問80
頻出度★★☆
ホームページへのアクセスに HTTPS を利用する目的として, 適切なものはどれか。
平成24年度 春期 ITパスポート試験 問80
テクノロジ系ネットワーク › 通信プロトコル
This question's explanation and your answers so far.
解説
問 80
Incorrectア
Receiving all the data of one screen, including images, together in a single connection is the work of efficiency features on the HTTP side, such as persistent connections (keep-alive) and pipelining in HTTP/1.1 and multiplexing in HTTP/2; it is not the purpose of using HTTPS, that is, SSL/TLS. HTTPS only inserts a layer of encryption beneath HTTP, and it does not change the manner of communication itself, namely how many connections are used to obtain one screen of data. If anything, because the TLS handshake is added, establishing a connection takes more effort.
- イ
正解 The correct answer is イ. HTTPS (HTTP over SSL/TLS) is a method in which the HTTP exchanged between a web browser and a server is carried on top of the encryption protocol SSL/TLS. The URL begins with https:// and the default port number is 443 (ordinary HTTP uses 80). The purpose of using HTTPS is to secure the communication by means of the following functions provided by SSL/TLS. The first is server authentication: the server presents a server certificate issued by a certificate authority (CA), and the browser verifies whether that certificate is signed by a trusted certificate authority and whether the domain name written in the certificate matches the site being connected to. This lets users confirm that they are connected to the genuine site, and it gives them a clue for spotting phishing or spoofing that would lead them to a fake site. The second is data encryption: the content of the communication is encrypted with a common (symmetric) key that was safely shared during the handshake, so even if the communication is intercepted along the way, its content cannot be read. In addition, tampering can be detected by means of a message authentication code. HTTPS is therefore used in situations such as entering an ID and password, or sending a credit card number or personal information. The choice that correctly states the “purpose of using HTTPS” asked about in the question is イ, which says that communication security is ensured through server authentication and data encryption.
Incorrectウ
Compressing data to shorten communication time is the role handled by HTTP content encoding (compressed transfer with gzip and the like); it is not the purpose of HTTPS. What HTTPS performs is encryption, converting plaintext into ciphertext, and encryption is not a process that reduces the amount of data. Encrypted data loses its regularity, so it also compresses poorly, and the load of the cryptographic processing is added as well; HTTPS therefore works in the opposite direction from shortening communication time.
Incorrectエ
Dynamically generating a web page according to the user's input or the contents of a database is handled by mechanisms of applications on the web server side, such as CGI and server-side scripts (PHP, JSP, ASP.NET, and so on). HTTPS is a communication protocol for safely carrying the content that is exchanged, and it has nothing to do with whether a page is prepared statically or generated dynamically. HTTPS can be used in the same way for static pages and for dynamic pages alike.
ここがポイント
- HTTPS = HTTP + SSL/TLS. Its purpose is to authenticate the other party (the server) by means of a server certificate, and to ensure security by encrypting the content of the communication and detecting tampering. The URL begins with https:// and the default port is 443.
- Distinguish mechanisms that bring about similar-sounding effects from their actual roles: reducing the number of connections is done by HTTP persistent connections and HTTP/2 multiplexing, reducing the amount of data transferred is done by compressed transfer such as gzip, and dynamic page generation is the job of CGI and server-side scripts; none of these are functions of HTTPS.
用語