KR100402735B1 - Management Mechanism of End-to-End Session State in Wireless Internet with Application Script - Google Patents

Abstract

The present invention provides a function of managing secure session information in the application layer of the wireless Internet, a wireless Internet system using an application layer script on the server side that can selectively provide only the necessary portion of the message transmitted and received between wired and wireless end-to-end And a method for managing end-to-end secure session information.

The present invention provides a wireless internet system using an application layer script. The wireless internet system includes a browser, a gateway, a web server, a wireless network, and a wired network, wherein the web server responds to a request of a web daemon and a web daemon receiving a service request of the browser. A script interpreter for interpreting and executing scripts; A script security API for providing a security service of the script, performing security negotiation with the browser, and managing session information; And a session information object for storing session information. The secure session information can be managed in a web server for realizing end-to-end end-to-end security services for wired and wireless end-to-end wireless Internet services. When providing the same application service, it is possible to provide a security service at the application layer for messages transmitted and received between wired and wireless end.

Description

Management Mechanism of End-to-End Session State in Wireless Internet with Application Script}

The present invention relates to a wireless Internet system using an application layer script and a method for managing end-to-end security session information using the same. Specifically, to realize end-to-end security service in an application using a wired / wireless end-to-end script for a wireless Internet service. The present invention relates to a method for providing end-to-end security service in an application by setting and maintaining necessary end-to-end security session information using a sub-side script.

As one of the typical wireless Internet contents security methods, there is a WAP (Wireless Application Protocol) security method that performs security at the transport layer. This security method considers the limitations of the wireless domain and changes the protocol scheme of wired and wireless domains and installs a gateway at the wired / wireless boundary.

However, the WAP security method not only temporarily disables security during the process of translating transport layer protocols (translating WSP and HTTP, WTLS and SSL / TLS to each other) at the gateway, but also directly mutually authenticates the WML browser and web server. There is a problem that the authentication process depends on the gateway.

Active Server Pages (ASP) are server-side scripts that run on Microsoft's Web server, Internet Information Server (IIS). ASP allows server-side functions to perform file access, database access, and complex computational tasks, but does not provide security in wired and wireless networks, and it is difficult to maintain session information in transaction-based web servers. have.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems of the prior art, and an object thereof is to provide a function of managing secure session information in an application layer of the wireless Internet, thereby selectively providing only a necessary portion of a message transmitted and received between wired and wireless ends. The present invention provides a wireless Internet system and an end-to-end secure session information management method using an application layer script on the server side.

The wireless Internet system using the application layer script of the present invention for achieving the above object is a wireless Internet system consisting of a browser, a gateway, a web server, a wireless network, a wired network, the web server receives a service request of the browser A script interpreter for interpreting and executing scripts at the request of the web daemon and the web daemon; A script security API for providing a security service of the script, performing security negotiation with the browser, and managing session information; And a session information object for storing session information.

In addition, the present invention provides a secure session information management method of a wireless internet system comprising a browser, a gateway, a web server, a wireless network, and a wired network, the method comprising: a first step of the browser requesting a wireless internet service from the web server; A second step of the web daemon of the web server executing a script through a script interpreter for the wireless Internet service requested by the browser; A third step of secure negotiation between the browser and the script security API in response to a request of the script interpreter; A fourth step of storing secure session information obtained as a result of the security negotiation in the session information object; And a fifth step of providing a security service through the script security API to the request of the browser by using the secure session information stored in the session information object.

1 is a block diagram of a wireless Internet system according to a first embodiment of the present invention;

2 is a block diagram of a WAP / ASP-based wireless Internet system according to a second embodiment of the present invention;

3 is a flowchart for explaining, in time, the steps of using secure session information in the security API of the present invention;

4 is a flowchart illustrating a session information management method in a script security API of the present invention.

* Description of the symbols for the main parts of the drawings *

100: wireless Internet system 130: web server

140: wireless network 150: wired network

200: WAP / ASP based wireless internet system 230: Web server

240: WSP / WTP / WTLS / WDP network 250: HTTP / TLS / TCP network

Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings. 1 is a block diagram of a wireless Internet system using an application layer script according to a first embodiment of the present invention.

Referring to the drawings, a wireless Internet system in which the entirety is denoted by reference numeral 100 includes a security function in an application layer, unlike a conventional wireless Internet system. That is, the wireless Internet system 100 includes a browser 110, a gateway 120, a web server 130, a wireless network 140, and a wired network 150, and the web server 130 is a web daemon 131. , A script interpreter 132, a script security API 133, and a session information object 134.

Referring to the operation of the wireless Internet system of the present invention configured as described above are as follows.

When describing the operation process, it will be described mainly for the end-to-end secure session information management method of the web server of the wireless Internet system, that is, the end-to-end secure session information management method of the web server for the wireless Internet service according to an embodiment of the present invention. .

First, when the browser 110 requests wireless Internet service information related to a security function from the web server 130, the requested information is transmitted to the script interpreter 132 by the web daemon 131 of the web server 130. . The script interpreter 132 calls the script security API 133 when security is required while executing the script, and the script security API 113 establishes a secure session through end-to-end authentication and security negotiation with the browser 110. .

In addition, the web daemon 131 stores parameters necessary for a secure session such as a security key in the session information object 134 and uses the script security API as the secure session information stored in the session information object 134 to generate a browser 110. ) To provide security applied services.

FIG. 2 is a configuration diagram of a WAP / ASP based wireless Internet system using ASP scripts on a WAP and a server side according to a second embodiment of the present invention.

Referring to the drawings, the WAP / ASP-based wireless Internet system of the present invention denoted by the entire code 200, WML browser 210 and gateway 220, web server 230, wireless network 240 and wired network 250 The WML browser 210 includes a WML security API 211 that provides security services such as security negotiation and encryption / decryption of WML scripts, and digital signatures.

The web server 230 includes a web daemon 231, a WML document 232 including an ASP script containing contents of a service requested by a browser, an ASP interpreter 233 for interpreting and executing an ASP, and a security service for an ASP interpreter. It provides an ASP security API 234 that provides a and Global.asa object 235 is stored secure session information. The Global.asa object 235 is an object provided in an ASP script and is suitable for storing session information.

The ASP security API 234 provides security negotiation API 236 for performing security negotiation with the WML security API of the browser, security service API 237 for providing encryption and decryption and digital signature services to the ASP interpreter, and secure session information. It may be divided into a session control block 238 for storing and managing.

In the WAP / ASP-based wireless Internet system 200 configured as described above, the gateway 220 performs protocol conversion and encoding / decoding of the received message. That is, the wireless network 240 section from the WML browser 210 to the gateway 220 is transmitted in the form of an encoded message through the WSP / WTP / WTLS / WDP protocol stack, and the gateway 220 accesses the Internet web server 230. The wired network section 250 is transmitted in a text form conforming to the WML HTTP / TLS / TCP protocol stack.

Add end-to-end security information to HTTP extension headers or WML scripts to implement a transparent security library that is not affected by the gateway. That is, since the wireless application security message is delivered in the form of an HTTP extended message or a WML script, the gateway 220 only needs to convert HTTP to WSP and pass it through. Therefore, regardless of the encoding function of the gateway, it is possible to provide end-to-end wireless application security service in the existing wireless Internet system environment.

The browser 210 starts a security session through the WML security API, negotiates security with the web server 230, and receives security services such as encryption and decryption and electronic signature.

The web daemon 231 executes the ASP script of the WML / ASP script document 232 through the ASP interpreter 233 at the request of the WML browser 210. Depending on the content of the ASP script, it uses the security negotiation, encryption and digital signature services provided by the ASP security API 234. This process is performed only once per transaction from the WML browser.

However, because one session contains several transactions, secure session information needs to be maintained throughout the session. Through the session control block 238, secure session information can be maintained by storing it in the session information object (Global.asa) 235 provided in the ASP script.

Hereinafter, a wireless internet end-to-end secure session information management method using an application layer script according to an embodiment of the present invention will be described.

3 is a flowchart for explaining, in time, a step in which security session information is used in a security API.

Referring to the drawings, when the WML script command is performed to perform security negotiation in the WML browser 210, the WML security API 211 requests the web server 230 to generate a secure session. In the web server 230, the security negotiation API 236 is performed to generate session creation information, and the information is stored in the session information object 239 through the session control block 238, and the server-side security information is stored in the WML browser. To 210.

Next, the WML browser 210 delivers the security information of the browser to the web server 230, and the security negotiation API 236 reads the session generation information stored in the previous transaction through the session control block 238, and secure session information. After completing, store it again in the session information object 239 and transmit the completed session information to the browser.

Through this process, the browser 210 and the web server 230 safely share information required for one security session. Thereafter, the security service API 237 reads the secure session information from the session information object 239 through the session control block 238 in response to a request of the script interpreter 233, and provides security services such as encryption and digital signature. do.

4 is a flowchart illustrating a session information management method in a script security API for processing a request message received from a browser user.

First, the script security API 237 determines whether the message requested from the browser is a message requesting to create a secure session (S401). If it is determined that the message is a request for creating a secure session, the session creation information is stored in the session information object 239 (S402), and the server security information is then returned to the browser (S403).

In step 401, if it is not a message for requesting the creation of a secure session, it is determined whether the message has been transmitted to the security information of the browser (S404), and if it is a message that has transmitted the security information of the browser, the session information object 239 Read the session creation information from (S405).

It is determined whether the session creation information is read from the session information object 239 or not (S406). If the session creation information is read, the secure session information is completed and stored in the session information object 239 (S407). ), And completes the process by responding (S408) the completed security session information to the browser.

If it is not the message that the security information of the browser side has been transmitted in step 404, it is determined whether it is a request to use a security service such as encryption and decryption and electronic signature (S409).

As a result of the determination in step 409, if the request uses the security service, the process is completed by reading the security session information from the session information object 239 (S410) and applying the security service using the response (S411).

In order to manage end-to-end sessions, the web server manages secure session information through a script security API and a session information object. In addition, the secure session information includes a session identifier, a socket identifier, a web address of a web server, a session state parameter, an end-to-end negotiation state, and a security parameter (session key, encryption algorithm, public key, private key, etc.).

As described above, the present invention has been described based on the preferred embodiments, but these embodiments are intended to illustrate the present invention, not to limit the present invention, and those skilled in the art to which the present invention pertains should be practiced without departing from the technical spirit of the present invention. It will be apparent that various changes, modifications, or adjustments to the examples are possible. Therefore, the protection scope of the present invention will be limited only by the appended claims, and should be construed as including all such changes, modifications or adjustments.

As described above, in the present invention, when providing an application service on the wireless Internet, the application of all the messages transmitted and received between the browser and the web server by managing the security information for the entire session in the web server beyond one transaction range, the application Security services can be provided as needed in the hierarchy, which can be used for end-to-end security applications for wireless Internet services such as electronic commerce applications.

Claims (7)

In the wireless Internet system consisting of a browser, a gateway, a web server, a wireless network, a wired network, The web server includes a script daemon for interpreting and executing a script according to the request of the web daemon and the web daemon; A script security API that provides a security service of a script, performs security negotiation with the browser, and manages session information; And A session information object for storing secure session information; Wireless Internet system using an application layer script, characterized in that it comprises a. The method of claim 1, The script security API includes a security negotiation API that provides a security negotiation function with the browser, a security service API that provides security service functions such as encryption and decryption, and an electronic signature, and session information objects that have been negotiated with the browser. Wireless Internet system using an application layer script, characterized in that it comprises a session control block for storing and managing. In the secure session information management method of a wireless Internet system consisting of a browser, a gateway, a web server, a wireless network, and a wired network, A first step of the browser requesting a wireless internet service from the web server; A second step of the web daemon of the web server executing a script through the script interpreter for the wireless Internet service requested from the browser; A third step of secure negotiation between the browser and the script security API in response to a request of the script interpreter; A fourth step of storing the secure session information obtained as a result of the security negotiation in the session information object; And A fifth step of providing a security service to the request of the browser through the script security API using the secure session information stored in the session information object; end-to-end of a wireless internet system using an application layer script How to manage secure session information. The method of claim 3, wherein the third step, A first sub step of the script interpreter requesting security negotiation with the browser from the security negotiation API; And A second sub-step of negotiating security information with the browser in the security negotiation API through an application layer message exchanged between the browser and the web server; and an end-to-end of a wireless Internet system using an application layer script. How to manage secure session information. The method of claim 3, wherein the fourth step, A first sub-step of instructing the session control block to store secure session information obtained as a result of the security negotiation in the security negotiation API; And And a second sub-step of storing the secure session information in the session information object in the session control block. 16. A method of managing end-to-end secure session information of a wireless internet system using an application layer script. The method of claim 3, wherein the fifth step, A first sub-step of requesting a security applied wireless Internet service to the web daemon from the browser; A second sub step of performing a script in the web daemon through the script interpreter for the wireless Internet service requested from the browser; A third sub-step of requesting, from the script interpreter, a security service function such as encryption and decryption and an electronic signature to the security service API; A fourth sub step of requesting secure session information from the secure service API to the session control block; A fifth sub step of reading secure session information from the session information object in the session control block and transferring the secure session information to the secure service API; A sixth sub step of providing a security service to the script interpreter using the security session information in the security service API; And And a seventh sub step of transmitting, by the web daemon, the execution result of the script interpreter to the browser. End-to-end secure session information management method of a wireless Internet system using an application layer script, characterized in that it comprises a. The method of claim 3, And the secure session information includes a session identifier, a connection state, and an end-to-end negotiated security key.