KR101492821B1 - Method and system for transmitting key securely to hypertext transfer protocol page - Google Patents

Abstract

A key delivery method and system for delivering a secure key to an HTTP (HyperText Transfer Protocol) page is disclosed. A computer-implemented key delivery method includes: acquiring a secret key for use during a login session in an HTTPS (Hypertext Transfer Protocol over Secure Socket Layer) according to a login request from a terminal; Receiving from the terminal a secure cookie or a sub-path cookie to which the secret key is added according to an HTTPS request in an HTTP (Hypertext Transfer Protocol) page, and transmitting the secure key or the sub- And transmitting the extracted HTTPS request message to the terminal through a response message to the HTTPS request.

Description

METHOD AND SYSTEM FOR TRANSMITTING KEY SECURELY TO HYPERTEXT TRANSFER PROTOCOL PAGE.

Embodiments of the present invention relate to a key delivery method and system for securely transmitting a key to a HyperText Transfer Protocol (HTTP) page.

In Hypertext Transfer Protocol (HTTP), there is a possibility that an authentication key (cookie) is seized through network sniffing. An attacker can use this authentication key to perform a session replay attack. Sniffing refers to the act of tapping data on a network using a sniffer, which is an eavesdropping device that eavesdrops on traffic flowing on a computer network. Sniffing attacks, which overheard packets exchanged by other parties on the network, can be a very dangerous attack in environments where multiple vendors share the same network, such as Web hosting, Internet Data Center (IDC), and others. When one system is attacked, the system is used to eavesdrop on the network, and it is possible to grasp the user ID and password of another system. Although it can make sniffing difficult by establishing a network of switching environments, there are many attack methods that can bypass it. The best way to prevent sniffing is to encrypt the data.

The Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) is a security-enhanced version of HTTP, the world wide web communications protocol. It is widely used in various web services and e-commerce. In addition, instead of using plain text in socket communication, session data is encrypted through SSL (Secure Socket Layer) or TLS (Transport Layer Security) protocol. Thus ensuring adequate protection of the data.

However, HTTPS has a higher introduction cost than HTTP. For example, in the content delivery network (CDN) of images over HTTPS, the cost is 3 to 5 times higher than the cost of CDN for images over HTTP. However, there is a problem that a security warning occurs when a page is provided with HTTPS and an image is provided with HTTP.

Provides a key delivery method and system that can securely encrypt an HTTP request by exchanging secret keys securely between an HTTP (Hypertext Transfer Protocol) page and a server.

A computer-implemented key delivery method, comprising: obtaining a secret key for use during a login session in a Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) according to a login request from a terminal; Transmitting the secret key to the terminal through an HTTPS page; Receiving, from the terminal, a secure cookie or a sub-path cookie to which the secret key is added according to an HTTPS request in an HTTP (Hypertext Transfer Protocol) page; And extracting the secret key from the secure cookie or the subpath cookie and transmitting the secret key to the terminal through a response message to the HTTPS request.

According to one aspect, the secret key is added to the secure cookie or the sub-path cookie via the HTTPS page, and the HTTPS request is transmitted to the HTTP page through an HTTPS API call using a JSONP (JavaScript Object Notation with Padding) And the like.

According to another aspect of the present invention, the secure cookie or the sub-path cookie may be deleted from the terminal after receiving the secure cookie or the sub-path cookie, or after transmitting the response message.

According to another aspect of the present invention, the key delivery method includes receiving a service request, a time stamp, and a first key-hash message authentication code (hereinafter, referred to as " keyed-hash message authentication code, HMAC); Retrieving a secret key of the terminal from a persistent storage and generating a second Kid-Hash message authentication code from the timestamp using the retrieved secret key; And comparing the first key-hash message authentication code with the second key-hash message authentication code, comparing the time of the time stamp with a current time, and providing a web service according to the service request according to the comparison result The method comprising the steps of:

A computer-implemented key delivery method comprising: transmitting login information to a web server via an HTTPS page; Receiving a secret key for use during a login session from the web server via the HTTPS page; Storing the received secret key in a secure cookie or a sub-pass cookie; Transmitting an HTTPS request to the web server via an HTTP page; And receiving a response message for the HTTPS request from the web server and confirming the secret key included in the response message. The web server may further include a step of receiving, by the web server, the secure cookie or the sub- And the secret key is extracted from the cookie and added to the response message and transmitted.

At least one storage unit; And at least one processor, the at least one processor obtaining a secret key for use during a login session in HTTPS according to a login request from the terminal; Transmitting the secret key to the terminal through an HTTPS page; Receiving, from the terminal, a secure cookie or a sub-path cookie to which the secret key is added according to an HTTPS request in an HTTP page; And extracting the secret key from the secure cookie or the subpath cookie and storing the secret key in the at least one storage unit and transmitting the extracted secret key to the terminal through a response message to the HTTPS request A key transmission system is provided.

At least one storage unit; And at least one processor, the at least one processor transmitting the login information to a web server via an HTTPS page; Receiving a secret key for use during a login session from the web server via the HTTPS page; Storing the received secret key in a secure cookie or a sub-pass cookie; Transmitting an HTTPS request to the web server through an HTTP page; And a step of receiving a response message for the HTTPS request and confirming the secret key included in the response message.

HTTP requests can be easily encrypted by securely exchanging secret keys between the Hypertext Transfer Protocol (HTTP) page and the server.

1 is a flowchart illustrating a key exchange process according to an exemplary embodiment of the present invention.
FIG. 2 is a diagram illustrating a process of securely providing a web service using an exchanged secret key according to an embodiment of the present invention. Referring to FIG.
3 is a diagram illustrating a user terminal, an HTTPS page, an HTTP page, and a web server according to an exemplary embodiment of the present invention.
4 is a flowchart illustrating a key delivery method performed by a Web server according to an exemplary embodiment of the present invention.
5 is a flowchart illustrating a key delivery method performed by a user terminal according to an exemplary embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

In the embodiments of the present invention, a technology for securely transmitting a secret key issued for each login session in an HTTPS page to an HTTP page, and using securely using the secret key in HTTP will be described.

1 is a flowchart illustrating a key exchange process according to an exemplary embodiment of the present invention. 1 shows a user 110, a Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) page 120, a Hypertext Transfer Protocol (HTTP) page 130 and a web server 140. The steps performed by the user 110, the HTTPS page 120 and the HTTP page 130 in Figure 1 are substantially the same as the input of the user 110 or the source code of the HTTPS page 120 or HTTP page 130 The HTTPS page 120 or the HTTP page 130 is performed by the terminal of the user 110 according to the control of the web browser or for the convenience of explanation and understanding.

The user 110 may attempt to log in to the web server 140 via the HTTPS page 120 with enhanced security as compared to the HTTP page 130 at step 151. [

At step 152, the web server 140 may securely receive the secret key at the HTTPS page 120. [

At step 153 the web server 140 may add the secret key to the response body of the HTTPS page 120 for the login attempt.

At step 154, the HTTPS page 120 may store the secret key in the local storage. Since HTTP and HTTPS have different schemes, local storage is not shared, and HTTP can not share a secret key stored in local storage. At this time, the HTTPS page 120 may store the secret key in the local storage in consideration of the case where the HTTPS page 120 is used again later.

In step 155, the HTTPS page 120 may store the secret key in a secure cookie or a subpath cookie. Even though HTTP and HTTPS have different schemes, cookies can be shared in the same domain. Accordingly, the HTTPS page 120 can store the secret key through the secure cookie so that it can not acquire the secret key via HTTP. In addition, the HTTPS page 120 may generate a cookie as a sub-path so that the cookie is not delivered over the network. Note that you can create but not read cookies from other passes.

At step 156, the HTTPS page 120 may be switched to the HTTP page 130. [ The embodiments of the present invention securely deliver the secret key to the HTTP page 130 in order to solve the problem of the HTTPS page 120 having a higher introduction cost than the HTTP page 130, Security. Accordingly, after the secure cookie or the sub-path cookie is generated, the service can be provided through the HTTP page 130 by switching to the HTTP page 130. [

In step 157, the HTTP page 130 may request the web server 140 for a secret key stored in the secure cookie or the sub-path cookie via an HTTPS request. For example, an HTTPS request may occur in response to an HTTPS API call using a JavaScript Object Notation with Padding (JSONP) method in the HTTP page 130. [ In order to communicate with the Javascript on the web, the HTTP page 130 may call the HTTPS API (Application Program Interface). Calls using the AJAX method are not available because they are recognized as cross domains between HTTP pages and HTTPS pages, whereas calls using the JSONP method are possible. For example, a JSONP-style call is a method that dynamically inserts a script object into an HTML page and calls the GET method, but not the POST method.

In step 158, the web server 140 may provide the secret key obtained through the secure cookie or the sub pass cookie to the HTTP page 130 through a response message to the HTTPS request. The HTTP page 130 may obtain the secret key via the web server 140, such as step 157 and step 158, since the secret key can not be directly read from the secure cookie or subpath cookie.

At step 159, the HTTP page 130 may store the secret key in local storage.

In step 160, the HTTP page 130 may display the HTTP page 130. [

As described above, the HTTP page 130 can securely exchange secret keys with the web server 140, and can encrypt and transmit messages using the exchanged secret key, thereby providing a sniffing-safe web service.

Also, for the safer secret key exchange, the secure cookie or sub-path cookie may be deleted after obtaining the secret key at the HTTP page 130. [ For example, the web server 140 may add the secret key to the response body of the HTTP page 130 at step 158, while the terminal of the user 110 may access the response page of the HTTP page 130 through the source code of the HTTP page 130 You can control to delete cookies.

FIG. 2 is a diagram illustrating a process of securely providing a web service using an exchanged secret key according to an embodiment of the present invention. Referring to FIG. FIG. 2 illustrates the user 110, HTTP page 130, and Web server 140 described in FIG. The steps performed by the user 110 and the HTTP page 130 may also be performed by the user 110 in accordance with the input of the user 110 or under the control of the source code or web browser of the HTTP page 130, And may be the steps performed by the terminal.

At step 210, the user 110 may access the HTTP page 130 as a page for the web service.

In step 220, the HTTP page 130 may read the secret key from the local storage if the HTTP page 130 does not have the secret key. In step 159 of FIG. 1, an example in which the HTTP page 130 stores the secret key in the local storage has been described.

In step 230, the HTTP page 130 may generate a keyed-hash message authentication code (HMAC) from the timestamp using the secret key. HMAC is a special structure for the computation of a message authentication code involving a cryptographic hash function combined with a cryptographic secret key in a cryptographic scheme with a hash-based message authentication code.

In step 240, the HTTP page 130 may request service information from the web server 140 using the time stamp and the HMAC.

At step 250, the web server 140 may retrieve the user's private key from a persistent storage.

In step 260, the web server 140 may generate an HMAC from the timestamp using the retrieved secret key.

The web server 140 may compare the generated HMAC (HMAC of the web server 140) with the received HMAC (HMAC of the HTTP page 130) at step 270.

In step 280, the web server 140 determines that the HMAC of the HTTP page 130 is identical to the HMAC of the web server 140, and that the HMAC of the HTTP page 130 is generated within a predetermined time using the time stamp If so, the HTTP page 130 may send the requested service information to the HTTP page 130 as a normal response. Practically, step 280 is a process in which the web server 140 adds service information to the source code of the HTTP page 130 and transmits the source code with the added service information to the terminal of the user 110 have.

In step 290, the HTTP page 130 may display the HTTP page 130 on which the service information is displayed. Actually, step 290 may be the process of displaying the HTTP page 130 where the terminal of the user 110 displays the service information.

In this way, secure communication using the secret key can be performed between the terminal of the user 110 and the web server 140.

FIG. 3 is a diagram illustrating a user terminal, an HTTPS page, an HTTP page, and a Web server according to an exemplary embodiment of the present invention. FIG. FIG. 5 is a flowchart illustrating a key delivery method performed by a Web server according to an exemplary embodiment of the present invention. Referring to FIG.

3 shows a terminal 310, an HTTPS page 320, an HTTP page 330, and a web server 340. FIG. 4 illustrates a key delivery method performed by the terminal 310 of FIG. 3, and FIG. 5 illustrates a key delivery method performed by the web server 340 of FIG. 3, respectively. Hereinafter, embodiments of the present invention will be described with reference to Figs. 3 to 5. Fig.

In step 410, the terminal 310 may send the login information to the web server 340 via the HTTPS page 320. The terminal 310 is a device of a user communicating with the web server 340 through a network to receive a web service, and may include at least one storage unit and at least one processor. The steps performed by the terminal 310 may be those performed by at least one processor included in the terminal 310 and the local storage illustrated in Figures 1 and 2 may be performed by at least one storage May be included in the unit. At this time, in order for the terminal 310 to communicate with the web server 340, the terminal 310 may access the HTTPS page 320 or the HTTP page 330 having the predetermined URL. Accessing the HTTPS page 320 or the HTTP page 330 by using the URL in the terminal 310 can be realized by the web browser of the terminal 310 displaying the page corresponding to the screen using the source code corresponding to the URL It can mean to do. At this time, if the user inputs information for login (for example, ID and password) through the input interface of the terminal 310 and the login interface of the corresponding page, the terminal 310 transmits the information ) To send the information for login. For example, in step 151, the user 110 attempts to log in to the web server 140 via the HTTPS page 120, the terminal 310 sends the login information to the web server 140 via the HTTPS page 320 340, respectively.

In step 510, the web server 340 may obtain a secret key for use during a login session in HTTPS according to a login request from the terminal 310. [ Here, the login request may correspond to the terminal 310 transmitting the login information to the web server 340 in step 410. The web server 340 is a system capable of providing a web service to the terminal 310 through the HTTPS page 320 or the HTTP page 330 and may include at least one storage unit and at least one processor. The steps performed by the web server 340 may be those performed by at least one processor included in the web server 340, and the fixed storage region described in Fig. 2 may include at least one May correspond to a storage unit.

At step 520, the web server 340 may transmit the secret key to the terminal 310 via the HTTPS page 320. For example, the web server 340 may send the secret key to the terminal 310 by adding the secret key to the response body of the HTTPS page 320 for the login request. As described above, in the HTTPS, since the session data is encrypted through the SSL (Secure Socket Layer) or the TLS (Transport Layer Security) protocol, the terminal 310 and the web server 340 can securely communicate with each other.

In step 420, the terminal 310 may receive a secret key for use during a login session from the web server 340 via the HTTPS page 320. [ In step 520, the terminal 310 can confirm the secret key included in the HTTPS page 320 provided by the web server 340. [ A secret key may be actually transmitted to the HTTPS page 320 and a secret key added to the HTTPS page 320 in the web browser of the terminal 310 may be used.

In step 430, the terminal 310 may store the secret key in the local storage. Storing the secret key in the local storage is for preparing to return to the HTTPS page 320 and back to the HTTPS page 320, and step 420 may optionally be performed as needed.

In step 440, the terminal 310 may store the received secret key in a secure cookie or a sub-pass cookie. As already mentioned, HTTP does not allow access to the data stored in the secure cookie and the subpath cookie, thereby avoiding the risk of exposing the private key via the HTTP page. The secure cookie or the sub-path cookie may also be stored in at least one storage unit included in the terminal 310. [

In step 450, the terminal 310 may send an HTTPS request to the web server 340 via the HTTP page 330. Since the HTTP page 330 can not access the local storage and also can not access the data of the secure cookie or the sub-path cookie, the terminal 310 uses the HTTPS 330 to obtain the secret key to be used in the HTTP page 330, And send the request to the web server 340.

In step 530, the web server 340 may receive from the terminal 310 a secure cookie or a sub-path cookie to which the secret key has been added according to the HTTPS request in the HTTP page 330. [ Since the web server 340 can access the data stored in the secure cookie or the sub pass cookie, the secret key can be obtained from the secure cookie or the sub pass cookie.

In step 540, the web server 340 may extract the secret key from the secure cookie or the sub-path cookie and transmit the secret key to the terminal 310 through a response message to the HTTPS request. At this time, since the secret key is a value read from the HTTPS page 320 according to the HTTPS API call in the HTTP page 330 (for example, it is read using the GET method) HTTP page 330. < / RTI > The extracted secret key may then be stored in a fixed storage area of the web server 340 for secure communication via the HTTP page 330 with the terminal 310.

In step 460, the terminal 310 receives a response message for the HTTPS request from the web server 340 and confirms the secret key included in the response message. In other words, since the secret key obtained via the HTTPS page 320 is not directly accessible / available in the HTTP page 330, the secret key can be delivered to the HTTP page 330 using the secure cookie or sub- have.

The terminal 310 can store the secret key obtained through the HTTP page 330 in the local storage and can receive the web service by displaying the HTTP page 330. [ 2, secure communication can be performed between the terminal 310 and the web server 340 using a secret key, a time stamp, and a key-hash message authentication code.

As described above, according to the embodiments of the present invention, the HTTP request can be easily encrypted by securely exchanging the secret key between the HTTP page and the server.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable array (FPA) A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (17)

A key delivery method of a web server implemented by a computer,
Receiving, by the web server, a secret key for use during a login session via a Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) according to a login request from the terminal;
Transmitting, by the web server, the secret key to the terminal through an HTTPS page;
Receiving, from the terminal, a secure cookie or a sub-path cookie to which the secret key is added according to an HTTPS request in an HTTP (Hypertext Transfer Protocol) page; And
The web server extracts the secret key from the secure cookie or the subpath cookie and transmits the extracted secret key to the terminal through a response message to the HTTPS request
≪ / RTI > The method according to claim 1,
The secret key is added to the secure cookie or the sub-path cookie via the HTTPS page,
Wherein the HTTPS request is generated according to an HTTPS API call using a JavaScript Object Notation with Padding (JSONP) method in the HTTP page. The method according to claim 1,
Wherein the secure cookie or the sub-path cookie is deleted from the terminal after receiving the secure cookie or the sub-path cookie or after the transmission of the response message. The method according to claim 1,
The web server transmits a first keyed-hash message authentication code generated using a secret key transmitted from the terminal to the terminal through a service request, a time stamp, and the response message from the time stamp , HMAC);
The web server retrieving a secret key of the terminal from a persistent storage and generating a second Kid-Hash message authentication code from the timestamp using the retrieved secret key; And
The web server compares the first key-hash message authentication code with the second key-hash message authentication code, compares the time stamp with the current time, Steps to Provide Services
Further comprising the steps of: A key delivery method of a terminal, which is implemented by a computer,
Transmitting, by the terminal, login information to a web server via an HTTPS page;
The terminal receiving a secret key for use during a login session from the web server via the HTTPS page;
The terminal storing the received secret key in a secure cookie or a sub-pass cookie;
The terminal transmitting an HTTPS request to the web server via an HTTP page; And
The terminal receives a response message for the HTTPS request from the web server and confirms the secret key included in the response message
Lt; / RTI >
Wherein the secret key is extracted from the secure cookie or the sub-path cookie in response to the HTTPS request, and is added to the response message and transmitted. 6. The method of claim 5,
Wherein the secret key is stored in the secure cookie or the sub-path cookie via the HTTPS page,
Wherein the HTTPS request is generated according to an HTTPS API call using the JSONP method in the HTTP page. 6. The method of claim 5,
The secure cookie or the sub-path cookie is deleted from the terminal after the secret key is extracted from the secure cookie or the sub-path cookie in the web server or after the response message is transmitted. . 6. The method of claim 5,
Generating a first key-hash message authentication code from a time stamp using the secret key received through the response message; And
The terminal transmits a service request including the time stamp and the first key-hash message authentication code to the web server
Further comprising:
Hash message authentication code is generated from the timestamp using a secret key retrieved from a fixed storage area of the web server, and the first and second key- The hash message authentication code is compared with the time stamp, and the time stamp is compared with the current time, and the web service according to the service request is provided according to the comparison result. A computer-readable recording medium having recorded therein a program for executing the method according to any one of claims 1 to 8. In a web server,
At least one storage unit; And
At least one processor
Lt; / RTI >
Wherein the at least one processor comprises:
Controlling the web server to receive a secret key for use during a login session via HTTPS according to a login request from the terminal;
Controlling the web server to transmit the secret key to the terminal through an HTTPS page;
Controlling the web server to receive a secure cookie or a sub-path cookie to which the secret key is added according to an HTTPS request in an HTTP page; And
Extracts the secret key from the secure cookie or the subpath cookie and stores the extracted secret key in the at least one storage unit and controls the web server to transmit the extracted secret key to the terminal through a response message to the HTTPS request Process
To the web server. 11. The method of claim 10,
The secret key is added to the secure cookie or the sub-path cookie via the HTTPS page,
Wherein the HTTPS request is generated according to an HTTPS API call using the JSONP method in the HTTP page. 11. The method of claim 10,
Wherein the secure cookie or the sub-path cookie is deleted from the terminal after receiving the secure cookie or the sub-path cookie, or after transmitting the response message. 11. The method of claim 10,
Wherein the at least one processor comprises:
Controlling the web server to receive a service request, a time stamp, and a first key-hash message authentication code generated from the time stamp using the secret key transmitted to the terminal through the response message;
Retrieving a secret key of the terminal from the at least one storage unit and using the retrieved secret key to generate a second Kid-Hash message authentication code from the timestamp; And
Hash message authentication code and the second key-hash message authentication code, compares the time stamp with the current time, and provides the web service according to the service request according to the result of the comparison The process of controlling the Web server
To the web server. In the terminal,
At least one storage unit; And
At least one processor
Lt; / RTI >
Wherein the at least one processor comprises:
Controlling the terminal to transmit login information to a web server through an HTTPS page;
Controlling the terminal to receive a secret key for use during a login session from the web server via the HTTPS page;
Controlling the terminal to store the received secret key in a secure cookie or a sub-pass cookie;
Controlling the terminal to transmit an HTTPS request to the web server through an HTTP page; And
Receiving a response message for the HTTPS request, and controlling the terminal to check the secret key included in the response message
Lt; / RTI >
Wherein the secret key is extracted from the secure cookie or the sub-path cookie according to the HTTPS request, and is added to the response message and transmitted. 15. The method of claim 14,
Wherein the secret key is stored in the secure cookie or the sub-path cookie via the HTTPS page,
Wherein the HTTPS request is generated according to an HTTPS API call using the JSONP method in the HTTP page. 15. The method of claim 14,
Wherein the secure cookie or the sub-path cookie is deleted from the terminal after receiving the secure cookie or the sub-path cookie or after transmitting the response message. 15. The method of claim 14,
Wherein the at least one processor comprises:
Controlling the terminal to generate a first key-hash message authentication code from the time stamp using the secret key received through the response message; And
Controlling the terminal to transmit a service request including the time stamp and the first key-hash message authentication code to the web server
Lt; RTI ID = 0.0 >
Hash message authentication code is generated from the timestamp using a secret key retrieved from a fixed storage area of the web server, and the first and second key- The hash message authentication codes are compared with each other, the time of the time stamp is compared with the current time, and the web service according to the service request is provided according to the comparison result.

Images