JP2004334455A - Server device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a server device for protecting a server from any attack or convergence. <P>SOLUTION: This server device 1 having a server 2 is provided with a redirector 3 for responding to an access from a client 5 to a server 1, and for guiding an access to the server 2 to redirect destination being access destination different from the first access designation from the client 5 by redirect processing. The access to the server 1 is redirect-processed so that a request from the client 5 can be access-guided to the redirect destination, and that contents data acquired from the server 2 can be outputted to the client 5. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a server device, and more particularly to a server device for avoiding attacks and congestion on a server.
[0002]
2. Description of the Related Art At present, with the spread of the Internet due to the widespread use of the World Wide Web (WWW), a DoS (Denial of Service) attack that causes an unauthorized request or a large amount of access to cause a server to go down or congestion. Service response speed degradation is a problem.
[0003]
As shown in FIG. 16, when the client 100 requests the server 101 to provide a service using the Internet, the client 100 accesses the server 101 and receives information provision. For this reason, the client 100 issues a connection request to the server, sends a request request (GET request) when the session is established, and returns the content data obtained by the server 101 performing the job to the client 100 to the client 100.
[0004]
In such a case, a DoS attack is a denial-of-service attack in which a connection request to the server 101 is continuously made to exceed the processing capacity of the server 101 and normal access cannot be performed. There is also a DDoS (Distributed DoS) that is performed simultaneously from a plurality of machines in the attack.
[0005]
In order to avoid a DoS attack, the attack pattern is currently known, so it can be detected by a fraud detection device (IDS) and filtered by a firewall to stop it. This is addressed by preventing access.
[0006]
However, for attacks that do not differ from normal access, such as a large amount of normal access using a script language and a manual HTTP reload (redisplay instruction) using a large number of people, even if the IDS and firewall exist in the front stage of the server device, The DoS packet that can be detected by the signature of the IDS is filtered, and cannot be detected and handled by the IDS and the firewall.
[0007]
As a countermeasure against a DoS attack, conventionally, there is a method in which different types of security identifiers are added to communication packets and priority control is performed on a communication packet delivery route according to the security identifiers (for example, see Patent Document 1). .
[0008]
In order to avoid congestion in which many normal users are gathered, a method of increasing the number of servers and performing clustering is general. However, this method has a problem that, in the case of electronic commerce or the like, once congestion occurs, the currently connected session cannot be processed, and the transaction opportunity and credibility are lost, resulting in a large loss.
[0009]
[Patent Document 1]
JP-A-2002-158699 (page 1, abstract)
[0010]
An object of the present invention is to eliminate attacks by normal access to a server by a simple method, and to make it possible to directly process a server currently in use, thereby concentrating a large number of accesses. It is an object of the present invention to provide a server device capable of effectively using resources and performing session security in a congested state.
[0011]
FIG. 1 shows the principle of the present invention. In FIG. 1, 1 is a server device, 2 is a server, 3 is a redirector, 4 is a proxy, and 5 is a client.
[0012]
The object of the present invention is achieved by the following (1) to (5).
[0013]
(1) A response from the client 5 to the server 2 is sent to the server device having the server 2 in between, and the access to the server 2 is redirected to the server 2 by a redirect process, which is different from the first access destination from the client. By providing a redirector 3 for guiding the user to the server 2 and performing a redirect process for the access to the server 2, the request from the client 5 is guided to the redirect destination and the content data obtained from the server 2 is output to the client 5. Characteristic server device.
[0014]
(2) The server device having the server is provided with the redirector that responds to the access from the client 5 to the server 2 during that period and guides the access to the proxy 4 by the redirect process and the proxy 4 that performs the relay process to the server 2. By performing a redirect process for the access to the server 2, the request from the client is notified to the proxy 4, the request is output from the proxy 4 to the server 2, and the content obtained from the server 2 is output to the client 5 by the proxy 4. A server device characterized in that:
[0015]
(3) The server according to (2), wherein the redirector is provided with delay processing means for delay-output processing the redirect instruction when executing the access guidance, and delay-outputs the redirect instruction output from the redirector to the client. apparatus.
[0016]
(4) The redirector is provided with a session ID adding means for adding a session ID to the direct command, and when the redirector is output from the redirector to the client, the proxy is also notified of the session ID, and the proxy transmits the session ID to the proxy. (2) The server device according to (2), wherein session guarantee is performed for the redirect command, and the content obtained from the server is output to the client.
[0017]
(5) When the redirector is provided with delay processing means for delay-output processing of a redirect command at the time of execution of access guidance, and session ID adding means for adding a session ID to the redirect command, and when the redirector outputs the redirect command to the client. The server device according to (2), wherein the proxy is also notified of the session ID, the proxy performs session guarantee for a request command having the session ID, and outputs the content obtained from the server to the client. .
[0018]
This produces the following effects.
[0019]
(1) By controlling the access from the client to the server once by the redirector and accessing the server, the attack impersonating the normal access stops the attack without performing the redirection, so the impersonation of the normal access is performed. Since an attack can be separated from normal access and the attack can be prevented, an attack due to normal access to a script or the like that cannot respond to a redirect command can be eliminated, and the load on the server can be reduced.
[0020]
(2) By controlling the client to access the server once with the redirector to access the proxy and then access the server from the proxy, the attack that masquerades as a normal access can be stopped without redirecting. Therefore, an attack impersonating normal access can be separated from normal access, and the attack can be prevented. This not only eliminates attacks by normal access to scripts and the like that cannot respond to the redirect command, and can reduce the load on the server, but also prevents the server from being directly attacked by hiding the server from the external Internet using a proxy. High security can be realized.
[0021]
(3) By providing a redirector that performs delay processing when executing access guidance, it is possible to provide a server device having a function of reducing the frequency of attacks impersonating normal access.
[0022]
(4) By adding a session ID to a redirect command and having a proxy that performs access control on the session ID, it is possible to reduce the frequency of attacks masquerading as normal access and provide a server device having session security. .
[0023]
(5) Since the access control is performed on the session ID by delaying the redirect command and adding the session ID, the frequency of the attack impersonating the normal access is further reduced, and the server apparatus having the session security is provided. be able to.
[0024]
BEST MODE FOR CARRYING OUT THE INVENTION
1. First embodiment
One embodiment of the present invention will be described with reference to FIG. In FIG. 1, 1 is a server device, 2 is a server, 3 is a redirector, 4 is a proxy, and 5 is a client.
[0025]
The server device 1 performs data processing in response to a request request from the client 5. For example, the server device 1 reads out required data and sends it to the requesting client, and the server 2, the redirector 3, and the proxy 4 Have.
[0026]
The server 2 manages files and performs input / output, and is configured by a computer such as a processor and a storage device.
[0027]
The redirector 3 changes the request destination to the proxy 4 in response to an access request from the client 5.
[0028]
When the client 5 accesses the server, the proxy 4 is designated by the redirector 3 provided between the client 5 and the server 2 as a request destination, relays the request on behalf of the server 2, and relays the obtained data. It has a relay proxy response function for relay transmission to the requesting client 4.
[0029]
The operation of FIG. 1 will be described based on the flowchart of FIG.
[0030]
S1. The client 5 sends a request request “GET request” to the server device 1, which is input to the redirector 3 of the server device 1.
[0031]
S2. This input is stored in an input HTTP (Hypertext Transfer Protocol) data buffer 10 of the redirector 3. As a result, in the case of the following GET request, the input HTTP data is held, and “www.fujitsu.co.jp” is extracted from the underlined portion as the host name.
[0032]
GET http: // www. Fujitsu. co. jp / fujitsu. html HTTP / 1.1S3. At the time of initial setting, the server device 1 statically sets a host name conversion table 11 for converting the host name extracted from the input HTTP data buffer 10 by the redirector 3. The redirector 3 searches the host name “www.fujitsu.co.jp” for an entry that matches the pre-conversion host name in the host name conversion table 11. Then, the converted address "jp.fujitsu.com" is obtained.
[0033]
S4. The redirector 3 creates redirect data “Location: http: //jp.fujitsu.com/fujitsu.html” in the output HTTP data buffer 12 with the matched converted address “jp.fujitsu.com” as the redirect destination. . If the host name of the input HTTP data does not exist in the host name conversion table 11, the data is discarded.
[0034]
S5. The redirector 3 outputs a redirect command including the redirect data created in the output HTTP data buffer 12 to the client 5.
[0035]
As a result, the client 5 receives the redirect command, outputs a GET request to “jp.fujitsu.com” in this example to the designated redirect destination, and the proxy 4 receives the GET request in the future.
[0036]
S10. As a result, as shown in FIG. 7B, HTTP data indicating a GET request sent from the client 5 as a redirect destination is input to the proxy 4.
[0037]
S11. The proxy 4 copies this to an output data buffer not shown.
[0038]
S12. The proxy 4 outputs the copied HTTP data to the server 2 and performs access. Then, the content data is obtained and relayed to the client 5.
[0039]
In the above description, an example in which the host name is converted is given. However, the present invention is not limited to this, and the port and path name may be changed and added in addition to the host name as follows. Good.
[0040]
http: // www. Fujitsu. co. jp / index. html @http: // www. Fujitsu. co. jp: 8080 / index. html
http: // www. Fujitsu. co. jp / index. html @http: // www. Fujitsu. co. jp / yokyoko / index. html
In the case of performing a DoS attack, there is almost no case where the redirect is performed according to the redirect data even if the redirect data is sent from the redirector, and thus the DoS attack can be prevented.
[0041]
When normal access is congested with respect to the server device 1, the client outputs a GET request again to the redirect destination by this redirection, so that access to the server 2 is generally guided to another machine. Therefore, the congestion state is reduced and the congestion state is improved.
[0042]
2. Second embodiment
A second embodiment of the present invention will be described with reference to FIG. In the second embodiment, a delay unit 6 is provided in the redirector 3, and delay processing is performed when a redirect command is sent to a client. For example, control such as sending after waiting for 0.1 second is performed.
[0043]
The operation of FIG. 2 will be described based on the flowchart of FIG.
[0044]
S21. The client 5 sends a request request “GET request” to the server device 1, which is input to the redirector 3 of the server device 1.
[0045]
S22. This input is held in the input HTTP data buffer 10 of the redirector 3. As a result, “www.fujitsu.co.jp” is extracted as the host name in the same manner as described above.
[0046]
S23. In the server device 1, a host name conversion table 11 for converting the host name extracted from the input HTTP data buffer 10 by the redirector 3 at the time of initial setting is statically set. The redirector 3 searches the host name “www.fujitsu.co.jp” for an entry that matches the pre-conversion host name in the host name conversion table 11. Then, the converted address "jp.fujitsu.com" is obtained.
[0047]
S24. The redirector 3 creates redirect data “Location: http: //jp.fujitsu.com/fujitsu.html” in the output HTTP data buffer 12 with the matched converted address “jp.fujitsu.com” as the redirect destination. . If the host name of the input HTTP data does not exist in the host name conversion table 11, the data is discarded.
[0048]
S25. The redirector 3 delays the redirect command including the redirect data created in the output HTTP data buffer 12 by the delay unit 6 before outputting the redirect command to the client 5. Specifically, for example, it waits for output for 0.1 second.
[0049]
S26. The redirector 3 outputs a redirect command including the redirected redirected data to the client 5.
[0050]
As a result, the client 5 receives the delayed redirect command, outputs a GET request to the designated redirect destination, and the proxy 4 receives the GET request this time.
[0051]
S27. As a result, as shown in FIG. 8B, HTTP data indicating a GET request transmitted from the client 5 as a redirect destination is input to the proxy 4.
[0052]
S28. The proxy 4 copies this to an output data buffer not shown.
[0053]
S29. The proxy 4 outputs the copied HTTP data to the server 2 and performs access. Then, the content data is obtained and relayed to the client 5.
[0054]
Thus, by delaying the output of the redirect data, the amount of access can be reduced, and the number of attacks that occur within a predetermined time can be suppressed.
[0055]
Note that the delay processing may be performed for all GET requests, or may be delayed at a fixed rate, for example, １ ／. In addition, since the access source address and the access count of the access source can be known on the Internet, it is possible to perform processing so as to delay the access source or a place where the access count is large.
[0056]
3. Third embodiment
A third embodiment of the present invention will be described with reference to FIG. In the third embodiment, the redirector 3 is provided with a session ID adding means 7, and when the client 5 outputs a GET request to the redirect destination, the redirector 3 sends the GET request with the added session ID, and receives a redirector command from the redirector 3. Can be confirmed.
[0057]
The operation of FIG. 3 will be described based on the flowchart of FIG.
[0058]
S31. The client 5 sends a request request “GET request” to the server device 1, which is input to the redirector 3 of the server device 1.
[0059]
S32. This input is held in the input HTTP data buffer 10 of the redirector 3. As a result, “www.fujitsu.co.jp” is extracted as the host name in the same manner as described above.
[0060]
S33. In the server device 1, a host name conversion table 11 for converting the host name extracted from the input HTTP data buffer 10 by the redirector 3 at the time of initial setting is statically set. The redirector 3 searches the host name “www.fujitsu.co.jp” for an entry that matches the pre-conversion host name in the host name conversion table 11. Then, the converted address "jp.fujitsu.com" is obtained.
[0061]
S34. When the converted address is obtained, the redirector 3 creates a session ID for identifying the session in the session ID buffer 13. The session ID is a combination of alphanumeric characters selected at random, generates a session ID using a random number, and writes this in the session ID buffer 13. FIG. 9 shows a state in which “X532j0w8afofdsia” is entered as the session ID. If the host name of the input HTTP data does not exist in the host name conversion table 11, the data is discarded.
[0062]
S35. The redirector 3 notifies the proxy 4 of the session ID created in this way.
[0063]
S36. The redirector 3 creates the result of adding the session ID to the path in the output HTTP data buffer 12 as redirect data.
[0064]
S37. The redirector 3 outputs a redirect command including the redirect data created in this way to the client 5.
[0065]
In this way, for example, the following output data in which the session ID “X532j0w8afofdsia” is entered is created.
[0066]
http: // www. Fujitsu. co. jp / fujitsu. html @http: // jp. Fujitsu. com / X532j0w8afofdsia / fujitsu. html
4. Fourth embodiment
A fourth embodiment of the present invention will be described with reference to FIGS. In the fourth embodiment, a state signal “new” indicating a new state of a session is transmitted from the redirector 3 to the proxy 4 as control data together with the session ID from the session ID adding means 7.
[0067]
In response to this, the proxy 4 creates the filtering passage table 14 shown in FIG. In FIG. 10, it is registered that the session with the session ID “X532j0w8afofdsia” is “new” and the session with “Fdsaugdsa315i4jl” is “continue”. The access to the server device 1 for the second and subsequent times in the same session is received by the proxy 4 specified at the beginning.
[0068]
A fourth embodiment will be described with reference to FIG.
[0069]
S41. A GET request to the redirect destination is transmitted to the proxy 4 as an HTTP packet input from the client 5.
[0070]
S42. The proxy 4 performs URL filtering on the HTTP packet. That is, a session ID is extracted from the HTTP packet, and the entry matching the session ID in the filtering passage table 14 is searched using the extracted session ID as a search key. It detects whether this session is “continuation” or “new”. If the entry does not exist, the data is discarded. Redirect to the redirector again. If the entry exists and the state is "new", change this to "continue".
[0071]
S43. The URL filtering determines whether the status of the GET request to the redirect destination is “new” or “continued”. ₁ And the continuous session output queue Q ₂ And the continuous session queue Q ₂ Is controlled so as to output the output data with priority.
[0072]
S44. Thus, the continuous session queue Q is stored in the output data buffer of the proxy 4 (not shown). ₂ Output data is preferentially copied.
[0073]
S45. Then, a GET request is transmitted from the proxy 4 to the server 2 and access is performed.
[0074]
The session ID notified from the redirector 3 is received by the proxy 4, and the corresponding session ID is newly registered in the filtering passage table 14. When the session has ended, it is deleted from the filtering table 14. In addition, the second and subsequent accesses in the same session are registered in the filtering passage table 14 with the status “continued”.
[0075]
At the end of the session, the proxy 4 deletes the session ID in the filtering passage table 14.
[0076]
In this manner, in the proxy 4, prior to the GET request from the client 5 being copied to the output data buffer, the URL filtering and the priority control based on the session ID are performed, and the one with the higher priority is preferentially accessed to the server 2. be able to.
[0077]
In the above description, an example in which the session ID is added to the URL (uniform resource locators) has been described. However, the present invention is not limited to this. Of course, other notation methods such as a cookie character string may be used. it can.
[0078]
5. Fifth embodiment
A fifth embodiment of the present invention will be described with reference to FIGS. In the fifth embodiment, the redirector 3 is provided with the delay unit 6 and the session ID adding unit 7.
[0079]
The operation of FIG. 4 will be described based on the flowchart of FIG.
[0080]
S51. The client 5 sends a request request “GET request” to the server device 1, which is input to the redirector 3 of the server device 1.
[0081]
S52. The input HTTP packet data is held in the input HTTP data buffer 10 of the redirector 3. Then, the redirector 3 extracts “www.fujitsu.co.jp” as the host name.
[0082]
S53. As described above, the host name conversion table 11 is statically set in the server device 1 at the time of initialization. The redirector 3 searches the host name “www.fujitsu.co.jp” for an entry that matches the pre-conversion host name in the host name conversion table 11. Then, the converted address "jp.fujitsu.com" is obtained.
[0083]
S54. When the converted address is obtained, the redirector 3 creates a session ID for identifying the session in the session ID buffer 13. The session ID is made up of, for example, a combination of alphanumeric characters using random numbers. FIG. 11 shows a state in which “X532j0w8afofdsia” has been created as the session ID. If the host name of the input HTTP data does not exist in the host name conversion table 11, the data is discarded.
[0084]
S55. The redirector 3 notifies the proxy 4 of the session ID created in this way.
[0085]
S56. The redirector 3 creates the result of adding the session ID to the path in the output HTTP data buffer 12 as redirect data. As a result, output HTTP packet data is written as redirect data in the output HTTP data buffer 12, as shown in FIG.
[0086]
S57. The redirector 3 delays the output by delaying the redirect data created in the output HTTP data buffer 12 by the delay unit 6 before outputting the redirect data to the client 5.
[0087]
S58. The redirector 3 outputs the delayed redirected data to the client 5.
[0088]
Thus, the same control as in FIG. 3 is performed, and the content data obtained from the server 1 is sent to the client 5.
[0089]
By adding the session ID, it is possible to recognize what kind of control the session has received. For example, if a session ID is added to the GET request to the proxy, it is recognized that this is received by the redirector 3 and not an attack, or a session with the same ID has already been processed by the proxy. When it is determined that the GET request with the same ID is received later, it can be processed as already processed, and can function as protection against an attack.
[0090]
Further, by performing the delay processing, it is possible to reduce the access data for the attack and to perform the load distribution.
[0091]
6. Other embodiments
Another embodiment of the present invention will be described with reference to FIGS. In another embodiment of the present invention, the proxy is omitted. FIG. 5 shows an embodiment in which the proxy 4 is omitted from the embodiment shown in FIG. 1, and FIG. 6 shows an embodiment in which the proxy 4 is omitted from the embodiment shown in FIG. In each case, the server 2 is instructed as the redirect destination.
[0092]
A. The operation of FIG. 5 will be described.
[0093]
(1) The client 5 sends a request request “GET request” to the server device 1, which is input to the redirector 3.
[0094]
(2) This input is held in the input HTTP data buffer of the redirector 3, which is omitted in FIG. Then, the host name is extracted. The redirector 3 retrieves the host name conversion table set in the server device 1 and omitted in FIG. In this case, an address for accessing the server 2 is used as the converted address. The redirector 3 sends the client 5 a redirect command including the address for accessing the server 2.
[0095]
(3) The client 5 sends a “GET request” to the server 2 that is the redirect destination.
[0096]
(4) The server 2 performs a corresponding process, and sends out the obtained content data to the client 5.
[0097]
B. The operation of FIG. 6 will be described.
[0098]
(1) The client 5 sends a request request “GET request” to the server device 1, which is input to the redirector 3.
[0099]
(2) This input is held in the input HTTP data buffer of the redirector 3, which is omitted in FIG. Then, the host name is extracted. The redirector 3 obtains the changed address by searching the host name conversion table set in the server device 1 and omitted in FIG. In this case, an address for accessing the server 2 is used as the converted address. The redirector 3 delays and outputs the redirect instruction including the redirect data by the delay unit 6.
[0100]
(3) Then, the redirector 3 sends the redirect command subjected to the delay processing to the client 5.
[0101]
(4) The client 5 sends a “GET request” to the server 2 that is the redirect destination.
[0102]
(5) The server 2 performs a corresponding process, and sends out the obtained content data to the client.
[0103]
As described above, in the other embodiments shown in FIGS. 5 and 6, redial processing can be performed without using a proxy, and DoS attacks and congestion can be dealt with.
[0104]
When a proxy is used, the server 2 can be made invisible from the outside, so that the server 2 can be guarded against an external DoS attack.
[0105]
Also, when an attack is performed on the proxy, the proxy can function as a redirector, and the redirector can function as a proxy, thereby coping with the attack.
[0106]
Alternatively, as shown in FIG. 12A, the proxy is operated as a redirector P, and a GET request input first to the redirector R is issued to the client by issuing a redirect instruction to the redirector P, and the redirector P sends the GET request to the client. In this case, the DoS attack can be eliminated by accessing the redirector R that has accessed first.
[0107]
Further, as shown in FIG. 12B, the proxy is operated as a redirector P, and a GET request input first to the redirector R is issued to the client by issuing a redirect command to the redirector P, thereby transmitting a DoS attack. Can also be eliminated.
[0108]
In this manner, the redirector performs the redirect operation with the proxy designated as the redirect destination, so that the access guidance can be performed in multiple stages.
[0109]
As a result, when the redirect destination becomes a new attack target due to an amplification attack or the like, if the proxy can detect the attack based on the number of accesses, it is possible to redirect again and avoid the attack.
[0110]
Incidentally, the server device of the present invention has an A-server mode and a B-proxy mode depending on the difference in recognition from the user (client).
[0111]
In the redirector of the server device of the present invention operating in the server mode, as shown in FIG. 13A, one server S is targeted for access in principle, while the redirector of the present invention operating in the proxy mode is used. In the redirector of the server device, as shown in FIG. ₀ , S ₁ ... are to be accessed.
[0112]
In the server mode, the client recognizes the server as a server, accepts only access to the access destination server (self) from the client, and has no information of the access destination server in the HTTP GET request. The server mode is for servers intended for an unspecified number of users.
[0113]
In the proxy mode, the client recognizes the server as a proxy, accepts access to all servers generated by the client, and includes information on the access destination server in the HTTP GET request.
[0114]
The proxy mode is for services intended for users in managed areas, such as Internet providers and corporate organizations.
[0115]
The HTTP request sent from the client to the server differs between the server mode and the proxy mode. This difference basically depends on the setting of the user browser. When accessing a server device operating in the proxy mode, it is necessary for a user or an administrator to make settings to use a proxy for a browser used by the user.
[0116]
In the case of the server mode, the GET request does not need the server information, that is, the host service information, as described below, and requires the index. html, that is, a file name is required.
[0117]
GET / index. html HTTP / 1.1
However, in the case of the proxy mode, the GET request requires host service information (for example, Fujitsu.com) and a file name as described below.
[0118]
GET http: // www. Fujitsu. com / index. html HTTP / 1.1
These differences are due to the fact that one server is targeted in the server mode and a plurality of servers are targeted in the proxy mode.
[0119]
Since the description of FIGS. 1 to 11 is for the proxy mode, an embodiment for the server mode will be described below with reference to FIGS.
[0120]
In the server device operating in the server mode, all accesses that reach the own server device are accesses to the own server device, so that the host name is statically converted.
[0121]
A sixth embodiment of the present invention in the case where the server device operates in the server mode will be described in detail with reference to FIG. 1 using the operation explanatory diagram shown in FIG. Note that the hardware configuration is the same as that of FIG. 1. Specifically, when the redirector is in the server mode, the operation as described with reference to FIG. 14A is performed.
[0122]
S61. A request request “GET request” is transmitted from the client 5 to the server device 1. This is input to the redirector 3 of the server device 1.
[0123]
At this time, the server device 1 performs reception only with one address and one port. The HTTP data input to the redirector 3 is held in the input HTTP data buffer 20. Note that when operating in the server mode, there is no host information in the request from the client 5.
[0124]
S62. In the server device 1, the redirect destination is set in the static redirect destination definition table 21 in advance. Thus, the redirector 3 determines the redirect destination “jp.fujitsu.com” by referring to the static redirect destination definition table 21. At this time, in this embodiment, the server device 1 accepts the request with one port and one address, so that there is only one redirect destination. The redirector 3 creates request data as redirect information in the output HTTP data buffer 22 based on the redirect destination and the file name “fujitsu.html” of the access destination written in the input HTTP data buffer 20. It is also possible to define a plurality of servers that provide the same service instead of one redirect destination and change the redirect destination by round robin or the like to share the load.
[0125]
S63. The redirector 3 outputs the redirect information including the request data created in the output HTTP data buffer 22 to the client 5.
[0126]
As a result, the client 5 outputs a GET request to the redirect destination, that is, the proxy 4, as described above.
[0127]
S70. As a result, HTTP data indicating the GET request sent from the client 5 is input to the proxy 4.
[0128]
S71. The proxy 4 copies this to an output data buffer not shown.
[0129]
S72. The proxy 4 outputs the copied HTTP data to the server and performs access. Then, the content data is obtained and relayed to the client 5.
[0130]
A seventh embodiment of the present invention will be described with reference to FIG. 1 using the operation explanatory diagram shown in FIG.
[0131]
Since a plurality of addresses can be assigned to one personal computer, in the seventh embodiment, the server device is operated in the server mode when receiving data at a plurality of addresses and a plurality of ports. Things.
[0132]
S81. A request request is transmitted from the client 5 to the server device 1. This is input to the redirector 3 of the server device 1. At this time, the server device 1 performs reception at a plurality of addresses and a plurality of ports. Therefore, the HTTP data input to the redirector 3 is held in the input HTTP data buffer 20, and the usage address of the server device 1, for example, “192.168.1.1” and the reception port “80” are set to the usage address and The information is recorded in the port information holding unit 23.
[0133]
S82. The redirector 3 of the server device 1 searches the redirect destination definition table 24 from the reception port “80” used for reception and the reception address “192.168.1.1”, and determines the redirect destination. The redirect destination definition table 24 is set in advance by a combination of a reception port and a reception address. Therefore, if the redirect destination cannot be obtained as a result of the search, this request request is terminated. It is also possible to define a plurality of servers that provide the same service instead of one redirect destination and change the redirect destination by round robin or the like to share the load.
[0134]
S83. As a result of the search, when the redirect destination is obtained, for example, when the redirect destination “jp.fujitsu.com” is obtained, the redirector 3 sets the access destination file name “fujitsu html” held in the input HTTP data buffer 20, Based on the server name “jp.fujitsu.com” of the access destination obtained from the redirect destination definition table 24, request data as redirect information is created in the output HTTP data buffer 22.
[0135]
S84. The redirector 3 outputs the redirect information including the request data created in the output HTTP data buffer 22 to the client 5.
[0136]
As a result, the client 5 outputs a GET request to the redirect destination, that is, the proxy 4, as described above.
[0137]
S90. As a result, HTTP data indicating the GET request sent from the client 5 is input to the proxy 4.
[0138]
S91. The proxy 4 copies this to an output data buffer not shown.
[0139]
S92. The proxy 4 outputs the copied HTTP data to the server and performs access. Then, the content data is obtained and relayed to the client 5.
[0140]
The other proxy mode can be operated in the server mode in the same manner.
[0141]
In the present invention, the server is configured by a computer, and the redirector and the proxy are each configured by a computer. However, the redirector and the proxy can be configured by one computer, or the server, the redirector, and the proxy can be configured by one computer. You can also.
[0142]
According to the present invention, the following effects can be obtained.
[0143]
(1) By controlling the access from the client to the server once by the redirector and accessing the server, the attack impersonating the normal access stops the attack without performing the redirection, so the impersonation of the normal access is performed. Since an attack can be separated from normal access and the attack can be prevented, an attack due to normal access to a script or the like that cannot respond to a redirect command can be eliminated, and the load on the server can be reduced.
[0144]
(2) By controlling the client to access the server once with the redirector to access the proxy and then access the server from the proxy, the attack that masquerades as a normal access can be stopped without redirecting. Therefore, an attack impersonating normal access can be separated from normal access, and the attack can be prevented. This not only eliminates attacks by normal access to scripts and the like that cannot respond to the redirect command, and can reduce the load on the server, but also prevents the server from being directly attacked by hiding the server from the external Internet using a proxy. High security can be realized.
[0145]
(3) By providing a redirector that performs delay processing when executing access guidance, it is possible to provide a server device having a function of reducing the frequency of attacks impersonating normal access.
[0146]
(4) By adding a session ID to a redirect command and having a proxy that performs access control on the session ID, it is possible to reduce the frequency of attacks masquerading as normal access and provide a server device having session security. .
[0147]
(5) Since the access control is performed on the session ID by delaying the redirect command and adding the session ID, the frequency of the attack impersonating the normal access is further reduced, and the server apparatus having the session security is provided. be able to.
[Brief description of the drawings]
FIG. 1 shows a first embodiment of the present invention.
FIG. 2 shows a second embodiment of the present invention.
FIG. 3 shows a third embodiment and a fourth embodiment of the present invention.
FIG. 4 shows a fifth embodiment of the present invention.
FIG. 5 shows another embodiment (part 1) of the present invention.
FIG. 6 shows another embodiment (No. 2) of the present invention.
FIG. 7 is an operation explanatory diagram of the first embodiment of the present invention.
FIG. 8 is an operation explanatory diagram of the second embodiment of the present invention.
FIG. 9 is an operation explanatory view of the third embodiment of the present invention.
FIG. 10 is an operation explanatory diagram of the fourth embodiment of the present invention.
FIG. 11 is an operation explanatory view of the fifth embodiment of the present invention.
FIG. 12 is an explanatory diagram of a DoS exclusion function.
FIG. 13 is an explanatory diagram of a server mode and a proxy mode.
FIG. 14 is an operation explanatory diagram of the sixth embodiment of the present invention.
FIG. 15 is an operation explanatory diagram of the seventh embodiment of the present invention.
FIG. 16 is an explanatory view of a conventional example.
[Explanation of symbols]
1 server device
2 server
3 redirector
4 Proxy
5 clients
6 Delay means
7 Session ID adding means
10 input HTTP data buffer
11 Host name conversion table
12 output HTTP data buffer
13 Session ID buffer
14 Filtering passage table

Claims (5)

In a server device having a server,
Provide a redirector that responds to the access from the client to the server between them, and guides the access to the server to the redirect destination that is different from the first access destination from the client by the redirect process,
A server device for performing a redirect process for an access to a server, thereby guiding a request from a client to a redirect destination, and outputting content data obtained from the server to the client. In a server device having a server,
A redirector that responds to the access from the client to the server between them, and guides access to the proxy by redirect processing;
Provide a proxy that performs relay processing to the server,
A server device, wherein a request from a client is notified to a proxy by performing a redirect process for access to the server, a request is output from the proxy to the server, and the proxy outputs content obtained from the server to the client. . 3. The server device according to claim 2, wherein the redirector is provided with delay processing means for delay-output processing the redirect instruction when executing the access guidance, and delay-outputs the redirect instruction output from the redirector to the client. The redirector is provided with a session ID adding means for adding a session ID to the direct command,
When outputting a redirect command from the redirector to the client, the proxy is also notified of the session ID, the proxy performs session security for the redirect command having the session ID, and outputs the content obtained from the server to the client. 3. The server device according to claim 2, wherein The redirector is provided with delay processing means for delaying output processing of a redirect instruction when executing access guidance, and session ID adding means for adding a session ID to the redirect instruction,
When outputting a redirect command from the redirector to the client, the proxy is also notified of the session ID, the proxy performs session guarantee for the request command having the session ID, and outputs the content obtained from the server to the client. 3. The server device according to claim 2, wherein

Images