JP5049807B2 - Method and flow processing apparatus for executing a service on a network - Google Patents

Description

  The present invention relates to a method for executing a service on a network and a flow processing apparatus.

  Conventionally, when a flow processing apparatus causes a service execution apparatus to execute a plurality of services using a flow description document, it is common to describe a service of a service execution apparatus connected to the same network as the flow processing apparatus.

For example, Patent Document 1 divides service cooperation processing into several parts, and creates a subroutine instruction and a main routine instruction that describes the contents for controlling the execution of each subroutine instruction. A service cooperation processing system is disclosed.
JP 2005-173892 A

  However, for example, when a flow process using different services arranged in two networks blocked by a firewall is described in the flow description document, there are the following problems.

  For example, if the firewall is set to allow communication from a specific address to a specific address and the security level is lowered, the instruction can be sent directly from the flow processing apparatus to the service execution apparatus. However, since the setting to lower the security level must be set for all services placed inside the firewall, it is necessary to change the firewall setting every time the flow description document is defined.

  This requires resetting the network environment such as a firewall during operation, especially when executing a new flow description document.

  It is also possible to use a protocol that can pass through the firewall (for example, SMTP) for communication from the flow processing device to the service execution device, but the protocol used in the service is generally HTTP. So there were the following problems.

  The service execution device used by the flow processing device needs to be changed so that it can be processed by SMTP. When a new flow description document is executed, the network environment must be set during operation. .

  An object of the present invention is to reduce a load for setting a network environment.

The present invention provides a method for executing a service executed in the second network by a first flow processing apparatus connected to a first network and a second flow processing apparatus connected to a second network. A second document describing a procedure for calling the second flow processing device from a first document in which the first flow processing device describes the service calling procedure; Generating a third document describing a service calling procedure executed in the second network, and the first flow processing apparatus registers the third document in the second flow processing apparatus; A step of calling the second flow processing device in accordance with a procedure described in the second document by the first flow processing device; and Calling a device that executes the service in accordance with the service calling procedure described in 1., and sending the result of the service executed by the second flow processing device to the first flow processing device. And a step of performing.

The present invention is also a flow processing apparatus connected to the first network, wherein the flow processing apparatus is connected to the second network from a first document describing a service calling procedure executed on the second network. a second document describes the procedure for calling the flow processing apparatus which is a generating means for generating a third document describing the calling sequence of service which the is performed in the second network, the third Means for registering the document in the flow processing device connected to the second network, means for calling the flow processing device connected to the second network according to the procedure described in the second document , receiving an execution result of the service of the second network to the connected flow processing apparatus calls according call procedure described in the third document And having a that means.

  ADVANTAGE OF THE INVENTION According to this invention, the load which sets a network environment can be reduced.

  Hereinafter, embodiments for carrying out the invention will be described in detail with reference to the drawings.

  First, the configuration of a flow processing system including a plurality of flow processing devices and a plurality of service execution devices will be described with reference to FIG.

  FIG. 1 is a block diagram illustrating an example of a configuration of a flow processing system in the present embodiment. The apparatus corresponding to each block shown in FIG. 1 may be realized by a single computer, or may be realized by distributing each function to a plurality of computers as necessary.

  In FIG. 1, reference numerals 101a and 101b denote networks, which are divided into two by a firewall 102 described later. In this example, 101a is an external network of the firewall 102, and 101b is an internal network of the firewall 102. A firewall 102 controls communication between the internal network 101b and the external network 101a, and maintains the safety of the internal network 101b. Detailed description of the firewall 102 is omitted.

  103a and 103b are flow processing apparatuses that interpret and execute a flow description document. Here, the flow description document is a document described in a format capable of executing service cooperation such as WS-BPEL. WS-BPEL is an abbreviation for Web Services Business Process Execution Language.

  104a, b, and c are service execution apparatuses that execute various services such as printing, storage, shooting, and image conversion as Web services on the network, and provide execution results to the flow processing apparatuses 103a and 103b.

  The devices connected to the internal network 101b are denoted by subscripts “b” and “c”, and the devices connected to the external network 101a are denoted by the subscript “a”. 104 are individually distinguished.

  In this example, the service execution device 104a executes the service S1, the service execution device 104b executes the service S2, and the service execution device 104c executes the service S3.

  FIG. 2 is a block diagram illustrating an example of the configuration of the flow processing apparatuses 103a and 103b illustrated in FIG. Hereinafter, the flow processing apparatuses 103a and 103b are collectively referred to as the flow processing apparatus 103. In FIG. 2, reference numeral 201 denotes a control unit that includes a CPU, a ROM, a RAM, and peripheral devices, and controls the entire flow processing apparatus 103. An input unit 202 includes an interface for connecting a keyboard, a mouse, and the like, and controls instructions and various inputs to the flow processing apparatus 103. An output unit 203 includes an interface for connecting a display or the like, and controls output of the state of the flow processing apparatus 103 and processing results.

  A communication control unit 204 includes an interface for communicating with the network, and controls communication with the service execution apparatuses 104a, 104b, and 104c. A storage unit 205 includes an interface for controlling access to the mass storage device (HD). A system bus 210 connects the above-described units.

  Next, a flow description document interpreted and executed by the flow processing apparatus 103a will be described with reference to FIG. The flow description document may be stored in advance in the storage unit 205 such as a hard disk of the flow processing apparatus 103a, or may be arranged by another device connected to the networks 101a and 101b.

  FIG. 3 is a diagram schematically showing an example of a flow description document in the present embodiment. In the example illustrated in FIG. 3, the flow description document 301 describes a flow in which the service S2 is executed after the service S1 is executed, and further the service S3 is executed. Here, the services S1 to S3 correspond to services executed by the service execution apparatuses 104a to 104c shown in FIG. In addition, the service destination address of each service is written in the services S1 to S3.

  In general, this type of firewall 102 often prohibits communication from the external network 101a to the internal network 101b except for a specific protocol, communication to a specific port at a specific address, or a combination of both. . This means that under normal settings, the flow processing apparatus 103a connected to the external network 101a cannot use the service in the internal network 101b.

  Therefore, in order for the flow processing apparatus 103a to use the service in the internal network 101b, first, the firewall 102 is uniquely set. That is, it is necessary to individually set the firewall 102 so that the service execution apparatuses 104b and 104c in the internal network 101b can be used from the external network 101a.

  This means that the number of service execution devices 104b and c in the internal network 101b is opened as much as the number of service execution devices 104b and c, and the security of the internal network 101b is significantly reduced. If all the services to be used are determined in advance, there is no problem, but it is usually difficult to determine all the services described in the flow description document in advance.

  Therefore, every time a new flow description document is written, if the new service execution devices 104b and 104c belonging to the internal network 101b are used, it is necessary to add the setting of the firewall 102, and a load during operation occurs.

  FIG. 4 is a schematic diagram showing an example when the flow description document 301 shown in FIG. 3 is divided. As shown in FIG. 4, first, a service S2 and a service S3 executed on the internal network 101b side are described as a partial flow description document 402. Then, the service call procedure provided in the partial flow description document 402 is added to the divided overall flow description document 401.

  As described above, in this embodiment, the flow description document 301 is divided into the entire flow description document 401 and the partial flow description document 402. In the divided overall flow description document 401, only a service calling procedure provided in accordance with the partial flow description document 402 is described. Then, the execution of the actual service is instructed to another flow processing apparatus.

  8, 9, and 10 show examples of the flow description document (first document) 301, the entire flow description document (second document) 401, and the partial flow description document (third document) 402. .

  Invoke-2 and Invoke-3 of the invoke element in the flow description document 301 shown in FIG. 8 delegate to the partial flow document shown in FIG. Therefore, Invoke-2 and Invoke-3 disappear from the entire flow description document shown in FIG. 9, and a new invoke element called invokeSubProcess is inserted for calling a partial document. Further, Invoke-2 and Invoke-3 described in the flow description document 301 are described in the partial flow description document.

  Next, an execution instruction method for instructing execution of a service by a flow description document in the flow processing system will be described with reference to FIGS.

  FIG. 5 is a schematic diagram illustrating an execution procedure of the first flow process. First, in step 501, the flow description document 301 is placed in the flow processing apparatus 103a in advance. Next, when receiving a request for executing the flow process described in the flow description document 301 in step 502, the flow processing apparatus 103a executes the service S1 on the network 101a in step 503. Next, in step 504, the service S2 inside the firewall 102 is executed, and in step 505, the service S3 inside the firewall 102 is executed similarly. In step 506, the execution result is transmitted, and the execution of this flow process is terminated.

  Here, since the flow processing apparatus 103a communicates with the inside of the firewall 102 in steps 504 and 505, an environment in which communication can be performed in steps 504 and 505 must be set in advance as the setting of the firewall 102.

  In this example, the settings for the two services (S2 and S3) are made in the firewall 102, but each time the services belonging to the internal network increase as S4, S5, S6,... It is necessary to increase the setting.

  FIG. 6 is a schematic diagram illustrating an execution procedure of the second flow process. First, when the flow description document 301 is placed in the flow processing apparatus 103 a connected to the external network 101 a of the firewall 102 in step 601, the registration information is compared in step 602. Specifically, the information registered in the delegation destination flow processing apparatus information 700 shown in FIG. 7 is compared with the service call destination address information described in the flow description document 301. The delegation destination flow processing device information 700 is stored in the storage unit 205. The flow processing device 103a may refer to the delegation destination flow processing device information 700 stored in another device connected to the networks 101a and 101b. The delegation destination flow processing device information 700 includes network address information 701, subnet mask 702, and flow processing device address information 703.

  Then, it is determined whether the call destination address of the service described in the flow description document 301 is included in the network registered in the delegation destination flow processing device information 700. As a result of the determination, if the call destination address is included in the network (for example, the network 101b) determined by the network address information 701 and the subnet mask 702 of the delegation destination flow processing device information 700, the process proceeds to step 603. In step 603, the service described in the flow description document 301 is extracted to create a partial flow description document 402.

  In addition, the service extracted from the flow description document 301 is deleted, and an entire flow description document 401 is created to which a call description including a call destination address for calling the partial flow description document 402 is added. This call destination address is used by the flow processing apparatus 103a to call the transfer destination flow processing apparatus. The transfer destination flow processing device called by this call destination address executes the partial flow description document 402. Thereafter, in step 604, the divided overall flow description document 401 is rearranged on the storage unit 205 of the flow processing apparatus 103a.

  Next, in step 605, the partial flow description document 402 is transmitted to the flow processing device (transfer destination flow processing device) 103b determined from the network address information 701 and the subnet mask 702 via a previously secured network. . The protocol for transmitting the partial flow description document 402 is SMTP. Moreover, you may transmit to the specific port of a specific address by HTTP. The address information 703 of the flow processing apparatus 103b is stored corresponding to the network address information 701 and the subnet mask 702. On the other hand, when the flow processing apparatus 103 b receives the partial flow description document 402 from the flow processing apparatus 103 a, the partial flow description document 402 is arranged on the storage unit 205 in step 606. Note that the entire flow description document 401 and the partial flow description document 402 may be generated by an apparatus other than the flow processing apparatus 103a and arranged in the flow processing apparatuses 103a and 103b.

  Next, when a request for actually calling a flow is received in step 607, the flow processing apparatus 103a executes the service S1 described in the overall flow description document 401 in step 608. This request is received from within the network 101a. Further, this request may be received from the input unit 202 of the flow processing apparatus 103a. In order to execute the service S1, the flow processing apparatus 103a calls the service execution apparatus 104a. The protocol for calling the service execution device 104a is HTTP.

  Next, a request for calling the flow processing device 103b connected to the internal network 101b of the firewall 102 is transmitted in step 609 using the port and address reserved in advance in the setting of the firewall 102. The transmission destination of this request is a call destination address for calling the partial flow description document 402 described in the entire flow description document 401. The protocol for sending this request is SMTP. Moreover, you may transmit to the specific port of a specific address by HTTP.

  On the other hand, when the flow processing apparatus 103b receives the request in step 610, the service is executed according to the flow processing described in the partial flow description document 402 arranged in step 606 described above. First, in step 611, the service execution device 104b is called to execute the service S2, and in the next step 612, the service execution device 104c is called to execute the service S3. The protocol for calling the service execution devices 104b and 104c is HTTP. In step 613, when the execution of the services S2 and S3 is completed, the respective execution results are transmitted to the flow processing apparatus 103a. The protocol for transmitting the execution result is HTTP.

  As a result, when the flow processing apparatus 103a receives the results of the services S2 and S3 in step 614, in step 615, the results of the services S2 and S3 are combined with the results of the service S1 and transmitted as an overall result to the request destination. . The request destination exists in the network 101a. When the flow processing apparatus 103 a itself is the request destination, the service result is output to the output unit 203.

  According to this embodiment, communication is suppressed between flow processing devices, and even when the number of calling services increases or the calling point of services changes, the settings at the time of system deployment can be used as they are, and the load during operation is also increased. It does not occur. In addition, since only communication between nodes determined in terms of security is required, it is not necessary to make a point that can pass through the firewall each time a service is added, and a decrease in security can be avoided.

  A recording medium recording software program codes for realizing the functions of the present embodiment is supplied to a system or apparatus, and a computer (CPU or MPU) of the system or apparatus reads and executes the program codes stored in the recording medium. . This also achieves the object of the present invention.

  In this case, the program code itself read from the computer-readable recording medium realizes the functions of the above-described embodiments, and the recording medium storing the program code constitutes the present invention.

  As a recording medium for supplying the program code, for example, a flexible disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a CD-R, a magnetic tape, a nonvolatile memory card, a ROM, or the like can be used.

  Further, by executing the program code read by the computer, not only the functions of the above-described embodiments are realized, but also the following cases are included. That is, based on the instruction of the program code, an OS (operating system) running on the computer performs part or all of the actual processing, and the functions of the above-described embodiments are realized by the processing. .

  Further, the program code read from the recording medium is written in a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer. After that, based on the instruction of the program code, the CPU of the function expansion board or function expansion unit performs part or all of the actual processing, and the function of the above-described embodiment is realized by the processing. It is.

It is a block diagram which shows an example of a structure of the flow processing system in this embodiment. It is a block diagram which shows an example of a structure of the flow processing apparatus 103 shown in FIG. It is the figure which represented typically an example of the flow description document in this embodiment. FIG. 4 is a schematic diagram illustrating an example when the flow description document 301 illustrated in FIG. 3 is divided. It is a schematic diagram which shows the execution procedure of a 1st flow process. It is a schematic diagram which shows the execution procedure of a 2nd flow process. It is a figure which shows an example of a structure of the transfer destination flow processing apparatus information 700 in this embodiment. 6 is a diagram illustrating an example of a flow description document 301. FIG. 5 is a diagram illustrating an example of a parent document 401. FIG. 5 is a diagram illustrating an example of a partial document 402. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 Network 102 Firewall 103 Flow processing apparatus 104 Service execution apparatus 201 Control part 202 Input part 203 Output part 204 Communication control part 205 Storage part

Claims (8)

A method of executing a service executed on the second network by a first flow processing device connected to a first network and a second flow processing device connected to a second network,
A second document describing a procedure for the first flow processing device to call the second flow processing device from a first document describing the service calling procedure; and the second network. Generating a third document describing a calling procedure of the service executed in
A step of the first flow processing apparatus registers the third document of the second flow processing apparatus,
Calling the second flow processing device according to a procedure described in the second document by the first flow processing device;
The second flow processing device calling a device that executes the service according to a service calling procedure described in the third document;
A method of executing a service, comprising: a step of transmitting a result of a service executed by the second flow processing device to the first flow processing device. The first flow processing device extracts a calling procedure of the service from the first document based on a network address of a device that executes the service on the second network, and the second document and the second The method according to claim 1, further comprising: generating three documents.   The method of claim 1, wherein the first network is an external network of a firewall, and the second network is an internal network of the firewall. A flow processing apparatus connected to a first network,
A second document describing a procedure for calling a flow processing device connected to the second network from a first document describing a service calling procedure executed in the second network; Generating means for generating a third document describing a calling procedure of a service executed in the network of 2;
Means for registering the third document in a flow processing apparatus connected to the second network;
Means for calling a flow processing device connected to the second network according to the procedure described in the second document;
A flow processing apparatus comprising: means for receiving an execution result of a service called by a flow processing apparatus connected to the second network according to a calling procedure described in the third document. The generation means extracts a calling procedure of a service executed on the second network from the first document based on a network address of a device that executes the service on the second network, and The flow processing apparatus according to claim 4 , wherein the document and the third document are generated. The flow processing apparatus according to claim 4 , wherein the first network is an external network of a firewall, and the second network is an internal network of the firewall. The program for functioning a computer as each means of the flow processing apparatus of any one of Claims 4 thru | or 6 . A computer-readable recording medium storing a program for causing a computer to function as each unit of the flow processing device according to any one of claims 4 to 6 .

Images