JP2012221255A - Information processing system, information processor and information processing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform access from a public network to a network isolated from the public network.SOLUTION: In an information processing system including an internal server connected to a private network and an external server arranged in a DMZ, the internal server includes an application processing part for executing an application program which responds to a received access request, and the external server includes: a conversion part for converting an access request from an external terminal into the access request whose destination is set to the internal server; a first transmission part for transmitting the converted access request to the internal server; an acquisition part for acquiring the execution result of the application program from the internal server; a second transmission part for transmitting the execution result to the external terminal; and a storage part for storing a predetermined Web page. When the first transmission part is not able to transmit the access request received from the external terminal to the internal server, the second transmission part of the external server transmits the predetermined Web page to the external terminal.

Description

  The present invention relates to a technique for providing information to a terminal via the Internet.

  Conventionally, notification of medical expenses, etc. from the health insurance association to each office has been made by printing on paper. Notifications from health insurance associations printed on paper to each office are mailed to each office in a lump and distributed to each subscriber at each office through an in-house logistics system. In addition, submission of materials from business establishments to the health insurance association is done in printed form on paper and is submitted by mail or using an in-house logistics system.

JP 2001-167201 A

  However, the distribution method and the submission method as described above have a problem of requiring paper and delivery costs. Furthermore, information cannot be acquired when the subscriber desires, and convenience is lacking.

  Therefore, a system that enables the exchange of information between the health insurance association and each business operator or each subscriber via a network is desired. However, since the network of the health insurance association handles highly confidential personal information and is a secure network that is isolated from the public network, it has been difficult to make it accessible from the Internet.

  In view of the above problems, an object of the present invention is to provide an information processing system that enables access from a public network to a network that is isolated from the public network.

  One aspect of the present invention is an information processing system including an internal server connected to a private network and an external server arranged in a DMZ (DeMilitarized Zone). An internal server in the information processing system includes an application processing unit that executes a plurality of application programs and an application program corresponding to an access request transmitted from an internal terminal connected to a private network and an access request transmitted from an external server. . An external server in this information processing system includes a conversion unit that converts an access request transmitted from an external terminal via a public network to an internal server, and a first transmission unit that transmits the converted access request to the internal server. An acquisition unit that acquires an execution result of an application program in response to an access request from an external terminal, a second transmission unit that transmits the execution result to the external terminal via a public network, and a predetermined web page And a second transmission unit, when the first transmission unit cannot transmit the access request received from the external terminal to the internal server, a predetermined web page held in the storage unit Send to external terminal. An internal terminal is a terminal connected to a private network. An external terminal is a terminal connected to a public network such as the Internet, for example.

  According to one information processing system of an aspect of the present invention, since an access request from an external terminal is transmitted to the internal server via the external server in the DMZ, the external terminal is prevented from accessing the private network. Can do. Further, when the external server includes a storage unit that holds a predetermined web page, and the access request received from the external terminal cannot be transmitted to the internal server, the predetermined web page held in the storage unit is transmitted to the external terminal. . Since such processing does not include processing by the internal server, the processing load can be distributed in the information processing system.

  In the information processing system according to the aspect of the present invention, the plurality of application programs held by the internal server are divided into those for the internal terminal and those for the external terminal, and the application processing unit of the internal server is An internal application program may be executed for the access request, and an external terminal application program may be executed for the access request from the external server. By dividing the application program into an internal terminal and an external terminal, the private network can be more reliably isolated from the external network.

  In the information processing system according to the aspect of the present invention, the internal server may not execute a storage unit that stores a predetermined web page stored in the external server and an application corresponding to an access request from the internal terminal. A transmission unit that transmits a predetermined web page held in the storage unit to the internal terminal may be further included. In this case, when the internal server cannot execute the application corresponding to the access request, the internal server transmits a predetermined web page to the internal terminal, and the external server transmits the predetermined web page to the external terminal. . That is, the processing load can be distributed between the internal server and the external server.

  Furthermore, the present invention can be grasped as a method, an apparatus, or a program as one aspect. In addition, one aspect of the present invention may be a program in which the above-described program is recorded on a recording medium that can be read by a computer, other devices, machines, or the like. Here, a computer-readable recording medium is a recording medium that stores information such as data and programs by electrical, magnetic, optical, mechanical, or chemical action and can be read from a computer or the like. Say.

  According to the present invention, a private network isolated from a public network can be accessed from a terminal connected to the public network.

It is a figure which shows the structural example of the web system of 1st Embodiment. It is a figure which shows the example of the hardware constitutions of an internal web server and an external web server. It is a figure which shows the example of the functional block of an internal web server. It is an example of the flowchart of a process of an internal web server. It is a figure which shows the example of the functional block of an external web server. It is an example of the flowchart of a process of an external web server. It is a figure which shows the example of the sequence of the web communication to the web system at the normal time. It is a figure which shows the sequence of the web communication to a web system when an application is in an inaccessible state by a maintenance.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. The configuration of the following embodiment is an exemplification, and the present invention is not limited to the configuration of the embodiment.

<First Embodiment>
FIG. 1 is a diagram illustrating a configuration example of a web system according to the first embodiment. The web system 1 is a system that enables access from an external network to a web server that provides health insurance association information.

  The web system 1 includes a health insurance association web system 110 (hereinafter referred to as a health insurance web system) and an external web system 120. The health insurance web system 110 is a system that manages information on hundreds of health insurance societies and social insurance societies and information on each subscriber, and provides information through web services. However, the health insurance web system 110 is a system that exists in a private network (intranet) isolated from any public network. To this private network, terminals of contracted health insurance associations and social insurance associations can be connected. The external web system 120 is a system that provides a web service similar to the web service provided by the health insurance web system 110 toward the terminal used by each office or each subscriber. The external web system 120 is arranged in a DMZ (DeMilitarized Zone), that is, in an area that is also isolated from a public insurance network such as the Internet by a firewall.

  Hereinafter, “internal” refers to the health insurance web system 110 and the health insurance association with which the contract is made, and the private network side where the health insurance web system 120 exists is referred to as “internal network”. Further, in contrast to “inside”, a system, a terminal, or the like existing in a public network such as the Internet is referred to as “outside”.

  The health insurance web system 110 includes an internal web server 1 and a database server 2. The internal web server 1 has a function as a web server that provides a web access interface to an internal terminal, and a function as an application server that provides a service for the web access. The database server 2 is a server that manages a database that holds information on health insurance societies and social insurance societies and information on each subscriber. An internal terminal is a terminal used by a user of a health insurance association or social insurance association belonging to an internal network, for example.

  The external web system 120 includes an external web server 3 and a DNS (Domain Name System) server 4. The external web server 3 is a web server that provides an external terminal with a web access interface to the health web system 110 via the Internet. The external terminal is, for example, a PC used in an office, a PC used by each subscriber, a mobile phone terminal, or the like. When the external web server 3 receives an access request for an application provided by the internal web server from an external terminal, the external web server 3 accesses the internal web server 1 which is an application server, and the web page between the internal web server 1 and the access request source terminal. Relay the exchange. The DNS server 4 is a server that performs name resolution for searching for an IP address from a domain name. For example, a name for searching for the IP address of the external web server 4 from a URL (Uniform Resource Locator) in response to a request from an external terminal. Make a solution.

  Although not shown in FIG. 1, a router having a firewall function exists between the internal web server 1 and the external web server 3. Communication between the internal web server 1 and the external web server 3 is performed via this router. Therefore, this router is a boundary between the inside and the outside (including DMZ).

<Internal web server>
FIG. 2 is a diagram illustrating an example of a hardware configuration of the internal web server 1. The internal web server 1 is, for example, a general-purpose computer or a dedicated computer. The internal web server 1 includes a control unit 101, an input device 103, an output device 104, an auxiliary storage device 105, a portable recording medium drive device 106, and a network interface 107, which are electrically connected to each other via a bus 109. Information processing apparatus.

  The input device 103 is, for example, a pointing device such as a keyboard and a mouse. Data input from the input device 103 is output to the control unit 101.

  The network interface 107 is an interface for inputting / outputting information to / from the network. The network interface 107 is connected to a wired network. The network interface 107 is, for example, a NIC (Network Interface Card) for connecting to a LAN (Local Area Network) to which a relay device (not shown) such as a router is connected. Data received by the network interface 107 is output to the control unit 101.

The auxiliary storage device 105 stores various programs and data used by the control unit 101 when executing each program. The auxiliary storage device 105 is, for example, an EPROM (Erasable
Programmable ROM) and hard disk (Hard Drive Disc). The auxiliary storage device 105 holds, for example, an operating system (OS), an internal web server program, and other various application programs.

  The portable recording medium driving device 106 drives the portable recording medium and reads data recorded on the portable recording medium. The read data is output to the control unit 101. The portable recording medium is, for example, a USB (Universal Serial Bus) memory, a CD (Compact Disc), a disc recording medium such as a DVD (Digital Versatile Disc), or a recording medium such as a flash memory card.

The control unit 101 includes a processor 101a and a RAM 101b. The processor 101a is, for example, a CPU (Central Processing Unit) or a DSP (Digital Signal Processor). The processor 101a executes various processes by loading the OS and various application programs held in the auxiliary storage device 105 into the main storage device 101b and executing them. Note that the control unit 101 may include a plurality of processors 101a.

  The main storage device 101b is a storage device that provides the processor 101a with a storage area and a work area for loading a program stored in the auxiliary storage device 105, and is used as a buffer. The main storage device 101b is a semiconductor memory such as a RAM (Random Access Memory), for example.

  The output device 104 outputs the processing result of the control unit 101. The output device 104 is a display or a printer.

  The hardware configuration of the internal web server 1 can be changed (replaced, added, or deleted) as appropriate depending on the configuration of the web system 100. For example, the internal web server 1 may not include the input device 103 and the output device 104.

FIG. 3 is a diagram illustrating an example of functional blocks of the internal web server 1. The control unit 101 of the internal web server 1 operates as the web server unit 11, the application server unit 12, and the packet distribution unit 14 by executing the internal web server program. The internal web server 1 further includes a storage unit 13. For example, the storage unit 13 is created in advance in the storage area of the auxiliary storage device 105 when the internal web server program is installed.

  The internal web server 1 includes a plurality of types of application programs (hereinafter simply referred to as applications). For example, the application includes an application for searching for information in a database managed by the database server 2 and an application for receiving information stored in the database via a network. The applications are divided into those for internal terminals and those for external terminals even if they are the same type of application. For example, the application for the internal terminal is an application for a health insurance association and an application for a social insurance association. For example, the application for the external terminal is a business application or a subscriber application. As described above, the application is divided into an internal terminal and an external terminal, and different URLs are assigned to the respective applications. In this way, by dividing the application for internal terminals and external terminals, the internal terminal and the external terminal are prevented from accessing the same application, and the internal and external are thoroughly separated. . Note that the application in the first embodiment is, for example, an application that controls a series of web access processes from login to logout. However, it is not limited to this.

  The packet distribution unit 14 distributes the packet to the web server unit 11 or the application server unit 12 according to the header of the received access request packet. For example, the packet distribution unit 14 distributes access requests from internal terminals to the web server unit 11 and access requests from the external web server 3 to the application server unit 12.

  The web server unit 11 has a function as a web server. The web server unit 11 includes an external access restriction unit 111 and a web server processing unit 112. The external access restriction unit 111 restricts access to an external terminal application by an internal terminal. For example, when the access request from the internal terminal is distributed by the packet distribution unit 14, the external access restriction unit 111 permits only an access request to the application (URL) for the internal terminal, and rejects (prohibits) otherwise. ) The web server processing unit 112 executes processing as a web server. Specifically, when the access is denied by the external access restriction unit 111 or when the application or the database server 2 cannot be accessed due to maintenance or the like, the web page including the message is read from the storage unit 13 and the access request source internal Send to the terminal. Further, when the access is permitted by the external access restriction unit 111 and the application can be accessed, the access request is transferred to the application server unit 12. When a web page including an application execution result is passed as a response from the application server unit 12, the web server processing unit 112 transmits the web page to the internal terminal that is the transmission source of the access request.

  The application server unit 12 has a function as an application server. The application server unit 12 includes an application processing unit 121 and a database access processing unit 122.

  The application processing unit 121 executes an application corresponding to the URL included in the access request, and transmits a web page including the execution result to the application processing request source (the web server processing unit 112 or the external web server 3). The database access processing unit 122 requests the database server 4 to execute the processing when the processing related to the database occurs in the execution process of the application program by the application processing unit 121, and acquires the processing result. The processing related to the database is, for example, retrieval or extraction of information in the database.

The storage unit 13 holds a URL list of web pages and applications provided in the internal web server 1. The web page held in the storage unit 13 is, for example, a web page including a login screen used by each application, a sorry page for notifying access in maintenance, etc., and access is denied due to access restrictions. An inaccessible notification page that notifies

  FIG. 4 is an example of a flowchart of processing of the internal web server 1. The flowchart shown in FIG. 4 is started when the internal web server 1 receives an access request via the network interface 107. For example, the flowchart shown in FIG. 4 is executed when the control unit 101 of the internal web server 1 operates as the web server unit 11, the application server unit 12, and the packet distribution unit 14 through the execution of the internal web server program. .

  In S <b> 1, the control unit 101 determines whether or not the received access request is transmitted from the external web server 3. This determination is performed, for example, by confirming the source IP address of the packet. If the access request is sent from the external web server 3 (S1: Yes), the process proceeds to S6. If the access request is not transmitted from the external web server 3, that is, if it is an access request transmitted from the internal terminal (S1: No), the process proceeds to S2.

  In S2, since the access request is transmitted from the internal terminal, the control unit 101 determines whether or not the access request can be made. Whether or not an access request can be made is determined, for example, by referring to a URL list held in the storage unit 13 and determining whether or not the URL included in the access request is a URL of an internal application. When the URL included in the access request is the URL of an internal application, the access request is permitted. When the URL included in the access request is the URL of an external application, and when there is no URL included in the access request, the access request is rejected. If the access request is permitted (S2: Yes), the process proceeds to S4. If the access request is rejected (S2: No), the process proceeds to S3.

  In S3, because the access request is rejected, the control unit 101 reads out the inaccessible notification page from the storage unit 13, and transmits it to the access request transmission source (internal terminal). Thereafter, the processing shown in FIG. 4 ends.

  In S4, since the access request is permitted, the control unit 101 determines whether or not the requested application is accessible. If the requested application is accessible (S4: Yes), the process proceeds to S6. For example, if the application requested during maintenance or an error is inaccessible (S4: No), the process proceeds to S5.

  In S5, since the requested application is inaccessible, the control unit 101 reads the sorry page from the storage unit 13 and transmits it to the transmission source (internal terminal) of the access request. Thereafter, the processing shown in FIG. 4 ends.

  In S6, since the access request is transmitted from the external web server 3 or the application requested by the access request transmitted from the internal terminal is accessible, the control unit 101 performs requested application processing. Execute. In S7, the control unit 101 transmits a web page including the execution result of the requested application to the access request transmission source (internal terminal or external terminal). Thereafter, the processing shown in FIG. 4 ends.

  The process of S1 corresponds to the packet distribution unit 14. The process of S2 corresponds to the external access restriction unit 111. The processing of S3-S5 corresponds to the web server processing unit 112. The process of S6 corresponds to the application processing unit 121 and the database access processing unit 122. The process of S7 corresponds to the application processing unit 121 (when an access request is received from an external web server) or the web server processing unit 112 (when an access request is received from an internal terminal).

<External web server>
The external web server 3 is, for example, a general-purpose computer or a dedicated computer. Since the hardware configuration of the external web server 3 is almost the same as that of the internal web server 1, a description of common parts is omitted with reference to FIG. The external web server 3 includes a control unit 301, an input device 303, an output device 304, an auxiliary storage device 305, a portable recording medium drive device 306, and a network interface 307, which are electrically connected to each other via a bus 309. Information processing apparatus.

  The auxiliary storage device 305 holds, for example, an operating system (OS), an external web server program, and other various application programs.

  The hardware configuration of the external web server 3 can be changed (replaced, added, or deleted) as appropriate depending on the configuration of the web system 100. For example, the external web server 3 may not include the input device 303 and the output device 304.

  FIG. 5 is a diagram illustrating an example of functional blocks of the external web server 3. The control unit 301 of the external web server 3 operates as an internal access restriction unit 31, a web server processing unit 32, a conversion unit 33, a client processing unit 34, and a packet distribution unit 37 by executing an external web server program. The external web server 3 further includes a storage unit 36. The storage unit 36 is created in advance in the storage area of the auxiliary storage device 305 at the time of installation of the external web server program, for example.

  The packet distributor 37 distributes received packets. For example, when the received packet is an access request to the external web server 3, the packet distribution unit 37 distributes the received packet to the internal access control unit 31. For example, when the received packet is a return packet, the packet distribution unit 37 distributes the received packet to the client processing unit 34. The return packet is a response packet to a packet transmitted from the external web server 3, for example, a web page packet corresponding to an access request transmitted from the external web server 3 to the internal web server 1.

  The internal access restriction unit 31 restricts access from the external terminal to the internal application. For example, when receiving a packet, the internal access restriction unit 31 rejects (inhibits) access to an internal address from an external terminal using an access list. For example, when the access request from the external terminal is distributed by the packet distribution unit 37, the internal unit access restriction unit 31 permits only the access request to the application (URL) for the external terminal, and rejects otherwise ( Ban.

  The web server processing unit 32 determines whether the application in the internal web server 1 requested by the access request permitted by the internal access restriction unit 31 is accessible. For example, when an application requested for maintenance or an error cannot be accessed, the web server processing unit 32 rejects the access request. If the requested application is accessible, the web server processing unit 32 permits the access request.

  Further, the web server processing unit 32 stores a web page including a message when the access request is denied by the internal access restriction unit 31 or when the application requested by the access request is inaccessible. The data is read from 36 and transmitted to the external terminal that is the source of the access request. Specifically, the web server processing unit 32 reads out and transmits an access impossibility notification page for notifying access impossibility to the external terminal that has transmitted the access request rejected by the internal access restriction unit 31 from the storage unit 36. When the application requested by the access request is not accessible, the web server processing unit 32 reads the sorry page from the storage unit 36 and transmits it to the external terminal that is the source of the access request.

  The conversion unit 33 performs a conversion process on an access request that is permitted by the internal access restriction unit 31 and is accessible to the requested application. For example, the conversion unit 33 converts the destination IP address of the access request from the IP address of the external web server 3 to the IP address of the internal web server 1. The conversion unit 33 converts the access request source IP address from the IP address of the access request source terminal (external terminal) to the IP address of the external web server 3. Further, the conversion unit 33 converts the destination port number of the access request. For example, the access from the external terminal to the external web server 3 is performed by HTTPS (port number 443) with high security because it passes through the Internet. For example, when the external web server 3 accesses the internal web server 1 as an application server, it is performed by JBOSS (8009). In such a case, the conversion unit 33 converts the destination port number of the access request from 443 to 8009. The conversion information before and after conversion of the received packet, which is an access request, is stored in, for example, a cache created in the work area in the main storage device 301b.

  The client processing unit 34 is a processing unit that makes an application request to the internal web server 1 as an application server. Specifically, the client processing unit 34 transmits an access request for which the conversion process has been executed by the conversion unit 33 to the internal web server 1, and acquires a web page including an execution result of the application from the internal web server 1. The acquired web page is converted by the conversion unit 33 using the cached conversion information, and is transmitted by the web server processing unit 32 to the external terminal that is the transmission source of the access request.

  The storage unit 36 holds a web page and a URL list of applications held by the internal web server 1. The web pages held in the storage unit 36 are, for example, a sorry page for notifying that access is not possible due to maintenance, an inaccessible notification page for notifying that access is denied due to access restrictions, and the like. The Story page, the inaccessible notification page, and the URL list held in the storage unit 36 are the same as those stored in the storage unit 13 of the internal web server 1.

  FIG. 6 is an example of a flowchart of processing of the external web server 3. The flowchart shown in FIG. 6 is started when the external web server 3 receives a packet. For example, in the flowchart shown in FIG. 6, the control unit 301 of the external web server 3 allows the internal access restriction unit 31, the web server processing unit 32, the conversion unit 33, the web client processing unit 34, and the like through the execution of the external web server program. It is executed by operating as the packet distribution unit 37.

In S <b> 11, the control unit 301 determines whether the received packet is a return packet from the internal web server 1. This determination is performed, for example, by referring to cached conversion information or referring to information (IP address, port number, etc.) included in the packet header. If the received packet is a return packet (S11: Yes), the process is S
Proceed to 16. If the received packet is not a return packet from the internal web server 1 (S11: No), the process proceeds to S12.

  In S12, since the received packet is not a return packet, that is, the received packet is an access request from an external terminal, the control unit 301 determines whether or not an access request can be made. Whether or not an access request can be made is determined, for example, by referring to a URL list held in the storage unit 36 and determining whether or not the URL included in the access request is a URL of an external application. If the URL included in the access request is the URL of an external application, the access request is permitted. When the URL included in the access request is the URL of an internal application, and when the URL included in the access request does not exist in the URL list, the access request is rejected. If the access request is permitted (S12: Yes), the process proceeds to S14. If the access request is rejected (S12: No), the process proceeds to S13.

  In S13, since the access request has been rejected, the control unit 301 reads the inaccessible notification page from the storage unit 36 and transmits it to the access request transmission source (external terminal). Thereafter, the process shown in FIG. 6 ends.

  In S14, since the access request is permitted, the control unit 301 determines whether or not the application requested by the access request is accessible. Whether or not the application requested by the access request is accessible may be determined based on, for example, whether or not notification from the internal web server 1 has been received in advance. If there is no response, it may be determined that access is not possible. When the application requested by the access request is accessible (S14: Yes), the process proceeds to S16. If the application requested by the access request is in an inaccessible state (S14: No), the process proceeds to S15.

  In S15, since the application requested by the access request is inaccessible, the control unit 301 reads the sorry page from the storage unit 36, accesses it, and transmits it to the request transmission source (external terminal). Thereafter, the process shown in FIG. 6 ends.

  In S16, the control unit 301 performs the above-described conversion process on the received packet. In S17, the control unit 301 transmits the received packet to the converted destination. Specifically, in the processing of S16 and S17, when the received packet is a return packet from the internal web server 1, the control unit 301 converts the received packet according to the conversion information (the destination is the source of the access request). The received packet is transmitted to the external terminal. If the received packet is an access request from an external terminal, the processing in S16 and S17 is performed by the control unit 301 using the destination IP address as the IP address of the internal web server 1 and the source IP address as the IP address of the external web server. The destination port is converted into an address of 8009, and the converted received packet is transmitted to the internal web server 1. Thereafter, the process shown in FIG. 6 ends.

  The process of S11 corresponds to the packet distribution unit 37. The process of S12 corresponds to the internal access restriction unit 31. The process of S13-15 corresponds to the web server processing unit 32. The processes of S16 and S17 correspond to the conversion unit 33 and the web client unit 34, or the conversion unit 33 and the web server processing unit 32.

<Operation example>
FIG. 7 is a diagram illustrating an example of a sequence of web communication to the web system 100 at a normal time. OP1 to OP4 in FIG. 7 show sequences when an access request is transmitted from the internal terminal to the internal web server 1.

  In OP1, the internal terminal transmits an access request from the web browser to the internal web server 1. Web communication between the internal terminal and the internal web server 1 is performed within the internal network (intranet) and security is maintained, and thus is performed using, for example, HTTP (port number 80).

  In OP2, the internal web server 1 receives an access request from the internal terminal and executes an application requested by the access request (S1, S2, S4, S6). As the application is executed, the internal web server 1 requests the database server 2 to read predetermined information. In OP3, the database server 2 transmits the requested information to the internal web server 1. For information exchange between the internal web server 1 and the database server 2 of OP2 and OP3, for example, a file sharing protocol such as Microsoft-DS (port number 445) or a connection function to an Oracle database (port number 1521) Is used.

  In OP4, the internal web server 1 transmits a web page including the execution result of the application to the internal terminal that is the transmission source of the access request (S7). Note that the processing of OP2 and OP3 is omitted when it is not necessary to execute the application.

  Next, OP11 to OP16 in FIG. 7 are sequences when an access request is transmitted from the external terminal to the external web server 3 via the Internet.

  In OP11, the external terminal transmits an access request to the external web server 3 from the web browser. Since web communication between the external terminal and the external web server 3 is performed via the Internet, for example, HTTPS (port number 443) is used to protect security.

  In OP12, the external web server 3 receives the access request from the external terminal, performs the above-described conversion processing on the access request, and transmits the converted access request to the internal web server 1 (S11, S12, S14, S16, S17). Web communication between the external web server 3 and the internal web server 1 is performed by, for example, JBOSS (port number 8009).

  In OP13, the internal web server 1 receives the access request from the external web server, and executes the application requested by the access request (S1, S6). As the application is executed, the internal web server 1 requests the database server 2 to read predetermined information (port number 1521 or 445). In OP14, the database server 2 transmits the requested information to the internal web server 1.

  In OP15, the internal web server 1 transmits a web page including the execution result of the application to the external web server 3 (S7). In OP16, the external web server 3 receives the web page including the execution result of the application from the internal web server 1, executes the conversion process, and transmits it to the internal terminal that is the source of the access request (S11, S16, S17). ).

  FIG. 8 is a diagram illustrating a sequence when the application is in an inaccessible state due to maintenance. OP21 to OP22 in FIG. 8 show a sequence when an access request is transmitted from the internal terminal to the internal web server 1.

  In OP21, the internal terminal transmits an access request from the web browser to the internal web server 1 (port number 80).

  In OP22, the internal web server 1 receives an access request from the internal terminal. However, since the requested application is inaccessible due to maintenance, the internal web server 1 transmits the sorry page to the internal terminal that is the source of the access request (S1, S2, S4, S5).

  Next, OP31 to OP32 in FIG. 8 are sequences when an access request is transmitted from the external terminal to the external web server 3 via the Internet.

  In OP31, the external terminal transmits an access request to the external web server 3 from the web browser (port number 443).

  In OP32, the external web server 3 receives an access request from an external terminal. However, since the requested application is inaccessible due to maintenance, the external web server 3 transmits the sorry page to the external terminal that has transmitted the access request (S11, S12, S14, S15).

  Note that the same sequence as OP21-OP22 or OP31-OP32 also occurs when an access request is denied due to access restrictions.

<Operational effects of the first embodiment>
In the first embodiment, an external external web server 3 is arranged in the DMZ, and the external web server 3 relays an access request from an external terminal received via the Internet to the internal web server 1. The internal web server 1 operates as an application server, and holds applications separately for internal terminals and external terminals. Further, the external web server 3 performs access restriction so that the external terminal cannot access the internal application. As a result, the health insurance association network can be provided to businesses and subscribers via the Internet while isolating the health insurance association network from the public network such as the Internet. Thus, paper and delivery costs can be reduced.

  In the first embodiment, the external web server 3 holds the same web page as the sorry page and the inaccessible notification page held by the internal web server 1. When the external web server 3 cannot transfer the access request from the external terminal to the internal web server 1, such as when the access request received from the external terminal is rejected or when the requested application is inaccessible Then, an appropriate web page is transmitted to the external terminal that is the source of the access request. The number of accesses expected from the outside is much larger between the number of accesses expected internally and the number of accesses expected from the outside. For this reason, the load of the internal web server 1 can be distributed when the external web server 3 performs part of the processing of the internal web server 1 as a web server.

DESCRIPTION OF SYMBOLS 1 Internal web server 2 Database server 3 External web server 4 DNS server 11 Web server part 12 Application server part 13, 36 Storage part 14, 37 Packet distribution part 31 Internal access restriction part 32, 112 Web server processing part 33 Conversion part 34 Client Processing unit 100 Web system 110 Health insurance association system 111 External access restriction unit 120 External system 121 Application processing unit 122 Database access processing unit

Claims (10)

An information processing system including an internal server connected to a private network and an external server arranged in a DMZ (DeMilitarized Zone),
The internal server is
Multiple application programs,
An application processing unit that executes an application program corresponding to an access request transmitted from an internal terminal connected to the private network and an access request transmitted from the external server;
The external server is
A conversion unit that converts an access request transmitted from an external terminal via a public network to the internal server;
A first transmitter for transmitting the converted access request to the internal server;
An acquisition unit that acquires an execution result of the application program in response to the access request from the external terminal from the internal server;
A second transmitter that transmits the execution result to the external terminal via the public network;
A storage unit for holding a predetermined web page,
The second transmission unit of the external server transmits the predetermined web page held in the storage unit when the access request received from the external terminal by the first transmission unit cannot be transmitted to the internal server. An information processing system for transmitting to the external terminal. The plurality of application programs are divided into internal terminals and external terminals,
The application processing unit executes the internal application program for an access request from the internal terminal, and executes the external terminal application program for an access request from the external server.
The information processing system according to claim 1. The external server is
The information processing system according to claim 1, further comprising a control unit that determines whether or not the access request can be transmitted to the internal server based on address information included in the access request from the external terminal. The said control part determines that the said access request cannot be transmitted to the said internal server, when the address information contained in the access request from the said external terminal shows the application program for the said internal terminals. Information processing system. The internal server is
The information according to any one of claims 1 to 4, further comprising: a determination unit that determines whether or not the application program according to the access request can be executed based on address information included in the access request from the internal terminal. Processing system. 6. The determination unit according to claim 5, wherein when the address information included in the access request from the internal terminal indicates an application program for the external terminal, the determination unit determines whether to reject the execution of the application program according to the access request. Information processing system. The internal server is
A storage unit for holding the predetermined web page held in the external server;
A transmission unit that transmits the predetermined web page held in the storage unit to the internal terminal when an application according to an access request from the internal terminal cannot be executed;
The information processing system according to any one of claims 1 to 6, further comprising: An information processing apparatus as the external server in an information processing system that includes an internal server that is connected to a private network and can execute an application, and an external server that is arranged in a DMZ (DeMilitarized Zone),
A conversion unit that converts an access request transmitted from an external terminal via a public network to the internal server;
A first transmitter for transmitting the converted access request to the internal server;
An acquisition unit for acquiring an execution result of the application program according to the access request from the internal server;
A second transmitter that transmits the execution result to the external terminal via the public network;
A storage unit for holding a predetermined web page,
The second transmission unit transmits the predetermined web page held in the storage unit to the external terminal when the first transmission unit cannot transmit the access request received from the external terminal to the internal server. Information processing device to transmit. An information processing apparatus as the internal server in an information processing system including an internal server connected to a private network and an external server arranged in a DMZ (DeMilitarized Zone),
Multiple application programs,
An application processing unit that executes an application program corresponding to an access request transmitted from an internal terminal connected to the private network and an access request transmitted from the external server;
A storage unit for holding a predetermined web page;
A transmission unit that transmits the predetermined web page held in the storage unit to the internal terminal when an application according to an access request from the internal terminal cannot be executed;
An information processing apparatus comprising: Executed in an information processing system including an internal server that connects to a private network and holds a plurality of application programs, and an external server that is arranged in a DMZ (DeMilitarized Zone) and has a storage unit that holds a predetermined web page An information processing method,
The external server is
A conversion step of converting an access request transmitted from an external terminal via a public network to the internal server;
A first transmission step of transmitting the converted access request to the internal server;
The internal server is
An application execution step of executing an application program corresponding to an access request transmitted from an internal terminal connected to the private network and an access request transmitted from the external server;
The external server is
An acquisition step of acquiring an execution result of the application program according to the access request from the external terminal from the internal server;
A second transmission step of transmitting the execution result to the external terminal via the public network;
An information processing method including
When the external server cannot transmit the access request received from the external terminal to the internal server in the first transmission step, the external server transmits the predetermined web page held in the storage unit to the external terminal. Information processing method.

Images