JPH07200433A - Gateway - Google Patents

Abstract

PURPOSE:To improve the security by preventing illegal invasion among networks. CONSTITUTION:A couple of storage devices 8 and 9 where writing in mutually opposite directions is restricted are provided, and transfer data sent from a computer 10 to a computer 4 are written in the storage device 8. A computer 5 takes data out of the storage device 8 and sends them to a computer 11 at a transfer destination. Flag data for erasing data in the storage device 8 which are already processed by the computer 4 are generated by the computer 5 and written in the storage device 9. The computer 4 erases the object data in the storage device 8 on the basis of the flag data in the storage device 9. Then the computer 5 checks whether or not the data corresponding to the flag data are erased and then erases the flag data on condition that the data have been erased.

Description

Detailed Description of the Invention

[0001]

FIELD OF THE INVENTION The present invention relates to a gateway,
Specifically, it relates to a gateway that makes remote access between different networks impossible and enhances security.

[0002]

2. Description of the Related Art In the conventional gateway, a common storage device is provided between different networks to transfer data between them.

[0003]

However, in these conventional gateways, if the software settings are incorrect,
There is a problem that the secret information held by the terminal of one network can be transferred to the terminal of the other network. The present invention has been made to solve the above problems, and an object of the present invention is to improve security between networks and prevent confidential information from being erroneously transferred to another network through a gateway. It's about providing a gateway that doesn't exist.

[0004]

In order to achieve the above object, the present invention is directed to a transfer data memory installed for each network and a read / write operation from both network sides installed between both networks. Shared memory and a means installed in each network and receiving transfer data whose destination is another network from the own network and storing it in the transfer data memory,
A means to read and write the transfer data stored in the transfer data memory to the shared memory installed for each network, and a transfer data for the own network that is installed in each network and written to the shared memory In a gateway having means for transmitting to a destination on its own network, the shared memory is a shared memory that enables read / write from one network side and is read-only from the other network side, and the other network side. Read-write from one network and read-only shared memory from one network, and installed in each network, transfer data remaining in read-only shared memory after transfer data is read and transmitted data Means for writing the read writable shared memory by creating a flag data for erasing,
A means for erasing the transfer data written in the read / write shared memory based on the flag data written in the read-only shared memory, which is installed in each network, and a read / write installed in each network. If possible shared memory is compared with read-only shared memory and the transfer data corresponding to the flag data written in the read-write shared memory is not in the read-only shared memory, the flag data can be read and written. And a means for erasing from the shared memory.

[0005]

According to the present invention, the shared memory of the gateway enables the read / write from one network side and the read-only shared memory from the other network and the read / write from the other network side. It consists of a shared memory that is read-only from one network. For each network, after the transfer data is read and written in the transfer data memory, flag data for erasing the transfer data remaining in the read-only shared memory is created and written in the read / write shared memory. .

For each network, the transfer data written in the readable / writable shared memory is erased based on the flag data written in the read-only shared memory. The read-write shared memory and the read-only shared memory are compared for each network, and if the transfer data corresponding to the flag data written in the read-write shared memory is not in the read-only shared memory, the The flag data is erased from the read / write shared memory.
By these procedures, data is transferred between networks via different shared memories depending on the data transfer direction, making it impossible to remotely access a terminal on one network to a terminal on the other network. become.

[0007]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing an embodiment of the present invention. In the figure, 1 is a gateway, which is connected between different networks 2 and 3. The gateway 1 is composed of computers 4 and 5, disks 6 and 7 which are transfer data memories, and storage devices 8 and 9 which are shared memories. The storage device 8 is read from the computer 4 /
It can be written (RW) and is read only (RO) from the computer 5. Similarly, the storage device 9 can be read / written (RW) from the computer 5, and is read only (RO) from the computer 4.

Next, a case where data is transferred from the computer 10 which is a terminal on the network 2 to the computer 11 which is a terminal on the network 3 via the gateway 1 will be described. First, transfer data to which transfer destination information is added from the computer 10 is transferred via the network 2 to the gateway 1
It is sent to the computer 4 inside. The computer 4 temporarily stores the transmitted transfer data in the disk 6. Next, the computer 4 checks the disk 6 by a monitoring program activated at regular intervals, and if there is data to be transferred, divides the data into transfer destination information and data body and moves them to the storage device 8. Then, after the movement is completed, the data in the disk 6 is deleted.

On the other hand, the computer 5 that receives the data checks the inside of the storage device 8 by means of the monitoring program that is activated at regular intervals, and if there is data to be processed, reads the data and its control data from the storage device 8 Network 3 to the computer 11 that is the transfer destination described in the data
To send via. Up to this point, the data transfer procedure is almost the same as the conventional gateway. However, since the storage device 8 is read-only from the computer 5, even if the transfer data is read by the computer 5, it is not erased. Therefore, every time data is transferred from the network 2, processed transfer data increases in the storage device 8.

Therefore, the computer 5 creates the flag data for requesting the computer 4 to erase the processed data in the memory device 8 and writes it in the memory device 9. The computer 4 monitors the storage device 9 and, if there is flag data, checks whether the data to be erased exists in the storage device 8 based on the flag data, and if there is, erases that data and the corresponding control data. . Next, in order to erase the used flag data remaining in the storage device 9,
The computer 5 checks by the monitoring program whether or not the data corresponding to the flag data in the storage device 9 and the corresponding control data are in the storage device 8, and if there is not, the flag data has been used and is deleted. . Through this series of processes, the transferred unnecessary data in the storage device 8 is sequentially erased, and the writing area for the next data is secured.

The computer 11 on the network 2 is connected to the computer 11 on the network 3 via the gateway 1.
When data transfer is to be performed, data is similarly transferred by performing the above procedure in the reverse direction. As described above, the gateway 1 limits use of either the storage device 8 or the storage device 9 that connects the networks 2 and 3 depending on the data transfer direction. Remote access (execution of remote copy, remote shell, etc.) to a computer on the network can be disabled to prevent illegal intrusion via the network, and security between networks can be improved.

[0012]

As described above, according to the present invention, the shared memory can be read and written from one network side and the read-only shared memory from the other network side, and the shared memory can be read from the other network side. A shared memory that enables writing and is read-only from one network is used, and data transfer is performed via a different shared memory depending on the data transfer direction. As a result, it becomes impossible for a terminal on one network to remotely access a terminal on the other network, thereby preventing illegal intrusion via the network and improving security between networks.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of an exemplary embodiment of the present invention.

[Explanation of symbols]

 1 gateway 2,3 network 4,5 computer 6,7 disk 8,9 storage device 10,11 computer

Claims (1)

[Claims] 1. A transfer data memory installed in each network, a shared memory installed between both networks and readable / writable from both networks, and installed in each network for transmission. A means for receiving the transfer data whose destination is another network from the own network and storing it in the transfer data memory, and a means for reading the transfer data stored in the transfer data memory for each network and writing it in the shared memory And a means for reading the transfer data destined for the own network, which is installed in each network and written in the shared memory, and transmitting it to the destination on the own network. Read / write is possible from the network side and It consists of a read-only shared memory from the other network and a read-only shared memory that enables read / write from the other network side, and is installed for each network to transfer data. A means for creating flag data for erasing the transfer data remaining in the read-only shared memory after being read and transmitted and writing it in the readable / writable shared memory, and a read-only shared device installed for each network. A means for erasing the transfer data written in the readable / writable shared memory based on the flag data written in the memory and a comparison between the readable / writable shared memory and the read-only shared memory installed for each network. do it When the transfer data corresponding to the flag data written in the readable / writable shared memory is not in the read-only shared memory, the flag data is erased from the readable / writable shared memory. And the gateway.