KR100388057B1 - Wireless Internet System and Content-based End-to-End Security Mechanism of Wireless Internet System - Google Patents

Abstract

The present invention relates to a wireless Internet system and a method for end-to-end content security.

In the present invention, selective end-to-end content security is achieved by using an extension header of a hypertext transfer protocol, a security script, and a wireless application security device in a wireless Internet application layer to realize a wired / wireless end-to-end security service for a wireless Internet service. Provide service. Therefore, when providing an application service such as electronic commerce on the wireless Internet, it is possible to provide a security service by selecting only important specific contents of all messages transmitted and received between wired and wireless end points.

The present invention can also be used for electronic payment schemes that are essential for electronic commerce services.

Description

End-to-End Content Security Method of Wireless Internet System {Wireless Internet System and Content-based End-to-End Security Mechanism of Wireless Internet System}

The present invention relates to a wireless Internet system and a method for end-to-end content security. More specifically, the present invention relates to a wireless Internet providing an end-to-end content security service using an extension header, a security script, and a wireless application security device of a hypertext transfer protocol. System and end-to-end content security method.

As one of the typical wireless Internet contents security methods, there is a ME (Mobile Explorer) security method. This is a method of providing end-to-end security service using SSL / TLS, which is a standard transport protocol of wired Internet, for both wired and wireless sections. The problem with this method is that it does not take into account the limitations of wireless terminals and wireless domains. . That is, since wireless is narrowband and has a high probability of error unlike wired, it is difficult to distinguish between SSL generated in the wireless domain and congestion generated in the wired Internet. In addition, wireless terminals (e.g. mobile phones, PDAs, etc.) have lower power, storage capacity, and computing power than Internet terminals (e.g. personal computers, etc.), which extends SSL designed for Internet terminals to the wireless domain. There is a problem with the application.

In order to solve this problem, the proposed method is a WAP (Wireless Application Protocol, WAP) security method. In order to solve the above-mentioned problem, the protocol scheme of the wired / wireless domain is different, and the wired / wireless boundary part is used. Installed the gateway on However, the WAP security method not only has a problem that the security is temporarily released in the process of converting the protocol at the gateway (the wireless session protocol is converted to the hypertext transfer protocol and the WTLS is converted to SSL / TLS). Cannot directly authenticate each other, and there is a problem that the authentication process is dependent on the gateway.

The above-described security methods according to the prior art commonly provide a security service in the transport layer. As a result, encryption and decryption may be performed even for a message that does not need security transmitted and received through a transmission channel. In other words, despite the limitations of wireless channels and wireless terminals, there is no ability to provide selective content security services targeting only important contents of wireless internet applications (eg, credit card passwords, etc.).

SUMMARY OF THE INVENTION An object of the present invention for solving the problems of the prior art is to use an extension header of a hypertext transfer protocol, a security script, and a wireless application security device in an application layer of the wireless Internet. It is to provide a wireless Internet system and end-to-end content security method that can provide security services only to specific contents.

1 is a block diagram of a wireless Internet system according to an embodiment of the present invention;

2 is a block diagram of a WAP-based wireless Internet system,

3 is an internal configuration diagram of a wireless terminal and a wireless application security device in a web server shown in FIG.

4 is a flowchart illustrating an operation process of a transmission security module in a wireless terminal;

5 is a flowchart illustrating an operation process of a reception security module in a web server;

6 is a flowchart illustrating an operation process of a transmission security module in a web server;

7 is a flowchart illustrating an operation process of a reception security module in a wireless terminal;

8 is a flowchart illustrating a process of end-to-end authentication and security negotiation according to the present invention.

※ Explanation of code about main part of drawing ※

110: wireless terminal 120: gateway

130: web server

112: wireless application security of the wireless terminal 133: wireless application security of the web server

311: security module for wireless terminal 313: security module for wireless terminal

331: reception security module of the web server 333: transmission security module of the web server

The present invention for achieving the above object, a wireless terminal including a wireless application security device, a web server including a web application server and a wireless application security device, a gateway for protocol conversion of the message transmitted between the wireless terminal and the web server In the content security method of the wireless Internet system consisting of, When the web application server of the web server is requested for the wireless Internet service from the wireless terminal, applying a security script to the wireless Internet service application requested from the wireless terminal and the security script A first step of generating a wireless application security message by displaying a security service type to be processed in an extension header of a hypertext transfer protocol (HTTP) message and providing the security application to a wireless application security device of the web server; If the security message is the wireless application security session set request signal A second step of detecting whether a secure session with the wireless terminal is connected; the wireless application security unit of the web server is connected to the wireless application security unit of the wireless terminal if the security session is not connected as a result of the detection of the second step. A third step of greatly authenticating and negotiating security; and the wireless application security of the web server secures the wireless application security message with the wireless terminal as a result of the detection of the second step or the wireless application security message in the first step. If the session is connected, the extension header of the HTTP message is analyzed and secured for the security script, and then transmitted to the wireless application security device of the wireless terminal. And a fourth step of processing.

According to the present invention, if a wireless Internet service is requested from the wireless terminal to a web server connected to the wireless terminal through a gateway, a security script is applied to the wireless internet service application requested from the wireless terminal and the security script is processed. Generating a wireless application security message by indicating a type of security service to be performed in an extension header of a hypertext transfer protocol (HTTP) message; if the wireless application security message is a session establishment request signal, a secure session with the wireless terminal is established. A second step of detecting whether a connection is established; a third step of end-to-end authentication and security negotiation with the wireless terminal if the security session is not connected as a result of the detection of the second step; and the wireless application security in the first step The message is not a session establishment request signal or the detection result of the second step If a secure session with a pre-terminal is connected, the extension header of the HTTP message is analyzed and secured for the security script, and then transmitted to the wireless terminal, so that the wireless terminal performs security reverse processing for the security script. A computer-readable recording medium having stored thereon a program for executing the content security method of a wireless Internet system including a fourth step is provided.

Hereinafter, an end-to-end content security method of a wireless Internet system according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings. 1 is a block diagram of a wireless Internet system according to an embodiment of the present invention.

As shown, unlike the conventional wireless Internet system, the wireless Internet system 100 according to the present embodiment has a security library function necessary for security negotiation and security service provision, authentication function for certificate management and certificate verification, and end-to-end security. Wireless application security (112, 133) for performing a session management function for session management. That is, the wireless Internet system 100 includes a wireless terminal 110, a gateway 120, and a web server 130, and the wireless terminal 110 includes a microbrowser 111, a wireless application security unit 112, and a WSP /. As the WTP / UDP / IP interface 113, the web server 130 includes a web daemon 231, a web application server 132, a wireless application security 133, and an HTTP / TCP / IP interface 134.

An operation process of the wireless Internet system having such a configuration will be described below. When describing the operation process, a description will be given mainly on a content security method between a wireless terminal and a web server of a wireless Internet system, that is, a wired / wireless end-to-end content security method for a wireless Internet service according to an embodiment of the present invention.

First, when the application service requested from the wireless terminal user is requested to the web daemon 131 in the web server 130 through the gateway 120 using the microbrowser 111 of the wireless terminal 110, the web daemon 131 ) Transmits an application service request of the wireless terminal 110 to the web application server 132. Thereafter, the web application server 132 applies the security script to the content to be securely transmitted and received, and indicates the type of the security service to process the security script in the extension header of the hypertext transfer protocol, and then through the web daemon 131 Transfer to the wireless application security 133 of the web server 130. The wireless application security unit 133 of the web server 130 analyzes the extended header of the transmitted hypertext transfer protocol, recognizes that the received message is a wireless application security message, and then, within the wireless application security unit 133 of the web server 130. After setting the end-to-end authentication and security session using the transmission security module and the reception security module in the wireless application security unit 112 of the wireless terminal 110, or processing the security script expressed in the application, the result of the wireless terminal ( 110 to the wireless application security unit 112. The wireless application security unit 212 of the wireless terminal 110 provides a reverse security service (eg, decryption for encryption) corresponding to the received message and delivers the unsecured message to the micro browser.

Here, a method of applying the security script, which is the operation process, and displaying the wireless application security header, will be described with reference to Table 1 below. In Table 1, Response.AddHeader "E2eSession", "on" is an example of expressing that the message of the hypertext transfer protocol has a wireless application security header, and requests the wireless application security service from the end-to-end secure session establishment service. Response.ContentType = "text / vnd.wap.wml; E2eService = EncField" is an example of expressing that there is content to be encrypted in units of fields in a message. In addition, it can be seen that the portion to be encrypted is specified using the svrEncrypt (% "pwd"%) script. In particular, since such a script is transmitted and received in the form of a character, there is an advantage that it is processed without error even if the WIP wireless internet system gateway encodes the full message.

TABLE 1

Example of writing wireless Internet application for <% 'end-to-end content security service

Response.AddHeader "E2eSession", "on"

Response.ContentType = "text / vnd.wap.wml; E2eService = EncField"%>

<? xml version = "1.0"?>

<! DOCTYPE wml PUBLIC "-// WAPFORUM // DTD WML 1.2 // EN" "http://www.wapforum.org/DTD/wml12.dtd">

<wml>

<card id = "mainmenu" ontimer = "# login" title = "Home Screen" <timer value = "50" />

<p align = "left">

Social Security Number: svrEncrypt (% 111111-2222222%)

</ p>

</ card>

<card id = "login" title = "Sign in">

<do type = "accept" label = "OK">

<go href = "http://www.etri.re.kr/wist/e2esec.asp" method = "post" enctype = "text / vnd.wap.wml; e2eService = Sign, EncMsg">

<postfield name = "password" value = "$ passwd" />

</ go>

</ do>

<p>

Secret number: <br/>

<input name = "passwd" type = "password" /> <br/>

</ p>

</ card>

</ wml>

As described above, the wireless Internet system 100 according to the present invention not only displays the wireless application security header by using the security script by the web application server 132, but also designates a specific message to receive the security service using the security script. .

Here, a wireless Internet system including such a feature will be applied to a wireless Internet system based on a WAP (Wireless Application Protocol). 2 is a block diagram of a WAP-based wireless Internet system according to a second embodiment. As shown, the WAP-based wireless Internet system is composed of a wireless terminal (210, 220), a gateway 230, and a web server 240, the wireless terminal (210, 220) and the web server 240 to realize end-to-end security services Each further includes a wireless application security (211, 221, 241).

Operation of the WAP-based wireless Internet system characterized by such a configuration is the same as the operation of the wireless Internet system according to the present invention will be omitted.

However, the gateway 230 in the operation of the WAP-based wireless Internet system 200 performs protocol conversion and encoding / decoding of the received message. That is, the wireless section from the wireless terminal (210, 220) to the gateway 230 is transmitted in the form of a message encoded with a wireless session protocol message / UDP / IP protocol, from the gateway 230 to the Internet web server 240 Hypertext Transfer Protocol The message / TCP / IP protocol stack is sent in text form.

Therefore, in order to realize a transparent wireless application security apparatus that does not affect the function of such a gateway, the extended header portion of the hypertext transfer protocol is used as a end-to-end security negotiation channel. That is, since the wireless application security message is delivered in the form of an extended hypertext transfer protocol message, the gateway only needs to convert the hypertext transfer protocol into a wireless session protocol and pass it through. Therefore, regardless of the encoding function of the gateway, it is possible to provide end-to-end wireless application security service in the existing wireless Internet system environment.

FIG. 3 is a detailed diagram illustrating a wireless application security device used in a wireless terminal and a web server of the wireless Internet system shown in FIG. 1. As shown, the wireless application security devices (310,330) used in the terminal and the web server is a security library function for providing security negotiations and security services, authentication management for certificate management and certificate verification, session management for end-to-end security session management It performs a function, and consists of transmission security modules 311 and 333 and reception security modules 313 and 331, respectively.

Looking at the operation of the wireless terminal and the wireless application security devices (310,330) in the web server characterized by such a configuration as follows. The transmission security module 311 used in the wireless application security unit 310 of the wireless terminal generates an encryption and an electronic signature for a message requested by the micro browser to the web server, which is a wireless application of the web server through the gateway 320. It is transmitted to the receiving security module 331 used for the security device 330. The reception security module 331 used for the wireless application security unit 330 of the web server applies a reverse security service to the received information, verifies and stores the decryption or the digital signature, and delivers the result to the application server. On the contrary, after the application server responds to the transmission security module 333 used in the wireless application security 330 of the web server is applied to the security service, the wireless application security of the wireless terminal through the gateway 320 It is transmitted to the reception security module 313 used for (310). The reception security module 313 used in the wireless application security unit 310 of the wireless terminal processes the received response message as a plain text message and then transfers the message to the microbrowser.

The operation of each of the transmission and reception security modules used in the wireless terminal and the wireless application security device in the web server including such features are as follows. 4 to 7 are flowcharts illustrating an operation process of a transmission / reception security module used for a wireless application security device in a wireless terminal and a web server.

In the present invention, the application service provider informs the wireless terminal user of the start of the secure session setup for the application by using the transmission security module of the web server, and after determining whether the wireless terminal user will use the content security service, the reception security of the wireless terminal. Applies a method of establishing end-to-end security negotiation between the module and the transmission security module of the web server.

4 is a flowchart illustrating an operation of a transmission security module of a wireless terminal for processing a request message received from a wireless terminal user and transmitting the request message to a reception security module of a web server. First, the transmission security module used in the wireless application security device in the wireless terminal receives the requested message from the wireless terminal user through the micro browser (S401), and then analyzes the header of the transmitted message (S402) to determine whether the wireless application security header. Determine (S403). As a result of the determination, if it is not the wireless application security header, the message transmitted to the reception security module of the web server is immediately transmitted (S411), while if the determination result, the wireless application security header, it is analyzed whether the received request message includes an electronic signature request. (S404). As a result of the analysis, if there is an electronic signature request, after extracting the content of the message to be digitally signed and making an electronic signature (S405), it is determined whether to perform an encryption process on the message including the electronic signature (S406). If the message does not request an electronic signature, it is immediately determined whether to perform an encryption process on the received message after omitting the generation of the electronic signature for the received message (S406). As a result of the determination, if the encryption process is required, it is checked whether there is a preset end-to-end session between the wireless terminal and the web server before encryption (S407). Send to the module. As a result of the search, if the end-to-end session exists, after processing the security script of the received request message (S408), and extracts the plain text to be encrypted (S409). Then, after reconfiguring the header of the hypertext transfer protocol by adding session identifier information in the header of the encrypted message (S410) and transmitting to the reception security module of the web server (S411), if the end-to-end session does not exist, Immediately after reconfiguring the header of the electronically signed message (S410), and transmits to the reception security module of the web server (S411). In particular, in the above process, the digital signature message is transmitted in an extension header of the hypertext transfer protocol.

Next, an operation process of the reception security module of the web server processing the message received from the transmission security module of the wireless terminal and delivering the message to the web daemon is as follows. FIG. 5 is a flowchart illustrating an operation process of a reception security module used in a wireless application security device of the web server of FIG. 3.

First, the reception security module of the web server receives the request message from the transmission security module of the wireless terminal (S501), and then analyzes the header of the received message (S502) to search whether it is a wireless application security header (S503). If the search result is not the wireless application security header, it is immediately transmitted to the transmission security module in the web server (S510), while if the search result, the wireless application security header, it is determined whether to decrypt the received message (S504). If it is determined that the message is to be decrypted, it is searched for whether there is an end-to-end session between the wireless terminal and the web server (S505). As a result of the search, if there is an end-to-end session, security script processing is performed on the received message (S506), and then the plain text to be decrypted is extracted and decrypted (S507). If the message does not exist, it is analyzed whether the received message immediately includes the electronic signature (S508). Next, after analyzing whether the decrypted message includes the digital signature (S508), and if the analysis result, if included, after confirming and storing the included electronic signature (S509), the wireless Internet of the web server While transmitting to the application 242 (S510), if the received message does not contain an electronic signature, the message is immediately delivered to the wireless Internet application 242 of the web server (S510).

Next, the operation process of the transmission security module of the web server transmitting the response message received from the wireless internet application / web daemon of the web server to the reception security module of the wireless terminal is as follows. 6 is a flowchart illustrating an operation process of a transmission security module used in the web server shown in FIG.

First, the transmission security module of the web server receives the response message received from the web daemon of the web server (S601), and then analyzes the header of the response message (S602) to search whether it is a wireless application security header (S603). If the search result is not the wireless application security header, the received message is directly transmitted to the microbrowser (S614). If the search result is the wireless application security header, it is analyzed whether the response message requests the session establishment between the web server and the wireless terminal. S603). As a result of the analysis, when the response message requests the end-to-end session establishment, it searches for whether there is a previously established end-to-end session (S604), while if the analysis result does not request the end-session establishment, it is determined whether the response message includes the electronic signature. Search (S608). In addition, if a previously established session does not exist, end-to-end authentication and security negotiation (S607) is performed, whereas if a previously established session already exists, the end-to-end authentication and security negotiation process (S607) is omitted. When end-to-end authentication and security negotiation is completed as described above, it is analyzed whether the response message requests the electronic signature (S608). As a result of the analysis, if the electronic signature request is included, after extracting the content of the message to be digitally signed from the response message (S609) and then determining whether to encrypt the electronically signed message (S610), the digital signature request If it does not include, it is immediately determined whether to encrypt the received message (S610). If it is determined that the message is to be encrypted, the security script of the response message is processed (S611), the plain text to be encrypted is extracted and encrypted (S612), and session identifier information is added to the header of the encrypted message. While the header is reconfigured (S613) and transmitted to the receiving security module of the wireless terminal, if it is determined that the message is not encrypted, the header is reconfigured (S613) and immediately transmitted to the receiving security module 120 of the wireless terminal. .

Next, the operation process of the reception security module of the wireless terminal providing the reverse security service by receiving the message received from the transmission security module of the web server is as follows. 7 is a flowchart illustrating an operation process of a reception security module used in the wireless terminal illustrated in FIG. 3.

First, when the reception security module of the wireless terminal receives a response message from the transmission security module of the web server (S701), it analyzes the header of the received message (S702) and searches whether it is a wireless application security header (S703). As a result of the search, the wireless application security header analyzes whether the received message requests the end-to-end session establishment (S704), while if the search result, the wireless application security header is not, the received message is directly transmitted to the microbrowser (S712). . Next, as a result of analysis of the received message, if there is an end-to-end session establishment request, the terminal performs end-to-end authentication and security negotiation (S705). If there is no end-to-end session establishment request, the end-to-end authentication and security negotiation process is omitted. As such, when end-to-end authentication and security negotiation is completed, it is determined whether or not to decrypt the received message (S706). As a result of the determination, if the message needs to be decrypted, it is searched whether there is a preset end-to-end session using the identifier indicated in the header of the response message (S707). The message is transmitted (S712). Next, as a result of the search, if there is a preset end-to-end session, the security script of the received response message is processed (S708), and then decrypted (S709), while if there is no preset session, it is immediately transmitted to the microbrowser (S712). Next, it is analyzed whether the decrypted plain text message includes the electronic signature (S710). As a result of the analysis, if the electronic signature is included, the electronic signature is checked and stored (S711), and then transferred to the microbrowser (S712). On the other hand, if the analysis result does not include the electronic signature, the plain text is immediately returned to the microbrowser. Deliver the message (S712).

The transmission / reception security module used in such a web server and a wireless application security device in a wireless terminal commonly manages a session control block to determine whether an end-to-end session is established. The session control block consists of session identifier, socket identifier, web server's internet address, session state parameter, end-to-end negotiation state, and security parameters (session key, cryptographic algorithm, public key, private key, etc.). There is a need for a way to know whether a session exists without session identifier information before a session is established from the block. In this way, the transmission security module of the web server uses the socket identifier. The transmission security module of the wireless terminal uses an Internet address (URL) of a web server.

Next, the end-to-end authentication and security negotiation process between the transmission security module of the web server and the reception security module of the wireless terminal will be described in detail. 8 is a flowchart illustrating an end-to-end authentication and security negotiation process between a reception security module of the wireless terminal and a transmission security module of a web server shown in FIG. 3. As shown, the operation process of the transmission security module of the web server, and accordingly the operation process of the reception security module of the wireless terminal. In such an operation step, a corresponding message transmission and reception step between the reception security module of the wireless terminal and the transmission security module of the web server will be omitted in the operation step.

First, the transmission security module of the web server allocates a session identifier for session establishment and initializes the session control block, and then constructs a message for initiating end-to-end security negotiation (S801) and transmits it to the reception security module of the wireless terminal. do.

An example of a message for initiating the end-to-end security negotiation transmitted is as follows: "HTTP / 1.1 200 OK Content-Length: 0 Content-Type: text / vnd.wap.wml E2eSession: on E2eSid: session identifier".

After receiving the end-to-end security negotiation initiation message, the reception security module of the wireless terminal stores the session identifier through the session control block and generates a security session start inquiry message (S802). The generated security session initiation inquiry message is shown to the wireless terminal user (S803), and the wireless terminal user who has seen the security session initiation inquiry message confirms what response (S804). If it is confirmed that the response positively accepts the secure session setup, the security negotiation parameter list available on the wireless terminal is included in the body of the message and sent to the transmission security module of the web server (S805). If rejected, the session establishment rejection message is configured (S806) and transmitted to the transmission security module of the web server.

An example of a session initiation response message transmitted here is "POST /wals.hs HTTP / 1.1 Content-Length: 0 Content-Type: Application / vnd.wap.hs; HsState = Reject E2eSid: Session Identifier" or POST / wals. hs HTTP /1.1 Content-Length: Length of ClientHello body Same as "Content-Type: Application / vnd.wap.hs; HsState = ClientHello E2eSid: Session Identifier CRLF clientHello Body".

The transmission security module of the web server determines whether to reject the session establishment for the received session start response message (S807). If it is determined that the end-to-end session establishment is rejected, the session is terminated and the mock session is maintained (S808). If the session establishment negotiation is agreed, the algorithm, key length, and the like that the server can support from the security negotiation list on the wireless terminal side are determined. After determining end-to-end security parameters, the result is stored in the session control block (S809).

At this time, the mock session is required for session management and means a session having a session identifier but no negotiated security parameters.

Next, a response message including a server negotiation result and a server certificate is configured (S810) and transmitted to the reception security module of the wireless terminal. The receiving security module of the wireless terminal receiving the response message verifies the received server certificate, calculates the session key based on the security negotiation result, and stores the result in the session control block (S811). Next, a message including a security negotiation end signal and a wireless terminal certificate is configured and transmitted to the transmission security module of the web server (S812). The transmission security module of the web server verifies the received certificate of the wireless terminal, calculates a session key, stores the session key in the session control block (S813), and constructs a message for the completion of the security negotiation (S814). The security negotiation is completed by transmitting to the module (S815). The reception security module of the wireless terminal also receives a message about the completion of the security negotiation received from the transmission security module of the web server and completes the security negotiation (S816).

While the invention has been described above based on the preferred embodiments thereof, these embodiments are intended to illustrate rather than limit the invention. It will be apparent to those skilled in the art that various changes, modifications, or adjustments to the above embodiments can be made without departing from the spirit of the invention. Therefore, the protection scope of the present invention will be limited only by the appended claims, and should be construed as including all such changes, modifications or adjustments.

As described above, according to the present invention, when providing an application service such as electronic commerce on the wireless Internet, it is possible to provide a security service by selecting only important specific contents among all messages transmitted and received between the wireless terminal and the web server. There is. In addition, there is an effect that can be used in the end-to-end security field for wireless Internet services, such as electronic commerce applications.

Claims (13)

delete delete delete delete A method of securing contents of a wireless Internet system comprising a wireless terminal including a wireless application security device, a web server including a web application server and a wireless application security device, and a gateway for protocol-translating messages transmitted between the wireless terminal and the web server. , When the web application server of the web server requests a wireless internet service from the wireless terminal, the web application server applies a security script to the wireless internet service application requested from the wireless terminal and sets a type of security service that will process the security script. A first step of generating a wireless application security message by displaying the HTTP header in an extension header of the message and providing the same to a wireless application security device of the web server; A second step of detecting, by the wireless application security unit of the web server, if the wireless application security message is a session establishment request signal, whether a secure session with the wireless terminal is connected; A third step of end-to-end authentication and security negotiation with the wireless application security device of the wireless terminal if the wireless application security device of the web server is not connected to the security session as a result of the detection of the second step; The wireless application security of the web server expands the HTTP message if the wireless application security message is not a session establishment request signal in the first step or if a secure session with the wireless terminal is connected as a result of the detection of the second step. A fourth step of analyzing the header to secure the security script and then transmitting the security script to the wireless application security device of the wireless terminal so that the wireless application security device of the wireless terminal performs security reverse processing on the security script. How to secure the contents of a wireless Internet system. 6. The method of claim 5, wherein the end-to-end authentication and security negotiation of the third step uses an extension header of the HTTP message as the end-to-end security negotiation channel. The method of claim 6, wherein the third end-to-end authentication and security negotiation step, A security negotiation initiation step of allocating a session identifier for establishing a session and transmitting an end-to-end security negotiation initiation message to the wireless application security unit of the wireless terminal; When the wireless application security device of the web server receives a security negotiation parameter list from the wireless application security device of the wireless terminal, a security negotiation for determining an end-to-end security parameter such as an algorithm and a key length that the web server can support from the security negotiation parameter list. Steps; The wireless application security unit of the web server transmits the end-to-end security negotiation result of the security negotiation step to the wireless application security unit of the wireless terminal, and calculates a session key according to the end-to-end security negotiation result from the wireless application security unit of the wireless terminal. A security negotiation result transmission step for transmitting the security negotiation result; The wireless application security server of the web server calculates a session key, generates a security negotiation completion message, and transmits to the wireless application security device of the wireless terminal when the security negotiation termination signal is input from the wireless terminal after performing the security negotiation result transmission step. A method of securing contents of a wireless Internet system, comprising a security negotiation completion step. The method of claim 5, wherein the first step, The web application server of the web server comprises a security script processing step of applying a security script to the content to be decrypted or digitally signed of the wireless Internet service applications requested from the wireless terminal; The web application server of the web server, the security service type display step of generating a wireless application security message by displaying the type of security service to process the security script in the HTTP extension header, The web application server of the web server includes a security message transmission step of transmitting the wireless application security message of the HTTP form to a wireless application security device of the web server through a web daemon. The method of claim 5, wherein the fourth step, The wireless application security of the web server is a first security message recognition step of recognizing whether the wireless application security message of the HTTP type of the wireless application security header; The wireless application security unit of the web server recognizes the security service type displayed in the wireless application security extension header and secure processing step of digitally signing and / or encrypting the security script applied to the HTTP message; The wireless application security unit of the web server calculates the body length of the HTTP message after the digital signature and / or encryption processing, updates the header of the HTTP message, adds a session identifier to the header of the HTTP message, and transmits the And a post-processing step of transmitting to a wireless application security device of the wireless terminal. The method of claim 9, wherein the fourth step, After the post-processing step, the wireless application security of the wireless terminal is a second security message recognition step of recognizing whether the HTTP message has a wireless application security header from the wireless application security of the web server, The wireless application security unit of the wireless terminal further includes a security reverse processing step of recognizing a security service type indicated in the wireless application security extension header and decrypting and / or reversely processing a digital signature in a security script applied to the HTTP message. How to secure content in a wireless Internet system. 6. The content security of a wireless internet system according to claim 5, wherein in the second step, the wireless application security of the web server recognizes whether a secure session with the wireless terminal is connected by using a session control block. Way. 12. The method of claim 11, wherein the session control block includes a session identifier, a socket identifier, a URL of a web server, a session state parameter, an end-to-end negotiation state, and a security parameter. To a web server connected to a wireless terminal through a gateway, When a wireless internet service is requested from the wireless terminal, a security script is applied to the wireless internet service application requested from the wireless terminal, and a security service type for processing the security script is displayed in an extension header of a hypertext transfer protocol (HTTP) message. Generating a wireless application security message; Detecting whether a secure session with the wireless terminal is connected when the wireless application security message is a session establishment request signal; A third step of end-to-end authentication and security negotiation with the wireless terminal if the security session is not connected as a result of the detection of the second step; In the first step, if the wireless application security message is not a session establishment request signal or if a security session with the wireless terminal is connected as a result of the detection of the second step, the extension header of the HTTP message is analyzed to the security script. To the wireless terminal after the secure process is executed, and the program is stored in a computer for executing a method for securing the contents of the wireless Internet system, the fourth step of causing the wireless terminal to perform security reverse processing on the security script. Recordable media.