JP2018156553A - Identification information application system and identification information application method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an identification information application system which can associate communication data between a Web server, an AP server and a DB server being business servers and a transmission source for applying identification information to each communication data by associating to the transmission source of the communication data being the client without increasing the load on a system designer.SOLUTION: An identification information application system applying identification information to communication data for association of each of communication data transmitted and received between business servers performing prescribed business processing constituting a web system and transmitted from a client being a transmission source includes: a data supply unit which serially supplies communication data to the business servers in the order received from the client; and an identification information application unit which applies the identification information identifying the transmission source to the communication data in the order.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an identification information providing system and an identification information providing method for providing identification information for identifying each piece of communication data in the information system.

In recent years, financial transactions using online banking via the Internet have become common in companies such as finance and banks.
In a commercial Web system that performs online banking, an attack that attempts to acquire financial transaction information or cause a system failure via the Internet or the like is from a malicious third party (attacker). May be done. This attack is an unauthorized login attempt or SQL (Structured Query Language) injection. In the case of such an attack, these attacks are generated as security incidents in the Web system of the company using the online banking.

The company is responsible for notifying customers who are doing financial transactions with themselves as security incident responses. So, if there was such an attack, when did the attack occur, who attacked, what happened as a result of the attack, what if the data leaked, It is necessary to investigate damages such as what kind of data has been leaked and whether it is necessary to clarify the whole picture at this time.
Log data, that is, log information in each of a Web (Web) server, an AP (Application) server, and a DB (database server) server in the three-layer model is necessary as data necessary for the above-described investigation.

As the log information, there are a log (log A) output from each of the devices constituting the Web system, the Web server that is a business server, the AP server, and the DB server, and communication data (packets) transmitted and received between the devices. ) Is captured (acquired) and stored (log B).
Here, when the log A is used, when a log indicating the processing result is extracted in each device constituting the Web system, the log is extracted at the design stage when creating the Web system or at the stage of changing the system. It is necessary to consider the configuration. In other words, it is necessary to set the log format or log item, design the Web system, and implement so that extraction is performed in the network.

For this reason, the load of performing design work considering the operations other than the original processing of each server is given to the system designer, and the development process is increased by performing log extraction simulation, etc., and the system development cost is reduced. It will increase.
Also, when changing the log format or log items, it is necessary to stop the Web system, that is, stop Internet banking operations in order to change the Web system.
For the reasons described above, it is conceivable to investigate a security incident using the log B in order to perform log extraction without including the log extraction function in the Web system itself and to suppress an increase in development cost of the Web system.

On the other hand, when using log B, packets transmitted and received between servers are captured from a mirror port of a NIC (network interface card) that connects the servers in the Web system, and history data is stored as log B. . When an attack occurs, the log B is referenced to investigate the damage caused by the attack.
Here, there are three possible points for capturing packets: the connection point of each of the client terminal, the Web server, the AP server, and the DB server.

However, in the case of a Web system with a large amount of traffic, the order of requests (packets requesting processing) input from each client terminal to the Web server matches the order of requests output from the Web server to the AP server. There is no guarantee to do. That is, the Web server adjusts the order of requests to be output to the AP server according to the request load. This makes it difficult to associate packets among client terminals, Web servers, AP servers, and DB servers.
For this reason, since it is very time-consuming for the person in charge of the survey to perform the association, the packet is associated with each server by including information for association in the packet (for example, Patent Literature 1 and Patent Document 2).

JP 2011-118951 A JP 2003-228498 A

  As described above, in the case of the prior art using the log B, since it is not necessary to have a function for outputting the log, it is possible to reduce the development cost compared to the case where the log A is used. . However, in the prior art, since it is necessary to add a function for embedding information for associating a packet to a server, it is compared with a case where a function for embedding information for associating a log in a packet is not added. As a result, the load on the system designer increases and the development cost also increases.

  The present invention has been made in view of the above circumstances, and does not increase the load of the system designer, but corresponds to the transmission source of communication data as a client, and gives identification information to each of the communication data. Therefore, an object of the present invention is to provide an identification information providing system and an identification information providing method capable of associating communication data between a transmission source, a business server, a Web server, an AP server, and a DB server.

  The present invention has been made to solve the above-described problems, and the identification information providing system according to the present invention is a client that is a transmission source that is transmitted and received in a business server that performs a predetermined business process, constituting a web system. An identification information providing system that assigns identification information to the communication data in order to associate each of the communication data transmitted from the communication data, and the communication data is serially arranged in the order of input to the business server. A data supply unit to be supplied (the virtual machine 111, the virtual machine 114, the virtual machine 211, the virtual machine 214, and the virtual machine 311 in the embodiment) and identification information for identifying the transmission source are assigned to the communication data in the order. Identification information adding unit (virtual machine 111, virtual machine 114, virtual machine 211, virtual machine in the embodiment) Singh 214, characterized in that it comprises a virtual machine 311).

  In the identification information providing system of the present invention, when the identification information adding unit outputs the communication data from the business server to another business server in the next stage, the identification information is given to the communication data. It is characterized by adding information.

  In the identification information providing system of the present invention, the data supply unit removes the identification information from the communication data when the communication data to which the identification information is added is supplied from another business server in the previous stage, It is characterized by being supplied to a business server.

  In the identification information provision system of the present invention, the data supply unit outputs the identification information excluded from the communication data to the business server to the identification information provision unit, and the identification information provision unit The identification information removed when the communication data is input from the communication data to the business server is added to the communication data from which the identification information is output from the business server.

  In the identification information providing system of the present invention, in the web system, each of the business servers is connected in series, and the identification information providing unit of the first-stage business server transmits the transmission source of the communication data. The identification information of each of the communication data is generated in correspondence with each of the original information.

  In the identification information providing system of the present invention, a plurality of each of the data supply unit and the identification information providing unit are provided, and the communication data supplied to the business server is load-distributed to each of the data supply units. The data supply unit and the identification information adding unit are provided as a set of cooperative processes for removing and adding the identification information, respectively.

  In the identification information providing system of the present invention, a plurality of the business servers are provided, and the communication data supplied from the data supply unit to the business servers is distributed and output to each of the business servers. A load balance unit that transmits the server identification information of the business server that has transmitted the communication data corresponding to the identification information output from the data supply unit to the identification information adding unit. It is characterized by doing.

  In the web system, the identification information providing system of the present invention is such that each of the business servers is connected in series, and the identification information providing unit of the first-stage business server includes the transmission source of the communication data, It has a correspondence table showing correspondence with identification information.

  The identification information providing system according to the present invention associates each of communication data transmitted from a client that is a transmission source, transmitted and received in a business server that performs a predetermined business process, which constitutes a web system. In the identification information providing system for assigning identification information to communication data, for the communication data received from the client, the identification information for identifying the transmission source of the communication data to the business server, An identification information adding unit (virtual machine 114C) that writes in an extended portion of the data area of the application layer in the communication data is provided.

  The identification information providing method of the present invention relates to each of communication data transmitted from a client as a transmission source and transmitted / received in a business server that performs a predetermined business process that constitutes a web system. A method for providing identification information to communication data, a data supply process in which the data supply unit supplies the communication data in series in the order of input to the business server, and an identification information adding unit Includes an identification information adding step of adding identification information for identifying the transmission source to the communication data in the order.

  According to this invention, without increasing the load on the system designer, it is possible to correspond to the transmission source of the communication data that is the client, and to add the identification information to each of the communication data, the Web that is the transmission source and the business server It is possible to provide an identification information providing system and an identification information providing method capable of associating communication data among a server, an AP server, and a DB server.

FIG. 1 is a diagram showing a configuration example of a web system using an identification information providing system according to a first embodiment of the present invention. 3 is a diagram illustrating a configuration example of an identification information table provided in a virtual machine 114. FIG. It is a sequence diagram explaining the addition of the identification information R of the identification information provision system 110 of the Web server 100 at the time of a request. It is a sequence diagram explaining the addition of the identification information R of the identification information provision system 210 of the AP server 200 at the time of a request. It is a sequence diagram explaining the addition of the identification information R of the identification information provision system 310 of the DB server 300. It is a sequence diagram explaining the addition of the identification information R of the identification information provision system 210 of the AP server 200 at the time of a response. It is a sequence diagram explaining the addition of the identification information R of the identification information provision system 110 of the Web server 100 at the time of a response. 6 is a diagram illustrating another configuration example of the identification information table provided in the virtual machine 114. FIG. It is a figure which shows the structural example of the web system using the identification information provision system by the 2nd Embodiment of this invention. It is a figure which shows the structural example of the web system using the identification information provision system by the 3rd Embodiment of this invention. It is a figure which shows the structural example of the web system using the identification information provision system by the 4th Embodiment of this invention.

<First Embodiment>
Hereinafter, a first embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing a configuration example of a web system using an identification information providing system according to a first embodiment of the present invention. In FIG. 1, the web system 1 in the present embodiment includes a web server 100, an AP server 200, a DB server 300, a log collection server 700, and a log collection database 800. In the present embodiment, each of the Web server 100, the AP server 200, and the DB server 300 is described as a physical machine server. A program having the above function may be installed.

Web system 1 responds to each request in Web server 100, AP server 200, and DB server 300 when client (client server) 400 transmits a request (communication data (packet) A) and is accessed. The predetermined processing is performed, and a response (communication data (packet) B) is returned to the client 400.
The log collection server 700 receives communication data (communication data A, communication data B) in each of the client 400, the Web server 100, the AP server 200, and the DB server 300 at each of the collection point 601, the collection point 602, and the collection point 603. Extracted as a log for security check in the web system 1.

  The Web server 100 includes an identification information providing system 110 (described later) configured with virtual machines, a physical NIC 131, a physical NIC 132, a physical NIC 133, a business virtual machine 151, and a virtual NIC. The business virtual machine 151 performs a predetermined business process and is a virtual machine (narrowly defined Web server) on the OS of the Web server 100. The business virtual machine 151 receives communication data A input from the identification information providing system 110 as, for example, HTTP on the Internet. A process of converting from the (hypertext transfer protocol) protocol to a protocol for communication between the Web server 100 and the AP server 200 is performed. Further, the business virtual machine 151 converts the communication data B input from the identification information adding system 110 from the protocol of communication between the Web server 100 and the AP server 200 to the HTTP (hypertext transfer protocol) protocol of the Internet. Perform the conversion process.

  The identification information providing system 110 adds and removes identification information to and from communication data (communication data A and communication data B) input / output on the Web server 100. The identification information providing system 110 includes a virtual machine 111, a virtual NIC 112, a virtual NIC 113, a virtual machine 114, a virtual NIC 115, a virtual NIC 116, a virtual bridge 117, and a virtual bridge 118.

  The virtual machine 111 is a virtual machine on the OS of the Web server 100, and communication information A from the client 400 supplied from the physical NIC 131 is sequentially placed in an internal queue and input from the physical NIC 131 during request processing. Are output to the business virtual machine 151 via the virtual NIC 112, the virtual bridge 118, and the virtual NIC 152. At this time, the virtual machine 111 outputs transmission source identification information for identifying the transmission source extracted from the communication data A to the virtual machine 116 via the virtual bridge 117. As the transmission source identification information, identification information for identifying the transmission source in the communication data A, for example, an IP (Internet Protocol) address, a port number, a user agent, etc. used by the client are used.

  At the time of response processing, the virtual machine 111 adds identification information R supplied from the virtual machine 114 to the communication data B input from the business virtual machine 151 via the virtual NIC 152, the virtual bridge 118, and the virtual NIC 112. Then, the data is output to the fake client 500, which is a dummy client used for processing the security incident, via the physical NIC 133. Further, the virtual machine 111 outputs the communication data B without adding the identification information R as a response to the client 400 accessed by the communication information A via the physical NIC 131. At this time, after outputting the communication data B to the client 400, the virtual machine 111 outputs an end signal indicating that the output has ended to the virtual machine 114 via the virtual NIC 113, the virtual bridge 117, and the virtual NIC 116. To do.

  The virtual machine 114 is a virtual machine on the OS of the Web server 100, and adds identification information R to the communication data A output from the business virtual machine 151 at the time of request processing. Here, the virtual machine 114 includes an identification information table therein, and detects the presence or absence of the identification information R generated for the transmission source identification information of the transmission source of the communication data A. When the virtual machine 114 detects the identification information R corresponding to the transmission source identification information of the transmission source in the identification information table, the virtual machine 114 adds the detected identification information R to the communication data A. On the other hand, when the identification information R corresponding to the transmission source identification information of the transmission source cannot be detected in the identification information table, the virtual machine 114 generates the identification information R to be added to the communication data R by a random number and adds it to the communication data A. To do. Then, the virtual machine 114 outputs the communication data A added with the identification information R to the AP server 200 via the virtual bridge 118 and the physical NIC 132. At this time, after outputting the communication data A to the AP server 200, the virtual machine 114 sends an end signal indicating that the output has ended via the virtual NIC 116, the virtual bridge 117, and the virtual NIC 113 to the virtual machine 111. Output.

  FIG. 2 is a diagram illustrating a configuration example of an identification information table provided in the virtual machine 114. In FIG. 2, the identification information table is provided with columns of transmission source identification information, identification information R, and last access date and time for each record. The virtual machine 114 extracts the transmission source identification information from the communication data A, searches the identification information table based on the extracted transmission source identification information, and detects the presence or absence of the same transmission source identification information. At this time, if the same transmission source identification information is detected, the virtual machine 114 assumes that the identification information R for this transmission source has already been generated and is paired with this transmission source identification information (in the same record). ) Read the identification information R, and add the read communication information R to the communication data A. On the other hand, if the same transmission source identification information is not detected, the virtual machine 114 generates new identification information R using a random number or the like as described above, assuming that the transmission source of the communication data A has accessed for the first time. The virtual machine 114 adds the generated communication information R to the communication data A, and newly writes the stored communication information R together with the transmission source identification information in the identification information table for storage.

  Returning to FIG. 1, the virtual machine 114 sequentially puts the communication data B input from the AP server 200 via the physical NIC 132, the virtual bridge 118, and the virtual NIC 115 in the internal queue during response processing, Are output to the business virtual machine 151 via the virtual NIC 115, the virtual bridge 118, and the virtual NIC 152 in the order of input from. At this time, when the virtual machine 114 takes out the communication data B from the internal queue, the virtual machine 114 removes the identification information R added to the communication data B. Then, the virtual machine 114 outputs the communication data B from which the identification information R has been removed to the business virtual machine 151 via the virtual NIC 115, the virtual bridge 118, and the virtual NIC 152. Here, the virtual machine 114 outputs the identification information R removed from the communication data B to the virtual machine 111 via the virtual NIC 216, the virtual bridge 117, and the virtual NIC 113.

  Returning to FIG. 1, the AP server 200 includes an identification information adding system 210 (described later) configured with virtual machines, a physical NIC 231, a physical NIC 232, a physical NIC 133, a business virtual machine 251, and a virtual NIC 252. The business virtual machine 251 is a virtual machine (narrowly defined AP server) on the OS of the AP server 200. The business virtual machine 251 executes predetermined business processing, and the communication data A input from the identification information providing system 210 is converted into, for example, a Web server. The communication protocol between the AP 100 and the AP server 200 is converted into a communication protocol between the AP server 200 and the DB server 300.

  The identification information providing system 210 adds and removes identification information to / from communication data (communication data A and communication data B) input / output in the AP server 200. The identification information providing system 210 includes a virtual machine 211, a virtual NIC 212, a virtual NIC 213, a virtual machine 214, a virtual NIC 215, a virtual NIC 216, a virtual bridge 217, and a virtual bridge 218.

  The virtual machine 211 is a virtual machine on the OS of the AP server 200, and at the time of request processing, communication information A from the Web server 100 supplied from the physical NIC 231 is sequentially placed in an internal queue and input from the physical NIC 231. In this order, the information is output to the business virtual machine 251 via the virtual NIC 212, the virtual bridge 218, and the virtual NIC 252. Here, when reading the physical data A from the queue, the virtual machine 211 removes the identification information R from the physical data A and outputs the physical data A from which the identification information R has been removed to the business virtual machine 251. To do. Further, the virtual machine 211 outputs the identification information R removed from the communication data A to the virtual machine 216 via the virtual bridge 217.

  Further, the virtual machine 211 receives the identification information R supplied from the virtual machine 214 to the communication data B input from the business virtual machine 251 via the virtual NIC 252, the virtual bridge 218, and the virtual NIC 212 during response processing. Is output to the Web server 100 via the physical NIC 231. At this time, after outputting the communication data B to the Web server 100, the virtual machine 211 sends an end signal indicating that the output has ended to the virtual machine 214 via the virtual NIC 213, the virtual bridge 217, and the virtual NIC 216. Output.

  The virtual machine 214 is a virtual machine on the OS of the AP server 200, and adds identification information R to the communication data A output from the business virtual machine 251 at the time of request processing. At this time, the virtual machine 214 uses the identification information R supplied from the virtual machine 211 as the identification information R added to the communication data A. Then, the virtual machine 214 outputs the communication data A with the identification information R added to the DB server 300 via the virtual NIC 212, the virtual bridge 218, and the physical NIC 232. At this time, after outputting the communication data A to the DB server 300, the virtual machine 214 sends an end signal indicating that the output has ended via the virtual NIC 216, the virtual bridge 217, and the virtual NIC 213 to the virtual machine 211. Output.

  In response processing, the virtual machine 214 sequentially enters communication data B input from the DBP server 300 via the physical NIC 232, virtual bridge 218, and virtual NIC 215 into an internal queue and is input from the physical NIC 132. In this order, the information is output to the business virtual machine 251 via the virtual NIC 215, the virtual bridge 218, and the virtual NIC 252. At this time, when the virtual machine 214 takes out the communication data B from the internal queue, the virtual machine 214 removes the identification information R added to the communication data B. Then, the virtual machine 214 outputs the communication data B from which the identification information R has been removed to the business virtual machine 251 via the virtual NIC 215, the virtual bridge 218, and the virtual NIC 252. Here, the virtual machine 214 outputs the identification information R removed from the communication data B to the virtual machine 211 via the virtual NIC 216, the virtual bridge 217, and the virtual NIC 213.

  The DB server 300 includes an identification information providing system 310 (described later) configured with virtual machines, a physical NIC 331, a business virtual machine 351, and a virtual NIC 352. The business virtual machine 351 is a virtual machine on the OS of the DB server 300, performs normal processing such as database search based on the communication data A input from the identification information adding system 310, and communication data B as a response. Is output to the AP server 200.

  The identification information adding system 310 adds and removes identification information to / from communication data (communication data A and communication data B) input / output in the DP server 300. The identification information providing system 310 includes a virtual machine 311, a virtual NIC 312, and a virtual bridge 318.

  The virtual machine 311 is a virtual machine (DB server in a narrow sense) on the OS of the DB server 300, performs predetermined business processing, and receives communication information A from the Web server 100 supplied from the physical NIC 331 at the time of request processing. Then, the data are sequentially placed in an internal queue, and output to the business virtual machine 351 in the order input from the physical NIC 331 via the virtual NIC 311, the virtual bridge 318, and the virtual NIC 352. Here, when reading the physical data A from the queue, the virtual machine 311 removes the identification information R from the physical data A, and outputs the physical data A from which the identification information R has been removed to the business virtual machine 351. To do. Further, the virtual machine 311 stores the identification information R removed from the communication data A therein.

  In response processing, the virtual machine 311 stores identification information R stored in the communication data B input from the business virtual machine 351 via the virtual NIC 352, the virtual bridge 318, and the virtual NIC 312. Is output to the AP server 200 via the physical NIC 331.

Next, using each of FIGS. 3 to 7, the identification information R is added and removed from the web system 1 using the identification information provision system 110, the identification information provision system 120, and the identification information provision system 310 of the present embodiment. The operation will be described.
FIG. 3 is a sequence diagram for explaining the addition of the identification information R of the identification information adding system 110 of the Web server 100 at the time of the request.

Step F101: Each of the clients 400 transmits the requested communication data A to the web system 1.
Then, the virtual machine 111 receives communication data A transmitted from each of the plurality of clients 400.

  Step F102: The virtual machine 111 sequentially accumulates the communication data A in the queue in the order supplied from the physical NIC 131.

Step F103: The virtual machine 111 determines whether or not the supplied communication data A is the first time. Here, the virtual machine 111 determines whether or not it is the first time based on whether or not the initial flag is set.
That is, when the initial flag is not set, the virtual machine 111 determines that it is the first time, and extracts one piece of communication data A from the queue.
On the other hand, when the initial flag is set, the virtual machine 111 determines that it is not the first time, and waits until an end signal is supplied from the virtual machine 114 indicating that the processing of the communication data A that has just been taken out from the queue has ended. To do. When the virtual machine 111 receives the end signal from the virtual machine 114, the virtual machine 111 extracts one piece of communication data A from the queue.
The above-described queue has a FIFO configuration, and communication data A is extracted in the order received by the Web server 100.

  Step F104: The virtual machine 111 extracts the transmission source identification information of the transmission source of the communication data A from the communication data A taken out from the queue.

  Step F105: The virtual machine 111 outputs the transmission source identification information extracted from the communication data A to the virtual machine 114.

  Step F106: After extracting the transmission source identification information, the virtual machine 111 outputs the communication data A to the business virtual machine 151.

  Step F107: The business virtual machine 151 executes processing of some functions of the web system 1. Here, for example, the business virtual machine 151 performs a process of converting the format of the communication data A packet from the HTTP protocol of the Internet to the protocol format of the communication between the Web server 100 and the AP server 200. .

  Step F108: The business virtual machine 151 ends the predetermined processing, and outputs the communication data A after the format conversion to the virtual machine 114.

  Step F109: The virtual machine 114 refers to the identification information table provided inside itself, and searches whether or not the same transmission source identification information as the transmission source identification information supplied from the virtual machine 111 exists.

  Step F110: When the same transmission source identification information as the transmission source identification information supplied from the virtual machine 111 is extracted in the identification information table, the virtual machine 114 identifies the identification information R corresponding to this transmission source identification information. Read from the information table. Then, the virtual machine 114 rewrites and changes the last access date and time in the identification information table to the date and time at the time of reading.

  On the other hand, when the same transmission source identification information as the transmission source identification information supplied from the virtual machine 111 is not extracted in the identification information table, the virtual machine 114 generates the identification information R for the transmission source identification information. Then, the virtual machine 114 writes the transmission source identification information and the generated identification information R in the identification information table. Further, the virtual machine 114 writes the last access date and time of the identification information table as the date and time when the writing process was performed.

  Step F111: The virtual machine 114 adds identification information R corresponding to the transmission source identification information of the communication data A to the communication data A.

  Step F112: The virtual machine 114 outputs the communication data A with the identification information R added to the AP server 200.

  Step F113: After outputting the communication data A to the AP server 200, the virtual machine 114 outputs an end signal indicating that the processing for the communication data A has ended to the virtual machine 111.

  FIG. 4 is a sequence diagram for explaining the addition of the identification information R of the identification information adding system 210 of the AP server 200 at the time of the request.

  Step F201: The virtual machine 211 receives the communication data A transmitted from the Web server 100.

  Step F202: The virtual machine 211 sequentially accumulates the communication data A in the queue in the order supplied from the physical NIC 231.

Step F203: The virtual machine 211 determines whether or not the supplied communication data A is the first time. Here, the virtual machine 211 determines whether or not it is the first time based on whether or not the initial flag is set.
That is, when the initial flag is not set, the virtual machine 211 determines that it is the first time and takes out one piece of communication data A from the queue.
On the other hand, when the initial flag is set, the virtual machine 211 determines that it is not the first time, and waits until an end signal is supplied from the virtual machine 214 indicating that the processing of the communication data A fetched from the queue immediately before is completed. To do. When the virtual machine 211 receives the end signal from the virtual machine 214, the virtual machine 211 extracts one piece of communication data A from the queue.
The queue described above is a FIFO configuration, similar to the configuration of the virtual machine 111, and communication data A is extracted in the order received by the AP server 200.

  Step F204: The virtual machine 211 removes the identification information R added by the identification information adding system 110 from the communication data A taken out from the queue.

  Step F205: The virtual machine 211 outputs the identification information R removed from the communication data A to the virtual machine 214.

  Step F206: The virtual machine 211 outputs the communication data A from which the identification information R has been removed to the business virtual machine 251.

  Step F207: The business virtual machine 251 executes processing of some functions of the web system 1. Here, for example, the business virtual machine 251 converts the communication data A packet format from the communication protocol between the Web server 100 and the AP server 200 to the communication between the AP server 200 and the DB server 300. Performs conversion to the protocol format.

  Step F208: The business virtual machine 251 ends the predetermined processing, and outputs the communication data A after the format conversion to the virtual machine 214.

  Step F209: The virtual machine 214 adds the identification information R supplied from the virtual machine 211 to the communication data A.

  Step F210: The virtual machine 214 outputs the communication data A with the identification information R added to the DB 300.

  Step F211: The virtual machine 214 outputs the communication data A to the DB server 300, and then outputs an end signal indicating that the processing for the communication data A has ended to the virtual machine 211.

  FIG. 5 is a sequence diagram for explaining the addition of the identification information R of the identification information adding system 310 of the DB server 300. FIG. 5A illustrates the removal of the identification information R of the identification information providing system 310 of the DB server 300 at the time of the request.

  Step F301: The virtual machine 311 receives the communication data A transmitted from the AP server 200.

  Step F302: The virtual machine 311 sequentially accumulates the communication data A in the queue in the order supplied from the physical NIC 331.

Step F303: The virtual machine 311 determines whether or not the supplied communication data A is the first time. Here, the virtual machine 311 determines whether or not it is the first time based on whether or not the initial flag is set.
That is, when the initial flag is not set, the virtual machine 311 determines that it is the first time, and takes out one piece of communication data A from the queue.
On the other hand, when the initial flag is set, the virtual machine 311 determines that it is not the first time, and the communication data B, which is a response to the communication data A taken out from the queue immediately before, is supplied from the business virtual machine 351, and this communication data Is output to the AP server 200, that is, whether or not the process for the immediately preceding communication data A has been completed, and waits until the process for the immediately preceding communication data A is completed. When the virtual machine 311 detects that the process for the immediately preceding communication data A has been completed, the virtual machine 311 extracts one communication data A from the queue.
The queue described above is a FIFO configuration, similar to the configuration of the virtual machine 111, and communication data A is extracted in the order received by the AP server 200.

  Step F304: The virtual machine 311 removes the identification information R from the communication data A, holds the removed identification information R inside, and outputs the communication data A from which the identification information R has been removed to the business virtual machine 351.

  Step F305: The business virtual machine 251 executes processing of some functions of the web system 1. Here, the business virtual machine 251 executes processing corresponding to a search request in a database (not shown) in the communication data A, for example.

  FIG. 5B illustrates the addition of the identification information R of the identification information adding system 310 of the DB server 300 at the time of response.

  Step F310: The business virtual machine 351 executes processing corresponding to the communication data A, and then outputs communication data B, which is a response to the communication data A, to the virtual machine 311.

  Step F311: The virtual machine 311 adds the identification information R stored therein to the communication data B supplied from the business virtual machine 351.

  Step F312: The virtual machine 311 outputs the communication data B with the identification information R added thereto to the AP server 200. At this time, the virtual machine 311 detects that the process for the communication data A has been completed.

  FIG. 6 is a sequence diagram for explaining the addition of the identification information R of the identification information adding system 210 of the AP server 200 at the time of response.

  Step F221: The virtual machine 214 receives the communication data B transmitted from the DB server 300.

  Step F222: The virtual machine 214 sequentially accumulates the communication data B in the queue in the order supplied from the physical NIC 232.

Step F223: The virtual machine 214 determines whether or not the supplied communication data B is the first time. Here, the virtual machine 214 determines whether or not it is the first time based on whether or not the initial flag is set.
That is, when the initial flag is not set, the virtual machine 214 determines that it is the first time, and takes out one communication data B from the queue.
On the other hand, if the initial flag is set, the virtual machine 214 determines that it is not the first time, and waits until an end signal is supplied from the virtual machine 211 indicating that processing of the communication data B fetched from the queue immediately before has ended. To do. When the virtual machine 214 receives the end signal from the virtual machine 211, the virtual machine 214 extracts one piece of communication data B from the queue.
The queue described above is a FIFO configuration, similar to the configuration of the virtual machine 111, and the communication data B is extracted in the order received by the AP server 200.

  Step F224: The virtual machine 214 removes the identification information R added by the identification information adding system 310 from the communication data B extracted from the queue.

  Step F225: The virtual machine 214 outputs the communication data B from which the identification information R has been removed to the business virtual machine 251.

  Step F226: The virtual machine 214 outputs the identification information R removed from the communication data B to the virtual machine 211.

  Step F227: The business virtual machine 251 executes processing of some functions of the web system 1. Here, the business virtual machine 251 converts the communication data B packet format from the communication protocol between the AP server 200 and the DB server 300 to the communication protocol between the Web server 100 and the AP server 200, for example. Performs conversion to the protocol format.

  Step F228: The business virtual machine 251 ends the predetermined processing, and outputs the communication data B after the format conversion to the virtual machine 211.

  Step F229: The virtual machine 211 adds the identification information R supplied from the virtual machine 214 to the communication data B.

  Step F230: The virtual machine 211 outputs the communication data B with the identification information R added to the Web server 100.

  Step F231: The virtual machine 211 outputs communication data B to the Web server 100, and then outputs to the virtual machine 214 an end signal indicating that the processing on the communication data B has ended.

  FIG. 7 is a sequence diagram for explaining the addition of the identification information R of the identification information adding system 110 of the Web server 100 at the time of response.

  Step F121: The virtual machine 114 receives the communication data B transmitted from the AP server 200.

  Step F122: The virtual machine 114 sequentially accumulates the communication data B in the queue in the order supplied from the physical NIC 132.

Step F123: The virtual machine 114 determines whether or not the supplied communication data B is the first time. Here, the virtual machine 114 determines whether or not it is the first time based on whether or not the initial flag is set.
That is, when the initial flag is not set, the virtual machine 114 determines that it is the first time and takes out one communication data B from the queue.
On the other hand, if the initial flag is set, the virtual machine 114 determines that it is not the first time, and waits until an end signal is supplied from the virtual machine 111 indicating that processing of the communication data B fetched from the queue immediately before has ended. To do. When the virtual machine 114 receives the end signal from the virtual machine 111, the virtual machine 114 extracts one piece of communication data B from the queue.
The above-described queue has a FIFO configuration, and communication data B is extracted in the order received by the Web server 100.

  Step F124: The virtual machine 114 removes the identification information B from the communication data B taken out from the queue.

  Step F125: After removing the identification information B, the virtual machine 114 outputs the communication data B to the business virtual machine 151.

  Step F126: The virtual machine 114 outputs the identification information R extracted from the communication data B to the virtual machine 111.

  Step F127: The business virtual machine 151 executes processing of some functions of the web system 1. Here, for example, the business virtual machine 151 performs a process of converting the format of the communication data B packet from the protocol of communication between the Web server 100 and the AP server 200 to the format of the HTTP protocol of the Internet. .

  Step F128: The business virtual machine 151 finishes the predetermined processing, and outputs the communication data B after the format conversion to the virtual machine 111.

  Step F129: The virtual machine 111 adds the identification information R supplied from the virtual machine 114 to the communication data B supplied from the business virtual machine 151.

  Step F130: The virtual machine 111 outputs the communication data B with the identification information R added thereto to the fake client 500 via the physical NIC 133.

  Step F131: The virtual machine 111 outputs the communication data B to which the identification information R is not added to the client 400 via the physical NIC 131.

  Step F132: The virtual machine 111 outputs the communication data B to which the identification information R is added (communication data B from which the identification information R is not removed) to the AP server 200.

  Step F133: After outputting the communication data B to each of the client 400 and the fake client 500, the virtual machine 111 outputs an end signal indicating that the processing for the communication data B has ended to the virtual machine 114.

In the configuration described above, the log collection server 700 collects communication information (communication information A or communication information B) at each of the collection point 601, the collection point 602, and the collection point 603, and collects the log corresponding to the collected date and time. Accumulate in database 800.
When the log collection server 700 investigates the security incident, the log collection server 700 refers to the identification information table of the virtual machine 114 and adds it to the problematic communication data in the history of communication data accumulated in the log collection database 800. The problem is analyzed by performing communication data association and transmission source identification information detection processing from the identification information R.

  As described above, according to the present embodiment, by adding identification information R to communication data transmitted / received among the client 400, the Web server 100, the AP server 200, and the DB server 300, the Web system The communication data transmitted and received in 1 can be associated with each other by this identification information R, and each communication data is set as a log (log B), and a security incident is easily investigated against an attack on the system. be able to.

  Further, according to the present embodiment, the fake client 500 is provided in the response to the request from the client, the identification information R is not added to the communication data B of the response from the Web server 100 to the client 400, and the fake client Since identification information R is added to communication data B for 500, correspondence for collecting logs in transmission / reception of communication data A and communication data B between servers of client 400 without being noticed by an attacker Can be attached.

  Further, according to the present embodiment, in each of the Web server 100, the AP server 200, and the DB server 300, the identification information providing system 110, the identification information providing system 210, and the identification information providing system 310 each receive the identification information R at the time of input. Since the identification information R is added at the time of removal and output, the business virtual machine 151, the business virtual machine 251 and the business virtual machine 351 are supplied with the same communication data as before and need to be aware of the identification information R. No. For this reason, according to the present embodiment, in designing each of the business virtual machine 151, the business virtual machine 251, and the business virtual machine 351, it is not necessary to deal with the identification information R, and the system designer increases the burden. This makes it possible to design a business virtual machine without causing it to occur.

Moreover, in this embodiment, you may perform the process which changes the identification information R corresponding to transmission origin identification information for every predetermined period.
If the user of the IP address that is the source information is changed, or if the IP address is used by impersonation, the security information is not changed during the period when the IP address was any user unless the identification information R is changed. Since it is impossible to distinguish whether a problem has occurred, the identification information R is changed every predetermined period (for example, one month) or when a predetermined period (for example, one month) has passed since the last access date and time. It is also good.

  FIG. 8 is a diagram illustrating another configuration example of the identification information table provided in the virtual machine 114. In FIG. 8, the identification information table as another configuration example is provided with a valid flag column for each record, in addition to each column of the transmission source identification information, the identification information R, and the last access date and time. The valid flag indicates whether or not the identification information R is valid. When the flag is set (data “1” is described), it indicates that the identification information R is valid and the flag is not set (data “ 0 ”) indicates that the identification information R is not valid (invalid).

When the identification information R is changed in a predetermined period, the following processing is performed. When the identification information R is changed in a predetermined period, the last access date / time column is changed to the identification information R creation date / time. The identification information R creation date and time indicates the date and time when the identification information R was created.
When the transmission source identification information is supplied from the virtual machine 111 at the time of the request, the virtual machine 114 searches the identification information table for the transmission source identification information from the record of the identification information R in which the valid flag is set. Then, the virtual machine 114 obtains the elapsed time from the created identification information R creation date and time of the transmission source identification information.
At this time, if the elapsed time does not exceed the predetermined period, the virtual machine 114 performs the process of adding the identification information R already described.

  On the other hand, when the elapsed time exceeds a predetermined period, the virtual machine 114 changes the valid flag of the identification information R in the information table from a standing state (valid) to a standing state (invalid). Then, the virtual machine 114 creates new identification information R for the transmission source identification information of the identification information R that has become invalid. The virtual machine 114 associates the newly created identification information R with the transmission source identification information, writes it in the identification information table, writes the current date and time with respect to the creation date of the identification information R, and sets the valid flag to a valid state. . Thereby, the virtual machine 114 performs the process of adding the identification information R already described.

In a case where the identification information R is changed when a predetermined predetermined period has elapsed since the last access date and time, the following processing is performed.
When the transmission source identification information is supplied from the virtual machine 111 at the time of the request, the virtual machine 114 searches the identification information table for the transmission source identification information from the record of the identification information R in which the valid flag is set. Then, the virtual machine 114 obtains an elapsed time from the last access date and time of the searched source identification information.
At this time, if the elapsed time does not exceed the predetermined period, the virtual machine 114 performs the process of adding the identification information R already described.

  On the other hand, when the elapsed time exceeds the predetermined period, the virtual machine 114 changes the valid state of the identification information R in the information table from the valid state. Then, the virtual machine 114 creates new identification information R for the transmission source identification information of the identification information R that has become invalid. The virtual machine 114 associates the newly created identification information R with the transmission source identification information, writes it in the identification information table, writes the current date and time with respect to the last access date and time, and sets the valid flag to a valid state. Thereby, the virtual machine 114 performs the process of adding the identification information R already described.

  With the configuration described above, according to the present embodiment, if the user of the IP address that is the source information is changed or if the IP address is used by impersonation, the IP address must be changed without changing the identification information R. It is possible to distinguish which user has had a security problem during the period.

In addition, each of the identification information providing system 110 and the business virtual machine 151, the identification information providing system 210 and the business virtual machine 251, and the identification information providing system 310 and the business virtual machine 351 described above are connected to the Web server 100, A plurality of AP servers 200 and DB servers 300 may be provided in parallel. In the case of this configuration, a load balance unit (load) is provided between each physical NIC of the Web server 100, the AP server 200, and the DB server 300, and each of the identification information adding system 110, the identification information adding system 210, and the identification information adding system 310. A balancer is provided, and load distribution is performed for each set of identification information providing system and business virtual machine.
Thereby, the throughput of processing in the web system can be improved in correspondence with the number of sets of the identification information providing system and the business virtual machine.

<Second Embodiment>
The second embodiment of the present invention will be described below with reference to the drawings. FIG. 9 is a diagram showing a configuration example of a web system using the identification information providing system according to the second embodiment of the present invention. In the web system 1A of FIG. 9, the same reference numerals are given to the same configurations as those of the first embodiment shown in FIG. 1, and the description thereof is omitted. Hereinafter, in the second embodiment, configurations and operations different from those in the first embodiment will be described.

As a configuration different from the first embodiment, in the identification information providing system 110A of the Web server 100A, virtual machines 111_1 to 111_n having the same configuration as the virtual machine 111 are provided, and the configuration similar to the virtual machine 114 is provided. A certain virtual machine 114_1 to virtual machine 114_n are provided.
A load balancer 160 is connected to each of the virtual machines 111_1 to 111_n. The load balancer 160 distributes the load of the communication data A supplied from each of the clients 400, and supplies each of the communication data A from the virtual machine 111_1 to each of the virtual machines 111_n as an equal load.

Here, each of the virtual machine 111_1 to the virtual machine 111_n is similar to the virtual machine 114_1, the virtual machine 114_2,..., The virtual machine 114_n, and the combination of the processes of the virtual machine 111 and the virtual machine 114 in the first embodiment. Is formed.
Further, the identification information table provided in the virtual machine 114 in the first embodiment is the same as the identification information table used in common by the virtual machines 114_1 to 114_n in the second embodiment. To the virtual machine 114_n.

  Each of the virtual machine 114_1 to the virtual machine 114_n indicates which of the virtual NIC 111_1, the virtual NIC 112_2, and the virtual NIC 112_n the communication data A output from the business virtual machine 151 is supplied from the virtual machine 111_1 to the virtual machine 111_n. Judgment by Similarly, each of the virtual machines 111_1 to 111_n determines whether the communication data B output from the business virtual machine 151 is supplied from the virtual machine 114_1 to the virtual machine 114_n by the virtual NIC 115_1, the virtual NIC 115_2, or the virtual NIC 115_n. The IP address is determined.

  Each of the virtual machines 111_1 to 111_n adds the IP addresses of the virtual NIC 112_1, the virtual NIC 112_2, and the virtual NIC 2_n to the transmission source identification information extracted from the communication data A via the virtual bridge 117, and the virtual machine 114_1. To all of the virtual machines 114_n. Each of the virtual machines 114_1 to 114_n determines whether the communication data A is processed by each of the virtual machines 111_1 to 111_n based on the IP address of the virtual NIC received together with the transmission source identification information.

Each of the virtual machines 111_1 to 111_n transmits transmission source identification information via the virtual NIC 113_1, the virtual NIC 113_2,..., The virtual NIC 113_n, the virtual bridge 117, the virtual NIC 116_1, the virtual NIC 116_2,. Similarly, each of the virtual machines 114_1 to 114_n transmits the identification information R via the virtual NIC 116_1, the virtual NIC 116_2, ..., the virtual NIC 116_n, the virtual bridge 117, the virtual NIC 113_1, the virtual NIC 113_2, ..., the virtual NIC 113_n. Do.
Each of the virtual machines 114_1 to 114_n performs transmission of the communication data A to the physical NIC 132 and reception of the communication data B through the virtual NIC 115_1, the virtual NIC 115_2,..., The virtual NIC 115_n, respectively.

In the identification information provision system 210A of the AP server 200A, a virtual machine 211_1 having a configuration similar to that of the virtual machine 211 is provided, and a virtual machine 214_n having a configuration similar to the virtual machine 214 is provided. ing.
A load balancer 260 is connected to each of the virtual machines 211_1 to 211_n. The load balancer 260 distributes the load of the communication data A supplied from the Web server 100 and supplies each of the communication data A from the virtual machine 211_1 to the virtual machine 211_n as an equal load.
Other configurations are the same as those of the Web server 100A.

Further, in the identification information providing system 310A of the DB server 300A, virtual machines 311_1 to 311_n having the same configuration as the virtual machine 311 are provided.
A load balancer 360 is connected to each of the virtual machines 311_1 to 311_n. The load balancer 360 distributes the load of the communication data A supplied from the AP server 200, and supplies each of the communication data A from the virtual machine 311_1 to the virtual machine 311_n as an equal load.
Other configurations are the same as those of the Web server 100A.

With the configuration described above, according to the present embodiment, the load balancing of the communication data A input to each of the Web server 100A, the AP server 200A, and the DB server 300A is performed by the load balancer, and the virtual machines 111_1 to 111_n Since each virtual machine 211_1 to each of the virtual machines 211_n and each of the virtual machines 311_1 to 311_n are performed, all the supplied communication data is transferred to one virtual machine without load balancing. 111, the virtual machine 211, and the virtual machine 311 can improve the throughput of the web system 1A as compared to the web system 1 of the first embodiment configured to process in series.
In the configuration described above, the log collection server (not shown) collects communication information (communication information A or communication information B) at each of the collection point 601, the collection point 602, and the collection point 603, and at the date and time when the collection is performed. Correspondingly, it is accumulated in a log collection database (not shown).

<Third Embodiment>
The third embodiment of the present invention will be described below with reference to the drawings. FIG. 10 is a diagram showing a configuration example of a web system using the identification information providing system according to the third embodiment of the present invention. In the web system 1B of FIG. 10, the same components as those of the first embodiment shown in FIG. Hereinafter, in the third embodiment, configurations and operations different from those in the first embodiment will be described.

As a configuration different from the first embodiment, the business virtual machine 151_1 to the business virtual machine 151_n having the same configuration as the business virtual machine 151 are provided in the identification information providing system 110B of the Web server 100B.
A load balance unit 160 is connected to each of the business virtual machine 151_1 to the business virtual machine 151_n. The load balancer 160 distributes the load of the communication data A supplied from the virtual machine 111, and supplies each of the communication data A from the business virtual machine 151_1 to each of the virtual machines 151_n as an equal load.

Here, each of the business virtual machine 151_1 to the business virtual machine 151_n is a virtual machine that performs the same processing as the business virtual machine 151 in the first embodiment.
The business virtual machine 151_1 to the business virtual machine 151_n respectively communicate with the load balancer 160 and the virtual machine 114 via the virtual NIC 152_1, the virtual NIC 152_2, ..., the virtual NIC 152_n (communication data A, communication data B). ).

The virtual machine 111 receives the IP address of the business virtual machine to which the communication data A is output from the load balancer 160 as information as to which of the business virtual machines 151_1 has output the communication data A from the business virtual machine 151_1. Receive. The virtual machine 111 sends the IP address of any one of the business virtual machine 151_1 to the business virtual machine 151_n that is the output destination of the communication data A together with the transmission source identification information of the communication data A via the virtual bridge 117. Supply to machine 114.
Thereby, the virtual machine 114 can identify from which source identification information the communication data A output from each of the business virtual machine 151_1 to the business virtual machine 151_n is supplied. That is, it becomes possible to associate the communication data A input from the business virtual machine 151_1 to each of the business virtual machines 151_n with the communication data A output from each, and output the communication data A and the transmission source identification. Correspondence with information can be easily obtained.

Further, in the identification information providing system 210B of the AP server 200B, business virtual machines 251_1 to business virtual machines 251_n having the same configuration as the business virtual machine 251 are provided.
A load balancer 260 is connected to each of the business virtual machine 251_1 to the business virtual machine 251_n. The load balancer 260 distributes the load of the communication data A supplied from the virtual machine 211, and supplies each of the communication data A from the business virtual machine 251_1 to each of the virtual machines 251_n as an equal load.

Here, each of the business virtual machine 251_1 to the business virtual machine 251_n is a virtual machine that performs the same processing as the business virtual machine 151 in the first embodiment.
Each of the business virtual machine 251_1 to the business virtual machine 251_n communicates with the load balancer 260 and the virtual machine 214 via the virtual NIC 252_1, virtual NIC 252_2, ..., virtual NIC 252_n (communication data A, communication data B). ).
Other configurations are the same as those of the Web server 100B.

In the identification information providing system 310B of the DB server 300B, business virtual machines 351_1 to 351_n having the same configuration as the business virtual machine 351 are provided.
A load balancer 260 is connected to each of the business virtual machine 351_1 to the business virtual machine 251_n. The load balancer 360 distributes the load of the communication data A supplied from the virtual machine 311 and supplies each communication data A from the business virtual machine 351_1 to the business virtual machine 351_n as an equal load.

Here, each of the business virtual machine 351_1 to the business virtual machine 351_n is a virtual machine that performs the same processing as the business virtual machine 351 in the first embodiment.
The business virtual machine 351_1 to the business virtual machine 351_n respectively communicate with the load balancer 360 and the virtual machine 314 via the virtual NIC 352_1, the virtual NIC 352_2, ..., the virtual NIC 352_n (communication data A, communication data B). ).
Other configurations are the same as those of the Web server 100B.

With the above-described configuration, according to the present embodiment, each of the communication data A input to each of the Web server 100B, the AP server 200B, and the DB server 300B is converted into the business virtual between the virtual machine 111 and the virtual machine 211. Since load balancing is performed by the load balancing unit from the machine 151_1 to the business virtual machine 151_n, all the supplied communication data is serialized in one virtual machine 111, virtual machine 211, and virtual machine 311 without performing load balancing. The throughput of the web system 1B can be improved as compared with the web system 1 according to the first embodiment configured to perform the above processing.
In the configuration described above, the log collection server (not shown) collects communication information (communication information A or communication information B) at each of the collection point 601, the collection point 602, and the collection point 603, and at the date and time when the collection is performed. Correspondingly, it is accumulated in a log collection database (not shown).

In the present embodiment, in each of the Web server 100B, the AP server 200B, and the DB server 300B, the business virtual machine 151_1 to the business virtual machine 151_n, the business virtual machine 251_1 to the business virtual machine 251_n, and the business The virtual machine 351 to the business virtual machine 251_n are provided, and each server is provided with a plurality of business virtual machines. However, a configuration in which the second embodiment described above including a plurality of virtual machines in each server and the present embodiment including a plurality of business virtual machines in each server may be combined.
That is, the Web server 100B may include a virtual machine 111_1 to a virtual machine 111_m, a business virtual machine 151_1 to a business virtual machine 151_n, and a virtual machine 114_1 to a virtual machine 114_m. Similarly, the AP server 200B may include a virtual machine 211_1 to a virtual machine 211_m, a business virtual machine 251_2 to a business virtual machine 251_n, and a virtual machine 214_1 to a virtual machine 214_m. The DB server 300B may include a virtual machine 311_1 to a virtual machine 311_m and a business virtual machine 351_2 to a business virtual machine 351_n. As described above, even in a configuration in which a plurality of virtual machines and business virtual machines each having a different or the same number are provided in parallel in each server, a load balance unit is provided, and the second embodiment or the third embodiment is provided. Similar to the embodiment, the communication data load is distributed to the virtual machine or the business virtual machine.

<Fourth Embodiment>
Hereinafter, a fourth embodiment of the present invention will be described with reference to the drawings. FIG. 11 is a diagram showing a configuration example of a web system using an identification information providing system according to the fourth embodiment of the present invention. In the web system 1C of FIG. 11, the same reference numerals are given to the same configurations as those of the first embodiment shown in FIG. 1, and the description thereof is omitted. Hereinafter, in the fourth embodiment, configurations and operations different from those in the first embodiment will be described.

The configuration different from the first embodiment is that the identification information providing system 110C is provided only for the Web server 100C, and the identification information system is not provided for each of the AP server 200C and the DB server 300C.
The virtual machine 114C in the identification information providing system 110C gives the identification information R to the communication information A. However, in the packet that is communication data, the virtual machine 151 for business, the virtual machine 251 for business, and the virtual machine 351 for business use 351. In each process, identification information R is embedded in a predetermined area that is not removed or does not affect the process. This predetermined area is, for example, an extended data area of an application layer of TCP / IP (Transmission Control Protocol / Internet Protocol). Other processes such as generation of identification information are the same as those of the virtual machine 114 in the first embodiment.
The configuration of the identification information table in the identification information providing system 110C is the same as that in the first embodiment.

The virtual machine 111 outputs the communication data B that does not remove the identification information R embedded in the predetermined area to the fake client 500 and the communication data B from which the identification information R embedded in the predetermined area is removed. Output for.
In the configuration described above, the log collection server (not shown) collects communication information (communication information A or communication information B) at each of the collection point 601, the collection point 602, and the collection point 603, and at the date and time when the collection is performed. Correspondingly, it is accumulated in a log collection database (not shown).

Thereby, according to this embodiment, since it is not necessary to perform the process of addition and removal of identification information R in each of the AP server 200C and the DB server, the processing time can be shortened and the throughput is improved. be able to.
In addition, according to the present embodiment, since only the identification information providing system 110C needs to be designed and implemented, the working time and cost are reduced compared to each of the first to third embodiments. be able to.

  In addition, a program for realizing a function relating to addition and removal of identification information R in the identification information providing system in each of FIGS. 1, 9, 10 and 11 is recorded on a computer-readable recording medium. Processing for adding and removing identification information R may be performed by causing a computer system to read and execute a program recorded on a medium. Here, the “computer system” includes an OS and hardware such as peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Furthermore, the “computer-readable recording medium” dynamically holds a program for a short time like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. In this case, a volatile memory in a computer system serving as a server or a client in that case, and a program that holds a program for a certain period of time are also included. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design and the like within a scope not departing from the gist of the present invention.

1, 1A, 1B, 1C ... Web system 100, 100A, 100B, 100C ... Web server 110, 110A, 110B, 110C, 210A, 210B, 310A, 310B ... Identification information providing system 111, 111_1, 111_1, 111_n, 114, 114_1, 114_1, 114_n, 114C, 211, 211_1, 211_1, 211_n, 214, 214_1, 214_1, 214_n, 311, 311_1, 311_1, 311_n, 314, 314_1, 314_1, 314_n ... virtual machines 112, 113, 115, 116, 152,212,213,215,216,152,312,352 ... virtual NIC
117, 118, 217, 218, 318 ... virtual bridge 160, 260, 360 ... load balance unit 151, 151_1, 151_1, 151_n, 251, 251_1, 251_1, 251_n, 351_1, 351_1, 351_n ... business virtual machine 200, 200A , 200B, 200C ... AP server 300, 300A, 300B, 300C ... DB server 400 ... client 500 ... fake client 700 ... log collection server 800 ... log collection database

Claims (10)

Identification information is given to the communication data in order to associate each of the communication data transmitted from the client that is the transmission source that is transmitted and received in the business server that performs the predetermined business processing that constitutes the web system. Identification information providing system
A data supply unit for supplying the communication data in series in the order of input to the business server;
An identification information providing system comprising: an identification information providing unit that provides identification information for identifying the transmission source to the communication data in the order. The identification information adding unit adds the identification information to the communication data when the communication data is output from the business server to another business server in the next stage. The identification information provision system according to claim 1. When the communication data to which the identification information is added is supplied from another business server in the previous stage, the data supply unit removes the identification information from the communication data and supplies the communication data to the business server. The identification information providing system according to claim 1 or 2. The data supply unit outputs the identification information removed from the communication data to the business server to the identification information adding unit;
The identification information adding unit adds the identification information removed when the identification data is input from the communication data to the business server to the communication data from which the identification information is output. The identification information provision system according to claim 3. In the web system, each of the business servers is connected in series,
The identification information adding unit of the first-stage business server generates the identification information for each of the communication data in association with each of the transmission source information indicating the transmission source of the communication data. The identification information providing system described in 1. A plurality of each of the data supply unit and the identification information providing unit are provided,
The communication data supplied to the business server further includes a load balance unit that outputs the data by distributing the load to each of the data supply units,
The said data supply part and the said identification information provision part are each provided as a group of the cooperation process which removes and adds the said identification information. The Claim 1 characterized by the above-mentioned. Identification information grant system. A plurality of the business servers are provided,
The communication data supplied from the data supply unit to the business server is further provided with a load balance unit that outputs a load distributed to each of the business servers,
The load balance unit transmits server identification information of a business server that has transmitted the communication data corresponding to the identification information output from the data supply unit to the identification information adding unit. The identification information provision system as described in any one of Claims 1-5. In the web system, each of the business servers is connected in series,
The identification information adding unit of the first-stage business server has a correspondence table indicating correspondence between the transmission source of the communication data and the identification information. The identification information providing system described in 1. Identification information is given to the communication data in order to associate each of the communication data transmitted from the client that is the transmission source that is transmitted and received in the business server that performs the predetermined business processing that constitutes the web system. Identification information providing system
Identification information for writing the communication data received from the client to the business server in the extended portion of the data area of the application layer in the communication data with the identification information for identifying the transmission source of the communication data The identification information provision system characterized by including a part. Identification information is given to the communication data in order to associate each of the communication data transmitted from the client that is the transmission source that is transmitted and received in the business server that performs the predetermined business processing that constitutes the web system. Identification information providing method
A data supply process in which the data supply unit supplies the communication data in series in the order of input to the business server;
An identification information adding method comprising: an identification information adding step in which an identification information adding unit assigns identification information for identifying the transmission source to the communication data in the order.

Images