JP2006115073A - Repeater in network, external repeater, communication system and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To establish communication between the terminal of network in an organization isolated by a firewall and an external server being accessed by an LDAP easily and inexpensively. <P>SOLUTION: An LDAP repeater 20 comprises a proxy DNS 21 sending back its own IP address as the domain name of a repeatable LDAP server 70 to a terminal 10, and a protocol converting means 23 in network for converting LDAP and HTTP. Consequently, communication is established by LDAP between the terminal 10 and the LDAP repeater 20 by simply interposing the LDAP repeater 20 between a firewall 50 and the terminal 10, and it is accessible from the terminal 10 by an operation quite similar to the operation for accessing the LDAP server 70 directly through a leased line. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a technology that enables communication between a terminal device of a network in an organization isolated by a firewall and an external server that is communicated by a protocol that is rejected by the firewall.

As a technique for accessing an external server communicated by a protocol (for example, LDAP) blocked by a firewall from a terminal device in an organization network isolated by a firewall, a technique disclosed in Non-Patent Document 1 is known. Are known. In this technology, a double firewall is set, and a proxy server for conversion (LDAP proxy server for electronic bidding) for converting from HTTP to LDAP is installed between two firewalls. More specifically, in order to pass through the firewall, the terminal device communicates with HTTP, accesses the electronic bidding LDAP proxy server, converts the HTTP from the electronic bidding LDAP proxy server to the LDAP, E-bidding is done on the Internet by passing through the firewall that allowed the passage of.
http://www.tdb.co.jp/whatsnew/k031203.html/

  By the way, when the system as described in Non-Patent Document 1 is not set, in order to obtain CRL information when performing electronic bidding, a dedicated separate line for direct communication with LDAP is installed. It is common. For this reason, software for performing electronic bidding by LDAP is already set in the terminal device. In such a case, if the technique described in Non-Patent Document 1 is used, it is necessary to incorporate software for performing electronic bidding by HTTP communication or some function addition module for enabling HTTP communication. is there.

  The present invention has been made in view of the above, and it is not necessary to install a dedicated separate line or to set a special program in the terminal device or the like, that is, without changing the setting of existing equipment, Intra-network relay that can establish communication between a network terminal in an organization that is isolated by a firewall at low cost and an external server that is accessed by a rejection communication protocol in the form that is rejected by the firewall It is an object to provide a device, an external relay device, a communication system, and a communication method.

In order to solve the above-mentioned problem, in the invention described in claim 1, a terminal device of the network in the organization isolated by the firewall, and an external device outside the network accessed by a rejection communication protocol of a form rejected by the firewall. An intra-network relay device for enabling communication with a server,
Interposed between the firewall and the terminal device,
When the DNS inquiry from the terminal device is the domain name of the external server that can be relayed, a proxy DNS that returns its own IP address to the terminal device as an IP address corresponding to the domain name of the external server;
After obtaining the IP address from the proxy DNS, the inquiry information by the reject communication protocol transmitted from the terminal device is converted into a permitted communication protocol that can pass through a firewall, and can be transmitted outside the network. , Receiving reply information from the external server in a rejected communication protocol in a form converted into a licensed communication protocol by an external protocol converting means outside the network, converting the reply information into a rejected communication protocol, and sending it back to the terminal device An intra-network relay apparatus comprising: an intra-network protocol conversion means.
The invention according to claim 2 is characterized in that a proxy server is set in the network in the organization and is interposed between the proxy server and the terminal device. I will provide a.
According to a third aspect of the present invention, when the DNS inquiry from the terminal device does not correspond to a domain name of an external server that can be relayed, the proxy DNS forwards the DNS inquiry to another DNS in the network. 3. The intra-network relay apparatus according to claim 1 or 2, further comprising a function.
The invention according to claim 4 provides the intra-network relay apparatus according to any one of claims 1 to 3, wherein the rejection communication protocol is an LDAP protocol.
According to a fifth aspect of the invention, there is provided the intra-network relay apparatus according to any one of the first to fourth aspects, wherein the licensed communication protocol is an HTTP protocol.
The invention according to claim 6 is a hardware / software integrated type in which the proxy DNS and the in-network protocol conversion means are integrally incorporated in a casing. An intra-network relay device is provided.

According to the seventh aspect of the present invention, communication between a terminal device in a network in an organization isolated by a firewall and an external server outside the network accessed by a rejection communication protocol in a form rejected by the firewall. In order to enable the external relay device provided outside the network,
Interposed between the firewall and an external server,
Inquiry information transmitted from within the network using a permitted communication protocol that can pass through a firewall is converted into the rejected communication protocol so that it can be transmitted to the external server, and a reply is transmitted from the external server using the rejected communication protocol. There is provided an external relay device comprising an external protocol conversion means for converting information into a licensed communication protocol and transmitting the information into the network.

In the invention according to claim 8, communication between a terminal device of a network in an organization isolated by a firewall and an external server outside the network accessed by a rejection communication protocol in a form rejected by the firewall A communication system for enabling
An intra-network relay device interposed between a firewall and a terminal device in the network, and an external relay device interposed before the external server outside the network,
When the DNS inquiry from the terminal device is the domain name of the external server that can be relayed, the intra-network relay device returns its own IP address to the terminal device as an IP address corresponding to the domain name of the external server. Proxy DNS,
In-network protocol conversion means for performing protocol conversion between a permitted communication protocol that can pass through the firewall and a rejected communication protocol that is rejected by the firewall,
The external relay device comprises external protocol conversion means for performing protocol conversion between the permitted communication protocol and the rejected communication protocol;
After obtaining the IP address of the proxy DNS from the proxy DNS of the relay device in the network, permission to allow inquiry information based on the reject communication protocol transmitted from the terminal device to pass through the firewall by the protocol conversion means in the network It can be converted to a communication protocol and transmitted outside the network,
When the external relay device receives the inquiry information, the external protocol conversion unit converts the permitted communication protocol into a rejected communication protocol, and transmits it to the external server.
If the external relay device receives the reply information from the external server, the external protocol conversion means converts the rejection communication protocol into a permitted communication protocol, and transmits it into the network.
When the intra-network relay apparatus receives reply information from an external server via the external relay apparatus, the intra-network protocol conversion means converts the reply information into a reject communication protocol and returns it to the terminal apparatus. There is provided a communication system characterized by having a configuration.
The invention according to claim 9 is characterized in that a proxy server is set in the network in the organization, and the intra-network relay device is interposed between the proxy server and the terminal device. A communication system according to claim 8 is provided.
The invention according to claim 10 provides the communication system according to claim 8 or 9, wherein the rejection communication protocol is an LDAP protocol.
The invention according to claim 11 provides the communication system according to any one of claims 8 to 10, wherein the licensed communication protocol is an HTTP protocol.

In the invention described in claim 12, communication between a terminal device in a network in an organization isolated by a firewall and an external server outside the network accessed by a rejection communication protocol in a form rejected by the firewall. A communication method for enabling
Between the firewall and the terminal device,
When the DNS inquiry from the terminal device is the domain name of the external server that can be relayed, a proxy DNS that returns its own IP address to the terminal device as an IP address corresponding to the domain name of the external server;
After obtaining the IP address from the proxy DNS, the inquiry information by the reject communication protocol transmitted from the terminal device is converted into a permitted communication protocol that can pass through a firewall, and can be transmitted outside the network. , Receiving reply information from the external server in a rejected communication protocol in a form converted into a licensed communication protocol by an external protocol converting means outside the network, converting the reply information into a rejected communication protocol, and sending it back to the terminal device By interposing an intra-network relay device comprising intra-network protocol conversion means,
Communication is established between the terminal device and the intra-network relay device using a reject communication protocol, and the terminal device can send inquiry information using the reject communication protocol and receive reply information using the reject communication protocol. A communication method is provided.
The invention according to claim 13 provides the communication method according to claim 12, wherein the rejection communication protocol is an LDAP protocol.
The invention according to claim 14 provides the communication method according to claim 12 or 13, wherein the licensed communication protocol is an HTTP protocol.

  In the present invention, the relay device in the network converts the proxy DNS that returns its own IP address to the terminal device as an IP address corresponding to the domain name of the external server that can be relayed, and the conversion between the reject communication protocol and the permitted communication protocol. And an intra-network protocol conversion means. For this reason, simply by interposing a relay device in the network between the firewall and the terminal device, communication using the reject communication protocol is established between the terminal device and the relay device in the network. Can be accessed in exactly the same way as when directly accessing an external server through a separate dedicated line. Therefore, there is no need to install a dedicated dedicated line or set a special program in the terminal device, etc., and an external server that can be accessed easily and at low cost by a rejected communication protocol simply by interposing a relay device in the network. Communication can be established.

  In particular, in an intra-company network, an inter-company network, etc., it is common to use a firewall setting in which HTTP communication is allowed. Rejected by the wall. Therefore, setting so that protocol conversion between HTTP and LDAP is possible is particularly effective because information such as CRL can be easily obtained.

  In addition, if an external relay device equipped with external protocol conversion means that converts between a rejected communication protocol and a permitted communication protocol is interposed between the firewall and the external server, it is not necessary to set a special program on the external server. Therefore, the present invention can be introduced more easily.

  Hereinafter, embodiments of the present invention will be described in more detail with reference to the drawings. FIG. 1 is a schematic diagram showing a communication system 1 for accessing the LDAP server 70 using the LDAP relay device 20 which is an intra-network relay device of the present embodiment, and FIG. 2 is a hardware diagram of the LDAP relay device 20. FIG. 3 and FIG. 4 are flowcharts until the LDAP inquiry information transmitted from the terminal device 10 reaches the LDAP server 70, and FIG. 5 reaches the LDAP server 70. 5 is a flowchart showing a process until reply information for LDAP inquiry information is returned to the terminal device 10;

  A communication system 1 according to an embodiment of the present invention is a system constructed on the premise of using a communication protocol called LDAP (Lightweight Directory Access Protocol). As a usage form of LDAP, a CRL (Certificate Revocation List) in electronic bidding or the like is used. ) Acquisition of information. LDAP is a protocol used in electronic applications and electronic bidding to ministries and local governments, etc., but this is set for internal networks such as corporate LAN (hereinafter referred to as “internal network”). It is often suitable for using the present invention because it cannot pass through a firewall, and CRL is a list of revoked digital certificates managed by a certificate authority (CA). Since it acquires using LDAP, it is suitable as an application object of this invention.

  More specifically, as shown in FIG. 1, the communication system 1 establishes communication between the terminal device 10 of the intra-organization network 100 and the LDAP server 70 outside the intra-organization network 100. Since the intra-organization network 100 is isolated from the external network by the firewall 50, when attempting communication using LDAP, which is a rejected communication protocol, the internal network 100 cannot pass through the firewall 50, and a predetermined protocol that is a permitted communication protocol Only (for example, HTTP) is set to be able to pass through the firewall 50. The intra-organization network 100 includes an HTTP proxy server 30 and an in-house DNS 40 installed in a normal corporate network. In the present embodiment, in addition to this, the HTTP proxy server 30 and the terminal device 10 include An LDAP relay device 20 as a relay device in the network is provided between them. As the firewall 50, a firewall dedicated machine may be installed, or software that performs a firewall function may be installed in the HTTP proxy server 30 or the like.

  As shown in FIG. 1, the LDAP relay device 20 includes a proxy DNS 21 and an intra-network protocol conversion unit 22. The LDAP relay device 20 has a domain storage unit 23 that stores the domain names of one or more LDAP servers 70 to be relayed, and the proxy DNS 21 receives the DNS inquiry from the terminal device 10 as the domain name of the LDAP server 70. Whether or not the IP address of the LDAP server 70 is returned to the terminal device 10 instead of the IP address of the LDAP server 70. As a result, the terminal device 10 recognizes that the IP address of the LDAP server 70 has been returned at this point, and performs communication settings. Although only one LDAP server 70 is shown in the figure, it is needless to say that a plurality of LDAP servers 70 may be used. In this case, the external relay device 60 described later has a ratio of one to a plurality of LDAP servers 70. Can be set.

  The intra-network protocol conversion means 22 is means for performing protocol conversion between LDAP and HTTP, and any means may be used as long as it has such a function. In the present embodiment, http tunnel 22a (see FIG. 2) is set as application software, and protocol conversion is performed by a tunneling means. That is, a packet described in LDAP transmitted from the terminal device 10 is wrapped in an HTTP packet and transmitted to the HTTP proxy server 30, while an HTTP packet returned via the HTTP proxy server 30 is converted into an LDAP packet To the terminal device 10 as LDAP.

  As shown in FIG. 2, the hardware configuration of the LDAP relay apparatus 20 according to the present embodiment employs a RedHat-based distribution 26 that operates using the Linux kernel 25 as a core, and operates on the OS. BND (Berkeley Internet Name Domain) 21a is used as server software for proxy DNS 21 to perform, and http tunnel 22a is used as in-network protocol conversion means 22 that also operates on the OS as described above. In the LDAP relay apparatus 20 of the present embodiment, the proxy DNS 21 (BIND 21a), the intra-network protocol conversion means 22 (http tunnel 22a), and the OS that controls the operation thereof are modularized and integrated into the casing. Hardware / software integrated type (appliance type). Of course, the software constituting the OS, proxy DNS 21, and in-network protocol conversion means 22 is not limited to these.

  The proxy DNS 21 has a function of transferring the DNS inquiry to the in-house DNS 40 when the DNS inquiry from the terminal device 10 is not the domain name of the relayable LDAP server 70. That is, since the domain name of the specific LDAP server 70 is stored in advance, DNS inquiries other than the LDAP server 70 are set to be forwarded to the in-house DNS 40. As a result, when the terminal device 10 accesses the Internet, an arbitrary business network in the organization network 100, etc., the proxy DNS 21 does not return its own IP address to the terminal device 10, The in-house DNS 40 is inquired and transferred as it is, and the DNS response from the in-house DNS 40 is returned to the terminal device 10 as it is. As a result, even if the LDAP relay device 20 is interposed between the terminal device 10 and the HTTP proxy server 30, normal communication other than the LDAP communication by the terminal device 10 is executed without any problem.

  An external relay device 60 is installed in the previous stage of the access path to the LDAP server 70. An external protocol conversion means 61 is set in the external relay device 60. As the external protocol conversion means 61, as in the above-described intra-network protocol conversion means 22, an http tunnel that performs protocol conversion between LDAP and HTTP is used. Used. As a result, the information transmitted from the HTTP proxy server 30 is restored from the HTTP packet to the LDAP packet, and sent to the LDAP server 70 as LDAP. On the other hand, the LDAP packet returned from the LDAP server 70 is wrapped in the HTTP packet by the external protocol conversion means 61 and returned to the HTTP proxy server 30, so that it can pass through the firewall 50 on the way. The external relay device 60 may be an appliance type in which an OS and an http tunnel are modularized and set so that it is only necessary to intervene in the communication path between the LDAP server 70 and the intra-organization network 100. What is preferable is the same as the intra-network relay apparatus 20 described above.

  Next, a processing procedure until the LDAP inquiry information transmitted from the terminal device 10 reaches the LDAP server 70 will be described with reference to FIGS. As shown in FIG. 3, first, the terminal device 10 transmits DNS inquiry information to the LDAP relay device 20 (S101). The LDAP relay device 20 determines whether or not the received DNS inquiry information is the relayable LDAP server 70 by referring to the domain storage unit 23 (S102), and confirms that it is a relayable LDAP domain name. Upon confirmation, the proxy DNS 21 of the LDAP relay device 20 returns its own IP address (impersonated IP address) to the terminal device 10 (S103), and makes the terminal device 10 recognize that it is an LDAP server. When the terminal device 10 receives the spoofed IP address (S104), the terminal device 10 transmits LDAP inquiry information to the LDAP relay device 20 (S105). When the LDAP relay device 20 receives the inquiry information of the LDAP (S106), the firewall 50 can pass the received inquiry information of the LDAP as described above by the intra-network protocol conversion means 22 (http tunnel 22a). Conversion into HTTP inquiry information which is a form is performed (S107).

  On the other hand, if the DNS inquiry information received from the terminal device 10 is not the LDAP server 70 in the domain storage unit 23, the proxy DNS 21 forwards the DNS inquiry information to the in-house DNS 40 (S108). The received in-house DNS 40 returns a DNS if it has data (S110), and if it does not have it, makes an inquiry about the DNS to the upstream DNS (S109).

  As shown in FIG. 4, the LDAP relay device 20 transmits HTTP inquiry information converted from LDAP to HTTP to the HTTP proxy server 30 (S201). After receiving the inquiry information in the HTTP format (S202), the HTTP proxy server 30 transmits the inquiry information to the external relay device 60 (S203). Accordingly, since the inquiry information of the LDAP from the terminal device 10 has already been converted into HTTP when passing through the firewall 50, it can be passed as normal HTTP packet handling without changing the setting of the firewall 50 or the like. Become. When the external relay device 60 receives the inquiry information in the HTTP format (S204), the external protocol conversion means (http tunnel) 61 restores the HTTP inquiry information to the LDAP inquiry information (S205), and the restoration processing is performed. The LDAP inquiry information is transmitted to the LDAP server 70 (S206). The LDAP server 70 receives the LDAP inquiry information (S207).

  Next, a processing procedure until the inquiry information of the LDAP that has reached the LDAP server 70 is returned to the terminal device 10 as return information will be described with reference to FIG. The LDAP server 70 returns a response (reply information) to the received LDAP inquiry information in the LDAP format (S301). When the external relay device 60 receives the LDAP reply information (S302), the external protocol conversion means (http tunnel) 61 converts the received LDAP reply information into HTTP reply information (S303). The reply information is transmitted to the HTTP proxy server 30 of the intra-organization network 100 (S304). Accordingly, even when the reply information is transmitted from the external relay device 60 to the HTTP proxy server 30, the HTTP information is in the HTTP format, so that it can pass through the firewall 50 in the same manner as normal HTTP communication. After receiving the HTTP-format reply information (S305), the HTTP proxy server 30 transmits the reply information to the LDAP relay apparatus 20 in the HTTP-format state (S306). Upon receiving the HTTP reply information (S307), the LDAP relay apparatus 20 restores the HTTP reply information to the LDAP reply information by the intra-network protocol conversion means 22 (http tunnel 22a) (S308). The reply information in the LDAP format is transmitted to the terminal device 10 (S309). The terminal device 10 receives the LDAP reply information from the LDAP relay device 20 (S310).

  According to the present embodiment, the LDAP relay device 20 is interposed between the firewall 50 and the terminal device 10 of the intra-organization network 100, and the external relay device 60 is interposed between the firewall 50 and the external LDAP server 70. It is not necessary to change the configuration of the other communication system 1 at all by simply installing it. In other words, although there is no need to change the settings of the terminal device 10, the HTTP proxy server 30, the in-house DNS 40, the firewall 50, and the LDAP server 70, between the terminal device 10 and the LDAP relay device 20, LDAP is used. Communication will be established. Therefore, the terminal device 10 can be accessed by the same operation as when directly accessing the LDAP server 70 through the LDAP dedicated line, and a dedicated line can be laid as in the past, or a special program can be installed in the terminal device or the like. There is no need to set to.

  In the above description, protocol conversion between HTTP and LDAP is described as an example, which is particularly effective when accessing an external LDAP server from an in-house network for electronic bidding and CRL acquisition. However, the present invention is not limited to HTTP and LDAP, and any licensed communication protocol that can pass through a firewall between a terminal device in an organization network isolated by a firewall and a server set outside. And establishment of communication between any rejected communication protocols rejected by the firewall.

  Further, in the above description, http tunnel is used as the intra-network protocol conversion means 22 and the external protocol conversion means 61 that perform protocol conversion between HTTP and LDAP. However, as long as the same purpose can be achieved, other protocol conversions are possible. It is also possible to use software. Of course, as described above, any protocol conversion software suitable for the conversion between another permitted communication protocol and a rejection communication protocol that is not between HTTP and LDAP is used.

  In the above description, the HTTP proxy server 30 is set in the intra-organization network 100, but the present invention can of course be applied to an intra-organization network that does not have such a proxy server. In that case, transmission / reception of information through the firewall 50 is performed between the intra-network relay device 20 and the external relay device 60.

It is a schematic block diagram which shows the whole structure of the communication system which concerns on embodiment of this invention. It is a block diagram which shows the hardware constitutions of a LDAP relay apparatus. It is the flowchart which showed until the inquiry information of the LDAP transmitted from the terminal device reaches the LDAP server. It is the flowchart which showed until the inquiry information of the LDAP transmitted from the terminal device reaches the LDAP server. It is the flowchart which showed until the inquiry information of the LDAP which reached | attained the LDAP server was returned to a terminal device as reply information.

Explanation of symbols

1 Communication system 10 Terminal device 20 LDAP relay device 21 Proxy DNS
22 Intra-network protocol conversion means 30 HTTP proxy server 40 In-house DNS
50 Firewall 60 External Relay Device 61 External Protocol Conversion Means 70 LDAP Server 100 Organizational Network

Claims (14)

In the network for enabling communication between a terminal device of the network in the organization isolated by the firewall and an external server outside the network accessed by a rejection communication protocol in a form rejected by the firewall. A relay device,
Interposed between the firewall and the terminal device,
When the DNS inquiry from the terminal device is the domain name of the external server that can be relayed, a proxy DNS that returns its own IP address to the terminal device as an IP address corresponding to the domain name of the external server;
After obtaining the IP address from the proxy DNS, the inquiry information by the reject communication protocol transmitted from the terminal device is converted into a permitted communication protocol that can pass through a firewall, and can be transmitted outside the network. , Receiving reply information from the external server in a rejected communication protocol in a form converted into a licensed communication protocol by an external protocol converting means outside the network, converting the reply information into a rejected communication protocol, and sending it back to the terminal device An intra-network relay apparatus comprising: intra-network protocol conversion means.   2. The intra-network relay apparatus according to claim 1, wherein a proxy server is set in the network in the organization, and is interposed between the proxy server and the terminal apparatus.   The proxy DNS is provided with a function of transferring the DNS inquiry to another DNS in the network when the DNS inquiry from the terminal device does not correspond to the domain name of the external server that can be relayed. The intra-network relay device according to claim 1 or 2.   The intra-network relay apparatus according to claim 1, wherein the reject communication protocol is an LDAP protocol.   5. The intra-network relay apparatus according to claim 1, wherein the licensed communication protocol is an HTTP protocol.   6. The intra-network relay apparatus according to claim 1, wherein said proxy DNS and intra-network protocol conversion means are of a hardware / software integrated type integrally incorporated in a casing. In order to enable communication between a terminal device of a network in an organization isolated by a firewall and an external server outside the network accessed by a deny communication protocol in the form of being denied by the firewall, the network An external relay device provided outside,
Interposed between the firewall and an external server,
Inquiry information transmitted from within the network using a permitted communication protocol that can pass through a firewall is converted into the rejected communication protocol so that it can be transmitted to the external server, and a reply is transmitted from the external server using the rejected communication protocol. An external relay device comprising external protocol conversion means for converting information into a licensed communication protocol and transmitting the information into the network. A communication system for enabling communication between a terminal device of a network in an organization isolated by a firewall and an external server outside the network accessed by a rejection communication protocol in a form rejected by the firewall Because
An intra-network relay device interposed between a firewall and a terminal device in the network, and an external relay device interposed before the external server outside the network,
When the DNS inquiry from the terminal device is the domain name of the external server that can be relayed, the intra-network relay device returns its own IP address to the terminal device as an IP address corresponding to the domain name of the external server. Proxy DNS,
In-network protocol conversion means for performing protocol conversion between a permitted communication protocol that can pass through the firewall and a rejected communication protocol that is rejected by the firewall,
The external relay device comprises external protocol conversion means for performing protocol conversion between the permitted communication protocol and the rejected communication protocol;
After obtaining the IP address of the proxy DNS from the proxy DNS of the relay device in the network, permission to allow inquiry information based on the reject communication protocol transmitted from the terminal device to pass through the firewall by the protocol conversion means in the network It can be converted to a communication protocol and transmitted outside the network,
When the external relay device receives the inquiry information, the external protocol conversion unit converts the permitted communication protocol into a rejected communication protocol, and transmits it to the external server.
If the external relay device receives the reply information from the external server, the external protocol conversion means converts the rejection communication protocol into a permitted communication protocol, and transmits it into the network.
When the intra-network relay apparatus receives reply information from an external server via the external relay apparatus, the intra-network protocol conversion means converts the reply information into a reject communication protocol and returns it to the terminal apparatus. A communication system, characterized in that   9. The communication system according to claim 8, wherein a proxy server is set in the network in the organization, and the intra-network relay device is interposed between the proxy server and the terminal device.   10. The communication system according to claim 8, wherein the reject communication protocol is an LDAP protocol.   The communication system according to any one of claims 8 to 10, wherein the licensed communication protocol is an HTTP protocol. A communication method for enabling communication between a terminal device in a network in an organization isolated by a firewall and an external server outside the network accessed by a rejection communication protocol in a form rejected by the firewall Because
Between the firewall and the terminal device,
When the DNS inquiry from the terminal device is the domain name of the external server that can be relayed, a proxy DNS that returns its own IP address to the terminal device as an IP address corresponding to the domain name of the external server;
After obtaining the IP address from the proxy DNS, the inquiry information by the reject communication protocol transmitted from the terminal device is converted into a permitted communication protocol that can pass through a firewall, and can be transmitted outside the network. , Receiving reply information from the external server in a rejected communication protocol in a form converted into a licensed communication protocol by an external protocol converting means outside the network, converting the reply information into a rejected communication protocol, and sending it back to the terminal device By interposing an intra-network relay device comprising intra-network protocol conversion means,
Communication is established between the terminal device and the intra-network relay device using a reject communication protocol, and the terminal device can send inquiry information using the reject communication protocol and receive reply information using the reject communication protocol. Communication method.   The communication method according to claim 12, wherein the rejection communication protocol is an LDAP protocol.   The communication method according to claim 12 or 13, wherein the licensed communication protocol is an HTTP protocol.

Images