KR102102524B1 - Network operation method and system for providing service between server and server - Google Patents

Abstract

An operation method for providing service between servers performed by an operation server according to an embodiment includes receiving data from a service providing API server connected through a logical protocol; And providing a service to a target server connected to the internal network based on the received data.

Description

NETWORK OPERATION METHOD AND SYSTEM FOR PROVIDING SERVICE BETWEEN SERVER AND SERVER}

The following description relates to network operation management technology for service provision.

With the development of computer and information and communication technologies and the rapid spread of the Internet, information sharing and exchange is being conducted through a network. While there is a net function of sharing information resources or facilitating real-time transactions as the informatization progresses, exploiting the fact that online access through the network is possible, illegally invading servers or client terminals, destroying, altering, or leaking information resources The threat of network security breaches such as hacking is increasing.

Moreover, in recent years, hacking and viruses have been automated, such as the combination of hacking and virus technology, attacks on individual systems of enterprises or organizations, attacks on networks and services, changes in targets, increased infringement of multimedia contents, and hacking of wireless network services. , Increasingly, the number of damages and the scale are increasing, showing the tendency of intelligentization, popularization, decentralization, large-scale and concealment. In particular, the corporate internal network is an area that requires high security, and is protected by various security devices and policies. However, as communication is inevitably approached from the external network to the internal network or from the internal network to the external network inevitably during business operations. You have no choice but to be exposed to code infections.

Referring to FIG. 1, a diagram for explaining a method of operating in a network for providing a service between a server and a server. A device 111 that performs external access security, such as a reverse proxy server and a gateway, connects to the service providing API server 110 through an internal network, and performs a device 111 that performs external access security, such as a reverse proxy server and a gateway. By connecting to the target server 120 through the internal network, data of each server is transmitted and received through the external public network 130. As such, in the past, anti-virus or spam blocking solutions were applied between the internal and external networks to prevent malicious code infection.

It is inevitable to be exposed to new malicious codes or variants that are not registered in the anti-virus or anti-spam solution. In addition, there is a hassle that data can be transmitted after executing a security program such as a security certificate or ActiveX to transmit data to the target server 120 through the external public network 130. Accordingly, there is an increasing need for network monitoring and vulnerability management between external and internal networks in enterprises or organizations.

References: KR10-2017-0127852, KR 10-1480263

It is possible to provide an in-network operating method and system for providing a service between a server and a server (B2B).

An operating method for providing server-to-server service performed by an operating server includes receiving data from a service providing API server connected through a logical protocol; And providing a service to a target server connected to the internal network based on the received data.

Receiving data from the service providing API server connected through the logical protocol may include connecting the service providing API server to the operation server using an exclusive protocol based on the logical protocol.

Receiving data from the service providing API server connected through the logical protocol may include performing encrypted communication on data transmitted from the service providing API server through an exclusive protocol based on the logical protocol. .

The step of providing a service to a target server connected to the internal network based on the received data is connected to the target server through the internal network, and data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol. And identifying the generated ciphertext and delivering the identified ciphertext to the target server.

Providing a service to a target server connected to the internal network based on the received data may include executing a service for data transmitted from the service providing API server in the target server.

The operating method may further include monitoring status information connected to the target server or status information of data provided to the target server.

The operating system for providing service between servers includes a service providing API server that transmits data of the service providing API server to the operating server as it is connected to the operating server through a secure line using a logical protocol; An operation server and the operation connected to the service providing API server through a secure line using the logical protocol and providing a service for data transmitted from the service providing API server to the target server in an internal network associated with the target server It may include a target server for executing a service for the data of the service providing API server provided from the server.

The operation server is connected to the target server through the internal network, identifies the ciphertext generated as data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol, and identifies the ciphertext as the target It can be delivered to the server.

The operation server may monitor status information associated with the target server or status information of data provided to the target server.

An operation server for providing server-to-server services includes: a receiver configured to receive data from a service providing API server connected through a logical protocol; And a provision unit providing a service to a target server connected to the internal network based on the received data.

The receiving unit, the service providing API server may be connected to the operating server using an exclusive protocol based on a logical protocol.

The receiver may perform encrypted communication on data transmitted from the service providing API server through an exclusive protocol based on the logical protocol.

The providing unit is connected to the target server through the internal network, identifies the ciphertext generated as data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol, and identifies the ciphertext as the target server Can be delivered to.

In the providing unit, a service for data transmitted from the service providing API server in the target server may be executed.

The operation server may further include a monitoring unit that monitors status information associated with the target server or status information of data provided to the target server.

As the operation server according to an embodiment is installed in the internal network of the target server, it is possible to efficiently operate the network for providing service between the server and the server.

The operation server according to one embodiment may be provided to easily transmit and receive data without installing a separate security program / server as it is installed in the internal network of the target server.

As the operation server according to an embodiment is connected to the internal network of the target server, it is possible to clarify the responsibility of a problem that may have occurred in the B2B between the server and the server.

1 is a view for explaining a method of operating in a network for providing a service between a server and a server.
2 is a diagram for explaining a method of operating in a network for providing a service between a server and a server in one embodiment.
3 is a block diagram illustrating an example of components that a processor of an operation server may include according to an embodiment.
4 is a flowchart for explaining a method for operating in a network for providing a service between a server and a server, which are performed in an operation server according to an embodiment.
5 is a diagram for explaining an operation operation in a network for providing services between servers through a service providing API server, an operation server, and a target server in one embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

2 is a diagram for explaining a method of operating in a network for providing a service between a server and a server in one embodiment.

The operating system 200 may include a service providing API server 110 and an operating server 210 connected to the service providing API server 110 through a secure line 201.

The secure circuit 201 may be a circuit that maintains security based on a protocol. The secure line 201 may mean a physical path or a logical path connecting the service providing API server 110 and the operation server 210 to be communicated.

In an embodiment, the secure circuit 201 may connect the service providing API server 110 and the operation server 210 through a closed protocol based on a logical protocol. Specifically, the service providing API server 110 is encrypted between the service providing API server 110 and the operation server 210 as it is connected to the operation server 210 through a TCP protocol composed of a logical protocol, for example, a custom packet. Communication can be performed. At this time, external access can be allowed or blocked by using a fixed IP address, a designated port number, or a designated protocol.

The service providing API server 110 may be a server for providing data and services of the service providing API server. For example, it may be assumed that the service providing API server 110 is an item exchange driven separately from the target server (eg, a game server). As at least one game server is connected to the item exchange, it is possible to broker transactions of items provided by each game server. As another example, the service providing API server 110 may be a server that provides a service such as content (eg, advertisement) separately from the target server. Furthermore, the service providing API server 110 may mean providing a service or data without limitation to fields such as weather information, bus information, and cafe information in the game.

The operation server 210 may operate and manage a network to provide services between the server and the server. The operation server 210 is connected to the service providing API server 110 through a secure line using a logical protocol, and connected to the internal 230 network associated with the target server 120 to receive the service received from the service providing API server. Can provide. For example, the operation server 210 may be connected to the internal network 230 of the enterprise system 220. The operation server 210 may be connected to the target server 120 in the internal network 230 of the enterprise system 220 to provide a service based on data transmitted from the service providing API server 110. Since the operation server 210 is connected through the target server 120 and the internal network 230, it can be easily connected regardless of security.

The internal network 230 may mean a network used by a certain organization that is independently configured to be blocked from the external Internet network. For example, it can usually consist of a private IP address, and it can correspond to an intranet used inside a company. Unlike the internal network, the external network may mean an internet network that is publicly accessible. For example, it can usually be accessed by a public IP address, and it can be an extranet.

The target server 120 may mean a service target server. For example, the target server 120 may exist in various ways, such as a game server, a shopping mall server, a web server, and a mail server. At this time, the target server 120 may exist in a network network different from the service providing API server 120. The target server 120 may receive a service based on data transmitted from the service providing API server 120 through the operation server 210 connected to the internal network 230. The target server 120 may execute a service for data of the service providing API server 120.

Accordingly, since the operation server 210 is connected to the target server 120 through the internal network, packet issues are reduced, and the target server and data are transmitted in packets that do not require security (for example, HTTP, HTTP, Websocket, etc.). It can transmit and receive.

Also, a case where a plurality of target servers exist will be described. Multiple target servers may have the same internal network. At this time, as described above, one operation server 210 may be connected to the same internal network. As described above, as the operation server 210 is connected to the same internal network, data received from the service providing API server 120 may be delivered to each of a plurality of target servers.

Alternatively, when a plurality of target servers have different internal networks, each operation server 210 may be connected to each internal network. As the operation server 210 is connected to each internal network, data received from the service providing API server 120 may be delivered to each of a plurality of target servers.

3 is a block diagram showing an example of components that a processor of an operation server may include according to an embodiment, and FIG. 4 is a network for providing a service between a server and a server performed in the operation server according to an embodiment It is a flow chart to explain the operation method.

The processor 222 of the operation server 210 may include a receiving unit 310 and a providing unit 320. In addition, a monitoring unit (not shown) for monitoring status information of data provided to the target server may be further included. The components of the processor 222 may be expressions of different functions performed by the processor 222 according to control commands provided by program codes stored in the operation server. The processor 222 and the components of the processor 222 may control the operation server to perform steps 410 to 420 included in the in-network operation method for providing services between the server in FIG. 4 and the server. At this time, the processor 222 and components of the processor 222 may be implemented to execute instructions according to the code of the operating system included in the memory and the code of at least one program. In addition, the operation server 210 may include a storage unit 330 and a communication unit 340. The storage unit 330 may serve to store protocol information, port information, and data related to the target server for connection with the service providing API server. The communication unit 340 may provide a function for performing communication with the target server. The communication unit 340 may transmit and receive data to and from the target server.

The processor 222 may load program code stored in a file of a program for a method of operating in a network for providing a service between a server and a server, in memory. For example, when a program is executed on the operating server, the processor may control the operating server to load program code from a file of the program into a memory under the control of the operating system. At this time, each of the processor 222 and the receiving unit 310 and the providing unit 320 included in the processor 222 executes the corresponding part of the program code loaded in the memory to execute the subsequent steps 410 to 420. It may be different functional representations of the processor 222 for execution.

In step 410, the receiving unit 310 may receive data from a service providing API server connected through a logical protocol. The receiver 310 may connect the service providing API server with an operation server using an exclusive protocol based on a logical protocol. The receiving unit 310 may perform encrypted communication on the data transmitted from the service providing API server through an exclusive protocol.

In step 420, the providing unit 320 may provide a service to a target server connected to the internal network based on the received data. The providing unit 320 may identify the ciphertext generated as data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol, and transmit the identified ciphertext to the target server. At this time, the service may be executed on the target server.

5 is a diagram for explaining an operation operation in a network for providing services between servers through a service providing API server, an operation server, and a target server in one embodiment.

The service providing API server 110 may be connected to the operation server 210 using the protocol (501). Specifically, the service providing API server 110 may be connected to the operation server 210 using an exclusive protocol based on a logical protocol. For example, the service providing API server 110 and the operation server 210 may specify protocol information in advance and set a port number in order to use an exclusive protocol based on a logical protocol. As such, the service providing API server 110 and the operation server 210 may be closedly connected through a secure line. Accordingly, each of the service providing API server 110 and the operation server 210 may be connected to each other through a preset port number and protocol. Since the connected service providing API server 110 and the operation server 210 are completely exclusively connected, it is not easy for data to be intercepted or decoded in the middle.

Meanwhile, the operation server 210 may be connected to the target server 120. The operation server 210 may operate by being connected to the internal network 502 of the target server 120. The operation server 210 can be easily connected regardless of security through the internal network 502 of the target server 120. For example, the operation server 210 may be connected to the internal network 502 of the target server 120 to perform communication with the target server 120, and to be inserted in the form of a program inside the target server 120 It might be.

The service providing API server 110 may transmit data to the connected operation server 210 through an exclusive protocol based on the logical protocol (503). It may be data associated with a service provided by the service providing API server 110. The service providing API server 110 may transmit API data for providing a service. For example, when the service providing API server 110 is an item exchange, the operation server 210 may identify data related to the item traded / requested in the item exchange. At this time, encrypted communication may be performed on the data transmitted from the service providing API server through an exclusive protocol.

The operation server 210 may receive data transmitted from the service providing API server 110 (504). The operation server 210 may identify the ciphertext generated as data transmitted from the service providing API server 110 is encrypted and transmitted through an exclusive protocol. The operation server 210 may provide data for data received from the service providing API server 110 to the target server 120 (505). The operation server 120 may deliver the identified ciphertext to the target server

The target server 120 may receive data transmitted from the service providing API server 110. The target server 120 may execute a service for data of the received service provision API server 110 (506). For example, the target server 120 may receive data that is traded / transferred from the item exchange and update the game.

Through the operation server according to an embodiment, connection problems with the target server, security certificate sharing, certificate verification and replacement problems can be solved, and since a security server such as a gateway or a proxy server is not used, cost can be reduced. In addition, it is possible to exclude connectivity problems with the target server and problems that may occur with the target server.

Moreover, since the operation server is connected to the target server through an internal network that does not require additional security, status information related to the target server can be monitored. A method of monitoring status information related to the target server 120 will be described in detail below.

The operation server 210 may monitor the target server 120 (507). The operation server 210 may monitor status information of the target server connected to the internal network 502. For example, the operation server 210 may detect connection status information connected to the target server 120, status information of data provided to the target server 120, or an abnormality occurring in the target server 120.

In one example, the operation server 210 may monitor status information of data provided to the target server 120. The operation server 210 may detect whether a service for data provided from the service providing API server 110 is normally executed on the target server 120. For example, the operation server 210 may monitor the presence or absence of an abnormality occurring in the target server 120 based on a preset time unit or in real time.

Alternatively, the operation server 210 may monitor status information connected to the target server 120. For example, since the connection between the target server 120 and the operation server 210 is disconnected, the target server 120 may not receive data provided from the operation server 210. Alternatively, the target server 120 may be disconnected from the internal network. As the operation server 210 is connected to the target server 120 through the internal network, the operation server 210 may determine a connection state connected to the target server 120.

Alternatively, the operation server 210 may determine status information of data provided to the target server 120. For example, the operation server 210 does not provide data to the target server 120 when it is determined that the data provided to the target server 120 contains unidentified data. In addition, the operation server 210 may stop the transmission of the data being transmitted as it determines whether or not the data already provided to the target server 120 is abnormal. Accordingly, it is possible to cope with hacking such as external intrusion.

As described above, since the operation server 210 can check the status of the target server 120 from the side that provides the service, that is, the internal network of the target server, it is easy to solve or discover the intermediate connection problem. In addition, it is possible to minimize problems caused by problems of the target server.

In addition, since the operation server 210 is connected to the internal network of the target server 120, it is possible to clarify the responsibility of the problem in the B2B between the server and the server, which may have occurred in the past. Conventionally, in delivering data to a target server through a service providing API server configured as shown in FIG. 1, problems such as data loss or data modification may occur during data delivery. At this time, the target server side can pass the responsibility to the other server even if the target server does not receive the delivered data due to a problem. On the other hand, according to the embodiment, since the operation server is installed in the internal network of the target server, the operation server can accurately detect a problem occurring in the target server, thereby making it possible to clarify whether the problem is responsible.

The device described above may be implemented with hardware components, software components, and / or combinations of hardware components and software components. For example, the devices and components described in the embodiments include, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors (micro signal processors), microcomputers, field programmable gate arrays (FPGAs). , A programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose computers or special purpose computers. The processing device may run an operating system (OS) and one or more software applications running on the operating system. In addition, the processing device may access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of understanding, a processing device may be described as one being used, but a person having ordinary skill in the art, the processing device may include a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that may include. For example, the processing device may include a plurality of processors or a processor and a controller. In addition, other processing configurations, such as parallel processors, are possible.

The software may include a computer program, code, instruction, or a combination of one or more of these, and configure the processing device to operate as desired, or process independently or collectively You can command the device. Software and / or data may be interpreted by a processing device, or to provide instructions or data to a processing device, of any type of machine, component, physical device, virtual equipment, computer storage medium or device. Can be embodied in The software may be distributed on networked computer systems, and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, or the like alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiments or may be known and usable by those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs, DVDs, and magnetic media such as floptical disks. -Hardware devices specially configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language code that can be executed by a computer using an interpreter, etc., as well as machine language codes produced by a compiler.

As described above, although the embodiments have been described by a limited embodiment and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques are performed in a different order than the described method, and / or the components of the described system, structure, device, circuit, etc. are combined or combined in a different form from the described method, or other components Alternatively, even if replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (15)

In the operating method for providing the server-to-server service performed by the operating server,
Receiving data from a service providing API server connected through a logical protocol; And
Providing a service to a target server connected to the internal network based on the received data
Including,
The step of receiving data from the service providing API server connected through the logical protocol,
The service providing API server is connected to the operation server using an exclusive protocol based on a logical protocol, and performing encrypted communication on data transmitted from the service providing API server through an exclusive protocol based on the logical protocol.
Including,
Providing a service to a target server connected to the internal network based on the received data,
When a plurality of target servers have the same internal network, one operation server is connected to the same internal network, and as the operation server is connected to the same internal network, data received from a service providing API server is provided to a plurality of target servers. Delivered to each, and when a plurality of target servers have different internal networks, each operation server is connected to each internal network, and service is provided as each connected operation server is connected to each internal network Passing data received from the API server to each of a plurality of target servers, and executing services for data received from the service providing API server in each of the plurality of target servers
Operating method comprising a. delete delete According to claim 1,
Providing a service to a target server connected to the internal network based on the received data,
Identifying the ciphertext generated as the data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol, connected to the target server through the internal network, and delivering the identified ciphertext to the target server
Operating method comprising a. delete According to claim 1,
Monitoring status information associated with the target server or status information of data provided to the target server
Operating method further comprising a. In the operating system for providing service between servers,
A service providing API server that transmits data of the service providing API server to the operating server as it is connected to the operating server through a secure line using a logical protocol;
An operation server connected to the service providing API server through a secure line using the logical protocol, and providing an service for data transmitted from the service providing API server to the target server in an internal network associated with the target server;
A target server that executes a service for data of the service providing API server provided from the operation server
Including,
The operating server,
The service providing API server is connected to the operation server using an exclusive protocol based on a logical protocol, and performs encrypted communication on data transmitted from the service providing API server through an exclusive protocol based on the logical protocol, and a plurality of When the target server of the server has the same internal network, a single operation server is connected to the same internal network, and as the operation server is connected to the same internal network, data received from a service providing API server is received by a plurality of target servers To the service provider, and when a plurality of target servers have different internal networks, each operation server is connected to each internal network, and each connected operation server is connected to the respective internal network, thereby providing a service API Data received from the server, each of a plurality of target servers It to pass
Operating system. The method of claim 7,
The operating server,
It connects to the target server through the internal network, identifies the ciphertext generated as data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol, and delivers the identified ciphertext to the target server
Operating system characterized in that. The method of claim 7,
The operating server,
Monitoring status information connected to the target server or status information of data provided to the target server
Operating system characterized in that. In the operating server for providing server-to-server service,
A receiver configured to receive data from a service providing API server connected through a logical protocol; And
A provision unit that provides a service to a target server connected to the internal network based on the received data
Including,
The receiving unit,
The service providing API server is connected to the operating server using an exclusive protocol based on a logical protocol, and includes performing encrypted communication on data transmitted from the service providing API server through an exclusive protocol based on the logical protocol. and,
The providing unit,
When a plurality of target servers have the same internal network, one operation server is connected to the same internal network, and as the operation server is connected to the same internal network, data received from a service providing API server is provided to a plurality of target servers. Delivered to each, and when a plurality of target servers have different internal networks, each operation server is connected to each internal network, and service is provided as each connected operation server is connected to each internal network The data received from the API server is delivered to each of the plurality of target servers, and the service for the data received from the service providing API server is executed in each of the plurality of target servers.
Operation Server. delete delete The method of claim 10,
The providing unit,
It connects to the target server through the internal network, identifies the ciphertext generated as data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol, and delivers the identified ciphertext to the target server
Operating server characterized in that. delete The method of claim 10,
Monitoring unit for monitoring the status information associated with the target server or status information of data provided to the target server
Operation server further comprising a.

Images