JP2008160497A - Communication apparatus and communication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication apparatus capable of maintaining a continuous channel and detecting a risk of spoofing and being altered when an external host in an external network establishes a tunnel to an internal host in an internal network beyond a firewall to perform a communication. <P>SOLUTION: The communication apparatus performs a communication after establishing a tunnel from the external host in the external network to the internal host device in the internal network beyond the firewall has a transmitting means for transmitting channel maintenance data for maintaining the tunnel in accordance with timing required to maintain the tunnel, and an electronic signature means for performing an electronic signature in the channel maintenance data. Further, the channel maintenance data includes data having a meaning that nothing will be done. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a communication system and a communication method.

  A technique for building a new service by combining various services distributed on a network such as the Internet is attracting attention. In particular, a technique called a Web service has begun to be widely used. Web services are built based on open standard technologies such as Hyper Text Transfer Protocol (HTTP), Simple Object Access Protocol (SOAP), and Extensible Markup Language (XML).

  By the way, companies generally restrict access from the Internet by introducing a system called a firewall (firewall) at the boundary between the Internet and the company network. Even in such an environment where a firewall exists, there is a demand to call a service that uses computing resources existing in the corporate network from a service configured on the Internet. FIG. 1 is a diagram for explaining the relationship between a conventional Web service and a firewall. When a user terminal 7 connected to an external network 3 such as the Internet calls the services 5a to 5c in the internal network 2 over the firewall 2 via the services 6a to 6c, only a specific user terminal exceeds the firewall 2 be able to.

  In order to meet the above requirements, it is necessary to enable communication from the Internet to the corporate network. As a technique for this purpose, it is common to use a method using a VPN (Virtual Private Network) technique and a technique called a reverse proxy. VPNs generally have the problem of requiring expensive equipment such as dedicated routers. The reverse proxy is a technique in which a normal reverse proxy is installed at the network boundary (firewall) and internal network resources are limitedly disclosed to the outside. However, the reverse proxy has a problem that it is necessary to change the configuration of the firewall or the perimeter network.

  In addition, it connects to an external host by communication means such as HTTP (Hyper Text Transfer Protocol, HTTP / 1.16 RFC2616) and HTTPS (Hyper Text Transfer Protocol Security, RFC2660) that can easily pass from inside the firewall to the outside. As a technology for making data ready to be transmitted from an external host, technologies such as server push and reverse tunneling have been proposed. HTTP is characterized by stateless and simple communication. The client transmits a request to the server, and the server returns a response corresponding to the request, and the session ends. In HTTP, even if there is a firewall or the like, a transparent connection is possible by using a general-purpose proxy. In HTTP, a client issues a request and a server responds. In server push, information is automatically distributed to each client host determined from the server side.

  However, since server push does not perform compression processing or the like, if the data update interval is shortened, the data amount is simply multiplied by the number of updates, resulting in a large overall traffic data, which is not suitable for real-time communication. Further, in server push, since the server periodically delivers update data, interactive communication is not considered and is not suitable for interactive communication. Further, in the distribution of moving images, it is common to use other data formats suitable for stream distribution such as MPEG2 / MPEG4. For this reason, server push became a hot topic as a next-generation Web technology around 1997, but it is not used much now. On the other hand, a reverse tunnel has been proposed as a connection form that realizes communication in a reverse method to that at the start of connection (see Patent Document 1). The reverse tunnel is a technique for establishing a tunnel connection by starting communication from the inside to the outside.

The following techniques have been proposed as general techniques for preventing spoofing. Patent Document 2 proposes a technique for installing a digital certificate in a multifunction machine or the like so that impersonation becomes difficult. Patent Document 3 proposes a technique for authenticating a user using a user's biometrics instead of a token for electronic transmission processing. Furthermore, in patent document 4, the secure communication is enabled using the security gateway for network games.
JP 2003-50756 A JP 2004-320715 A JP 2003-509775 A JP 2004-56784 A

  However, a normal reverse tunnel creates an encrypted tunnel using a protocol having a tunnel mode such as HTTPS or SSL. HTTP is characterized by stateless and simple communication. The client transmits a request to the server, and the server returns a response corresponding to the request, and the session ends. For this reason, since HTTP is designed on the premise of stateless communication, there is a problem that a communication path cannot be continuously maintained. In addition, since this tunnel is based on HTTP, there is a risk of being simply spoofed or tampered with.

  Therefore, the present invention has been made in view of the above problems, and continues when an external host in an external network establishes a tunnel and communicates with an internal host in the internal network across a firewall. An object of the present invention is to provide a communication system and a communication method capable of maintaining a typical communication path and detecting the risk of impersonation and tampering.

  In order to solve the above problems, the present invention provides a firewall that blocks communication from an external host in an external network to an internal host in an internal network and selectively allows communication from the internal network to the external network. In a certain environment, a communication system that performs communication by establishing a communication path from the external host in the external network to the internal host in the internal network, wherein the external host maintains the communication path Transmission means for transmitting communication path maintenance data for maintaining the communication path to the internal host according to necessary timing, and electronic signature means for applying an electronic signature to the communication path maintenance data. Features.

  According to the present invention, the communication path maintenance data is sent at a timing necessary for maintaining the communication path, so that the external host in the external network passes the firewall and establishes the communication path with the internal host in the internal network. When constructing and performing communication, it is possible to maintain a continuous communication path. Also, by applying a digital signature to the communication path maintenance data for maintaining the communication path, the connection source can verify the reliability of the connection destination, and the connection destination host can guarantee its own reliability. it can. As a result, it is possible to provide a mechanism for preventing spoofing by a malicious third party and detecting tampering.

  Further, the internal host establishes the communication path by transmitting request information for establishing the communication path to the external host and receiving reply information of the request information from the external host. The communication path is maintained by receiving the communication path maintenance data after receiving the reply information. The communication path maintenance data includes information indicating that processing is not required on the internal host side. The information indicating that processing is not required on the internal host side is data meaning that nothing is done. The request information and reply information are based on the hypertext transfer protocol. The communication path maintenance data may include a random value obtained by signing and encrypting a predetermined initial value.

  In the communication system according to the present invention, when the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value, the external host includes pseudo random number generation means for generating the predetermined initial value. Furthermore, it can be set as the structure which has. When the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value, an authentication unit that authenticates a communication partner by generating the random value based on the predetermined initial value at the time of authentication. Furthermore, it can be set as the structure which has.

  In the communication system according to the present invention, when the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value, a signing unit that signs the predetermined initial value with a secret key on a transmitting side is provided. Furthermore, it can be set as the structure which has. In the communication system according to the present invention, when the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value, the initial value for encrypting the predetermined initial value with the public key of the receiving side It may be configured to further include an encryption unit. The communication system of the present invention may further include a certificate authority that issues a certificate to the public key. This makes it possible to generate a signature for proving that the data issuer is a reliable server. In addition, the authenticity of the connection destination host and data can be confirmed more securely and reliably. In addition, it is easy to check the authenticity when the number of newly connected hosts increases, and it is possible to expand the system with scalability.

  The communication system of the present invention can be configured to further include construction means for constructing the communication path using reverse tunnel technology. The external host may further include service call accepting means for accepting a service call in the internal network and transmitting service call data for the service call to the internal host. Thereby, for example, a service existing on the internal network in the company can be called over the firewall from the external network.

  The communication system of the present invention may further comprise transmission data encryption means for encrypting transmission data transmitted via the communication path. As a result, the confidentiality of the data can be ensured as necessary. The service call data may be text data. The service call data may be XML data. As a result, communication can be performed using a structured document format.

  The present invention cuts off communication from an external host in an external network to an internal host in an internal network and selectively transmits the communication from the internal network to the external network from the external network in the environment. A communication method for establishing a communication path to an internal network and performing communication, wherein an electronic signature is applied to communication path maintenance data for maintaining the communication path according to a timing required to maintain the communication path And transmitting from the external host to the internal host.

  According to the present invention, the communication path maintenance data is sent at the timing necessary to maintain the communication path (tunnel), so that the external host in the external network can pass over the firewall and the internal host in the internal network. When a communication path is constructed and communication is performed, a continuous communication path can be maintained. Also, by applying a digital signature to the communication path maintenance data for maintaining the communication path, the connection source can verify the reliability of the connection destination, and the connection destination host can guarantee its own reliability. it can. This can prevent spoofing by a malicious third party. Further, by verifying the signature data included in the communication path maintenance data, it is possible to provide a mechanism for detecting falsification of the communication maintenance data by a malicious third party.

  The communication path maintenance data may include a random value obtained by signing and encrypting a predetermined initial value. The communication method of the present invention may further include a generation step for generating the predetermined initial value when the communication path maintenance data includes a random value obtained by signing and encrypting the predetermined initial value. it can. In the communication method of the present invention, when the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value, communication is performed by generating the random value based on the predetermined initial value at the time of authentication. It may be configured to further include an authentication step for authenticating the other party.

  In the communication method according to the present invention, when the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value, a signature step of applying a signature to the predetermined initial value with a secret key on the transmitting side is performed. Furthermore, it can be set as the structure which has. In the communication method of the present invention, when the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value, the predetermined initial value is encrypted with a public key on the receiving side. Furthermore, it can be set as the structure which has.

  The communication method of the present invention may further include a step of receiving a service call in the internal network and transmitting service call data for the service call to the internal host. Thereby, for example, a service existing on the internal network in the company can be called over the firewall from the external network. The communication method of the present invention may further comprise a step of encrypting transmission data transmitted via the communication path. As a result, the confidentiality of the data can be ensured as necessary.

  According to the present invention, when an external host in an external network establishes a tunnel and communicates with an internal host in the internal network over a firewall, it is possible to maintain a continuous communication path, and A communication system and a communication method that can detect the risk of impersonation or tampering can be provided.

  Hereinafter, the best mode for carrying out the present invention will be described. FIG. 2 is a diagram showing a configuration of a communication system (communication device) according to the embodiment of the present invention. As shown in FIG. 2, the communication system 10 includes an internal host 20 that starts a session and an external host 30 that receives the session. The internal host 20 and the external host 30 are connected via a firewall 40. The communication system 10 includes a firewall 40 that blocks communication from the external host 30 in the external network 35 to the internal host 20 in the internal network 25 and selectively allows communication from the internal network 25 to the external network 35. In the environment, communication is performed by building a tunnel 50 as a communication path from the external host 30 in the external network 35 to the internal host 20 in the internal network 25.

  The firewall 40 has a role of blocking communication from the external network 35 to the internal network 25 via the Internet. On the other hand, communication from the internal network 25 to the external network 35 has a function of selectively passing through. When the firewall 40 selectively permits communication, a filter that passes only packets that are permitted in advance among data packets communicated between the internal network 25 and the external network 35 and blocks other packets. There are cases where processing is performed, and there are cases where only communication via a special application called an application gateway (typically, HTTP Proxy) is permitted. The setting of the filter processing is usually performed by designating the IP (Internet Protocol) address of the transmission source terminal, the IP address of the transmission destination terminal, the type of protocol used, the port number, and the like. The port number is an identifier used for specifying an upper layer process in TCP and UDP (User Datagram Protocol).

  The internal host 20 is connected to an internal network 25 such as an in-house intranet, for example, and transmits a connection request from the internal network 25 to an external host 30 existing in an external network that is an external network 35. The internal host 20 includes an encryption / decryption / signature / verification unit 21, a communication path establishment / maintenance unit 22, and a data relay unit 23. The external host 30 is connected to an external network 35 such as the Internet and accepts a connection request from the internal host 20. The external host 30 includes an encryption / decryption / signature / verification unit 31, a communication path establishment / maintenance unit 32, and a data relay unit 33.

  First, the internal host 20 will be described. The encryption / decryption / signature / verification unit 21 has a function of applying a digital signature using public key encryption to communication data in order to verify / guarante authenticity between connected hosts. Have. Further, the encryption / decryption / signature / verification unit 21 can also ensure the confidentiality of the data by encrypting the transmission data.

  The encryption / decryption units 21 and 31 have a function of encrypting transmission data transmitted via the tunnel 50, and encrypt or decrypt a part of the XML data as necessary. Specifically, the encryption / decryption units 21 and 31 are structured data in which the transmission data is structured. If there is confidential information in the transmission data, the encryption / decryption units 21 and 31 use an encryption technique such as XML encryption. Encrypt only a part (necessary part) of structured data.

  The encryption / decryption / signature / verification unit 21 can further realize encryption tunneling with higher confidentiality of communication contents by further encrypting communication data exchanged in the tunnel 50. By using this encryption tunneling technology, in a packet communication network that is basically based on no connection, a closed virtual network that realizes a highly secure connection link between terminals, that is, a VPN-like function is provided. It becomes possible to do. The data relay unit 23 has a function of relaying data received from the program 37 of the terminal 36 using the established tunnel 50.

  The encryption / decryption / signature / verification unit 31 has a function of encrypting or decrypting transmission data to be transmitted via the tunnel 50. The encryption / decryption / signature / verification unit 31 is structured data in which transmission data is structured. If there is confidential information in the transmission data, the encryption / decryption / signature / verification unit 31 uses an encryption technique such as XML encryption Only a part (necessary part) of encrypted data is encrypted. When the structured data is a SOAP format document, the encryption / decryption / signature / verification unit 31 encrypts only the body portion of the structured data and does not encrypt the header portion. In addition, the encryption / decryption / signature / verification unit 31 has a function of applying an electronic signature using public key encryption to communication data in order to verify / guarante the authentication of the connection destination and the authenticity of the communication contents between the connected hosts. Have

  The encryption / decryption / signature / verification unit 31 applies an electronic signature to part or all of the payload portion of communication. Here, the payload refers to net data excluding management information (header information) such as a destination address and a source address in the total packet size in packet communication. The encryption / decryption / signature / verification unit 31 encrypts a part or all of the payload portion of the communication using a public key according to the importance of the data. It is more preferable that the encryption / decryption / signature / verification units 21 and 31 use a public key certificate issued by a certificate authority instead of the public key.

  The communication channel establishment / maintenance unit 32 establishes the tunnel 50 without encrypting the communication channel with the communication channel establishment / maintenance unit 22 of the internal host 20 using the reverse tunnel technology. The communication path establishment / maintenance unit 32 establishes and maintains a communication path by transmitting and receiving communication data for bidirectional connection.

  In order to maintain the communication path, the communication path establishment / maintenance unit 32 transmits communication path maintenance data for maintaining the tunnel 50 according to the timing necessary to maintain the tunnel 50. This communication path maintenance data includes, for example, NOP (No Operation: one of CPU (Central Processing Unit) instructions) data meaning nothing, and a random value. The communication path establishment / maintenance unit 32 transmits NOP data at an appropriate timing to maintain the connection after the connection is established. For example, the communication path establishment / maintenance unit 32 transmits communication path maintenance data when there is no need to call a service.

  The random value is data obtained by signing and encrypting a hard-to-predict initial value generated by the pseudo-random number generator. The internal host 20 and the external host 30 share initial values by exchanging initial values at the start of communication. Thereafter, the internal host 20 and the external host 30 generate a random value next under the same processing steps based on this initial value, and repeat the same processing, thereby enabling mutual authentication of communication partners.

  Further, the encryption / decryption / signature / verification unit 31 described above authenticates the communication partner by generating a random value based on an initial value at the time of authentication and a function for applying an electronic signature to the communication path maintenance data. A function, a function of signing the initial value with the private key of the transmitting side, and a function of encrypting the initial value with the public key of the receiving side. The communication system 10 may further include a certificate authority that issues a certificate to the public key.

  The data relay unit 33 relays data from the terminal 36 using a tunnel. Further, the data relay unit 33 receives a service call in the internal network 25 and transmits service call data for the service call to the internal host 20. At this time, the data relay unit 33 uses structured text data (for example, XML data) such as SOAP in order to call a service.

  Next, processing of the internal host 20 when establishing the tunnel 50 will be described. FIG. 3 is a processing flowchart of the internal host 20 when the tunnel 50 is established. This is started by communication from the internal host 20 to the external host 30. First, the communication path establishment / maintenance unit 22 of the internal host 20 transmits tunnel establishment request information for establishing a tunnel by HTTP to the external host 30 on the Internet via a proxy server or the like (step S11). If there is no response from the external host (“N” in step S12), the communication path establishment / maintenance unit 22 of the internal host 20 returns to S11. On the other hand, if a response from the external host is received (“Y” in step S12) and the received response is a reset response (“Y” in step S13), it is determined that the tunnel cannot be established and the tunnel is disconnected. (Step S14). On the other hand, if the received response is a normal response (“N” in step S13) and the normal response is a tunnel maintenance response (“Y” in step S15), the tunnel 50 is established. to decide.

  The communication path establishment / maintenance unit 22 of the internal host 20 determines that the tunnel 50 has been established, and if the received response receives data for maintaining the communication path (“Y” in step S15). ]), The tunnel 50 is maintained (step S16), and the process returns to step S12. On the other hand, if the received response is a service call (“N” in step S15), the internal service is called (step S17), and the process returns to step S12. When the communication path establishment / maintenance unit 22 of the internal host 20 receives the reset response, the communication path establishment / maintenance unit 22 determines that it is not necessary to maintain the tunnel establishment, and disconnects the tunnel (step S14).

  Next, processing of the external host 30 when establishing the tunnel 50 will be described. FIG. 4 is a process flowchart of the external host 30 when the tunnel 50 is established. The communication path establishment / maintenance unit 32 of the external host 30 receives the tunnel establishment request (step S21). When the communication path establishment / maintenance unit 32 of the external host 30 determines whether the partner of the tunnel establishment request is a reliable partner, and determines that the partner is an untrusted partner (“N” in step S22), A reset response is sent (step S23).

  The communication path establishment / maintenance unit 32 of the external host 30 performs tunnel establishment processing (step S24) when the partner is a reliable partner (“Y” in step S22 after negotiation). Here, an electronic signature is applied to communication data to be exchanged. By verifying the electronic signature, it is possible to mutually confirm the authenticity of the connected hosts.

  The communication channel establishment / maintenance unit 32 generates a communication channel maintenance response only for maintaining the communication channel so that the session of the communication channel is not disconnected. The communication path establishment / maintenance unit 32 of the external host 30 transmits the generated communication path maintenance response to the internal host 20 (step S25). By transmitting this communication path maintenance response, it is possible to establish and maintain a communication path for calling a service across the firewall 40 or the like. The communication path maintenance data is digitally signed as described above. As a result, a communication path for service call communication can be established and maintained while verifying the authenticity of the connection destination in the connection across the firewall 40 and the like.

  If the communication path establishment / maintenance unit 32 of the external host 30 determines that it is not necessary to maintain the tunnel establishment, it makes a tunnel termination request (step S26). In the case of session hijacking, it can be detected by verifying the communication path maintenance response described above. If a connection disconnection occurs, a reconnection request is transmitted from the internal host 20 at a predetermined time. According to the communication system 10, the external host 30 in the external network 35 crosses the firewall 40 and the internal host 20 in the internal network 25 by sending the communication path maintenance data at a timing necessary to maintain the tunnel 5. It is possible to maintain a continuous communication path when establishing a tunnel between the two and performing communication. As a result, the terminal 36 can continuously send data to the terminal 26 via the data relay unit 33 in the external host 30, the tunnel 50, and the data relay unit 23 in the internal host 20.

  FIG. 5 is a flowchart of the authentication / initial value sharing process. First, the pseudorandom number generator in the internal host 20 on the transmission side generates a pseudorandom number (step S31). This pseudo random number is the initial value. Next, the encryption / decryption / signature / verification unit 21 of the internal host 20 applies an electronic signature to the initial value based on the transmission side secret key (step S32). Next, the encryption / decryption / signature / verification unit 21 of the internal host 20 performs an encryption process on the initial value based on the public key of the external host 30 on the receiving side (step S33). Next, the encryption / decryption / signature / verification unit 21 of the internal host 20 sends the signed and encrypted initial value to the external host 30 (step S34).

  The external host 30 on the receiving side receives the initial value signed and encrypted from the internal host 20 (step S35). The encryption / decryption / signature / verification unit 31 of the external host 30 performs a decryption process on the initial value signed and encrypted with the private key of the external host 30 on the receiving side (step S36). The encryption / decryption / signature / verification unit 31 of the external host 30 performs data verification processing (authentication processing) using the public key of the internal host 20 on the transmission side (step S37). In this way, the initial value can be shared between the internal host 20 and the external host 30 (step S38). In the above description, the pseudo random number generator is provided in the internal host 20 and the initial value is sent to the external host 23. However, the pseudo random number generator is provided on the external host 30 side and the initial value is sent to the internal host 20. May be.

  According to the above communication system, an external host in the external network constructs a tunnel with the internal host in the internal network across the firewall by sending communication path maintenance data at the timing necessary to maintain the tunnel. Thus, when performing communication, it is possible to maintain a continuous communication path. In addition, by applying an electronic signature to the communication path maintenance data for maintaining the tunnel, the connection source can verify the reliability of the connection destination, and the connection destination host can guarantee its own reliability. . Thereby, it is possible to provide a mechanism for preventing spoofing by a malicious third party and detecting tampering of communication contents.

  In addition, even if there is a firewall, it is possible to connect transparently, and it is a communication path that allows two-way communication, and it can be monitored by a network administrator, so there is no need to change the network configuration or firewall system. It is possible to realize access to resources in the internal network protected by such as. Also, the encryption / decryption / signature / verification units 21 and 31 may apply a digital signature using public key cryptography to the communication data and verify the received digital signature on the other side. This makes it possible to detect impersonation, data falsification, and the like. In addition, data confidentiality can be ensured by encrypting the data. As a result, it is possible to verify the authenticity of the connection destination and the integrity of the communication contents in the connection with the firewall or the like interposed therebetween.

  The communication method according to the present invention is realized by the communication system 10. The internal host 20 and the external host 30 are realized by, for example, a microcomputer using a CPU, a ROM (Read Only Memory), a RAM (Random Access Memory), and the like. Each function of the communication method is realized by the CPU executing a predetermined program.

  Although the preferred embodiments of the present invention have been described in detail above, the present invention is not limited to the specific embodiments, and various modifications, within the scope of the gist of the present invention described in the claims, It can be changed.

It is a figure for demonstrating the relationship between the conventional web service and a firewall. It is a figure which shows the structure of the communication system (communication apparatus) which concerns on embodiment of this invention. 5 is a processing flowchart of the internal host 20 when a tunnel 50 is established. 6 is a processing flowchart of the external host 30 when establishing a tunnel 50. It is a flowchart of an authentication and initial value sharing process.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Communication system 20 Internal host 21 Encryption / decryption / signature / verification unit 22 Communication channel establishment / maintenance unit 23 Data relay unit 30 External host 31 Encryption / decryption / signature / verification unit 32 Communication channel establishment / maintenance unit 33 Data relay Part

Claims (23)

The external host in the external network in an environment having a firewall that blocks communication from the external host in the external network to the internal host in the internal network and selectively allows communication from the internal network to the external network. A communication system that performs communication by constructing a communication path from an internal host to an internal host in the internal network,
The external host, transmitting means for transmitting communication path maintenance data for maintaining the communication path to the internal host according to a timing required to maintain the communication path;
An electronic signature means for applying an electronic signature to the communication path maintenance data;
A communication system comprising: The internal host has establishment means for establishing the communication path by transmitting request information for establishing the communication path to the external host and receiving return information of the request information from the external host. 2. The communication system according to claim 1, wherein the communication path is maintained by receiving the communication path maintenance data after receiving the reply information. 2. The communication system according to claim 1, wherein the communication path maintenance data includes information indicating that processing is not required on the internal host side. The communication system according to claim 2, wherein the request information and the reply information are based on a hypertext transfer protocol. 5. The communication system according to claim 1, wherein the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value. The external host further includes pseudo-random number generation means for generating the predetermined initial value when the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value. The communication system according to any one of claims 1 to 5. When the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value, an authentication unit that authenticates a communication partner by generating the random value based on the predetermined initial value at the time of authentication. The communication system according to any one of claims 1 to 6, further comprising: The signing means for signing the predetermined initial value with a secret key on the transmission side when the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value. Item 8. The communication system according to any one of Item 7. When the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value, the communication path maintenance data further includes initial value encryption means for encrypting the predetermined initial value with a public key on the receiving side. The communication system according to any one of claims 1 to 8. The communication system according to claim 9, further comprising a certificate authority that issues a certificate to the public key. The communication system according to any one of claims 1 to 10, further comprising construction means for constructing the communication path using a reverse tunnel technology. The said external host further has a service call reception means which receives the service call in the said internal network, and transmits the service call data for the said service call to the said internal host. Communication system. The communication system according to any one of claims 1 to 12, further comprising transmission data encryption means for encrypting transmission data transmitted through the communication path. The communication system according to claim 12, wherein the service call data is text data. The communication system according to claim 12, wherein the service call data is XML data. The communication from the external network in the external network to the internal host in the internal network is blocked and the communication from the internal network to the external network is selectively passed from the external network to the internal network. A communication method for establishing a communication path and performing communication,
A transmission step of applying an electronic signature to communication path maintenance data for maintaining the communication path according to a timing required to maintain the communication path and transmitting the digital signature from the external host to the internal host. A characteristic communication method. The communication method according to claim 16, wherein the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value. 18. The generation method for generating the predetermined initial value when the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value. The communication method described in 1. When the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value, an authentication step of authenticating a communication partner by generating the random value based on the predetermined initial value at the time of authentication The communication method according to any one of claims 16 to 18, further comprising: The signing step of signing the predetermined initial value with a secret key on the transmission side when the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value. Item 20. The communication method according to any one of Items 19. 17. The method according to claim 16, further comprising the step of encrypting the predetermined initial value with a public key on the receiving side when the communication path maintenance data includes a random value obtained by signing and encrypting a predetermined initial value. Item 21. The communication method according to any one of Items 20. The communication method according to any one of claims 16 to 21, further comprising a step of receiving a service call in the internal network and transmitting service call data for the service call to the internal host. The communication method according to any one of claims 16 to 22, further comprising a step of performing encryption on transmission data transmitted through the communication path.

Images