JP2005100194A - Server device multiply belonging to two or more user closed network - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To allow a physical one server device multiply belonging to a plurality of user closed networks to perform independent operations for every user closed networks, and to secure the closed property of user closed networks inside the multiply belonging server device. <P>SOLUTION: The execution environment of a user process is independently constructed for each of user closed networks in an application layer in a server device so that the use of an application or file between the different user closed networks can be made exclusive. The server device is provided with a network space where those execution environments are made privately independent, and it is logically separated from the network communication path of a server program operating in each execution environment on the network so that the closed property of the user closed networks inside the server device multiply belonging to the plurality of user closed networks can be secured. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention provides a server hosting service of multiple attribution to a plurality of different closed networks connected via the Internet, a private network, or a provider IP network (physically using a single server device to a plurality of user closed networks). The present invention relates to a server device such as a service that provides a server function as a virtual dedicated server) and an information sharing server service (a service that shares files, databases, and the like with a plurality of user closed networks via the server device).

  As a technique for operating a single server device as if each server is virtually dedicated to a plurality of different user networks, an execution space for applications and user commands in the user process layer of the server device In general, there is a method of preparing a plurality of execution environments that are usually prepared and assigning a dedicated execution environment (hereinafter referred to as a virtual execution environment) to each user network. This method uses the fact that the application and file handling is exclusive between user networks because the effective range of the application and file is closed in each virtual execution environment. A server apparatus using this method increases security and exclusiveness among users who use the server apparatus, and lowers the user cost through shared use.

  In recent years, a closed network is often used in order to reduce communication costs and perform safe communication. Closed networks are used not only by companies but also by SOHO (Small Office Home Office) users and individual users, and the number thereof is increasing. In addition, the use of closed networks has become smaller and more numerous, such as using closed networks for each department within a company. One way to provide server equipment for such a small closed network is to install a server equipment for each closed network, but it is actually used for the required operation and cost. There are many problems such as small amount.

Thus, a virtual server device for a multi-affiliation type closed network that operates as if there is a dedicated server device in each closed network using one physical server device is considered. In a closed network, a local address is generally used. When considering such a server device belonging to multiple user closed networks, it is necessary to ensure closeness between the user closed networks.
Here, it is assumed that the user closed networks A and B are connected to the server device, respectively. By assigning multiple virtual execution environments provided by the server device to A and B one by one, A and B do not know each other in the server device, as if the server device is a dedicated server Server programs can be executed and files can be manipulated.

  However, B can access the server program executed by A in its own virtual execution environment through network communication, resulting in a problem of loss of closeness between user closed networks. Normally, a different IP address is assigned to each server device for each user closed network, and it is logically impossible on the network to assign IP addresses in duplicate. B can use the server program of A by connecting to the IP address of the server device used by A. As a workaround for this problem, there is a method in which A sets access permission for each server program so as to refuse IP connections from other than the local address space used by its own client host. However, not all server programs are configurable and do not lead to a complete solution.

  Further, when the user closed networks A and B use the same local address space, and the IP address collides between the A client host and the B client host, the same IP address is assigned to the server device. There appears to be a problem that a plurality of hosts appear to exist and normal communication cannot be performed. As a workaround for this problem, a method of allocating a different local address space for each user network using the server device can be considered. However, when the user network using the server device and the number thereof dynamically change, there is a problem that both the user network administrator and the server device administrator need to manage the IP address very complicated. .

  Meanwhile, on the Internet, the TCP / IP protocol group is currently used for communication between devices such as a host and a router. The TCP / IP protocol group is called an Internet protocol stack (hereinafter simply referred to as a protocol stack). The protocol stack plays a role necessary for network communication, such as management of IP addresses, management of route (routing) information for packet delivery, and processing of each protocol packet.

Conventional server devices and routers have only one protocol stack in the lower layer of the user process layer. Server devices and routers can execute communication functions in the protocol stack and applications in the user process layer. Provide an environment.
Therefore, when providing a server device with multiple attribution to a plurality of different user closed networks, the communication function unit and the application execution environment unit of the server device are virtually separated for each user closed network, and a user in the server device is provided. It is necessary to ensure closeness between closed networks.

  In the server device in which only the communication function unit shown in Patent Document 1 is virtually separated, handling of files and applications is shared in the standard, and complicated exclusive processing between user closed networks is required separately. In a server device in which only the execution environment part is virtually separated (a server device using the jail function in the Free BSD community, a server device in which the User Mode Linux is introduced in the Linux community, etc.) In communication, complicated exclusion processing between user closed networks is required separately. These server devices have a virtual server service belonging to multiple different user closed networks due to complicated settings and operational restrictions to complement the lack of closed systems by server device administrators and user closed network administrators. Making it practical is difficult.

JP 2003-167805 A

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a communication function section and an application execution environment section in each physically one server device belonging to multiple user closed networks. An object of the present invention is to enable independent provision to each user closed network without sharing between the user closed networks, and to easily ensure the closeness between the user closed networks inside the server device.

  In order to achieve the above object, the present invention provides a server device having a plurality of virtual execution environments in a user process layer by providing one protocol stack in a lower layer of each virtual effective environment. The present invention is characterized in that the virtual server area of each user closed network inside the apparatus is divided without being shared.

  More specifically, the present invention connects simultaneously with a plurality of user closed networks, and has a virtual execution environment of an application independently for each user closed network in the user process layer, between different virtual execution environments. Is a server device that is physically exclusive for handling applications and files, and independently provides a communication protocol stack and a communication function of the communication protocol stack for each virtual execution environment. A server device is provided.

  Here, between the virtual execution environment and the protocol stack, the combination of the virtual execution environment and the protocol stack is stored, the virtual execution environment to which the server program belongs is recognized from the user process information of the server program, and the server program It is preferable to provide a link control mechanism for controlling the link between the protocol stack and the protocol stack according to the storage.

  Further, it is preferable that each of the virtual execution environments can use a plurality of IP addresses at the same time, and can use IP addresses between different virtual execution environments. Furthermore, it is preferable that the server program source code or binary can be used without modification.

  The operation of each of the server devices described above is preferably realized by computer control, and the technical scope of the present invention is a server device program for this purpose, and further, a computer storing the server device program. Needless to say, it extends to a readable storage medium.

  According to the present invention, a single physical server device belonging to a plurality of user closed networks can provide an independent server function to each user closed network, and the user closed network inside the server device can be provided. It is possible to easily ensure the closeness between.

  More specifically, according to the present invention, even in shared VPN (Virtual Private Network) server hosting, it is possible to have a closed property and confidentiality equivalent to a dedicated server. In addition, the construction and operation of virtual servers for multiple closed networks, which are required when implementing projects that require data exchange between multiple companies or when performing procurement operations, which are expected to increase in the future Expansion to housing services that provide

  In addition, since this service allows information to be linked with multiple other companies without modifying the company's closed network, it can be used as a new additional service for the IP-VPN service provided by ISPs (Internet Service Provider). Expansion is expected. Furthermore, it will be possible to develop portal site services for individuals as well as companies. As described above, the present invention can be used as a means for constructing a new information distribution platform for a closed network.

  Hereinafter, the present invention will be described in detail based on preferred embodiments shown in the accompanying drawings.

  FIG. 1 is a schematic diagram of a server device according to an embodiment of the present invention. In contrast to the conventional server device, in addition to the real environment unit 4, the communication protocol unit 5 in the kernel 5, the file system unit 6, the core unit 7, etc., the virtual execution environment units 1a, 1b,. A stack multiplex configuration unit 2 (in which TCP / IP protocol stacks 2a, 2b,... Are provided) and a system call interface unit link control unit 3 are newly provided.

  Each of the virtual execution environment units 1a, 1b,... Described above is an operation command, a server program 11, and a command that requests a specific “work” from the kernel. Are provided with a system call 12 described as a function and a shared library 13 loaded from the server program when the server program 11 is executed.

  The above-described protocol stack multiplexing configuration unit 2 includes a plurality of well-known TCP / IP protocol stacks shown in FIG. The link control unit 3 is located between the virtual execution environment units 1a, 1b,... Described above and the TCP / IPs 2a, 2b,. And a function for coupling the server program in the virtual execution environment unit to a predetermined TCP / IP protocol stack based on the stored contents.

  Hereinafter, the operation of the server device according to the present embodiment configured as described above will be described with reference to the operation flowchart shown in FIG.

Steps 21 and 22: Constructing a virtual execution environment By an operation command for determining the initialization operation of the virtual execution environment, the initialization sequence is executed as in the real environment to make the virtual execution environment active. In this case, a virtual execution environment can be constructed by using the above-mentioned existing OS, such as Free BSD jail or Linux UML (User Mode Linux). However, since jail and UML assume that one protocol stack is shared and used by multiple virtual execution environments, each virtual execution environment specifies a single IP address that is different from other virtual execution environments. Can only be used.
The virtual execution environment according to the present embodiment is a virtual execution environment equivalent to jail or UML in which an arbitrary protocol stack is specified instead of an IP address and is activated. At this point, the server program and files in the virtual execution environment are isolated from other virtual execution environments.

Steps 23 and 24: Server program execution and table writing When the virtual execution environment is activated, the information of the protocol stack used by the virtual execution environment reaches the link control unit 3. A user process such as an operation command or a server program executed in the virtual execution environment is stored in a process table in which various information such as a process ID (Identifier) and a group ID is stored. Information on whether or not it is operating, and identification information for specifying the virtual execution environment when operating in the virtual execution environment.

  The link control unit 3 that has received the information on the protocol stack used by the virtual execution environment stores the combination of the virtual execution environment and the protocol stack, and when the server program is started, the virtual execution environment to which the server program belongs from the process table And prepare for connecting the server program to a predetermined protocol stack.

  Note that in the virtual execution environments A, B, and C used by the respective user closed networks, local addresses are freely used, and here, IP addresses are assigned to the server devices. A assigns IP address a (192.168.1.1), B assigns IP address b (192.168.1.1), and C assigns IP address c (192.168.1.1). It shall be. Since local address space collisions are often seen between closed networks, in this embodiment, they are intentionally made to collide.

Steps 25 and 26: Binding (connection) with reference to the table
Each user closed network considers using a server device as a web server. When the server program for the web server is executed in the virtual execution environment A, the link control unit 3 refers to the process table of the server program and identifies the virtual execution environment that is the parent of the server program. The link control unit 3 performs control so that the above-described server program can be connected to a predetermined protocol stack based on a combination of a virtual execution environment and a protocol stack designated in advance. Once the link is established, the link is maintained until the aforementioned server program is closed. The same applies to the virtual execution environments B and C.

  A packet received from the outside of the server device, that is, from the user closed network side, is labeled with a layer 2 identifier such as VLAN (Virtual Local Area Network) or MPLS (Multi Protocol Label Switching). The VLAN-ID # 1 packet is transferred from the network interface of the server device to the protocol stack of the virtual execution environment A. Conversely, when transmitting to the user closed network side, when a packet is delivered from the protocol stack of the virtual execution environment A to the network interface, VLAN-ID # 1 is tagged and the virtual execution environment A is used. To the closed user network.

  The above operation is the same for the virtual execution environments B and C. This makes it impossible to access the IP address of the virtual execution environment B and also the web server on the network from the user closed network side terminal using the virtual execution environment A and the virtual execution environment A inside. .

  Subsequent processing (packet transmission / reception processing, etc.) is as shown in steps 27 to 29. Since this portion is the same as normal processing, detailed description thereof is omitted.

  As described above, with the server device according to the present embodiment as described with a specific example, the communication function unit, the application execution environment unit, and the like in the physically single server device belonging to multiple user closed networks. Can be provided independently to each user closed network without being shared among the user closed networks, and the closeness between the user closed networks inside the server apparatus can be easily secured.

  The above embodiment is merely an example of the present invention, and the present invention is not limited to this, and appropriate modifications and improvements may be made without departing from the spirit of the present invention. Needless to say, it is good.

  For example, the operation of the server device described above is preferably realized by computer control, and the technical scope of the present invention is read by a server device program for this purpose, and further by a computer storing the server device program. It goes without saying that it extends to possible storage media.

  As described above, according to the present invention, even with shared VPN server hosting, it is possible to have closeness and confidentiality equivalent to a dedicated server. In addition, it provides the construction and operation of virtual servers for multiple closed networks that are required when implementing projects that require data exchange between multiple companies, which are expected to increase in the future, and when performing procurement operations. Development into a housing service is possible.

  In addition, since this service allows information to be linked with multiple other companies without modifying the company's closed network, it can be expected to be developed as a new additional service for the IP-VPN service provided by the ISPs mentioned above. . Furthermore, it will be possible to develop portal site services for individuals as well as companies. As described above, the present invention can be used as a means for constructing a new information distribution platform for a closed network.

It is a schematic diagram which shows the server apparatus which concerns on one Embodiment of this invention. It is a block diagram of a single TCP / IP protocol stack. It is an operation | movement flowchart of the server apparatus which concerns on one Embodiment.

Explanation of symbols

1a, 1b,... Virtual execution environment section 2 Protocol stack multiplex configuration section 2a, 2b,... TCP / IP protocol stack 3 Link control section 4 Real environment section 5 Communication protocol section 6 File system section 7 Core section 11 Server program 12 System call 13 Shared library

Claims (6)

A plurality of user closed networks are connected simultaneously, and a virtual execution environment of an application is independently provided for each user closed network in a user process layer,
It is one server device that is physically exclusive to handling applications and files between different virtual execution environments,
A server apparatus characterized by independently providing a communication protocol stack and a communication function of the communication protocol stack for each virtual execution environment.   Between the virtual execution environment and the protocol stack, storing the combination of the virtual execution environment and the protocol stack, recognizing the virtual execution environment to which the server program belongs from the user process information of the server program, and the server program and the protocol stack 2. The server apparatus according to claim 1, further comprising a link control mechanism that controls a link between the first link and the second link according to the storage.   3. The server apparatus according to claim 1, wherein each of the virtual execution environments can use a plurality of IP addresses simultaneously, and can use IP addresses between different virtual execution environments.   The server apparatus according to any one of claims 1 to 3, wherein the server apparatus can be used without modifying the source code or binary of the server program.   The program for server apparatuses for implement | achieving operation | movement of the server apparatus of any one of Claims 1-4 by computer control.   A computer-readable storage medium storing the server device program according to claim 5.

Images