J2ME - Based Mobile Commerce Application - Layer Security Solution

With the rapid development of mobile communication technology and the continuous enhancement of mobile terminal function, it laid the foundation for hardware technology for the realization of mobile commerce.In recent years, there are a lot of WAP-based mobile commerce applications which have achieved some good results. However, the incompatibility with standard Internet protocols and the need for using a gateway to perform protocol conversion raises some security concerns and prevents WAP 1.x from providing end-to-end security. This is due to the fact that the protocol conversion mechanism leaves data in an unencrypted form at the gateway during the protocol switching process, which risks the confidentiality of data in the gateway. Through the study and comparison based on existing mobile commerce security solutions, this thesis proposes an application-layer security solution for mobile commerce applications using the J2ME.The solution uses the AES algorithm to encrypt sensitive data, then packages the encrypted data into the HTTP message, which is transported using WAP protocol stack between the client and server.The solution uses pure Java components to provide client authentication and data confidentiality and integrity.This solution can be implemented with the available limited resources of a Java MIDP device, without any modification to the underlying protocols or wireless network infrastructure.The work the author has done is:1. Research the AES algorithm and the principles of its design, implement AES encryption algorithm which fit for PC and mobile terminal using optimized method.2. Research in-depth J2ME platform characteristics and technical defects and realize session tracking function based J2ME platform.3. Analyze the characteristics and defects for existing WAP-based security solution, propose an application-layer security solution for mobile commerce applications using the J2ME and realize prototype system for this solution.4. Analyze the security performance for the prototype system and test the system performance.