JP5977706B2 - Data exchange system and method for setting environment that enables data exchange between virtual private clouds - Google Patents

Description

  The present invention relates to a data exchange system and a method for setting an environment that enables data exchange between virtual private clouds.

  Recently, cloud computing has attracted attention. The form of paying only the usage fee without using computing resources as an asset by itself is a conventional on-premise type, and purchasing and using computing resources with sufficient margins, drastically reducing costs Is possible.

  However, in view of the dangers of security when using public clouds, an increasing number of companies construct private clouds. Comparing the public cloud with the private cloud, the private cloud is characterized by high security in terms of security because it is initially installed in a data center that is purchased on-premises or connected via a dedicated line. However, because there is an upper limit on resources, there is a possibility of resource shortage when necessary. On the other hand, the public cloud has abundant resources, so there is a merit that you can secure resources as much as you need, but it will be safe because it will leave your data to public cloud operators. I have anxiety. By combining the good points of these two clouds, data that does not need to be secure is placed in the public cloud, and data that must be secured is placed in a private cloud. A hybrid cloud is being built.

  At this time, a virtual private cloud is constructed in order to ensure the safety of communication between the public cloud and the private cloud and to separate the tenants in the multi-tenant environment of the public cloud. The virtual private cloud is configured so that a private cloud of each tenant can be constructed by separating communication between tenants using a virtual network on a public cloud. By connecting between the private cloud and the virtual private cloud using VPN (Virtual Private Network), it is possible to freely assign an IP address for each tenant to a virtual machine on the virtual private cloud, as in the private cloud. .

  When each tenant uses a virtual private cloud, even if the same cloud platform is used, a mechanism for easily exchanging data between virtual private clouds is not prepared. Therefore, it is necessary to use an online storage service for exchanging data, or to connect tenants who want to exchange data with another network. For example, many online storage services provide a function that allows users to share files by assigning a URL to any file stored on the storage service and accessing and downloading via the URL. doing. Some also provide a function of creating a shared folder accessible by specific users (see Non-Patent Document 1).

“Dropbox makes it possible to share files with non-users with the“ get link ”function”, ITmedia News (April 24, 2012); http://www.itmedia.co.jp/news/articles/1204/ 24 / news046.html

  However, when data is exchanged between users using a virtual private cloud, if an online storage service different from that of the virtual private cloud is used, it will be once online via an on-premises Internet exit. You have to access the storage. For this reason, (i) network delays occur, (ii) URLs that point to cloud storage files leak, users other than the tenant who wants to share the files can also access (iii) different There is a possibility that multiple accounts need to be managed to use the cloud service.

  The present invention has been made in view of such a situation, and realizes a mechanism that allows data exchange among a plurality of tenants in a cloud service providing a virtual private cloud safely and easily. .

  In order to achieve the above object, the data exchange system according to the present invention includes a cloud service system in which a plurality of tenants, a plurality of virtual private clouds used by the plurality of tenants are set, and a separate tenant used by different tenants. And a virtual private cloud communication setting system for setting an environment that enables data exchange between virtual private clouds. In the present invention, the virtual private cloud communication setting system includes a data exchange area for data exchange provided in the cloud service system, a first segment corresponding to the virtual private cloud used by the first tenant, and a second segment. Each of the second segments corresponding to the virtual private cloud used by the tenant is connected via NAT (Network Address Translation). In this configuration, communication between the virtual machine set in the first segment and the virtual machine set in the second segment is possible only via NAT.

  Further features related to the present invention will become apparent from the description of the present specification and the accompanying drawings. The embodiments of the present invention can be achieved and realized by elements and combinations of various elements, the following detailed description, and the appended claims. Further, the scope of claims and application examples of the present invention do not limit the present invention in any way.

  According to the present invention, data can be exchanged between a plurality of tenants safely and easily within a cloud service providing a virtual private cloud.

It is a figure which shows the example of schematic structure of the data exchange system by embodiment of this invention. It is a figure which shows the structure of the communication setting system between virtual private clouds. It is a figure which shows the example of a screen at the time of selecting the exchange registration tab in the screen of the self-service portal at the time of setting communication between virtual private clouds, and using a stem. It is a figure which shows the example of a screen when the replacement application tab is selected on the screen of the self-service portal. It is a figure which shows the example of a screen when the exchange permission tab is selected on the screen of the self-service portal. It is a figure which shows the example of a screen when the access setting tab is selected on the screen of the self-service portal. It is a figure which shows the structural example of the tenant information table which the communication setting system between virtual private clouds uses. It is a figure which shows the structural example of the data exchange area information table utilized by the communication setting system between virtual private clouds. It is a figure which shows the structural example of the connection management table which the communication setting system between virtual private clouds uses. It is a figure which shows the structural example of the access control table which a virtual private cloud communication setting system utilizes. It is a structural example of the address management table utilized by the communication setting system between virtual private clouds. It is a structural example of the data exchange application table used by the communication setting system between virtual private clouds. It is a figure which shows the logical network and the example of a structure of a virtual machine at the time of ensuring the area which can exchange data between two different tenants using a virtual private cloud communication system. It is a figure which shows the example of an initial screen of a self-service portal. It is a flowchart for demonstrating the whole process by the communication setting system between virtual private clouds. It is a flowchart for demonstrating the process at the time of registering data exchange in the communication setting system between virtual private clouds. It is a flowchart for demonstrating the process at the time of applying for utilization of the registered data exchange area in the virtual private cloud communication setting system. It is a flowchart for demonstrating the process at the time of permitting the utilization application of the registered data exchange area in the communication setting system between virtual private clouds. It is a flowchart for demonstrating the process at the time of setting the virtual machine which can access the constructed data exchange area in the communication setting system between virtual private clouds. It is a flowchart for demonstrating the process (detail of step 1806) of the virtual network connection program which comprises a communication setting system between virtual private clouds.

  The present invention relates to an in-cloud communication setting system that provides an environment in which data can be safely exchanged between virtual private clouds of a plurality of tenants constructed in one public cloud.

  Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be noted that this embodiment is merely an example for realizing the present invention, and does not limit the technical scope of the present invention. In each drawing, the same reference numerals may be given to common configurations.

  In the following description, each information of the present invention will be described in a “table” format. However, the information does not necessarily have to be expressed in a data structure by a table, such as a data structure such as a list, a DB, a queue, or the like. It may be expressed as Therefore, “table”, “list”, “DB”, “queue”, etc. may be simply referred to as “information” to indicate that they do not depend on the data structure.

  In addition, when explaining the contents of each information, the expressions “identification information”, “identifier”, “name”, “name”, “ID” can be used, and these can be replaced with each other. It is.

  In the following, each process in the embodiment of the present invention will be described using “program” as the subject (operation subject), but the processing determined by the program being executed by the processor (CPU) is the memory and communication port (communication control). Therefore, the description may be based on the processor. Part or all of the program may be realized by dedicated hardware, or may be modularized. Various programs may be installed in each computer by a program distribution server or a storage medium.

<Data exchange system configuration outline>
FIG. 1 is a conceptual diagram showing a schematic configuration of a data exchange system according to an embodiment of the present invention. The data exchange system 100 includes a plurality of tenants (only tenants A_1 and B_2 are shown in FIG. 1) and a cloud system 8 provided by a cloud operator, and these are the Internet or network businesses. Connected through a closed network 7.

  In the data center of the tenant A_1 and the tenant B_2, the computers 5 and 6 are respectively connected via the VPN devices 3 and 4 via the Internet or the VPN devices 9 and 10 in the closed network 7 and the cloud system 8 of the network operator. Thus, communication with the virtual machines 12 and 13 in the cloud service 11 is possible.

  Further, the virtual private cloud inter-communication setting system 14 can control resources such as a network, a virtual machine, and an external storage device in the cloud service 11. In FIG. 1, the virtual private cloud communication setting system 14 is provided in the cloud system 8. However, the present invention is not limited to this configuration, and the cloud system 8 may be remotely connected to the cloud system 8 via a network. good.

<Configuration of virtual private cloud communication setting system>
FIG. 2 is a diagram showing a system configuration of the virtual private cloud communication setting system 14 according to the embodiment of the present invention.

  The virtual private cloud communication setting system 14 includes a terminal device 141 including a CPU 141A and a memory 141B, an external storage device 142, and a communication port 143 for network connection.

  The external storage device 12 includes a self-service portal program 142A, a virtual network connection program 142B, a tenant information table 142C, a data exchange area information table 142D, a connection management table 142E, and an access control table 142F, which will be described later. An address management table 142G and a data exchange application table 142H are stored.

<Example of self-service portal screen>
(I) FIG. 14 is a diagram illustrating an initial screen example of the self-service portal. When a user logs in to the virtual private cloud communication setting system 14 from each tenant, the initial screen is displayed on the computer of the logged-in tenant.

  The client screen 300 includes an exchange registration tab 301 for displaying a screen for newly registering a data exchange area (data exchange area), an exchange application tab 302 for displaying a screen for applying for use of the registered data exchange area, It has an exchange permission tab 303 for authorizing an application, and an access setting tab 304 for determining a virtual machine that can access a registered data exchange area.

(Ii) FIG. 3 is a diagram showing a screen example of the self-service portal displayed when the exchange registration tab 301 is selected. This screen is used by a tenant user who wants to set a data exchange area.

  When the logged-in user selects the exchange registration tab 301, the tenant name 305 for performing exchange registration, the input area 306 for specifying the size of the data exchange area to be registered, the input area 307 for the name at access, and the registration request A button 308 for performing is displayed.

  For example, the tenant XXX Corporation (a user thereof) inputs a capacity to be secured in the input area 306 and inputs an access point name in the input area 307. When the registration button 308 is pressed, the virtual private cloud communication setting system 14 secures an area of the access point name designated as a free area of the storage.

(Iii) FIG. 4 is an example of a self-service portal screen displayed when the replacement application tab 302 is selected. This screen is used by a user other than the data exchange area setting person who wants to use the exchange area.

  When the logged-in user selects the exchange application tab 302, a list 401 of tenant names that have registered data exchange areas and an application button 402 are displayed on the screen.

  For example, AAA Co., Ltd. (user) designates a tenant (multiple selection is possible) to exchange data from the list 401 with a check box, and presses the application button 402 to apply for data exchange.

(Iv) FIG. 5 is an example of a self-service portal screen displayed when the exchange permission tab 303 is selected. This screen is used when a tenant user who has received a replacement application permits the application.

  When the logged-in user selects the exchange permission tab 303, a list 501 of tenant names that have applied for use of the registered data exchange area is displayed on the screen.

  For example, the tenant XXX Co., Ltd. (the user) designates a tenant permitted to exchange data from the list 501 using a check box, and presses the allow button 502 to permit data exchange.

  When another tenant makes a permission application, the virtual private cloud inter-communication setting system 14 sends a message prompting the tenant that has set the data exchange area to exchange (or refuse to exchange). You may do it. In this case, it is possible to alert the tenant of the existence of an application that should be allowed to be exchanged.

(V) FIG. 6 is an example of a self-service portal screen displayed when the access setting tab 304 is selected. This screen is a screen that is used when a tenant user permitted to exchange sets an access-permitted virtual machine.

  When the logged-in user selects the access setting tab 304, a list 601 of storage server addresses having usable data exchange areas and a list 602 of virtual machine addresses for which connection permission is set are displayed on the screen. The

  For example, XXX Corporation (user) specifies the address of the storage server to be connected using a check box, and specifies the address of a virtual machine that is permitted to connect using the check box. Then, a registration button 603 is pressed to set an accessible virtual machine. In FIG. 6, two data exchange areas are created. A user of XXX Corporation uses this screen to set his own virtual machine that can access each data exchange area.

<Tenant information table>
FIG. 7 is a diagram illustrating an example of the tenant information table 142C for managing the tenant using the system in the virtual private cloud communication setting system 14.

  The tenant information table 142C has a tenant ID 701 and a tenant name 702 as configuration information. With this table, all tenants using the system can be managed.

<Data exchange area information table>
FIG. 8 is a diagram showing an example of a data exchange area information table 142D for managing information exchanged and registered by each tenant in the virtual private cloud communication setting system 14.

  The data exchange area information table 142D has tenant ID 801, data exchange ID 802, data exchange storage server address 803, data exchange area size 804, and access point name 805 as configuration information.

<Connection management table>
FIG. 9 is a diagram showing a configuration example of a connection management table 142E for managing the connection relationship between the set data exchange area and the NAT to be constructed in the virtual private cloud communication setting system 14.

  The connection management table 142E includes the data exchange ID 901, the NAT address (1) 902 indicating the port address of the NAT connected to the data exchange area in the segment (1), and the data exchange area in the segment (2). The configuration information includes a NAT address (2) 903 indicating the port address of the NAT on the connected side and an address 904 of the data exchange storage server.

  When constructing a data exchange environment between different virtual private clouds, first, a data exchange ID 901 and an address (data exchange area address) 904 are described in the connection management table 142E, and the processing shown in FIG. Is set, NAT address (1) 902 and NAT address (2) 903 are described.

<Access control table>
FIG. 10 is a diagram showing an example of an access control table 142F for managing information on virtual machines that are permitted to access in the virtual private cloud communication setting system 14.

  The access control table 142F has a data exchange ID 1001 and an access permission address 1002 as configuration information. This table manages the addresses of the shared server and the access-permitted virtual machine that are set for access according to FIG.

<Address management table>
FIG. 11 is a diagram illustrating an example of the address management table 142G for managing the virtual private cloud segment and the assigned address in the inter-virtual private cloud communication setting system 14.

  The address management table 142G has tenant ID 1101, virtual private cloud (enclosed by a dotted line in FIG. 1) ID 1102, segment information 1103, and used address list 1104 as configuration information. Addresses not listed in the address list can be assigned as NAT addresses.

<Data exchange application table>
FIG. 12 shows a data exchange application table for managing information on a tenant (for example, XXX Corporation) and an exchange application source (for example, AAA Corporation) as an exchange application destination in the virtual private cloud communication setting system 14. It is a figure which shows the example of 142H.

  The data exchange application table 142H includes tenant ID 1201, data exchange ID 1202, and application tenant ID 1203 as configuration information.

  For example, with respect to data exchange ID = 1 in FIG. 12, a tenant with tenant ID = 7 (for example, AAA stock for one data exchange area set by a tenant with tenant ID = 1 (for example, XXX Corporation)). Two tenants, a company) and a tenant with a tenant ID = 9 (for example, BBB Co., Ltd.) are in a state of applying for replacement.

<Logical configuration enabling access to data exchange area>
FIG. 13 is a diagram showing a logical configuration that enables access to the data exchange area. FIG. 13 shows a logical network between two different tenants and a virtual machine configuration constructed when a storage server area capable of exchanging data is secured using the virtual private cloud communication system 14. .

  The tenant A_1 is connected to the virtual private cloud 8 provided by the cloud operator via the VPN devices 3 and 9. A virtual machine 1301 and a virtual router 1302 are operating on the virtual network.

  On the other hand, the tenant B_2 is connected to the virtual private cloud 8 provided by the cloud operator via the VPN devices 4 and 10. A virtual machine 1304 and a virtual router 1305 are operating on the virtual network.

  When the virtual private cloud communication system 14 registers the data exchange area in response to the request from the tenant A_1 or the tenant B_2, the NAT server A_1303 is installed on the virtual private cloud of the tenant A and the tenant A_1 uses Is assigned to the NAT server A_1303.

  Further, the virtual private cloud communication system 14 installs the NAT server B_1306 on the virtual private cloud of the tenant B_2, and assigns a free address (192.168.1.254) in the segment used by the tenant B_2 to the NAT server. Assigned to B_1306.

  Further, the virtual private cloud communication system 14 installs the storage server 1307 on the virtual network managed by the cloud operator, and assigns the global address managed by the cloud operator to the NAT server A_1303 (10.1.1.251), Assigned to the NAT server B_1306 (10.1.1.252) and the storage server 1307 (10.1.1.27). At the same time, the inter-virtual private cloud communication system 14 sends the communication to the storage server 1307 to the NAT server A_1303 to the route table (not shown) of the virtual router 1302 on the virtual private cloud of the tenant A_1. A route is added to the route table (not shown) of the virtual router 1305 on the virtual private cloud of the tenant B_2 so that the communication to the storage server 1307 is transmitted to the NAT server B_1306.

  In the network configuration shown in FIG. 13, the addresses of the ports connected to the NAT server A — 1303 and NATB — 1306 and the storage server 1307 need only be different from each other (in FIG. 13, 10.1.251 and 10. 1.1.252 is different). On the other hand, the addresses of the corresponding ports in the segments 1 and 2 may be the same. Since each segment is connected to the storage server 1307 via NATA or NATB, it is possible to construct a system without the segments colliding with each other.

<Overview of virtual private cloud communication setting process>
The overall operation of the virtual private cloud communication setting system will be described below using a flowchart.

  FIG. 15 is a flowchart for explaining the overall outline of the virtual private cloud communication setting process by the virtual private cloud communication setting system.

  When a user of any tenant in the network (for example, tenant A_1 (XXX Corporation)) logs in to the self-service portal program 142A of the private cloud communication setting system 14 using a computer and receives the information (step) 1501), the self-service portal program 142A returns the screen shown in FIG. 14 (step 1502).

  When the user presses the tab, the self-service portal program 142A receives the operation type (step 1503).

  Then, the self-service portal program 142A determines the selected operation type (step 1504). That is, when the operation type is registration processing, the processing after step 1601 is executed, when the operation type is exchange processing, the processing after step 1701 is executed, and when it is permission processing, the processing after step 1801 is executed. In the case of processing, the processing after step 1901 is executed.

  When one of the processes is completed, the process proceeds to step 1502, and the processes after step 1502 are repeated.

<Exchange registration process>
FIG. 16 is a flowchart for explaining the details of the exchange registration process when the user selects the exchange registration tab on the self-service portal screen.

  When the user selects the exchange registration tab, the self-service portal program 142A transmits the self-service portal exchange registration screen (FIG. 3) to the tenant to which the selected user belongs and displays the screen (step 1601).

  When the user of the corresponding tenant inputs the capacity of the area he / she wants to use for replacement into 306, the name (access point name) for accessing the area is input into 307, and the registration button 308 is pressed, the self-service portal program 142A The tenant name, area size, and access point name are received from the corresponding tenant (step 1602).

  Then, the self-service portal program 142A selects a storage server that secures a data exchange area (step 1603), secures the area size (step 1604), and newly assigns a data exchange ID (serial number) ( Step 1605).

  Further, the self-service portal program 142A registers the tenant ID, data exchange ID, storage server address, area size, and access point name in the data exchange area information table 142D (step 1606), and ends the process.

<Exchange application processing>
FIG. 17 is a self-service portal screen for explaining the details of the exchange application process when a user of a tenant (for example, AAA Corporation) who does not have the corresponding data exchange area selects the exchange application tab. It is a flowchart.

  When the user selects the replacement application tab, the self-service portal program 142A extracts the tenant ID from the data exchange area information table 142D (step 1701), and extracts the corresponding tenant name from the tenant information table 142C (step 1702).

  The self-service portal program 142A creates a list of all tenant names associated with the data exchange ID (step 1703) and displays the screen of FIG. 4 on the self-service portal (step 1704).

  When the user selects a partner tenant whose data is to be exchanged from the tenant name list 401 and presses the application button 402, the selected information is sent from the tenant to the virtual private cloud communication setting system 14, and the self-service portal program 142A Receives the tenant ID of the application source, the tenant ID of the application destination, and the data exchange ID (step 1705).

  Then, the self-service portal program 142A sets the tenant ID of the application destination as the tenant ID, registers the data exchange ID in the data exchange application table 142H, and sets the tenant ID of the application source as the application tenant ID (step 1706). ), The process ends.

<Exchange permission process>
FIG. 18 is a flowchart for explaining the details of the exchange permission process when the user of the application tenant (for example, XXX Corporation) selects the exchange permission tab on the self-service portal screen.

  When the user of the application destination tenant selects the exchange permission tab, the self-service portal program 142A takes out the data exchange ID from the data exchange area information table 142D (step 1801).

  In addition, the self-service portal program 142A takes out the application tenant ID corresponding to the corresponding data exchange ID from the data exchange application table 142H (step 1802).

  Furthermore, the self-service portal program 142A extracts a tenant name corresponding to the application tenant ID from the tenant information table 142C, creates a list of tenant names (step 1803), and displays the screen of FIG. 5 on the self-service portal ( Step 1804).

  When the user of the application destination tenant selects a partner tenant whose data exchange is permitted from the tenant name list 501 and presses the permission button 502, the self-service portal program 142A receives the data exchange ID and the tenant ID ( Step 1805).

  The self-service portal program 142A also sends the received tenant ID, the cloud ID of the virtual private cloud being used, the tenant ID of the permission source, the cloud ID of the virtual private cloud being used, and the data exchange ID to the virtual network connection program 142B. (Step 1806). Details of step 1806 will be described later with reference to FIG.

  The self-service portal program 142A receives the end of the virtual network connection program (step 1807), deletes the corresponding entry from the data exchange application table (step 1808), and ends the process.

  When the processing of FIG. 18 is completed, NAT servers (for example, NAT server A_1303 and NAT server B_1306) necessary to access the data exchange area are generated.

<Access setting process>
FIG. 19 is a flowchart for explaining the details of the access setting process when the user of the tenant (for example, XXX Corporation) who has executed the exchange permission process selects the access setting tab on the self-service portal screen.

  When the tenant user who executed the exchange permission process selects the access setting tab, the self-service portal program 142A uses the tenant ID of the user as a key, and the address of the storage server (address 904 in FIG. 9) from the data area exchange information table 142D. Is created (step 1901). At this point, NAT addresses (1) and (2) in the connection management table 142E (FIG. 9) are blank.

  Next, the self-service portal program 142A obtains the segment information and the used address list from the address management table 142G using the tenant ID and the cloud ID of the virtual private cloud being used as a key, and obtains a virtual machine address list. It is created (step (1902)), and the screen of FIG. 6 is displayed on the self-service portal (step 1903).

  When the user selects a virtual machine that is permitted to access the storage server and presses the registration button 603, the self-service portal program 142A receives the data exchange ID and the address of the virtual machine that is permitted to access (step 1904).

  Then, the self-service portal program 142A registers the received data exchange ID and the address of the access-permitted machine in the access control table 142F (FIG. 10) (step 1905).

  Furthermore, the self-service portal program 142A sets the NAT virtual machine obtained from the connection management table 142E using the data exchange ID as a key so that only communication from the access-permitted machine is transferred (step 1906), and the process is performed. finish.

<Processing by virtual network connection program>
FIG. 20 is a flowchart for explaining details of the processing (step 1806) of the virtual network connection program 142B.

  The virtual network connection program 142B receives, from the self-service portal program 142A, the pair of tenant ID and cloud ID and the data exchange ID for the two sets of the application side and the permission side (step 2001).

  The virtual network connection program 142B uses the tenant ID and cloud ID on the application side as keys to obtain segment information and an address list that are in use from the connection management table 142E, and acquires an unused address. (Step 2002).

  Similarly, the virtual network connection program 142B obtains the segment information and address list being used from the connection management table 142E by using the tenant ID and cloud ID of the permitting side as keys, and acquires unused addresses (step 2003).

  Next, the virtual network connection program 142B creates a NAT virtual machine (NAT server) on the virtual network of the private cloud on the requesting side and the permitting side (Step 2004), and the addresses acquired in Step 2002 and Step 2003 are Set for each NAT virtual machine (step 2005).

  Thereafter, the virtual network connection program 142B obtains the address of the storage server from the data exchange area information table 142D using the permitting tenant ID and data exchange ID as keys (step 2006).

  Then, the virtual network connection program 142B requests the cloud management system (outside the scope of the present invention) to obtain two addresses of the same segment as the storage server 1307 (step 2007).

  Furthermore, the virtual network connection program 142B sets the address obtained in Step 2007 to the NAT virtual machine (for example, NAT server) created in Step 2004 (Step 2008).

  Next, the virtual network connection program 142B communicates with the virtual routers (1302 and 1305) on the virtual private cloud of the permission source and the permission destination, and the communication to the storage server 1307 is a NAT virtual machine (NAT server A_1303 and NAT server B_1306). Route information is added so as to be transmitted to (step 2009).

  Finally, the virtual network connection program 142B registers the data exchange ID, the addresses of the two NAT virtual machines obtained in Step 2007, and the address of the storage server in the connection management table 142E (Step 2010), and ends.

<Summary>
(I) The communication setting system between virtual private clouds according to the embodiment of the present invention is a self-service for setting which tenant using the virtual private cloud exchanges data with which tenant and from which virtual machine can exchange data. A portal, a virtual network connection system that automatically performs network connection between the virtual private cloud, and a virtual machine that is a client terminal that uses the self-service portal. A tenant using a virtual private cloud accesses the self-service portal from a virtual machine that is a client terminal and registers that they want to exchange data. The other tenant who wants to exchange data accesses the self-service portal in the same manner, selects a tenant that can exchange data, and requests data exchange. The tenant who received the data exchange request selects the other party and instructs the data exchange permission. When data exchange between the two tenants becomes possible by the above operation, the virtual network connection program provisions a NAT (Network Address Translation) virtual machine on each virtual private cloud, and the address and data to connect to the virtual private cloud. An address belonging to the network segment of the storage server for performing the exchange is set. A setting is added to the router virtual machine on each virtual private cloud so that a packet for accessing the storage server is transferred to the NAT virtual machine. After that, each tenant uses the self-service portal to set the address of the virtual machine that can access the storage server for data exchange, and the virtual network connection system adds the NAT-capable address to the NAT virtual machine. To do. By doing so, it becomes possible to access a storage server for data exchange from a virtual machine on each virtual private cloud, and data exchange between virtual private clouds becomes possible. At this time, access from one virtual private cloud to the other virtual private cloud is prohibited by the NAT virtual machine, so that the safety as a private cloud is ensured. Thus, by setting the environment for data exchange using the self-service portal of the communication setting system between virtual private clouds, it becomes possible to exchange data between virtual private clouds safely.

(Ii) In other words, the virtual private cloud communication setting system is used by the data exchange area provided in the storage area, the first segment corresponding to the virtual private cloud used by the first tenant, and the second tenant. The environment is set so that each of the second segments corresponding to the virtual private cloud to be connected is connected via NAT. In this environment, communication between the virtual machine set in the first segment and the virtual machine set in the second segment is possible only via NAT. In this environment, each segment is separated by NAT. By setting the environment as described above, it is possible to exchange data between different virtual private clouds used by different tenants. In other words, data can be exchanged within a closed network in one cloud system, and network performance can be secured while ensuring safety. In addition, management of IDs and passwords for using different cloud services becomes unnecessary. Furthermore, since access is only possible from a virtual machine on the virtual private cloud, it is possible to avoid the risk of wiretapping information by other tenants. In the embodiment, a configuration that enables data exchange between two segments is shown, but data exchange is possible between three or more segments (virtual private clouds used by three or more tenants). The environment to perform can be realized by the same procedure.

  In such an environment, the address of the port connected to the data exchange area of the NAT set in the first segment (the address 10.1.251 of the NAT server A 1303 in FIG. 13) is the second segment. Is different from the address of the port connected to the data exchange area (address 10.1.252 of NAT server A 1303 in FIG. 13). Addresses in other configurations may be common in the first and second segments. By doing so, it becomes possible to construct an environment for data exchange without collision of network segments.

  The virtual private cloud communication setting system provides each tenant with data on a GUI screen for setting an environment that allows data exchange between different virtual private clouds used by different tenants. Specifically, the GUI screen includes an exchange registration screen for setting a data exchange area, a screen for applying for use of the data exchange area, a screen for permitting use of the data exchange area, a data And a screen for setting a virtual machine accessible to the exchange area. The user of each tenant can switch each screen by selecting a tab on the GUI screen. By doing so, the tenant can easily request the environment setting for data exchange from the cloud system using the screen.

(Iii) The present invention can also be realized by software program codes that implement the functions of the embodiments. In this case, a storage medium in which the program code is recorded is provided to the system or apparatus, and the computer (or CPU or MPU) of the system or apparatus reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the program code itself and the storage medium storing the program code constitute the present invention. As a storage medium for supplying such program code, for example, a flexible disk, CD-ROM, DVD-ROM, hard disk, optical disk, magneto-optical disk, CD-R, magnetic tape, nonvolatile memory card, ROM Etc. are used.

  Also, based on the instruction of the program code, an OS (operating system) running on the computer performs part or all of the actual processing, and the functions of the above-described embodiments are realized by the processing. May be. Further, after the program code read from the storage medium is written in the memory on the computer, the computer CPU or the like performs part or all of the actual processing based on the instruction of the program code. Thus, the functions of the above-described embodiments may be realized.

  Further, by distributing the program code of the software that realizes the functions of the embodiment via a network, it is stored in a storage means such as a hard disk or memory of a system or apparatus, or a storage medium such as a CD-RW or CD-R And the computer (or CPU or MPU) of the system or apparatus may read and execute the program code stored in the storage means or the storage medium when used.

  Finally, it should be understood that the processes and techniques described herein are not inherently related to any particular apparatus, and can be implemented by any suitable combination of components. In addition, various types of devices for general purpose can be used in accordance with the teachings described herein. It may prove useful to build a dedicated device to perform the method steps described herein. Various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiments. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined. Although the present invention has been described with reference to specific examples, these are in all respects illustrative rather than restrictive. Those skilled in the art will appreciate that there are numerous combinations of hardware, software, and firmware that are suitable for implementing the present invention. For example, the described software can be implemented in a wide range of programs or script languages such as assembler, C / C ++, perl, shell, PHP, Java (registered trademark).

  Furthermore, in the above-described embodiment, control lines and information lines are those that are considered necessary for explanation, and not all control lines and information lines on the product are necessarily shown. All the components may be connected to each other.

  In addition, other implementations of the invention will be apparent to those skilled in the art from consideration of the specification and embodiments of the invention disclosed herein. Various aspects and / or components of the described embodiments can be used singly or in any combination in a computerized storage system capable of managing data. The specification and specific examples are merely exemplary, and the scope and spirit of the invention are indicated in the following claims.

1, 2, data center 3, 4, 9, 10, VPN device 5, 6, computer 7, Internet 8, cloud service provider cloud system 11, cloud service 12, 13 ... Virtual machine 14 ... Virtual private cloud communication setting system 100 ... Data exchange system 141 ... Terminal device 141A ... CPU
141B ... Memory 142 ... External storage device 142A ... Self-service portal program 142B ... Virtual network connection program 142C ... Tenant information table 142D ... Data exchange area information table 142E ... Connection management Table 142F ... Access control table 142G ... Address management table 142H ... Data exchange application table.

Claims (12)

Virtual that sets up an environment that allows data exchange between multiple tenants, a cloud service system configured with multiple virtual private clouds used by the multiple tenants, and separate virtual private clouds used by different tenants A private cloud communication setting system, and
The virtual private cloud communication setting system includes a data exchange area for data exchange provided in a cloud service system, a first segment and a second tenant corresponding to a virtual private cloud used by a first tenant. Connecting each of the second segments corresponding to the virtual private cloud used by the
A data exchange system, wherein communication between a virtual machine set in the first segment and a virtual machine set in the second segment is possible only through the NAT. In claim 1,
The address of the port connected to the data exchange area of the NAT set in the first segment is different from the address of the port connected to the data exchange area of the NAT set in the second segment. A featured data exchange system. In claim 2,
The inter-virtual private cloud communication setting system sets the data exchange area in the cloud service system in response to the data exchange area setting request from the first tenant, and receives the data exchange area from the second tenant. A data exchange system, wherein the NAT is set based on an access permission of the first tenant for an access request for a data exchange area. In claim 3,
In response to a request from the first tenant, the virtual private cloud communication setting system is configured to access a virtual machine provided in the first segment that is accessible to the data exchange area via the NAT. A data exchange system characterized by deciding. In claim 1,
The inter-virtual private cloud communication setting system uses GUI screen data for setting an environment that enables data exchange between separate virtual private clouds used by the first and second tenants. 2 to the tenant
The data exchange system, wherein the first and second tenants receive the GUI screen data and display the GUI screen. In claim 5,
The virtual private cloud communication setting system uses, as the GUI screen, an exchange registration screen for setting the data exchange area, a screen for applying for use of the data exchange area, and use of the data exchange area. A data exchange system, characterized in that a screen for allowing and a screen for setting a virtual machine accessible to the data exchange area are provided to the first and second tenants. A method for setting an environment that enables data exchange between different virtual private clouds used by different tenants of a cloud service system using a communication setting system between virtual private clouds,
The virtual private cloud communication setting system sets a data exchange area for the data exchange in the cloud service system;
The inter-virtual private cloud communication setting system includes a second segment corresponding to the data exchange area, a first segment corresponding to the virtual private cloud used by the first tenant, and a virtual private cloud used by the second tenant. Connecting each of the segments via NAT,
2. A method according to claim 1, wherein communication between a virtual machine set in the first segment and a virtual machine set in the second segment is possible only via the NAT. In claim 7,
The address of the port connected to the data exchange area of the NAT set in the first segment is different from the address of the port connected to the data exchange area of the NAT set in the second segment. Feature method. In claim 8,
Further, the virtual private cloud communication setting system sets the data exchange area in the cloud service system in response to the data exchange area setting request from the first tenant, and the second tenant A method comprising: setting the NAT based on an access permission of the first tenant for an access request to the data exchange area. In claim 9,
Further, the virtual private cloud inter-communication setting system is provided in the first segment that is accessible in the data exchange area via the NAT in response to a request from the first tenant. A method comprising the step of determining a machine. In claim 7,
Further, the virtual private cloud communication setting system receives GUI screen data for setting an environment that enables data exchange between different virtual private clouds used by the first and second tenants. And sending to the second tenant;
The method wherein the first and second tenants receive the GUI screen data and display the GUI screen. In claim 11,
The virtual private cloud communication setting system uses, as the GUI screen, an exchange registration screen for setting the data exchange area, a screen for applying for use of the data exchange area, and use of the data exchange area. A method for providing a screen for allowing and a screen for setting a virtual machine accessible to the data exchange area to the first and second tenants.

Images