KR20190119785A - Network operation method and system for providing service between server and server - Google Patents

Abstract

According to an embodiment of the present invention, an operation method for providing a service between servers performed by an operation method comprises the steps of: receiving data from a service providing API server connected through a logical protocol; and providing a service to a target server connected to an internal network based on the received data.

Description

NETWORK OPERATION METHOD AND SYSTEM FOR PROVIDING SERVICE BETWEEN SERVER AND SERVER}

The following description relates to network operation management technology for service provision.

With the development of computers and information and communication technologies and the rapid spread of the Internet, information sharing and exchange through the network is taking place. While there is a net function of sharing information resources and facilitating real-time transactions as information progresses, it is possible to illegally invade servers or client terminals to destroy, change or leak information resources by exploiting the possibility of online access through the network. Network security threats such as hacking are increasing.

More recently, hacking and viruses have been automated, such as a combination of hacking and virus technologies, attacks on networks and services from attacks on individual systems in an enterprise or organization, changing the target of attacks, increasing the breach of multimedia content, and hacking wireless network services. As the trend of intelligence, popularization, decentralization, large-scale and concealment, the number and scale of the damages are increasing. In particular, the internal network of the enterprise is protected by various security equipments and policies because it is an area that requires high security.However, inevitably, the internal network is accessed from the external network or from the internal network to the external network. You are exposed to code infections.

Referring to FIG. 1, a diagram for describing an in-network operating method for providing a service between a server and a server is illustrated. A device 111 that connects a device 111 that performs external access security, such as a reverse proxy server, a gateway, to the service providing API server 110 through an internal network, and performs a device 111 that performs external access security, such as a reverse proxy server, a gateway. By connecting to the target server 120 through the internal network to transmit and receive the data of each server through the external public network (130). As such, in the related art, anti-virus or anti-spam solutions were applied between internal and external networks to prevent malware infection.

The company is exposed to new threats or variants of malware infection that are not registered in these anti-virus or anti-spam solutions. In addition, there is a hassle that the data can be delivered after executing a security program such as a security certificate or ActiveX to transmit data to the target server 120 through the external public network 130. Accordingly, the necessity of network monitoring and vulnerability management between the external network and the internal network is increasing in enterprises or institutions.

References: KR10-2017-0127852, KR 10-1480263

It is possible to provide an in-network operation method and system for providing a service between a server and a server (B2B).

An operation method for providing a service between servers performed by an operation server includes: receiving data from a service providing API server connected through a logical protocol; And providing a service to a target server connected to an internal network based on the received data.

Receiving data from the service providing API server connected through the logical protocol may include connecting the service providing API server with the operation server using an exclusive protocol based on the logical protocol.

Receiving data from the service providing API server connected through the logical protocol may include performing encrypted communication on the data transmitted from the service providing API server through an exclusive protocol based on the logical protocol. .

Providing a service to a target server connected to an internal network based on the received data is connected to the target server through the internal network so that data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol. Identifying the cipher text generated according to, and transmitting the identified cipher text to the target server.

Providing a service to a target server connected to an internal network based on the received data may include executing a service on data transmitted from the service providing API server in the target server.

The operating method may further include monitoring state information connected to the target server or state information of data provided to the target server.

An operating system for providing a service between servers includes a service providing API server which transmits data of a service providing API server to an operating server as connected to the operating server through a secure line using a logical protocol; An operation server and the operation connected to the service providing API server through a secure line using the logical protocol and providing a service to the target server for data transmitted from the service providing API server in an internal network associated with the target server; It may include a target server for executing a service for the data of the service providing API server provided from the server.

The operation server is connected to the target server through the internal network to identify a cipher text generated as data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol, and the identified cipher text is used as the target. You can forward it to the server.

The operation server may monitor state information connected to the target server or state information of data provided to the target server.

An operation server for providing a service between servers includes a receiving unit which receives data from a service providing API server connected through a logical protocol; And a providing unit providing a service to a target server connected to an internal network based on the received data.

The receiving unit may be connected to the operation server, the service providing API server using an exclusive protocol based on a logical protocol.

The receiver may perform encrypted communication with respect to data transmitted from the service providing API server through an exclusive protocol based on the logical protocol.

The providing unit is connected to the target server through the internal network, and identifies a cipher text generated as data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol, and the identified cipher text is converted into the target server. Can be forwarded to

The providing unit may execute a service for data transmitted from the service providing API server in the target server.

The operation server may further include a monitoring unit that monitors state information connected to the target server or state information of data provided to the target server.

According to an embodiment, the operation server may be installed in the internal network of the target server to efficiently operate a network for providing a service between the server and the server.

The operation server according to an embodiment may be provided to easily transmit and receive data without installing a separate security program / server as installed in the internal network of the target server.

As the operation server according to an embodiment is connected to the internal network of the target server, it is possible to clarify the responsibility of a problem that may occur in the B2B between the server and the server.

FIG. 1 is a diagram illustrating an in-network operating method for providing a service between a server and a server.
FIG. 2 is a diagram for describing an in-network operating method for providing a service between a server and a server according to an exemplary embodiment.
3 is a block diagram illustrating an example of a component that may be included in a processor of an operation server according to an exemplary embodiment.
4 is a flowchart illustrating an in-network operation method for providing a service between a server and a server performed by an operation server according to an exemplary embodiment.
FIG. 5 is a diagram for describing an operation in a network for providing a service between servers through a service providing API server, an operation server, and a target server according to an embodiment.

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings.

FIG. 2 is a diagram for describing an in-network operating method for providing a service between a server and a server according to an exemplary embodiment.

The operating system 200 may include a service providing API server 110 and an operating server 210 connected to the service providing API server 110 through a secure line 201.

The secure line 201 may be a line that maintains security based on a protocol. The secure line 201 may mean a physical passage or a logical passage connecting the service providing API server 110 and the operation server 210 to communicate.

In an embodiment, the secure circuit 201 may connect the service providing API server 110 and the operation server 210 through a closed protocol based on a logical protocol. Specifically, the service providing API server 110 is encrypted between the service providing API server 110 and the operation server 210 according to the connection to the operation server 210 through a logical protocol, for example, a TCP socket composed of a custom packet. Communication can be performed. In this case, the fixed IP address, the designated port number, or the designated protocol may be used to allow or block external access.

The service providing API server 110 may be a server for providing data or a service of the service providing API server. As an example, it may be assumed that the service providing API server 110 is an item exchange driven separately from the target server (eg, a game server). As at least one game server is connected to the item exchange, it is possible to broker a transaction of an item provided by each game server. As another example, the service providing API server 110 may be a server that provides a service such as content (for example, an advertisement) separately from the target server. Further, the service providing API server 110 may mean providing a service or data without limitation to fields such as weather information, bus information, and cafe information in a game.

The operation server 210 may operate and manage a network for providing a service between the server and the server. The operation server 210 is connected to the service providing API server 110 through a secure line using a logical protocol and connected to an internal 230 network associated with the target server 120 to receive a service received from the service providing API server. Can provide. For example, the operational server 210 may be connected to the internal network 230 of the enterprise system 220. The operation server 210 may be connected to the target server 120 in the internal network 230 of the enterprise system 220 to provide a service based on data transmitted from the service providing API server 110. Since the operation server 210 is connected to the target server 120 through the internal network 230, it may be easily connected regardless of security.

The internal network 230 may refer to a network used by a predetermined organization that is isolated from the external internet network. For example, it can usually consist of a private IP address and correspond to an intranet used inside an enterprise. Unlike the internal network, the external network may mean an internet network that is publicly accessible. For example, it can usually be accessed by a public IP address, which can be an extranet.

The target server 120 may mean a server of a service target. For example, the target server 120 may exist in various ways such as a game server, a shopping mall server, a web server, a mail server, and the like. In this case, the target server 120 may exist in a different network from the service providing API server 120. The target server 120 may receive a service based on data transmitted from the service providing API server 120 through the operation server 210 connected to the internal network 230. The target server 120 may execute a service for data of the service providing API server 120.

Accordingly, since the operation server 210 is connected to the target server 120 through the internal network, packet issues are reduced, and the target server and the data are stored in packets that do not require security (eg, HTTP, HTTP, Websocket, etc.). Can send and receive

In addition, a case where a plurality of target servers exist will be described. The plurality of target servers may have the same internal network. In this case, as described above, one operating server 210 may be connected to the same internal network. As such, as the operation server 210 is connected to the same internal network, the operation server 210 may transfer data received from the service providing API server 120 to each of the plurality of target servers.

Alternatively, when the plurality of target servers have different internal networks, the respective operation server 210 may be connected to each internal network. The operation server 210 may transfer data received from the service providing API server 120 to each of the plurality of target servers as it is connected to each internal network.

3 is a block diagram illustrating an example of a component that may be included in a processor of a production server according to an embodiment. FIG. 4 is a network for providing a service between a server and a server performed by the production server according to an embodiment. It is a flowchart for explaining the operation method.

The processor 222 of the operation server 210 may include a receiver 310 and a provider 320. The apparatus may further include a monitoring unit (not shown) that monitors state information of data provided to the target server. The components of the processor 222 may be representations of different functions performed by the processor 222 according to a control command provided by program code stored in an operation server. The processor 222 and the components of the processor 222 may control the operation server to perform the steps 410 to 420 included in the in-network operation method for providing a service between the server and the server of FIG. 4. In this case, the processor 222 and the components of the processor 222 may be implemented to execute instructions according to code of an operating system included in a memory and code of at least one program. In addition, the operation server 210 may include a storage unit 330 and the communication unit 340. The storage unit 330 may store protocol information, port information, and data related to the target server for connecting to the service providing API server. The communication unit 340 may provide a function for performing communication with the target server. The communication unit 340 may transmit and receive data with the target server.

The processor 222 may load a program code stored in a file of a program for an in-network operating method for providing a service between the server and the server in a memory. For example, when a program is executed in the operating server, the processor may control the operating server to load program code from a file of the program into a memory under control of the operating system. At this time, each of the processor 222 and the receiver 310 and the provider 320 included in the processor 222 executes instructions of a corresponding part of the program code loaded in the memory to perform the following steps 410 to 420. There may be different functional representations of the processor 222 to execute.

In operation 410, the receiver 310 may receive data from a service providing API server connected through a logical protocol. The receiver 310 may connect the service providing API server with an operation server using an exclusive protocol based on a logical protocol. The reception unit 310 may perform encrypted communication on the data transmitted from the service providing API server through an exclusive protocol.

In operation 420, the provider 320 may provide a service to a target server connected to an internal network based on the received data. The provider 320 may identify a cipher text generated as data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol, and may transmit the identified cipher text to the target server. At this time, the service may be executed in the target server.

FIG. 5 is a diagram for describing an operation in a network for providing a service between servers through a service providing API server, an operation server, and a target server according to an embodiment.

The service providing API server 110 may be connected to the operation server 210 using the protocol (501). In detail, the service providing API server 110 may be connected to an operation server 210 using an exclusive protocol based on a logical protocol. For example, the service providing API server 110 and the operation server 210 may be designated in advance of the protocol information, the port number may be set in order to use an exclusive protocol based on the logical protocol. As such, the service providing API server 110 and the operation server 210 may be connected to each other through a secure line. Accordingly, each of the service providing API server 110 and the operation server 210 may be connected to each other through a predetermined port number and a protocol. In this way, since the connected service providing API server 110 and the operation server 210 are completely exclusively connected, data is not easily taken or decoded in the middle.

Meanwhile, the operation server 210 may be connected to the target server 120. The operation server 210 may operate in connection with the internal network 502 of the target server 120. The operation server 210 may be simply connected regardless of security through the internal network 502 of the target server 120. For example, the operation server 210 may be connected to the internal network 502 of the target server 120 to communicate with the target server 120, and be inserted into the target server 120 in a program form. It may be.

The service providing API server 110 may transfer data to the connected operating server 210 through an exclusive protocol based on a logical protocol (503). It may be data associated with a service provided by the service provision API server 110. The service providing API server 110 may deliver API data for providing a service. For example, if the service providing API server 110 is an item exchange, the operation server 210 may identify data related to the item being traded / requested on the item exchange. In this case, encrypted communication may be performed through an exclusive protocol with respect to data transmitted from the service providing API server.

The operation server 210 may receive data transmitted from the service providing API server 110 (504). The operation server 210 may identify a cipher text generated as data transmitted from the service providing API server 110 is encrypted and transmitted through an exclusive protocol. The operation server 210 may provide data on the data received from the service providing API server 110 to the target server 120 (505). The operation server 120 may deliver the identified cipher text to the target server.

The target server 120 may receive data transmitted from the service providing API server 110. The target server 120 may execute a service on the data of the received service providing API server 110 (506). For example, the target server 120 may receive the data traded / requested from the item exchange and update the game.

Through the operation server according to an embodiment, the problem of connection with the target server, security certificate sharing, certificate verification and replacement problems can be solved, and the cost can be reduced because a security server such as a gateway or a proxy server is not used. In addition, the connectivity test with the target server and problems that may occur with the target server can be excluded.

Furthermore, since the operation server is connected to the target server through an internal network that does not require separate security, it is possible to monitor the status information related to the target server. A method of monitoring status information related to the target server 120 will be described in detail below.

The operation server 210 may monitor the target server 120 (507). The operation server 210 may monitor state information of the target server connected to the internal network 502. For example, the operation server 210 may detect connection state information connected to the target server 120, state information of data provided to the target server 120, or whether there is an abnormality occurring in the target server 120.

For example, the operation server 210 may monitor state information of data provided to the target server 120. The operation server 210 may detect whether the service for the data provided from the service providing API server 110 is normally executed in the target server 120. For example, the operation server 210 may monitor an abnormality occurring in the target server 120 based on a predetermined time unit or in real time.

Alternatively, the operation server 210 may monitor state information connected to the target server 120. For example, the connection between the target server 120 and the operation server 210 may be lost, so that the target server 120 may not receive data provided from the operation server 210. Alternatively, the target server 120 may be disconnected from the internal network. The operation server 210 may determine a connection state connected to the target server 120 as the target server 120 is connected through the internal network.

Alternatively, the operation server 210 may determine the state information of the data provided to the target server 120. For example, when determining that the data provided to the target server 120 includes unidentified data, the operation server 210 does not provide the data to the target server 120. In addition, the operation server 210 may stop the transmission of the data being transmitted as it determines whether there is an abnormality of the data already provided to the target server 120. Accordingly, it is possible to cope with hacking such as external intrusion.

As such, since the operation server 210 can check the state of the target server 120 in the side providing the service, that is, the internal network of the target server, it is easy to solve or find an intermediate connection problem. In addition, it is possible to minimize the problem caused by the problem of the target server.

In addition, since the operation server 210 is connected to the internal network of the target server 120, it is possible to clarify the responsibility of the problem in the B2B between the server and the server that may occur in the past. Conventionally, in delivering data to a target server through a service providing API server configured as shown in FIG. 1, problems such as data loss or data deformation may occur during data delivery. In this case, the target server may transfer the responsibility to the counterpart server even when a problem occurs in the target server and fails to receive the transmitted data. On the contrary, according to the embodiment, since the production server is installed in the internal network of the target server, the production server can accurately detect the problem occurring in the target server and can clarify the responsibility of the problem.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the devices and components described in the embodiments are, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors, microcomputers, field programmable gate arrays (FPGAs). Can be implemented using one or more general purpose or special purpose computers, such as a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of explanation, one processing device may be described as being used, but one of ordinary skill in the art will appreciate that the processing device includes a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that it may include. For example, the processing device may include a plurality of processors or one processor and one controller. In addition, other processing configurations are possible, such as parallel processors.

The software may include a computer program, code, instructions, or a combination of one or more of the above, and configure the processing device to operate as desired, or process it independently or collectively. You can command the device. Software and / or data may be any type of machine, component, physical device, virtual equipment, computer storage medium or device in order to be interpreted by or to provide instructions or data to the processing device. It can be embodied in. The software may be distributed over networked computer systems so that they may be stored or executed in a distributed manner. Software and data may be stored on one or more computer readable recording media.

The method according to the embodiment may be embodied in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the media may be those specially designed and constructed for the purposes of the embodiments, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

Although the embodiments have been described by the limited embodiments and the drawings as described above, various modifications and variations are possible to those skilled in the art from the above description. For example, the described techniques may be performed in a different order than the described method, and / or components of the described systems, structures, devices, circuits, etc. may be combined or combined in a different manner than the described method, or other components. Or even if replaced or substituted by equivalents, an appropriate result can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are within the scope of the claims that follow.

Claims (15)

In the operation method for providing server-to-server service performed by the operation server,
Receiving data from a service providing API server connected via a logical protocol; And
Providing a service to a target server connected to an internal network based on the received data;
Operating method comprising a. The method of claim 1,
Receiving data from the service providing API server connected through the logical protocol,
Connecting the service providing API server to the operation server using an exclusive protocol based on a logical protocol
Operating method comprising a. The method of claim 2,
Receiving data from the service providing API server connected through the logical protocol,
Performing encrypted communication on the data transmitted from the service providing API server through an exclusive protocol based on the logical protocol;
Operating method comprising a. The method of claim 1,
Providing a service to a target server connected to an internal network based on the received data,
Connecting to the target server through the internal network, identifying a cipher text generated as data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol, and transmitting the identified cipher text to the target server.
Operating method comprising a. The method of claim 4, wherein
Providing a service to a target server connected to an internal network based on the received data,
Executing a service for data transmitted from the service providing API server in the target server;
Operating method comprising a. The method of claim 1,
Monitoring status information associated with the target server or status information of data provided to the target server;
Operating method comprising more. In the operating system for providing services between servers,
A service providing API server which transmits data of the service providing API server to the operating server as connected to the operating server through a secure line using a logical protocol;
An operation server connected to the service providing API server through a secure line using the logical protocol and providing a service to the target server for data transmitted from the service providing API server in an internal network associated with a target server;
Target server for executing a service for the data of the service providing API server provided from the operation server
Operating system comprising a. The method of claim 7, wherein
The operation server,
Connected to the target server through the internal network, identifying a cipher text generated as data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol, and transmitting the identified cipher text to the target server.
Operating system, characterized in that. The method of claim 7, wherein
The operation server,
Monitoring status information connected to the target server or status information of data provided to the target server
Operating system, characterized in that. In the operation server for providing services between servers,
A receiver for receiving data from a service providing API server connected through a logical protocol; And
Providing unit providing a service to a target server connected to the internal network based on the received data
Operation server comprising a. The method of claim 10,
The receiving unit,
The service providing API server is connected to the operation server using an exclusive protocol based on a logical protocol
Operation server, characterized in that. The method of claim 11,
The receiving unit,
Performing encrypted communication on the data transmitted from the service providing API server through an exclusive protocol based on the logical protocol.
Operation server, characterized in that. The method of claim 10,
The providing unit,
Connected to the target server through the internal network, identifying a cipher text generated as data transmitted from the service providing API server is encrypted and transmitted through an exclusive protocol, and transmitting the identified cipher text to the target server.
Operation server, characterized in that. The method of claim 13,
The providing unit,
The service for the data transmitted from the service providing API server in the target server is executed
Operation server, characterized in that. The method of claim 10,
A monitoring unit for monitoring state information connected to the target server or state information of data provided to the target server
Operation server further comprising.

Images