Huawei MU509-b User guide

HUAWEI MU509-b HSDPA LGA Module
V100R003
SSL Application Guide
Issue
01
Date
2014-10-10

Copyright © Huawei Technologies Co., Ltd. 2014. All rights reserved.
No part of this manual may be reproduced or transmitted in any form or by any means without prior written
consent of Huawei Technologies Co., Ltd. and its affiliates ("Huawei").
The product described in this manual may include copyrighted software of Huawei and possible licensors.
Customers shall not in any manner reproduce, distribute, modify, decompile, disassemble, decrypt, extract,
reverse engineer, lease, assign, or sublicense the said software, unless such restrictions are prohibited by
applicable laws or such actions are approved by respective copyright holders.
Trademarks and Permissions
, , and are trademarks or registered trademarks of Huawei Technologies Co., Ltd.
Other trademarks, product, service and company names mentioned may be the property of their respective
owners.
Notice
Some features of the product and its accessories described herein rely on the software installed, capacities
and settings of local network, and therefore may not be activated or may be limited by local network
operators or network service providers.
Thus, the descriptions herein may not exactly match the product or its accessories which you purchase.
Huawei reserves the right to change or modify any information or specifications contained in this manual
without prior notice and without any liability.
DISCLAIMER
ALL CONTENTS OF THIS MANUAL ARE PROVIDED “AS IS”. EXCEPT AS REQUIRED BY APPLICABLE
LAWS, NO WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE, ARE MADE IN RELATION TO THE ACCURACY, RELIABILITY OR CONTENTS OF THIS
MANUAL.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL HUAWEI BE
LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT, OR CONSEQUENTIAL DAMAGES, OR LOSS OF
PROFITS, BUSINESS, REVENUE, DATA, GOODWILL SAVINGS OR ANTICIPATED SAVINGS
REGARDLESS OF WHETHER SUCH LOSSES ARE FORSEEABLE OR NOT.
THE MAXIMUM LIABILITY (THIS LIMITATION SHALL NOT APPLY TO LIABILITY FOR PERSONAL
INJURY TO THE EXTENT APPLICABLE LAW PROHIBITS SUCH A LIMITATION) OF HUAWEI ARISING
FROM THE USE OF THE PRODUCT DESCRIBED IN THIS MANUAL SHALL BE LIMITED TO THE
AMOUNT PAID BY CUSTOMERS FOR THE PURCHASE OF THIS PRODUCT.
Import and Export Regulations
Customers shall comply with all applicable export or import laws and regulations and be responsible to
obtain all necessary governmental permits and licenses in order to export, re-export or import the product
mentioned in this manual including the software and technical data therein.
Privacy Policy
To better understand how we protect your personal information, please see the privacy policy at
http://consumer.huawei.com/privacy-policy.

HUAWEI MU509-b HSDPA LGA Module
SSLApplication Guide
About This Document
Issue 01 (2014-10-10)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
3
About This Document
Revision History
Document
Version
Date
Chapter
Descriptions
01
2014-10-10
Creation

HUAWEI MU509-b HSDPA LGA Module
SSLApplication Guide
Contents
Issue 01 (2014-10-10)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
4
Contents
1 Introduction....................................................................................................................................5
1.1 Scope ............................................................................................................................................... 5
1.2 Audience........................................................................................................................................... 5
1.3 CyaSSL ............................................................................................................................................ 5
2 Preliminary Operations................................................................................................................6
2.1 IP Configuration................................................................................................................................ 6
2.2 Configuring or Activating Context..................................................................................................... 6
2.3 SSL................................................................................................................................................... 7
2.3.1 Cipher Suites........................................................................................................................... 8
2.3.2 Certificates............................................................................................................................... 8
3 Configure SSL................................................................................................................................9
3.1 Initialize SSL Library......................................................................................................................... 9
3.2 Enable Secure CyaSSL Channel..................................................................................................... 9
3.3 Configure CyaSSL Socket.............................................................................................................. 10
3.4 Manage Certificate ......................................................................................................................... 10
4 Work with SSL.............................................................................................................................18
4.1 Open a Secure Socket................................................................................................................... 18
4.2 Socket Connection Status.............................................................................................................. 19
4.3 Exchange Data Through a Secure Socket..................................................................................... 20
4.3.1 Transmit Data ........................................................................................................................ 20
4.3.2 Receive Data......................................................................................................................... 20
4.4 Close Socket.................................................................................................................................. 21
5 SSL AT Commands.....................................................................................................................22
6 SSL Error Codes...........................................................................................................................23
7 Abbreviations ............................................................................................................................24

HUAWEI MU509-b HSDPA LGA Module
SSLApplication Guide
Introduction
Issue 01 (2014-10-10)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
5
1 Introduction
1.1 Scope
This document provides the description of the set of Secure Socket Layer (SSL)AT
commands related to the SSL protocol.
1.2 Audience
This document is intended for people who are about to develop applicationsusing
secure sockets.
The reader is expected to have knowledgein wireless technologyas well as inAT
commands.A basic knowledge of SSL and Transport Layer Security (TLS) security
protocol is also needed. For protocol details, refer to RFC 2246; The TLS Protocol
Version 1.0.
For details about certificates,refer to RFC 2459; X509v3.
1.3 CyaSSL
CyaSSL library is the third party SSL library for building security functionality into
embedded devices with minimal footprint and supports SSL 3.0, TLS 1.0, TLS 1.1 and
TLS 1.2 standards. With the help of CyaSSL service layer, application protocols such
as HTTPS and Lightweight DirectoryAccess Protocol (LDAP) can be designed to
transmit data over a secure connection.

HUAWEI MU509-b HSDPA LGA Module
SSLApplication Guide
Preliminary Operations
Issue 01 (2014-10-10)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
6
2 Preliminary Operations
Before initializing a secure socket and transmitting data over the secure channel,
certain preliminary operations need to be performed which are mentioned below.
2.1 IP Configuration
CyaSSLrequires IP configurations to be done to access the secure server over which
data can be transmitted.
2.2 Configuring or Activating Context
Before working withAT commands for establishing secure connection using SSL, the
activation of a PDP context is needed.
First of all, context parameters have to be set. They consist in a set of information
identifying the internet entry point interface provided by the ISP. This can be done
using theAT+CGDCONT command:
AT+CGDCONT[=<cid>[,<PDP_type>[,<APN>[,<PDP_addr>[,<d_comp>[,<h_com
p>]]]]]]
Where:
<cid>: the PDP Context Identifier, a numeric parameter which specifies a
particular PDP context definition.
<PDP_type>: string value. It indicates the type of the packet switching protocol.
"IP": IP protocol
"PPP": Point-to-Point protocol
<APN>: theAccess Point Name, a string that represents logical name used to
select GGSN or external packet data network.
To unlock password protected PIN, use AT+CPIN=<PIN>.
<PDP_addr>: string value. It indicates the address of MSl.
<d_comp>: a numerical value, controlling the compression of PDP data.
0: No compression

HUAWEI MU509-b HSDPA LGA Module
SSLApplication Guide
Preliminary Operations
Issue 01 (2014-10-10)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
7
1: Compression
2: V.42bi (reserved, not supported currently)
If no <d_comp> is included, it is equivalent to the effect that the <d_comp> is 0.
<h_comp>: a numerical value, controlling the compression of PDP header.
0: No compression
1: Compression
2: RFC1144 (applicable for SNDCP only) (reserved, not supported currently)
3: RFC2507 (reserved, not supported currently)
Other values are reserved.
If no <h_comp> is included, it is equivalent to the effect that the <h_comp> is 0.
Example
To configureAPN:
AT+CGDCONT=1,"IP","mhahuawei1.com"
OK
To check the APN settings:
AT+CGDCONT?
+CGDCONT: 1,"IP","mhahuawei1.com","",0,0
OK
To get the signal strength:
AT+CSQ
+CSQ: 28,99
OK
31 is the strongest, 0 is the weakest, and 99 for none.
To get the registered network:
AT+COPS?
+COPS: 0,0,"Terminal MHANet",2
OK
2.3 SSL
SSL is a cryptographic protocol used over the internet to provide secure data
communication in client server architecture. Examples are HTTP (HTTPS)
connection between web browsers and web servers; SMTP (SMTPS) connection
between SMTP client and server; FTP (FTPS) connection between FTP client and
server.

HUAWEI MU509-b HSDPA LGA Module
SSLApplication Guide
Preliminary Operations
Issue 01 (2014-10-10)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
8
2.3.1 Cipher Suites
The cipher suite represents the set of algorithms which are used to negotiate the
security settings for a network connection using the SSL network protocol. It includes
a public key algorithm (used for sharing the secret key during the handshake), an
encryption algorithm (used for encrypting the message stream) and a hash algorithm
(used for generating message digests).
The supported cipher suites are listed below:
Value
Cipher_suites
0
All supported Ciphers
1
TLS_RSA_WITH_RC4_128_SHA
2
TLS_RSA_WITH_RC4_128_MD5
3
TLS_RSA_WITH_NULL_SHA
4
TLS_RSA_WITH_NULL_SHA256
5
TLS_RSA_WITH_AES_256_CBC_SHA
6
TLS_RSA_WITH_AES_128_CBC_SHA
7
TLS_RSA_WITH_AES_128_CBC_SHA256
8
TLS_RSA_WITH_AES_256_CBC_SHA256
9
TLS_RSA_WITH_3DES_EDE_CBC_SHA
10
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
11
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
12
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
13
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
14
SSL_RSA_WITH_RC4_128_SHA
15
SSL_RSA_WITH_RC4_128_MD5
2.3.2 Certificates
The SSL module allows the storage of client and server certificate. The certificates
should be in PEM format. Certificates can be stored usingAT commands also.

HUAWEI MU509-b HSDPA LGA Module
SSLApplication Guide
Configure SSL
Issue 01 (2014-10-10)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
9
3 Configure SSL
Before opening an SSL socket and exchanging data through secure or normal socket,
the following steps need to be performed:
Initialize SSL library
Enable secure CyaSSL channel
Configure secure socket
Manage certificate
3.1 Initialize SSL Library
Before opening a secure socket and exchanging data through it, the CyaSSL library
needs to be initialized. Once SSL service task is created, CyaSSL library is
initialized internally and a CyaSSL context is created.
3.2 Enable Secure CyaSSL Channel
The first step to be done in order to exchange data through an SSL socket is to
enable the secure socket.
This can be done using theAT commandAT^SSLEN:
AT^SSLEN=<SSL_id>,<Enable>[,<Encode_ok>]
Where:
<SSL_id>: must be set to 1, for security socket ID available.
<Enable>: indicates the desired status. 0 indicates to disable socket; 1 indicates
to enable socket.
<Encode_ok>: indicates encode type for AT^SSLRX andAT^SSLTX commands
(optional, it will take the value as 1 by default).
Without entering this command, any attempt to set SSL parameters by means of
an SSL command fails.
Example
Enable SSL socket 1:

HUAWEI MU509-b HSDPA LGA Module
SSLApplication Guide
Configure SSL
Issue 01 (2014-10-10)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
10
AT^SSLEN=1,1
OK
3.3 Configure CyaSSL Socket
CyaSSLsocket parameters can be configured using the AT command AT^SSLCFG.
AT^SSLCFG=<SSL_id>,<TimeOut>[,cipher_suit>,security_level>]
Where:
<SSL_id>: must be set to 1, for security socket ID available.
<TimeOut>: indicates default maximum blocking timeout. Time out may range
from 1s to 60s.
<cipher_suit>: set the value to 0; all the available cipher suites supported by
CyaSSLare proposed to the server. It is responsibility of the remote server to
select one of them. Supported ciphers are mentioned in section 2.3.1 .
<security_level>: the authentication mode.
0: SSL verify none: no authentication,no security data is needed at all.
1: Server authenticationmode: CA Certificate storage is needed (the most
common case).
2: Server or Client authentication mode: CA Certificate (server), Certificate (client)
and Private Key (client) are needed.
Example
CyaSSLsocket configuration:
AT^SSLCFG=1,60,0,1
OK
3.4 Manage Certificate
Certificate management can be done using the AT commandAT^SSLMNG.
AT^SSLMNG=<SSL_id>,<data_type>,<action>,<file_name>,[<package_id>,<tota
l_no_of_packages>,<cert_info>],[<password>]
Where:
<SSL_id>: shouldbe set to 1 for secure socket.
<data_type>: identifies the certificate/keyto be stored.
0: Certificateof the client (module).
1: Root CA certificate of the remote server, it is used to authenticatethe remote
server. It is needed when <security_level> parameter ofAT^SSLCFG command
is set to 1 or 2.
2: RSA private key of the client (module). Storing of certificates or private keys
are required if the Server or Client authentication mode has been configured.
Refer to <security_level> option in section 3.3 .