JP7203297B2 - End-to-end encrypted communication system - Google Patents

Description

The present invention provides encrypted communication between communication parties in communication via devices that relay in layers above the transport layer of the OSI reference model (see Non-Patent Document 1) formulated by OSI (Open System Interconnection). This is to prevent decipherment of communication contents in equipment that performs relaying.

When Internet communication is performed in a home LAN (Local Area Network) environment or in a LAN environment of various offices, the IP address and port number are changed by the NAPT (Network Address Port Translation) function (see Non-Patent Document 2) of the router. converted and communicated.

Also, when performing Internet communication from the LAN environment of various offices, there are many environments in which communication types that can be communicated are restricted by firewall devices.

"The Basic Reference Model of Open Systems Interconnection (OSI)", ISO/IEC 7498, 1989 P. Srisuresh, M.; Holdrege, Lucent Technologies, "IP Network Address Translator (NAT) Terminology and Considerations", RFC2663, [online], August 1999, [searched on September 27, 2017], Internet <https://tools. ietf. org/html/rfc2663>

In such an Internet communication environment, parties performing peer-to-peer communication use TCP (Transmission Control Protocol; see Non-Patent Document 3) or UDP (User Datagram Protocol; see Non-Patent Document 4), etc., in the transport layer of the OSI reference model. Using a localized communication protocol, a communication path may be established for a device that relays communication, such as a relay server or relay agent, and communication may be performed via the device that performs the relay.

On the other hand, SSL/TLS (Secure Socket Layer)/TLS (Transport Layer Security), which are widely used as cryptographic communication protocols for realizing encrypted communication between communicating parties; In Patent Document 7), encrypted communication is performed between programs that terminate communication in the transport layer of the OSI reference model.

When peer-to-peer communication is performed via a relaying device, a program that is a party to the communication establishes a logical transport-layer communication session with the relaying program on the relaying device. When SSL/TLS is used in this communication, encryption of communication contents is performed between a program that is a party to communication and a relay program on a relay device.

Then, the relay program on the relay device can decode the contents of the communication and decipher the contents. For this reason, the communication parties have a potential threat that the contents of the communication can be deciphered by the person who operates the relay path of the communication.

Defense Advanced Research Projects Agency Information Processing Techniques Office, "Transmission Control Protocol", RFC 793, [online], September 1981, [searched on September 27, 2017], Internet/<http://tolps. ietf. org/html/rfc793> J. Postel, "User Datagram Protocol", RFC768, [online], August 1980, [searched on September 27, 2017], Internet <https://tools. ietf. org/html/rfc768> T. Dierks, C. Allen, "The Transport Layer Security (TLS) Protocol Version 1.0", RFC2246, [online], January 1999, [searched on September 27, 2017], Internet https://tools. ietf. org/html/rfc2246 T. Dierks, E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.1", RFC4346, [online], April 2006, [searched on September 27, 2017], Internet <https://tools. ietf. org/html/rfc4346> T. Dierks, E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC5246, [online], August 2008, [searched on September 27, 2017], Internet <https://tools. ietf. org/html/rfc5246>

Means to solve problems

The present invention, as shown in FIG. 1, consists of a P2P E2EE client, a P2P E2EE agent, and a relay server.

Prior to communication, the relay server first listens on a specific TCP port.

The P2P E2EE client and P2P E2EE agent present their own identifiers to the relay server, establish logical sessions using TCP connections or WebSockets, and perform one-way or two-way communication at arbitrary timing. make it possible.

A P2P E2EE client listens for an external program on a TCP port in the computer 1 and acts as a TCP server.

When the P2P E2EE client receives a TCP connection establishment from an external program, the P2P E2EE client establishes a pseudo TCP connection to the P2P E2EE agent through the relay server.

The P2P E2EE agent also acts as a TCP client within the computer 2 and establishes a TCP connection to an external server when establishing a pseudo TCP connection. The IP address or host name and TCP port number of the external server are either stored in advance by the P2P E2EE agent as setting values, or are specified by the relay server when a pseudo TCP connection is established. Although the external server is located on the same computer as the P2P E2EE agent in FIG. 1, it may be located on another computer.

After the pseudo TCP connection is established between the P2P E2EE client and the P2P E2EE agent, an SSL/TLS session is established on this pseudo TCP connection between the P2P E2EE client and the P2P E2EE agent.

When establishing the pseudo TCP connection described in [0014] to [0015], the P2P E2EE client requests the establishment of the pseudo TCP connection from the relay server with an identifier for identifying the P2P E2EE agent that is the communication partner. . Also, when the P2P E2EE agent is requested to establish a pseudo TCP connection from the relay server, the identifier of the P2P E2EE client requesting the establishment of the pseudo TCP connection is attached. At the start of the SSL/TLS session after establishing the TCP connection, an SSL/TLS handshake is performed between the P2P E2EE client and the P2P E2EE agent. 509 format public key certificate to mutually confirm the legitimacy of each other. At this time, the public key certificate has a common name (Common Name) field, and the public key certificate having the identifier of the P2P E2EE client or P2P E2EE agent as the common name is used.

As described above, by establishing a pseudo TCP connection and then establishing an SSL/TLS session, communication content by a relay server, which is a relay device, can be transferred between a P2P E2EE client and a P2P E2EE agent. A logical communication path is established that is difficult to read.

The invention's effect

Even when peer-to-peer communication is performed in an environment where direct peer-to-peer communication is difficult, such as an environment where NAPT or firewall equipment is interposed, the user must eliminate the possibility of reading the communication contents by various relay devices on the relay path, and ensure safe communication. can communicate.

In one example of a specific implementation of the present invention, as shown in FIG. 2, to establish a logical communication path from the P2P E2EE client to the relay server and from the P2P E2EE agent to the relay server, The WebSocket protocol (see Non-Patent Document 8) is used.

WebSocket is a communication protocol that uses HTTP (Hypertext Transfer Protocol; see Non-Patent Document 9) or generally called HTTPS (HTTP over TLS; see Non-Patent Document 10). Since it is necessary to protect the communication contents from the P2P E2EE agent to the relay server from eavesdropping and falsification by third parties, the WebSocket communication established from the P2P E2EE client to the relay server and from the P2P E2EE agent to the relay server uses HTTPS. take advantage of

After establishing a logical communication path using WebSockets from the P2P E2EE client to the relay server and from the P2P E2EE agent to the relay server, the P2P E2EE client and the P2P E2EE agent each perform 4. Each P2P E2EE client and P2P E2EE agent can be identified by the relay server by performing an authentication procedure on the relay server.

In FIG. 2, 2. on the P2P E2EE client. For TCP server and TLS client: 1. When a TCP connection is established from an external program,2. The TCP server and TLS client is also 3. in the P2P E2EE client. Establish a TCP connection to the TCP server and WebSocket client.

3. A TCP connection has been established. The TCP server and WebSocket client is 4.0 in the relay server. 5. in the P2P E2EE agent to the WebSocket server. Send a pseudo TCP connection establishment request to the WebSocket client and TCP client. This corresponds to the "pseudo TCP connection establishment request (on WebSocket)" transmitted from "3. WebSocket client and TCP server" in FIG. 3 to "4. WebSocket server".

3. 5. From the TCP server and WebSocket client. 4. Received a pseudo TCP connection establishment request for a WebSocket client and TCP client. 5. WebSocket server. A TCP connection establishment request is sent to the WebSocket client and TCP client. This corresponds to the "pseudo TCP connection establishment request (on WebSocket)" transmitted from "4. WebSocket server" to "5. WebSocket client and TCP client" in FIG.

4. 5. in the P2P E2EE agent that received the pseudo TCP connection establishment request from the WebSocket server; 4. Web socket client and TCP client. A response of success in establishing a pseudo TCP connection is returned to the WebSocket server. This corresponds to the "pseudo TCP connection establishment reply" sent from "5. Web socket client and TCP client" to "4. Web socket server" in FIG.

4. The WebSocket server is 5. 3. After receiving a response indicating that the pseudo TCP connection has been successfully established from the WebSocket client and TCP client; A response of success in establishing a pseudo TCP connection is returned to the TCP server and WebSocket client. This corresponds to the "pseudo TCP connection establishment response" transmitted from "4. Web socket server" to "3. Web socket client and TCP server" in FIG.

After the pseudo TCP connection is successfully established,2. 6. The TCP server and TLS client performs a handshake at the start of SSL/TLS communication on the pseudo TCP communication channel. This is done for the TLS server and TCP client. As a result, 2. 5. TCP server and TLS client; The TLS server and TCP client can authenticate a communication partner and negotiate an encryption algorithm used for encrypted communication according to a general SSL/TLS communication mechanism.

If the SSL/TLS communication session is 2. 5. TCP server and TLS client; 5. Once established between the TLS server and TCP client; 7. The TLS server and TCP client. Establish a TCP connection to an external server.

The communication procedure described in [0023] to [0029] is shown as FIG.

After completing the above steps, 1. From an external program2. The contents of the data transmitted through the TCP connection to the TCP server and TLS client are transparently processed according to 6. 7. From the TLS server and TCP client. Forwarded to an external server. On the contrary, 7. 6. From an external server. The contents of the data transmitted through the TCP connection to the TLS server and TCP client are transparently 2. From the TCP server and TLS client 1. Forwarded to an external program. However, the SSL/TLS session is 2. 5. TCP server and TLS client; 4. Since it is established between the TLS server and TCP client. The WebSocket server cannot decipher the contents of the communication.
[Non-Patent Literature]

[Non-Patent Document 8] I.M. Fette, Google Inc. A. Melnikov, Isode Ltd.; , "The WebSocket Protocol", RFC6455, [online], December 2011, [searched on September 27, 2017], Internet <https://tools. ietf. org/html/rfc6455>
[Non-Patent Document 9] UC Irvine, J.; Gettys, Compaq/W3C, J. Am. Mogul, Compaq, H.; Frystyk, W3C/MIT, L.P. Masinter, Xerox, P.M. Leach, Microsoft, T. Berners-Lee, W3C/MIT, "Hypertext Transfer Protocol", RFC2616, [online], June 1999, [searched on September 27, 2017], Internet <https://tools. ietf. org/html/rfc2616>
[Non-Patent Document 10] E.I. Rescorla, RTFM, Inc. , “HTTP over TLS”, RFC2818, [online], May 2000, [searched on September 27, 2017], Internet <https://tools. ietf. org/html/rfc2818>

The present invention enables encrypted communication between communicating parties in peer-to-peer communication while using existing communication protocols, and allows users to perform peer-to-peer communication without worrying about interception of communication contents by the operator who operates the communication channel. can contribute to

In the present invention, the existing SSL/TLS protocol and X.2000 protocol are used as the key points of encrypted communication, namely authentication of the communication partner and the procedure for determining the encryption algorithm to be used. By using the mechanism of public key certificates standardized as V.509, it is possible to provide users with a security level equivalent to existing authentication mechanisms and encrypted communication mechanisms.

Components for constructing the present invention Elements Constituting the Best Mode for Carrying Out the Invention Communication procedure in the best mode for realizing the present invention

Claims (1)

A communication device configuration group consisting of two or more P2P E2EE client communication devices connected by a connection-oriented protocol such as WebSocket over HTTPS, which is an encrypted communication channel, and a P2P E2EE server communication device called a relay server or the like that accepts the connection. is a group of communication devices in which communication between two specific P2P E2EE clients is sent and received at a given moment via the P2P E2EE server communication device shown on the left, and a connection such as WebSocket on HTTPS, which is an encrypted communication path. A group of communication devices in which a connection of a type protocol is terminated between each P2P E2EE client and a P2P E2EE server. A connection-oriented protocol connection such as WebSocket over HTTPS between the first P2P E2EE client and the P2PE2EE server, as well as the second P2P E2EE client and P2PE2EE, so as not to be decrypted by the P2P E2EE server communication device terminating the connection. A group of communication devices that establish another pseudo SSL/TLS communication on a logical communication path via a connection-oriented protocol connection such as WebSocket over HTTPS between servers and perform communication.

Images