JP2003030064A - Network system and communication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a network system and a communication method to enable required data communication without changing setting of an interposed firewall when the system is connected with equipment connected with the Internet from a device such as a personal computer connected with an intranet. SOLUTION: In the network system perform data communication between a client program 1 to be operated by an information processing terminal 6 connected with an internal network 8 to be connected with an external network 10 via the firewall 9 to pass only a signal according to a specific communication protocol and a server program 5 to be operated by equipment 7a or 7b of communication object, which is connected with the external network 10, it is characterized that a repeating function 2 on the client's side and a repeating function 4 on the server's side are interposed and the repeating function 2 on the client's side relays optional protocol data to the repeating function 4 on the server's side by using a communication path secured by a securing means of the communication path according to the specific communication protocol.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network for operating and monitoring a communication target device such as a process control device from an information processing terminal such as a personal computer (hereinafter referred to as a personal computer) or a management device via a communication network. The present invention relates to a system and a communication method used in such a network system.

[0002]

2. Description of the Related Art With the improvement of network environments using the Internet and Intranet, systems using communication bases have been constructed in the field of automation such as process control and building management. According to this, there is no need for a special network environment, no dedicated wiring equipment is required, equipment management is possible using a general-purpose OS, and the cost of system construction is relatively low.

In such a communication infrastructure, an unauthorized intrusion from an external network such as the Internet into an internal network such as an intranet constructed by a company, or leakage of confidential information from the internal network to the external network, etc. As a means for preventing the above, a firewall is generally provided between the internal network and the external network. The firewall has relay software for each required application or required protocol (for example, Telnet, FTP, etc.), and has an IP filtering function that does not pass a protocol without this relay software. Further, by making the relay software react only to the access from the internal network, the safety of the internal network is ensured.

As described above, data collection or maintenance of data such as a measuring instrument connected to the Internet from a personal computer or the like connected to the intranet can be performed by using the Internet having the advantage of not requiring a dedicated wiring facility. There are cases when you want to do it.

[0005]

However, even if an information processing terminal such as a personal computer connected to an intranet tries to connect to a communication target device connected to the Internet, it is blocked by a firewall having an IP filtering function. Is mostly. That is, data transmission other than the preset protocol data cannot be performed even from an information processing terminal such as a personal computer connected to the intranet without changing the firewall setting, and a new communication target device has been introduced. In some cases, the firewall settings were changed as well.

An object of the present invention is to provide a network system which enables necessary data communication without changing the setting of a firewall interposed between an information processing terminal such as a personal computer and a communication target device as described above. It is to provide a communication method.

[0007]

The first aspect of the present invention is as follows.
Operated or monitored by an information processing terminal connected to the internal network and an information processing terminal connected to the external network that connects to the external network through a firewall that passes only signals that comply with a specific communication protocol. In the network system for performing data communication with the communication target device, the information processing terminal transmits the communication target device to the communication target device through the communication path secured by the communication path securing means according to the specific communication protocol. Data transmission is performed according to a protocol other than a specific communication protocol.

In the second aspect of the present invention, the information processing terminal, via the communication path secured by the securing means of the communication path complying with the specific communication protocol, to the communication target device,
By transmitting data of protocol identification information for the communication target device to identify the protocol to be transmitted and its destination, a communication path for data transmission according to a protocol other than a specific communication protocol is secured. To do.

A third aspect of the present invention is a communication target device,
Between the communication target device and the information processing terminal, use a communication network that is interposed between the information processing terminal that operates this or monitors its operation, and that has a firewall that passes only signals that comply with a specific communication protocol. And a first step of securing a communication path to a communication target device by a communication path securing unit that complies with a specific communication protocol. A second step of performing data transmission of protocol identification information for the communication target device to identify the protocol to be transmitted and its destination on the communication path, and data transmission according to the protocol identified by the communication target device by the protocol identification information. And a third step of securing a communication path for the communication.

A fourth aspect of the present invention is operated by an information processing terminal connected to an external network through a firewall that passes only signals complying with the HTTPS protocol and an information processing terminal connected to the external network and connected to an internal network. Alternatively, in a network system for performing data communication with a communication target device whose operation is monitored, the communication path secured by the information processing terminal to the communication target device by means for securing a communication path according to the HTTPS protocol. It is characterized by performing data transmission according to a protocol other than the HTTPS protocol via the.

In the fifth aspect of the present invention, the information processing terminal, via the communication path secured to the communication target device by means for securing a communication path conforming to the HTTPS protocol,
A feature is that a communication path for performing data transmission according to a protocol other than the HTTPS protocol is ensured by performing data transmission of protocol identification information for the communication target device to identify the protocol to be transmitted and its destination. .

A sixth aspect of the present invention is a communication target device,
Data is communicated between the communication target device and the information processing terminal by using a communication network that is provided between the information processing terminal that operates or monitors the operation and that has a firewall that allows only signals conforming to the HTTPS protocol to pass. A first step of a communication method for performing communication, wherein the information processing terminal secures a communication path to a communication target device by a communication path securing unit according to the HTTPS protocol,
The second step of transmitting data of protocol identification information for the communication target device to identify the protocol to be transmitted to the secured communication path and its destination, and the data transmission according to the protocol identified by the communication target device by the protocol identification information. And a third step of securing a communication path for performing the communication.

A seventh aspect of the present invention is operated by an information processing terminal connected to an external network through a firewall that passes only signals according to the HTTPS protocol and an information processing terminal connected to the external network and connected to an internal network. Alternatively, in a network system for performing data communication with a communication target device whose operation is monitored, the communication path secured by the information processing terminal to the communication target device by means for securing a communication path according to the HTTPS protocol. It is characterized in that an electronic mail is transmitted or received via.

In the eighth aspect of the present invention, the information processing terminal, via the communication path secured to the communication target device by means for securing a communication path conforming to the HTTPS protocol,
It is characterized in that a communication channel for transmitting or receiving an electronic mail is secured by performing data transmission of protocol identification information for a communication target device to identify a protocol to be transmitted and a transmission destination thereof.

A ninth aspect of the present invention is a communication target device,
Data is communicated between the communication target device and the information processing terminal by using a communication network that is provided between the information processing terminal that operates or monitors the operation and that has a firewall that allows only signals conforming to the HTTPS protocol to pass. A first step of a communication method for performing communication, wherein the information processing terminal secures a communication path to a communication target device by a communication path securing unit according to the HTTPS protocol,
A second step of transmitting data of protocol identification information for the communication target device to identify the transmission destination to the secured communication path, and a second step of transmitting data of the protocol identification information for the communication target device; And a third step of securing a communication path for transmitting or receiving the electronic mail identified by the identification information.

A tenth aspect of the present invention is operated by an information processing terminal connected to an external network through a firewall that passes only signals complying with the HTTPS protocol and an information processing terminal connected to the external network and connected to an internal network. Alternatively, in a network system for performing data communication with a communication target device whose operation is monitored, the communication path secured by the information processing terminal to the communication target device by means for securing a communication path according to the HTTPS protocol. It is characterized in that the TELNET protocol is transmitted via.

In the eleventh aspect of the present invention, the information processing terminal, via the communication path secured by the securing means of the communication path conforming to the HTTPS protocol, to the communication target device,
It is characterized in that a communication path for transmitting the TELNET protocol is secured by performing data transmission of protocol identification information for the communication target device to identify the protocol to be transmitted and its destination.

A twelfth aspect of the present invention is a communication network provided with a firewall which is interposed between a communication target device and an information processing terminal which operates or monitors the operation of the communication target device and which passes only signals complying with the HTTPS protocol. A communication method for performing data communication between a communication target device and an information processing terminal using,
The first step of securing a communication path to the communication target device by means of securing a communication path according to the HTTPS protocol, and the protocol to be transmitted to the secured communication path is TELN.
The second step of transmitting the data of the protocol identification information for the communication target device to identify the transmission destination of the ET protocol, and the data transmission of the TELNET protocol identified by the communication target device by the protocol identification information. And a third step of securing a communication path for the communication.

A thirteenth aspect of the present invention is operated by an information processing terminal connected to an external network through a firewall that passes only signals complying with the HTTPS protocol, and an information processing terminal connected to the external network and connected to an internal network. Alternatively, in a network system for performing data communication with a communication target device whose operation is monitored, the communication path secured by the information processing terminal to the communication target device by means for securing a communication path according to the HTTPS protocol. It is characterized in that a file is transferred via the.

In the fourteenth aspect of the present invention, the information processing terminal, via the communication path secured by the securing means of the communication path conforming to the HTTPS protocol to the communication target device,
A feature is that a communication path for file transfer is secured by performing data transmission of protocol identification information so that a communication target device can identify a protocol to be transmitted and a transmission destination thereof.

In the fifteenth aspect of the present invention, when the information processing terminal receives a telegram specifying a communication path for transmitting actual data from the communication target device, this is secured in advance for data transmission. It is characterized in that a communication path for file transfer is secured by tampering so as to indicate the communication path.

A sixteenth aspect of the present invention is a communication network provided with a firewall that is interposed between a communication target device and an information processing terminal that operates or monitors the operation of the device and communicates only signals complying with the HTTPS protocol. Is a communication method for performing data communication between a communication target device and a management device, wherein the information processing terminal establishes a communication path to the communication target device by means for securing a communication path according to the HTTPS protocol. The first step of securing two lines, and the protocol that the information processing terminal sends to the communication target device on the first communication route of the secured communication routes is the control data transmission protocol of the FTP protocol. And a second step of transmitting data of protocol identification information for the communication target device to identify the transmission destination, and the communication target device The third step of securing a communication path for transmitting the data for the control data of the FTP protocol identified by the protocol identification information, and the information processing terminal performs two of the secured communication paths to the communication target device. The protocol to be transmitted to the first communication path is the data transmission protocol of the FTP protocol, the fourth step of transmitting the data of the protocol identification information for the communication target device to identify the transmission destination, and the communication target device But,
A fifth step of securing a communication path for transmitting data of the protocol for data transmission of the FTP protocol identified by the protocol identification information.

In the seventeenth aspect of the present invention, when the information processing terminal receives a telegram specifying a communication path for transmitting actual data from the communication target device, this is secured in advance for data transmission. It is characterized by including a step of tampering so as to point to a communication path

[0024]

According to the present invention, the information processing terminal uses a communication path according to a specific communication protocol (for example, HTTPS protocol) that can pass through a firewall, and uses a protocol other than the specific communication protocol (for example, Protocol data according to the SMTP protocol). Therefore, an information processing terminal connected to an internal network such as an intranet connects to a communication target device connected to an external network such as the Internet without changing the firewall in the middle to acquire and operate data. it can. As a result, the information processing terminal can operate and monitor the communication target device such as the process control device. For example, when a new measuring instrument or other device is manufactured, in order to monitor or operate the measuring instrument or other device connected to the Internet from the information processing terminal connected to the intranet, a relay program is required for the firewall. Although it was necessary to add or change the setting so as to relay the corresponding protocol to the firewall, the present invention eliminates the need for either measure. Therefore, it is not necessary for the manufacturer company to manufacture a relay program to be added to the firewall, and the firewall administrator is freed from the work of changing the settings.

According to a specific aspect of the present invention, the client-side relay function operating on the information processing terminal allows the communication target device to communicate with the communication target device via a specific port of the protocol relayed by the firewall, which is permitted to be continuously connected. Connecting. Generally, this is the standby port (443 port) of the HTTPS protocol. When the client-side relay function operating on the information processing terminal requests the firewall to connect to the communication target device by the HTTPS protocol, the firewall connects to port 443 of the communication target device and notifies that the connection is successful. Return a response. At this time, the server-side relay function of the present invention needs to be operating in the communication target device. The client-side relay function discards this response if the response returned from the firewall indicates a successful connection, and actually sends it to the server-side relay function operating on the communication target device (for example, SMTP). And its destination (for example, IP address = 127.0.0.1, port number = 25) are transmitted as protocol identification information. The server-side relay function of the communication target device discriminates the protocol to be actually transmitted from the received protocol identification information, and connects to the requested destination by socket communication. As a result, a communication path from the information processing terminal to the communication target device is established. After the communication path is established, the relay function on the client side monitors and relays the data transmission from the information processing terminal side and the firewall side, and the relay function on the server side monitors the data transmission on the firewall side and the communication target device side. And, by relaying, data transmission between the information processing terminal and the communication target device can be realized. As a result, the information processing terminal can operate and monitor the communication target device. It should be noted that by adding information for authenticating the user to the protocol identification information (for example, user identification information for identifying the user and its personal identification number), and authenticating by the server side relay function, It is also possible to add measures to prevent unauthorized use of.

[0026]

FIG. 1 is a diagram showing the configuration of a network system for implementing the present invention. In this network system, the communication target devices 7a and 7b such as a process control controller equipped with a server program, and the information processing terminal 6 as a management device that operates the device or monitors its operation are Through the intranet 8 to which the processing terminal 6 is connected and the Internet 10 with the firewall 9 interposed, they are communicably connected to each other. In order to simplify the configuration of this network system, the information processing terminal 6 is equipped with the client-side relay function 2, but the client-side relay function 2 is connected to the intranet 8 and is connected to the information processing terminal 6 as well. It may be installed in a device having a communication function that is installed in a place where it can directly communicate with and is set in a communicable state. Similarly, the server-side relay function 4 is also provided with a communication function that is connected to the Internet and is installed in a place where it can directly communicate with the communication target devices 7a and 7b, and is set in a communicable state. It may be mounted on the device.

Hereinafter, with the firewall 9 as a boundary, the Internet 10 side is referred to as the outside, and the intranet 8 side protected by the firewall is referred to as the inside.

The firewall 9 is generally UNIX.
In order to protect a device or the like connected to the intranet 8 from unauthorized intrusion via the Internet 10, only a signal complying with a specific protocol (for example, HTTPS protocol) that can be set appropriately is used. It has an IP filtering function to pass it.

FIG. 2 shows the configuration of the firewall 9 when the HTTPS protocol is set as the protocol of the signal passing through the firewall 9.

The firewall 9 shown in the figure includes network interface units 91 and 93 for each network (in this case, the intranet 8 and the Internet 10) connected to the firewall 9 and two network interfaces 91 for relaying the HTTPS protocol. , 93, an IP filtering unit 92 for filtering a request and a response to be passed according to the setting.

The IP filtering unit 92 can be set so that only the HTTPS protocol is passed from the intranet 8 to the Internet 10, and only the HTTPS protocol being connected is passed from the Internet 10 to the intranet 8.

In general, a firewall 9 installed between a corporate intranet 8 and the Internet 10
Establishes a communication path that can communicate until a disconnection due to timeout or data transmission completion by an HTTPS request from the inside (Intranet 8 side) to the outside (Internet 10 side), and thereafter relays communication using this communication path Is set to. That is, H issued by the client-side relay function 2 in the inner network
The communication path by the TTPS request can be transmitted to the server side relay function 4 in the outside network. Then, the client side relay function 2 and the server side relay function 4 can communicate using this communication path.

FIG. 3 is a diagram showing a connection method for securing a communication path from the client program 1 to the server program 5 by using an individual protocol as an example. The client program 1 in FIG. 1 is more specifically the existing client protocol SMTP client 1 in FIG.
1, POP3 client 12, TELNET client 13, and FTP client 14. In addition to the above, the client program 1 can add a dedicated client program when a new device to be communicated is developed. Further, the client-side relay function 2 in FIG. 1 is more specifically expressed as the relay client 31 and the FTP relay client 32 in FIG. The FTP relay client 32 may be incorporated in the relay client 31, but by dividing the FTP relay client 32 in this way, it is possible to easily cope with the addition of a client program for a new communication target device (function addition). The server program 5 in FIG. 1 is more specifically the existing protocol in FIG. 3, that is, the SMTP server 51, the POP3 server 52, and the TELNET server 5.
3 and the FTP server 54. In addition to this, a dedicated server program can be added to the server program 5 when a new communication target device is developed. The server-side relay function shown in FIG. 1 is more specifically shown in FIG. 3 as the relay server 41 and the FTP relay server 4.
Expressed as 2. The FTP relay server 42 may be incorporated in the relay server 41, but by dividing it in this way, it becomes easy to cope (addition of functions) when a server program for a new communication target device is added.

The relay client 31 waits for a connection from the SMTP client 11 by TCP / IP socket communication (hereinafter simply referred to as a connection) by opening the A1 port. Similarly, for the POP3 protocol, use the A2 port,
Open the A3 port for the TELNET protocol, the A4 port for sending the FTP protocol control data from the FTP relay client 32, and the A5 port for the FTP protocol data sending protocol from the FTP relay client 32. wait. Here, the port numbers of A1 to A5 can be arbitrarily determined, but since they do not overlap with the port numbers already used by the information processing terminal, they are generally used by the server program of the relevant protocol. By setting the port number
Avoid unnecessary confusion. In this case, the port number of A1 port is 25, the port number of A2 port is 110, and A3 port is A3.
The port number of the port is 23. A4 port and A5
Since the FTP relay client 32 uses the 21st port and the 20th port, the port number of the A4 port is 8021 and the port number of the A5 port is 8020.

The FTP relay client 32 has a B1 port for transmitting the control data of the FTP protocol from the FTP client 14, and a B1 port for the data transmission protocol of the FTP protocol from the FTP client 14.
Open port 2 and wait. Here, the port numbers of the B1 to B2 ports have a property that they can be arbitrarily determined, but since they do not overlap with the port numbers already used by the information processing terminal, they are generally used by the server program of the corresponding protocol. Avoid unnecessary confusion by assigning numbers that are In this case, the port number of B1 port is 21, B
The port number of 2 ports is 20.

The relay server 41 is the relay client 3
It waits for the connection from 1 through the firewall 9 at the C port. Generally, the port number of the C port that can pass through the firewall 9 and can be used for implementing this network system is 443.

The SMTP server 51 is the relay server 41
Waits for connection from port a1. Generally, the port number of the a1 port is 25.

The POP3 server 52 is the relay server 41
Waits for connection from port a2. Generally, the port number of the a2 port is 110.

The TELNET server 53 waits for a connection from the relay server 41 at the a3 port. Generally, the port number of the a3 port is 23.

The FTP relay server 42 opens the a4 port for transmitting the control data of the FTP protocol from the relay server 41 and the a5 port for the data transmission protocol of the FTP protocol from the relay server 41 and waits. Here, the port numbers of the ports a4 to a5 have a property that they may be arbitrarily determined. In this embodiment, the port number of the a4 port is 8021 and the port number of the a5 port is 8020.

The FTP server 54 has a b1 port for transmitting the control data of the FTP protocol from the FTP relay server 42 and an F1 port from the FTP relay server 42
Open the b2 port for the data transmission protocol of the TP protocol and wait. Generally, the port number of b1 port is 21
The port number of the port No. b2 is undefined because the FTP server 54 arbitrarily determines it during the actual data transfer.

A relay procedure of the SMTP protocol will be shown. S
The MTP client 11 is A of the relay client 31.
Connect to 1 port. The relay client 31 connects to the firewall 9 and transmits the data shown in the example in FIG. Here, in FIG. 4, "CONNECT prox
y. dummy. click. cx: 443 HTTP /
1.0 "is a proxy. dummy. click. cx
It is a message requesting connection to port 443 of the host. In FIG. 4, the communication target device equipped with the relay server 41 is proxy. dummy. click. cx
It is a host, and the port number of the C port is 443. (The description of FIG. 4 is omitted hereinafter)

The firewall 9 that received the message in FIG.
Connects to port 443 of the relay server 41. When the connection is successful, the electronic message shown in the example in FIG. 5 is returned to the relay client 31. If the connection fails, a response message other than that shown in FIG. 5 (for example, “HTTP / 1.0 502 Ba
d Gateway ”). Figure 5 shows HTTPS
This is a normal response telegram of the HTTP protocol, which is also used when opening the communication channel of the protocol. (The description of FIG. 5 is omitted hereinafter)

When the response of FIG. 5 is received, the relay client 41 transmits the message (protocol identification information) shown in FIG. 6 to the relay server 41. In FIG. 6, “SMTP” indicates that the protocol to be transmitted is the SMTP protocol, and “smtp.dummy.c”
lick. cx: 25 "is smtp. dummy. c
lick. It shows that the connection is made to the SMTP server 51, which is waiting for connection at the 25th port of the cx host. When a response other than that shown in FIG. 5 is received, the processing ends without transmitting the message shown in FIG.

The relay server 41 receiving the message of FIG. 6 connects to the SMTP server 51.

By the above procedure, the communication path from the SMTP client 11 to the SMTP server 51 is established. After the communication channel is established, since the electronic message is transmitted and received according to the SMTP protocol, the relay client 3
1 and the relay server 41 transfer (relay) messages between the SMTP client 11 and the firewall 9 and between the firewall 9 and the SMTP server 51, respectively.
1 can communicate. It should be noted that this communication path is automatically disconnected when data transmission according to the SMTP protocol is completed. When the communication path is disconnected, the relay client 31 and the relay server 41 stop the transfer.

A relay procedure of the POP3 protocol will be shown. P
Since the relay procedure of the OP3 protocol is almost the same as the relay procedure of the SMTP protocol, the description will be simplified. P
The relay client 31 connected from the OP3 client 12 connects to the firewall 9 and transmits the message shown in FIG. When the relay client 31 receives the normal response of FIG. 5 from the firewall 9, the relay client 31 transmits a message (protocol identification information) illustrated in FIG. 7. Figure 7
The relay server 41 that has received the message of No. 2 connects to the a2 port (No. 110) of the POP3 server 52. After the connection is established, the message between the POP3 client 12 and the POP3 server 52 is transferred (relayed) by the relay client 31 and the relay server 41, respectively. This transfer is P
It continues until the data transmission according to the OP3 protocol is completed. In FIG. 7, “POP3” indicates that the protocol to be transmitted is the POP3 protocol, and “p3”
op3. dummy. click. cx: 110 ”is
pop3. dummy. click. cx host 11
POP3 server 52 waiting for connection on port 0
Shows to connect to

A relay procedure of the TELNET protocol will be shown. Most of the TELNET protocol relay procedures are SMTP.
Since it is the same as the relay procedure of the protocol, the description will be simplified. The relay client 31 connected from the TELNET client 13 connects to the firewall 9 and sends a message, an example of which is shown in FIG. When the relay client 31 receives the normal response of FIG. 5 from the firewall 9, a message (protocol identification information) of which an example is shown in FIG.
To send. The relay server 41 receiving the message of FIG. 8 connects to the a3 port (23) of the TELNET server 53. After the connection is established, the message between the TELNET client 13 and the TELNET server 53 is transferred (relayed) by the relay client 31 and the relay server 41, respectively. This transfer continues until the data transmission according to the TELNET protocol is completed. In addition, in FIG. 8, "TELNET" indicates that the transmission protocol is TEL.
Tel protocol.
dummy. click. cx: 23 ”is telne
t. dummy. click. It shows that it is connecting to the TELNET server 53, which is waiting for connection on port 23 of the cx host.

The relay procedure of the FTP protocol will be shown. still,
This network system has a property that an information processing terminal on an intranet connects to a communication target device on the Internet. Therefore, even for the FTP protocol, a port connection for data transfer is made from an FTP client to an FTP.
It is assumed to connect to the server in passive mode.

The FTP client 14 connects to the B1 port (21) of the FTP relay client 32. F
When the TP relay client 32 is connected to the B1 port, the A4 port (8021 version) of the relay client 31
Connect to. When the relay client 31 is connected to the A4 port, the relay client 31 connects to the firewall 9 and transmits the data illustrated in FIG. When the firewall 9 receives the message in FIG. 4, it receives the C port (44
Connect to # 3). When the connection is successful, the firewall 9 returns the response message of FIG. 5 to the relay client 31. Relay client 31 that received the response message in FIG.
Sends a message (protocol identification information) illustrated in FIG. 9 to the relay server 41. The relay server 41 that receives the message in FIG. 9 connects to the a4 port (8021 version) of the FTP relay server 42. The FTP relay client 32 transmits a message (protocol identification information) illustrated in FIG. 11 to the FTP relay server 42. Figure 11
The FTP relay server 42, which has received the message of, connects to the b1 port (21) of the FTP server 54.

By the above procedure, the FTP client 1
A communication path for transmitting the data for the control data of the FTP protocol from 4 to the FTP server 54 is secured.

When the communication path for transmitting the control data of the FTP protocol is secured, the control data is transmitted and received between the FTP client 14 and the FTP server 54. FTP relay client 32, relay client 31, relay server 41, FTP relay server 4
In 2, the data is transferred (relayed).

In the FTP relay client 32, the FTP
When the electronic message shown in FIG. 13 among the protocol control data is received from the relay client 31, the data is processed and a communication path for data transmission of the FTP protocol is secured. Specifically, when the message in FIG. 13 is received from the relay client 31, the message is processed as shown in the example in FIG. 14 and transmitted to the FTP client 14. Here in FIG.
Prepares a communication path for data transmission of the FTP protocol.
It is a message indicating that it is completed on the TP server,
The IP address of the FTP server 54 is 210.22
The port number = 12345 of 5.64.140 is shown to be waiting for connection. FTP client 14
13 receives the message in FIG. 13 as it is, tries to secure a communication path for the data transmission protocol of the FTP protocol by the IP address and port number shown in FIG. 13, but is blocked by the firewall 9. In order to avoid this, the message in FIG.
To the FT from the FTP client 14
The communication path for the data transmission protocol of the P protocol is F
The B2 port (20th) of the TP relay client 32 is secured (connected).

When the FTP relay client 32 is connected to the B2 port, it connects to the A5 port (8020) of the relay client 31. The relay client 31 is
When it is connected to the A5 port, it connects to the firewall 9 and sends the message in FIG. When the firewall 9 receives the message shown in FIG. 4, it connects to the C port of the relay server 41. When the connection is successful, the firewall 9 sends the response message of FIG. 5 to the relay client 31. Figure 5
The relay client 31 that has received the response message of FIG.
Is transmitted to the relay server 41. The relay server 41 receiving the message of FIG.
Connect to port a5 (8020). The FTP relay client 32 is shown in FIG.
The message shown in 2 is transmitted. The FTP relay server 42 receiving the message of FIG. 12 is b2 of the FTP server 54.
Connect to port (12345). By performing the above steps, the FTP client 14 to the FTP server 5
The communication path of the data transmission protocol of the FTP protocol to 4 is established. After that, until the data transmission according to the data transmission protocol of the FTP protocol is completed, the FTP
File transfer is realized by transferring (relaying) data with the relay client 32, the relay client 31, the relay server 41, and the FTP relay server 42.

As described above, the information processing terminal on the intranet protected by the firewall performs data acquisition, maintenance, etc. on the communication target device connected to the Internet without changing the firewall. You can It should be noted that although not illustrated, the reading of the e-mail is not limited to the POP3 protocol and the I
It is also possible to use other protocols such as MAP.

[0056]

FIG. 15 is a diagram showing a case where a network service provider, such as an Internet service provider, provides a network relay service to a third party.
It is a figure which shows one Example at the time of implementing this network system.

FIG. 16 shows an embodiment in which a manufacturer of communication target equipment such as process control equipment implements this network system in order to operate or monitor the communication target equipment from an information processing terminal. FIG.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of a network system for implementing a communication method.

FIG. 2 is a diagram showing an internal configuration of a firewall.

FIG. 3 is a diagram showing a connection method for securing a communication path.

FIG. 4 is a diagram showing an example of a message sent to a firewall to secure a communication path.

FIG. 5 is a diagram showing an example of a response message from a firewall.

FIG. 6 is a diagram showing an example of a message transmitted to the relay server to secure a communication path for the SMTP protocol.

FIG. 7 is a diagram showing an example of a message transmitted to the relay server to secure a communication path for the POP3 protocol.

FIG. 8 is a diagram showing an example of a telegram sent to the relay server to secure a communication path for the TELNET protocol.

FIG. 9 is a diagram showing an example of a message sent to the relay server to secure a communication path for sending control data of the FTP protocol.

FIG. 10 is a diagram showing an example of a message sent to the relay server to secure a communication path for sending FTP protocol data.

FIG. 11 is a diagram showing an example of a telegram sent to the FTP relay server to secure a communication path for sending the control data of the FTP protocol.

FIG. 12 is a diagram showing an example of a message sent to the FTP relay server to secure a communication path for sending data of the FTP protocol.

FIG. 13 is a diagram showing an example of a message sent from the FTP server to notify that it has transited to a passive mode.

FIG. 14 is a diagram showing an example of a message sent from the FTP relay client to notify the transition to the passive mode.

FIG. 15 is a diagram showing an embodiment of the present invention in which the relay function operates as an independent device.

FIG. 16 is a diagram showing an example in which the relay function of the present invention operates as a program.

[Explanation of symbols]

1 ... Client program, 2 ... Client side relay function, 3 ... Relay communication channel, 4 ... Server side relay function, 5 ... Server program, 6 ... Information processing terminal, 8 ... Intranet, 9 ..Firewalls,
10 ... Internet, 11 ... SMTP client, 12 ... POP3 client, 13 ... TELN
ET client, 14 ... FTP client, 31
・ ・ Relay client, 32 ・ ・ FTP relay client, 41 ・ ・ Relay server, 42 ・ ・ FTP relay server, 51 ・ ・ SMTP server, 52 ・ ・ POP3 server, 53 ・ ・ TELNET server, 54 ・ ・ FTP
Server, 91 · Network interface, 9
2 ... IP filtering unit, 93 ... Network interface, 2a ... Client side relay device, 2
b .. client side relay program, 4a .. server side relay device, 4b .. server side relay program, 7
a ... Communication target device, 7b ... Communication target device

Claims (17)

[Claims] 1. An information processing terminal connected to an external network through a firewall that passes only signals complying with a specific communication protocol, and communication that is connected to the external network and operated or monitored by the information processing terminal. In a network system for performing data communication with a target device, the information processing terminal, for the communication target device, via a communication path secured by means for securing a communication path according to the specific communication protocol. ,
A network system for transmitting protocol data other than the specific communication protocol. 2. The network system according to claim 1, wherein the information processing terminal transmits to the communication target device via a communication path secured by a securing means of a communication path conforming to the specific communication protocol. To perform data transmission according to the protocol identified by the protocol identification information other than the specific communication protocol by performing data transmission of protocol identification information for identifying the protocol and its destination by the communication target device A network system characterized by securing a communication path of. 3. An information processing terminal and a communication target device operated or monitored by the information processing terminal,
A communication method for performing data communication between the information processing terminal and the communication target device by using a communication network provided with a firewall that passes only a signal according to a specific communication protocol, wherein the information processing terminal is A first step of securing a communication path for the communication target device by means for securing a communication path conforming to the specific communication protocol; and a protocol for transmitting to the secured communication path and a destination of the communication. A second step of transmitting data of protocol identification information for identifying the target device;
And a third step of securing a communication path for the communication target device to perform data transmission according to the protocol identified by the protocol identification information. 4. An information processing terminal connected to an external network through a firewall that passes only signals conforming to the HTTPS protocol, and a communication target device connected to the external network and operated or monitored by the information processing terminal. In the network system for performing data communication with the information processing terminal, the information processing terminal, via the communication path secured by the securing means of the communication path according to the HTTPS protocol, to the communication target device,
A network system for transmitting protocol data other than the HTTPS protocol. 5. The network system according to claim 4, wherein the information processing terminal transmits to the communication target device via a communication path secured by means for securing a communication path conforming to the HTTPS protocol. By performing data transmission of protocol identification information for identifying the transmission destination by the communication target device, a communication path for performing data transmission according to the protocol identified by the protocol identification information other than the HTTPS protocol is provided. A network system characterized by securing. 6. An information processing terminal and a communication target device which is operated by the information processing terminal or whose operation is monitored,
A communication method for performing data communication between the information processing terminal and the communication target device by using a communication network provided with a firewall that passes only a signal according to the HTTPS protocol, wherein the information processing terminal comprises: A first step of securing a communication path to a communication target device by means for securing a communication path according to the HTTPS protocol, and the communication target device identifies a protocol to be transmitted and a destination of the protocol on the secured communication path. A second step of transmitting data of protocol identification information for
And a third step of securing a communication path for the communication target device to perform data transmission according to the protocol identified by the protocol identification information. 7. An information processing terminal connected to an external network through a firewall that passes only signals complying with the HTTPS protocol, and a communication target device connected to the external network and operated or monitored by the information processing terminal. In the network system for performing data communication with the electronic mail, an electronic mail is transmitted or received via the communication path secured by the securing means of the communication path according to the HTTPS protocol. 8. The network system according to claim 7, wherein the information processing terminal transmits to the communication target device via a communication path secured by a communication path securing unit according to the HTTPS protocol. A network system for securing a communication path for transmitting or receiving the electronic mail by transmitting data of protocol identification information for identifying the transmission destination and the destination of the communication by the communication target device. 9. An information processing terminal and a communication target device operated or monitored by the information processing terminal,
A communication method for performing data communication between the information processing terminal and the communication target device by using a communication network provided with a firewall that passes only a signal according to the HTTPS protocol, wherein the information processing terminal comprises: A first step of securing a communication path to a communication target device by means for securing a communication path conforming to the HTTPS protocol; a protocol to be transmitted to the secured communication path is an e-mail protocol; A second step of performing data transmission of protocol identification information for identifying the transmission destination by the communication target device; and performing data transmission according to the protocol of the electronic mail identified by the communication target device by the protocol identification information And a third step of securing a communication path. 10. An information processing terminal connected to an external network through a firewall that passes only signals conforming to the HTTPS protocol, and a communication target device connected to the external network and operated or monitored by the information processing terminal. In the network system for performing data communication with the network system, the TELNET protocol is transmitted via the communication path secured by the securing means of the communication path conforming to the HTTPS protocol. 11. A network system according to claim 10, wherein the information processing terminal transmits to the communication target device via a communication path secured by a communication path securing unit conforming to the HTTPS protocol. And by performing data transmission of protocol identification information for the communication target device to identify the transmission destination,
A network system, which secures a communication path for transmitting the TELNET protocol. 12. A communication network, which is interposed between an information processing terminal and a communication target device which is operated or whose operation is monitored by the communication network and which is provided with a firewall for passing only signals complying with the HTTPS protocol, is used. A communication method for performing data communication between an information processing terminal and the communication target device, wherein the information processing terminal communicates with the communication target device by means for securing a communication path according to the HTTPS protocol. And a data transmission of protocol identification information for identifying the transmission destination of the communication target device by the communication target device, in the first step In the second step, the communication target device identifies the TELNET program identified by the protocol identification information. Communication method characterized in that it comprises a third step of securing the communication path for data transmission col. 13. An information processing terminal connected to an external network through a firewall that passes only signals conforming to the HTTPS protocol, and a communication target device connected to the external network and operated or monitored by the information processing terminal. In the network system for performing data communication with the file system, the file transfer is performed via the communication path secured by the securing means of the communication path according to the HTTPS protocol. 14. The network system according to claim 13, wherein the information processing terminal transmits to the communication target device via a communication path secured by a securing means of a communication path conforming to the HTTPS protocol. And by performing data transmission of protocol identification information for the communication target device to identify the transmission destination,
A network system which secures a communication path for performing the file transfer. 15. The network system according to claim 14, wherein the information processing terminal performs data transmission of an FTP protocol data transmission protocol from the communication target device via the first communication path. A network system characterized in that, when data indicating a transmission destination is received, the data is tampered with so as to point to the secured second communication path. 16. A communication network, which is provided between an information processing terminal and a communication target device operated or monitored by the information processing terminal and provided with a firewall for passing only signals complying with the HTTPS protocol, A communication method for performing data communication between an information processing terminal and the communication target device, wherein the information processing terminal communicates with the communication target device by means for securing a communication path according to the HTTPS protocol. The first step of securing two of the above, and the information processing terminal for controlling the communication target device to the first communication path of the secured communication paths, in which the protocol to be transmitted is the FTP protocol. Data transmission of protocol identification information for the communication target device to identify the data transmission protocol and its destination A second step, a third step in which the communication target device secures a communication path for data transmission of the control data of the FTP protocol identified by the protocol identification information, and the information processing terminal , The protocol to be transmitted is the data transmission protocol of the FTP protocol to the second communication path among the secured communication paths with respect to the communication target apparatus, and the destination is the communication target apparatus. A fourth step of performing data transmission of protocol identification information for identification and a communication path for performing data transmission of the data transmission protocol of the FTP protocol identified by the communication target device by the protocol identification information are secured. And a fifth step. 17. The communication method according to claim 16, wherein the information processing terminal performs data transmission of a data transmission protocol of an FTP protocol from the communication target device via the first communication path. A communication method comprising the step of tampering so as to point to the secured second communication path when receiving data indicating a destination.