KR20010056418A - Method keeping end-to-end security in application level for wireless application protocol - Google Patents

Abstract

The end-to-end security method in the WAP according to the present invention, the WSP layer for providing a browser layer as an application for the interface with the user, and the function to establish and release a reliable session between the service providing server and the wireless terminal according to the procedure. And a WTP layer for request and response processing, a WTLS layer for security between the wireless terminal and the WAP gateway, and a WDP layer for providing datagram services for specific bearer services supporting data transmission services. A service providing server as an Internet service provider comprising a wireless terminal as a terminal, an application layer, an HTTP layer for enabling HTTP, which is one of the protocols on the Internet, and a TCP / IP layer for enabling communication of a network and a transport layer. For connecting the two ends A WAP, WTP, WTLS, WDP layer as a WAP stack of a wireless terminal, and a WAP gateway for performing protocol conversion work together with the HTTP and TCP / IP layers of a service providing server. In this case, an SSLS layer is provided at a browser layer of the wireless terminal and an application layer of a service providing server to perform information exchange and encryption for security by the SSLS layer of the wireless terminal and the service providing server.

Here, the information exchange for security uses a POST method of the WSP layer, and the encryption between the wireless terminal and the service providing server preferably uses a method of sharing an encryption key.

The present invention can perform end-to-end security on a WAP even in a conventional WAP gateway with only a change in the application level of the end without a structural change of the WAP gateway.

Description

Method keeping end-to-end security in application level for wireless application protocol

The present invention relates to a method of end-to-end security on a wireless application protocol (WAP), and more particularly, to a method of end-to-end security on a WAP that can implement security between two ends only by changing the application level of the end.

The Internet that can communicate with each other by connecting networks around the world is now living in a way that makes us feel uncomfortable without the Internet such as providing various information, mail service, e-commerce, internet banking, cyber securities, etc. Occupies a large part of the. In addition, due to the recent development of mobile communication, internetworking has emerged not only in the wired network, but also in the connection between the Internet and the mobile network. Security issues in commerce, banking, and securities payment systems are becoming more important.

1 is a block diagram illustrating a security system for end-to-end security on a WAP.

Referring to FIG. 1, a security system for end-to-end security on a WAP includes a mobile client 100, which is a wireless terminal for using a service, and a service provider server for providing the service. 400 and a WAP (Wireless Application Protocol) Gateway 200 for converting a protocol between a wireless network and a Transmission Control Protocol / Internet Protocol (TCP / IP) network to connect the two ends. It is equipped with.

In addition, the security system is further provided with a WAP proxy (300) having a WAP gateway in the security area in addition to the WAP gateway 200.

Here, the wireless terminal 100 is a browser layer 101 as an application for an interface with a user, a reliable session between the service providing server 400 and the wireless terminal 100. a wireless session protocol (WSP) layer 102 for providing a function of setting and releasing a session according to a procedure, a wireless transaction protocol (WTP) layer 103 for request and response processing, and a wireless terminal ( 100) and a wireless transport layer security (WTLS) layer 104 for security between the WAP gateway 200 and a datagram service for a specific bearer service supporting a data transmission service. It consists of a Wireless Datagram Protocol (WDP) layer 105.

In addition, the service providing server 400 enables communication between the application layer 401, the HTTP layer 402 for enabling the HyperText Transport Protocol (HTTP), which is one of the protocols on the Internet, and the network and transport layers. It consists of a TCP / IP layer (403).

In addition, the WAP gateway 200 and the WAP proxy 300 are for connecting the two end points, and correspond to the WSP stack 201, the WTP layer 202, and the WTLS corresponding to the WAP stack of the wireless terminal 100. The layer 203, the WDP layer 204, the HTTP layer 205 corresponding to the service providing server 400, and the TCP / IP layer 206 are provided together to perform protocol conversion between WAP and HTTP. Here, the WAP proxy 300 receives data from the WDP layer 204 of the WAP gateway 200.

Therefore, unless the service providing server 400 has the WAP stacks 201 to 204, the wireless terminal 100 may access the service providing server 400 only through the WAP gateway 200.

The end-to-end security method on the conventional WAP in the above security system will be briefly described.

First, when a wireless terminal 102 reading a Wireless Markup Language (WML) page selects an address on the web that includes a particular port (e.g. 5003) and attempts to access that address, the browser layer ( 101 informs the WDP layer 105 that the port 5003 is in range of the specified particular port. The WDP layer 105 then sends the message to the WAP gateway 200 by replacing the destination port of the message with the port 5003 contained in the address. The WAP gateway 200 monitors the specific port 5003 and forwards the message coming into the port 5003 to the WAP proxy 300.

At this time, the WAP proxy 300 checks the forwarded message and if the wireless terminal 100 that sent the message is not in the secure area, rejects the connection and if it is in the secure area, converts a protocol such as a general WAP gateway 200. In operation, the message is processed to transmit the message transmitted from the wireless terminal 100 to the service providing server 400.

As described above, in the conventional end-to-end security method on the WAP, the wireless terminal 100 establishes a session with the WAP proxy 300, and the WAP gateway 200 transfers data from the WDP layer 204 to the WAP proxy 300. By not transmitting the data to the WAP gateway 200 to maintain the security with the service providing server 400. However, in the security maintenance method as described above, a separate security gateway called WAP proxy 300 should be provided. The WAP proxy 300 performs actual security, and the service providing server 400 relates to security. Only WAP proxy 300 should be absolutely trusted.

The present invention was created to solve the above problems, and it is possible to operate in a conventional WAP gateway without changing the other WAP gateway by changing only the application level of the end, and to exchange information for security at the application level of the two ends. Its purpose is to provide an end-to-end security method on WAP that can perform end-to-end security by performing encryption directly.

1 is a block diagram illustrating a security system for end-to-end security on a conventional WAP.

2 is a block diagram illustrating a security system for end-to-end security on a WAP in accordance with the present invention.

<Explanation of symbols for the main parts of the drawings>

100 ... Wireless terminal 200 ... WAP gateway

300 ... WAP Proxy 400 ... Service Provisioning Server

101 ... Browser layer 102, 201, 301 ... WSP layer

103, 202, 302 ... WTP Layer 104, 203, 303 ... WTLS Layer

105, 204 ... WDP layer 205, 304, 402 ... HTTP layer

206, 305, 403 ... TCP / IP layer 401 ... application layer

501, 502 ... SSLS layer

In order to achieve the above object, in the end-to-end security method on the WAP according to the present invention, the browser layer as an application for the interface with the user, and a reliable session between the service providing server and the wireless terminal in accordance with the procedure, Datagram services for specific bearer services that support data transfer services, a WSP layer to provide the capability to provide a request, a WTP layer to process requests and responses, a WTLS layer to secure wireless terminals and WAP gateways, and data transfer services. A wireless terminal as a wireless terminal composed of a WDP layer for providing, an application layer, an HTTP layer for enabling HTTP, which is one of the protocols on the Internet, and a TCP / IP layer for enabling communication between a network and a transport layer. A service providing server as a configured internet service provider; WAP, WTP, WTLS, WDP layer as a WAP stack of wireless terminal, and WAP gateway for performing protocol conversion work together with HTTP, TCP / IP layer of service server. In a security system on a WAP, an SSLS layer is provided at a browser layer of the wireless terminal and an application layer of a service providing server to perform information exchange and encryption for security by the SSLS layer of the wireless terminal and the service providing server.

Here, the information exchange for security uses a POST method of the WSP layer, and the encryption between the wireless terminal and the service providing server preferably uses a method of sharing an encryption key.

According to the present invention as described above, the end-to-end security can be performed on the WAP even in the conventional WAP gateway only by the change of the application level of the end without the structural change of the WAP gateway.

Hereinafter, an end-to-end security method on a WAP according to the present invention will be described in detail with reference to the accompanying drawings.

2 is a block diagram illustrating a security system for end-to-end security according to the present invention.

2, the end-to-end security method on the WAP according to the present invention can be applied to the conventional security system on the WAP. That is, the security system provides a function for setting and releasing a reliable session between the browser layer 101 and the service providing server 400 and the wireless terminal 100 as an application for an interface with a user. WSP layer 102, WTP layer 103 for request and response processing, WTLS layer 104 for security between wireless terminal 100 and WAP gateway 200, and specific data support services. A wireless terminal 100 as a wireless terminal composed of a WDP layer 105 for providing a datagram service for a bearer service, an application layer 401, and an HTTP layer for enabling HTTP, which is one of protocols on the Internet ( 402, a service providing server 400 as an Internet service provider composed of a TCP / IP layer 403 for enabling communication of a network and a transport layer, between the two ends WSP layer 201, WTP layer 202, WTLS layer 203, WDP layer 204, and service providing server 400 corresponding to the WAP stack of the wireless terminal 100. And a WAP gateway 200 having an HTTP layer 205 and a TCP / IP layer 206 together to perform protocol conversion between WAP and HTTP.

However, unlike the conventional security system in which a WAP proxy having a WAP gateway is added for security, the security method according to the present invention uses the conventional WAP gateway 200 as it is and uses two application levels, that is, a wireless terminal ( Security is performed by the SSLS layers 501 and 502 by placing the SSLS layers 501 and 502 in the browser layer 101 of the 100 and the application layer 401 of the service providing server.

The end-to-end security method according to the present invention in the above security system will be described in detail.

First, when the wireless terminal 100 selects an address including a specific port of the security area, the browser layer 101 analyzes the address, and if the port included in the address is a specific port, the SSLS layer 501 is selected. Send a message via At this time, the SSLS layer 501 includes the user information and the like in the transmitted message for information exchange for security as required by the browser layer 101, and provides a service providing server (WAP gateway 200) through the WAP gateway 200 ( 400).

Here, the address includes a name of an SSLS agent for processing a message coming into a specific port of the SSLS layer 502 of the service providing server 400, and the service providing server 400 refers to the specific port. The agent runs on incoming messages and processes them. In addition, including the above security information in the message uses a POST method provided by the WSP layer (102, 201) that provides a function for establishing a session between the service providing server 400 and the wireless terminal 100. do.

When the message is transmitted to the service providing server 400 through the WAP gateway 200, the SSLS agent included in the message is executed at the service providing server 400. The agent processes and stores the security information included in the message transmitted from the wireless terminal 100, and then transmits a response to the wireless terminal 100. In addition, if the security information transmitted to the wireless terminal 100 is identical to a predetermined value between the wireless terminal 100 and the service providing server 400, the SSLS layer 501 of the wireless terminal 100 encrypts data to be actually transmitted. To the service providing server (400).

After receiving the data, the SSLS agent executes a program for interpreting the encrypted data, interprets the data, performs an operation according to the data, encrypts the result, and transmits the result to the wireless terminal 100. do.

At this time, the encryption applied to the present invention uses a method of sharing the encryption key between the wireless terminal 100 and the service providing server 400.

Meanwhile, when the header information of the transmitted message is SSLS encoding, the wireless terminal 100 decodes it in the SSLS layer 501 and then shows it to the user.

Here, in the present invention, the two ends send and receive data through the WAP gateway 200, but because the data is encrypted, the data can be interpreted only at both ends. Therefore, while using the conventional WAP gateway 200 as it is, it is possible to perform end-to-end security on the WAP by performing information exchange and encryption for security at the application level of the two ends.

As described above, the end-to-end security method in the WAP according to the present invention can be applied to a conventional WAP gateway because the information exchange and encryption for security at the application level is applied, the WTLS layer added for security to the WAP gateway End-to-end security can be achieved without In addition, since the conventional security method uses a WAP proxy having a WAP gateway, it operates separately from the method of the present invention, and thus, when used with the present invention, there is an advantage in that a dual security effect can be obtained.

Claims (3)

A browser layer as an application for interfacing with a user, a WSP layer for providing a function of establishing and releasing a reliable session of a service providing server and a wireless terminal according to a procedure, a WTP layer for request and response processing, A wireless terminal comprising a WTLS layer for security between a wireless terminal and a WAP gateway, and a WDP layer for providing a datagram service for a specific bearer service supporting a data transmission service; A service providing server as an Internet service provider comprising an application layer, an HTTP layer for enabling HTTP, which is one of the protocols on the Internet, and a TCP / IP layer for enabling communication of a network and a transport layer; WAP, WTP, WTLS, WDP layer as a WAP stack of a wireless terminal, and a WAP gateway for performing protocol conversion work together with the HTTP and TCP / IP layers of a service providing server. In the security system on the configured WAP, An SSLS layer is provided at the browser layer of the wireless terminal and the application layer of the service providing server, and information exchange and encryption for security are performed by the SSLS layer of the wireless terminal and the service providing server. Security method. The method of claim 1, The exchange of information for security uses a WSP layer POST method. The method of claim 1, And encryption between the wireless terminal and the service providing server uses a method of sharing an encryption key.