JPH0844643A - Gateway device - Google Patents

Abstract

PURPOSE:To perform access to an external data base while keeping transparency to a user without using any special client and sacrificing security by using a hypertext by providing a hypertext changing device for outputting the hypertext after the change of link information. CONSTITUTION:A link analyzing device 2, that receives the link information, changes that information into access information and dispatches it to various network service access controllers 3. Based on this access information, the various access controllers 3 access various network servers and acquire the information designated by the access information. When this acquired information is the hypertext, it is dispatched to a hypertext changing device 4. According to a processing method to which the link information in the acquired information is applied, the hypertext changing device 4 outputs the hypertext reloaded (changed) so as to access this gateway device 1, the other gateway device or the server.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a device for changing a link in hypertext or realizing a gateway by hypertext.

In recent years, various databases distributed on a network and various clients for accessing them have come out. The network protocols that support them include the local file system (LO
CAL FILE SYSTEM, Fttipi (FT)
P), Internet news (INTERNET NE
WS), Telnet (TELNET), Ways (WA)
IS), Gopher, and World Wide Web (WWW: World Wide Web) HTTP (Hyper)
Text Transfer Protocol). Particularly in WWW, a server using another protocol is accessed directly or using a gateway, and the result is finally displayed in hypertext for the user.

As described above, various kinds of information can be easily obtained, but in many organizations such as companies that need to protect the security of information, access to the outside is restricted. On the other hand, however, as various databases on the network have been enriched, it is required to easily access those data.

For this reason, it is desired for the user to realize the same access to the external database as that of the internal database, that is, transparent access, while maintaining the required database security. There is.

[0005]

2. Description of the Related Art First, the terms used here will be defined. A server has a database and provides information to clients who have accessed using a specific protocol.

[0006] The client fetches the information held by the server using a specific protocol and is usually realized by software. A protocol is an agreement when computers communicate with each other for a certain purpose (for example, exchanging files).

Hypertext is a method for presenting information. Some words in a document are links, and when those words are selected, the document to which the link points is. It is supposed to be displayed. The document pointed to by the link may be hypertext, ordinary text, a still image, a moving image, a sound, or anything else.

A link is a character string indicating how to access a document indicated by a word,
This link is usually hidden from the user on clients that display hypertext as a format. For example, the character string includes information such as "which protocol, which file on which machine to access".

Conventionally, there has been a method of directly accessing a server outside the organization from a computer inside the organization instead of a computer on the network outside the organization to a server provided in the network outside the organization.

In this case, there are usually the following methods for ensuring the security of the organization. Connect the outside network of the organization and the inside network with a router. And this router limits the types of protocols that can pass through it and their directions, and it is a firewall.
As such, the security inside the organization is ensured.

9 and 10 are explanatory views of a conventional example,
Hereinafter, a description will be given based on the conventional example 1 of FIG. In FIG. 9, a network 14 inside the organization is provided with a computer 14 used by a user 13. A computer 16 and various protocols such as FTP, TELNET, WAIS, and GOPH are provided in the network 12 outside the organization.
A server (not shown) having ER and HTTP is connected. The network 11 inside the organization and the network 12 outside the organization have a limited protocol (TELNE).
It is connected via a router 15 that can only pass T, FTP).

[0012] Under such an environment, a method of securing access to the outside is prepared by some computers 16 (one is shown in the figure) on the network outside the organization and from the inside of the organization to the outside network. The computer 16 that has been accessed can be accessed using TELNET, FTP, or the like. When it becomes necessary for the user 13 to access the outside using the computer 14 placed on the network inside the organization, first, for example, TELNE from the computer 14 which is a machine inside the organization.
At T, the user enters the computer 16 prepared in the network 12 outside the organization through the router 15 and then accesses other machines outside the organization by various protocols changed by the computer 16 to obtain information.

Further, as another method for securing access inside the organization while securing security inside the organization, FIG.
There was a conventional example 2 of 0. Hereinafter, description will be given with reference to FIG. 10, those parts which are the same as those corresponding parts in FIG. 9 are designated by the same reference numerals.

In FIG. 10, a new protocol called ZZZ (ZZZ is a temporary name) is allowed to pass through the router 15. Then, the computer 14, which is a client that uses a normal protocol that cannot pass through the router 15, such as GOPHER or HTTP, is changed to a special client 17 that uses the ZZZ protocol. Further, a ZZZ server 18, which is a gateway device, is provided in the network 12 outside the organization.

User 1 from network 11 inside the organization
When it becomes necessary for 3 to access the outside, first, ZZ
ZZ running on the computer 16 on the external network 12 through the router 15 using the Z protocol
Access the Z server. Next, the ZZZ server 18 accessed a server such as GOPHER or HTTP on the external network 12 instead of the client 17, and returned the information to the client 17.

[0016]

The above-mentioned conventional ones have the following problems. The method of using the computer 16 on the external network 12 as in the conventional example 1 is very troublesome because it enters the inside of the computer 16 once, for example, because of the login procedure. Further, for example, even if the user wants to use a window-compatible client that displays a graphical display from his / her computer 14, the router 15 uses a character base (characte) such as TELNET.
If you need to communicate with an external server using a fixed protocol directly from your own computer 14 on the network inside the organization, you can use a general client. It had the drawback of not being usable.

Further, as in the conventional example 2, the protocol ZZ is used.
In the method of using a special client 17 such as Z, the client can be used from the computer used by oneself, but the client to be used cannot be used as it is, and a normal client to be used is communicated using the special protocol ZZZ. It was necessary to change to such a special client 17.

It is an object of the present invention to access an external database without using a special client by using hypertext, without sacrificing security, and transparent to the user.

[0019]

The present invention has the following structure to solve the above problems. FIG. 1 is a diagram illustrating the principle of the present invention. In FIG. 1, a gateway device 1 includes a link analysis device 2 that analyzes link information, and various network services that access various network servers to obtain designated information. An access control device 3, a hypertext changing device 4 for changing the hypertext of the acquired information, and a hypertext converting device 5 for converting the acquired information into hypertext are provided.

[0020]

The operation of the present invention based on the above configuration will be described with reference to FIG. First, link information is analyzed by the link analysis device 2
To receive. The link analysis device 2 analyzes the link, changes it to access information that is information for accessing, and passes it to various network service access control devices 3. The various network service access control devices 3 access various network servers based on this access information and acquire the information specified in the access information. If the acquired information, which is the acquired information, is a hypertext, it is passed to the hypertext changing device 4. The hypertext changing device 4 outputs the rewritten (changed) hypertext so as to access this gateway device 1 or another gateway device or another server according to the processing method given the link information in the acquired information. To do.

When the acquired information of the various network service access control devices 3 is not hypertext, the acquired information is passed to the hypertext converting device 5.
As a result, the hypertext conversion device 5 outputs hypertext in which the link information in the acquired information is set to access this gateway device 1 or another gateway device or another server.

If such a gateway device 1 is provided on the external network 12, the computer on the internal network can use a normal hypertext client on the external network without sacrificing security. Access to resources located in.

[0023]

Embodiments of the present invention will be described with reference to FIGS. In the figure, the same parts as those in FIG. 1 are designated by the same reference numerals.

FIG. 2 is a block diagram of the gateway device according to the embodiment of the present invention.
It controls communications performed using the network. The access monitor / control device 6 monitors the network control device 7 and monitors whether there is an access.

When the access monitor / control device 6 is accessed by another client, the access monitor / control device 6 passes the link information given by the client to the gateway device 1. The gateway device 1 returns to the access monitoring / controlling device 6 a hypertext having an unusual link. As a result, the access monitor / control device 6 controls the network control device 7 and returns the hypertext to the accessing client.

At this time, for example, if it is written to access the gateway device 1 to the hypertext link again and then to the destination pointed to by the original link from the gateway device 1, the client is used. When the user selects this link, it will automatically regain access to this gateway.

FIG. 3 is an explanatory diagram of the hypertext changing device of the gateway device 1. The hypertext change device 4 is provided with a link replacement processing device 41 and a link change processing device 42.

The following is a description of when the hypertext changing device 4 receives a hypertext as an input. First, the link replacement processing device 41 receives the hypertext. The link replacement processing device 41 extracts a link from the hypertext and passes it to the link change processing device 42. The link change processing device 42 converts the link according to a processing method given in advance (for example, to access the gateway device 1), and gives the changed link to the link replacement processing device 41.

The link replacement processor 41 replaces the original extracted link in the hypertext with the changed link and outputs the finally obtained hypertext. FIG. 4 is an explanatory diagram of the hypertext conversion device of the gateway device. The hypertext conversion device 5 includes a hypertext conversion processing device 51 and a link setting processing device 5.
2 is provided.

The following is a description of how the hypertext conversion device 5 receives the acquired information as an input. The hypertext processing device 51 is, for example, FTP, GOPHER
Various types of acquisition information, which are information in the form of Then, the parts other than the links are converted into hypertext by a normal method. At the stage of generating the link portion, the hypertext conversion processing device 51 gives a necessary control signal (information) to the link setting processing device 52.

The link setting processing device 52 generates a link according to a processing method given in advance and gives it to the hypertext processing device 51. As a result, the hypertext conversion processing device 51 integrates the link into the hypertext in the normal method, and outputs the finally obtained hypertext.

For example, assuming that the acquired information is (protocol A + server A + additional information), in the case of rewriting the link setting processing device 52 so as to access the gateway device 1, protocol + this gateway + ( Link information is added like (protocol A + server A + additional information).

Since the added link information is hidden from the user of the client, it cannot be seen by the user.
Thus, the user appears to be free to access various servers on the external network from the internal network, just as if the client were running on the external network.

FIG. 5 is a flow chart of an embodiment of the present invention. The operation of the gateway device 1 will be described below based on the flowchart of FIG. S1 to S9 indicate processing numbers.

First, the access monitor / control device 6 checks whether there is an access from a client (S1). Access monitoring / control device 6 when accessed by a client
Receives the link information and passes it to the link analysis device 2 (S
2). The link analysis device 2 extracts the access information and transfers it to the various network service access control devices 3 (S3). The various network service access control devices 3 acquire the information specified based on the access information through the network control device 7 (S4).

The various network service access control devices 3 determine whether the acquired information is hypertext (S5). If the acquired information is hypertext (Yes), the various network service access control devices 3 pass the acquired information (hypertext) to the hypertext changing device 4, and the hypertext changing device 4 follows a process given a link in advance. Change (S6).
If the acquired information is not hypertext in the processing number S5 (No), the various network service access control devices 3 pass the acquired information to the hypertext conversion device 5, and the hypertext conversion device 5 normally generates the link information. Is changed according to the process given in advance to output the hypertext (S7).

The hypertext processed in the processing number S6 or S7 is passed to the access monitoring / controlling device 6 (S8). The access monitor / control device 6 returns the hypertext to the client through the network control device 7 (S9).

FIG. 6 is an explanatory diagram of server access in the embodiment. Hereinafter, description will be given with reference to FIG. In FIG. 6, the external network 12 is provided with the gateway devices 1a and 1b and the servers 20 to 22, and the internal network 11 is provided with the gateway device 1c, the computer 14, and the servers 23 and 24. The router 15 connects the internal network 11 and the external network 12, for example, TELNET, FT.
Only limited protocols such as P and HTTP can be passed.

In order for the user 13 to access the external server 20 from the computer 14 on the network 11 inside the organization while maintaining security, the gateway device 1a is placed on the external network 12. In addition, the router 15 uses a protocol that is normally permitted (for example, TE
In addition to LNET, FTP, for example, the HTTP protocol, which is a protocol for exchanging hypertext, is allowed to pass from the network 11 inside the organization.

As a result, once this gateway device 1
If the resource of the server 20 on the external network is accessed through a, all the access results are returned in hypertext, and all the links are set to access the gateway device 1a again. Since the link is set to access the gateway device 1a no matter how many times this access process is repeated thereafter, when the user 13 of the client selects the link, the gateway device 1a is accessed first.

When some such gateway devices 1a are provided in the external network 12 (for example, the gateway device 1b), if those gateway devices 1a and 1b are selected by an appropriate method and written in the link, It is also possible to distribute the load between the gateway devices 1a and 1b.

For example, the destination pointed by the original link is analyzed and a gateway device close to the destination pointed is selected. Depending on the load of the gateway device 1a, another gateway device 1b
Try to turn to. Choose the gateway appropriately (eg, by a random number). Further, it is carried out by a method such as passing it to a gateway device with a light load by communication between gateways.

Furthermore, the present invention can be carried out not only by the gateway device for ensuring security but also by the following. When resources on the same network exist in several places (for example, the servers 23 and 24) or when resources on the network have different names, such information is stored, and when the gateway device rewrites the link. You can also use them to rewrite.

For example, when resources on the same network exist in the servers 23 and 24, the resources are rewritten so that the load is appropriately distributed. Further, when a resource equivalent to the resource on the external network 12 exists in the internal network, the link can be rewritten to point to the internal resource.

In this way, the user can efficiently access the resource. Hereinafter, the server access of the present invention will be described with a specific example. First, the URL in WWW will be described. The URL (Universal Resource Locator) indicates whether or not there is information. This is made up of three parts, and a specific example of the URL is shown below.

Http: // www.is.university.ac.jp/welcome.html The part up to the first ":"("http" in this case) indicates the method of accessing the server. In this case, HTTP (Hyper Text Transfer Protocol) which is a WWW protocol is used.
ol).

The name of the server is shown between the following ": //" and "/". In this case, the specified information is "www.is.univ
ersity.ac.jp ”is a machine (note that this part may also give information on which port of the server to access). The remaining part shows the path of information on that server. In the case of this example, it is "welcome.html".

FIG. 7 is an explanatory diagram of a specific example of server access, showing an example of a WWW gateway. In this example, there is a computer (client) 14 in a network 11 inside the organization (inside the company), there is a machine of the gateway device 1 directly connected to the network 12 outside (outside the company), and the network between the outside and the company is a router that passes HTTP. Connected at 15. This gateway device 1
Let's assume that the name of the machine is "www.out.company.co.jp" and the HTTP server 2 is connected to the external network 12.
5, 26 and an FTP server 27 are provided.

First, the user 13 uses the URL "http:
Suppose you want to access the homepage of a university department of information science with "www.is.university.ac.jp/welcome.html". At this time, the user 13 first specifies the following URL for the client 14 instead of the normal URL.

Http: //www-out.company.co.jp/http: //www.is.university.ac.jp/welcome .html The client 14 interprets this URL and uses HTTP to create the machine name "www. Access the gateway device 1 of "-out.company.co.jp". The router is set up so that the internal network can access a specific machine on the external network with a specific protocol. Since the router 15 in this case is set to pass HTTP, the client 14 can reach the machine of the gateway device 1. Then, the client 14 sends "http: /// ww ww" as a path to the machine of the gateway device 1.
w.is.university.ac.jp/welcome.html "is shown.

The machine of the gateway 1 uses the server 25 (server name "ww
w.is.university.ac.jp ”). Since this gateway device 1 is directly connected to the network 12 outside the company, those machines can be accessed without any problem. Then, the gateway device 1 receives the following information as information.

<HTML><HEAD><TITLE> Welcome Message (ABC Univ--Dept Info Sci) </ TITLE></HEAD><BODY><Hl> Welcome to ABC University <p>-Department of Information Science . </ H1> Welcome to our WWW server! --- This is under development, though. <P> This WWW server is run by Department of Information Science, ABC University (somewhere-cho, ABC, <A HREF = "http : //www.xyz.jp/japan/index.html "> Japan </A>), which is a new department established in 1990. We have a collection of images on the Earth's environment (in preparation) and <A HREF = "/ FTP / images / sat /"> weather information </A>. We also serve <A HREF="/FTP/images/sat/gms.polar/"> GMS (Himawari) images </A> for Chugoku / Shikoku area. <P></BODY></HTML> In addition, the above <HTML> is HTML (Hyper Text Mar
indicates the beginning of a document written in kup Language format,
</ HTML> indicates the end. <HEAD> is
The beginning of the header of the document is shown. In this header, there are a title name, an author name, etc., the title name is written here, and </ HEAD> indicates the end of the header. <TI
TLE> indicates the beginning of the title, </ TITLE>
> Indicates the end of the title. <BODY> indicates the body of the document, and </ BODY> indicates the end. <H
1> indicates the start of section level 1 and </ H
1> indicates the end. <P> indicates the beginning of a paragraph (paragraph), and this end is not particularly necessary.

The gateway device 1 hyperlinks the information "<A HREF="..."> ... </A>", which is a link, based on the information received and the information of the page currently accessed. By rewriting by the changing device 4, the above information is changed as follows.

<HTML><HEAD><TITLE> Welcome Message (ABC Univ--Dept Info Sci) </ TITLE></HEAD><BODY><Hl> Welcome to ABC University <p>-Department of Information Science . </ H1> Welcome to our WWW server! --- This is under development, though. <P> This WWW server is run by Department of Information Science, ABC University (somewhere-cho, ABC, <A HREF = "http : //www-out.company.co.jp/http: //www.xyz.jp/japan/index.ht ml "> Japan </A>), which is a new department established in 1990. We have a collection of images on the Earth's environment (in preparation) and <A HREF = "http://www-out.company.co.jp/http://www.is.university.ac.jp/F TP / images / sat / "> weather information </A>. We also serve <A HREF =" http://www-out.company.co.jp/http://www.is.university.ac.jp/F TP / images / sat / gms.polar / "> GMS (Himawari) images </A> for Chugoku / Shikoku area. <P></BODY></HTML> Information changed in this way is sent from the gateway device 1 to the client 14 Passed to. On the client 14 side,
This information is displayed to the user 13 as shown in FIG. It should be noted here that the rewritten link information is hidden from the user 13, so the display to the user 13 is exactly the same regardless of whether the information is received directly from the server or through the gateway. That is. That is, the client 14 displays the two hypertexts in the same manner.

If the user 13 clicks on the first link " Japan " with a mouse or the like, the client 14 uses "http: /// www-ou" as the URL.
t.company.co.jp/http: //www.xyz.jp/japan/index.ht
"ml" is specified, and the exact same cycle as above is repeated.

When the access destination outside the company is a server other than HTTP (for example, FTP, GOPHER), rewriting is similarly performed. For example, in the case of the URL of the information in the FTP server 27 as follows, ftp://ftp.uvw.edu/gutenberg/etext93/pimil10.txt can be rewritten as follows.

Http://www-out.company.co.jp/ftp://ftp.uvw.edu/gutenberg/etext93/pimil 10.txt As a result, the client 14 inside the company can access the gateway device 1 outside the company. The machine is accessed by HTTP. FT from the machine of the gateway device 1 outside the company
At P, the server 27 outside the company is accessed. The machine of the gateway device 1 converts the information obtained by FTP into hypertext and returns the information to the client by HTTP. Naturally, in the above hypertext conversion, a link is written so that the gateway device 1 can be accessed again.

If the user 13 accesses the server 27 outside the company through the gateway device 1 and the server 27 has a file such as ".Mac.Unix.X11", the gateway device 1 will cause the hypertext conversion device 5 to operate.
Is converted into hypertext with and the information is returned to the client 14 by HTTP.

In this case, the client 14 is the user 1
Will be a link display "· Mac · Unix · X11" to 3, naturally link to access this case gateway device 1 again also takes place is written.

[0060]

As described above, according to the present invention, a resource on an external network can be directly used from a computer on a network inside an organization by using a normal hypertext client without sacrificing security. Will be able to access to improve work efficiency.

[Brief description of drawings]

FIG. 1 is a diagram illustrating the principle of the present invention.

FIG. 2 is a configuration diagram of a gateway device according to an embodiment.

FIG. 3 is an explanatory diagram of a hypertext changing device according to an embodiment.

FIG. 4 is an explanatory diagram of a hypertext conversion device according to an embodiment.

FIG. 5 is a flowchart in the embodiment.

FIG. 6 is an explanatory diagram of server access according to the embodiment.

FIG. 7 is an explanatory diagram of a specific example of server access according to the embodiment.

FIG. 8 is an explanatory diagram of a display screen in the example.

FIG. 9 is an explanatory diagram of Conventional Example 1.

FIG. 10 is an explanatory diagram of Conventional Example 2.

[Explanation of symbols]

 1 gateway device 2 link analysis device 3 various network service access control device 4 hypertext change device 5 hypertext conversion device

Claims (9)

[Claims] 1. A hypertext changing device is provided with a link replacement processing means for replacing a hypertext link and a link changing processing means for changing a link, and when the link replacement processing means receives the hypertext, it changes the link. A hypertext changing device is provided which causes the link replacing processing means to output the hypertext after the link information is changed after the link information in the hypertext is changed by the processing means according to a specific processing means. Gateway device. 2. A hypertext conversion device for converting a hypertext into a hypertext and a link setting processing part for generating a link are provided in the hypertext conversion device, and the acquired information is converted into a hypertext by the hypertext conversion processing means. In the gateway device, the hypertext converting device outputs the hypertext after the link information is changed, after the link information is changed according to the specific processing means. 3. The gateway device according to claim 1, further comprising means for adding information for accessing the same gateway again as a specific processing means for changing the link information. 4. The gateway device according to claim 1, further comprising means for adding information for accessing the same gateway or another gateway again as a specific processing means for changing the link information. 5. The gateway device according to claim 1, further comprising a unit for providing information for accessing another server as a specific processing unit for changing the link information. 6. A link analysis device that receives link information and analyzes the link information, and various network service access control devices that access a server and acquire the information based on access information from the link analysis device, A hypertext changing device for changing hypertext link information according to a specific processing means when the acquired information is hypertext, and converting the hypertext into hypertext when the acquired information is not hypertext and changing the link information according to a specific processing means. A gateway device comprising a hypertext device. 7. The gateway device according to claim 6, further comprising means for adding information for accessing the same gateway again as a specific processing means for changing the link information. 8. The gateway device according to claim 6, further comprising means for adding information for accessing the same gateway or another gateway again as a specific processing means for changing the link information. 9. The gateway device according to claim 6, further comprising means for providing information for accessing another server as a specific processing means for changing the link information.