1 Protection Domains

Protection domains is a key security concept in MIDP 2.0. A protection domain is a set of permissions and

interaction modes. Those permissions can be either automatically granted or deferred until user approval.

They are called

allowed

and

user

permissions respectively. When a MIDlet suite is installed, it is assigned

to a given protection domain and acquires its permissions and interaction modes.

User

permissions may require an explicit approval by the user. The user can either deny the permission or

allow it. There are three interaction modes in which

user

permissions can be granted:

•

blanket

When the

blanket

interaction mode is used, the MIDlet suite acquires the permission as long as the suite

is installed, unless explicitly revoked by the user.

•

session

The

session

mode requests the user authorization the first time the API is invoked and its validity is

guaranteed while any of the MIDlets in the same suite are running.

•

oneshot

Oneshot

permissions request user approval every time the API is invoked. The protection domain

determines which of the modes are available for each user permission as well as the default mode.

A MIDlet suite has to request permissions declaratively using the

MIDlet-Permissions

and

MIDlet-

Permissions-Opt

attributes, either in the application descriptor or in the manifest file. MIDlet-Permissions

contains permissions that are critical for the suite's functionality and MIDlet-Permissions-Opt indicates

desired permissions, which are not so fundamental for the core functionality. For example, for an

application's functionality it is critical to make HTTP connections to work. It may also use HTTPS connections

for improved security, but it is not so vital. In this case, the application descriptor could look like this:

MIDlet-Permissions: javax.microedition.io.Connector.http

MIDlet-Permissions-Opt: javax.microedition.io.Connector.https

One of the requirements to install a MIDlet and assign it to a given domain is that the requested permissions

should be a subset of the permissions given to the protection domain. As an example, the S60 MIDP Emulator

Prototype 2.0 (SDK) includes a domain called

minimum

, which has no permissions at all. If a signed MIDlet

Forum.Nokia.com

MIDP 2.0: Signed MIDlet Developer's Guide 7

剩余32页未读，继续阅读

Hesky

粉丝: 0
资源: 1

MIDP 2.0 签名MIDlet开发者指南（2.0版）

MIDP_2_0.rar_数字签名

j2me的midp2.0所有源代码

贝尔金F7D1101v2_WW_2.0.5.0_signed.zip

xGame_2.0.2485.13_legu_signed-1.apk

MIDP 2.0: Tutorial On Signed MIDlets

Lineage_LiveClient_201906131556_setup_0_tgod_signed.exe

10202dce\PA_E-Learning_nokiaN95_v_1_0_16_signed.SIS

harden_iL_prod_release_v4_11_0_263_11302134_signed.apk

FateGO_v2_71_1_MOD_signed.apk

STLinkUSBDriver6.1.2.0Signed.zip

最新资源