OBEX Security

The JSR-82 OBEX API complies with the MIDP 2.0 Security model and defines the following permissions and sensitive APIs.

**Table 18:** OBEX-related security permissions and API calls. Source: MIDP 2.0.
Permission	Permitted API calls	Function group
`javax.microedition.io.Connector.obex.client`	Connector.open("btgoep://<server BD_ADDR> ...")Connector.open("irdaobex://discover ...")Connector.open("irdaobex://addr ...")Connector.open("irdaobex://conn ...")Connector.open("irdaobex://name ...")	Local connectivity
`javax.microedition.io.Connector.obex.client.tcp`	Connector.open("tcpobex://<server IP_ADDR> ...")	Net access
`javax.microedition.io.Connector.obex.server`	Connector.open("btgoep://localhost: ...")Connector.open("irdaobex://localhost: ...")	Local connectivity
`javax.microedition.io.Connector.obex.server.tcp`	Connector.open("tcpobex://:<PORT>")Connector.open("tcpobex://")	Net access

The JSR-82 specification allows performing the OBEX authentication procedure of the remote peer. The authentication is based on the shared secret or password and follows a challenge-response scheme. The authentication was not used in the Business Card Exchanger example and is not described in this document. For more information on the authentication process, see the JSR-82 specification.

Also basic Bluetooth security mechanisms (authorization, encryption, and authentication) are available for OBEX connections. They are accessible via URL parameters and API calls.