JP2003309548A - Communication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication system enabling easy implementation of secure communication environment in the HTTP communication. <P>SOLUTION: A communication system includes a mobile terminal provided with a data generation means which requests a home server to issue a key and generates an encrypted compression data using the key issued based on the request, a header generation means generating an HTTP header against the data generated by the data generation means, and a transmission means adding a predetermined characteristic string to Accept-Encoding and Content- Encoding in the HTTP header generated by the header generation means, to transmit to the home server. The home server is provided with a reception means receiving the data transmitted from the mobile terminal, and decrypts the data using the key after detecting the added predetermined characteristic string in the data received by the reception means. <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

TECHNICAL FIELD The present invention relates to HTTP (Hyp
er Text Transfer Protocol
The present invention relates to a communication system for transmitting data encrypted by a data communication service using the above l) or the like.

[0002]

2. Description of the Related Art Conventionally, PDA (Personal Di)
Each of the mobile terminals compatible with the Internet, such as the Digital Assistant, has a function of connecting to the Internet independently. In addition, it is possible to connect devices compatible with the Internet in the home to each other via switches, hubs, etc., and to connect to the Internet side via routers for home use.

In the home server used in the home network, home computers, electric appliances and the like are IP (I
It has functions such as switches and hubs for connecting to each other via Internet Protocol), a function as a gateway for connecting to the Internet, and a router function for performing address conversion in Internet communication between home and outside the home. In addition, it is a communication device capable of providing a data communication service by HTTP or the like inside and outside the home. In addition, AV such as TV and video
From the cooperation with the equipment, the broadcast wave tuner function and HDD (H
There is also one having a recording function with a storage such as an Ard Disk Drive). Further, the home server is capable of relaying the connection between the home network, which enables the internet compatible devices in the home to be interconnected in the home, and the network outside the home. From the IP address, it is possible to determine whether the home or the home network is accessed from the home or the outside device. The HTTP standard is described in RFC2616.

When performing secure communication (with a security protection function) by HTTP between the mobile terminal and the home server described above via the Internet, the HTTP (Secure) of the application layer referred to in the OSI seven-layer structure model.
Hyper Text Transfer Proto
col), session layer SSL (Secure So)
ccket Layer) and TLS (Transport)
Layer Security, and also IPsec (IP security protocol) in the network layer.
col) and the like were used.

[0005]

In the above-mentioned prior art, security correspondence is made for each layer, and secure communication is possible by using these. For example, HTTP is an extension of the HTTP protocol and uses extended requests and responses for secure communication. Therefore, in order to use it, it was necessary to implement a process for interpreting an HTTP request or response in the server and the client. In addition, SSL, TLS, IPse
c and the like are versatile in that they can be used for communication other than HTTP, and are generally means suitable for security, but these also needed to implement processing for securing each layer.

[0006] These implementations are unlikely to cause a problem in a server having a relatively large amount of resources, but have a problem in that a heavy load is placed on an embedded device such as a home electric device.

[0007]

In order to solve the above-mentioned problems, in-home network devices are connected to transmit and receive predetermined data, and network devices outside the home are connected via the Internet to transmit and receive data. And a connection means for connecting to the home server inside the home and to the home server outside the home via the Internet, and requesting the home server to issue a key. Then, a data creating means for creating encrypted compressed data using a key issued based on this request, and an HT for the encrypted compressed data.
Header creating means for creating a TP header, and the HTTP
Accept-Encoding and / or C of header
A mobile terminal having a transmitting means for adding a specific character string to the present-Encoding and transmitting the encrypted compressed data to the home server via the connecting means, wherein the home server is ,
Receiving means for receiving the encrypted compressed data transmitted from the mobile terminal, and detecting means for detecting that the specific character string is added to the encrypted compressed data received by the receiving means, There is provided a communication system comprising: a decrypting unit that decrypts the encrypted compressed data by using the key when the specific character string is detected by the detecting unit.

[0008] Further, a home server for connecting network devices in the home to send and receive predetermined data, and to connect network devices outside the home to send and receive data via the Internet, and the home in the home. A communication system having a mobile terminal connected to a server and capable of connecting to the home server via the Internet outside the home, wherein the home server issues a key issuance request from the mobile terminal. Data creating means for creating encrypted compressed data using a key issued based on the above, and HT for the encrypted compressed data.
Header creating means for creating a TP header, and the HTTP
Accept-Encoding and / or C of header
and a transmitting means for transmitting the data to the mobile terminal by adding a specific character string to the ontent-encoding, the mobile terminal receiving means for receiving the encrypted compressed data transmitted from the home server. A detecting unit that detects that the specific character string is added to the encrypted compressed data received by the receiving unit; and the key that is detected when the specific character string is detected by the detecting unit. And a decryption means for decrypting the encrypted compressed data by using the decryption means.

[0009]

DETAILED DESCRIPTION OF THE INVENTION A communication system according to the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing the configuration of a home network and a network outside the home, such as the Internet, which constitute a communication system according to the present invention. According to the figure, first, a personal computer 101, a television 10
2, video 103, DVD (Digital Vers)
file disc 104) and the like are present. On the other hand, as a mobile terminal, the PDA 105, DVC (Digi
tal Video Camera) 106, DSC
(Digital Still Camera) 107
And so on. At home, these are interconnected by a home server 131. Then, the mobile terminal P
The DA 105, DVC 106, and DSC 107 can be connected to the home server 131 from outside the home by using the Internet connection function of each mobile terminal, not only in the home. That is, the PDA 105 ', DVC 106', D which are mobile terminals taken out of the home.
The SC 107 'has a function of independently connecting to the Internet, and by utilizing this, an environment capable of communicating with the home server 131 from outside the home can be constructed.

When the mobile terminal brought out of the home has the Internet connection function to connect to the home server 131 from outside the home to perform secure communication by HTTP, data transmitted by HTTP is encrypted to communicate. Data confidentiality can be maintained. Further, as for the description indicating encryption, since the Encoding header related to HTTP data compression transfer and the like is used, compression can be performed together with encryption. Further, as an encryption means, DES (Data Encryption Sta) whose algorithm is open to the public is used.
ndard), 3DES, AES (Advanced)
It is easy to use a common key encryption method such as Encryption Standard). In these common key encryption methods, the home server 131 and the mobile terminal need to share the key information, so that the key is shared at home. However, the encryption method shown here is not particularly limited. Further, in order to connect to the home server 131 from outside the home, the I
It is necessary to obtain the domain name for specifying the P address or IP address. The IP address of the server operated as the home server 131 is fixedly assigned to the home server, or the IP address is Dynamic.
DNS (Dynamic Domain Name)
In some cases, it can be obtained from the domain name using System). Further, when the IP address is fixed, the IP address is acquired, and when it is indefinite, the IP address is acquired from outside the home and the domain name for identifying the home server 131 is acquired inside the home.

FIG. 2 is a diagram showing an outline of the key sharing at home and the mobile terminal accessing the home server from outside the home. PDA201, DVC202, DSC20 as mobile terminals connected to home server 211 at home
There are three. These mobile terminals can be accessed from outside the home by HTT.
The home server 211 ′ is accessed by P communication to apply for registration of a key for data encryption and for obtaining an IP address or domain name for specifying the home server 211 ′ on the Internet. The home server 211 issues a key for encrypting the data to be transmitted, and the home server 211 and the mobile terminals (PDA 201, D
Each of the VC 202 and DSC 203) stores the key. Then, the mobile terminal (PD
When the A201 ', DVC202', DSC203 ') access the home server 211' via the Internet, the mobile terminals (PDA201 ', DVC202', D)
When the SC 203 ') determines that it is necessary to encrypt the data with the key, it makes an HTTP method request to the home server 211' by using the key to encrypt and compress the data to be transmitted.

On the other hand, from the home server 211 ', if there is data, an encrypted and compressed response is returned to the mobile terminal. By performing this encryption / decryption process in the HTTP layer, the user can exchange encrypted and compressed data without being aware of it. Note that this means is characterized in that encrypted communication is performed only within the HTTP range.

The home server 211 'and the mobile terminal (PDA
Each of 201 ', DVC202', and DSC203 ') needs to implement a mechanism capable of encrypting data based on key information in HTTP communication. DE
The use of encryption methods such as S, 3DES, and AES is configured so that it can be called as a module, and which of these modules is selected is the home server 21.
If 1'is common to the mobile terminal, it is implementation-dependent. With this configuration, it is possible to cope with the existing system by a slight modification such as the addition of the call processing of the encryption module. Here, from the mobile terminal to the home server 21
An example of connecting to 1'to perform secure communication will be described with reference to FIG.

The WWW browser 301 installed in the mobile terminal sends a request by the HTTP method to HTTP c.
Perform on client 302. HTTP clien
At t302, if the HTTP method request includes data, cr is performed by using the key registered in advance.
Requests encryption of data from the ypt library 303. After that, TCP (Transmissi)
on Control Protocol) 304, IP
The request reaches the home server via the layer 305.

On the other hand, in the home server, IP311, TC
HTTP server3 via P312 layer
13 is the HTT from the WWW browser 301 of the mobile terminal
Receive P method request. If the request contains data, use the key registered in advance
Request the t library 314 to decrypt the data. When the response to the HTTP method request includes data, the HTTP server31
3 uses the key registered in advance to perform crypto l
Request the encryption of data from the ibury 314. After that, the response reaches the mobile terminal via the layers of TCP312 and IP311. IP30 for mobile terminals
5. HTTP CLI via TCP 304 layer
ent 302 receives the response from the home server. When the response includes data, the cryptographic library 303 is requested to decrypt the data by using the key registered in advance. After that, the data is W
By returning to the WW browser 301, the response process to the HTTP method request is completed.

When performing secure communication by HTTP between the mobile terminal and the home server, the unit for encrypting the data by the key is the directory (or file) unit of the file system on the home server. Files (data) contained under the specified directory will be encrypted and compressed with the same key before being sent. FIG. 4 is a configuration diagram showing key registration and file (data) encryption.

At home, the mobile terminal 401 applies for key registration to a directory under "/ usr / private1" of the directory published by the HTTP server of the home server 402. The mobile terminal 401 and the home server 402 are connected by TCP / IP at home, and the existing HTT is connected between the home networks.
Apply for key registration by specifying the directory using P communication. The mobile terminal 401 obtains the "key 1" for the specific directory by issuing a key from the home server 402 in response to the key registration application. By storing this key 1 as a file in the mobile terminal 401 and holding it, the HTTP client in the mobile terminal 401 is ready for encryption / decryption. Note that the key is generated by the home server 402 based on the application information from the mobile terminal 401 operated by the user. In addition, the home server 402 before key registration and the like can handle encrypted compressed data in addition to handling uncompressed data that is normal HTTP communication and unencrypted compressed data. Becomes Then, for the directory where the key is registered,
Appropriate Acc which means that encrypted compressed data can be handled
When an HTTP method request including an ept-Encoding header comes, an appropriate Content-Encoding that means that it also includes encrypted compressed data is sent.
When an HTTP method request including a header is received, HT
HT between the home server 402 ′ and the mobile terminal 401 by encrypting and compressing the data exchanged by the TP server.
Enables secure communication by TP. In addition, improper Accept-Encodi is set for the key-registered directory of the home server 402 ′ after key registration.
HTTP method request with ng header or Acc
When an HTTP method request without ept-Encoding arrives, it is possible to restrict access by returning a response indicating failure to the request. Also, even if the data is transmitted, the HTT without the key
The P client cannot decrypt the received encrypted compressed data, so the HTTP client cannot use the HTTP compressed data.

FIG. 5 shows an example of the structure of the HTTP header in the case of making a request and response by the HTTP method in a mobile terminal outside the home with a home server that sends encrypted data. Here, Ac is used to specify the encryption compression key.
As a character string used in accept-Encoding, "gzip-210151247233" is used.

The mobile terminal has an HTT including Accept-Encoding for permitting encrypted compressed data.
When the P method request 501 is sent, the home server encrypts and compresses the data transferred as a response to the request, and the H including Content-Encoding
The TTP method response 502 is sent. On the other hand, when the HTTP method request 503 that does not permit the encrypted compressed data is sent, the home server does not send the data as a response to the request, but sends the HTTP method response 504 indicating an error.

Next, FIG. 6 shows a sequence diagram when the mobile terminal issues a data acquisition request to the home server and when the mobile terminal issues a data transmission request to the home server. When the mobile terminal issues a data acquisition request to the home server, the mobile terminal is in a state in which the WWW browser can browse the Internet content. From a WWW browser to a URL (Uniform R
The data acquisition is requested by designating the resource Locators (step S101). It is judged from the domain name or IP address whether or not the specified URL is a connection to a home server whose key is registered in advance at home (step S).
102). When the specified URL is a connection to the home server where the key is registered and the area (directory), Accept-Encoding is added to the header when the HTTP method request is sent from the mobile terminal to the home server to allow the encrypted compressed data. A request is issued (step S103).

On the other hand, in the home server which receives the HTTP method request from the mobile terminal, the Accept-Enc
Coding is added to the header of the HTTP method response in response to a request that permits reception of encrypted compressed data
Content-Encoding is added and the encrypted compressed data is transmitted to the request source (step S104).

When the mobile terminal receives the encrypted compressed data from the home server, the mobile terminal decrypts the encrypted compressed data using the registered key (step S105) so that it can be used like normal data. To do. Also, Accept
-Request or Accept without Encoding added-
When it is determined that the corresponding character string is not included in the Encoding (not shown), an error is returned and the data is not transferred (not shown).

When the mobile terminal issues a data transmission request to the home server, the mobile terminal is set to a state in which the Internet content can be browsed by the WWW browser.
The WWW browser specifies the URL and requests the data transmission (step S151). And the specified URL
Determines from the IP address or domain name whether it is a connection to a home server whose key has been registered in advance at home (step S152). When the specified URL is a connection to the home server in which the key is registered and the area (directory) is specified, the HTT from the mobile terminal to the home server
Content-Enco in header when requesting P method
ding is added and the encrypted compressed data is transmitted (step S153).

On the other hand, in the home server which receives the encrypted compressed data and the HTTP method request from the mobile terminal, C
When a request that is encrypted and compressed by the ontent-encoding is made to the area to be encrypted and transferred by the registered key, the data is decrypted by using the registered key (step S154), the data is accepted by the server. Further, a response to the accepted request is sent to the requesting mobile terminal (step S155).

The mobile terminal can acquire the state of sending the encrypted compressed data by receiving the response from the home server (step S156). By these operations, secure communication using HTTP is performed between the mobile terminal and the home server. Note that Accept-
Encoding header, Content-Encod
For the character string indicating Encoding included in the ing header, an appropriate character string that does not affect other systems shall be used.

[0026]

As described above, according to the communication system of the present invention, when the client side does not permit the encrypted compressed data, the server side does not have to transfer the data. Even if it can be received, the encrypted compressed data cannot be decrypted, so the encrypted compressed data is treated as error data. As a result, it is possible to easily support an existing system with only a few improvements and to easily construct an environment for secure communication in HTTP communication.

[Brief description of drawings]

FIG. 1 is a block diagram showing an embodiment of a communication system according to the present invention.

FIG. 2 is a diagram showing an example of encryption by a key applied to the communication system according to the present invention.

FIG. 3 is a block diagram showing how the communication system according to the present invention is connected to the home server from outside the home.

FIG. 4 is a block diagram showing a state of designation of an encryption area applied to the communication system according to the present invention.

FIG. 5 is an HTT applied to a communication system according to the present invention.
It is a figure which shows an example of a P header.

FIG. 6 is an access sequence diagram of encrypted compressed data between a mobile terminal outside the home and a home server applied to the communication system according to the present invention.

Claims (2)

[Claims] 1. A home server for connecting a home network device to send and receive predetermined data, and to connect a network device outside the home via the Internet to send and receive data, and the home in the home. While connecting to the server,
Connection means for connecting to the home server via the Internet outside the home, and a request for issuing a key to the home server, and using the key issued based on this request to generate encrypted compressed data Data creating means for creating, header creating means for creating an HTTP header for the encrypted compressed data, and Acc of the HTTP header
ept-Encoding and / or Content-
A mobile terminal having a transmission unit that adds a specific character string to Encoding and transmits the encrypted compressed data to the home server via the connection unit, wherein the home server is the Receiving means for receiving the encrypted compressed data transmitted from a mobile terminal; detecting means for detecting that the specific character string is added to the encrypted compressed data received by the receiving means; A decryption unit that decrypts the encrypted compressed data using the key when the specific character string is detected by the detection unit. 2. A home server that connects a home network device to send and receive predetermined data, and also connects a network device outside the home via the Internet to send and receive data, and the home in the home. While connecting to the server,
A communication system having a mobile terminal capable of connecting to the home server via the Internet outside the home, wherein the home server is issued based on a key issuance request from the mobile terminal. A data creating unit that creates encrypted compressed data using a key; a header creating unit that creates an HTTP header for the encrypted compressed data;
Accept-Encoding of TTP header and /
Or a transmitting means for transmitting the data to the mobile terminal by adding a specific character string to Content-Encoding, the mobile terminal receiving the encrypted compressed data transmitted from the home server. Means, detecting means for detecting that the specific character string is added to the encrypted compressed data received by the receiving means, and the key for detecting the specific character string by the detecting means. And a decryption unit for decrypting the encrypted compressed data by using the communication system.