JP2022134913A - Service linkage system - Google Patents

Abstract

To provide a service linkage system that enables easy linkage between external services and resources on a user's network while avoiding risks such as unauthorized access.SOLUTION: A service linkage system 10 comprises a linkage service 16 on the Internet 11 that can be connected to an external service 12. The service linkage system 10 software 21 on a network 13 that acquires an instruction from the external service 12 in the linkage service 16 using a general-purpose protocol, and executes the instruction on the network 13 of a user to send results obtained from resources 14 of the network 13 to the linkage service 16.SELECTED DRAWING: Figure 1

Description

The present invention relates to a service linking system that links external services and resources on a user's network.

In recent years, the widespread use of the Internet has made it possible to exchange information within and between companies, and to use various services provided outside the company, resulting in dramatic improvements in business productivity.

In recent years, in addition to simply using services, various systems used by users can be linked with external services on the Internet, or by combining and linking multiple external services. , it is possible to improve operational efficiency than before.

Japanese Patent Application Publication No. 2017-516410

In order to link the user's system with an external service on the Internet, it is necessary to connect the system of the user's corporate network and the external service.

In that case, since the security policy of the corporate network is different for each company, it is necessary to change the specifications of the corporate network and firewall settings according to the specifications of the external service. There are risks such as unauthorized access.

In order to avoid these risks, there is also a method of installing a device called VPN (Virtual Private Network). However, since setting up a VPN requires expertise, when using a VPN, companies that do not have personnel with specialized knowledge will need to ask a specialized vendor to do so.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a service linking system that can easily link an external service with resources on a user's network while avoiding risks such as unauthorized access. With the goal.

A service linking system according to claim 1 uses a linking service on the Internet that can be connected to an external service, and a general-purpose protocol to acquire commands from the external service in the linking service, and software on the network that executes the instructions on the network and sends results obtained from resources of the network to the federation service.

In the service cooperation system according to claim 2, in the service cooperation system according to claim 1, the software confirms whether or not there is an instruction for the cooperation service for a predetermined instruction waiting time, and if the instruction is present during this confirmation, is to take the instructions and execute them on the user's network.

According to claim 3, in the service cooperation system according to claim 1 or 2, the service for cooperation has a queue holding commands.

According to claim 4, in the service cooperation system according to any one of claims 1 to 3, the command is a specified command registered in the software in advance.

According to the present invention, it is possible to easily link external services and resources on the user's network while avoiding risks such as unauthorized access.

1 is a block diagram schematically showing a service cooperation system according to one embodiment of the present invention; FIG. FIG. 10 is an explanatory diagram showing a processing flow of the same service cooperation system; FIG. 4 is an explanatory diagram schematically showing connections between software of the same service cooperation system and cooperation services;

An embodiment of the present invention will be described below with reference to the drawings.

The embodiments may be practiced in network computing environments having many types of computing system configurations, including various types of computers such as personal computers, desktop computers, laptop computers, handheld devices, and the like.

In FIG. 1, 10 is a service cooperation system. The service linkage system 10 links the Internet (public cloud) 11 or an external service 12 connectable to the Internet 11 with a resource 14 on a user's network (on-premises) 13 such as an in-house network. A network is defined herein as one or more data links that enable the transport of electronic data between computing systems, modules, electronic devices, and the like. A firewall 15 is installed between the network 13 and the Internet 11 . The firewall 15 protects the network 13 from unauthorized access from the Internet 11 side to the network 13 side, that is, from the outside to the inside.

Examples of the external service 12 include software such as various applications or backends, and solutions or tools integrating multiple services such as information analysis and cooperation.

Examples of resources 14 include various applications, databases, servers, storages, files, directories, and the like.

The service cooperation system 10 also includes a cooperation service 16 on the Internet 11 that can be connected to the external service 12 . The cooperation service 16 can be connected to the external service 12 by using an application programming interface (API) implemented in the external service 12, for example. The API may be any API, but preferably a REST API is used.

A request queue 18 and a response queue 19 are preferably set in the cooperation service 16 . Request queue 18 is a queue that holds instructions sent from external service 12 . Response queue 19 is a queue that holds data to be returned to external service 12 .

Further, the service linking system 10 includes software 21 capable of communicating with the linking service 16 . Software 21 is installed on network 13 . For example, the software 21 is installed on a server or the like that can be accessed arbitrarily on the network 13 . The software 21 can communicate with the cooperation service 16 from the user's network 13 to the Internet 11 using a general-purpose protocol such as HTTP that is set to pass through the firewall 15 . For this communication, an environment-specific URL set in the cooperation service 16 is used as a connection port.

In the software 21, a controller 24 as a first program section, a requester 25 as a second program section, and a response queue 26 are set. The controller 24 is a communication unit or control unit that communicates with the cooperation service 16 . The controller 24 confirms and receives commands for the software 21 held in the request queue 18 of the cooperation service 16 . The controller 24 is pre-written and set with executable specified instructions (prescribed and permitted instructions).

Requester 25 is a request handler that executes instructions received from controller 24 and receives results from resource 14 . The requester 25 can connect to a driver provided in advance for each resource 14 using an API. Any API may be used as the API. Although the requester 25 is collectively shown in FIG. 1, it is set for each resource 14 type.

Response queue 26 is a queue that holds results received from resources 14 that have executed instructions by requester 25 .

Next, the operation of this embodiment will be described with reference to FIGS. 2 and 3 as well.

As an overview, when an external service 12 needs access to a resource 14 located within network 13 to provide information or process a request, external service 12 accesses resource 14 on network 13. When it decides to do so (step S1), an instruction is sent from the external service 12 to the cooperation service 16 on the Internet 11 (step S2).

The cooperation service 16 holds the command sent from the external service 12 in the request queue 18 .

The controller 24 of the software 21 connects to the request queue 18 of the cooperation service 16 by designating an environment-specific URL, and acquires instructions transmitted or held in the request queue 18 from the network 13 side. That is, the software 21 periodically communicates with the request queue 18 of the cooperation service 16 from the inside to the outside of the firewall 15 to check whether there is an instruction (step S3).

At this time, in the software 21, the controller 24 waits for an instruction from the request queue 18 of the cooperation service 16 for a predetermined instruction waiting time T1. For example, 30000 ms or the like is set as the command waiting time T1 so that the connection between the controller 24 and the request queue 18 of the cooperation service 16 continues for the command waiting time T1 (the connection is extended for a long time).

If there is no command until the command waiting time T1 passes, the software 21 (controller 24) once cuts off the communication (connection) with the cooperation service 16 (request queue 18), waits for a predetermined waiting time T2, and then waits for the cooperation. The instruction is checked again against the request queue 18 of the service 16 for use. The waiting time T2 is set shorter than the instruction waiting time T1, for example, 200 ms. Therefore, every time the controller 24 cuts off the communication with the cooperation service 16, the controller 24 reconnects the communication with the cooperation service 16 after the waiting time T2 has elapsed. That is, the software 21 periodically confirms whether or not there is an instruction for the cooperation service 16 over a predetermined instruction waiting time T1.

If an instruction is already held in request queue 18 upon connection, controller 24 of software 21 receives the instruction immediately. Also, when a command is sent to the request queue 18 while waiting for a command to the request queue 18, that is, while a connection is established, the controller 24 immediately receives the command.

Then, the software 21 executes the instruction (step S4). More specifically, in software 21 , controller 24 sends instructions received from request queue 18 to requestor 25 , and requestor 25 executes the instructions sent from controller 24 . The instructions may be binaries or instructions that undergo some transformation (such as compilation) before direct execution by a processor, or source code, scripting language, for example in a language that controls a database, intermediate format instructions such as assembly language.

When the requester 25 of the software 21 executes the instruction and the resource 14 sends the result to the software 21 (step S5), the software 21 sends the result to the cooperation service 16 by the general protocol (step S6), and further cooperates. The external service 16 sends the result to the external service 12 (step S7).

More specifically, in software 21 , requesters 25 receive results from corresponding resources 14 and add them to response queue 26 . Next, the response queue 26 immediately adds the added result as data to the response queue 19 of the linking service 16 connected by designating the environment-specific URL using a general-purpose protocol.

The data added to the response queue 19 is immediately returned from the response queue 19 of the cooperation service 16 to the external service 12 .

Although FIG. 2 shows that the processing of steps S5 to S7 is completed while the software 21 confirms the command with the linking service 16, the timing at which the software 21 confirms the command with the linking service 16 is different. Regardless, the processing of steps S5 to S7 may be executed.

As a result, the external service 12 hosted on the Internet 11 can cooperate with the resource 14 on the network 13 by interposing the service cooperation system 10 in the same way as when it is locally executed on the network 13 .

As described above, in the service cooperation system 10 of the present embodiment, the environment-specific URL set in the cooperation service 16 on the Internet 11 that can be connected to the external service 12 is used as the connection port, and the user's network 13 The software 21 connects using a general-purpose protocol, acquires commands from the external service 12 in the collaboration service 16, executes the acquired commands on the user network 13, and outputs the result obtained from the resource 14 to the collaboration service. Send to 16. Therefore, access from the software 21 inside the firewall 15 to the outside cooperation service 16 is basically made only by general-purpose protocols, and direct access from the outside to the inside of the firewall 15 does not occur. Therefore, the firewall 15, which is generally difficult to access from the outside to the inside compared to the access from the inside to the outside, does not require special settings, that is, without changing the specifications of the user's network 13, or , without introducing special additional equipment such as VPN, while preventing unauthorized access to the network 13 of the user, the resource 14 of the network 13 and the external service 12 of the Internet 11 can be easily linked.

In addition, the software 21 confirms the presence or absence of a command for the cooperation service 16 for a predetermined command waiting time, and if there is a command during this confirmation, the command is acquired and executed on the user's network 13. Compared to connecting to the cooperation service 16 each time, the load on the Internet 11 and the network 13 can be suppressed, and the command can be executed immediately.

By setting the request queue 18 holding the command in the cooperation service 16, even if the command is lost during transmission, it can be reacquired from the request queue 18.例文帳に追加Therefore, even in communication using the Internet 11 in which the route quality is not guaranteed, it is difficult to lose instructions.

By executing only prescribed instructions registered in the software 21 in advance, the user's network 13 can be protected from malicious instructions, and the security of the network 13 can be improved.

10 Service linkage system
11 Internet
12 External services
13 networks
14 resources
16 Coordination services
Request queue which is 18 queues
21 Software
T1 instruction wait time

The service linkage system according to claim 1 uses a linkage service on the Internet that can be connected to an external service, and a general -purpose protocol that allows passage from the network to the Internet through a firewall that protects a user's network from the Internet. , software on the network that acquires commands from the external service in the collaboration service, executes the commands on the network, and transmits results obtained from resources of the network to the collaboration service. and

Claims (4)

A service for cooperation on the Internet that can be connected to external services,
Using a general-purpose protocol, obtain a command from the external service in the linking service, execute the command on the user's network, and send the result obtained from the network resources to the linking service. , software on the network; and
A service linkage system characterized by comprising: The software confirms whether or not there is a command for the cooperation service for a predetermined command waiting time, and if there is the command during this confirmation, acquires the command and executes it on the user's network. The service cooperation system according to claim 1. 3. The service cooperation system according to claim 1, wherein the cooperation service has a queue holding commands. 4. The service linkage system according to any one of claims 1 to 3, wherein the command is a prescribed command registered in software in advance.

Images