KR20010017849A - Method of data sending and receiving for supporting a security function in world wide web - Google Patents

Abstract

PURPOSE: A data transceiving method for supporting a security function in a world wide web(www), is provided to respectively apply a proxy supporting a public key encryption system and a common gateway interface(CGI) program to a web browser and a web server used in a www environment based on the Internet, so as to supply the security function in an application program level. CONSTITUTION: A request line, a header and a body included in a first request message are interpreted. Information on a method, hypertext transfer protocol(HTTP) address, HTTP version, security flag and system name is extracted. A key of a server system is obtained to encrypt the information on the method, HTTP address, HTTP version, header, body and random number, and a digital signature is performed. The encrypted information is transmitted to a web server in a second request message type. A request line included in the request message is analyzed to execute a corresponding common gateway interface(CGI) program. Information like a content-length is interpreted, and an environment variable value of a security request is calculated. Information received through the web server is decoded by using a secret key value of the server system. The second request message is encrypted, and the encrypted information is transmitted to the web server. A proxy server receiving the information, status line, content length generated from the CGI program checks a security version and a security response. The information received from the web server is decoded by using a secret key of the proxy server. Information for transmission is established based on the decoded information, and transmitted to a web browser.

Description

Method of data sending and receiving for supporting a security function in world wide web}

The present invention relates to a data transmission and reception method for supporting a security function on the world wide web (www), and in particular, a web browser used in a world wide web environment based on the Internet, and The present invention relates to a method for providing security at an application level by applying a proxy and a common gateway interface (CGI) program supporting a public key encryption method to a web server.

Since the World Wide Web, which is online based on the Internet, has been used, the vast majority of information available on the Web has been transmitted and received as it is, without the need for security. However, companies that want to conduct electronic transactions such as buying and selling goods through the World Wide Web, hospitals, schools, and government agencies that produce important personal information data, and important organizations that send and receive confidential data, appear to Security is essential.

Security technologies available or provided by the World Wide Web include Internet Protocol version 6 (IPv6), Secure Socket Level (SSL), and Secure Hyper Text Transfer Protocol (Secure Hyper). Text Transport Protocol (S-HTTP). They provide security when sending and receiving data at the Internet Protocol (or IP) or socket level. These technologies have a problem that must be supported on both web browsers and web servers. In addition, most web browsers and web servers currently in use include security-related technologies. However, when a web server including security-related technologies is to be used commercially, it is not easy to pay a considerable price and easy to build.

On the other hand, in the case of proxy and CGI programs, even if the above technologies are used, the existing web browser and web server can be used without modification.

Therefore, an object of the present invention is to solve the above problems by providing a security function in the current state without replacing the existing web browser and web server.

In order to achieve the above object, the present invention provides a method for analyzing a request line, a header, and a body included in the first request message at a proxy server that receives the first request message from a web browser, and the method, HTTP from the request line. Extracting information about an address, an HTTP version, a security flag, and a system name; a method of obtaining a key of a server system from a public key based security module, extracted from the request line, an HTTP address and version, header and body information, and arbitrary Encrypting the number and electronically signing as necessary, transmitting the encrypted information to a web server in the form of a second request message, and receiving the second request message from the proxy server in response to the request message. Analyzing the included request line and executing the corresponding CGI program; and listing from the web server Interpreting the information by the CGI program that has received the length information, and obtaining a value of a security request environment variable, and using information received through the web server using a secret key value of a server system according to the value of the security request environment variable. Decrypting the data, encrypting the second request message transmitted from the proxy server, and transmitting the encrypted information to the web server, and information, status line, and list generated from the CGI program through the web server. Checking a security version and a security response in the proxy server having received the length, decrypting the information received from the web server with a secret key of the proxy server, and transmitting the information to the web browser based on the decrypted information; Characterized in that it comprises a step of building and transmitting to a web browser.

1 is an overall block diagram illustrating a method of providing a security function applying a proxy server and a CGI program to a web browser and a web server according to the present invention, respectively.

2 is a flowchart illustrating a data processing process in a proxy server for providing a security function according to the present invention.

3 is a flow chart illustrating in detail the data processing of the proxy server for a request from a web browser according to the present invention.

4 is a flow chart for explaining in detail the data processing of the web server / CGI program for the request from the proxy server according to the present invention.

5 is a flow chart for explaining in detail the processing of the proxy server for the response information from the web server according to the present invention.

<Explanation of symbols for main parts of drawing>

101: web browser 102: proxy server

103 and 106: first and second library toolkit functions

104: Web server 105: CGI program

107: public key based security module

The present invention will be described in detail with reference to the accompanying drawings.

1 is an overall configuration diagram providing a security function by applying a proxy server and a CGI program to a web browser and a web server according to the present invention, respectively.

In general, the web browser 101 receives the information posted on the web server 104 from the web server 104 through a network based on the Internet, and processes the information to be processed according to the web browser 101 environment. It is. At this time, the information exchanged / transmitted between the web browser 101 and the web server 104 is not provided with any security. Of course, when the web browser 101 and the web server 104 support a protocol such as SSL or S-HTTP, it is possible to encrypt the information transmitted using the technology to maintain confidentiality. However, the proxy server 102 and the CGI program 105 may be introduced into the web browser 101 and the web server 104 in the case of not supporting such a technique, respectively, to maintain the security of the transmitted information. By doing so, it is possible to apply and use any of the supported security technologies without depending on the specific product of the web browser 101 or the web server 104. That is, the server system obtains the key of the server system from the public key based security module 107 through the library toolkit function 103 supporting the proxy server 102 and encrypts the data using the same. In addition, the system key is obtained from the public key based security module 107 through the library toolkit function 106 supporting the CGI program 105, and the data is decrypted using the system key. The information received through the web server 104 and the CGI program 105 is decrypted, and data to be sent to the web browser is constructed and transmitted to the web browser 101 through the proxy server 102.

2 is a flowchart illustrating a data processing process in a proxy server for providing a security function according to the present invention, in which a proxy server logs in, sends and receives data between a web browser and a web server, and processes and reconstructs data transmitted and received. A schematic flow diagram for the.

Receives a connection request from a web browser, receives data (201), and logs in to a proxy server (202). The protocol used at this time is the Hyper-Text Transfer Protocol (hereinafter referred to as HTTP / 1.0). An HTTP request is received from the received data and interpreted (203). In order to use the security function of the proxy server, the user logs in to a public key-based security module that performs substantial encryption / decryption using the proxy server, finds the key, encrypts and digitally signs (204), and reconstructs the HTTP request ( 205). Send the reconstructed HTTP request to the web server or receive data from the web server (206). Receive an HTTP response from the web server and interpret it (207). The key is retrieved from the public key based security module, decrypted, and digitally signed (208) to reconstruct the HTTP response (209). The reconstructed HTTP response is transmitted to the user through a web browser (201).

3 is a flowchart illustrating in detail a data processing process of a proxy server for a request from a web browser according to the present invention. The proxy server listens to a request of a web browser on a specific transmission control protocol (TCP) port. At this time, a request of a resource having an HTTP address from the web browser is as follows. ) Can be received. http://reuse.etri.kr/cgi/putsecurity.exe/grim.jpg?security=3. The web browser makes the above request on the HTTP / 1.0 protocol for the user and forwards it to the proxy server. The proxy server receives the full-request for the HTTP / 1.0 protocol defined in RFC1945 through socket communication through the request of the web browser (301). The request line (Linear), the header (Header) and the body (Body) constituting the received Full-Request is interpreted (302). Information about a method, an HTTP address, an HTTP version, a security flag, and a system name is extracted from the request line (303). The security flag value can be found in the HTTP address of the Request-Line, which indicates one of the following: digital signature, public / private encryption, or both. The public key-based security module obtains the key of the server system (304), request-line method, HTTP address and version, header and body information to be received from the web browser, and random number. Number) is encrypted (305). This random number is intended to prevent third parties from intercepting and reusing encrypted information at the intermediate node between the proxy server and the web server. To encrypt the above information, the key value of the server system must be obtained from the authentication server, which can be obtained through the system name of the HTTP address. For reference, the Distinguished Name (DN) value and the public key are registered as the name of the server system. Therefore, the user who has successfully logged in at the proxy server can encrypt the above information by obtaining the public key value of the server system from the authentication server. If a digital signature is required, the decrypted result of the information to be sent is encrypted with its own digital signature secret key and attached with the public key value of the server system. The encrypted information is sent to the web server through socket communication. The TCP port number of the web server is defined in the HTTP address received from the web browser or 80 is used by default. At this time, the request sent to the web server is the request-line method received from the web browser, the relative HTTP address, the content-length of the header, the content-type, and the encryption of the header. Body information. The list length (Content-Length) of the header becomes the length of the body information encrypted above. If this is expressed in HTTP / 1.0 format, it is as follows.

GET SP /cgi/putsecurity.exe/grim.jpg HTTP / 1.0 CRLF

Content-Length: 124 CRLF

Content-Type: application / x-www-form-urlencoded CRLF

Security-Version: 1.0 CRLF

Security-Request: both CRLF

Body Information (*)

4 is a flowchart illustrating in detail a data processing process of a web server / CGI program for a request from a proxy server according to the present invention.

The web server receives the request of the proxy server through the socket communication in accordance with the HTTP / 1.0 protocol defined in RFC1945 (401). The web server analyzes the Request-Line, invokes the corresponding CGI program, passes control to the program, and waits for another web browser to connect (402). The CGI program executed from the web server has the authority to log in to the public key based security module and use its own private key and authentication server system. The login name and password used at this time are stored in the web server system. Then, the CGI program receives information from the web server by content-length and interprets it (403). At this time, to find out how the information received from the web server is encrypted, the value of the security request (Security-Request) environment variable is obtained (404). This flag value indicates either a digital signature, public / private encryption, or both. Decrypting the information transmitted from the web browser through the web server with the secret key value of the server system according to this flag value, and if it is digitally signed, the result obtained by verifying it is stored in the required structure (405). The CGI program finds the requested resource from the web browser among the decrypted information. Finally, the proxy server obtained through the authentication server with the random number generated by the proxy server, the status code, the status code, the reason-phrase, the header information, and the found resource information. Encrypt with a public key of 406. Random numbers are intended to prevent intercepting and reusing this information in the middle. Status-Code and Reason-Phrase are responses from the HTTP protocol to requests from proxy servers. The header contains a location. If a digital signature is required, the resulting value of the above information and its digital signature public key are attached to the back of the information, encrypted with the public key value of the proxy server system, and sent to the web server. The information sent to the web server in HTTP / 1.0 format is as follows.

Content-Type: application / encoded CRLF

Security-Version: 1.0 CRLF

Security-Response: both CRLF

Body Information (*)

(*) It transmits the length defined in Content-Length.

5 is a flowchart illustrating in detail the processing of the proxy server for the response information from the web server according to the present invention.

The proxy server receives information generated by the CGI program, a status line, and a content length from the web server (501). The Status-Line contains the HTTP version and the Status-Code and Reason-Phrase of the results performed by the web server. First, the proxy server checks the security version (Security-Version) and the security response (Security-Response) to check whether the context of the two security programs (Con) is correct (502). Next, the proxy server decrypts the information received from the web server with its private key and stores the obtained result in the required structure if it is digitally signed (503). After checking whether it has been reused by a third party using random numbers among the decrypted information, the proxy server constructs information to be sent to the web browser based on the decrypted information (504) and then complies with the HTTP protocol. In operation 505. The information sent to the web browser in HTTP / 1.0 format is as follows.

HTTP / 1.0 SP Status-Code SP Reason-Phrase CRLF

Location: http://reuse.etri.re.kr/cgi/grim.jpg CRLF

Body Information (*)

(*) It transmits the length of body information that is known in advance.

Finally, the web browser receives full-response according to the HTTP / 1.0 protocol defined in RFC1945 through socket communication from the proxy server and displays the result on the browser screen. This completes one cycle of the security performance model. Another request from the web browser repeats the cycle described above.

As described above, according to the present invention, the proxy server and the CGI program can be applied to the web browser and the web server, respectively, without changing or changing the web browser and the web server, and the security policy level to be provided is applied for each information. Gives you the flexibility to provide. In order to provide security functions in proxy servers and CGI programs, standard API functions are provided using standard application program interface (API) functions proposed as Request For Comment (RFC) of the Internet Expert Task Force (IETF). For the underlying security model, different underlying security models can be used with little change. Therefore, it can be easily applied where it is already installed and using the existing security model that provides API functions to support various and powerful security functions on the web of the Internet.

Claims (2)

Interpreting, by the proxy server, the first request message from the web browser, the request line, header and body included in the first request message; Extracting information about a method, an HTTP address, an HTTP version, a security flag, and a system name from the request line; Obtaining a key of a server system from a public key based security module, encrypting the method, HTTP address and version, header and body information and random number extracted from the request line, and electronically signing as needed; Transmitting the encrypted information to a web server in the form of a second request message; Analyzing a request line included in the request message in a web server receiving the second request message from the proxy server, and executing a corresponding CGI program; Obtaining a value of a security request environment variable after interpreting the information in the CGI program that has received the length information of the list from the web server; Decrypting information received through the web server using a secret key value of a server system according to the security request environment variable value; Encrypting the second request message transmitted from the proxy server and transmitting the encrypted information to the web server; Checking a security version and a security response at the proxy server that has received the information, status line and list length generated from the CGI program via the web server; Decrypting the information received from the web server with a secret key of the proxy server; And building the information to be transmitted to the web browser based on the decrypted information and transmitting the information to the web browser. The method of claim 1, wherein the second request message transmitted from the proxy server to the web server includes a method of a request line received from the web browser, a relative HTTP address, a list length of a header, a list form, and encrypted body information. Data transmission and reception method for supporting a security function on the World Wide Web characterized in that.