JP3701866B2 - Relay device, communication terminal, and server device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a relay device that relays encrypted communication, and a communication terminal and server device that perform encrypted communication via the relay device.
[0002]
[Prior art]
As a client of a WWW (World Wide Web) server on the Internet, software called an Internet browser is widely used. A user can browse HTML (Hyper Text Markup Language) data on the WWW by accessing a WWW server on the Internet using a browser. The main communication protocol of the upper layer used for browsing content is HTTP (Hyper Text Transfer Protocol), and the browser has a function for realizing data communication according to HTTP.
[0003]
Also, in the Internet WWW service, a technique for realizing secure encrypted communication has been proposed and put into practical use, and SSL (Secure Sockets Layer) is widely used as one of such techniques. SSL is included in HTTPS (HTTP extended protocol) installed in major Internet browsers, and a user can safely use content on a WWW server corresponding to HTTPS using HTTPS. Encrypted communication using SSL (hereinafter referred to as SSL communication) is a client / server type communication. At the start of SSL communication, server authentication (and client authentication) and encryption method are determined in order. Depending on the level of security required, client authentication is not essential.
[0004]
In recent years, a service has been started in which a mobile phone is equipped with a browser and can access a WWW server on the Internet via a mobile communication network. In this system, when the mobile phone receives the HTML data provided by the WWW server on the Internet, the mobile phone interprets and executes the HTML data, and generates a user interface according to the HTML data. Provided against.
[0005]
The system is rapidly spreading, and the types of services provided in the system are rapidly increasing. Among these services are services that require high security, such as a service for operating one's bank account from a mobile phone, and HTTPS is also implemented in the browser of the mobile phone accommodated in the above system. ing.
[0006]
As SSL communication in the above system, data exchanged between a gateway server that connects the Internet and a mobile communication network and an IP (Information Provider) server that provides information to a user is encrypted, Server-to-server SSL communication is provided in which data exchanged with a mobile phone is kept in plain text. That is, in the above system, encryption / decryption is performed in the gateway server.
[0007]
[Problems to be solved by the invention]
As described above, a system that can use the Internet WWW service from a mobile phone equipped with a browser is rapidly spreading. As a business operator of the system, in order to realize various services, many technologies Specific options need to be presented. One possible option is end-to-end SSL communication. The end-to-end SSL communication is a communication method for encrypting data to be exchanged in the entire section between one end (mobile phone) and the other end (IP server) of the communication path. That is, the gateway server does not terminate encryption in end-to-end SSL communication. If this communication method can also be used, the range of services that can be provided by the above system is expanded.
[0008]
By the way, in the mobile phone of the above system, the browser is stored in an internal ROM (Read Only Memory). Therefore, it is impossible to update the encrypted communication program that enables SSL communication via the communication network. In addition, the number of users of the above system is enormous, and even if the encrypted communication program can be updated via the communication network, the amount of processing becomes enormous, which may cause inconvenience during the transition period.
[0009]
For example, in the above system, the gateway server adds a UID (user ID) that can uniquely identify a mobile phone in the mobile communication network to the HTTP header and notifies the IP server, and the information corresponding to the UID is sent from the IP server. A service that is provided by server-to-server SSL communication has already been implemented. However, if such a service is used from a mobile phone that supports end-to-end SSL communication, the UID cannot be notified to the IP server. Because the mobile phone cannot grasp the SSL communication between the ends in advance whether the IP server wants the server-to-server SSL communication, it is forced to start communication with the SSL SSL communication with higher safety and the SSL between the ends. This is because, in communication, since the encryption is not released in the gateway server, it is impossible for the gateway server to change the HTTP header.
[0010]
Of course, it is conceivable to change the system on the IP server side so as to authenticate the user by SSL client authentication, but it is practically difficult to change the system of a large number of IP servers all at once. Although it is conceivable to add a UID to the HTTP header in a mobile phone, there is a possibility that the UID modified by the user may be notified to the IP server, and there is a problem that the reliability of user authentication is lacking. Alternatively, it may be possible to prepare a table of IP servers that desire SSL communication between servers in the mobile phone and select the SSL communication method with reference to this table, but the specification of the IP server has been changed. In some cases, it is necessary to update the tables in all mobile phones, which is unrealistic.
[0011]
The present invention has been made in view of the circumstances described above, and includes a communication terminal (or server device) that supports only server-to-server encrypted communication and a communication terminal (or server device) that also supports end-to-end encrypted communication. It is an object of the present invention to provide a relay device, a communication terminal, and a server device that can provide appropriate encrypted communication without significant system changes even in a mixed environment.
[0012]
[Means for Solving the Problems]
In order to solve the above-described problem, the relay device according to claim 1 receives content corresponding to the content of an access request transmitted from a communication terminal in a communication network from a server device outside the communication network, and Information indicating whether or not notification of identification information that can identify the communication terminal in the communication network is required for access by the communication terminal with respect to preset content in the relay device that performs relay processing to be transmitted to the communication terminal A first encrypted communication method for transmitting and receiving plaintext data between the storage unit storing the data and the communication terminal, and a second for performing encrypted communication directly between the communication terminal and the server device. A relay side selection unit that selects one of the encrypted communication methods, and a relay unit that performs the relay processing according to the encrypted communication method selected by the relay side selection unit. When the content of the access request indicates that the content requiring notification of the identification information is to be accessed by the second encrypted communication method, the relay side selection unit selects the first encrypted communication method. The relay unit transmits an instruction to switch to access according to the first encrypted communication method to the communication terminal that is the transmission source of the access request.
[0013]
Further, in the relay device, the storage unit further stores information related to the encrypted communication set in the preset content, and the relay side selection unit notifies the identification information of the content of the access request. When indicating that access is made to content that is not required, an encrypted communication method may be selected based on the content of the access request and information related to the encrypted communication set in the content (claim) Item 2).
[0014]
Each of the relay devices further includes an authentication necessity identifying unit that identifies whether or not the communication terminal needs to be authenticated for the content according to the content of the access request, and the relay side selecting unit performs the first encryption. When the communication method is selected and the authentication necessity identifying unit identifies that the content according to the content of the access request requires authentication of the communication terminal, the relay unit includes the content. (Claim 3), the storage unit stores information indicating whether or not authentication of the communication terminal is required for accessing the preset content by the communication terminal Then, the first encryption communication method is selected by the relay side selection unit, and the content according to the content of the access request authenticates the communication terminal. When, the relay unit may be configured to send alerts to the server device having the content (claim 4).
[0015]
Further, in each of the relay devices, when the content according to the content of the access request is not included in the preset content, the relay side selection unit performs an encrypted communication method according to the content of the access request. May be selected (Claim 5).
[0016]
In order to solve the above-described problem, the relay device according to claim 6 receives content corresponding to the content of the access request transmitted from the communication terminal in the communication network from the server device outside the communication network, and In a relay apparatus that performs relay processing to be transmitted to a communication terminal, whether or not notification of identification information that can identify the communication terminal in the communication network is required for content corresponding to an access request transmitted from the communication terminal is identified A first encrypted communication method for transmitting and receiving plaintext data between the identification information necessity identifying unit and the communication terminal, and direct encrypted communication between the communication terminal and the server device. A relay-side selecting unit that selects one of the second encrypted communication methods, and a relay unit that performs the relay processing according to the encrypted communication method selected by the relay-side selecting unit. When the content of the access request indicates that the content requiring notification of the identification information is accessed by the second encrypted communication method, the relay side selection unit selects the first encrypted communication method, The relay unit transmits an instruction to switch to access according to a first encrypted communication method to the communication terminal that is the transmission source of the access request.
[0017]
In order to solve the above-described problem, a communication terminal according to claim 7 is a communication terminal that accesses content existing in a server device outside a communication network to which the terminal belongs, via the relay device. Between the first encrypted communication method for transmitting and receiving plaintext data and the second encrypted communication method for performing encrypted communication directly with the server device. A terminal-side selection unit that selects the content, a transmission unit that transmits an access request to the content in accordance with the encrypted communication method selected by the terminal-side selection unit, and a reception unit that receives an instruction from the relay device When the receiving unit receives an instruction to switch to access according to the first encrypted communication method, the terminal side selecting unit selects the first encrypted communication method.
[0018]
Further, in the communication terminal, when the content to be accessed by the second encrypted communication method requires the authentication of the own terminal and the authentication of the own terminal cannot be obtained, the transmitting unit transmits to the server device. A warning may be transmitted (claim 8). Further, in each of the communication terminals, the own terminal may be a mobile phone (claim 9).
[0019]
  In order to solve the above-described problem, the server device according to claim 10 is:A storage unit that stores content, an authentication unit that authenticates a communication terminal that is a request source when a communication terminal is requested to start encrypted communication via a relay device, and the communication terminal A control unit that executes an encrypted communication process of reading out the content corresponding to the access request transmitted from the communication terminal from the storage unit and returning the encrypted content when the authentication is performed by the control unit. When a first warning indicating that communication cannot be performed directly with the communication terminal because communication is terminated by the relay device is transmitted from the relay device, or Since the communication with the communication terminal is direct, a second warning indicating that the authentication unit cannot acquire an identifier for authenticating the own terminal from the relay device is When transmitted from the end, in response to an access request transmitted from the communication terminal only for a predetermined content among the contents stored in the storage unit instead of the encrypted communication process It is characterized by executing a security ensuring process of encrypting and returning.
[0020]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the drawings.
A: Configuration
(1) Overall configuration
FIG. 1 is a diagram showing a configuration of a mobile packet communication system using a gateway server (relay device) GWS according to an embodiment of the present invention. This mobile packet communication system is constructed on a system that allows the mobile phone MS to use the WWW.
[0021]
In the figure, mobile phones MS1 and MS2 are mobile phones that receive a packet communication service of a mobile packet communication network MPN, and are wirelessly connected to the mobile packet communication network MPN and a mobile phone network (not shown). The mobile phones MS1 and MS2 have the same hardware configuration, and are hereinafter referred to as a mobile phone MS when they are not distinguished from each other. The functional difference between the mobile phone MS1 and the mobile phone MS2 will be described later. The mobile telephone network is a network that provides a general mobile telephone call service, and the mobile phone MS can receive the call service.
[0022]
The mobile packet communication network MPN is composed of a plurality of base stations BS, a plurality of packet subscriber processing devices PS, a gateway server GWS, and a communication line connecting them. The base stations BS are arranged at predetermined intervals obtained by dividing the ground within a range of a radius of 500 m, for example, and perform radio communication with the mobile phone MS located in the radio zone formed by each. The packet subscriber processing device PS is a computer system provided in a packet subscriber switching center that accommodates a plurality of base stations BS. The packet subscriber processing device PS receives a packet switching request from the mobile phone MS, and receives the received packet as another packet subscription. Relay to the destination mobile phone MS via at least one of the person processing device PS and the subordinate base station BS. The packet subscriber processing device PS relays a packet between the mobile phone MS and the gateway server GWS.
[0023]
The gateway server GWS is a computer system provided in a mobile packet gateway relay switching center for interconnecting the mobile packet communication network MPN and other networks such as the Internet INET. Relay and so on. Here, the conversion of the communication protocol specifically refers to mutual conversion between the transmission protocol for the mobile packet communication network that the mobile packet communication network MPN follows and the transmission protocol that the Internet INET follows.
[0024]
The transmission protocol conforming to the Internet INET includes TCP / IP (Transmission Control Protocol / Internet Protocol) of the network layer and the transport layer and a protocol such as HTTP realized on the TCP / IP. The transmission protocols that the packet communication network MPN follows include a protocol (TL) that is a simplified version of TCP / IP and a protocol (AL) that is equivalent to HTTPS. That is, the mobile phone MS accesses the Internet INET on the AL. The “HTTPS” includes an SSL function. SSL is composed of two layers, in which data delivery and compression are performed in the lower layer, and authentication and various negotiations are performed in the upper layer. In SSL communication, server authentication is performed during negotiation, and data exchange is further performed.
[0025]
The maintenance terminal MT is a terminal for maintaining and managing the gateway GWS, and is configured by a general computer system. The maintenance terminal MT is operated by the administrator of the gateway GWS, and transmits instructions, data, and the like to the gateway GWS in accordance with this operation.
[0026]
IP servers (distribution devices) W1 to W3 are servers connected to the Internet INET, and provide a WWW service to clients using the WWW. The IP servers W1 to W3 have the same hardware configuration, and are hereinafter referred to as IP servers W unless they are distinguished. When receiving the HTTP GET request via the Internet INET, the IP server W returns the content specified by the URL included in the GET request. The functional differences between the IP servers W will be described later.
[0027]
Note that the communication relay provided by the gateway server GWS includes a proxy mode that involves rewriting a packet header and a tunneling mode that does not refer to the packet contents. In the proxy mode, when the gateway server GWS receives a message (hereinafter referred to as a GET message) using the HTTP GET method from the mobile phone MS, the gateway server GWS checks a URL (Uniform Resource Locator) included in the GET message, and the URL is the Internet. If the URL is a general URL on the INET, the GET message is transferred to the Internet INET, and a response transmitted from the Internet INET in response to the GET message is returned to the mobile phone MS. That is, the proxy mode gateway server GWS functions as a so-called proxy server. In the tunneling mode, the gateway server GWS is not involved in data transmitted / received over the connection between the mobile phone MS and the IP server W. That is, the gateway server GWS in the tunneling mode functions as a simple router. Note that the gateway server GWS itself switches between the above modes.
[0028]
(2) Configuration of main parts
(2-1) Configuration of mobile phone MS
FIG. 2 is a block diagram showing a hardware configuration of the mobile phone MS.
As shown in this figure, a mobile phone MS includes a transmission / reception unit (for example, having an antenna, a radio unit, a transmitter, a receiver, etc.) 21 that performs radio communication with a base station BS, and a sound collection unit for inputting sound. (For example, a microphone) 22, a sound generation unit (for example, having an amplifier or a speaker) 23 for sound generation, an input unit 24 having a keypad or the like for performing input operations such as numeric input and character input, display of a predetermined size A liquid crystal display 25 having a region and a control unit 26 for controlling these units are incorporated.
[0029]
The control unit 26 includes a CPU (Central Processing Unit) 261 that performs various controls, software such as a browser and an SSL communication processing program executed by the CPU 261, and a ROM 262 that stores information necessary for connection with the gateway server GWS, A flash memory 263 for storing various types of information is built in. When a power supply (not shown) is turned on, the CPU 261 reads out and executes the software stored in the ROM 262, and executes the ROM 262, the flash memory 263, each unit 21-1. 25 is controlled. The SSL communication processing program differs between the mobile phone MS1 and the mobile phone MS2.
[0030]
In the mobile phone MS, the CPU 261 reads the browser stored in the ROM 262 and executes the browser, whereby the home URL stored in the ROM 262 (the content position on the gateway GWS to be accessed first) is displayed using normal HTTP. Access is made, HTML data on this URL is acquired, and an interactive screen is displayed on the liquid crystal display 25 based on this data. The user (subscriber of the mobile packet communication network MPN) starts using the WWW from this menu screen and acquires desired information from the desired IP server W.
[0031]
(2-2) Configuration of gateway server GWS
FIG. 3 is a block diagram showing a hardware configuration of the gateway server GWS.
As shown in this figure, the gateway server GWS includes a communication device 31 for communicating with a mobile phone MS via a base station BS and a packet subscriber processing device PS, an IP server W via the Internet INET, etc. For connecting an Internet connection interface 32 for communication with a computer, a storage device (for example, a semiconductor disk or a hard disk) 33 rewritably storing a basic program, an SSL setting table T described later, and the like, and a maintenance terminal MT A maintenance terminal connection interface 34 and a control unit 35 for controlling the above-described units.
[0032]
The control unit 35 includes a CPU 351 that performs various controls, a ROM 352 that stores a control program executed by the CPU 351, and a RAM 353 that is used as a work area of the CPU 351, and the CPU 351 stores the control stored in the ROM 352. The aforementioned functions are realized by reading and executing the program, controlling the ROM 352, RAM 353 and the units 31 to 34, and further reading and executing the basic program stored in the storage device 33.
[0033]
(2-3) Configuration of IP server W
FIG. 4 is a block diagram showing a hardware configuration of the IP server W.
As shown in this figure, the IP server W has an Internet connection interface 41 for performing communication with the gateway server GWS via the Internet INET, a storage device in which various contents, an SSL communication processing program, and the like are stored in a rewritable manner. (For example, a semiconductor disk or a hard disk) 42 and a control unit 43 for controlling them are included. Note that the SSL communication processing program differs between the IP server W1 and the IP server W2, and does not exist in the IP server W3.
[0034]
The control unit 43 includes a CPU 431 that performs various controls, a ROM 432 that stores a control program executed by the CPU 431, and a RAM 433 that is used as a work area of the CPU 431. The ROM 432, the RAM 433, and the units 41 to 42 are controlled by reading and executing the program. Further, the control unit 43 has a function of realizing SSL communication with the client by reading and executing the SSL communication processing program stored in the storage device 42.
[0035]
(3) Functions of main parts related to SSL communication
(3-1) Functions of mobile phone MS1
FIG. 5 is a flowchart showing the flow of SSL communication start processing performed by the mobile phone MS1, and the CPU 261 of the control unit 26 executes the SSL communication processing program stored in the ROM 262, thereby realizing the processing shown in FIG. The communication processing program is a program compliant with a version of HTTP (herein referred to as “HTTP / 1.0”) that supports only server-to-server SSL communication as feasible SSL communication, and can be implemented by the mobile phone MS1. SSL communication is only server-to-server SSL communication.
[0036]
As shown in this figure, at the start of SSL communication, the mobile phone MS1 requests a GET request message (for example, “GET https: // ... HTTP / 1.0”) requesting SSL communication with the IP server W having a desired URL. Is transmitted to the gateway server GWS and the response message is received (steps SA1 and SA2). If this response message is a message that “SSL communication is not possible because the server has not been authenticated”, the mobile phone MS1 disconnects the connection for SSL communication following the connection disconnection processing by the gateway server GWS. At the same time, an image indicating that “SSL communication is not possible because the server has not been authenticated” is displayed on the liquid crystal display 25 (steps SA3 and SA5), and the SSL communication start process is terminated. On the contrary, when the response message is a message indicating that the SSL communication has been successfully started (for example, “HTTP / 1.0 200 OK”), the mobile phone MS1 continues the communication in plain text without disconnecting the connection ( Steps SA3 and SA4).
[0037]
(3-2) Functions of mobile phone MS2
FIG. 6 is a flowchart showing the flow of SSL communication start processing performed by the mobile phone MS2, and the CPU 261 of the control unit 26 executes the SSL communication processing program stored in the ROM 262, thereby realizing the processing shown in this figure. In this figure, the same reference numerals are given to portions common to FIG. Further, the communication processing program is a program compliant with a version of HTTP (herein referred to as “HTTP / 1.1”) that supports server-to-server SSL communication and end-to-end SSL communication as feasible SSL communication. SSL communication that can be realized by the MS 2 is server-to-server SSL communication and end-to-end SSL communication.
[0038]
As shown in this figure, at the start of SSL communication, the mobile phone MS2 requests a Connect request message requesting SSL communication with the IP server W having a desired URL (for example, “Connect https: // ... HTTP / 1.1”). Is transmitted to the gateway server GWS and the response message is received (steps SB1, SB2). When this response message is a message indicating disconnection of the connection (for example, “Connection Closed”), the cellular phone MS2 performs the process shown in FIG. The communication start process is terminated. Note that the Connect request message is a request message using a method similar to the HTTP Connect method.
[0039]
Conversely, if the response message is a message indicating the establishment of a connection (for example, “Connection Established”), the mobile phone MS2 performs a negotiation process including an authentication process with the IP server W of the communication partner, and the IP server If W is not authenticated, the connection with the IP server W is disconnected, and an image indicating that “SSL communication is not possible because the server has not been authenticated” is displayed on the liquid crystal display 25 (step SB3 To SB6), the SSL communication start process is terminated.
[0040]
If the IP server W is authenticated as a result of the negotiation process, the mobile phone MS2 starts encrypted communication with the IP server W via the established connection. However, when the IP server W requests client authentication and the mobile phone MS2 is not authenticated, the mobile phone MS2 does not start the encrypted communication (before sending the client key exchange (CrientKeyExchange) in the SSL negotiation procedure). A warning message (for example, “Warning”) is transmitted to the IP server W (steps SB5, SB7 to SB9).
[0041]
(3-3) Function of gateway server GWS
(3-3-1) SSL setting table T
FIG. 7 is a conceptual diagram showing the data structure of the SSL setting table T stored in the storage device 33 of the gateway server GWS. As shown in this figure, the SSL setting table T includes a URL registered by the user, an access method to the content desired by the administrator of the content on the URL (hereinafter referred to as an initial setting communication method), and the URL on the URL. Information indicating whether or not a UID is required for accessing the content (hereinafter referred to as UID necessity) is stored. The UID is a user ID uniquely assigned to each mobile phone MS.
[0042]
In FIG. 7, “EE” means end-to-end SSL communication, and “SS” means server-to-server SSL communication. The URL registered in the SSL setting table T is basically a URL registered in advance by the user using the mobile phone MS. When the URL is registered in the SSL setting table T, the gateway server GWS registers “SS” as the initial setting communication method corresponding to the URL and “Necessary” as the UID necessity. The contents of the SSL setting table T can be changed from the maintenance terminal MT based on a request from the administrator of the IP server W. However, for the same URL, the initial setting communication method is “SS” and whether or not the UID is required. The change which makes “No” is rejected by the gateway server GWS.
[0043]
(3-3-2) Inter-server SSL communication start processing
FIG. 8 is a flowchart showing a flow of inter-server SSL communication start processing performed by the gateway server GWS. The CPU 351 of the control unit 35 executes the SSL communication processing program stored in the storage device 33 and requests SSL communication. When the request message is received from the mobile phone MS, the processing shown in this figure is realized. Note that the communication processing program is a program based on HTTP / 1.0 and HTTP / 1.1, and HTTP / 1.1 has upward compatibility with HTTP / 1.0.
[0044]
As shown in this figure, when the gateway server GWS receives a GET request message for requesting SSL communication with the IP server W having a desired URL from the mobile phone MS, the gateway server GWS performs negotiation processing with the IP server W of the communication partner. (Step SC1). When the IP server W is not authenticated in this negotiation process, the gateway server GWS disconnects the connection with the IP server W and displays a message “SSL communication is impossible because the server was not authenticated”. A response message to the GET request message is returned to the mobile phone MS (steps SC2 and SC3), and the server-to-server SSL communication start process is terminated.
[0045]
Conversely, when the IP server W is authenticated in the negotiation process, the gateway server GWS starts the conversion relay process (step SC6). Specifically, the gateway server GWS returns a message indicating that the SSL communication has been successfully started to the mobile phone MS as a response message to the GET request message. Note that when the IP server W is an IP server that requests client authentication and the mobile phone MS2 is not authenticated, the gateway server GWS performs the client key exchange (in the SSL negotiation procedure ( Before sending (CritentKeyExchange), a warning message (for example, “Warning”) is sent to the IP server W (steps SC4 and SC5). The gateway server GWS identifies whether or not the target IP server W requests client authentication at the time of negotiation with the IP server W.
[0046]
(3-3-3) End-to-end SSL communication start processing
FIG. 9 is a flowchart showing the flow of end-to-end SSL communication start processing performed by the gateway server GWS. The CPU 351 of the control unit 35 executes the SSL communication processing program stored in the storage device 33 and requests SSL communication. When the request message is received from the mobile phone MS, the processing shown in this figure is realized.
[0047]
As shown in this figure, when starting the SSL communication, when the mobile phone MS2 receives a Connect request message requesting SSL communication with the IP server W having a desired URL, the gateway server GWS refers to the SSL setting table T. Then, it is determined whether or not the UID needs to be notified to the IP server W in accessing the content from the URL (step SD1). When the UID notification is required, the gateway server GWS returns a message indicating the disconnection to the mobile phone MS as a response message to the Connect request message (step SD4), and ends the end-to-end SSL communication start processing. To do. In addition, when the UID notification is not required, the gateway server GWS returns a message indicating the establishment of the connection to the mobile phone MS as a response message to the Connect request message, and the SSL communication through the connection thereafter. The mode of the own device is set to the tunneling mode (steps SD2 and SD3).
[0048]
(3-4) Functions of IP server W1
FIG. 10 is a flowchart showing the flow of SSL communication start processing performed by the IP server W1. When the CPU 431 of the control unit 43 executes the SSL communication processing program stored in the storage device 42, the processing shown in FIG. 10 is realized. . The communication processing program is a program conforming to HTTP / 1.0.
[0049]
As shown in this figure, when receiving a request for starting SSL communication from the client via the Internet INET, the IP server W1 starts encrypted communication after negotiation processing with the client (steps SE1, SE2). In this embodiment, it is assumed that the IP server W1 is a type of IP server that does not require client authentication at the start of SSL communication.
[0050]
(3-5) Functions of IP server W2
FIG. 11 is a flowchart showing the flow of SSL communication start processing performed by the IP server W2. When the CPU 431 of the control unit 43 executes the SSL communication processing program stored in the storage device 42, the processing shown in FIG. 11 is realized. . The communication processing program is a program compliant with HTTP / 1.0 and HTTP / 1.1. Moreover, in this figure, the same code | symbol is attached | subjected to the part which is common in FIG.
[0051]
As shown in this figure, when receiving a request for starting SSL communication from the client side via the Internet INET, the IP server W2 performs a negotiation process including an authentication process with the client side (step SE1). In this negotiation process, when the mobile phone MS is authenticated and a predetermined warning message is not received from the client side, the IP server W2 starts encrypted communication (steps SF1 and SE2). In the present embodiment, the IP server W2 is assumed to be a type of IP server that requires client authentication when SSL communication is started.
[0052]
Conversely, when the client is not authenticated or when a predetermined warning message is not received from the Internet INET side, the IP server W2 performs security ensuring processing (step SF2). The content of the security ensuring process is arbitrary. For example, the encrypted communication may be started by making only low-importance information usable from the client, or the encrypted communication may not be started.
[0053]
The IP server W3 has a function for processing normal HTTP, but does not have a function related to SSL communication.
[0054]
(3-6) Behavior pattern of mobile phone MS and gateway server GWS
12 is a diagram illustrating behavior patterns of the mobile phone MS1, the gateway server GWS, and the IP server W in association with various conditions during SSL access from the mobile phone MS1 to the URL stored in the SSL setting table T. FIG. FIG. 6 is a diagram exemplifying behavior patterns of the mobile phone MS2, the gateway server GWS, and the IP server W during SSL access from the mobile phone MS2 to the URL stored in the SSL setting table T in association with various conditions. In these drawings, behavior patterns corresponding to all condition patterns that can be adapted to the two types of initial setting communication methods (SS / EE) are shown.
[0055]
In these drawings, “◯” means necessary, successful authentication, accessible, and the like. “X” means unnecessary, authentication failure, inaccessibility, and the like. Δ means that the accessibility or the accessible range changes depending on the operation of the IP server W. Further, “−” means that the behavior pattern is not affected at all. For example, since it is unlikely that the IP server W having “EE” set as the initial setting communication method requires a UID, in each figure, the UID necessity corresponding to “EE” is “−”. It is shown. Similarly, since the IP server W in which “SS” is set as the initial setting communication method cannot obtain the client authentication result, the client corresponding to “SS” is shown in each figure. The authentication result is indicated by “−”.
[0056]
In these figures, P101 to P116 and P201 to P216 are symbols associated with behavior patterns, respectively, and a total of 32 behavior patterns are shown in these figures. When a request for starting SSL communication to a URL not stored in the SSL setting table T is made, the gateway server GWS applies any of the above patterns according to the type of message requesting the start of the SSL communication. Specifically, when the message requesting the start of SSL communication for a URL not stored in the SSL setting table T is a GET request message, “SS”, and when the message is a Connect request message, “EE”. It becomes. In any type, the UID necessity is “No”. The specific behavior of each behavior pattern will be described below.
[0057]
B: Operation
B-1: Premise
As described above, when requesting the start of SSL communication to a URL not stored in the SSL setting table T, the gateway server GWS treats the URL as if it is stored in the SSL setting table T. . That is, it can be said that FIGS. 12 and 13 cover all behavior patterns regardless of whether or not the URL for requesting the start of SSL communication is stored in the SSL setting table T. That is, all operations of the present system can be described by describing specific behaviors of all the behavior patterns shown in FIGS. Although all behavior patterns are described below, there are behavior patterns that have the same actual behavior even under different conditions in these figures. Therefore, the behavior patterns that have the same behavior are summarized. To avoid complications.
[0058]
B-2: Behavior
(1) When the mobile phone MS that first uses the GET method accesses the IP server W
First, a case where the mobile phone MS using the GET method first accesses the IP server W in the SSL communication start request will be described.
[0059]
(1-1) When server authentication is not obtained
FIG. 14 is a conceptual diagram showing a message flow when server authentication is not obtained in access from the mobile phone MS (including the mobile phone MS1) to the IP server W (including the IP server W3). Examples of the behavior pattern that becomes the flow shown in FIG. 4 include behavior patterns P101, P102, P105, P106, P110, P112, P114, and P116.
[0060]
In this case, first, a message m11 for requesting SSL communication to the URL in the IP server W by the GET method is transmitted from the mobile phone MS to the gateway server GWS (step SA1 in FIG. 5). Next, in the gateway server GWS that has received this message m11, the inter-server SSL communication start processing in FIG. A negotiation process is performed with the server W (step SC1, step SE1 in FIG. 10).
[0061]
Here, since the server authentication of the IP server W is not obtained, the connection for SSL communication is disconnected by the gateway server GWS, and the gateway server GWS to the mobile phone MS “SSL communication is not possible because the server has not been authenticated”. Message m13 is transmitted (steps SC2 and SC3), the user is notified of this by the mobile phone MS, and the start of SSL communication ends in failure (steps SA2, SA3 and SA5).
[0062]
(1-2) When server authentication is obtained, client authentication is required, and client authentication is not obtained
FIG. 15 shows a message flow when server authentication is obtained and client authentication is required and client authentication is not obtained in access from the mobile phone MS to the IP server W (including the IP servers W1 and W2). The behavior patterns P103, P109, and P111 are listed as the behavior patterns that follow the flow shown in this diagram.
[0063]
In this case, first, a message m31 for requesting SSL communication to the URL in the IP server W by the GET method is transmitted from the mobile phone MS to the gateway server GWS (step SA1). Next, negotiation processing is performed between the gateway server GWS and the IP server W that have received this message m31 (messages m32, m33,..., Step SC1, step SE1 in FIG. 10 or FIG. 11). This negotiation process is completed when the message m34 is transmitted from the IP server W to the gateway server GWS.
[0064]
Since the IP server W cannot directly communicate with the mobile phone MS, client authentication cannot be obtained in the authentication process. Therefore, warning message m38 is transmitted from gateway server GWS to IP server W (steps SC4 and SC5). When the IP server W that has received the warning message m38 is the IP server W2, security ensuring processing is performed in the IP server W (steps SF1 and SF2). In the description of this operation, it is assumed that a security ensuring process for starting encrypted communication is performed after only less important content can be used. If the IP server W is an IP server W1 that does not require client authentication, the warning message m38 is ignored in the IP server W, and encrypted communication is simply started (step SE2).
[0065]
The gateway server GWS starts conversion relay processing (step SC6). As a result, the message m35 in which the information on the transmission source of the message m31 is rewritten and further encrypted is transmitted from the gateway server GWS to the IP server W, and the response message m36 corresponding to the message m35 is transmitted from the IP server W to the gateway server GWS. A response message m37 in which the encryption of the response message m36 is released and the information on the destination is further rewritten is transmitted from the gateway server GWS to the mobile phone MS.
[0066]
In the mobile phone MS, since the response message m37 is not a message indicating that “SSL communication is not possible because the server has not been authenticated”, plaintext communication is continued (steps SA2 to SA4).
[0067]
(1-3) Other cases
FIG. 16 is a conceptual diagram showing a message flow when access from the mobile phone MS (including the mobile phone MS1) to the IP server W (including the IP server W1) is excluded from the cases according to FIGS. In this figure, the same reference numerals are given to the parts common to FIG. In addition, behavior patterns P104, P107, P108, P113, and P115 are mentioned as the behavior patterns that become the flow shown in this figure.
[0068]
The flow shown in this figure is different from the flow shown in FIG. 15 in that the warning message m38 is not transmitted from the gateway server GWS to the IP server W. That is, the gateway server GWS skips the process of step SC5 (steps SC4 and SC6). Further, the IP server W starts encrypted communication immediately after the negotiation process (steps SF1 and SE2).
[0069]
(2) When the mobile phone MS that first uses the Connect method accesses the IP server W
Next, the case where the mobile phone MS using the Connect method first accesses the IP server W in the SSL communication start request will be described.
[0070]
(2-1) When the initial setting communication method is end-to-end SSL
First, the case where the initial setting communication method desired by the content of the desired URL is end-to-end SSL will be described in the following cases.
[0071]
(2-1-1) When server authentication is not obtained
FIG. 17 shows that the server authentication is not obtained in the access from the mobile phone MS (including the mobile phone MS2) using the Connect method to the IP server W (including the IP server W3) whose initial setting communication method is the end-to-end SSL. The behavior patterns P201, P202, P205, and P206 are given as the behavioral patterns that are the flow shown in this figure.
[0072]
In this case, first, a message m21 for requesting SSL communication to the URL in the IP server W by the Connect method is transmitted from the mobile phone MS to the gateway server GWS (step SB1 in FIG. 6). Next, in the gateway server GWS that has received this message m21, the end-to-end SSL communication start process in FIG. 9 is started, and first, it is determined whether or not a UID is required for the IP server W (step SD1 in FIG. 9). Here, since the initial setting communication method of the IP server W is end-to-end SSL and the necessity of the UID is not set, the determination result is forcibly “No”, and the gateway server GWS is connected to the mobile phone MS and the IP A TCP connection is established with the server W (message m22), and a message m23 indicating that the connection has been established is returned to the mobile phone MS (step SD2). Note that the relay mode of the gateway server GWS for the connection is a tunneling mode (step SD3).
[0073]
In the mobile phone MS, the message m23 is received, and a negotiation process via the connection with the IP server W is started (message m24, steps SB2 to SB4). Here, since the server authentication of the IP server W cannot be obtained, the mobile phone MS disconnects the connection and notifies the user that “SSL communication is not possible because the server was not authenticated” (steps SB5 and SB6). ).
[0074]
(2-1-2) When server authentication is obtained, client authentication is required, and client authentication is not obtained
FIG. 18 shows that when the mobile phone MS using the Connect method first accesses the IP server W (including the IP server W2) whose end-point communication method is the end-to-end SSL, server authentication is obtained and client authentication is required. It is a conceptual diagram showing a message flow when the client authentication is not obtained, and a behavior pattern P203 is given as a behavior pattern that becomes the flow shown in this drawing.
[0075]
In this case, the flow is the same as in the case of (2-1-1) described above until the negotiation process is started. Here, in the negotiation process (messages m44 to m46), server authentication of the IP server W is obtained, client authentication of the mobile phone MS is not obtained, and the IP server performs client authentication for access to a desired URL. Therefore, the mobile phone MS ends the negotiation process after transmitting the warning message m49 to the IP server W, and starts encrypted communication (steps SB5, SB7 to SB9).
[0076]
Further, since the client server authentication of the mobile phone MS cannot be obtained in the negotiation process (or the warning message m49 is received) and the client authentication is required in the IP server W, the above-described security ensuring process is performed (steps SF1 and SF2). ). Thereafter, encrypted communication is performed between the mobile phone MS and the IP server. Note that the relay mode of the gateway server GWS for the encrypted communication is a tunneling mode.
[0077]
(2-1-3) Other cases
FIG. 19 shows an example in which access is initially made from the mobile phone MS (including the mobile phone MS2) using the Connect method to the IP server W (including the IP server W2) whose initial setting communication method is the end-to-end SSL. It is a conceptual diagram which shows the flow of a message when the case where it concerns is excluded, In this figure, the same code | symbol is attached | subjected to the part which is common in FIG. In addition, behavior patterns P204, P207, and P208 are mentioned as the behavior pattern which becomes the flow shown in this figure.
[0078]
The flow shown in this figure is different from the flow shown in FIG. 18 in that the warning message m49 is not transmitted from the mobile phone MS to the IP server W. That is, in the mobile phone MS, the process of step SB8 is skipped (steps SB7 and SB9). Further, the IP server W starts encrypted communication immediately after the negotiation process (steps SF1 and SE2).
[0079]
(2-2) When the initial setting communication method is SSL between servers
Next, the case where the initial setting communication method desired by the content of the desired URL is server-to-server SSL will be described for each case.
[0080]
(2-2-1) When notification of UID is required
When the initial setting communication method desired by the content of the desired URL is SSL between servers, the behavior of the gateway GWS is roughly classified depending on whether or not the notification of the UID is required. Here, first, the case where the notification of the UID is required will be described separately for each case.
[0081]
(2-2-1-1) When server authentication is not obtained
FIG. 20 shows an example in which an initial setting communication method from a mobile phone MS (including a mobile phone MS2) using the Connect method to an IP server W (including an IP server W3) that desires notification of a UID by SSL between servers. It is a conceptual diagram which shows the flow of a message when server authentication is not obtained, and behavior patterns P210 and P214 are mentioned as a behavior pattern used as the flow shown in this figure.
[0082]
In this case, first, a message m71 for requesting SSL communication to the URL in the IP server W by the Connect method is transmitted from the mobile phone MS to the gateway server GWS (step SB1). Next, in the gateway server GWS that has received this message m71, the end-to-end SSL communication start process of FIG. 9 is started. Here, since it is necessary to notify the IP server W of the UID when accessing the content of the desired URL, the gateway server GWS does not establish a TCP connection between the mobile phone MS and the IP server W, and the server A message m72 indicating switching to the inter-SSL is returned to the mobile phone MS (step SD4).
[0083]
The mobile phone MS that has received the message m72 transmits a request message m73 using the GET method to the gateway server GWS (steps SB2, SB3, SA1). When receiving the request message m73, the gateway server GWS transmits the message m74 to the IP server W and starts a negotiation process with the IP server W (steps SC1 and SE1). However, since the server authentication of the IP server W is not obtained here, the connection for SSL communication is disconnected by the gateway server GWS and the gateway server GWS sends the message “The server was not authenticated because the server was not authenticated. The message m75 indicating “impossible” is transmitted (steps SC2 and SC3), the user is notified by the mobile phone MS, and the start of SSL communication ends in failure (step SS1 (steps SA2, SA3, SA5)).
[0084]
(2-2-1-2) When Server Authentication is Obtained and Client Authentication is Not Required FIG. 21 shows that the initial setting communication method is the server-to-server SSL notification of the UID from the mobile phone MS that first uses the Connect method. FIG. 4 is a conceptual diagram showing a message flow when server authentication is obtained and client authentication is not required in accessing the IP server W, and a behavior pattern P213 is given as a behavior pattern shown in this diagram. .
[0085]
In this case, first, a message m51 for requesting SSL communication to the URL in the IP server W by the Connect method is transmitted from the mobile phone MS to the gateway server GWS (step SB1). Next, the gateway server GWS that has received this message m51 starts an end-to-end SSL communication start process, and determines whether or not a UID is required for the IP server W (step SD1). Since this determination result is “necessary”, the gateway server GWS does not establish a TCP connection between the mobile phone MS and the IP server W, but returns a message m52 indicating switching to the inter-server SSL to the mobile phone MS. (Steps SD1, SD4).
[0086]
The mobile phone MS that has received the message m52 transmits a request message m53 using the GET method to the gateway server GWS (steps SB2, SB3, SA1). When receiving the request message m53, the gateway server GWS performs a negotiation process with the IP server W (messages m54 to m56, steps SC1 and SE1).
[0087]
Here, since server authentication of the IP server W is obtained and client authentication is not required, the gateway server GWS starts relay conversion processing (steps SC2, SC4, and SC6), and information on the transmission source of the message m53 is rewritten. The further encrypted message m57 is transmitted from the gateway server GWS to the IP server W.
[0088]
On the other hand, the IP server W starts encrypted communication processing (steps SF1 and SE2), a response message m58 corresponding to the message m57 is returned from the IP server W to the gateway server GWS, and the response message m58 is decrypted. Then, the response message m59 in which the information on the destination is further rewritten is transmitted from the gateway server GWS to the mobile phone MS.
[0089]
In the mobile phone MS, since the response message m37 is not a message indicating that “SSL communication is not possible because the server has not been authenticated”, plaintext communication is continued (steps SA2 to SA4).
[0090]
(2-2-1-3) When server authentication is obtained and client authentication is required
FIG. 22 shows that the server authentication is obtained in the access from the mobile phone MS (including the mobile phone MS2) using the Connect method to the IP server W in which the initial setting communication method desires the notification of the UID by the SSL between servers. It is a conceptual diagram which shows the flow of a message when client authentication is required, In this figure, the same code | symbol is attached | subjected to the part which is common in FIG. In addition, the behavior pattern P209 is mentioned as a behavior pattern used as the flow shown in this figure.
[0091]
The flow shown in this figure is different from the flow shown in FIG. 21 in that a warning message m60 is transmitted from the gateway server GWS to the IP server W (step SC5). That is, here, it is determined in step SC4 of FIG. 8 that client authentication is not obtained and the IP server W requires client authentication. Further, the determination result in step SF1 in FIG. 11 is “YES”, and the security ensuring process is performed in the IP server W (step SF2). That is, in this behavior pattern, only limited access to the IP server W by inter-server SSL is allowed for the mobile phone MS.
[0092]
(2-2-2) When the IP server W does not require notification of the UID
Next, the case where the notification of the UID is not required will be described separately for each case.
[0093]
(2-22-1) When server authentication is not obtained
The behavior patterns applicable to this case include behavior patterns P212 and P216, and the message flow in this case is as shown in FIG. The flow shown in FIG. 17 is as described above, and in this behavior pattern, access to the IP server W by SSL is not allowed to the mobile phone MS.
[0094]
(2-2-2-2) When server authentication is obtained and client authentication is not required A behavior pattern P215 is given as a behavior pattern applicable in this case, and a message flow in this case is as shown in FIG. is there. The flow shown in FIG. 19 is as described above, and in this behavior pattern, access to the IP server W by end-to-end SSL is permitted to the mobile phone MS.
[0095]
(2-2-2-3) When server authentication is obtained and client authentication is required
The behavior pattern applicable to this case is the behavior pattern P215, and the message flow in this case is as shown in FIG. The flow shown in FIG. 18 is as described above, and in this behavior pattern, limited access to the IP server W by end-to-end SSL is permitted to the mobile phone MS.
[0096]
C: Supplement
In the above-described embodiment, the example in which the behavior pattern is defined corresponding to all the condition patterns that can be adapted to the two types of initial setting communication methods (SS / EE) is shown. It is not limited to. For example, as shown in FIGS. 23 and 24, the types of condition patterns can be reduced. FIG. 23 shows a mobile phone that supports only the inter-server SSL, and FIG. 24 shows a mobile phone, a gateway server, and a mobile phone that are compatible with the inter-server SSL and the end-to-end SSL when accessing the URL stored in the SSL setting table. It is the figure which matched the behavior pattern of IP server and matched with various conditions. In these drawings, the same reference numerals are given to the portions common to FIGS. 12 and 13.
[0097]
23 differs from FIG. 12 in that behavior patterns P301 and P302 are provided instead of behavior patterns P105 to P108, and FIG. 24 differs from FIG. 13 in that behavior patterns P205 to P208 are provided. This is that behavior patterns P401 and P402 are provided. If client authentication is performed only when client authentication is required in end-to-end SSL, the behavior pattern is determined without depending on the client authentication result when client authentication is unnecessary. Reduction is possible.
[0098]
In the above-described embodiment, an example in which the present invention is applied to switching between the server-to-server SSL and the end-to-end SSL has been described. However, the present invention is not limited to such an aspect, and between the mobile phone and the gateway server. Arbitrary encrypted communication method for sending and receiving plaintext data and performing encrypted communication between gateway server and IP server, and arbitrary encryption for performing encrypted communication directly between mobile phone and IP server It can be applied to switching to a communication method.
[0099]
In the above-described embodiment, an example in which a warning message is transmitted in the middle of negotiation has been described. However, the present invention is not limited to such a mode, and may be transmitted after the end of negotiation, for example. Of course, in the case of an encrypted communication method different from SSL, the transmission is performed at a timing suitable for the communication method. However, since the IP server performs the security ensuring process based on the warning message, the transmission timing of the warning message must be a timing at which the security ensuring process can be performed without missing a chance.
[0100]
In the above-described embodiment, the mode in which the gateway server identifies in negotiation with the IP server whether or not the IP server needs to authenticate the mobile phone has been described. However, the present invention is not limited to such a mode, and the gateway A server may store information for the identification in advance and perform the identification based on the stored information. Of course, the gateway server may store the identification information in advance in units of contents, not in units of IP servers.
[0101]
In the above-described embodiment, the gateway server stores in advance information indicating whether or not a UID notification is required for a preset IP server. However, the present invention is limited to such an embodiment. Instead, for example, the gateway server may identify whether the IP server needs to notify the UID by communicating with the IP server at the start of relaying.
[0102]
In the above-described embodiment, an example in which communication is performed via a mobile packet communication network and the Internet has been described. However, the present invention is not limited to such a mode, and a mode in which communication is performed via a fixed public network and the Internet Various modes are included, such as a mode in which communication is performed only through a mobile packet communication network, a mode in which communication is performed only through a fixed public network, and the like. Of course, the client targeted by the present invention is not limited to a mobile phone. For example, a PDA (Personal Digital (Data) Assistants) or a computer having a communication function may be used, or a combination of a communication terminal and a data terminal may be used. The relay device according to the present invention is not limited to a gateway server that connects a plurality of networks, and may be any relay device that relays communication between a client and a server.
[0103]
【The invention's effect】
As described above, according to the present invention, when the communication terminal tries to access content requiring notification of identification information of the communication terminal by the second relay method, the access is switched to the access by the first encrypted communication method. An instruction to that effect is transmitted from the relay apparatus to the communication terminal, and the relay apparatus performs relay processing according to the first encrypted communication method. In the first encrypted communication method, since data transmitted and received between the communication terminal and the relay device is not encrypted, the relay device tries to receive the content from the server device having the content. The identification information can be notified. Therefore, according to the present invention, it is possible to realize appropriate encrypted communication without significant system change even in an environment where communication terminals and server apparatuses that support different encrypted communication methods coexist.
[0104]
In addition, more appropriate encrypted communication can be realized by selecting an encrypted communication method in consideration of information related to encrypted communication set for the content.
In addition, in consideration of the necessity of authentication of the communication terminal set for the content, when the communication terminal accesses the content that requires authentication of the communication terminal by the first encrypted communication method, the relay device is the server device. If a communication terminal that is not authenticated to the content that requires authentication of the communication terminal accesses the server apparatus by using the second encrypted communication method, the server apparatus The reliability of the communication terminal can be accurately grasped and dealt with appropriately.
For content that is not set in advance, if an encrypted communication method is selected according to the content of the access request, appropriate encrypted communication can be realized between the communication terminal and a large number of server devices. it can.
[0105]
[Brief description of the drawings]
FIG. 1 is a diagram showing a configuration of a mobile packet communication system using a gateway server GWS according to an embodiment of the present invention.
FIG. 2 is a block diagram showing a hardware configuration of a mobile phone MS.
FIG. 3 is a block diagram showing a hardware configuration of a gateway server GWS.
4 is a block diagram showing a hardware configuration of an IP server W. FIG.
FIG. 5 is a flowchart showing a flow of SSL communication start processing performed by the mobile phone MS1.
FIG. 6 is a flowchart showing a flow of SSL communication start processing performed by the mobile phone MS2.
FIG. 7 is a conceptual diagram showing a data structure of an SSL setting table T stored in the storage device 33 of the gateway server GWS.
FIG. 8 is a flowchart showing a flow of a server-to-server SSL communication start process performed by the gateway server GWS.
FIG. 9 is a flowchart showing a flow of end-to-end SSL communication start processing performed by the gateway server GWS.
FIG. 10 is a flowchart showing a flow of SSL communication start processing performed by the IP server W1.
FIG. 11 is a flowchart showing a flow of SSL communication start processing performed by the IP server W2.
12 is a diagram illustrating behavior patterns of the mobile phone MS1, the gateway server GWS, and the IP server W in association with various conditions at the time of SSL access from the mobile phone MS1 to the URL stored in the SSL setting table T. FIG. .
FIG. 13 is a diagram illustrating behavior patterns of the mobile phone MS2, the gateway server GWS, and the IP server W in association with various conditions at the time of SSL access from the mobile phone MS2 to the URL stored in the SSL setting table T. .
FIG. 14 is a conceptual diagram showing a message flow when server authentication is not obtained in the access from the mobile phone MS using the GET method to the IP server W first.
FIG. 15 shows a message flow when server authentication is obtained, client authentication is required, and client authentication is not obtained in the access to the IP server W from the mobile phone MS using the GET method first. It is a conceptual diagram.
FIG. 16 is a conceptual diagram showing a message flow when access from the mobile phone MS using the GET method to the IP server W is excluded except for the cases shown in FIGS. 14 and 15;
FIG. 17 shows a message flow when server authentication is not obtained in access to an IP server W with an initial setting communication method from the mobile phone MS using the Connect method, and from the mobile phone MS2 to the server. It is a conceptual diagram which shows the flow of a message when server authentication is not obtained in the access to the IP server W which desires inter-SSL and does not desire notification of UID.
FIG. 18 shows that when the mobile phone MS using the Connect method first accesses the IP server W whose end-point communication method is end-to-end SSL, server authentication is obtained, client authentication is required, and client authentication is obtained. It is a conceptual diagram which shows the flow of the message when there is not.
FIG. 19 shows a message flow when the mobile phone MS using the Connect method first accesses the IP server W whose end-point communication method is end-to-end SSL, except for the case according to FIG. 17 and FIG. It is a conceptual diagram which shows the flow of a message when server authentication is acquired and client authentication is not required in access to IP server W which desires the SSL between servers from telephone MS2, and does not desire the notification of UID.
FIG. 20 shows a message flow when the server authentication is not obtained in the access from the mobile phone MS using the Connect method to the IP server W in which the initial setting communication method is SSL between servers and desires to notify the UID. FIG.
FIG. 21 shows a case where server authentication is obtained and no client authentication is required in access from the mobile phone MS that uses the Connect method to the IP server W that the initial communication method is SSL between servers and desires notification of a UID. It is a conceptual diagram which shows the flow of messages.
FIG. 22 shows a case where server authentication is obtained and client authentication is required in the access from the mobile phone MS using the Connect method to the IP server W in which the initial communication method is SSL between servers and desires to notify the UID. It is a conceptual diagram which shows the flow of a message.
FIG. 23 is a diagram showing another example of behavior patterns of the mobile phone MS1, the gateway server GWS, and the IP server W.
FIG. 24 is a diagram showing another example of behavior patterns of the mobile phone MS2, the gateway server GWS, and the IP server W.
[Explanation of symbols]
BS ... base station, GWS ... gateway server, INET ... Internet, MPN ... mobile packet communication network, MS, MS1, MS2 ... mobile phone, MT ... maintenance terminal, P101 to P116, P201 to P216 ... behavior pattern, PS ... packet subscription Person processing device, T ... SSL setting table, W, W1, W2, W3 ... IP server, 21 ... transmission / reception unit, 22 ... sound collection unit, 23 ... sound generation unit, 24 ... input unit, 25 ... liquid crystal display, 26,35 , 43 ... Control unit, 31 ... Communication device, 32, 41 ... Internet connection interface, 33, 42 ... Storage device, 34 ... Maintenance terminal connection interface, 261, 351, 431 ... CPU, 262, 352, 432 ... ROM, 263: Flash memory, 353, 433: RAM.

Claims (10)

In a relay device that performs a relay process of receiving content from a server device outside the communication network and transmitting the content according to the content of the access request transmitted from the communication terminal in the communication network to the communication terminal,
A storage unit that stores information indicating whether notification of identification information that can identify the communication terminal in the communication network is required for access by the communication terminal for preset content;
A first encrypted communication method for transmitting and receiving plaintext data to and from the communication terminal; and a second encrypted communication method for performing encrypted communication directly between the communication terminal and the server device. A relay-side selection unit that selects one of the encrypted communication methods;
A relay unit that performs the relay process according to the encrypted communication method selected by the relay side selection unit,
When the content of the access request indicates that the content requiring the notification of the identification information is to be accessed by the second encrypted communication method, the relay side selection unit selects the first encrypted communication method, The relay device transmits an instruction to switch to access according to the first encrypted communication method to the communication terminal that is the transmission source of the access request. The storage unit further stores information related to encrypted communication set in the preset content,
When the content of the access request indicates that access is made to content that does not require notification of the identification information, the relay side selection unit relates to the content of the access request and the encrypted communication set in the content The relay apparatus according to claim 1, wherein an encryption communication method is selected based on the information. An authentication necessity identifying unit that identifies whether or not the communication terminal needs to be authenticated for the content according to the content of the access request;
When the first encryption communication method is selected by the relay side selection unit, and the content according to the content of the access request is identified by the authentication necessity identifying unit as requiring authentication of the communication terminal, The relay device according to claim 1, wherein the relay unit transmits a warning to the server device having the content. The storage unit stores information indicating whether or not authentication of the communication terminal is required when accessing the preset content by the communication terminal;
When the first encryption communication method is selected by the relay side selection unit and the content according to the content of the access request requires authentication of the communication terminal, the relay unit includes the server device having the content The relay device according to claim 1, wherein a warning is transmitted to the relay device. When content according to the content of the access request is not included in the preset content, the relay side selection unit selects an encrypted communication method according to the content of the access request. The relay device according to any one of claims 1 to 4. In a relay device that performs a relay process of receiving content from a server device outside the communication network and transmitting the content according to the content of the access request transmitted from the communication terminal in the communication network to the communication terminal,
An identification information necessity identifying unit that identifies whether or not notification of identification information that can identify the communication terminal in the communication network is required for the content in response to the access request transmitted from the communication terminal;
A first encrypted communication method for transmitting and receiving plaintext data to and from the communication terminal; and a second encrypted communication method for performing encrypted communication directly between the communication terminal and the server device. A relay-side selection unit that selects one of the encrypted communication methods;
A relay unit that performs the relay process according to the encrypted communication method selected by the relay side selection unit,
When the content of the access request indicates that the content requiring the notification of the identification information is to be accessed by the second encrypted communication method, the relay side selection unit selects the first encrypted communication method, The relay device transmits an instruction to switch to access according to the first encrypted communication method to the communication terminal that is the transmission source of the access request. In a communication terminal that accesses content existing in a server device outside the communication network to which the own terminal belongs via a relay device,
Either the first encrypted communication method for transmitting / receiving plaintext data to / from the relay device and the second encrypted communication method for performing encrypted communication directly with the server device A terminal side selection unit for selecting an encrypted communication method;
A transmission unit that transmits an access request to content according to the encrypted communication method selected by the terminal-side selection unit;
A receiving unit that receives an instruction from the relay device;
When the receiving unit receives an instruction to switch to access according to the first encrypted communication method, the terminal side selecting unit selects the first encrypted communication method. When the content to be accessed by the second encrypted communication method requires authentication of the own terminal and the authentication of the own terminal cannot be obtained, the transmitting unit transmits a warning to the server device. The communication terminal according to claim 7.   9. The communication terminal according to claim 7, wherein the terminal is a mobile phone. A storage unit in which content is stored;
An authentication unit that authenticates a communication terminal that is a request source when a communication terminal is requested to start encrypted communication via a relay device;
When the communication terminal is authenticated by the authentication unit, a control unit that executes an encrypted communication process of reading out the content corresponding to the access request transmitted from the communication terminal from the storage unit and returning the encrypted content ,
With
The controller is
When the first warning indicating that communication cannot be performed directly with the communication terminal because communication is terminated by the relay device is transmitted from the relay device, or when the present device and the communication terminal When a second warning indicating that an identifier for allowing the authentication unit to authenticate its own terminal cannot be acquired from the relay device is transmitted from the communication terminal. In place of the encrypted communication process, only the predetermined content among the contents stored in the storage unit is encrypted in response to an access request transmitted from the communication terminal, and security is ensured. Execute the process
The server apparatus characterized by the above-mentioned.

Images