JP6475768B2 - Server apparatus and program - Google Patents

Description

  The present invention relates to a server device and a program.

  Conventionally, a technique in which a plurality of virtual servers are provided on a server device (logical server) and the virtual servers communicate with each other is known (see, for example, Patent Document 1).

JP 2016-31610 A

  However, if the virtual servers can communicate with each other freely, it may not be preferable from the viewpoint of security, so it is necessary to limit communication between the virtual servers.

  The present invention has been made in view of the circumstances described above, and an object of the present invention is to provide a server device and a program that allow a user to easily limit communication between virtual servers.

  The server device according to the first aspect of the present invention includes a plurality of virtual servers, a setting unit that sets group identification information common to two or more virtual servers for each virtual server, and the plurality of virtual servers. A connection unit that connects to be communicable, and when one virtual server among the plurality of virtual servers communicates data with another virtual server, group identification information set in the one virtual server; And a connection unit that restricts the communication based on group identification information set in the other virtual server.

  According to this aspect, when the number of virtual servers newly increases in the server device, the user considers the relationship with the group identification information set in the existing virtual server, and groups the newly added virtual servers. By setting the identification information, communication between the newly added virtual server and the existing virtual server can be restricted without changing the setting of the group identification information for the existing virtual server. Therefore, the user can easily limit communication between virtual servers.

  According to the present invention, a user can easily limit communication between virtual servers.

FIG. 1 is a schematic diagram of an information processing system including a server device of the present embodiment. FIG. 2 is a diagram schematically illustrating an example of the hardware configuration of the physical server. FIG. 3 is a block diagram schematically showing an example of a functional configuration of the information processing system shown in FIG. FIG. 4 is a flowchart illustrating an example of a flow of communication processing between virtual servers in the functional configuration of the information processing system illustrated in FIG. 3.

  Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In order to facilitate understanding of the description, the same components and steps are denoted by the same reference numerals as much as possible in each drawing, and redundant description is omitted.

  FIG. 1 is a schematic diagram of an information processing system including a server device of the present embodiment. As illustrated in FIG. 1, the information processing system 1 includes one or more physical servers 10 as server devices. The plurality of physical servers 10 can communicate with each other by being connected to each other via the communication network NT.

  The physical server 10 includes one or a plurality of virtual servers 12. The virtual server 12 is realized by a program stored in the physical server 10. The virtual server 12 can execute an OS (Operating System) and applications, and provides a user with an independent computer.

  FIG. 2 is a diagram schematically illustrating an example of the hardware configuration of the physical server 10. As illustrated in FIG. 2, the physical server 10 includes a control device 20, a communication device 26, and a storage device 28. The control device 20 mainly includes a CPU (Central Processing Unit) 22 and a memory 24.

  In the control device 20, the CPU 22 functions as various function realizing means by executing predetermined programs stored in the memory 24 or the storage device 28. Details of this function realizing means will be described later.

  The communication device 26 includes a communication interface for communicating with an external device. The communication device 26 transmits and receives various types of information to and from other physical servers 10, for example.

  The storage device 28 is composed of a hard disk or the like. The storage device 28 stores various programs and various information necessary for execution of processing in the control device 20 and information on processing results.

  The physical server 10 can be realized using an information processing apparatus such as a dedicated or general-purpose computer. Note that the physical server 10 may be configured by a single information processing apparatus or may be configured by a plurality of information processing apparatuses distributed on the communication network NT.

  Note that FIG. 2 shows only a part of the main hardware configuration of the physical server 10, and the physical server 10 can have other configurations generally included in the server.

  FIG. 3 is a block diagram schematically showing an example of a functional configuration of the information processing system 1 shown in FIG. As illustrated in FIG. 3, the information processing system 1 includes, for example, a first physical server 10 </ b> A and a second physical server 10 </ b> B as the physical server 10.

  The first physical server 10A has, for example, a first virtual server 12A, a second virtual server 12B, a third virtual server 12C, a first path unit 14A, and a second path unit 14B as functional configurations. The third path unit 14C, the first connection unit 16A, and the setting unit 18A are exemplarily provided. The second physical server 10B has, for example, a fourth virtual server 12D, a fifth virtual server 12E, a sixth virtual server 12F, a fourth path unit 14D, and a fifth path unit 14E as functional configurations. The sixth path unit 14F, the second connection unit 16B, and the setting unit 18B are exemplarily provided. These functional configurations are realized by the control device 20 executing a program.

  The first virtual server 12A, the second virtual server 12B, the third virtual server 12C, the fourth virtual server 12D, the fifth virtual server 12E, and the sixth virtual server 12F transmit data, for example, using another virtual server as a destination. It is a functional part that can. In the present embodiment, the data is packet data. Hereinafter, the packet data is simply referred to as “packet”.

  The first route unit 14A, the second route unit 14B, the third route unit 14C, the fourth route unit 14D, the fifth route unit 14E, and the sixth route unit 14F are functional units that serve as packet routes. Each of the routing units 14A to 14F is called a TAP device or a TAP interface, for example.

  The first path unit 14A is provided in association with the first virtual server 12A, and connects the first virtual server 12A and the first connection unit 16A. The second path unit 14B is provided in association with the second virtual server 12B, and connects the second virtual server 12B and the first connection unit 16A. The third path unit 14C is provided in association with the third virtual server 12C, and connects the third virtual server 12C and the first connection unit 16A. The fourth path unit 14D is provided in association with the fourth virtual server 12D, and connects the fourth virtual server 12D and the second connection unit 16B. The fifth path unit 14E is provided in association with the fifth virtual server 12E, and connects the fifth virtual server 12E and the second connection unit 16B. The sixth path unit 14F is provided in association with the sixth virtual server 12F, and connects the sixth virtual server 12F and the second connection unit 16B.

  In each of the path units 14A to 14F, group identification information that can be shared by two or more virtual servers is set. In the present embodiment, the group identification information is a group number as a non-limiting example. For example, No. 14 (Gr: 14) is set for the first path unit 14A, No. 20 (Gr: 20) is set for the second path unit 14B, and No. 20 (Gr: 20) is set for the third path unit 14C. Yes. In addition, No. 14 (Gr: 14) is set for the fourth path unit 14D, No. 14 (Gr: 14) is set for the fifth path unit 14E, and No. 20 (Gr: 20) is set for the sixth path unit 14F. Yes. Since the path units 14A to 14F are provided in the virtual servers 12A to 12F, it can be said that a group number is associated with each of the virtual servers 12A to 12F. The group number may be set not in the path units 14A to 14F but in the virtual servers 12A to 12F themselves.

  The first connection unit 16A and the second connection unit 16B are functional units that connect the plurality of virtual servers 12A to 12F so as to communicate with each other. The first connection unit 16A and the second connection unit 16B are connected to the communication device 26, respectively. 16A of 1st connection parts and the 2nd connection part 16B are groups set to one virtual server, when one virtual server communicates a packet with another virtual server among several virtual servers 12A-12F. Communication is restricted based on the number and the group number set in another virtual server.

  In the present embodiment, the first connection unit 16A and the second connection unit 16B have acquired data in a process in which data is transmitted from one virtual server to another virtual server among the plurality of virtual servers 12A to 12F. If the group number set for one virtual server is acquired, it is determined whether the acquired group number matches the group number associated with the destination, and if an affirmative determination is made If it is transferred to the destination and a negative determination is made, transfer to the destination is prohibited. Here, when a negative determination is made, for example, the connection units 16A and 16B delete the acquired data.

  The setting units 18A and 18B are functional units that set group numbers for the respective route units 14A to 14F corresponding to the virtual servers 12A to 12F in accordance with user operations. For example, when the route unit 14 is newly provided, the setting units 18A and 18B accept designation of a group number for the new route unit 14 from the user, and set the received group number for the new route unit 14. . Note that the setting units 18A and 18B may automatically set the group number instead of manually.

  FIG. 4 is a flowchart illustrating an example of a flow of communication processing between the virtual servers 12 in the functional configuration of the information processing system 1 illustrated in FIG. 3.

(Step SP10)
One virtual server, for example, the first virtual server 12A among the plurality of virtual servers 12A to 12F creates a packet. And a process transfers to the process of step SP12.

(Step SP12)
The first virtual server 12A transmits a packet destined for the specific virtual server via the corresponding first path unit 14A. And a process transfers to the process of step SP14.

(Step SP14)
The first path unit 14A acquires a packet from the first virtual server 12A and transfers it to the first connection unit 16A. And a process transfers to the process of step SP16.

(Step SP16)
The first connection unit 16A acquires a packet from the first virtual server 12A via the first route unit 14A. In this case, the group number associated with the first virtual server 12A is acquired. In the present embodiment, the group number (No. 14) set in the first path unit 14A of the first virtual server 12A is acquired. This group number may be transferred from the first path unit 14A together with the packet. And a process transfers to the process of step SP18.

(Step SP18)
The first connecting unit 16A gives the acquired group number to the packet. And a process transfers to the process of step SP20.

(Step SP20)
16 A of 1st connection parts determine whether the transmission destination (destination) of a packet exists in the same physical server 10A provided with the 1st virtual server 12A which transmitted the packet. If the determination is affirmative, the process proceeds to step SP28. If the determination is negative, the process proceeds to step SP22.

(Step SP22)
The first connecting unit 16A transfers the packet to the communication device 26. And a process transfers to the process of step SP24.

(Step SP24)
The communication device 26 of the physical server 10A transfers the packet to the physical server corresponding to the destination, for example, the physical server 10B via the network NT. And a process transfers to the process of step SP26.

(Step SP26)
The communication device 26 of the physical server 10B receives a packet from the physical server 10A. In response to this, the communication device 26 transfers the received packet to the second connection unit 16B. And a process transfers to the process of step SP28.

(Step SP28)
The first connection unit 16A or the second connection unit 16B determines whether the group number (14) assigned to the packet matches the group number of the path unit corresponding to the destination. If an affirmative determination is made, the process proceeds to step SP30. If a negative determination is made, the process proceeds to step SP32.

  For example, when the route unit corresponding to the destination is the second route unit 14B, the group number is 20, so it does not match the group number (14) assigned to the packet, and the determination in step SP28 Negative determination is made. Further, when the route portion corresponding to the destination is the third route portion 14C, the group number is 20, so it does not match the group number (14) assigned to the packet, and the determination in step SP28 Negative determination is made. Further, when the route portion corresponding to the destination is the fourth route portion 14D, since the group number is 14, it matches the group number (14) assigned to the packet, and the determination in step SP28 is affirmative. Determined.

(Step SP30)
The first connection unit 16A or the second connection unit 16B transfers the packet to the destination via the corresponding path unit. Then, a series of processing ends.

(Step SP32)
The first connection unit 16A or the second connection unit 16B discards (deletes) the packet without transferring it to the destination. Then, a series of processing ends.

  Here, as a method for restricting communication, as a reference example, for each virtual server, the IP address of the virtual server subject to communication restriction is registered, and there is communication from the virtual server of the registered IP address. A method of prohibiting communication is conceivable. However, in this method, every time the number of virtual servers increases, it is necessary to register all the IP addresses of the virtual servers whose communication is to be restricted in the increased number of virtual servers. In the case of restricting the communication, it is necessary to register the IP address, and it is complicated for the user (administrator or the like) of the physical server to restrict the communication.

  On the other hand, according to this embodiment, when the virtual server 12 newly increases in the server device 10, the user considers the relationship with the group numbers set in the existing virtual servers 12A to 12F, By setting group numbers for newly added virtual servers, the newly added virtual servers and existing virtual servers 12A-12F can be changed without changing the group number settings for the existing virtual servers 12A-12F. Can be restricted. Therefore, the user can easily limit communication between the virtual servers 12.

  In addition, when the first connection unit 16A or the second connection unit 16B acquires a packet from one virtual server, the first connection unit 16A or the second connection unit 16B acquires a group number set in one virtual server, and the acquired group number is the destination and It is determined whether or not it matches the group number set in the other virtual server, and if an affirmative determination is made, it is transferred to the other virtual server, and if a negative determination is made, it is transferred to the other virtual server. Prohibit transfer. In this way, the first connection unit 16A or the second connection unit 16B, when the acquired group number does not match the group number set in the other virtual server that is the destination, Since the transfer is prohibited, the communication restriction between the virtual servers 12 can be more reliably performed.

  The group number is set for the path units 14A to 14F corresponding to the plurality of virtual servers 12A to 12F, respectively. Here, the users of the virtual servers 12A to 12F may be different from the users (administrators) of the server device 10, but in this case as well, the path units 14A to 14F are managed by the administrator. Therefore, if the group number is set for the path units 14A to 14F, the group number is set freely and reliably on the administrator side as compared with the case where the group number is set for the plurality of virtual servers 12A to 12F themselves. be able to.

  Further, when the first connection unit 16A or the second connection unit 16B makes a negative determination, in other words, when the group number is different, the packet is deleted, so that the consumption of the memory 24 can be suppressed.

  In addition, since the first connection unit 16A or the second connection unit 16B assigns a group number set to one virtual server (transmission source) to the packet, even when communication is performed between physical servers 10 with different communication. Therefore, it is possible to reliably determine whether the group numbers match each other.

<Modification>
The embodiments of the present invention have been described above with reference to specific examples. However, the present invention is not limited to these specific examples. In other words, those specific examples that have been appropriately modified by those skilled in the art are also included in the scope of the present invention as long as they have the characteristics of the present invention. Each element included in each of the specific examples described above and their arrangement, conditions, shape, and the like are not limited to those illustrated, and can be changed as appropriate.

  For example, although the process of assigning a group number to a packet has been described in step SP18, this process may be omitted.

10, 12A-12F ... Server device (physical server)
12, 12A to 12F ... Virtual server 14, 14A to 14F ... Path parts 16A and 16B ... Connection parts 18A and 18B ... Setting part

Claims (4)

Multiple virtual servers,
A setting unit for setting group identification information common to two or more virtual servers for each virtual server;
A connection unit that connects the plurality of virtual servers so that they can communicate with each other, and is set in the one virtual server when one virtual server among the plurality of virtual servers communicates data with another virtual server. A connection unit that restricts the communication based on the group identification information being set and the group identification information set in the other virtual server;
Equipped with a,
When the connection unit acquires the data from the one virtual server, the connection unit acquires group identification information set in the one virtual server, and the acquired group identification information is set in the other virtual server. It is determined whether or not the group identification information matches, and if an affirmative determination is made, the data is transferred to the other virtual server. If a negative determination is made, transfer to the other virtual server is prohibited. ,
The said connection part is a server apparatus which provides the group identification information set to the said 1 virtual server to the said data . The connection unit deletes the data when the negative determination is made,
The server device according to claim 1 . Provided in each of the plurality of virtual servers, further connecting each of the plurality of virtual servers and the connection unit, further comprising a path unit configured as a path of the data;
The group identification information is set for a path unit corresponding to each of the plurality of virtual servers.
The server device according to claim 1 or 2 . A computer comprising a plurality of virtual servers,
A setting unit for setting group identification information common to two or more virtual servers for each virtual server;
A connection unit that connects the plurality of virtual servers so that they can communicate with each other, and is set in the one virtual server when one virtual server among the plurality of virtual servers communicates data with another virtual server. A connection unit that restricts the communication based on the group identification information being set and the group identification information set in the other virtual server,
To function as,
When the connection unit acquires the data from the one virtual server, it acquires group identification information set in the one virtual server, and the acquired group identification information is set in the other virtual server. It is determined whether or not the group identification information matches, and if an affirmative determination is made, the data is transferred to the other virtual server. If a negative determination is made, transfer to the other virtual server is prohibited. ,
The connecting portion, because the program to grant group identification information set in the one virtual server to the data.