Notifications and security

[Cover] [Previous Section] [Next Section] [Index]

Current chapter: Creating HDML Services that "Push" Information
Section 36 out of 67 total sections , Section 5 out of 11 sections in this chapter

Notifications and security

Because careless or malicious services could potentially annoy UP.Link subscribers with notifications, the UP.Link server provides the following controls on notifications:

It allows the UP.Link server administrator to set an access control list, which specifies the domains it will (or will not) accept notifications from.
It provides a secure notification port. The secure port accepts notifications only from services that identify themselves with a server certificate from an approved Certificate Authority. The UP.Link operator must enable this port after installation--the non-secure notification port is enabled by default.

The server certificate required to send notifications to the secure port is a special type of certificate, which can only be used for issuing notifications from a specific domain to an UP.Link server. It ensures that malicious services cannot misrepresent themselves and send spurious notifications.

IMPORTANT The certificate that an HDML service must provide when it sends notifications is called a "server certificate" by most Certificate Authorities. The certificate stores the subdomain and domain name of the system that is sending notifications as the Common-Name of the certificate.

For more background information on how certificates are used in the UP.Link platform, see Chapter 6, Creating Secure HDML Services.

Determining which security mode to use

The UP.SDK notification APIs allow you to issue either secure or non-secure notifications. When you issue a secure notification, the default mode is "secure-preferred." In secure-preferred mode, UP.SDK APIs first attempt to connect to the UP.Link server's secure port; if the secure port is not available, they attempt to connect to the non-secure port.

The following table lists notification modes and the types of connections the APIs will establish with different UP.Link server ports enabled:

Notification mode	Non-secure only	Secure only	Both
Non-secure only	Non-secure connection	Connection fails	Non-secure connection
Secure-preferred	Non-secure connection	Secure connection	Secure connection
Secure only	Connection fails	Secure connection	Secure connection

Secure-preferred mode is most likely to work on any UP.Link server; Unwired Planet recommends using it to achieve the greatest possible coverage. You should not use it for services that require security. The following table summarizes the recommended uses for each notification mode:

Notification mode	Use
Non-secure only	Testing
Secure preferred	Applications for which it is important to work on every UP.Link server, regardless of security (most applications)
Secure-only	Applications that require security

Notification port numbers

In general, you should not worry about notification port numbers, because the UP.SDK APIs issue notifications to the appropriate ports by default.

The following ports are the default notification ports for UP.Link servers:

Port	Description
`4445`	Internet Assigned Number Authority (IANA) assigned port for non-secure notifications
`3356`	IANA-assigned port for secure notifications