KR100876320B1 - Web service security system and method using an embedded security server. - Google Patents

Abstract

The present invention relates to a web service security system and method using an embedded security server.

More specifically, in a web service security system made between a client and a web server via the Internet, embedded in the web server, when receiving a security policy and certificate request signal from the client provides a pre-stored security policy and certificate, and transmits Decrypts the session key and sequence information, generates and digitally signs the session information, decrypts the received request page, generates a response page after verification, and then sends the encrypted and electronic signature to the client, and sends it to the client. An embedded security server that encrypts the cookie information to be set and decrypts the encrypted cookie information when provided, and is installed in the client, and interoperates with the embedded security server to request a security policy and a certificate for a request page and to transmit the server. Created by checking authenticity and setting security Encrypts and transmits the session key and sequence information.If the electronically signed session information is transmitted from the embedded security server, the request page is encrypted and sent through an electronic signature inspection.After verification, the encrypted response page is decrypted to decrypt the sequence information. It provides a built-in security server client for providing a response screen to the client after the electronic signature check and matching confirmation, and provides a built-in security server client installation information to the client, and provides a communication interface for communication between the web server and the embedded security server A web service security system using a built-in security server including a security server filter, a built-in security server client, a web application server performing data communication with the security server filter, or the embedded security server;

A method of securing a web service between a client and a web server through the Internet, the method comprising: (A) determining whether to install an embedded security server client when receiving information on a request page from the client, and (B) the embedded security server client. If is installed, check the security policy set in the request page, encrypting the request page using the session key and sequence information generated in accordance with the security policy and transmitting to the embedded security server, and (C) the transmitted security policy Verifying and decrypting the request page using the session key, inspecting the digital signature of the sequence information, and generating a response page if the match is confirmed; (D) encrypting the generated response page; Increasing and then digitally signing and transmitting; (E) recovering the encrypted response page. (B) providing a response screen to the client after the sequence information is digitally verified and checking the sequence information; and (F) encrypting and digitally signing and transmitting the cookie information set from the client, The present invention relates to a web service security method using an embedded security server comprising providing a response screen to the client by decrypting and checking an electronic signature when the encrypted cookie information is provided from the client.

Description

System and Method for processing security for web services using Embedded Secure Server}

1 is a block diagram of a web service security system using a built-in security server according to an embodiment of the present invention.

2 is a detailed configuration diagram of a web service security system using a built-in security server according to an embodiment of the present invention.

3A is a flowchart illustrating a web service security method using an embedded security server when a requesting web page is first accessed according to an exemplary embodiment of the present invention.

3B is a flowchart illustrating a web service security method using an embedded security server when a requesting web page is first accessed according to an exemplary embodiment of the present invention.

4 is a flowchart illustrating a web service security method using a built-in security server when using a secured web page according to an embodiment of the present invention.

*** Explanation of symbols for main parts of drawing ***

100: Client 110: Web Browser Handler

111: HTTP module 112: SSL module

120: embedded security server client 121: encryption module

122: decryption module 123: digital signature module

124: version control module 125: account management module

126: Security Policy Management Module 200: Internet

300: web server 310: web server engine

320: security server filter 330: filter interlocking means

331: HTML / IMAGE module 332: CGI module

333: SSL module 334: WAS interface module

335: S / W installation module 340: embedded security server

341: encryption module 342: decryption module

343: digital signature module 344: version control module

345: account management module 346: cookie management module

347: Security Policy Management Module 348: Security Rule Database

349: certificate management module 350: certificate database

400: web application server

The present invention relates to a web service security system and method using an embedded security server.

More specifically, the present invention relates to a web service security system and a method for easily applying security by embedding a security server in a web server to increase security tightness of a web service between a client and a web server.

Web security protocols currently being used as de facto standards worldwide are Netscape's Secure Socket Layer (SSL) and TLS (Transport Layer Security) protocols.

SSL is a cryptographic security used to establish a secure connection between two communication entities, and an SSL application that allows independent programmers to successfully exchange cryptographic parameters without knowing anything about each other's code. It provides a mechanism for interoperability and the ability to apply new public keys and new cryptographic techniques as needed, and by providing such a structure, you can design another new protocol to apply a new public key or cryptographic technique, or a new security library. Its goal is to provide scalability that prevents the implementation of the system and additional efficiency of additional session caching for CPU-intensive cryptographic operations, thereby reducing the number of connections that need to be established and the relative efficiency that reduces network footprint. do.

The components of the SSL protocol consist of session creation, key exchange method, and encryption for data transmission.

Session creation follows the handshake process between the client and server.

The key exchange method defines how the shared secret key to be used for the transfer of application data is shared between the client and server. The key exchange algorithm allows you to choose between RSA key exchange and Diffie-Hellman key exchange.

Encryption for data transmission uses SSL symmetric encryption.

However, the SSL protocol is a web security protocol implemented in the United States, and only the products with low encryption level that can be imported into Korea among the cipher products that applied the SSL protocol due to the US export restriction law, Therefore, there is a problem in that there is no method of adopting or using a cipher technology such as a cipher algorithm developed in Korea in the conventional SSL protocol.

Meanwhile, an electronic filing document is a document made of a computer or the like and composed of digital information. Since electronic documents can be transmitted in a short time through a data communication network or the Internet, their use is increasing as computer communication technology is developed.

However, since the electronic document is transmitted to the counterpart as a digital signal through a communication network, the security of the document is weak. Therefore, a method of attaching an electronic signature is used as a method for improving the reliability of an electronic document.

An electronic signature is a signature in the form of a seal, signature, or cryptographic form of digital information that is electronically attached or logically attached to the electronic document to identify the signer and indicate that the signer has signed the document.

In order to overcome the problems of the SSL security protocol, a localized algorithm compatible with the SSL security protocol has been developed.

Therefore, there is a need to develop a security system for a web service by combining a localized encryption algorithm with the digital signature.

The present invention has been made to solve the above problems,

It is an object of the present invention to provide a web service security system and method using a built-in security server that can easily apply encryption and digital signature to securely process communication data between a client and a server.

Another purpose is to select and apply pages that require security processing to reduce client performance degradation due to the encryption and decryption process, and by interworking with the web application server (WAS), there is no need for a separate process to reduce process performance. The purpose is to provide a web service security system and method using a built-in security server that can reduce and save memory.

For another purpose, web service security using the built-in security server that is compatible with other applications because the client installation program is installed as a web browser communication module without being affected by other security protocols by processing all communication using HTTP. The purpose is to provide a system and method.

Web service security system and method using a built-in security server of the present invention for achieving the above object,

A web service security system formed between a client and a web server through the Internet, the web server is embedded in the web server, and upon receiving a security policy and certificate request signal from the client, provides a pre-stored security policy and certificate, and transmits a session key and After decrypting the sequence information, the session information is generated and digitally signed, and when the encrypted request page is received, the encrypted information page is decrypted by verifying, generating a response page after verification, then encrypted and digitally signed and transmitted to the client, and the cookie information set in the client And a built-in security server that decrypts and transmits encrypted cookie information when provided, and installed on the client, and checks the authenticity of the server when requested by sending a security policy and certificate for a request page in conjunction with the embedded security server. Secure Session Generated Session Keys and Sequences Encrypts and transmits the information, and when the electronically signed session information is transmitted from the embedded security server, encrypts and transmits the request page through the digital signature check, and decrypts the encrypted response page when the encrypted response page is transmitted after verification. Security server filter that provides a built-in security server client that provides a response screen to the client after confirming a match, and provides embedded security server client installation information to the client, and provides a communication interface for communication between the web server and the embedded security server. And a web application server configured to perform data communication with the embedded security server client, the security server filter, or the embedded security server.

In the method of securing web service between client and web server through internet,

(A) receiving information about a request page from the client, determining whether an embedded security server client is installed, and (B) checking the security policy set on the request page if the embedded security server client is installed, and a security policy. Encrypting the request page using the previously generated session key and sequence information according to the method and transmitting the encrypted request page to the embedded security server, (C) confirming the transmitted security policy and decrypting the request page using the session key; Checking a digital signature of sequence information and generating a response page if it is matched; (D) encrypting the generated response page, incrementing the sequence information, and then transmitting and digitally signing; (E) the Decrypt the encrypted response page and check the sequence information digital signature to increase the sequence information Providing a response screen to the client, and (F) encrypting and electronically signing and transmitting the cookie information set from the client, and decrypting and checking the electronic signature when the encrypted and digitally signed cookie information is provided from the client. It is achieved by providing a web service security method using a built-in security server comprising the step of providing a response screen to the client.

Hereinafter, a preferred embodiment of the present invention will be described in detail with reference to the drawings.

1 is a block diagram of a web service security system using a built-in security server according to an embodiment of the present invention.

In detail with reference to Figure 1,

As shown in FIG. 1, the present invention may include a client 100, a web browser handler 110, an internet 200, a web server 300, and a web application server 400.

The client 100 is a user terminal that can be connected to the web server 300 or the web application server 400 (WAS) through a wired or wireless Internet 200 network, and is generally a desktop computer or a notebook computer. , Ultra Mobile PC (UMPC), Personal Digital Assistant (PDA), refers to a palmtop computer and the like, but the present invention is not limited thereto.

The web browser handler 110 is an application program provided from the web server 300 and installed inside the client 100 to control the web browser.

In addition, an Internet communication protocol, a security protocol, a security policy, etc. are provided from the web server 300 to perform a security process in the client 100.

The internet 200 is a computer communication network connected to the client 100 and the web server 300 or the web application server 400 to be connected through a wired or wireless network.

The web server 300 works with the web browser handler 110 installed in the client 100 to provide a security policy and a certificate necessary for a security process.

The web application server 400 configures an application-based server to facilitate data communication between the client 100 or the web browser handler 110 and the web server 300.

In addition, a distributed system for smoothly communicating data with the web server 300 may be provided.

2 is a detailed configuration diagram of a web service security system using a built-in security server according to an embodiment of the present invention.

In detail with reference to Figure 2,

The web browser handler 110 may be configured to include an HTTP module 111, SSL module 112, embedded security server client 120.

The HTTP module 111 is a transmission protocol for communication of the Internet 200 with the web server 300.

The SSL module 112 is a security protocol for securing data communication by using an authentication encryption function between the web browser and the web server 300.

The embedded security server client 120 is a security application provided from the web server 300, encryption module 121, decryption module 122, digital signature module 123, version management module 124, account management Module 125, security policy management module 126 may be configured to include.

When the encryption module 121 requests and provides a security policy and a certificate for the request page of the client 100, a session key and sequence generated when the server authenticity is determined using the certificate information and the security policy is set. The information is encrypted and transmitted to the web server 300.

In addition, when the session information about the session key and the sequence information is generated and transmitted from the web server 300, the electronic device checks whether the session information is digitally signed and checks whether it matches, and encrypts the request page and transmits it to the web server 300. .

The session key refers to an encryption key temporarily used during a session between the embedded security server client 120 and the web server 300.

The session information includes information for securely communicating during a session between the embedded security server client 120 and the web server 300.

The sequence information may be configured to include information on the sequence of the data processing process during data communication between the web server 300 and the web browser, and a sequence number having a reproduction blocking protection function during data communication. The sequence number also consists of a 32-bit number that is incremented by one, and the receiving computer examines this field to verify that no data has ever been received with this number on the secure connection, and if so, rejects the data. Perform

The certificate is a certificate issued for the security of the web server by an accredited certification authority. The certificate includes the issuer, the user, the expiration date, and the identification information. Therefore, the certificate is used to match the domain and other information of the web server. Judging from this, the certificate information is confirmed that there is no alteration.

The decryption module 122 performs a decryption process when an encrypted response page is transmitted from the web server 300.

The digital signature module 123 digitally inspects the session information provided from the web server 300 to determine whether the digital signature module 123 matches the session information digitally signed by the web server 300.

In addition, the digital signature inspection is performed on the sequence information provided from the web server 300 to determine whether it matches the sequence information digitally signed by the web server 300.

The digital signature is a security technology that performs message authentication and user authentication functions transmitted through a communication network. In general, an electronic signature is generated by encrypting with a sender's private key and attached to the information. The information is compared and judged by decrypting with the public key.

That is, the electronically signed session information and the electronically signed sequence information are decrypted from the web server 300 using the public key, and then a match is determined.

The version management module 124 checks the version of the embedded security server client 120 (or the web browser handler 110) installed in the client 100, and determines whether to update. In other words, if the version is not the latest version through the latest version to manage the version.

The account management module 125 manages account information for the client 100. The account information may be configured for each client 100, but may also be configured for each program of the embedded security server client 120 installed in the client 100.

The security policy management module 126 requests a security policy for a request page from the web server 300, performs a security policy setting process when a security policy is transmitted, and transmits the set security policy to the web server 300. Send again.

In addition, if the security policy for the request page is already set, check the security policy set in conjunction with the web server 300.

The web server 300 may include a web server engine 310, a security server filter 320, a filter interlocking means 330, and a built-in security server 340.

The web server engine 310 is a main processor that constructs a web server 300 including web page information.

The security server filter 320 provides a communication protocol and an interface to facilitate communication between the web server engine 310 and the embedded security server 340.

In addition, it is possible to configure a network structure to be separated and interlocked with the filter interlocking means (330).

The filter interlocking means 330 is, as shown in Figure 2, HTML / IMAGE module 331, CGI module 332, SSL module 333, WAS interface module 334, S / W installation module 335 It may be configured to include).

The HTML / IMAGE module 331 configures source information of an HTML-based web page document and includes an IMAGE file included in the web page document.

The CGI module 332 provides an interface for data communication between the web server 300 and a web browser through a common gateway interface (CGI).

The SSL module 333 provides a security protocol for data security during internet communication between the web server 300 and the web browser handler 110 (or the embedded security server client 120).

The WAS interface module 334 provides a communication interface for facilitating data communication with the web application server 400.

The S / W installation module 335 provides an embedded security server client 120 (or web browser handler 110) when requested from the client 100 in association with the embedded security server 340, and installs the process. To play a role.

The embedded security server 340 is a server embedded in the web server 300, and builds a security server in the web server 300.

In addition, the built-in security server 340, encryption module 341, decryption module 342, digital signature module 343, version management module 344, account management module 345, cookie management module 346, security The policy management module 347, the security rule database 348, the certificate management module 349, and the certificate database 350 may be configured.

The encryption module 341 encrypts the response page for the request page provided from the client 100 and transmits the encrypted response page to the client 100.

The decryption module 342 decrypts the session key and sequence information generated and encrypted according to the security policy set by the embedded security server client 120, and performs a decryption process when an encrypted request page is transmitted.

The electronic signature module 343 generates the electronic signature by generating session information when the session key and the sequence information are decrypted from the decryption module 342, and electronically signs the response page by the encryption module 341 so that the client ( 100).

The version management module 344 determines whether to update the version of the embedded security server client 120 (or the web browser handler 110) installed in the client 100, and determines the latest version of the embedded security server client 120. Performs a function provided in conjunction with the version control module 124 of the client 100.

The account management module 345 receives and manages the account information when the embedded security server client 120 is installed in the client 100. The account information may be generated for each client 100 or for each program installed in the client 100.

When the cookie management module 346 transmits the cookie information to the client 100, the cookie management module 346 encrypts and transmits the information and transmits the cookie information. do.

The security policy management module 347 works with the security policy management module 126 of the embedded security server client 120 to provide a security policy and to store and manage a security policy set in a web page.

The security rule database 348 is a database constructed by storing a security rule for determining a security policy in association with the security policy management module 347.

When the certificate management module 349 requests a certificate from the embedded security server client 120, the certificate management module 349 loads a previously stored certificate and transmits the stored certificate to the embedded security server client 120 together with a security policy.

The certificate database 350 is a database constructed by storing the certificate in association with the certificate management module 349. Requesting a certificate from the certificate management module 349 provides a certificate.

3A is a flowchart illustrating a web service security method using an embedded security server when a requesting web page is first accessed according to an exemplary embodiment of the present invention.

3B is a flowchart illustrating a web service security method using an embedded security server when a requesting web page is first accessed according to an exemplary embodiment of the present invention.

Referring to Figures 3a and 3b in detail,

First, the web page access request is determined from the client 100 to check the request page (S300).

Next, it is determined whether the embedded security server client 120 (or the web browser handler 110) provided from the web server 300 is installed (S302).

If the embedded security server client 120 is not installed, the security policy is determined from the embedded security server 340 to determine whether to apply the security (S304, S306).

If the security target is not applied to the non-security applied HTML-based web page is provided (S308).

If the security target is applied in step S306, it is determined whether there is a security policy applied to the request page (S310).

If no security policy is applied, it provides a built-in security server client 120 (or web browser handler 110) installation screen interface (S312), if there is an installation request from the client 100, the web server 300 embedded The security server client 120 (or the web browser handler 110) is downloaded and the installation process is performed (S314).

If the built-in security server client 120 (or the web browser handler 110) is installed in step S302 to proceed to step S316.

The built-in security server client 120 (or web browser handler 110) is installed to request the security policy and certificate to be set in the request page to the embedded security server 340 (S316).

The requested security policy and certificate are loaded from the embedded security server 340 (S318), and the responded security policy is provided to the embedded security server client 120 (or the web browser handler 110) (S320).

Set the security policy and certificate transmitted from the embedded security server 340 and determine whether or not to match the information of the web server 300 using the certificate (S322), and encrypts the generated session key and sequence information again the The built-in security server 340 transmits (S324).

The transmitted session key and sequence information are decrypted (S326), session information is generated and digitally signed (S328), and the electronically signed session information is maintained (S330).

When the electronically signed session information is transmitted to the embedded security server client 120 (or the web browser handler 110), the electronic signature of the session information is checked to determine whether the session information matches (S332).

Maintaining the matched session information (S334), the sequence number included in the sequence information is increased, and then the request page is encrypted and transmitted to the embedded security server 340 (S347).

When the encrypted request page is transmitted to the embedded security server 340, the encrypted request page is decrypted and the sequence information is verified (S349). The verification process is a process of checking whether the electronic signature of the sequence information matches.

If the sequence information is verified, a response page is generated (S340).

The generated response page is encrypted (S342), the sequence number is incremented, and then electronically signed and transmitted to the embedded security server client 120 (or the web browser handler 110) (S344).

The transmitted response page is decoded (S346), and the electronic signature is checked to determine whether it matches (S348).

If the match is confirmed, the sequence number is increased, and then a response screen is provided to the client 100 (S350).

4 is a flowchart illustrating a web service security method using a built-in security server when using a secured web page according to an embodiment of the present invention.

Referring to Figure 4 in detail,

Web page access request from the client 100 to confirm the request page (S400).

The security policy set in the request page is checked from the embedded security server client 120 (or the web browser handler 110) installed in the client 100 (S402).

If the security policy is confirmed, the request page is encrypted using the session key and sequence information according to the security policy and transmitted to the embedded security server 340 (S404).

After checking the security policy of the transmitted request page, it is decrypted using the session key (S406 and S408), and the electronic signature of the sequence information is checked to determine whether it matches (S410).

If the match is confirmed, a response page is generated, and the response page is encrypted using the session key (S412, S414).

The sequence number is incremented and then digitally signed (S416), and transmitted to the embedded security server client 120 (or web browser handler 110) together with the encrypted response page.

Decode the transmitted response page (S418), and if the match is confirmed by checking the digital signature of the sequence information (S420, S422), and increases the sequence number (S420, S422), and provides a response screen to the client (S424).

Preferred embodiments of the present invention described above are disclosed for purposes of illustration, and those skilled in the art will be able to make various modifications, changes and additions within the spirit and scope of the present invention. Additions should be considered to be within the scope of the following claims.

Web service security system and method using a built-in security server of the present invention as described above,

By using a security program installed in a web browser, a web service security system and method using an embedded security server that can be easily encrypted and applied to an electronic signature can be improved, thereby improving user accessibility and security tightness.

Another effect is that it can reduce the performance of the client or reduce the traffic by selecting and applying secured pages, and can implement distributed systems through security systems and methods linked with web applications. It is effective.

Another effect is that HTTP-based security processing is not affected by other security protocols, and there is no need to monitor the network, and it is highly compatible with other applications through a security program installed in the communication module of a web browser. It is easy to apply.

Claims (10)

In the web service security system between the client and the web server through the Internet, It is embedded in the web server and, upon receiving a security policy and certificate request signal from the client, provides a pre-stored security policy and certificate, decrypts the transmitted session key and sequence information, and generates and digitally signs the session information. Built-in security that decrypts and receives the requested page, generates a response page after verification, encrypts and digitally signs and transmits it to the client, encrypts the cookie information set in the client, and decrypts and transmits the encrypted cookie information when provided. server; Installed in the client, in conjunction with the built-in security server to request a security policy and certificate for the request page when sent to verify the authenticity and security of the server generated by encrypting the transmitted session key and sequence information, the built-in security When the electronically signed session information is transmitted from the server, the request page is encrypted and transmitted through the digital signature check, and the encrypted response page is decrypted after the verification is transmitted. An embedded security server client; A security server filter providing the client with embedded security server client installation information and providing a communication interface for communication between the web server and the embedded security server; And And a web application server communicating data with the embedded security server client, the security server filter, or the embedded security server. The method of claim 1, wherein the built-in security server An encryption module for encrypting a response page for the request page requested from the client; A decryption module for generating session information by decrypting the session key and sequence information provided from the embedded security server client, and decrypting an encrypted request page from the embedded security server client; An electronic signature module for digitally signing the generated session information, encrypting a response page of a request page decrypted from the decryption module, and incrementing a sequence number included in the sequence information; A version management module for performing a version update by determining whether to update an embedded security server client installed in the client; An account management module for managing the generated accounts for each client; A cookie management module for encrypting and digitally signing cookie information set in the client, and for decrypting and digitally signing cookie information transmitted from the client; A security policy management module providing a security policy to which a security policy is requested from the client, and checking a security policy of an encrypted request page; A security rule database that stores a security rule applied to a security policy; A certificate management module for providing a certificate previously stored in a database when a certificate is requested from the client; And Certificate database for storing the certificate in conjunction with the certificate management module; Web service security system using a built-in security server further comprises. The method of claim 1, wherein the embedded security server client An encryption module for setting a security policy and a certificate transmitted from the web server, encrypting the session key and sequence information, and encrypting a request page of the client; An electronic signature module for electronic signature checking of session information and sequence information provided from the web server; A version management module for updating a version by determining whether to update the installed software version; An account management module for managing a user account created from the client; And The web service security system using the embedded security server further comprises a security policy management module for requesting the web server to set the provided security policy, and check the security policy of the request page. The method of claim 1, wherein the security server filter An HTML / IMAGE module for generating a web page document source provided from the web server and providing various web pages to the client; A CGI module providing a communication interface for data communication between the embedded security server client and the web server installed in the client; An SSL module for providing a security protocol during internet communication with the embedded security server client; A WAS interface module for data communication with the web application server; And S / W installation module for providing the built-in security server client when requested from the client; Web service security system using an embedded security server made in conjunction with the filter interlocking means. The method of claim 1, wherein the embedded security server client Is installed in the client to control the web browser, characterized in that it is installed inside the web browser handler including an HTTP module for providing an internet communication protocol between web servers, and an SSL module for providing a security protocol for internet communication between web servers. Web service security system using an embedded security server. In the web service security method between the client and the web server through the Internet, (A) the web server determining whether to install a built-in security server client when receiving information about a request page from the client; (B) If the embedded security server client is installed, the client checks the security policy set in the request page, encrypts the request page using the previously generated session key and sequence information according to the security policy, and sends it to the embedded security server. Doing; (C) the embedded security server checking the transmitted security policy, decrypting the request page by using the session key, and checking the digital signature of the sequence information to generate a response page if it is confirmed to match; (D) the embedded security server encrypting the generated response page, incrementing the sequence number included in the sequence information, and then digitally signing and transmitting it; (E) the embedded security server client decrypts the encrypted response page, checks the sequence information digital signature, increments the sequence number if match is found, and provides a response screen to the client; And (F) The embedded security server encrypts and digitally signs and transmits the cookie information set from the client, and if the encrypted and electronically signed cookie information is provided from the client, decrypts and digitally signs and provides a response screen to the client. Web service security method using an embedded security server comprising the step of. The method of claim 6, wherein step (A) (A-1) the web server, if the embedded security server client is not installed, checking whether the request page is subject to security; (A-2) if the web server is a security target, determining whether security is applied; (A-3) if the web server is an unsecured page, providing a built-in security server client installation interface to the client; And (A-4) the web server, if there is an installation request from the client using the provided interface, providing and installing the embedded security server client; Web service security method using an embedded security server further comprises. The method of claim 7, wherein step (A-1) (A-11) if the web server is a non-security target, providing a response page in the form of a non-security HTML document; Web service security method using a built-in security server further comprises. The method of claim 7, wherein step (A-2) (A-21) if the web server is a security-applied page, classifying the secured web page and providing a previously applied security response page; Web service security method using an embedded security server further comprises. The method of claim 6, wherein step (B) (B-1) if the client does not have a security policy set for a request page from the installed embedded security server client, requesting a security policy and a certificate from the embedded security server; (B-2) the web server transmitting the security policy and the certificate from the embedded security server to the client; (B-3) setting, by the client, the transmitted security policy and certificate to generate a session key and sequence information, encrypting and transmitting the encrypted key to the embedded security server; (B-4) the embedded security server decrypting the transmitted session key and sequence information, generating session information, and digitally signing; And (B-5) if the embedded security server client checks the electronic signature of the session information and confirms the match, increases the sequence number, encrypts the request page, and transmits the request page to the embedded security server. Web service security method using a security server.

Images