JP2019062512A - End-to-end encryption communication system - Google Patents

Abstract

To achieve encryption communication between communication parties on a communication path via an apparatus that relays peer-to-peer communication via a communication apparatus such as a NAT or firewall.SOLUTION: An apparatus for relaying is prevented from decrypting communication contents by establishing a session by SSL/TLS on a program that terminates peer-to-peer communication via a communication apparatus such as a NAT or firewall.SELECTED DRAWING: Figure 1

Description

The present invention relates to encrypted communication between communication parties in communication via an apparatus relaying in a layer higher than the transport layer of the OSI reference model (see Non-Patent Document 1) formulated by OSI (Open System Interconnection). It is intended to prevent the deciphering of the communication contents in the device which performs and relays.

When performing Internet communication in a home LAN (Local Area Network) environment or a LAN environment of various business offices, the IP address and port number can be changed by the Network Address Port Translation (NAPT) function (see Non-Patent Document 2) possessed by the router. It is converted and communication is performed.

In addition, when performing Internet communication from the LAN environment of various business establishments, there are many environments in which the types of communication that can be communicated are restricted by firewall devices.

“The Basic Reference Model of Open Systems Interconnection (OSI)”, ISO / IEC 7 498, 1989 P. Srisuresh, M .; Holdrege, Lucent Technologies, “IP Network Address Translator (NAT) Terminology and Considerations”, RFC 2663, [online], August 1999, [September 27, 2017 search], Internet <https: // tools. ietf. org / html / rfc2663>

In such an Internet communication environment, the party performing peer-to-peer communication is in the transport layer of the OSI reference model, such as TCP (Transmission Control Protocol; see Non-Patent Document 3) or UDP (User Datagram Protocol; see Non-Patent Document 4). A communication path may be established to a device for relaying communication called a relay server or relay agent using a communication protocol located, and communication may be performed via the device for relaying.

On the other hand, SSL / TLS (Secure Socket Layer) / TLS (Transport Layer Security; Non-Patent Document 5, Non-Patent Document 6, Non-Patent Document 6, Non-Patent Document 6, Non-Patent Document 6, Non-Patent Document 6) In Patent Document 7), encrypted communication is performed between programs that terminate communication in the transport layer of the OSI reference model.

When performing peer-to-peer communication via a relaying device, the program which is the communicating party establishes a logical communication session of the transport layer with the relay program on the relaying device. When SSL / TLS is used in this communication, encryption of communication contents is performed between the program which is the communication party and the relay program on the device which relays.

Then, the relay program on the relaying device can decode the communication content and decode the content. Therefore, the party of communication has a potential threat to the person who operates the relay route of communication that the contents of communication can be deciphered.

Defense Advanced Research Projects Agency Information Processing Techniques Office, "Transmission Control Protocol", RFC 793, [online], September 1981, [September 27, 2017 search], Internet <https: // tools. ietf. org / html / rfc793> J. Postel, "User Datagram Protocol", RFC 768, [online], August 1980, [September 27, 2017 search], Internet <https: // tools. ietf. org / html / rfc768> T. Dierks, C.I. Allen, “The Transport Layer Security (TLS) Protocol Version 1.0”, RFC 2246, [online], January 1999, [September 27, 2017 search], Internet https: // tools. ietf. org / html / rfc2246 T. Dierks, E.I. Rescorla, “The Transport Layer Security (TLS) Protocol Version 1.1”, RFC 4346, [online], April 2006, [September 27, 2017 search], Internet <https: // tools. ietf. org / html / rfc4346> T. Dierks, E.I. Rescorla, “The Transport Layer Security (TLS) Protocol Version 1.2”, RFC 5246, [online], August 2008, [search on September 27, 2017], Internet <https: // tools. ietf. org / html / rfc5246>

Means to solve the problem

The present invention, as shown in FIG. 1, is composed of a P2P E2EE client, a P2P E2EE agent, and a relay server.

Prior to communication, the relay server first waits on a specific TCP port.

The P2P E2EE client and P2P E2EE agent present their identifiers to the relay server, establish a logical session using a TCP connection or WebSocket, and perform one-way or two-way communication at any timing Be ready to

The P2P E2EE client is waiting for an external program on the TCP port in the computer 1 and acts as a TCP server.

When a P2P E2EE client receives establishment of a TCP connection from an external program, the P2P E2EE client establishes a pseudo TCP connection to the P2P E2EE agent through the relay server.

The P2P E2EE agent also acts as a TCP client in the computer 2 and establishes a TCP connection to an external server when establishing a pseudo TCP connection. The IP address or host name of this external server or the port number of TCP is assumed to be held in advance by the P2P E2EE agent as a set value, or designated from the relay server when establishing a pseudo TCP connection. Although the external server is located on the same computer as the P2P E2EE agent in FIG. 1, it may be located on another computer.

After the pseudo TCP connection is established between the P2P E2EE client and the P2P E2EE agent, an SSL / TLS session is established on the pseudo TCP connection between the P2P E2EE client and the P2P E2EE agent.

When establishing the pseudo TCP connection described in [0014] to [0015], the P2P E2EE client requests the relay server to establish the pseudo TCP connection by attaching an identifier for identifying the P2P E2EE agent that is the communication partner. . When the P2P E2EE agent is requested by the relay server to establish a pseudo TCP connection, the identifier of the P2P E2 EE client requesting the establishment of the pseudo TCP connection is attached. After establishment of the TCP connection, SSL / TLS handshake is performed between the P2P E2EE client and the P2P E2EE agent at the start of the SSL / TLS session. Each other's legitimacy is mutually confirmed by the 509 format public key certificate. At this time, a public key certificate is provided with a common name field, but a public key certificate having an identifier of a P2P E2EE client or a P2P E2EE agent as a common name is used.

As described above, by establishing a pseudo TCP connection and establishing an SSL / TLS session on it, communication between the P2P E2EE client and the P2P E2EE agent is performed by the relay server that is the relay device. A logical communication path that is difficult to read is established.

Effect of the invention

Even when peer-to-peer communication is performed in an environment where direct peer-to-peer communication is difficult, such as in environments where NAPT and firewall devices intervene, users are not likely to read the communication contents by various relay devices on the relay path. It can communicate.

In an example of a specific implementation of the present invention, as shown in FIG. 2, it is defined as RFC 6455 for establishing a logical communication path from a P2P E2EE client to a relay server and from a P2P E2EE agent to a relay server Use the WebSocket protocol (see Non-Patent Document 8).

WebSocket is a communication protocol that uses HTTP (Hypertext Transfer Protocol; see Non-Patent Document 9) or HTTPS (generally referred to as HTTP over TLS; see Non-Patent Document 10), but P2P E2EE client to relay server, and Communication content from the P2P E2EE agent to the relay server also needs to be protected from eavesdropping and tampering by third parties, so WebSocket communication established from the P2P E2EE client to the relay server and from the P2P E2EE agent to the relay server is HTTPS Use

After the logical communication path using the WebSocket from the P2P E2EE client to the relay server and from the P2P E2EE agent to the relay server is established, the P2P E2EE client and the P2P E2EE agent are each 4. By performing an authentication procedure on the relay server, the relay server can identify each P2P E2EE client and P2P E2EE agent.

In FIG. 2 on the P2P E2EE client. For TCP server and TLS client When a TCP connection is established from an external program, The TCP server / TLS client is also within the P2P E2EE client. Establish a TCP connection to the TCP server and WebSocket client.

TCP connection established 3. The TCP server and WebSocket client are in the relay server 4. 5. In the P2P E2EE agent for the WebSocket server Send a pseudo TCP connection establishment request to the Web socket client and TCP client.

3. From the TCP server and WebSocket client 5. 3. received a pseudo TCP connection establishment request for the Web socket client and the TCP client; The WebSocket server is 5. Send a TCP connection establishment request to the Web socket client and TCP client.

4. 4. In the P2P E2EE agent that has received the pseudo TCP connection establishment request from the WebSocket server The Web socket client and the TCP client are as follows. A response to the establishment of a pseudo TCP connection is sent back to the WebSocket server.

4. WebSocket server is 5. After receiving an answer of successful establishment of the pseudo TCP connection from the Web socket client and the TCP client, 3. A reply of establishment success of the pseudo TCP connection is sent back to the TCP server and WebSocket client.

After successful establishment of the pseudo TCP connection, The TCP server / TLS client performs a handshake performed at the start of the SSL / TLS communication on the pseudo TCP communication channel. Perform for TLS server and TCP client. By this, 2. 6. TCP server and TLS client The TLS server / TCP client can perform the authentication of the communication partner and the negotiation of the encryption algorithm used for the encrypted communication according to the general SSL / TLS communication mechanism.

The session of SSL / TLS communication is 2. 6. TCP server and TLS client If established between the TLS server and the TCP client The TLS server and TCP client Establish a TCP connection to the external server.

The communication procedure described in [0023] to [0029] is shown as FIG.

After completing the above procedure, 1. From an external program The contents of the data sent over the TCP connection to the TCP server / TLS client are transparently From TLS server and TCP client It is transferred to the external server. Also, contrary to this, 7. From an external server The contents of the data sent over the TCP connection to the TLS server and TCP client are transparently From TCP server and TLS client It is transferred to the external program. However, SSL / TLS sessions 6. TCP server and TLS client Since it is established between the TLS server and the TCP client, The WebSocket server can not decipher the communication contents.

I. Fette, Google Inc. A. Melnikov, Isode Ltd. “The WebSocket Protocol”, RFC 6455, [online], December 2011, [September 27, 2017 search], Internet <https: // tools. ietf. org / html / rfc6455> UC Irvine, J.M. Gettys, Compaq / W3C, J.M. Mogul, Compaq, H. Frystyk, W3C / MIT, L.S. Masinter, Xerox, P.I. Leach, Microsoft, T. Berners-Lee, W3C / MIT, "Hypertext Transfer Protocol", RFC 2616, [online], June 1999, [September 27, 2017 search], Internet <https: // tools. ietf. org / html / rfc2616> E. Rescorla, RTFM, Inc. “HTTP over TLS”, RFC 2818, [online], May 2000, [Sept. 27, 2017 search], Internet <https: // tools. ietf. org / html / rfc2818>

The present invention enables encrypted communication between communicating parties in peer-to-peer communication while using an existing communication protocol, and enables peer-to-peer communication without the user having to worry about interception of communication contents by a carrier operating a communication path. Can contribute to

In the present invention, authentication of the communication partner, which is the main point of encrypted communication, and the existing SSL / TLS protocol and X.I. By using a standardized public key certificate mechanism as 509, it is possible to provide the user with a security level equivalent to the existing authentication mechanism and encrypted communication mechanism.

Components for implementing the present invention Elements constituting the best mode for realizing the present invention Communication procedure in the best mode for realizing the present invention

Claims (1)

Communication content is encrypted by establishing an SSL / TLS session between the parties that terminate the communication on the communication path where there are devices relaying peer-to-peer communication in the communication layer above the transport layer of the OSI reference model, and communication is relayed Communication program that prevents the device from deciphering the contents of communication.

Images