JP4205637B2 - Data exchange method and data exchange system - Google Patents

Description

  The present invention relates to a data exchange method and a data exchange system for exchanging data between two independent networks that are completely separated, and in particular, data exchange that can exchange data without directly connecting the two networks. The present invention relates to a method and a data exchange system.

  Information processing apparatuses belonging to an open network (LAN connected to another network) can easily exchange information via the network (for example, using FTP).

  However, the fact that information can be easily exchanged also means that information is easily leaked. For example, an information processing apparatus belonging to a LAN connected to the Internet can exchange data with many information processing apparatuses via the Internet. However, when information is transmitted / received via the Internet that can be accessed by an unspecified number of people, data may be stolen by a third party during transmission.

The information processing apparatus belonging to the open network, depending on those with malicious from other information processing apparatus on the network is unauthorized access or information is stolen, or tampered, may or break is there.

  For this reason, it is common for an information processing apparatus that stores data requiring confidentiality and security to belong to a closed network (LAN not connected to another network), not an open network.

  For example, in a company, it is common to separately construct a LAN for an in-house intranet that is a closed network and a LAN for the Internet that is an open network.

  However, an information processing device belonging to a closed network can exchange information with an information processing device belonging to the same network using a network line. Information cannot be exchanged using it.

As a prior art aiming at enabling an information processing apparatus belonging to a closed network to exchange data with an information processing apparatus belonging to another network, a “data exchange method, data exchange system, And program ". In the invention disclosed in Patent Document 1, each system has storage means for storing data to be transmitted to other disconnected systems (corresponding to the network in the present application) and data received from other disconnected systems. It is provided.
Japanese Patent Laid-Open No. 2004-133587

  However, in the invention disclosed in Patent Document 1, an information recording medium (flexible disk (FD), magnetic tape (MT), etc. , Hereinafter also referred to as “media”).

  In order to exchange data using a medium, it is necessary to write information on the medium in the information processing apparatus that is the exchange source and to read this information in the information processing apparatus that is the exchange destination. In this case, it is necessary for the user to manually perform a cumbersome task of replacing media.

Also, as shown in FIG. 3, data may be exchanged using a tape device having two tape drives. The first server 50 is connected to the first tape drive 71, and the second server 60 is connected to the second tape drive 72. Each server can record (save) and read (restore) data from / to the MT loaded in the connected tape drive.
The MT, which is an information recording medium, is stored in the tape library 73, and the MT is transported and loaded into the tape drive in accordance with control from the tape controller 80.
For example, when data stored in the exchange data storage unit 53 of the first server 50 is moved to the second server 60, a blank MT taken out from the tape library 73 by an instruction from the tape controller 80. Is loaded into the first tape drive 71, and the data in the exchange data storage unit 53 is written to the MT in the tape drive 71. The MT in which the data has been written is transported to the second tape drive 72 and loaded according to a command from the tape controller 80. When the MT in which the data is written is loaded into the second tape drive 72, the second server 60 reads the information written in the MT and acquires it in the exchange data storage unit 63.

  As described above, in a tape device having two tape drives, a method of automating the loading of the tape is adopted. Therefore, if this is used, it is not necessary to manually replace the media, but the device itself is Expensive.

  Furthermore, even if a tape device equipped with two tape drives is used, there is no substitute for having to physically move the media on which the data is recorded, and the data to be exchanged is not transferred immediately, which improves real-time performance. There was a problem of lacking.

  Thus, conventionally, a data exchange method and a data exchange system capable of exchanging data in real time without requiring complicated manual work between two completely separated independent networks have not been provided.

  The present invention has been made in view of such problems, and a data exchange method and a data exchange system capable of exchanging data in real time between two independent networks that are completely separated without requiring complicated manual work. The purpose is to provide.

In order to achieve the above object, according to a first aspect of the present invention, there is provided a data exchange system for exchanging data between an information processing apparatus belonging to a first network and an information processing apparatus belonging to a second network. The first server connected to the first network and the second server connected to the second network are each connected to the storage device via fiber channel, and the first server Means for receiving data to be output to an information processing apparatus belonging to the second network from the information processing apparatus belonging to the first network and storing the data in the storage apparatus; and data acquired from the storage apparatus to the first network which is a delivery destination And the second server outputs to the information processing apparatus belonging to the first network. Receiving data from the information processing apparatus belonging to the second network and storing the data in the storage apparatus, and means for transmitting the data acquired from the storage apparatus to the information processing apparatus belonging to the second network that is the delivery destination. The storage device includes a first storage area accessible only from the first server, a second storage area accessible only from the second server, and data stored in the first storage area. The data recorded in the second storage area was copied from the first recording area by synchronizing with the means for synchronizing the data stored in the second storage area and the data recorded in the second recording area. means for outputting read data to the second server, which by synchronization with the second recording region of the data recorded in the first recording area transcribed from the second recording area Have a means for outputting read data to the first server, the first and second recording regions, and wherein the the middle of the synchronization is not possible to reach from the first and second server A data exchange system is provided.

  In the first aspect of the present invention, the storage device is preferably a disk array device.

  In any of the above configurations of the first aspect of the present invention, the second network is preferably an open network.

In order to achieve the above object, the present invention provides, as a second aspect, a data exchange method for transferring data held by an information processing apparatus belonging to the first network to an information processing apparatus belonging to the second network. Then, each of the first server connected to the first network and the second server connected to the second network is connected to the storage device via the fiber channel, and the first server Data to be output to the information processing apparatus belonging to the network is acquired from the information processing apparatus belonging to the first network, and the data acquired from the information processing apparatus belonging to the first network is stored in the storage apparatus. First and second storage areas accessible only by the first server and second recording areas accessible only by the second server The data stored in the first storage area by the first server is copied to the second storage area in synchronization, and the first and second recording areas are copied to the first and second servers. Can be accessed, and the copied data is read from the second storage area and transmitted to the second server, and the second server delivers the data acquired from the storage device to the information processing device belonging to the second network. The present invention provides a method for exchanging data.

In order to achieve the above object, according to a third aspect of the present invention, there is provided a data exchange method in which an information processing apparatus belonging to a second network transfers data to an information processing apparatus belonging to a first network. Each of the first server connected to the first network and the second server connected to the second network is connected to the storage device via a fiber channel, and the second server is connected to the first network. The data output to the information processing apparatus belonging to the second network is acquired from the information processing apparatus belonging to the second network, and the data acquired from the information processing apparatus belonging to the second network is stored in the storage apparatus. A first storage area accessible only by one server and a second recording area accessible only by the second server The data stored in the second storage area by the second server is synchronously copied to the first storage area, and the first and second recording areas are copied to the first and second servers. Can be accessed, and the copied data is read from the first storage area and transmitted to the first server, and the first server delivers the data acquired from the storage device to the information processing device belonging to the first network. The present invention provides a method for exchanging data.

In the second aspect or the third aspect of the present invention, the storage device is preferably a disk array device. The second network is preferably an open network.

  According to the present invention, it is possible to provide a data exchange method and a data exchange system capable of exchanging data in real time without requiring complicated manual work between two independent networks that are completely separated.

A preferred embodiment of the present invention will be described. FIG. 1 shows a configuration of a data transmission system according to the present embodiment. This data transmission system includes a first server 10, a second server 20, and a storage device 30. The first server 10 and the second server 20 are each connected to the storage device 30 via a fiber channel.
The first server 10 is connected to the in-house intranet LAN 100, and the second server 20 is connected to the Internet LAN 200. The Internet LAN 200 is an open network that can be accessed by an unspecified number of people from the outside, and the in-house intranet LAN 100 is a closed network that cannot be accessed from the outside.

The first server 10 includes a control unit 11, a LAN communication unit 12, an exchange data storage unit 13, and a fiber channel communication unit 14.
The control unit 11 is a substantial computer that controls the operation of the entire first server 10 and includes a CPU, MPU, RAM, ROM, and the like. The LAN communication unit 12 is a functional unit for transmitting and receiving information via the Internet LAN 200. The exchange data storage unit 13 is a functional unit that stores information transferred to the second server 20 or information transferred from the second server 20. The fiber channel communication unit 24 is a functional unit for transmitting and receiving information to and from the storage apparatus 30 via the fiber channel.

The second server 20 includes a control unit 21, a LAN communication unit 22, an exchange data storage unit 23, and a fiber channel communication unit 24.
The control unit 21 is a substantial computer that controls the operation of the entire second server 20 and includes a CPU, MPU, RAM, ROM, and the like. The LAN communication unit 22 is a functional unit for transmitting and receiving information via the Internet LAN 200. The exchange data storage unit 23 is a functional unit that stores information transferred to the first server 10 or information transferred from the first server 10. The fiber channel communication unit 24 is a functional unit for transmitting and receiving information to and from the storage apparatus 30 via the fiber channel.

  The storage device 30 includes a first disk array device 31, a second disk array device 32, and a controller 33. In the first disk array device 31, information transferred from the first server 10 via the fiber channel is written. In the second disk array device 32, information transferred from the second server 20 via the fiber channel is written. The first disk array device 31 and the second disk array device 32 have a “data synchronization” function for copying information recorded in one of them to the other under the control of the controller 33. The controller 33 controls the operation of transferring the information written in the first disk array device 31 to the first server 10 via the fiber channel, and the information written in the second disk array device 32 is the first. The operation of transferring data to the second server 20 via the fiber channel and the data synchronization between the first disk array device 31 and the second disk array device 32 are controlled.

The operation of the data exchange system will be described by taking as an example a case where an electronic mail transmitted from an information processing terminal on the Internet (not shown) is sent to an information processing device (not shown) on the in-house intranet LAN 100. FIG. 2 shows an operation flow of the data exchange system.
When receiving the e-mail data through the LAN communication unit 22, the control unit 21 refers to the header information and confirms whether the destination is an information processing terminal belonging to the in-house intranet LAN 100 (step S101). ). When the control unit 21 receives an e-mail addressed to the information processing terminal belonging to the in-house intranet LAN 100 (step S102 / Yes), the control unit 21 stores the e-mail data in the exchange data storage unit 23 (step S103). Then, the control unit 21 transfers the e-mail data stored in the exchange data storage unit 23 to the storage device 30 using the fiber channel communication unit 24 (step S104).

  When the storage device 30 receives the data transmitted from the second server 20 via the fiber channel, the controller 33 stores the received data (e-mail data) in the second disk array device 32 (step S105). ).

  The controller 33 synchronizes data between the second disk array device 32 and the first disk array device 31, and sends e-mail data stored in the second disk array device 32 to the first disk array device 31. A copy is made (step S106). When all the information has been copied, the controller 33 releases the synchronization between the second disk array device 32 and the first disk array device 31. As a result, the first disk array device 31 becomes accessible from the first server.

  The controller 33 transmits the e-mail data copied to the first disk array device 31 to the first server 10 via the fiber channel (step S107).

  The control unit 11 of the first server 10 stores the e-mail data received from the storage device 30 using the fiber channel communication unit 14 in the exchange data storage unit 13. The control unit 11 sends the e-mail data stored in the exchange data storage unit 13 to the in-house intranet LAN 100 using the LAN communication unit 12 (step S108). Thus, the e-mail data is delivered to the destination information processing terminal based on the header information.

  It should be noted that when an e-mail sent from an information processing terminal (not shown) on the in-house intranet LAN 100 is sent to an information processing terminal on the Internet (not shown), an operation reverse to the above is performed.

  As described above, the data exchange system according to the present embodiment can quickly exchange data between the information processing apparatus on the open network and the information processing apparatus on the closed network without any manual intervention. That is, since the data exchange system according to the present embodiment is excellent in real-time data exchange, the e-mail received from the outside via the open network is transferred to the closed network side and received by the information processing terminal on the closed network. It becomes possible.

  A storage device, which is an intermediate device between an open network and a closed network, is connected to an information processing device belonging to each network by a direct connection method such as Fiber Channel, and communication between the information processing device and the storage device does not use IP. Do. Thereby, it is possible to prevent an information processing apparatus on the open network from being illegally accessed by the information processing apparatus on the closed network.

In addition, the said embodiment is an example of suitable implementation of this invention, and this invention is not limited to this.
For example, in the above-described embodiment, the configuration in which the server on the open network side and the server on the closed network side and the storage device are connected by the fiber channel has been described as an example. There is no need.
Further, the storage device is not limited to the disk array device, and any information storage device can be applied.
Furthermore, in the above-described embodiment, the example of data exchange between the open network and the closed network has been described. However, the present invention is also applicable to the case of exchanging data between two closed networks.
Furthermore, in the above-described embodiment, the configuration in which the storage apparatus mediates two networks has been described, but it goes without saying that the storage apparatus may mediate three or more networks.
As described above, the present invention can be variously modified.

It is a figure which shows the structure of the data exchange system which implemented this invention suitably. It is a flowchart which shows the flow of operation | movement of the data exchange system concerning this invention. It is a figure which shows the structure of the conventional data exchange system using a tape apparatus.

Explanation of symbols

10 First server 11, 21 Control unit 12, 22 LAN communication unit 13, 23 Exchange data storage unit 14, 24 Fiber channel communication unit 20 Second server 30 Storage device 31 First disk array device 32 Second disk Array device 33 Controller 100 LAN for in-house intranet
200 LAN for Internet

Claims (7)

A data exchange system for exchanging data between an information processing device belonging to a first network and an information processing device belonging to a second network,
The first server connected to the first network and the second server connected to the second network are each connected to the storage device via Fiber Channel,
The first server receives from the information processing apparatus belonging to the first network data to be output to the information processing apparatus belonging to the second network and stores the data in the storage apparatus. Means for transmitting data to the information processing apparatus belonging to the first network as a delivery destination,
The second server receives the data to be output to the information processing apparatus belonging to the first network from the information processing apparatus belonging to the second network and stores the data in the storage apparatus, and is acquired from the storage apparatus Means for transmitting data to an information processing apparatus belonging to the second network as a delivery destination,
The storage device stores a first storage area accessible only from the first server, a second storage area accessible only from the second server, and the first storage area. Synchronization control means for synchronizing data and data stored in the second storage area, and the first recording area synchronized with the first recording area among the data recorded in the second recording area. Means for reading out the data copied from the recording area and outputting it to the second server, and the second recording area in synchronization with the second recording area among the data recorded in the first recording area. Means for reading data copied from the recording area and outputting the data to the first server,
The data exchange system, wherein the first and second recording areas cannot be accessed from the first and second servers during synchronization.   The data exchange system according to claim 1, wherein the storage device is a disk array device.   The data exchange system according to claim 1 or 2, wherein the second network is an open network. A data exchange method for transferring data held by an information processing apparatus belonging to a first network to an information processing apparatus belonging to a second network,
Connecting each of the first server connected to the first network and the second server connected to the second network to a storage device via a fiber channel;
Data acquired by the first server from the information processing apparatus belonging to the first network, obtained from the information processing apparatus belonging to the first network, data to be output to the information processing apparatus belonging to the second network Is stored in the storage device,
The storage device makes the first storage area accessible only by the first server and the second recording area accessible only by the second server inaccessible from the first and second servers, Data stored in the first storage area by the first server is copied to the second storage area in synchronization, and the first and second recording areas are accessed from the first and second servers. Enabling the copied data to be read from the second storage area and transmitted to the second server;
The data exchange method, wherein the second server delivers data acquired from the storage device to an information processing device belonging to the second network. A data exchange method in which an information processing device belonging to a second network delivers data to an information processing device belonging to a first network,
Connecting each of the first server connected to the first network and the second server connected to the second network to a storage device via a fiber channel;
Data acquired by the second server from the information processing apparatus belonging to the second network, obtained from the information processing apparatus belonging to the second network, data to be output to the information processing apparatus belonging to the first network Is stored in the storage device,
The storage device makes the first storage area accessible only by the first server and the second recording area accessible only by the second server inaccessible from the first and second servers, The data stored in the second storage area by the second server is copied to the first storage area in synchronization, and the first and second recording areas are accessed from the first and second servers. Enabling the copied data to be read from the first storage area and transmitted to the first server;
The data exchange method, wherein the first server delivers data acquired from the storage device to an information processing device belonging to the first network. The storage apparatus according to claim 4 or 5 data exchange method wherein a is a disk array device. The data exchange method according to any one of claims 4 to 6 , wherein the second network is an open network.

Images