JP2001356973A - Network system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable a client existing on the outside of a fire wall to access a server existing on the inside of the fire wall. SOLUTION: A server agent 2 is arranged on the inside of the fire wall and a repeating proxy 1 for repeating connection between a client 4 and the agent 2 is arranged on the outside of the fire wall. A 1st communication channel 61 is set in the proxy 1 from the agent 2, a 2nd communication channel 62 is set in the proxy 1 from the client 4 (S5), the proxy 1 informs the agent 2 of the information of an access from the client 4 (S7), the agent 2 set up a 3rd communication channel 63 to be a communication channel capable of accessing the server 3 in the proxy 1 (S10), and the 2nd communication channel 62 is connected to the 3rd communication channel (S11).

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network system, and more particularly, to a server inside a firewall or in a private address space that can be accessed from a client outside the firewall or the private address space. And a relay proxy therefor.

[0002]

2. Description of the Related Art In recent years, the Internet has been rapidly developing. Network elements such as computers and network devices accessed through the Internet each have a unique IP address. From anywhere in the world, if the IP address (global IP address) is specified, a specific network element can be accessed through the Internet. Can be accessed.

A conventionally used IP address (IP address)
Since version 4) consists of 32 bits, it is theoretically possible to provide about 4 billion IP addresses. However, as a result of the unexpected development of the Internet, a problem that IP addresses will not be sufficient in the near future is called out (IP address depletion problem).

As a method for connecting a network element having no global IP address to the Internet, a PAT (Port Address Translator) is used.
There is a method using an address translator called r). The network element having no global IP address (only having a private IP address) is connected to the Internet via the address translator. When the network element having no global address requests the address translator to connect to the Internet, the address translator determines a temporary port number that enables a response to the network element, and the address translator itself. Use the global IP address and port number to connect to the Internet. Then, the address translator transmits the temporary port number and the IP address of the connection source network element.
The correspondence with the address (private IP address) is temporarily stored.

A connection destination network element on the Internet sends a response by designating the temporary port number and the IP address of the address translator, and returns a response to the connection source network element via the address translator. can do. According to this method, a network element having no global address can access a network element on the Internet and send a reply from a connected network element. The correspondence between the private IP addresses is released. Therefore, a network element on the Internet cannot access a network element in the private address space.
Since the address translator restricts external access in this way, it can also function as a firewall.

In order to avoid the IP address exhaustion problem due to the current IP version 4, an address space of more than 32 bits is allocated to the next and subsequent IP addresses,
In IP version 6, 128 bits are reserved. However, no matter how much the address space is expanded, there is a limit, and an address converter similar to the above may be required in the future. Further, even if it has an enormous address space like IP version 6, an address converter is used for the purpose of operating a group of a plurality of network elements with one IP address for the sake of management. to continue.

As a method for accessing the inside of a firewall, a method described in Japanese Patent Application Laid-Open No. H10-285216 is known. In this example, an end-to-end connection can be established between the client and the server by connecting the client end proxy and the server end proxy to the intermediate proxy respectively.

[0008]

However, Japanese Patent Application Laid-Open No.
In the method of 0-285216, after one of the client terminal proxy and the server terminal proxy connects to the intermediate proxy, the above one connection must be maintained until the other connects to the intermediate proxy. Must. Therefore, even before the communication between the client and the server is actually realized, it is necessary to secure a temporary port number that can access the client.

According to the present invention, when accessing a network element inside a firewall or a private address space from outside a firewall or a private address space, a network element inside a firewall or the like to be accessed is accessed. It is an object of the present invention to provide a system in which a temporary port number need only be secured at the time of connection.

[0010] Also, with regard to the relay proxy, it is not necessary to always establish a connection on the client side, and even when a plurality of servers exist inside one firewall, the connection is always established for each server. It is an object of the present invention to eliminate the necessity to keep resources and to effectively use resources such as port numbers and memories of a firewall and a relay proxy.

It is another object of the present invention to provide a system which does not require a special configuration or function to be added to a firewall, a server and a client when accessing from outside a firewall.

[0012]

SUMMARY OF THE INVENTION In order to achieve the above object, a system according to the present invention is provided for a server inside a firewall or in a private address space.
A system for allowing access from a client outside of said firewall or said private address space, comprising a server agent inside said firewall or in said private address space, wherein said firewall or said private address space A relay proxy that relays a connection between the client and the server agent, establishes a first communication channel from the server agent to the relay proxy, and establishes a first communication channel from the client to the relay proxy. Establishing a second communication channel, the relay proxy notifies the server agent of access information from the client through the first communication channel, and the server agent A third communication channel, which is a communication channel accessible to the server, is established with the relay proxy, the relay proxy connects the second communication channel and the third communication channel, Communication is performed between the client and the server via the relay proxy and the server agent.

Also, the relay proxy of the present invention enables a server located inside a firewall or inside a private address space to be accessed from a client outside the firewall or outside the private address space. Therefore, the server agent is provided outside the firewall or the private address space, receives an access from a server agent provided inside the firewall or in the private address space, and establishes a first communication channel. For the first
Transmitting a specific request through a communication channel of the client, receiving access from the client, establishing a second communication channel, and transmitting information of access from the client to the server agent through the first communication channel. , A third communication channel accessible from the server agent to the server.
A relay proxy that receives the information about the communication channel of, establishes the third communication channel with the server agent, and connects the second communication channel and the third communication channel, When receiving the access information from the client from the relay proxy as the specific request, the server agent instructs the server agent to determine the third communication channel and transmit information relating to the third communication channel to the relay proxy. Request.

[0014]

Embodiments of the present invention will be described below with reference to the drawings.

(Network Configuration) FIG. 1 is a diagram showing a network configuration of a system according to an embodiment of the present invention. The server 3, server agent 2, relay proxy 1, and client 4, which are network elements of this system, are all composed of computers or communication devices. Each network element has a communication function. The relay proxy 1 has functions (described later) characteristic of the present invention.

The relay proxy 1 and the client 4 are connected to a network 5. The network 5 typically includes the Internet. The server 3 and the server agent 2 are not directly connected to the network 5 but can be connected to the network 5 via the firewall 7. With this firewall, access to the server 3 and the server agent 2 inside the firewall from outside the firewall (such as the client 4) is restricted.

Reference numeral 33 of the server 3, reference numerals 21, 22 and 23 of the server agent 2, reference numeral 1 of the relay proxy 1
Reference numerals 43 of 1, 12, 13 and the client 4 indicate ports at which each network element communicates with other network elements. The port 33 of the server 3
Cannot be directly connected to the network 5.

(Connection Process) FIG. 2 conceptually shows a connection status of each port when a client accesses a server in the system according to the above embodiment.
Reference numerals 5 and 7 in the figure correspond to the network 5 and the firewall 7 in FIG. 1, respectively, and do not necessarily mean that the network 5 and the firewall 7 are separated into a plurality.

FIG. 3 is a diagram showing a communication sequence at the time of connection in the system according to the above embodiment. In this system, as described in detail below, communication is performed between each of the server 3, the server agent 2, the relay proxy 1, and the client 4.

Step S1 The server agent 2 accesses the relay proxy 1 and
A control communication channel is established between the two. Specifically, a first communication channel 61 is established between the port 11 on the relay proxy shown in FIG. 2 and the port 21 on the server agent. The communication channel 61 is desirably maintained permanently during use of the present system, but is maintained at least until the processing of step S8 described later is executed.

Further, the server agent 2 transmits information on the server agent to the relay proxy 1.
Specifically, the server agent transmits a server agent ID and a password for the server agent to access the relay proxy.

Step S2 Upon receiving the server agent information from the server agent 2, the relay proxy 1 stores and retains the server agent information and transmits the server agent information registration confirmation to the server agent 2. I do.

Step S3 The server agent 2 transmits information on the server 3 to the relay proxy 1. Specifically, network elements outside the firewall (relay proxy 1, etc.)
Transmits a connection ID for requesting the server agent 2 to connect to the server 3.

Prior to the process in step S3, the server 3 accesses the server agent 2 and requests the server agent 2 to transmit the above information of the server to the relay proxy 1 from the server 3. You may do it. Alternatively, the information of the server may be preset in the server agent 2 by an administrator.

Step S4 When the relay proxy 1 receives the server information from the server agent 2, the relay proxy 1 stores and retains the server information and transmits a server registration confirmation to the server agent 2. Further, the relay proxy 1 transmits a specific request to the server agent 2. The specific request is a request to return information of a communication channel that can access the server (to be described later, step S10) when transmitting that there is a connection request from the client (to be described later, step S7). Things.

After performing the above transmission, the relay proxy 1 waits for a connection from a client.

Step S5 The client 4 transmits a connection request to the server to the relay proxy 1. Generally, this connection request includes the specific specification of the server, but if the connection request does not include the specific specification of the server, the relay proxy 1 sends the client 4 a specific specification of the server. You can also query for information.

Step S6 Upon receiving the connection request to the server from the client 4, the relay proxy 1 determines whether or not the corresponding server exists. Further, the connection request to the server received from the client 4 is held until step S11 described later.

Here, a second communication channel 62 which is a communication channel between the client 4 and the relay proxy 1 is used.
Is established.

Step S7: The relay proxy 1 notifies the server agent 2 that the client has made the connection request to the server.
A notification is made using information such as the connection ID set in step S3 in order to permit connection to the server.

Step S8 When the server agent 2 receives the above notification from the relay proxy 1, the connection agent I notified in step S7
It is determined whether or not D matches the connection ID set in step S3. When the connection IDs match, the reception confirmation of this notification is transmitted to the relay proxy 1.

The communication between the relay proxy 1 and the server agent 2 up to this point is performed through the first communication channel 61.

Step S9 The server agent 2 establishes a communication channel with the server 3. Specifically, a communication channel 64 (fourth communication channel) is established between the port 23 on the server agent shown in FIG. 2 and the port 33 on the server.

Step S10 The server agent 2 establishes a communication channel (third communication channel 63) with the relay proxy 1 for connecting to the server. Specifically, a communication channel is established by accessing an arbitrary port (for example, port 12) on the relay proxy from the port 22 on the server agent.

Further, the server agent 2 communicates with the third communication channel 63 established with the relay proxy 1.
And the fourth communication channel 64 established with the server 3 in step S9. In other words, the port 22 and the port 23 on the server agent 2 are connected to each other so that the information entered into the port 22 is sent to the port 23, and conversely, the information entered into the port 23 is sent to the port 22. I do.

In step S11, the relay proxy 1 receives the access from the server agent 2, and establishes the third communication channel 63. When the third communication channel 63 is established, the relay proxy 1 The second communication channel 62 is connected. In other words, ports 12 and 13 on the relay proxy 1
Are connected to each other, and the information input to port 12 is
3, and conversely, the information that has entered the port 13 is sent to the port 12.

As a result, the connection request to the server transmitted from the client 4 and held in the relay proxy 1 in step S5 is transferred to the server agent 2 through the third communication channel 63.

Step S12 The server agent 2 transfers the connection request from the client to the server transferred from the relay proxy 1 to the server 3 through the fourth communication channel 64.

After step S13, the server 3 to the fourth communication channel 64 to the server agent 2 to the third communication channel 63 to the relay proxy 1
The server 3 and the client 4 through a communication path from the second communication channel 62 to the client 4 or vice versa.
Can communicate with each other. Server 3
At this time, the client 4 may perform the authentication procedure for confirming the access right again.

(End Process) FIG. 4 is a diagram showing a communication sequence for ending the connection between the server 3 and the client 4 established in the system of this embodiment.

Step S 14 The client 4 sends a request to disconnect the communication to the server 3 via the relay proxy 1 and the server agent 2.

Step S15 Upon receiving the disconnection request from the client 4, the server 3 disconnects the fourth communication channel 64 with the server agent 2.

Step S16: The server agent 2 detects the disconnection of the communication channel 64 and sends the third communication channel 6 to the intermediate proxy 1.
Cut 3

Step S17: The intermediate proxy 1 detects the disconnection of the third communication channel 63 and sends the second communication channel 6 to the client 4.
2 is cut, and a series of processing ends.

Here, the termination processing is started from the server side in response to a disconnection request from the client 4, but the present invention is not limited to this, and the termination processing may be started in response to a disconnection request from the server 3.

The disconnection may be started from the server 3 or the client 4 without waiting for the disconnection request.
FIG. 5 shows a communication sequence when the client 4 starts disconnection and terminates connection without waiting for a disconnection request. As shown in the figure, after the communication session in step S13, the client 4 disconnects the communication channel (second communication channel 62) with the relay proxy 1 in step S18. Next, in step S19, upon detecting disconnection of the second communication channel 62, the relay proxy 1 disconnects the communication channel (third communication channel 63) with the server agent 2. Finally, in step S20, upon detecting the disconnection of the third communication channel 63, the server agent 2 disconnects the fourth communication channel 64 with the server, and ends a series of processing.

(Advantage of the present embodiment) In the present embodiment, as described above, the communication channel (the third channel) with the server 3 or the server agent 2 in the step S10 only after the access from the client 4 in the step S5. A communication channel 63) is established. Therefore, the port 22 prepared in the server agent 2 for the third communication channel 63 may be determined after access from the client 4. Therefore, the time for occupying the port 22 only needs to be during the actual communication, and the occupying time of the port can be short. Therefore, when a plurality of servers are installed in the firewall, the port 22 on the server agent
If is not occupied by communication with server 3, other servers can use it. Even if the port 22 is in use, another port can be newly allocated and communicated in the same manner. In addition, only the first communication channel 61 may be always reserved as the communication channel, and there is no need to prepare a communication channel for connecting to each server.

In the present embodiment, there is no need to add a special configuration or function to the server 3 and the client 4, and access is made from outside the firewall only by installing the relay proxy 1 and the server agent 2. It is possible to realize a system that enables the above. This system can be realized by one relay proxy even if there are a plurality of servers 3, server agents 2, and clients 4.

Further, this system comprises a firewall 7 between the server agent 2 and the relay proxy 1.
Can be realized even if it is configured in multiple stages, and can be realized even if a firewall is configured between the relay proxy 1 and the client 4.

(Other Embodiments) In the embodiments described above, the server 3 and the server agent 2 are described as being inside the firewall 7. However, the present invention is not limited to this. The present invention can be applied even in the case where the private address space is allocated.

The server agent 2 is connected to the server 3
And can be implemented as software in the same machine. Also in this case, the first communication channel 61 and the third communication channel 63 are established between the relay proxy and the server agent program, and the fourth communication channel 64 is established between the server agent program and the server program. Is established.

[0052]

As described above, according to the present invention,
It is possible to provide a system in which when accessing from outside the firewall, a temporary port number for accessing a network element in the firewall, which is the access destination, need only be secured at the time of connection.

Further, the relay proxy does not need to always establish a connection with the client side. Further, even when a plurality of servers exist inside one firewall, the connection is always established for each server. Since there is no need to keep resources, resources such as port numbers and memories of the relay proxy can be used effectively.

Further, it is possible to provide a system that does not need to add a special configuration or function to the firewall or the client when accessing from outside the firewall.

[Brief description of the drawings]

FIG. 1 is a diagram showing a network configuration of a system according to an embodiment of the present invention.

FIG. 2 conceptually shows a connection state of each port when a client accesses a server in the system according to the embodiment.

FIG. 3 is a diagram showing a communication sequence at the time of connection in the system according to the embodiment.

FIG. 4 is a diagram showing a communication sequence for terminating a connection between a server and a client established in the system according to the embodiment.

FIG. 5 is a diagram showing a communication sequence in a case where disconnection is started from a client 4 and a connection is terminated without waiting for a disconnection request.

Claims (2)

[Claims] 1. A system for enabling a server located inside a firewall or in a private address space to be accessed from a client located outside the firewall or outside the private address space. A server agent is provided inside or in the private address space, and a relay proxy for relaying a connection between the client and the server agent is provided on the firewall or outside the private address space. From the server agent to the relay proxy Establishing a first communication channel from the client to the relay proxy, wherein the relay proxy transmits access information from the client to the relay proxy in advance. Notifying the server agent via a first communication channel, the server agent establishes a third communication channel with the relay proxy, which is a communication channel accessible to the server, A system, wherein the second communication channel is connected to the third communication channel, and communication is performed between the client and the server via the relay proxy and the server agent. 2. The firewall or the private address space to allow a server outside the firewall or the private address space to access a server inside the firewall or the private address space. A first communication channel is established by receiving access from a server agent provided inside the firewall or in the private address space, and provided to the server agent through the first communication channel. Transmitting a specific request, receiving an access from the client, establishing a second communication channel, and transmitting information of the access from the client to the server agent through the first communication channel. Receiving information on a third communication channel that is a communication channel accessible to the server from the server agent, and establishing the third communication channel with the server agent; A relay proxy for connecting the second communication channel and the third communication channel, wherein, when information of access from the client is received from the relay proxy as the specific request, the third communication A relay proxy that requests the server agent to determine a channel and send information about it to the relay proxy.