問73
頻出度★★☆
Web の通信で使用される HTTPS に関する説明のうち, 適切なものはどれか。
平成25年度 秋期 ITパスポート試験 問73
テクノロジ系ネットワーク › 通信プロトコル
This question's explanation and your answers so far.
解説
問 73
Incorrectア
Incorrect. “Duplicating communication to improve availability” is the idea of redundancy (duplication), which is achieved with load balancers, duplicated servers, redundant lines, and the like. HTTPS is only a technology that encrypts a single communication to make it safe; it has no function for doubling the communication path or for switching over on failure so that service does not stop. This choice confuses availability (resistance to outages) with confidentiality (resistance to leaks).
Incorrectイ
Incorrect. HTTPS does not simplify the communication procedure of HTTP. On the contrary, because an SSL/TLS handshake (checking the server certificate and agreeing on the keys used for encryption) is performed when communication starts, there are more steps than with HTTP. The HTTP exchange itself (request and response) stays as it is, and a layer of encryption is added outside it; that is the relationship between them.
- ウ
正解 The correct answer is “ウ”. HTTPS (HTTP over SSL/TLS) is a protocol that carries the HTTP communication exchanged between a Web browser and a Web server on top of an encryption mechanism called SSL/TLS. The S at the end of the name stands for Secure, and remembering it as “HTTP + SSL/TLS” makes it easier to understand. Because SSL/TLS is at work, you get these effects: (1) the content of the communication is encrypted, so even if it is intercepted on the way it cannot be read; (2) a server certificate lets you check whether the Web site you are connecting to is genuine; (3) tampering can be detected. For this reason, HTTPS is used on pages that handle information you do not want third parties to know, such as entering an ID and password or sending a credit card number, and the browser address bar starts with “https://” and shows a padlock icon. Choice ウ, “It is a protocol that uses SSL to encrypt the content of communication”, states exactly this essence of HTTPS, so it is appropriate.
Incorrectエ
Incorrect. What HTTPS guarantees is “the safety of the communication”, namely encryption, confirmation of the other party, and detection of tampering; it does not guarantee the conclusion of the commercial transaction itself or the validity of a contract. Proving that a transaction has been concluded requires other mechanisms, such as digital signatures, time stamps, or electronic contract services. HTTPS is often used in online shopping, but that is in order to send order information safely; it does not guarantee that a sales contract has been formed.
ここがポイント
- HTTPS = HTTP over SSL/TLS. A protocol that encrypts the content of HTTP communication with SSL/TLS, prevents eavesdropping and tampering, and uses a server certificate to confirm that the connection destination is legitimate (the S at the end stands for Secure).
- In terms of the three elements of security, what HTTPS mainly strengthens is confidentiality and integrity, while availability (duplication and redundancy) and the guarantee that a transaction has been concluded (digital signatures, electronic contracts) are handled by other technologies. This question asks you to draw that distinction.
用語