JP7419771B2 - Network system and connection method - Google Patents

Description

The present invention relates to a network system and a connection method.

To introduce remote services via the Internet (hereinafter referred to as remote printing as an example) at locations scattered within large facilities such as universities and hospitals (classrooms, laboratories, libraries, etc.), it is necessary to install the service in the cloud. A receiving port will be provided to send print data to a printer located on-premises. In order to realize this function, a mechanism that goes beyond FW (Fire Wall) and Proxy is required in some way.

Generally, there is a way to achieve this by connecting the cloud and on-premises using VPN (Virtual Private Network) technology. If setting up a VPN is difficult, you can also use a printer that has a cloud polling function.

However, in order to set up a VPN, it is not easy to do so because it is necessary to modify the FW and Proxy, which are in charge of the core side of the in-house network, rather than at each site.

Also, the idea of using a printer with a cloud polling function is not easy as it would require replacing the existing printer.

Furthermore, if each branch tries to introduce a cloud service individually, it may not be possible to satisfy the security rules set by the core network administrator, and in order to persuade the administrator, it is necessary to provide evidence that security is guaranteed. Is required.

In this way, it is difficult to utilize cloud services while making use of the existing environment.

An object of the present invention is to easily construct a connection environment between an on-premises environment and a cloud environment while ensuring security.

In order to solve the above-mentioned problems, a network system according to one aspect of the present invention includes a first server located on a cloud, a second server located on an on-premises system, and utilizes a VPN over Websocket. a connection device that establishes a VPN connection with the first server and connects to the first server using an HTTP request-based VPN; The network address is NATed , and the first server updates a list holding valid/invalid information of containers on the cloud and the valid/invalid information in the list according to the operating state of the first server. an update unit, the connection device includes a NAPT module that connects the cloud and the shared area within the on-premises by port forwarding, and the connection device connects the NAPT module according to the list updated by the update unit. By changing the settings of the operation mode information, the second server can be moved from the access-prohibited area in the on-premises to the shared area, and data can be transferred from the first server to the second server. shall be.

You can easily build a connection environment between on-premises and cloud environments while ensuring security.

A diagram showing the overall configuration of a network system according to an embodiment Functional module configuration diagram of virtual N/W appliance Diagram showing the flow of automatic update of NAPT settings Example of service list yaml format Image of application of the network system according to the embodiment to a university Hardware configuration diagram of PC (server)

Embodiments will be described below with reference to the accompanying drawings. In order to facilitate understanding of the description, the same components are denoted by the same reference numerals as much as possible in each drawing, and redundant description will be omitted.

FIG. 1 is a diagram showing the overall configuration of a network system 1 according to an embodiment. The network system 1 shown in FIG. 1 provides an environment in which cloud services can be easily utilized in an on-premises environment. For example, remote printing from outside the campus network can be realized in university classrooms, laboratories, libraries, etc. where regulations on the backbone network are strict.

As shown in FIG. 1, a network system 1 includes a cloud server 2 (first server) located on a cloud A, and a server that is located on an on-premise B such as a campus network and is capable of cloud collaboration. 3 (print server in FIG. 1; hereinafter also referred to as "print server 3") (second server), and a virtual network (N/W) appliance 4 (connection device) located on on-premises B. Be prepared.

In the on-premise environment B, in addition to the print server 3, other network resources 5 such as printers, personal PCs, authentication devices, LDAP (Lightweight Directory Access Protocol) servers, and shared print clients are connected to the print server via the existing LAN 6. 3 and is communicably connected. In the example of FIG. 1, among the network resource groups arranged in on-premise B, only the print server 3 can be linked to the cloud, and the other resource group 5 is arranged so as not to be accessible from the cloud A side.

In the network system 1 of this embodiment, a print job issued from a terminal device 7 such as a smartphone owned by a user The data can be transferred to the print server 3 above and printed using a printer under the on-premises environment B.

The network system 1 of this embodiment has the following configuration.

Configuration 1: Realization of VPN using HTTP requests The cloud server 2 on Cloud A and the print server 3 on On-Premise B are equipped with a communication method that connects them using an HTTP request-based VPN (Virtual Private Network). . In this embodiment, VPN over Websocket is utilized. VPN over Websocket eliminates the need to change the core side (router, firewall (FW), etc.). In other words, there is no need to change the settings of the firewall (FW) and proxy (Proxy) 8 of the on-premise environment B shown in FIG. 1 for VPN, for example. Additionally, the VPN enables server push, making it possible to use existing printers under on-premises B as they are.

Configuration 2: NAT for on-premises When constructing a VPN, use NAT (Network Address Translation), it is realized that the IP address system on the cloud A side also has a degree of freedom. Additionally, consumption of IP addresses, which are network resources in the customer environment (on-premises environment B), can be reduced.

Configuration 3: Automatic construction of NAT settings In addition, the virtual N/W appliance 4 enables not only NAT but also port forwarding and bridge operation modes. The virtual N/W appliance 4 in the on-premises environment automatically generates a virtual Ethernet I/F according to this operation mode information and server information (IP address, port number) built on the cloud.

Configuration 4: Establishing a safe cloud service usage environment The October function ensures safety by restricting the range of access from the cloud using isolation network technology.

FIG. 2 is a functional module configuration diagram of the virtual N/W appliance 4. As shown in FIG. As shown in FIG. 2, the virtual N/W appliance 4 includes a hardware (H/W) layer L1, a kernel layer L2, and a root file system (rootfs) layer L3.

The hardware configuration of the virtual N/W appliance 4 is assumed to be a general Linux (registered trademark) Box that includes a CPU 41, memory such as RAM 42, storage 43, and Ethernet (registered trademark) 44 used in IoT Gateway, etc. . In the example of FIG. 2, the H/W layer L1 is provided with a CPU 41, a RAM 42, a storage 43, and an Ethernet 44.

The kernel layer L2 is provided with a Linux common section 45, an IP packet transmission filter 46, a NAPT (Network Address Port Translation) module 47, an Ethernet I/F 48, and an Ethernet I/F (for VPN) 49. .

The IP packet transmission filter 46 is a module that performs filter processing using the transmission IP address of the IP header.

The NAPT module 47 is a module that connects two networks by port forwarding.

The Ethernet I/F 48 is a module that transmits and receives data to and from the Ethernet device 44 of the H/W layer L1, and the Ethernet I/F (for VPN) 49 is a virtual Ethernet module for encapsulation with the VPN. .

The rootfs layer L3 is provided with a Linux basic command group 50, a NAPT update application 51, a VPN Client application 52, and a WebSocket module 53.

The NAPT update application 51 is a module that changes settings for the NAPT module 47 of the kernel layer L2.

The VPN Client application 52 is a module that uses the WebSocket module 53 to establish a VPN connection.

The operation of the network system 1 of this embodiment will be explained with reference to FIG. 3. FIG. 3 is a diagram showing the flow of automatic update of NAPT settings. FIG. 3 illustrates the main configuration of the network system 1 according to the embodiment. Each step will be explained below.

STEP1:
User X accesses a server built on cloud A in order to use some remote service (location-free printing service in this example).

STEP2:
Generally, cloud services A1 such as AWS and Azure include an API Gateway 21 that serves as a temporary window, and transfers data to a server that performs actual data processing according to the accessed URL. At this time, server modules with low operating rates (hereinafter also referred to as "containers"; for example, in AWS, server modules running on Amazon Elastic Container Service or Amazon Elastic Compute Cloud) may be stopped and restarted as necessary. Processing takes place. In the example of FIG. 3, the cloud service provision environment A1 includes a printing cloud service container 22 and a storage remote access service container 23, and the API Gateway 21 transfers access from user X to the printing cloud service container 22. There is.

STEP3:
The activated service container (print cloud service container 22 in the example of FIG. 3) updates the valid/invalid information in the service list 24 (list) on the VPN cloud management system A2 that manages VPN connections. The service list 24 holds parameters with keys and values as files in yaml format or INF format. An example of the yaml format of the service list 24 is shown in FIG.

STEP4:
According to the service list 24 updated in STEP 3, the NAPT management module 25 (update unit) on the VPN cloud general system A2 updates the virtual N/W appliance 4 ("VPN Box" in FIG. 3) located on the on-premises B. ) to update the NAPT settings. For example, the NAPT update application 51 in the virtual N/W appliance 4 changes the settings of the NAPT module 47.

STEP 5:
In this example, the printer 3 located on on-premises B will move from the access-prohibited area to the shared area, and a print job will be sent from the print cloud service container 22 on cloud A to the printer 3 on on-premises B by push communication. transmission becomes possible.

Note that the API Gateway 21 shown in FIG. 3, the print cloud service container 22, the storage remote access service container 23, the VPN server 26 having the service list 24 and the NAPT management module 25, and the relay server 27 of the VPN cloud routing service A3 is included in the cloud server 2 shown in FIG.

The above mechanism provides the following benefits.
(1) The risk of receiving an unauthorized print job from a remote location can be reduced.
(2) It is sufficient to start the printing cloud service container 22 only when necessary, which reduces the cost of using cloud services.

This embodiment may be applied to, for example, universities. FIG. 5 is an image of the application of the network system 1 according to the embodiment to a university.

As shown in FIG. 5, by applying this embodiment, it becomes possible to use only the print server 3 of a certain classroom B2 in the campus network (on-premise B) without affecting the core side B1. For example, when a user Of network B, the data can be transferred only to the print server 3 of a certain classroom B2.

As shown in FIG. 5, by using Websocket, it is possible to construct a VPN without changing the router settings (1 in the diagram). In addition, the isolated N/W technology can limit the communication range from cloud A, thereby making it possible to safely construct a cloud service usage environment. (2 in the diagram)

In this way, in the network system 1 according to the present embodiment, the virtual N/W appliance 4 filters data from the cloud A, thereby realizing an isolated network, and changing the access range from the cloud A side to the isolated network technology. Safety is also ensured by limiting the number of As a result, the network system 1 according to the present embodiment can easily establish a connection environment between the on-premises B and the cloud environment A while ensuring security. Additionally, legacy systems on on-premises B can be safely used via cloud A.

Each function of the embodiments described above can be realized by one or more processing circuits. Here, the term "processing circuit" as used herein refers to a processor programmed to execute each function by software, such as a processor implemented by an electronic circuit, or a processor designed to execute each function explained above. This includes devices such as ASICs (Application Specific Integrated Circuits), DSPs (digital signal processors), FPGAs (field programmable gate arrays), and conventional circuit modules.

The devices described in the embodiments above are merely indicative of one of multiple computing environments for implementing the embodiments disclosed herein.

In some embodiments, virtual N/W appliance 4 includes multiple computing devices such as server clusters. The plurality of computing devices are configured to communicate with each other via any type of communication link, including a network, shared memory, etc., to perform the processes disclosed herein. Similarly, cloud server 2 may include multiple computing devices configured to communicate with each other.

Note that the virtual N/W appliance 4 is not limited to the Linux Box shown in FIG. 2 as long as it is a device with a communication function. The information processing device 10 includes, for example, a PJ (Projector), an IWB (Interactive White Board: a whiteboard with an electronic blackboard function capable of mutual communication), an output device such as a digital signage, and a HUD (Head Up Display) device. , industrial machinery, imaging devices, sound collection devices, medical equipment, network home appliances, automobiles (Connected Cars), notebook PCs (Personal Computers), mobile phones, smartphones, tablet terminals, game consoles, PDAs (Personal Digital Assistants), digital cameras. , a wearable PC, a desktop PC, or the like.

For example, the virtual N/W appliance 4 may be a PC 9 having the hardware configuration shown in FIG.

FIG. 6 is a hardware configuration diagram of a PC (server). Here, the hardware configuration of the server 9 will be explained.

As shown in FIG. 6, the server 9 is constructed by a computer, and includes a CPU 901, ROM 902, RAM 903, HD 904, HDD (Hard Disk Drive) controller 905, and display 906. , an external device connection I/F (Interface) 908, a network I/F 909, a data bus 910, a keyboard 911, a pointing device 912, a DVD-RW (Digital Versatile Disk Rewritable) drive 914, and a media I/F 916.

Among these, the CPU 901 controls the operation of the server 9 as a whole. The ROM 902 stores programs used to drive the CPU 901 such as IPL. RAM903 is used as a work area for CPU901. The HD 904 stores various data such as programs. The HDD controller 905 controls reading and writing of various data to the HD 904 under the control of the CPU 901. The display 906 displays various information such as a cursor, menu, window, characters, or images. External device connection I/F 908 is an interface for connecting various external devices. The external device in this case is, for example, a USB (Universal Serial Bus) memory, a printer, or the like. The network I/F 909 is an interface for data communication using the communication network 100. The bus line 910 is an address bus, a data bus, etc. for electrically connecting each component such as the CPU 901 shown in FIG. 6.

Further, the keyboard 911 is a type of input means that includes a plurality of keys for inputting characters, numerical values, various instructions, and the like. The pointing device 912 is a type of input means for selecting and executing various instructions, selecting a processing target, moving a cursor, and the like. The DVD-RW drive 914 controls reading and writing of various data on a DVD-RW 913, which is an example of a removable recording medium. Note that it is not limited to DVD-RW, but may be DVD-R or the like. The media I/F 916 controls reading or writing (storage) of data to a recording medium 915 such as a flash memory.

The present embodiment has been described above with reference to specific examples. However, the present disclosure is not limited to these specific examples. Design changes made by those skilled in the art as appropriate to these specific examples are also included within the scope of the present disclosure as long as they have the characteristics of the present disclosure. The elements included in each of the specific examples described above, their arrangement, conditions, shapes, etc. are not limited to those illustrated, and can be changed as appropriate. The elements included in each of the specific examples described above can be appropriately combined as long as no technical contradiction occurs.

1 Network system 2 Cloud server (first server)
3 Print server (second server)
4 Virtual N/W appliance (connection device)
24 Service list (list)
25 NAPT management module (update section)
A Cloud B On-premises

Patent No. 6449896

Claims (4)

a first server located on the cloud;
a second server located on-premises;
a connection device that establishes a VPN connection with the first server using VPN over Websocket and connects to the first server with an HTTP request-based VPN;
The connection device NATs a network address for a local area on the on-premises,
The first server is:
a list that holds valid/invalid information of the containers on the cloud;
an updating unit that updates the valid/invalid information of the list according to the operating state of the first server,
The connection device is
comprising a NAPT module that connects the cloud and a shared area within the on-premises by port forwarding;
By changing the setting of the operation mode information of the NAPT module according to the list updated by the update unit , the second server is moved from the access-prohibited area in the on-premises to the shared area, and enabling data transfer from the first server to the second server ;
network system. The connection device constructs an isolated network that limits an access range from the cloud side.
The network system according to claim 1. The container on the cloud stops if service usage does not occur after a certain period of time;
The network system according to claim 1 or 2. a first server located on the cloud;
a second server located on-premises;
a connection device that establishes a VPN connection with the first server by utilizing VPN over Websocket and connects the first server with an HTTP request-based VPN, the connection device configured to connect to the cloud. A method for connecting a network system having a NAPT module that connects a shared area in the on-premises and a shared area in the on-premises by port forwarding ,
an updating step in which the first server updates valid/invalid information in a list holding valid/invalid information of containers on the cloud according to an operating state of the first server;
The connection device changes the settings of the operation mode information of the NAPT module according to the list updated in the update step, thereby removing the second server from the access-prohibited area within the on-premises shared area. an automatic update step of changing the area to enable data transfer from the first server to the second server ;
Connection method including.

Images