WO2004001630A1

WO2004001630A1 - Network system and program

Info

Publication number: WO2004001630A1
Application number: PCT/JP2003/007617
Authority: WO
Inventors: Seiichiro Inoue; Takahiro Hidaka; Hiroki Otani; Shinichi Iwata
Original assignee: Ariel Networks Co., Ltd.
Priority date: 2002-06-19
Filing date: 2003-06-16
Publication date: 2003-12-31
Also published as: JP2004023597A

Abstract

When a gateway node (NAT server) (16) switching a global address and a private address from one to another has received a hit reply from a node (21) in a private network (20), information of the gateway node (16) is added to the information of the search hit node (21) before propagation. When it is impossible to establish an access session to the search hit node (21) from the command issuing origin node (10) which has received the hit reply, the gateway node (16) is switched so as to execute access. Thus, even when an NAT server is present, it is possible to freely access from the outside into the inside of the private network (20) to acquire a resource (30).

Description

Description Network System and Program Technical Field

The present invention relates to a network system and a program, and is particularly suitable for a system in which data is directly exchanged between clients without going through a server. Background art

In recent years, based on the social background of the penetration of the Internet and the explosive increase in the number of Internet users, and the technological background of high-performance personal computers (PCs) and high-speed networks, peer-to-peer (P2P ) Is attracting attention.

In most of the conventional network systems, a small number of servers and a large number of clients are connected via a network, and resources generated by the clients are collected and managed by the servers. However, with the explosive increase in the number of users, the cost of collecting resources created by users on the server is not negligible. In other words, there are two types of mechanisms for discovering resources scattered on the Internet when collecting resources on a server in the conventional Web architecture: directory services and search engines. . The former is an approach that should be called human naval tactics, in which resources are gathered by hand. In the latter, the agent tropopot collects resources by traversing the Internet overnight, and each type is a brute force approach. Also, resources gathered on the server create a concentration of access. As a result, high-performance personal computers used as clients are almost idle, and even in high-speed networks, only the surroundings of the servers are crowded.

In contrast, network technology based on P2P is an architecture in which clients exchange information directly with each other without using a server near the user. In other words, resources generated by many clients are managed by each client itself, so there is no need to collect many resources on the server, and there is almost no access concentration for resource acquisition. . In addition, idle resources of high-performance personal computers can be used effectively.

Referring to FIG. 1, a procedure for searching and acquiring a desired resource using the P2P architecture will be described. FIG. 1 is a diagram showing a schematic configuration of a network to which a P2P architecture is applied. A P2P network is defined by a set of nodes. A node is a program process that implements the P2P protocol. Therefore, for example, if a single personal computer has multiple running programs, there will be multiple nodes.

The nodes form a topology with multiple sessions spanning each other. This normal session is called a “connection”. A “connection” forms a normal topology, and a basic protocol (1 o okup command corresponding to a resource search command, hit reply corresponding to a search hit response, etc.) is transmitted over this connection session. Flows.

On the other hand, a session is established from the user node 10 (1 o okup command issuing node) to the node 103 with resource 110 (hit reply issuing node). We refer to these as “access”. "A Access ”is a session that is temporarily established between the command issuing node and the search hit node after the resource is discovered, over which a protocol according to the access interface flows.

The topology formation state of “connection” and “access” described above is not managed centrally, and individual nodes form autonomously. First, as shown in Fig. 1 (a), the node 100 of the user who wants to acquire the resource 110 sends a 1 ookup command to find out where the resource 110 is located. Issued to 101 and 102.

Nodes 101 and 102 receiving the looku command check to see if they have the required resource 110. If the corresponding resource 1 110 cannot be found, as shown in Fig. 1 (b), 1 the ookup command is sent to the neighboring node (the node that is connected other than the source of the lookup command). 0 Transfer to 6. Nodes 103 to 106 receiving this 1ookup command also check whether they have the requested resource 110.

As the command propagation and the search for the resource 110 are repeated as described above, the node 110 3 hits the search for the resource 110. If the search hits, it returns a hit reply to node 101, which is the sender of the lookup command, as shown in Fig. 1 (c). The node 101 that has received the hit reply forwards the hit reply to the user node 100 that is the source of the lookup command. In this way, the M t reply is propagated in the reverse direction by each node that has transmitted the lookup command, and reaches the user node 100 that issued the command.

The hit reply is a packet containing the name of the access interface of the resource 110 and the information of the search hit node 103. According to the above procedure, the user node 100 that first issued the 1 ookup command sets the desired Resource 110 can be found to exist on node 103. Next, the user node 100 receiving the hit rebroadcast accesses the node 103 directly as shown in FIG. 1 (d) to obtain the resource 110.

It is expected that various network systems will be constructed using the P2P architecture described above. For example, based on the P2P protocol, it is desired to build a duplication protocol that manages schedules and tasks for individuals or groups, manages files such as documents, and manages the progress of projects. I have.

However, in the conventional P2P network technology described above, if there is a firewall or NAT (Network Address Translation), an inward group session cannot be established (connection or access is not possible), and communication is large. There is a problem that a serious failure occurs.

Firewalls generally use a single server as a gateway to the group, and run dedicated software here to prevent unauthorized third parties from unauthorized entry into the group. It is. Specifically, it determines whether communication is possible by looking at the IP addresses of the source and destination. Therefore, if a firewall is installed, communication from outside the group to the inside is rejected, and it becomes impossible to establish a connection and access session.

NAT is a method devised to address the shortage of IP addresses. This is to save global addresses by allocating global addresses only to gateways that enter and exit the group, and allocating private addresses that are only used within the group within the group. It is. The NAT server serving as a gateway accesses a node in the group by converting a global address sent from outside the group into a private address. Therefore, if a NAT server is installed as a gateway, 1 o okup command issuing node is outside the group, and if the node discovered by command propagation is inside the group, global address It is impossible to establish a direct access session from an external node having a private address to an internal node having a private address.

When building groupware using the P2P architecture, it is necessary to protect the data in the server from unauthorized eavesdropping or tampering by a third party, while at the same time making the members of the group accessible from outside. It is desired to do so. This is because it is preferable that access be possible not only from within the company where the LAN is built, but also from home and on the road. However, if a firewall / NAT server is installed for security measures and to secure IP addresses, there is a problem that inward sessions cannot be established as described above and external access is not possible.

The present invention has been made to solve such a problem. A P2P system that can freely access resources and acquire resources even when a firewall or a NAT server is installed is provided. The purpose is to provide. Disclosure of the invention

The network system according to the present invention includes a gateway node that exchanges communications inside and outside a private network by replacing a global address with a private address. When receiving a search hit response, the node has means for adding the information of the gateway node to the information of the search hit node and transferring the search hit response to another node. If it is the command issuing node, the information of the search hit node included in the search hit response and A means for accessing a search hit node or a gateway node based on the information of the gateway node. In another aspect of the present invention, when each node is a command issuing node and cannot access the search hit node, each node issues an access request command to a connected neighboring node group. An access requesting means, and a reverse access means for executing an access to the command issuing node when receiving the propagated access request command when the node itself is a search hit node. I do.

In another aspect of the present invention, when each node is a command issuing node and access from a search hit node is not established despite issuing an access request command, First gateway access means for accessing a predetermined gateway node, and second access request means for issuing a gateway access request command for requesting access to the gateway node to a group of connected neighboring nodes. And a second gateway access means for accessing the gateway node when receiving the transmitted gateway access request command when the gateway itself is a search hit node. I do.

As described above, according to the present invention, when a gateway node that performs replacement between a global address and a private address receives a search hit response, the gateway node information is added to the search hit node information. When the command issuing node receives a search hit response, the search hit node or the gateway node information included in the search hit response and the information of the gateway node are used. It is trying to access the gateway. This allows external access to the private network even when the gate-to-node is present. You will be able to access resources internally and vice versa to obtain resources.

According to another feature of the present invention, when the command issuing node cannot access the search hit node, the access request command is propagated to the search hit node via the connected neighboring nodes. At the same time, the search hit node that receives this command accesses the node that issued the command. In this way, even if access is not possible from outside the firewall to the inside, it is possible to establish access from inside the firewall to the outside by issuing the above access request command, and use the session. This allows free access to internal resources from outside the firewall. According to another feature of the present invention, when a command issuing node issues an access request command but access from a search hit node is not established, a predetermined gateway node is accessed. In both cases, the access request command for the gateway node is propagated to the search hit node via the neighboring nodes, and the search hit node that receives the command accesses the gateway node. This allows access to be established from inside each firewall to the outside gateway node, even if both the command issuing node and the search hit node are inside the firewall. By using these sessions, it is possible to freely access resources inside the firewall from outside. BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a diagram showing a procedure for searching and acquiring a desired resource using the P2P architecture. FIG. 2 is a diagram illustrating a schematic configuration example of a network according to the first embodiment.

FIG. 3 is a flowchart showing the operation of the NAT server according to the first embodiment.

FIG. 4 is a flowchart showing the operation of the command issuing node according to the first embodiment. FIG. 5 is a diagram illustrating a schematic configuration example of a network according to the second embodiment.

FIG. 6 is a flowchart showing the operation of the command issuing node shown in FIG. 'FIG. 7 is a diagram showing another configuration example of the network according to the second embodiment.

FIG. 8 is a flowchart showing the operation of the command issuing node shown in FIG.

FIG. 9 is a flowchart showing the operation of the search hit node shown in FIG.

FIG. 10 is a flowchart showing an operation of notifying user information.

FIG. 11 is a diagram for explaining an operation when performing SSL-based user authentication.

BEST MODE FOR CARRYING OUT THE INVENTION

(First Embodiment)

Hereinafter, a first embodiment of the present invention will be described with reference to the drawings.

FIG. 2 is a diagram illustrating a schematic configuration example of a network according to the first embodiment. The network of this embodiment is composed of a set of nodes 10 to 16 and 21 to 1

It is configured to include 2 2. In the example of FIG. 2, the nodes 21 and 22 constitute a private network 20. Therefore, access is performed between the nodes 21 and 22 based on the private IP address (hereinafter, abbreviated as private IP). On the other hand, nodes 10 to 16 are nodes existing outside the private network 20. Therefore, access is performed between these nodes 10 to 16 based on the global IP address (hereinafter abbreviated as global IP).

Node 16 is a NAT server, which has both a global IP and a private IP. When a packet is sent from outside the private network 20, the destination global IP (the global IP of the NAT server 16) is converted to a private IP, so that the private network 20 is sent. Access node 2 1 in Conversely, when a packet is sent from the node 21 in the private network 20, the source private IP (the private IP of the node 21) is sent to the global IP of the NAT server 16. And access to the external node.

In the present embodiment, the port forwarding function of the NAT server 16 is used to make settings for forwarding the port for the P2P architecture. That is, the NAT server 16 is set as a masquerade node. As a result, the NAT server 16 transmits both the information of the search hit node hit for the resource search and the information of the NAT server 16 which is a masquerade node when transferring the hit reply. Process to transfer.

For example, as shown in Figure 2, the source node 10 of the 1 ookup command is outside the private network 20 and the search hit node 21 with the desired resource 30 is the private node. Consider the case where it is inside the network 20. In this case, the NAT server 16 searches for the search hit node. When forwarding the hit reply sent from node 21, add the global IP of NAT server 16, which is a masquerade node, to the search IP address of node 21, Make sure to transfer both node information.

The command issuing node 10 receiving this hit reply sends the command to the search hit node 21 according to the normal processing based on the private IP of the search hit node 21 included in the hit reply. Attempt access. However, an access session cannot be established directly from the command issuing node 10 to the search hit node 21. Therefore, the command issuing node 10 switches to access to the masquerade node based on the global IP of the NAT server 16 included in the hit reply, and searches for the search hit node 21. Access indirectly.

FIG. 3 is a flowchart showing the operation of the NAT server 16. This flowchart shows an operation when the NAT server 16 receives some command from another node. In FIG. 3, the NAT server 16 determines whether the received command is a 1 ookup command (step S1), and if so, propagates the lookup command to another node (step S2). .

If the received command is not one ookup command, it is further determined whether or not it is a hit reply (step S3). If it is not the Mt reply, other processing is performed according to the received command (step S4). On the other hand, when the hit reply is received, the NAT server 16 adds its own global IP operating as a masquerade node to the hU reply (step S5), and The hit reply added with is transmitted to other nodes (step S6). FIG. 4 is a flowchart showing the operation of the command issuing node 10. This flowchart shows the operation when the command issuing node 10 receives a hit reply from another node. In FIG. 4, the command issuing node 10 attempts to access the search hit node 21 based on the private IP of the search hit node 21 included in the received hit reply ( Step S 1 1).

Then, it is determined whether or not an access session has been established (step S12). A session can be set up when access is made between private networks 20 or between external parties. Thus, for example, if the search hit node is located outside the private network 20 as well as the command issuing node 10, the command issuing node 10 will determine based on the access. The resource is obtained from the search hit node (step S14).

However, in this example, since the search hit node 21 is inside the private network 20, the command issuing node 10 outside the private network 20 sends the search hit node 21 1 An access session cannot be established for. In this case, the command issuing node 10 switches to access to the masquerade node based on the global IP of the NAT server 16 included in the hit reply and searches for the search hit node 2 1 Is accessed (step S13), and resources are obtained (step S14).

As described in detail above, according to the first embodiment, the hit reply is added with the global IP of the NAT server as a masquerade node and propagated, and the command issuing node is sent to the search hit node. When a session cannot be established due to access, a switch to access to the masquerade node is made to access the search hit node. Even if a server is installed, it will be possible to freely access the inside and outside of the private network.

(Second embodiment)

Next, a second embodiment of the present invention will be described with reference to the drawings.

FIG. 5 is a diagram illustrating a schematic configuration example of a network according to the second embodiment. The network of the present embodiment is configured to include a set of nodes 10 to 15 and 21.

In the example of FIG. 5, it is assumed that the node 21 is inside the firewall 40. The other nodes 10 to 15 are outside the firewall 40. In the present embodiment, the connection session is not dealt with if it cannot be established. However, it does not matter whether the connection session is established from inside or outside the firewall 40, and the connection session is started only in the direction in which the connection session can be established to form a topology.

In the example shown in Fig. 5, when a session is started from the node 21 in the firewall 40 to the external nodes 11 and 15, a connection has already been established between them. Is shown. In this state, as a result of issuing the lo okup command for searching for resource 30 from node 10, the lo okup command is propagated to node 21 in firewall 40 via node 11. It is assumed that hit reply is returned from the node 21 in the reverse flow.

The command issuing node 10 receiving the hit reply attempts direct access to the search hit node 21 according to the normal processing. However, since the search hit node 21 exists inside the firewall 40, an access session cannot be established from the command issuing node 10 to the search hit node 21. In this case, the command issuing node 10 issues a push-req command (access request command) to the search hit node 21 throughout the connection session. This push-req command is delivered to the search hit node 21 along the route in which the hit reply is backpropagated. The push-req command is a packet that contains information on the command issuing node 10. Therefore, the search hit node 21 receiving this push-req command can know the command issuing node 10.

Therefore, the search hit node 21 receiving the push-req command accesses the command issuing node 10. This is the opposite of a normal access session. In this case, since the access is from inside the firewall 40 to the outside, the session can be set up without any problem. The command issuing node 10 accesses the search hit node 21 through the access session established at this time and obtains the resource 30.

FIG. 6 is a flowchart showing the operation of the command issuing node 10 shown in FIG. This flowchart shows the operation when the command issuing node 10 receives a hit reply from another node. In FIG. 6, the command issuing node 10 tries to access the search hit node 21 based on the name of the access interface and the information of the search hit node 21 included in the received hit reply. (Step S21).

Then, it is determined whether or not an access session has been established (step S22). In the case of access from outside the firewall 40 to each other or from inside the firewall 40, a session can be established. In that case, the command issuing node 10 obtains resources from the search hit node based on the access (step S 2 6).

However, when the internal search hit node 21 is accessed from outside the firewall 40 as shown in Fig. 5, an access session cannot be set up. In this case, the command issuing node 10 issues a push-req command (step S23). Thereafter, it is determined whether or not access has been made from the search hit node 21 according to the push-req command (step S24), and if so, the search hit node 2 has been accessed through the access session. 1 is accessed (step S25), and resource 30 is acquired (step S26).

FIG. 7 is a diagram illustrating another configuration example of the network according to the second embodiment. In the example shown in FIG. 7, not only the search hit node 21 is inside the firewall 40, but also the command issuing node 10 is included inside another firewall 41. In order to cope with such a case, a gateway node (GW node) 50 for mediating access is prepared outside each of the firewalls 40 and 41. The gateway node 50 needs to be able to establish a session from both the command issuing node 10 and the search hit node 21.

Also in the example of FIG. 7, the lookup command for searching for the resource 30 from the node 10 is issued, and as a result, the lookup command is sent to the node 21 in the firewall 40 via the node 11. Node is propagated, and hit reply is returned from the node 21 in reverse flow.

Upon receipt of the hit reply, the command issuing node 10 tries to access the directory to the search hit node 21 according to the normal processing. However, since the search hit node 21 exists inside the firewall 40, no access session can be established from the command issuing node 10 to the search hit node 21. In this case, the command issuing node 10 issues a push-req command to the search hit node 21 along the connection path on which the hit reply is backpropagated. The search hit node 21 receiving the push-req command attempts to access the command-issuing node 10. This is the opposite of a normal access session.

In the example shown in Figure 5 above, an access session could be established at this point. However, here, since the command issuing node 10 also exists inside the firewall 41, an access session must be established from the search hit node 21 to the command issuing node 10 as well. Can't.

In this case, the command issuing node 10 issues a gw-req command (gateway access request command) to the search hit node 21 through the connection session. The gw-req command is delivered to the search hit node 21 along the route through which the hit reply is backpropagated. The gw-req command is a packet containing information on the gateway node 50. Therefore, both the command issuing node 10 that has issued the gw-req command and the search hit node 21 that has received it can know the gateway node 50.

Therefore, the command issuing node 10 and the search hit node 21 access the gateway node 50. Both of these are accesses from inside the firewall 40 to the outside, so you can set up a session without any problems. Gateway node 50 links two sessions internally and mediates an access session. The command issuing node 10 accesses the search hit node 21 through the access session established at this time and acquires the resource 30.

FIG. 8 is a flowchart showing the operation of the command issuing node 10 shown in FIG. This is a charter. This flowchart shows the operation when the command issuing node 10 receives an Mt reply from another node. Figure

In step 8, the command issuing node 10 sets the name of the access interface and the search hit node 2 included in the received hit reply.

An attempt is made to access the search hit node 21 based on the information in step 1 (step S31).

Then, it is determined whether an access session has been established (step S32). If an access session can be established here, the command issuing node 10 acquires a resource from the search hit node based on the access (step S38).

On the other hand, when accessing the internal search hit node 21 from the outside of the firewall 40 as shown in Fig. 7, an access session cannot be established. In this case, the command issuing node 10 issues a push-req command (step S33). Thereafter, it is determined whether or not access has been performed from the search hit node 21 according to the ush-req command (step S34), and if so, the search hit node 21 has been accessed through the access session. Is accessed (step S35) to obtain a resource 30 (step S38).

However, in the example of FIG. 7, an access session cannot be established from the search hit node 21 to the command issue node 10 as well. In this case, the command issuing node 10 issues a gw-req command to the search hit node 21 (step S36), and then accesses the gateway node 50 (step S3). 7). By issuing the gw-req command to the search hit node 21, the search hit node 21 also accesses the gate node 50, so that the command issuing node 10 0 Accesses the search hit node 21 through these access sessions. And obtains resource 30 (step S38).

FIG. 9 is a flowchart showing the operation of the search hit node 21 shown in FIG. This flowchart shows the operation after the search hit node 21 issues a hit reply to another node. In FIG. 9, the search hit node 21 determines whether a push-req command has been received (step S41). If the push-req command has not been received, it means that a session for access to the search hit node 21 from the command issuing node 10 has been successfully established, and the process ends without doing anything. .

On the other hand, when the push-req command is received, the command issuing node 1 is included based on the information of the command issuing node 10 included in the received push-req command. Attempt to access 0 (step S42). Then, it is determined whether or not an access session has been established (step S43). If an access session can be established here, the process ends without doing anything.

If the search hit node 21 cannot establish an access session to the command issuing node 10, the search hit node 21 waits for the gw-req command (step S 4 4). When the gw-req command is received, the gateway node 50 is accessed based on the information of the gateway node 50 included in the received gw-req command (step S4). 5) End the processing.

As described in detail above, according to the second embodiment, when trying to access resources in the firewall from outside, a predetermined command is issued to allow the resources from inside the firewall to outside. Since an access session is set up, even if a firewall is installed for security measures, it will be outside the firewall. Departments can freely access internal resources.In this way, if it becomes possible to freely access the firewall inward, an unauthorized third party can pretend to be a member of the group and have access to the firewall. Could invade. In the present embodiment, even in such a case, resources such as a data file to be transferred are encrypted so that confidential information is not leaked. It also uses user authentication. Although the encryption method is not particularly limited, for example, PKI (public key encryption method) can be used.

In this embodiment, the type of authentication can be specified at the time of user login. Authentication range from simple password authentication to complex SSL (Secure Sockets Layer) authentication. Password authentication is performed on each node. SSL authentication is based on the certificates that each node submits when connecting.

FIG. 10 is a diagram for explaining the operation when notifying user information. As shown in FIG. 10, the user node 10 notifies the user information using the connection session after login to the network and at the start of a new connection. This user information includes the user ID, display name, description, and user authentication certificate (public key). The packet of the user information notified from the user node 10 is propagated between the other nodes 11 to 19.

The user information transmitted from the user node 10 is cached in a common user list 61, 62,... Provided in the local storage of each of the nodes 11 to 19. When performing user authentication or encrypting or decrypting data, the user information stored in the common user list 61, 62,.

Figure 11 illustrates the operation when performing SSL-based user authentication. FIG. When performing SSL authentication, the authenticating party needs a certificate of the certificate authority. Therefore, the node distributes a predetermined attribute file and a certificate of the certificate authority as a set. As described in Fig. 10, when a user logs in to a node, the user node 10 submits the user's certificate to the connection destination. The node that receives the user certificate authenticates the user certificate with the certificate of the certificate authority. After the certificate is authenticated, the identity of the user's private key is verified, and if it is accepted, login is permitted.

The certificate submitted at the time of user authentication is propagated to other nodes as notification of user information. Each node caches the received user certificate in the oral storage. Use the public key in the user certificate when encrypting the resource based on SSL, or when verifying the signature of the resource.

As described above, in the present embodiment, the user information is notified when the user logs in to the network, and the user information (including the public key) is included in the user information. Public keys can be easily distributed to each node. Conversely, it is very easy to obtain a public key from each node, and user authentication and encryption can be easily performed in a P2P network.

The functions of the network system according to the present embodiment described above are actually configured by a computer CPU or MPU, RAM, ROM, and the like, and the programs stored in the RAM and ROM operate. This can be achieved. Therefore, the present invention can be realized by recording a program that causes a computer to perform the above functions on a recording medium such as a CD-ROM, and reading the program over the computer. As a recording medium for recording the above programs, in addition to a CD-ROM, a flexible disk, a hard disk, a magnetic tape, an optical disk, an optical disk A magnetic disk, a DVD, a nonvolatile memory card, or the like can be used. It can also be realized by downloading the above program to a computer via a network such as the Internet.

In addition, not only the functions of the above-described embodiments are realized by the computer executing the supplied program, but also the program is running on a computer. S (operating system) or When the functions of the above-described embodiment are realized in cooperation with other application software, etc., or all or a part of the processing of the supplied program is performed by a computer function expansion board or function expansion unit. Such a program is also included in the present embodiment when the functions of the above-described embodiment are realized.

Each of the embodiments described above is merely an example of a concrete example for carrying out the present invention, and the technical scope of the present invention should not be interpreted in a limited manner. is there. That is, the present invention can be implemented in various forms without departing from the spirit or the main features thereof. Industrial applicability

INDUSTRIAL APPLICABILITY The present invention is useful for making it possible to freely access from outside and acquire resources even when a firewall or NAT server is installed in a P2P system.

Claims

The scope of the claims

1. The resource search command is propagated to the connected neighboring nodes, and if a certain node hits the resource search, the search hit response is transmitted from the search hit node and the above resource search command is propagated. A network system in which each of the nodes transmits in the opposite direction to reach the command issuing node, and then the command issuing node accesses the search hit node to acquire the resource. And a gateway node for exchanging communications inside and outside the private network by exchanging the global address with the private address, and the gateway node responds to the search hit described above. When the search hit node information is received, the information of the search hit node A means for adding the information and transferring the search hit response to another node,

Each node, when the node itself is the command issuing node, based on the information of the search hit node and the information of the gateway node included in the search hit response, obtains the search hit node. Alternatively, a network system comprising means for accessing the gateway node.

2. The resource search command is propagated to the connected neighboring nodes, and when a search is hit on a certain node, the search hit response from the search hit node is sent to the resource search command. After the node has propagated the data and transmitted it to the command issuing node in the opposite direction, the command issuing node accesses the search hit node to acquire the resource. Network system, where each node An access request means for issuing an access request command to the connected neighboring nodes when the search request node cannot be accessed when the node itself is the command issuing node;

A reverse access means for executing access to the command issuing node when receiving the propagated access request command in the case where the search hit node is the search hit node itself; Network system.

3. Each of the above-mentioned nodes, when the node itself is the above-mentioned command issuing node, issues a predetermined gateway when access from the above-mentioned search hit node is not established despite the above-mentioned access request command being issued. A first gateway access means to access the node;

Second access requesting means for issuing a gateway access request command for requesting access to the gateway node to the connected neighboring nodes,

A second gateway access means for accessing the gateway node when receiving the propagated gateway access request command in the case where the gateway itself is the search hit node. The network system according to claim 2, wherein:

4. A program for causing a computer to function as each means described in any one of claims 1 to 3.