GB2370660A

GB2370660A - File sharing

Info

Publication number: GB2370660A
Application number: GB0102080A
Authority: GB
Inventors: Matthew Peter Cobby; David Cooper; Ian Murray Harris
Original assignee: BRIGHT STATION PLC
Current assignee: BRIGHT STATION PLC
Priority date: 2000-10-06
Filing date: 2001-01-26
Publication date: 2002-07-03
Also published as: GB0102013D0; GB2370447A; GB0102080D0; GB0024535D0; GB2370447A9

Abstract

Files are shared between a first data processing station 103 and a second data processing station 104 over a network. The network facilitates the establishment of connections between processing stations and has a server 101 and a third processing station 112 connected thereto. The first processing station attempts to read a file from the second processing station. The second processing station includes protection software eg a fire wall 215 that prevents the first processing station from reading data therefrom. The first processing station requests 233 details of the third processing station from the server. The third processing station is known to the second processing station. The first processing station requests the server to instruct the second processing station to perform a data transfer 235 from the second processing station to the third processing station, thereby allowing the first processing station to connect directly 236, 237 to the third processing station.

Description

File Sharing Background of the Invention

1. Field of the Invention

The present invention relates to file sharing apparatus and a method of sharing files over a network. The invention is particularly concerned with the accessing of files from data processing systems that include programs being executed to provide protection from unauthorized access, often identified by the designation "firewalls".

2. Description of the Related Art

Physical peer-to-peer networks are known in which a plurality of computers or other data processing devices are mutually connected by physical transmission media. Logical peer-to-peer networks may be established within a much wider physical environment, such as the Internet.

With a network of this type established, a plurality of computers have storage devices, typically hard disk drives, that store files of data that may be accessed across the network.

Within peer-to-peer networks of this type, it is known to perform 20 searching operations in order to identify files of interest. Although physically connected to the Internet, the flow of data will depend upon connections established by software. Thus, for a communication to take place from a first system A to a second system B. A must be aware of the address of B and B must then be aware of the address of A. When an identification of this type c has been established, along with appropriate protocols for effecting data transfer, the stations A and B may be considered as being "connected".

Thus, as used herein, a connection refers to a logical mutual acknowledgement along with appropriate transmission protocols thereby allowing a direct communication of data to established through this connection over the appropriate physical hardware.

A connection may have been established between A and B. and a similar connection may have been established between B and C. A now conducts a search via its connection to B. Files of interest are not identified on B but B. via its connection to C, is capable of extending the search to the files available at C. If a file of interest is now found on C, an identification to to this effect is conveyed back to B and B in turn conveys this indication back to A. If A wishes to obtain a copy of the data held on C, the information may be pushed back to A via the BC, AB connections. Alternatively and preferably, the location of C is identified to A and then A attempts to connect with C directly. 5 The number of connections between a source of information, identified as C above and a destination for the information, identified as A above may be significantly longer than as identified above. Thus, as an alternative to a single intermediate node, identified as B above, it could be possible for there to be say, twelve interconnecting modes between A and C. Under these 20 circumstances, the pushing of data back through each individual node would incur significantly more overhead than a direct connection between A and C. When A makes a request for data to be supplied from C to it directly, C is not aware of the presence of A. This creates a problem if C includes protection software such as a firewall. With firewall software in place, an 2 attempt made by A to contact C directly would be refused by C and A would not be in a position to make the connection. Under these circumstances, the data must be pushed back through the chain thereby significantly reducing

overall operating efficiency.

It should be understood that C has agreed to allow other members of the peer-to-peer network to gain access to particular files. The firewall is present to stop any unauthorized access, which does not include an access 5 made by A. However, because A is not known to C, the access is treated as being unauthorized while in actual fact the access should be authorised and A should be able to gain access to the files. From a security perspective, A still gains access to the files but through the pushing process using the other nodes. The firewall is not therefore improving security but merely reducing lo efficiency.

Brief Summary of the Invention

According to an aspect of the present invention there is provided apparatus as defined by claim 1.

Brief Description of the Several Views of the Drawings

Figure 1 shows an environment for connecting apparatus via the Internet; Figure 2 shows essential constituents of a preferred embodiment; 20 Figure 3 shows the physical structure of the application server shown in Figure 1; Figure 4 shows a map of instructions stored within the system memory of the apparatus shown in Figure 3; Figure 5 shows a summary of the database application identified in

25 Figure 4; Figure 6 shows procedures for the provision of assistance with respect to the presence of firewalls, identified in Figure 5;

Figure 7 shows the physical structure of a user station; Figure 8 shows a map of instructions stored within the system memory of the user station shown in Figure 7; Figure 9 shows operations performed by a typical member station; Figure 10 shows procedures for initiating a search, identified in Figure 9; Figure 11 shows procedures for the downloading of data, identified in Figure 10; Figure 12 shows procedures executed by a requesting destination; lo Figure 13 shows procedures executed by a source station; Figure 14 shows an example of data storage; Figure 15 details the nature of a text file identified in Figure 14; Figure 16 shows procedures for responding to an external search request; Figures 17 to 22 shows schematic representations of procedures performed within the environment to assist data transfers in the presence of fireballs. Best Mode for Carrying Out the Invention

20 An environment in which network apparatus may be configured to establish connections between processing stations by use of the Internet is shown in Figure 1. An application server 101 facilitates the establishment of virtual peer-to-peer networks over the Internet 102. A plurality of conventional PC computer terminals 103 to 113 are connected to the s Internet and once a peer-to-peer network has been established, a user's relationship of the application server becomes relatively minimal. Thus, primarily, the server is configured to establish a network in which programs

executed by individual machines allow a group of users to communicate usually with a specified topic of interest. The group, having a particular shared interest, may be considered as a sect and the interlinking terminals with their virtual peer-to-peer network may be identified as a sectranet.

5 The server therefore provides applications to users allowing them to form new sectranets (referred to as creators) or allowing them to join existing sectranets. It is also possible for different types of members to join the sectranets and the level of access may also be modified.

Each user of the sectranet would have particular communication to attributes. Primarily, these would define the user's connection speed to the Internet and the number of files available for shared access. In addition to allowing the establishment of sectranets, the server 101 also facilitates the enhancement or optimization of the network. In particular, it includes monitoring devices to monitor information flows such that databases may 5 be populated to assist with enhancement of the database. Furthermore, optimization routines are supplied to each user such that each user may over a period of time attempt to optimise its connections to other users.

Thus, a network is established in which each user has a predetermined number of direct connections to other users while high bandwidth high 20 volume users will tend to form direct links with other high volume high bandwidth users thereby enhancing overall functionality.

Thus, although the server has minimal interest to the operation of the peer-to-peer network, reference is occasionally made back to the server to provide new connection details so as to assist with this enhancement 25 process.

A further problem that arises, as previously identified, concerns gaining access to firewalls. In a preferred embodiment, each

communicating computer includes a searching application which allows it to search for files of interest. In addition to searching shared files of directly connected equipment, the searching process also searches for files held on indirectly connected machines. Once identified, a temporary connection 5 would then tend to be made so as to effect fast transfer of the data itself. It should be appreciated that the volume of data contained within a data file would usually be significantly larger than the amount of data conveyed in order to instruct machines to perform searches. However, a problem arises if a newly identified source machine is protected by a firewall. It is not 10 possible to undermine the provisions of the firewall but a requesting machine may contact the server 101 to provide assistance in terms of increasing the speed at which the data may be removed from the firewall protected disk.

Essential constituents of the preferred embodiment are illustrated in Figure 2. The file sharing apparatus has a first data processing station 103, a second data processing station 104, a third data processing station 112, a network 102 facilitating the establishment of connections between the processing station to enable the transfer and sharing of data files and a server 101 configured to supply instructions and data to the processing 20 stations 103, 104, 112 over the network 102. The first data processing station includes a first storage device such as a hard disk drive 201 arranged to store first data files that may be shared over the network. In addition, the station includes a first processing device 202 arranged to facilitate file access and network communication in response to first stored s instructions. In addition, there is provided a first communication device 203 configured to facilitate the connection of a first processing device to the network 102.

Similar provisions are provided at the second data processing station 104, in the form of a second storage device 211 arranged to store second data files that may be shared over the network. The second station 104 also includes a second processing device 212 arranged to facilitate file access and network communication in response to second stored instructions. Second station 104 also includes a second communication device 213 configured to facilitate the connection of the second processing device 212 to the network 102.

The third processing station 112 includes a third storage means JO arranged to temporarily store data files that are being transferred between other stations. The third station includes a third processing device 222 and a third communication device 223 configured to facilitate the connection of the third processing device 222 to the network 102.

The first communication device 203 includes facilities for initiating the transfer of data from the second storage device 211. However, the second processing device 212 includes instructions (in the form of a firewall) that prevent the first communication device 203 from reading data from the second storage device 211. The presence of the firewall at station 104 is illustrated by dotted line 215. A similar firewall exists at station 103 20 illustrated by dotted line 205. Station 112 does not include a firewall.

The first processing station requests assistance from the server 101 in order to achieve the transfer of data from storage device 211. Normally, station 103 would make a request to station 104 as illustrated by communication line 231. However, such a communication is blocked by the 25 presence of firewall 215. Similarly, an attempt to directly connect from station 104 to station 103, as illustrated by communication line 232 would also be blocked by the presence of firewall 205.

Station 103 makes a request to server 101 as illustrated by communication 233. Server 101 returns location details of station 112, as illustrated by communication 234.

Server 101, which is known to station 211, requests station 104 to establish communication with station 112, as illustrated by communication line 235. Station 112 is not protected by a firewall therefore it is possible to make this connection. The data of interest is transferred from the second storage device 211 to the third storage device 221 and temporarily held there. Station 103 makes a request to station 112 as illustrated by Jo communication line 236 and this communication is accepted given that station 112 is not behind a firewall. Having established this communication, it is now possible for station 112 to submit the temporarily held data to its requesting destination, as illustrated by communication line 236.

A physical structure of the application server 101 is detailed in Figure 3. The server includes a central processing unit 301, randomly accessible memory 302, local interfaces 303, for connection to local display devices and input devices etc. a network interface 304 connecting the server 101 to the Internet 102 and a disk storage device 305.

Central processing unit 301 in combination with executable 20 instructions stored within the system memory 302 provide the means for achieving server functionality as described herein.

A map of instructions stored within system memory 302 is shown in Figure 4. The executable instructions include instructions for an operating system such as UNIX, LINUX or Windows NT. In addition, instructions are 2 provided for internet communications including a web server application 402. A database application 403 is included to enable information relating to groups to be stored in database tables. The tables for the groups

themselves are stored at region 404 and region 405 stores the main server applications. Procedures for facilitating the downloading of applications stored at region 406.

A summary of the database application, stored at location 403 is

5 shown in Figure 5. At step 501, the server sends applications to potential users to facilitate the establishment or joining of a sectranet virtual peer-to peer network. At step 502, details of other members are sent to users that have installed the software received under the execution of process 501.

Steps 501 and 502 allow sectranets to be established. Once 10 operational, minimal reference is then made back to the application server.

However, as shown in Figure 5, the application does assist in two other areas. As indicated at step 503, the application server may send details to assist with network optimization. These optimization procedures work towards optimising direct connections between users. Thus, for each user s having a finite number of direct connections, attempts are made to make the most of these connections from the user's perspective. At step 504 procedures are included for providing assistance due to the presence of firewalls. Procedures 504 for the provision of assistance with respect to the go presence of firewalls are detailed in Figure 6. Procedures 504 are invoked in response to a request being made from a particular user to the effect that communication is being made difficult due to the presence of firewalls.

Communications between systems enclosed within the firewalls is achieved by using an intermediate node that is not protected by a firewall.

:s Each firewall protected station may initiate a connection to the intermediate node and having established this connection, it is then permissible for the intermediate node to return information back to the firewall protected node.

Thus, if a node (identified as a destination) is protected by a firewall and is requesting information from a source station that is also protected by a firewall, the provision of an intermediate unprotected node allows each protected node to contact this intermediate station and allows the 5 intermediate station to return data back to the originating node.

Consequently, the intermediate node provides a pathway by which communications may be made from the protected source station to the protected destination station.

At step 602 details of the intermediate node's "middleman" location 10 are sent to the user requesting assistance (is the data destination).

At step 603 the middleman node location is sent to the firewall protected source and at step 604 a request is made to the source to transfer the data to the intermediate node.

At step 605 the intermediate node is instructed to pass the data onto s the requesting destination node and at step 606 a question is asked as to whether the information has been received by the requester. If answered in the negative, control is returned to step 601 and an alternative node is selected. If answered in the affirmative, the transfer has taken place and the connection is closed at step 607.

So A physical structure of a user station, such as station 103, is illustrated in Figure 7. The user station includes a central processing unit 701, randomly accessible memory 702, local interfaces 703, for connection to local display devices and input devices etc. a network interface 704, connecting the station to the Internet and a disk storage device 705.

2s Central processing unit 701 in combination with executable instructions stored within system memory, provides the functionality of the network stations, allowing it to create peer-to-peer sectranet networks over

the Internet and allowing it, when necessary, to make contact with the application server.

A map of instructions stored within system memory 702 is detailed in Figure 8. The executable instructions include instructions for an operating 5 system 801, such as Windows 98. In addition, instructions are provided for internet communications including web server application 702. A database application 703 is included to enable information relating to connections to be stored in database tables. The peer-to-peer application, received initially from the application server 101, is held at location 804 and a table of 10 connected located users is stored at location 805. Procedures and data are also included to assist with the optimization of connections, although not illustrated in Figure 8.

The peer-to-peer application stored at location 804 is primarily concerned with providing access to distributed storage regions within the peer-to-peer network. A considerable amount of data may be stored in this way and the system is therefore provided with procedures to assist with searching for information. Thus, each application allows a user to specify search criteria and then a searching process propagates throughout the network. so Initially, searches are performed at directly connected stations and if an item of interest is found at a directly connected station, this provides the most efficient way of the information being copied to a requesting destination. However, in addition, the searching criteria permeates further outwards through the network as each connected station conveys search as requests to its own connected stations and so on.

To illustrate the operations performed within the sectranet, the following illustration is given and it should be emphasised that this is merely

an example of a particular use of the system. in this example, it is assumed that many art galleries have many works of art that they are prepared to mutually share on a commercial basis. Locally, images of the works of art are stored along with textural information relating to the nature of the work 5 and commercial terms. From the gallery's point of view, it is seen as being mutually beneficial that this information should be shared with other galleries that are in similar situations. However, although the galleries are prepared to let other galleries see images of their work, they do not wish this information to be placed on general access, as it could undermine and 10 devalue the work as a whole. Thus, the sectranet establishes a private search space for members of the virtual network, while requiring no additional hardware compared to that for general internet access.

Furthermore, instructions that allow the system to operate are available from the application server, which in turn provides additional benefits to the 15 overall functionality.

Thus, members of the sectranet may gain access to the information.

Furthermore, the server will provide additional assistance if any of this information is stored behind a firewall. However, the sectranet does have entry requirements and it is not available for anyone to join. The sectranet 20 itself would therefore be considered as a private access sectranet and as such charges would be issued by the administrator of the application server to the individual members.

Operations performed by a typical member station, such as station 103 in response to peer-to-peer application 804 being executed by CPU 25 701 are illustrated in Figure 9.

At step 901 a local file system is updated. This process would be executed at any time when new information is to be placed into the local file

system. Thus, in the example identified previously, an update could be made if a gallery has received a new painting or if the terms and conditions on which a painting may be loaned have changed.

At step 902 the user initiates a search. Thus, a search may take the 5 form of identifying a work of a particular artist required for a particular duration. Thus, a user may initiate a search to identify any paintings by Constable that may be loaned for two months. The search criteria is then propagated throughout the network and results are received back.

In addition to initiating a search locally, the local station must 0 respond to search criteria specified elsewhere. Consequently, step 903 relates to this alternative mode of operation in which an external search request is received. The search is performed and then the search results are returned at step 904. Furthermore, the search criteria are passed on to other connected users at step 905 and search results received back from other connected users are passed back to the requesting station at step 906. At step 907 copies of the actual data are transferred.

Step 902 relating to the initiation of a search concerns procedures in which the local station is interested in obtaining copies of data from other stations within the network. The local station may therefore be considered 20 as a destination and a search is initiated to obtain copies of files from one or more sources. This contrasts with step 903 in which a search request is received from an external user. Under these procedures, an actual search is performed locally and the local station of interest may then be considered as a source looking for data that may or may not be supplied to a 25 destination.

Procedures 902 for initiating a search are detailed in Figure 10. At step 1001 search criteria are received from a user using manual input

devices connected to local interfaces 703. At step 1002 the criteria are transmitted to connected nodes for searches to be performed remotely.

These searches are performed and results are returned to the requesting user, whereupon step 1003 displays the search results to the local user via a visual display unit.

At step 1004 instructions are received from a user to effect a download from a remote source and at step 1005 the data is downloaded.

Procedures 1005 for the downloading of data are detailed in Figure 11. At step 1101 details of the first data source are read and at step 1 102 a to question is asked as to whether a direct connection exists. If answered in the affirmative, control is directed to step 1107 and the data is transferred.

If a direct connection is not available, resulting in the question asked at step 1102 being answered in the negative, a question is asked at step 1103 as to whether the source material is protected by a firewall. If the 15 question is answered in the negative, control is directed to step 1105 resulting in a temporary correction being established, details of the connection being cached at step 1106 and then the data transfer being performed at step 1107.

If the question asked at step 1103 is answered in the affirmative, to 20 the effect that the source data is protected by a firewall, assisted data transfer is effected at step 1104.

Assisted data transfer requires assistance from the server as indicated at 504 of Figure 5. In addition, procedures are required to be executed by the requesting destination as shown in Figure 12 along with 2s procedures being required to be executed by the protected source, as indicated in Figure 13.

Referring to procedures executed by the requesting destination, as shown in Figure 12, a data requester asks for an internet protocol address of a middleman from the server 101. The server, provides details of a middleman at step 504 and at step 1201 a requester receives the middleman internet protocol address.

At step 1203 the requester waits for the source station to communicate with the middleman station "hereafter at step 1204 a question is asked as to whether the middleman does now have the file (ie received from the source). If answered in the negative, control is returned to to step 1203 and if answered in the affirmative, the file is downloaded from the middleman at step 1205. Thereafter, at step 1206 the middleman is informed to the effect that the download has been completed.

Procedures executed by the source station is illustrated in Figure 13.

At step 1301 the source station receives a request from the server to connect to the middleman. Connection is then performed at step 1302 and the file is then pushed to the middleman at step 1304 along with an instruction to the effect that the files should be held locally. At step 1305 the server is then informed that the middleman has the file. The interrelationship between these operations is described below with 20 reference to Figures 17 to 22.

During the establishment of a sectranet, a creator must establish how data is to be stored and how the peer-to-peer stations are to interact.

In the example given herein, relating to the exchange of paintings, it has been agreed that all stations within the network should hold their data in a 25 particular way, as illustrated in Figure 14.

Each station within the sectranet establishes a volume identified as V:. Within this volume individual directories are created for each particular

painting and each directory contains a text file, such as file 1401, along with a graphical image file 1402. Each member of the sectranet is prepared to let other members receive a high quality graphical image of selected works of art and as such the graphical data is stored in high definition uncompressed form.

A text file 1401 is shown in detail in Figure 15. A first field 1501

identifies the artist and a second field 1502 identifies the name of the work

with any alternative names being placed at field 1503. Field 1504 provides

an indication of an estimated value and a field 1505 identifies availability.

to Field 1506 identifies typical loan durations with field 1507 identifying charges

for a loan, field 1508 identifying any security provisions and field 1509

providing any relevant known history of the painting. Thus, with each member of the sectranet using the same file layout as shown in Figure 15, it is possible for the searching procedures to respond to particular search criteria.

s Procedures 903 for responding to an external search request are detailed in Figure 16. At step 1601 the search criteria are identified and at step 1602 the criteria are processed, to the extent that this is necessary, to make them compatible with the local system. At step 1603 a file is examined and at step 1604 a question is asked as to whether the file is considered So relevant, ie does the texturally stored data identify a painting that is consistent with the search criteria? If answered in the affirmative, details are added to search results at step 1605 "hereafterat step 1606 a question is asked as to whether any other file is present. If the question asked at step 1604 is answered in the negative, control is directed to step 1606, if the z question asked at step 1606 is answered in the affirmative, control is returned to step 1603 and the next file is examined. Eventually, the question asked at step 1606 will be answered in the negative.

A schematic representation of procedures conducted within a sectranet, embodying the present invention, is shown in Figures 17 to 22.

Referring to Figure 17, a plurality of internet enabled computer systems 1701,1702, 1703, 1704, 1705, 1706, 1707 and 1708 have received 5 sectranet enabling software and have expressed a desire to connect to other members of the network. Stations 1701 to 1708 do not represent the totality of the sectranet and details will be received from the application server 101 enabling them to connect to existing members. Thus, respective sets of locations of other existing members are supplied, sequentially, as illustrated to by communications 1711 to 1716 respectively.

After receiving details of other stations within the network, each of stations 1701 to 1708 establishes direct connections with their respective set, as illustrated by communication links 1801 shown in Figure 18.

Referring to Figure 19, station 1701 initiates a search and as such, it 15 establishes itself as a potential data destination. Search criteria are dispatched to connected stations, including station 1702, as indicated by communication 1901. Station 1702 conducts a search and passes details of the search request to other connected stations, including station 1703 as indicated by communication 1902. Similarly, the search request is passed to no station 1704 as indicated by communication 1903, onto station 1705 as indicated by communication 1904, onto station 1706 as indicated by communication 1905, onto station 1707 as indicated by communication 1906 and onto station 1708 as indicated by communication 1907.

At station 1708 a search is conducted and a file that satisfies this 25 search criteria is identified. Details of the file have not been returned to station 1701 but this is a file of interest to station 1701 and a copy of the data will be requested. However, a problem arises in that the requesting

destination station 1701 is protected by a firewall 1911 and the source station 1708 is also protected by a firewall 1912.

Referring to Figure 20, station 1708 has identified a file that satisfies the search criteria and an indication of this is conveyed back to station 1707, as indicated by communication 2001. Similarly, information is conveyed back to station 1706 by communication 2002, back to station 1705 by communication 2003, back to station 1704 by communication 2004, back to station 1703 by communication 2005, back to station 1702 by communication 2006 and back to the requesting destination station 1701 by communication o 2007.

As previously stated, both station 1701 and 1708 are behind firewalls 1911 and 1912 respectively. in response to a search defined at station 1701, station 1708 has returned information back to station 1701 to the effect that it has identified a file which satisfies the search criteria. Station 1708 has also 15 informed station 1701 that it is located behind a firewall.

The user at station 1701 revues the search request and considers the file to be of interest. Station 1701 is therefore instructed to obtain a copy of the file held at station 708. With both station 1701 and station 1708 being located behind firewalls, it is not possible for either station to establish a 20 direct connection to the other.

Referring to Figure 21, requesting station 1701 makes a request to the server 101 as indicated by communication 2101 to the effect that it requires an internet protocol address of a middleman. Server 101 identifies the address of middleman 2102 to requesting station 1701, as indicated by z communication 2103. In addition, the server 101 issues a request to source station 1708, as indicated by communication 2104 to the effect that it is to connect to middleman station 2102. Referring to Figure 22, the destination

station 1708 connects to the middleman station 2102 and pushes the file of interest to the middleman 2102, as indicated by communication 2201. in addition, a source station 1708 indicates to the middleman station 2102 that the file is to be held.

5 The source station 1708 informs the server 101 that the file has been transferred to the middleman station 2102, as indicated by communication 2202. The server 101 informs the destination station 1701 to the effect that the middleman station 2102 now has the file of interest, as indicated by to communication 2203.

The destination station 1701 now downloads the file of interest, as indicated by communication 2204 from the middleman station 2102.

Thereafter, the destination station 1701 informs the middleman station 2102 to the effect that a file has been received, as indicated by communication 1 5 2205.

Claims

1. File sharing apparatus, comprising a first data processing station, a second data processing station, a third data processing station, a network facilitating the establishment of connections between said processing stations to enable the transfer and sharing of data files, and serving means configured to supply instructions and data to said processing stations over said network; wherein said first data processing station includes a first storage means 10 arranged to store first data files that may be shared over said network, a first processing means arranged to facilitate file access and network communication in response to first stored instructions and a first communication means configured to facilitate the connection of said first processing means to said network; said second data processing station includes a second storage means arranged to store second data files that may be shared over said network, a second processing means arranged to facilitate file access and network communication in response to second stored instructions and a second communication means configured to facilitate the connection of said To second processing means to said network; said third data processing station includes a third storage means arranged to temporarily store data files that are being transferred between the stations, a third processing means arranged to facilitate file access and network communication in response to third stored instructions and a third z communication means configured to facilitate the connection of said third processing means to said network;

said first communication means includes initiate transfer means configured to attempt to read a file from said second storage means; said second processing means includes protection means that prevents said first communication means reading data from said second 5 storage means; said first processing means includes requesting means configured to (a) request details of said third processing system from said serving means, wherein said third processing system is known to said protection means; and to 10 (b) request said serving means to instruct said second processing means to perform a data transfer from said second storage means to said first processing station, to whom a direct connection cannot be made, via said third processing station to whom a direct connection can be made.

2. Apparatus according to claim 1, wherein said first data processing station is configured to instruct said second data processing station to perform a search to identify files of interest.

3. Apparatus according to claim 1, wherein said second data 20 processing station receives data from said first processing system via a chain of directly connected processing stations.

4. Apparatus according to claim 1, wherein said first communication means includes protection means preventing said second as processing means making a direct connection to said first processing means.

l

5. A method of sharing files between a first data processing station and a second data processing station over a network that facilitates the establishment of connections between processing stations and has a server and a third processing station connected thereto, wherein said first processing station attempts to read a file from said second processing station; said second processing station includes protection means that prevent said first processing station from reading data therefrom; said first processing station requests details of said third processing Jo station from said server, wherein said third processing station is known to said second processing station; and said first processing station requests said server to instruct said second processing station to perform a data transfer from said second processing station to said third processing station thereby allowing said first s processing station to connect directly to said third processing station.

6. A method according to claim 5, wherein said first processing station instructs said second processing station to perform a search to identify files of interest.

7. A method according to claim 5, wherein said second processing station receives data from said first processing station via a chain of directly connected processing stations,.

s

8. A method according to claim 5, wherein said first processing station includes protection means preventing said second processing station from making a direct connection to said first processing station.

9. A file sharing apparatus substantially as herein described with reference to the accompanying drawings.

5

10. A method of sharing files between processing stations substantially as herein described with reference to the accompanying drawings.