JP5073616B2 - User identification type reverse proxy device, data relay method thereof, and program thereof - Google Patents

Description

  The present invention is a technology that constitutes an Internet communication technology for performing data communication using a hypertext transfer protocol represented by WWW (World Wide Web). In particular, the Internet communication field belongs to the VPN communication field for securely accessing a VPN (Virtual Private Network) outside the company from an intranet closed within the company.

  A conventional reverse proxy device is positioned as a relay device based on a hypertext transfer protocol between a user and a web server, and is mainly realized by using a program called apache or squid.

  The user describes the identifier of the reverse proxy device in the host identifier of the destination unified resource location specifier, and transmits data to the reverse proxy device. The reverse proxy device converts the host identifier addressed to itself into the host identifier of the actual web server, and transfers the data to the web server. At this time, by converting the data to a different web server host identifier for each data relay and transferring the data, it is possible to distribute the load among the plurality of web servers.

  By using the reverse proxy device, the host identifier of the web server is concealed from the user, so that it is also effective in terms of security.

  For example, Non-Patent Documents 1 and 2 are provided as documents describing the reverse proxy device.

Performance evaluation and application area of load balancing control algorithm, Performance Evaluation of a Load Balancing Routing Algorithm for a Cache Server Array, Hiroka Tonami, Kazunori Kumagai, Shinya Nogami, Takeo Abe, IEICE Technical Report, NS, Network System, IEICE technical report, Vol. 101, no. 8 (20010412), pp. 15-20, NS2001-3, The Institute of Electronics, Information and Communication Engineers, ISSN: 09135685 WWW cluster system that uses the content simultaneous release mechanism by notification, Ichiro Nishima, Eiji Kawai, Kenichi Chinen, Hideichi Yamaguchi, Heiichi Yamamoto, Transactions of Information Processing Society of Japan, Vol. 43, no. 11 (20021115), pp. 3439-3447, Information Processing Society of Japan, ISSN: 0387806

  In the conventional reverse proxy device, it is possible to specify a plurality of transfer destination web servers. However, even if an individual web server is prepared for each user, a single reverse proxy device cannot uniquely transfer a destination web server for each transmission user.

  For example, as a network configuration example, the first network is positioned as a corporate intranet, a user is positioned, the second network is positioned as an application service provider network, a web server is positioned, There is a configuration in which the second network is interconnected only through the reverse proxy device. In this configuration, in the first network, only the host identifier and address in the unified resource location specifier destined for the reverse proxy device need be managed regardless of the addition of the web server in the second network. On the other hand, in the second network, a web server can be added without affecting the first network.

  However, in a single reverse proxy device, since it was not possible to uniquely specify and transfer the destination web server for each sending user, a separate web server was prepared for each user on the second network to provide services. Could not do. Therefore, in the present invention, it is an object to be solved to uniquely specify a destination web server for each transmission user.

  Of the inventions disclosed in this specification, the outline of typical ones will be briefly described as follows.

In the invention of claim 1, with respect to the reverse proxy device, among the destination uniform resource locator configured to include a directory identifier that includes the host identifier and the user identifier comprising an identifier of the first network, from directories identifier A function is added for extracting a user identifier , specifying a destination host identifier from the extracted user identifier with reference to a conversion table, and converting the host identifier described in the destination unified resource location specifier into the specified destination host identifier. Thus, it is possible to uniquely specify the destination web server for each transmission user.

Furthermore, the invention of claim 2 has a function of specifying a destination address by referring to different address resolution servers when sending hypertext transfer protocol data to the first network and the second network. In addition, it is possible to uniquely specify a destination web server for each transmission user under a condition in which different networks are interconnected via a reverse proxy device.

Furthermore, the invention of claim 3 is a data relay method for realizing the contents of the invention of claim 1, and the invention of claim 4 is for causing a computer to function as the reverse proxy device according to claim 1 or 2. It is a program.

  According to the present invention, in a single reverse proxy device, a destination web server can be uniquely specified for each transmission user and transferred.

  A configuration example of the present invention will be described.

  FIG. 1 shows a network configuration according to an embodiment of the present invention. 1-1 is a network, 1-2 is VPN # 1, 1-3 is VPN # 2, and 1-4 is VPN # 3. 1-5 is a user identification type reverse proxy device according to the embodiment of the present invention. 1-6 is the user # 1 (more precisely, the terminal of the user # 1), and 1-7 is the user # 2 (more precisely, the terminal of the user # 2). 1-8 is DNS # 1, 1-9 is DNS # 2, and 1-10 is DNS # 3. DNS # 1 to DNS # 3 are DNS (Domain Name System) servers, which manage the correspondence between names and IP (Internet Protocol) addresses. 1-11 is server # 1, 1-12 is server # 2, 1-13 is server # 3, and 1-14 is server # 4.

  In this configuration, the network 1-1 is configured with VPN # 1, VPN # 2, and VPN # 3.

  VPN # 1 accommodates user # 1, user # 2, and DNS # 1. VPN # 2 accommodates server # 1, server # 2, and DNS # 2. VPN # 3 accommodates server # 3, server # 4, and DNS # 3.

  VPN # 1 is the network interface # 1, VPN # 2 is the network interface # 2, and VPN # 3 is the network interface # 3, which are connected to the user identification type reverse proxy device 1-5.

  These include VPN # 1: vpn1, VPN # 2: vpn2, VPN # 3: vpn3, DNS # 1: dns1, DNS # 2: dns2, DNS # 3: dns3, user # 1: user1, user # 2: user2, server # 1: server1, server # 2: server2, server # 3: server3, server # 4: server4, network interface # 1: r_proxy1 of user-identified reverse proxy device 1-5, user-identified reverse proxy The network interface # 2: r_proxy2 of the device 1-5 and the network interface # 3: r_proxy3 of the user identification type reverse proxy device 1-5 are assigned names.

  Here, DNS # 1 is DNS # 1: dns1, user # 1: user1, user # 2: user2, and the relationship between the name and IP address of network interface # 1: r_proxy1 of user-identified reverse proxy device 1-5 Manage.

  DNS # 2 manages the correspondence between the DNS # 2: dns2, server # 1: server1, server # 2: server2, and the network interface # 2 of the user identification type reverse proxy device 1-5: r_proxy2 and the IP address. .

  DNS # 3 manages the correspondence between the name and IP address of DNS # 3: dns3, server # 3: server3, server # 4: server4, network interface # 3 of user-identified reverse proxy device 1-5: r_proxy3 .

  FIG. 2 is a conversion processing example of the destination unified resource location specifier in the user identification type reverse proxy device 1-5. This figure is composed of a destination unified resource position specifier 2-1 before conversion shown in the upper part and a destination unified resource position specifier 2-2 after conversion shown in the lower part.

  In this example, in the destination unified resource location specifier 2-1 before conversion, as an access means identifier, among http and host identifier, as an identifier of the user identification type reverse proxy device 1-5, r_proxy1 and among host identifiers, As the VPN identifier to which the transmission source user belongs, vpn1, among the directory identifiers, user1 as the transmission source user identifier, and among the directory identifiers, folder1 / file1 is specified as the directory identifier in the destination server. .

  In the destination unified resource location specifier 2-2 after conversion, the access means identifier is http, the host identifier is the destination server identifier, server1, and the host identifier is the VPN identifier to which the destination server belongs. , Vpn2 and directory identifier, user1 is specified as the sender user identifier, and folder1 / file1 is specified as the directory identifier in the destination server among the directory identifiers.

  FIG. 3 shows the conversion table 3-1. In this conversion table 3-1, a set of a destination server identifier after conversion and a VPN identifier to which the destination server belongs is derived from the source user identifier among the directory identifiers before conversion.

  For example, from user1 before conversion, server1. vpn2 is changed from user2 before conversion to server3. vpn3 is derived. Here, “.” Is a symbol indicating a boundary point between identifiers.

  FIG. 4 is a system configuration diagram of the user identification type reverse proxy device 1-5 according to the embodiment of this invention.

  4-1 is a destination host according to the contents of the directory identifier among the destination uniform resource location specifiers including the host identifier and the directory identifier described in the hypertext transfer protocol data received from VPN # 1. Host identifier conversion means for specifying an identifier and converting the host identifier described in the destination uniform resource location specifier into the specified destination host identifier. Reference numeral 4-2 denotes address resolution means for specifying a destination address with reference to DNS # 1 to # 3 when sending hypertext transfer protocol data to VPN # 1 to VPN # 3. 4-3 is a transfer means for transferring the hypertext transfer protocol data in which the destination uniform resource location specifier with the converted host identifier is described to VPN # 1, VPN # 2, and VPN # 3.

  3-1 is a conversion table shown in FIG. In the conversion table 3-1, the correspondence between the user identifier and the destination host identifier is registered. The host identifier conversion unit 4-1 extracts the user identifier from the directory identifier of the destination unified resource location specifier, and specifies the destination host identifier by referring to the conversion table 3-1 from the extracted user identifier.

  Needless to say, the user-identified reverse proxy apparatus 1-5 includes means included in a normal reverse proxy apparatus in addition to the means shown in FIG.

  An operation example in the above configuration will be described.

  Here, an example in which the user # 1 accesses the folder 1 / file 1 of the server # 1 in the hypertext transfer protocol layer in FIG. 1 will be described.

  The user # 1 uses the destination unified resource location specifier http: // r_proxy1. The hypertext transfer protocol data to which vpn1 / user1 / folder1 / file1 is assigned is transmitted.

  At this time, the host identifier r_proxy1. Based on vpn1, DNS # 1 is used to resolve the IP address of the user-identified reverse proxy device, and the corresponding data is transmitted to the user-identified reverse proxy device based on the conventional IP data transfer means. .

  When the user identification type reverse proxy device receives the hypertext transfer protocol data at the network interface # 1, the host identifier conversion unit 4-1 refers to the conversion table 3-1 in FIG. 2-1. Among the directory identifiers of 2-1, the set server1.1 is a set of the source user identifier user1 to the destination server identifier server1 and the VPN identifier vpn2 to which the destination server belongs. vpn2 is derived. Thereafter, this identifier set server1. Using vpn2, the host identifier before conversion r_proxy1. Replace vpn1.

  As a result, as shown by 2-2 in FIG. 2, the destination unified resource location specifier http: // server1. vpn2 / user1 / folder1 / file1 is generated.

  Thereafter, the network interface # 2 is changed based on the VPN identifier vpn2 to which the destination server of the host identifier of the destination unified resource location specifier after conversion of the generated hypertext transfer protocol data to which the destination unified resource location designator is assigned. Identify and send from here.

  At this time, the address resolving means 4-2 makes the host identifier server1. Based on vpn2, DNS # 2 is used to resolve the IP address of server # 1, and conventional IP data transfer means 4-3 transmits the data to server # 1.

  Response data from the server # 1 to the user # 1 is transferred in the conventional sequence by the user identification type reverse proxy device 1-5 operating in the same manner as the reverse proxy device.

  Here, the user identification type reverse proxy device is characterized in that each VPN is separated by an IP layer and that IP addresses destined for other VPNs are aggregated into one.

  For example, when the server # 5 is added in the VPN # 2, the DNS # 2 needs to rearrange the relationship between the name of the server # 5 and the IP address, but the DNS # 1 has the name and IP address to be managed. There is no need to modify the relationship.

  For this reason, when it is required to connect a large number of VPNs, the management load of the relationship between names and IP addresses in the DNS in each VPN increases by connecting each VPN via a user identification type reverse proxy device. Can be prevented.

  As a result, a large-scale network composed of a large number of VPNs can be easily constructed.

  As described above, according to the embodiment of the present invention, it is possible to uniquely designate and transfer a destination web server for each transmission user in a single reverse proxy device. For this reason, it is possible to provide a service by arranging users on the first network and preparing individual web servers for each user on the second network. Here, the first network and the second network may be operated with different host identifiers and addresses.

As a result, the first network is positioned as the corporate intranet, the user is positioned, the second network is positioned as the application service provider network, the web server is positioned, and then the first network and the second network are positioned. In the first network, the host identifier in the unified resource locator addressed to the reverse proxy device, regardless of the addition of the web server in the second network, etc. On the other hand, in the second network, it is possible to increase the number of web servers without affecting the first network.

  The user identification type reverse proxy device according to the embodiment of the present invention can be configured by a computer and a program. Moreover, you may comprise a part or all of the program with a hardware.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Of course.

It is a figure which shows the network structure of embodiment of this invention. It is a figure which shows the example of a conversion process of the destination uniform resource position designator in the user identification type | mold reverse proxy apparatus of embodiment of this invention. It is a figure which shows a conversion table. It is a system configuration figure of a user identification type reverse proxy device of an embodiment of the present invention.

Explanation of symbols

1-1 Network 1-2 VPN # 1
1-3 VPN # 2
1-4 VPN # 3
1-5 User identification type reverse proxy device 1-6 User # 1
1-7 User # 2
1-8 DNS # 1
1-9 DNS # 2
1-10 DNS # 3
1-11 Server # 1
1-12 Server # 2
1-13 Server # 3
1-14 Server # 4
2-1 Unified Resource Location Specifier Before Conversion 2-2 Unified Resource Location Specifier After Conversion 3-1 Conversion Table 4-1 Host Identifier Conversion Unit 4-2 Address Resolution Unit 4-3 Transfer Unit

Claims (4)

A reverse proxy device that relays hypertext transfer protocol data between a first network and a second network,
A conversion table for registering the correspondence between the user identifier and the destination host identifier including the identifier of the second network to which the destination server belongs;
Directory among the destination uniform resource location specifiers including the host identifier including the identifier of the first network and the directory identifier including the user identifier described in the hypertext transfer protocol data received from the first network. A user identifier is extracted from the identifier, a destination host identifier is identified from the extracted user identifier with reference to the conversion table, and a host identifier described in the destination uniform resource location specifier is converted into the identified destination host identifier. Host identifier conversion means;
The hypertext transfer protocol data in which the destination unified resource location specifier in which the host identifier is converted is described is transferred to the second network identified by the identifier of the second network to which the destination server included in the host identifier belongs. Transfer means;
The reverse proxy apparatus characterized by having. The reverse proxy device according to claim 1 ,
A reverse proxy device comprising address resolution means for specifying a destination address by referring to different address resolution servers when transmitting hypertext transfer protocol data to a first network and a second network. A data relay method in a reverse proxy device that relays hypertext transfer protocol data between a first network and a second network,
The reverse proxy device includes a user identifier, a conversion table for registering a correspondence between the destination host identifier comprising a second network identifier to attribution of destination servers, and host identifier converting means, a transfer means, and
The destination unified resource, wherein the host identifier conversion means includes a host identifier including a first network identifier and a directory identifier including a user identifier described in hypertext transfer protocol data received from the first network. Among the location specifiers, the user identifier is extracted from the directory identifier, the destination host identifier is identified from the extracted user identifier by referring to the conversion table, and the host identifier described in the destination unified resource location specifier is identified. To the destination host identifier
The transfer means identifies the hypertext transfer protocol data in which the destination unified resource locator in which the host identifier is converted is described by the identifier of the second network to which the destination server belongs included in the host identifier . Forward to your network,
A data relay method. As a reverse proxy device according to claim 1 or 2, a program for causing a computer to function.

Images