JP6451963B1 - Communications system - Google Patents

Abstract

Provided are a method, a communication system, and a communication program for preventing unauthorized access in communication between a native application and a web application via a web browser. A native application and a web application share a common key by an arbitrary method, and communication between the native application and the web application via the web browser thereafter is encrypted and protected by the shared common key. [Selection] Figure 1

Description

The present invention relates to a method, a communication system, and a communication program for securely communicating a web application and a native application via a web browser.

As demand for web applications increases, it is required to perform advanced processing on web applications. As a method for performing advanced processing on a web application, one of the functions not yet widely used in web applications is that executable code (that is, JavaScript code) runs on the same terminal where the web browser is running. It is a function that allows you to access the native application you want.

Special table 2016-517571

Fusion of native application and web application opened by WebSocket, HTML http: / d. hatena. ne. jp / eel3 / 20120901/1344643866

When a native application and a web application communicate with each other via a web browser, the communication between the web browser and the web application or between the web browser and the native application can be encrypted by SSL communication, but is deployed on the web browser. Since the HTML content information can be easily tampered by the user, tampering of communication can be intercepted.
The object of the present invention is to communicate between a web application and a native application executed on the same terminal as the web browser, from communication with an unauthorized web application or from tampering with communication by impersonation of a third party. Is provided, and a method for eliminating commands caused by unauthorized communication is provided.

For access from a web application to a native application that runs on the same device as the web browser, the web browser receives content containing executable code, the web browser executes executable code, and the web browser Communicating with the native application, the web browser communicating with the web application, the native application and the web application sharing a common key, the native application encrypting and sending a message, and the web application By encrypting and transmitting a message, communication contents can be protected.

The block diagram which shows embodiment of this invention A block diagram showing an embodiment when a common key is transmitted from a native application to a web application A block diagram showing an embodiment when a common key is transmitted from a web application to a native application A block diagram showing an embodiment when a common key is generated from a password by setting a password for a web application and a native application A flowchart showing a method for acquiring a common key when a common key is transmitted from a native application to a web application A flowchart showing a method for acquiring a common key when a common key is transmitted from a web application to a native application Flow chart for sending a message from a native application to a web application Flow chart for sending a message from a web application to a native application

In a communication between a native application and a web application executed on the same terminal as the web browser, the method of preventing tampering and interception of the communication contents due to unauthorized access is to allow the native application to encrypt or decrypt a message. Including a web application that the native application communicates with the web browser, allowing the web server to encrypt or decrypt messages, so that in communication between the native application and the web application, It is possible to protect the contents of communication or eliminate the command due to unauthorized communication.
For example, if a web application provider issues a native application corresponding to the web application to be provided and the web application user has installed the native application, the web browser communicates with the web application, and the web browser and native application By performing communication, mutual communication between the web application and the native application becomes possible.
Alternatively, the web application corresponds to the communication function of the native application issued by a third party, so that the web application and the native application can communicate with each other.
Furthermore, both the web application and the native application share the same common key, and the communication content can be protected by encrypting or decrypting the communication content using the shared common key.

FIG. 1 is a functional block diagram illustrating an embodiment of a system for providing secure communication in communication between a native application and a web application. The client terminal 100 can be any computer device that can access the World Wide Web and can be connected to the web server 141 through the network 150. The network 150 can be HTTP, HTTPS, or web socket, or any other communication protocol.

The web application 131 can hold and distribute content in the form of one or more web pages 103. The HTML content 103 can include a variety of web-based content including HTML content. The network 150 can be any wide area network or local area network, and can be the World Wide Web.

The client terminal 100 is shown in FIG. 1 as a simplified device that can access the World Wide Web. Those skilled in the art will appreciate that the client terminal 100 has many other components that are omitted in FIG. 1 for simplicity. The client terminal 100 includes a native application 101 and a web browser 102.
The native application 101 is downloaded from the web application 131 or a third party server to the client terminal 100 and executed. The native application 101 can be one or a plurality of arbitrary modules or applications.

The embedded web server 113 can listen to the connection of the network 104 at an arbitrary port.
The embedded web server 113 can communicate with either the message decryption unit 111 or the message encryption unit 112 based on an arbitrary control flow, and transmit arbitrary information to the native application communication unit 121 via the network 104.
The embedded web server 113 can communicate arbitrary information with the native application communication unit 121 based on an arbitrary control flow.

The common key 114 is common key data created using AES, DES, or PBE as a common key encryption method.

The common key 114 and the common key 145 are the same common key data shared by an arbitrary method.

When the client terminal 100 and the web application 131 exchange common key data by an arbitrary method and the common key 114 and the common key 145 are installed, the common key encryption method is subsequently performed between the native application 101 and the web application 131. Encrypted communication is possible.

The message encryption unit 112 can encrypt the message transmitted from the embedded web server 113 using the common key encryption method using the common key 114 and transmit the message to the embedded web server 113. .
The encrypted message is transmitted to the native application communication unit 121 through the network 104, transmitted from the native application communication unit 121 to the web application communication unit 122, and transmitted from the web application communication unit 122 to the web server 141 through the network 150.

The message decryption unit 111 can decrypt the message transmitted from the embedded web server 113 using the common key encryption method using the common key 114 and transmit the message to the embedded web server 113. .

The network 104 may be an HTTP, HTTPS, web socket, or WebRTC communication channel with the native application communication unit 121 as a client.

When the network 104 is HTTP or HTTPS, the embedded web server 113 implements Cross-Origin Resource Sharing and permits communication with other domains.

The web browser 102 is an HTML5-compliant web browser capable of web socket connection with an HTML5-compliant web server.

The HTML content 103 can include HTML or JavaScript code.
Further, the JavaScript code constitutes a native application communication unit 121 and a web application communication unit 122.

The HTML content 103 is downloaded from the HTML content issuing unit 142 through the network 151.
The communication method at that time is HTTP or HTTPS.

When the HTML content 103 is displayed by the web browser 102, the native application communication unit 121 and the web application communication unit 122 are configured to be executable.

The native application communication unit 121 requests the embedded web server 113 to connect to the network 104 based on an arbitrary control flow.

The native application communication unit 121 can communicate arbitrary information with the embedded web server 113 through the network 104.
The communication format at that time may be JSON, XML, binary data, or any communication format.

The native application communication unit 121 can communicate arbitrary information with the web application communication unit 122.
The communication method at that time is exchange of information on executable code, COOKIE or HTML5 compliant data storage, or any information exchange means that the native application communication unit 121 and the web application communication unit 122 can access each other. It is possible.
The communication format at that time may be JSON, XML, binary data, or any communication format.

The web application communication unit 122 can communicate with the web server 141 through the network 150.
The web application communication unit 122 can communicate arbitrary information with the web server 141 through the network 150 using AJAX, IFRAME, or any HTML5-compliant communication method based on any control flow. .
The communication format at that time may be JSON, XML, binary data, or any communication format.

The network 150 can be the Internet, an intranet, or any network.

The network 151 can be the Internet, an intranet, or any network.

The web application 131 is an arbitrary program constructed on an arbitrary computer device.
The web application 131 can be composed of one or a plurality of arbitrary modules or applications.

The web server 141 is any program that runs on Apache, Nginx, IIS, or any web server program.

The HTML content issuing unit 142 transmits the HTML content 103 to the web browser 102 via the network 151 based on a request from the web browser 102 using HTTP or HTTPS.
The HTML content issuing unit 142 is expressed as a URL or an arbitrary address accessible by the web browser 102.

The web server 141 can wait for a connection of the web application communication unit 122 at any port by HTTP, HTTPS, web socket, WebRTC, or any protocol.

The web server 141 can communicate with any one of the message decryption unit 143 and the message encryption unit 144 based on an arbitrary control flow, and can transmit arbitrary information to the web application communication unit 122 through the network 150.

The message encryption unit 144 can encrypt the message transmitted from the web server 141 using the common key encryption method using the common key 145 and transmit the message to the web server 141.
The encrypted message is transmitted to the web application communication unit 122 through the network 150, transmitted from the web application communication unit 122 to the native application communication unit 121, and transmitted from the native application communication unit 121 to the embedded web server 113 through the network 104. Send.

The message decrypting unit 143 can decrypt the message transmitted from the web server 141 using the common key 145 using the common key encryption method, and transmit the decrypted message to the web server 141.

FIG. 2 is a block diagram illustrating an embodiment when a common key is transmitted from the native application 101 to the web application 131.

The common key issuing unit 211 can issue the common key 114 using the common key encryption method.

The public key 213 may be public key data having a length of 1024 to 4096 bits created using DSA encryption or RSA encryption.
The public key 213 corresponds to the secret key 222, and the public key 213 is issued when the secret key 222 is issued.
The public key 213 is set in the native application 101 at an arbitrary timing.
The public key 213 is stored in an arbitrary storage accessible by the common key encryption unit 212.

The common key encryption unit 212 encrypts the common key 114 using the public key 213.

The common key encryption unit 212 transmits the encrypted common key to the native application communication unit 121 through the built-in web server 113 and the network 104.

The native application communication unit 121 transmits the encrypted common key to the web application communication unit 122.

The web application communication unit 122 transmits the encrypted common key to the web server 141 through the network 150.

The web server 141 transmits the encrypted common key to the common key decryption unit 221.

The common key decryption unit 221 decrypts the encrypted common key using the secret key 222 and installs it as the common key 145.

FIG. 3 is a block diagram illustrating an embodiment when a common key is transmitted from the web application 131 to the native application 101.

The common key issuing unit 322 can issue the common key 145 using the common key encryption method.

The public key 323 may be public key data having a length of 1024 to 4096 bits created using DSA encryption or RSA encryption.
The public key 323 corresponds to the secret key 312, and the public key 323 is issued when the secret key 312 is issued.
The public key 323 is set in the web application 131 at an arbitrary timing.
The public key 323 is stored in an arbitrary storage accessible by the common key encryption unit 321.

The common key encryption unit 321 encrypts the common key 145 using the public key 323.

The common key encryption unit 321 transmits the encrypted common key to the web application communication unit 122 through the web server 141 and the network 150.

The web application communication unit 122 transmits the encrypted common key to the native application communication unit 121.

The native application communication unit 121 transmits the encrypted common key to the embedded web server 113 via the network 104.

The embedded web server 113 transmits the encrypted common key to the common key decryption unit 311.

The common key decryption unit 311 decrypts the encrypted common key using the secret key 312 and installs it as the common key 114.

FIG. 3 is a block diagram illustrating an embodiment when a common key is set using a password for the native application 101 and the web application 131.

A user 401 is a user of the native application 101 and the web application 131.

The password setting 402 receives a password from the user 401.
A method of receiving a password from the user 401 may be input from a setting dialog provided in the native application 101, a setting file associated with the native application 101, or an arbitrary setting method.

The password setting 402 uses the password received from the user 401 to generate the common key 114 by PBE and install it in the native application 101.

The password setting 403 receives a password from the user 401.
A method of receiving a password from the user 401 may be input from a setting form provided in the web application 131, a setting file associated with the web application 131, or an arbitrary setting method.

The password setting 403 uses the password received from the user 401 to generate a common key 145 by PBE and install it in the web application 131.

FIG. 4 is a flowchart illustrating an embodiment in the case where a common key is transmitted from the native application 101 to the web application 131.

After the connection is established between the web browser 102 and the native application 101, the common key issuance 501 is executed at an arbitrary timing, and the common key 114 is issued.

The common key 114 is held in a storage accessible from the native application 101.
After the common key 114 is issued, the common key encryption 502 is executed using the public key 213.

After the common key encryption 502 is executed, the encrypted common key is returned to the web browser 102 by the encrypted common key return 503.

Next, the encrypted common key is returned to the web application 131 by the encrypted common key return 504.

After the web application 131 receives the encrypted common key, the common key decryption 505 is executed using the secret key 222, and the decrypted common key 145 is obtained.
The common key 145 is held in a storage accessible from the web application 131.

FIG. 5 is a flowchart illustrating an embodiment in the case where a common key is transmitted from the web application 131 to the native application 101.

After the connection is established between the web browser 102 and the web application 131, the common key issuance 601 is executed at an arbitrary timing, and the common key 145 is issued.

The common key 145 is held in a storage accessible from the web application 131.
After the common key 145 is issued, the common key encryption 602 is executed using the public key 323.

After the common key encryption 602 is executed, the encrypted common key return 603 returns the encrypted common key to the web browser 102.

Next, the encrypted common key is returned to the native application 101 by the encrypted common key return 604.

After the native application 101 receives the encrypted common key, the common key decryption 605 is executed using the secret key 312 to obtain the decrypted common key 114.
The common key 114 is held in a storage accessible from the native application 101.

FIG. 6 is a flowchart illustrating an embodiment for transmitting an encrypted message from the native application 101 to the web application 131.

The process start 701 is executed at a timing when a message needs to be transmitted from the native application 101 to the web application 131.

In the message issue 702, a message of arbitrary information that needs to be transmitted is constructed based on an arbitrary control flow.
The message format can be JSON, XML, or binary, or any format.

In the message encryption 703, the message is encrypted using the common key 114.
The encryption method may be the common key encryption method.

In the encrypted message transmission 704, the encrypted message is transmitted from the native application 101 to the web browser 102.

In encrypted message transmission 705, the encrypted message is transmitted from the web browser 102 to the web application 131.

In the message decryption 706, the message is decrypted using the common key 145.

In the message reception 707, the message is transmitted to an arbitrary program.

FIG. 7 is a flowchart illustrating an embodiment for transmitting an encrypted message from the web application 131 to the native application 101.

The process start 801 is executed at a timing when a message needs to be transmitted from the web application 131 to the native application 101.

In the message issue 802, arbitrary information that needs to be transmitted is constructed in an arbitrary message format based on an arbitrary control flow.
The message format can be JSON, XML, or binary, or any format.

In the message encryption 803, the message is encrypted using the common key 145.
The encryption method may be the common key encryption method.

In the encrypted message transmission 804, the encrypted message is transmitted from the web application 131 to the web browser 102.

In encrypted message transmission 805, the encrypted message is transmitted from the web browser 102 to the native application 101.

In the message decryption 806, the message is decrypted using the common key 114.

In message reception 807, the message is transmitted to an arbitrary program.

Claims (3)

About the communication that the native application that runs on the same client terminal as the web browser interacts with the web application that runs on the computer device via the web browser, the contents of the tampering are intercepted by unauthorized access. A communication system for preventing
The client terminal includes a CPU, a memory, and a network interface,
The client terminal includes a web browser unit and a native application unit that is executed on the same terminal as the web browser unit,
The computer device comprises a CPU and memory and a network interface;
The computer device includes a web application unit,
A network interface provided in the client terminal and a network interface provided in the computer device are connected by a network,
The web browser portion receives content including executable code;
The web browser portion executing the executable code on the web browser portion;
The native application unit waits for a connection from the web browser unit at a predetermined port, and the web browser unit and the native application unit are executed by the executable code executed on the web browser unit. Establishing communication with
The web application unit waits for a connection from the web browser unit at a predetermined port, and the web browser unit is connected to the network of the client terminal and the computer device by the executable code executed on the web browser unit. Establishing communication between the web browser portion and the web application portion using an interface;
The web browser unit exchanges information between the native application unit and the web application unit by the executable code executed on the web browser unit, and the native application unit communicates with the native application via the web browser unit. Configuring the communication to the department or vice versa,
The native application unit and the web application unit share a common key and stored in a memory of the client terminal and the computer device;
Using the common key shared by the native application unit, encrypting a message, transmitting an encrypted message to the web browser unit, and the web browser unit receiving the encrypted message received from the native application unit Is transmitted to the web application unit, and the web application unit uses the common key stored in the memory on the computer device to receive the encrypted message received from the web browser unit by the web application unit. Decrypting
The web application unit uses the shared key shared, encrypts a message, transmits an encrypted message to the web browser unit, and the web browser unit receives the encrypted message received from the web application unit. Is transmitted to the native application unit, and the native application unit uses the common key stored in the memory on the client terminal to receive the encrypted message received from the web browser unit by the native application unit. The communication system characterized by decoding. When the web browser unit receives content including executable code, the computer device includes an HTML content issuing unit, and uses the network interface of the client terminal and the network interface of the computer device to issue the HTML content. The HTML content including the executable code that can be constructed by the function provided by the web browser unit is transmitted to the web browser unit, and the web browser unit constructs the HTML content including the executable code, The communication system according to claim 1, comprising displaying on a web browser unit. The web browser unit exchanges information between the native application unit and the web application unit by the executable code executed on the web browser unit, and the native application unit communicates with the native application via the web browser unit. The communication between the native application unit and the web browser unit, the network interface of the client terminal, and the network of the computer device are configured to enable communication to the unit or vice versa. Using the interface to communicate between the web application unit and the web browser unit; and the web browser unit is configured to transmit the encrypted message received from the web application unit. Without No. of the transmitted to the native application unit, or includes configuring to enable communication reverse claim 1 or claim 2, the communication system according to any one of.

Images