Previous Topic

Next Topic

Book Contents

Book Index
Home Connect Security

Overview

Home Connect protocol driver uses REST calls towards the Home Connect backend server. It is designed with the idea to support any URL for the backend server. It may be:

Both these servers are accessible through HTTPS. This requires certain checks to be performed upon each connection to make sure that the client (Home Connect protocol driver) is actually communicating the the expected server, in order to prevent no man-in-the-middle attacks.

External services to extend Home Connect protocol driver behaviour

Home Connect protocol driver is modified is a way that it will track and use any javax.net.ssl.X509TrustManager and/or javax.net.ssl.HostnameVerifier registered with service registration property service.pid=homeconnect in the OSGi service registry.

  1. If multiple OSGi services with Home Connect service.pid are available, the one with the highest service ranking will be used to check the server certificates and its hostname.
  2. If no OSGi services with Home Connect service.pid are available, then the Home Connect protocol driver will use the JVM default javax.net.ssl.X509TrustManager and javax.net.ssl.HostnameVerifier implementations as fallback.
    1. Getting JVM default X509TrustManager is done by the following code:

              // get instance of the default TrustManagerFactory

                    TrustManagerFactory tmFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());

                    // init with null trust KeyStore, this will make the implementation load the default cacerts file (JDK)

                    tmFactory.init((KeyStore) null);

                    // iterate through the array with TrustManagers and use the first X509TrustManager instance

                    for (TrustManager trustManager : tmFactory.getTrustManagers()) {

                      if (trustManager instanceof X509TrustManager) {

                        defaultTrustManager = (X509TrustManager) trustManager;

                        break;

                      }

                    }

    2. Getting JVM default HostnameVerifier is easier:

      HostnameVerifier defaultHostnameVerifier = HttpsURLConnection.getDefaultHostnameVerifier();

    3. If there is any problem getting a JVM default implementations, the server certificate and/or hostname verification will fail. This means if the protocol driver could not find the default X509TrustManager, it will throw java.security.cert.CertificateException when checking server certificate.

Additional Notes