JP2998839B1 - Data communication method, data relay device, and recording medium - Google Patents

Abstract

A data communication system capable of performing real-time communication even in an environment where direct data communication with a partner is restricted. SOLUTION: Security servers 20 and 3 permitting transmission of only communication data of a predetermined format such as a firewall.
0 and clients 30a to 3 under the security server 30.
0n, a relay server 10 for relaying communication data between clients is provided. This relay server 10
Security server 30 having communication data from client 20a under client 30a of the communication partner
Pseudo-exchanges to a data form that allows transmission, and transmits this to the client 30a.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method of exchanging data between communication devices, and more particularly to a communication device under a security device that permits transmission of only communication data of a predetermined communication format, and an external device such as a communication device. The present invention relates to a data communication method performed with a communication device under the control of another independent security device via a data relay device arranged on a network, and a related technique thereof.

[0002]

2. Description of the Related Art In recent years, in order to enhance security when performing data communication via a network that can be used by unspecified persons such as the Internet, it has become common to provide a security device on the network. This type of security device is provided with, for example, a firewall between a communication device under the control and a network, and allows transmission of only predetermined data such as e-mail and homepage data, and transmission of other data. Which has the function of preventing Such a security device having a server function in the Internet is called a security server.

[0003] Providing such a security server on the Internet has the advantage that harmful access of unspecified persons to subordinate communication devices can be eliminated, but also causes the following problems. That is, even if an attempt is made to perform real-time communication, for example, a battle game or a real-time chat service, between a certain communication device and a communication device under another independent security server, the security server intervenes. Can not. That is,
Even if an attempt is made to establish a session (logical line, hereinafter the same) for communication from one communication device to the other communication device, the session establishment is rejected by one or both security servers. This is because the security server protects the communication device under the communication device by allowing the packet between the communication device and the network to pass through only the indirect route without directly transmitting the packet.

[0004] Therefore, the present invention provides an improved data communication that can perform real-time communication or communication similar thereto as necessary even in an environment where direct data communication with the other party is restricted. It is an object to provide a method. Another object of the present invention is to provide a data relay device for realizing the data communication method, and a recording medium for executing the data communication method on a computer device.

[0005]

According to a data communication method of the present invention for solving the above-mentioned problems, a security device which permits transmission of only a predetermined form of transmission-permissible data with one or more communication devices under its control is provided. A data communication method performed in an intervening environment, wherein a data communication method is performed between a security device and an external device.
The data relay device intervenes, and the data relay device assigns an appropriate ID addressed to the specific communication device from an external device.
The communication data is pseudo-converted into the permissible transmission data and transmitted through the security device.
Preferably, the security device and the specific communication device are registered in advance, and only the communication data addressed to the registered communication device is pseudo-converted into the transmission allowable data so that the registered security device is transmitted. I do.

When data communication is performed in an environment where a plurality of security devices intervene, the data relay device must be secured.
Is interposed between Yuriti device, for the other security device communication data proper ID is attached to the second addressed communication device from the first communication device working under a particular security device under the other security devices Is pseudo-converted to the above-mentioned transmission allowable data and transmitted through the other security device. Note that the communication data or the permissible transmission data is temporarily stored for each of the second communication devices,
In response to a request from the communication device, the communication data is pseudo-converted into the transmission permission data for the other security device, and the previous transmission permission data is transmitted to the second communication device. It may be.

A data relay device according to the present invention for solving the above-mentioned other problems is interposed between an external device and a security device which permits transmission of only a predetermined form of transmission-permitted data with a subordinate communication device. Registering means for registering the external device, the security device, and a partner communication device subordinate to the security device; and simulating communication data addressed to the registered partner communication device from the registered external device. Data conversion means for converting the security- permitted data into a security- permitted transparent data for the security device.
Means for guiding to the registered other party's communication device via the communication device.

[0008] The data conversion means may include, for example, in a header portion of the communication data, the communication data in response to a request from the partner communication device and an HTTP (Hy
perText Transfer Protocol) or SMTP (Simple)
The communication data is pseudo-converted into the permissible transmission data by adding information indicating that the data conforms to the Mail Trasfer Protocol.

According to another aspect of the present invention, there is provided a recording medium having a data communication function for a security device which permits transmission of only a predetermined form of transmission-permitted data with a subordinate communication device and an external device. A computer-readable recording medium in which a program for causing a computer device provided to execute at least the following processing is recorded. (1) a process of registering the external device, the security device, and a partner communication device under the security device; (2) transmitting communication data from the registered external device to the registered partner communication device; A process of pseudo-converting the data into the permissible transmission data ;
A process of leading to the registered communication device via the security device .

[0010]

Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a schematic configuration diagram of a data communication system to which the present invention is applied. The data communication system 1 includes a plurality of communication devices (hereinafter, referred to as “clients”) 20 a to 20 n under the security server 20 and a plurality of clients 30 a under another independent security server 30. ~ 3
0n are connected to each other via the relay server 10 on the Internet L in such a manner that two-way communication is possible.

The security server 20 and the security server 30 are publicly known, for example, having a function of permitting transmission of only data satisfying the following two conditions. (1) Data that conforms to HTTP used for connection to a homepage or SMTP used for exchange of e-mail. (2) Requests homepage data from a subordinate client to a homepage server on an external network, for example, the Internet, through its own server. Data that was returned from the homepage server in response to the request. In the present embodiment, data in a form that satisfies the above condition is referred to as “transmissive data”. Reference numeral IL in FIG. 1 is a communication path virtually formed by the permissible transmission data.

Normally, even if the security server 20 attempts to establish a session between any of the subordinate clients 20a to 20n and any of the subordinate clients 30a to 30n, data other than the above-described transparent allowable data is transmitted. In this case, the security server 30 rejects the session establishment. Therefore, in the present embodiment, the communication path I of the pseudo-permissible data between the clients performing data communication is
L is formed so that real-time communication or communication similar thereto can be performed.

FIG. 2 shows a functional block configuration of the relay server 10 for realizing such a function. In the relay server 10, the identification information of the client that performs data communication via the own server, the identification information of the security server that subordinates each client (protects each client), and the transmission allowable data by the security server are stored in the database unit. Registered to 150. For example, if the client 20a is the client 30a
When communicating with the client, the identification information of the client 20a, the client 30a, the security server 20, and the security server 30 is registered.

Registration is performed as follows. For example, assume that a data transmission request addressed to the client 30a is transmitted from the client 30a. The relay server 10 receives the data transmission request via the I / O interface 110, receives the data transmission request at the registration / communication request receiving unit 120, and passes it to the determination processing unit 130. The determination processing unit 130 checks whether the client 20a can register, and if so, notifies the ID issuing unit 140. ID issuing unit 14
0 issues a unique ID for the client 20a and registers it in the database unit 150 as identification information. Further, the security server 20 having the client 20a under its control is checked whether or not the identification information and the permissible transmission data are already registered.
Register them.

When the client 20a or the like is registered, the client 30a to be the communication partner of the client 20a and the security server 30 under the client 30a are registered.
Check if is registered. If not registered, a unique ID and transparent permissible data are registered in the same procedure as described above. If the client 30a or the like has been registered or has already been registered, the session establishing unit 180
0a is established.

Thereafter, when communication data is transmitted from the client 20a, the registration / communication request unit 1
20 and is managed by the data management unit 170 for each client. At this time, the data transmission unit 160 notifies the client 30a of the communication partner that communication data addressed to the client exists. When there is a request from the client 30a, the data management unit 170 pseudo-converts the data so as to conform to the permissible data of the security server 30, and transmits the data to the client 30a.

The pseudo conversion to the permissible data is performed by adding, for example, the following information to the header of the communication data addressed to the client 30a. (1) information that the communication data is return data from the homepage server requested by the client 30a;
(2) The form of the communication data is the security server 3
0, for example, information indicating that the data is in the form of homepage data or e-mail. Thereby, the security server 30 recognizes that the passed communication data is a reply of the data requested by the client 30a under its own server, and transfers the communication data to the client 30a without being excluded. Is done.

Although not shown, the data management unit 1
In 70, a buffer area dedicated to the client with which the session is established is secured, and each client can be treated as if it were its own storage device. For example, the communication data is stored in a buffer area for the client 20a, and is read out at the time of a request from the client 30a, and is pseudo-converted into transmission allowable data as needed. The data converted into the transparent permissible data in a pseudo manner is stored, and the client 30a
The client 20a directly accesses the buffer area for the client 30a, accumulates communication data, and stores the communication data in the client 30a.
In response to the request from the client 30a, it can be converted into transparent permissible data as needed and transmitted to the client 30a.

Each of the functional blocks 110 to 180 of the relay server 10 is realized by a CPU (processor) of a server having a communication function reading a program code recorded on a recording medium of the present invention. The recording medium is usually a fixed disk or a semiconductor memory that can be read by the CPU at any time, but a portable medium such as a flexible disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a DVD, a magnetic tape, or a computer. It may be recorded on an accessible program server or the like, distributed, and installed on the fixed recording medium during operation. Also,
The function blocks 110 to 180 are not only formed by the CPU executing the above program, but also the operating system running on the server main body performs a part of the actual processing based on the instruction of the program. , Through the processing, the above functional blocks 110-1
80 may be formed.

Next, the function of the relay server 10 will be described with reference to FIGS. First, the clients 20a and 30a to be the parties, the security servers 20 and 30 under their control, and the security servers 20 and 30
Must be registered in the relay server 10 in advance. FIG. 3 shows the procedure in this case. That is, when the client 20a issues a registration request for itself and the security server 20 (step S101), the relay server 10 determines whether the registration can be accepted. If registration cannot be accepted, the client 20a is notified of that (step S102: No, S
103). If registration is possible, a buffer area dedicated to the client that issued the registration request is secured in the data management unit 170 (step S102: Yes, S104), and an ID for the client / security server is issued (step S105). Then, the permissible transmission data of the security server 20 is registered in the database unit 150 (step S106).

After registration, data communication is started according to the procedures shown in FIGS. In FIG. 4, the client 20a
Issues a data transmission request to the client 30a (step S201), the relay server 10 checks whether the client 20a / security server 20 is registered and has an appropriate ID (step S202). ). If not registered, a rejection is notified and the process returns to the initial state (step S202: No, S20)
3). If registered, a buffer area dedicated to the client 20a is secured (step S204). Thereafter, a registration list transmission request from the client 20a is received, and a list of registered clients is notified to the client 20a (step S204: Yes, S20).
6).

Referring to FIG. 5, the client 20a confirms from the list of registered clients that the client 30a is already registered,
Is issued (step S30).
1) The relay server 10 sends the client 3
It is checked whether 0a is appropriate (step S303). If not, the client 20a is notified that data communication cannot be performed, and returns to the initial state (step S303:
No, S304). If appropriate, a buffer area dedicated to the client 30a is secured and
0a indicates that a data transmission request has been received from the client 30.
a is notified (step S305).

Thereafter, the communication data from the client 20a is sequentially received (step S306), and the received communication data is pseudo-converted into the permissible transmission data of the security server 30 and stored in a buffer area dedicated to the client 30a. When there is a reception request from the client 30a, data is read from the corresponding buffer area as needed and transmitted to the client 30a (step S).
307). The processing after step S306 is repeated until transmission of all communication data is completed (step S306).
308).

The data transmission request from the client 30a to the client 20a can be realized by replacing the subject of the data transmission request in step S201 with the client 30a. In this way,
Real-time communication or communication similar thereto can be performed.

FIG. 6 shows a data communication system according to this embodiment in which data communication from a client A under one security server A to a client B under another security server B is executed. 6 is a sequence chart showing the overall flow of the operation. Here, it is assumed that the transparent permitted data of the security server A is HTTP data and the transparent permitted data of the security server B is SMTP data. The relay server is the relay server 10 described above.

When a session establishment from the client A to the client B is requested (A11), the relay server 10 judges whether or not the session establishment is possible, and notifies the client A of the result (C11). When the session establishment is permitted, the client A encodes the communication data (A
12) Then, a data transmission request is issued by adding information indicating that the communication data is in the HTTP format and reply data addressed to the client B to the header portion (A13).

The security server A examines from the header of the communication data whether or not the communication data is permissible data. If affirmative, the communication data is transmitted to the relay server 10 (B11). Upon receiving the communication data, the relay server 10 stores the communication data in a buffer area dedicated to the client B (C1).
2) Further, the client B is notified that there is data that can be transmitted.

The client B that has received the notification issues a data reception request to the relay server 10 (F11). The relay server 10 that has received the data reception request encodes the data stored in the buffer area dedicated to the client B, and includes, in its header, information indicating that the data is data to be returned in response to the request from the client B. And information indicating that the data is in the SMTP format (C14), and transmits this to the security server B (C15).

The security server B is a relay server 1
The header of the communication data transmitted from the client B is examined, and the communication data is transmitted permission data, that is, the client B
After confirming that the requested reply data is in the SMTP format, the communication data is transferred to the client B (D11). After completing the reception of the communication data, the client B shifts to each process.

In this way, it becomes possible for two or more clients under the independent security server on the Internet to perform real-time communication within the performance limit range of the security server and the line. Such a form of data communication can be widely applied to a battle-type game service, a real-time chat service, and the like that can be played via the Internet.

[0031]

As is apparent from the above description, according to the present invention, real-time communication or communication similar thereto can be performed even in an environment where direct data communication with the other party is restricted. There is a unique effect that can be done.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a data communication system to which the present invention is applied.

FIG. 2 is a functional block configuration diagram of a relay server according to the embodiment.

FIG. 3 is a flowchart of a registration process to a relay server according to the embodiment;

FIG. 4 is a processing procedure diagram of data communication between clients according to the embodiment;

FIG. 5 is a processing procedure diagram of data communication between clients according to the embodiment;

FIG. 6 is a sequence chart showing the flow of the overall data communication process.

[Explanation of symbols]

 1 Data Communication System 10 Relay Server 110 I / O Interface 120 Registration / Communication Request Unit 130 Judgment Processing Unit 140 ID Issuing Unit 150 Database Unit 160 Data Transmission Unit 170 Data Management Unit 180 Session Establishing Unit

────────────────────────────────────────────────── ─── Continuation of front page (72) Inventor Kazuo Kawakami 2-13-9 Nihonbashi Ningyocho, Chuo-ku, Tokyo BR Ningyocho 1 Building 3F, Dowango Co., Ltd. (56) References Kazuo Takagi et al. Firewall Internet-Related Technology ”(Showa Kodo), June 9, 1998, page 28 LAN TIMES May 1997 p. 50-55 Nikkei Communication No. 225 p70-77 (58) Field surveyed (Int. Cl. ⁷ , DB name) H04L 12/56 H04L 12/22 H04L 12/28

Claims (10)

(57) [Claims] 1. A data communication method performed in an environment in which a security device that allows transmission of only a predetermined form of transmission-permitted data intervenes with one or more communication devices under its control, wherein the security device and the security device Data relay between external devices
In this data relay device, it is supposed that the communication data with an appropriate ID addressed to the specific communication device from an external device is pseudo-converted into the transmission allowable data and transmitted through the security device. Characteristic data communication method. 2. The external device, the security device, and the specific communication device are registered respectively, and only communication data addressed to the registered communication device from the registered external device is pseudo-converted into the permissible transmission data. 2. The data communication method according to claim 1, further comprising transmitting the registered security device. 3. A data communication method performed in an environment in which a plurality of security devices permitting transmission of only a predetermined form of transmission-permitted data between one or more communication devices under its control . Between security devices and other security devices
The data relay device intervenes, and the data relay device transmits communication data with an appropriate ID from the first communication device under the control of one security device to the second communication device under the control of another security device. A data communication method, wherein the data is pseudo-converted into the permissible transmission data for the other security device and transmitted through the other security device. 4. The communication data or the permissible transmission data is temporarily stored for each of the second communication devices, and
It is for the communication data in response to a request from the communication device artificially converting the transmission permissible data for the other security devices, that for the transmission permissible data to send it to the addressed to the second communication device 4. The data communication method according to claim 3, wherein: 5. An intervening system between an external device and a security device that permits transmission of only a predetermined form of transmission-permitted data with a communication device under its control, wherein the external device, the security device, and the security device Registration means for registering a communication device under the communication device, and pseudo- conversion of communication data from the registered external device addressed to the registered communication device to the registered permissible transmission data for the security device. Data conversion means for performing the security
Means for guiding to the registered other communication device via a security device. 6. A data storage area for each of the other communication devices, wherein the communication data conversion means converts the held communication data into the transmission allowable data upon a request from the other communication device. The data relay device according to claim 5, wherein the data relay device performs a pseudo conversion. 7. The data conversion means according to claim 1, wherein said communication data is in a header portion of said communication data, said communication data is in response to a request from said communication apparatus of the other party, and
7. The data relay device according to claim 6, wherein the communication data is pseudo-converted into the transmission permitting data by adding information indicating that the data conforms to the TP. 8. The data relay device according to claim 5, wherein the external device is a communication device under the control of another security device having the same function as the security device. 9. The data relay device according to claim 8, wherein the data relay device is connected to a public communication network conforming to TCP / IP together with the security device and the other security device. 10. A computer device having a data communication function for each of a security device and an external device that permits transmission of only a predetermined form of transmission-permitted data with a communication device under its control, wherein at least the external device, A process of registering the security device and a communication device under the security device, and converting communication data destined for the registered communication device from the registered external device to the transmission allowable data in a pseudo manner. And transmitting the pseudo-transformed transmission allowance data to the security
And a computer-readable recording medium on which a program for executing a process of leading the registered communication device to the other communication device via a security device is recorded.