WO2020065476A1

WO2020065476A1 - System and method for accessing data in an internal region

Info

Publication number: WO2020065476A1
Application number: PCT/IB2019/057971
Authority: WO
Inventors: Oliver Bollmann
Original assignee: Cordaware GmbH Informationslogistik
Priority date: 2018-09-26
Filing date: 2019-09-20
Publication date: 2020-04-02
Also published as: DE102018123692A1

Abstract

The invention relates to a system (1) and a method for publicly accessing data in an internal region (2) which is secured against unauthorized intrusions. The system (1) comprises a closed region (100) which has an internal region (2), a DMZ (4), and a computing center (5). The closed region (100) has an internal region (2) with a plurality of devices (32₁, 32₂,..., 32_N), a DMZ (4) with at least one proxy (25₁, 25₂,..., 25_P) and a respective assigned pool (23), and a computing center (5) with at least one server (30₁, 30₂,..., 30_S). In each case, a hive (24₁, 24₂,..., 24_S) is assigned to each server (30₁, 30₂,…,30_S) of the computing center (5), wherein each combination of hive (24₁, 24₂,..., 24_S) and server (30₁, 30₂,..., 30_S) provides a protocol-free connection (21) to the public region (8) and a protocol-free connection (21) to the DMZ (4) of the closed region (100). The internal region (2) of the closed region (100) provides a protocol-free connection (21) to the DMZ (4) of the closed region (100).

Description

System and method for accessing data in an internal area

The invention relates to a secure system for accessing data in an internal area. In particular, the system comprises a public area and a closed area. The closed area has an internal area, a demilitarized zone (DMZ) and a data center. The internal area includes a variety of devices, such as Mobile phones, tablets, laptops, desktops,

Control computers and the like. The DMZ includes at least one proxy, to which a pool is assigned. The data center comprises at least one server.

The invention further relates to a secure method for accessing data.

European patent application EP 3 316 545 A1 discloses a method in which a request for a specific service is received by a server outside the firewall (external server) via the firewall from a server inside a firewall (internal server). The firewall is designed in such a way that units within the firewall can connect to units outside the firewall. It is also possible to block connections that originally come from outside the firewall, whereby the service is provided within the firewall. A connection is created with the Outbound Proxy Server (OPS), whereby data is sent to a server within the firewall, which stores the specific service. Ultimately, the request is routed with the OPS via the connection created.

The German translation DE 1 1 2012 003 731 T5 of the international

Patent application WO 2013/036946 discloses various methods for the secure exchange of private keys for authenticating a user with regard to an RDP service. A request can be received that includes session information to provide a user with access to an RDP service. The method may further include assigning a validity period to the password. Furthermore, the method can generate a first secret key, which is based on user information, and generate a second secret Key based on the first secret key and a salt, and encrypting a packet having the password and the period using the second secret key. In addition, that can

Methods include transmitting the user name and the encrypted packet to the device for authenticating the user with respect to the requested RDP service.

The German translation DE 1 1 2005 002 614 T5 of the international

Patent application WO 2006/046973 discloses a method for controlling access between a computer and a network. Network requests are identified that are assigned to at least one task that runs on said computer. In response to a detected network request, the task is enabled to access the network if network access is currently disabled for the task. In response to a lack of new activity associated with the task on the network, at least one device on the network is prevented from accessing at least one port that is currently open on the computer.

European patent application EP 2 031 817 A1 discloses a system and a method for streaming an inverted HTTP gateway. A network is also disclosed which also includes this system or method. The reverse HTTP gateway is shielded between two firewalls, ie in the DMZ, by an internal server and the Internet. The system disclosed here communicates via an HTTP protocol.

According to the prior art, servers are to be regarded as sinks. For example, when emails are accessed, the client accesses the server. The clients are sources such as cell phones, tablets, laptops or desktops. A complex firewall setting is required to protect the at least one server. The problem with the firewall setting is that depending on the number of required activation of the firewall ports, the overview of the settings made is complicated. So It can happen that an administrator can rule itself out in the event of an error in the firewall settings.

In Germany, the Federal Office for Information Security (BSI) recommends a two-stage firewall concept from the internal area to the Internet in its IT-Grundschutz catalogs. In this case, a firewall separates the Internet from the DMZ and another firewall separates the DMZ from the internal network. As a result, a single vulnerability does not immediately compromise the internal network. Ideally, the two firewalls are from different manufacturers, otherwise a known vulnerability would be sufficient to overcome both firewalls.

The filter functions can be performed by a single device; in this case, the filtering system requires at least three network connections: one for each of the two network segments to be connected (e.g. Wide Area Network (WAN) and Local Area Network (LAN)) and a third one for the DMZ.

Even if the firewall protects the internal network from attacks by a compromised server from the DMZ, the other servers in the DMZ can be attacked directly as long as no further protective measures are taken. This could e.g. Legs

Segmentation in the Virtual Local Area Network (VLANs) or software firewalls on the individual servers that discard all packets from the DMZ network.

A connection should always be established from the internal network to the DMZ, never from the DMZ to the internal network. A common exception to this is access from the DMZ to database servers in the internal network. As a last resort, the firewall administrator usually monitors this principle before the rule is activated. This largely reduces the risk potential of a compromised server in the DMZ to attacks: directly on the inner firewall, on other servers in the same DMZ, via security gaps in administration tools such as Telnet or Secure Shell "SSH" and on connections that are regular were set up in the DMZ. SSH describes both a network protocol and corresponding programs, with the help of which one can establish an encrypted network connection with a remote device in a secure manner. This method is often used to make a remote command line available locally. That is, the output from the remote console is output on a local console and the local keyboard inputs are sent to the remote computer. This can be used for example for

Remote maintenance of a server located in a remote data center.

Some routers for home use incorrectly refer to the configuration of an exposed host as "DMZ". You can specify the IP address of a computer in the internal network to which all packets from the Internet are forwarded that do not use the NAT table of another The host (also for potential attackers) can be reached from the Internet. Port forwarding of the ports actually used is - if possible - possible.

preferable.

It depends on the specific configuration of the firewall whether the

Port forwardings to the other computers are taken into account and only then the exposed host, or whether the exposed host makes the port forwardings on other computers ineffective.

Another possibility of protection can be a "dirty DMZ". The “dirty DMZ” or “dirty riet” is usually the network segment between the two

Perimeter router and the firewall of the (internal) LAN. From the outside, this zone has only the limited security of the perimeter router. This version of the DMZ hampers the data transfer less because the incoming data only have to be filtered (perimeter router).

Another option is the individual security of the firewall using a "protected DMZ". A “protected DMZ” is a DMZ that is connected to a firewall's own LAN interface. This DMZ has the individual security of the firewall. Many firewalls have multiple LAN interfaces to set up multiple DMZs.

Currently, according to the state of the art, public access to data in an internal area is accomplished through the implementation of a DMZ. The DMZ separates the public area from the internal area. According to the current state of the art, two methods can be used to make data from the internal area accessible to the public. On the one hand, the data is kept in the DMZ. Access to the data via a corridor into the internal area can also be made possible.

The dilemma of establishing a connection is that an escape route can be implemented if the DMZ is compromised by establishing a connection to the public area. This favors the theft. In addition, according to the BSI IT baseline protection catalog, there must be no connection from the DMZ to the internal area. If there is one, the DMZ is no longer a DMZ by definition. However, this connection establishment is tolerated in order to be able to access data in the internal area, as there is as yet no known technology that provides data in any other way.

It is therefore an object of the present invention to provide a system for access from a public area (for example the Internet) to data in an internal area, with protection against attacks on and against theft of data in the internal area despite the provision of public access Area is enabled.

This object is achieved by a system for public access to data in an internal area, which comprises the features of claim 1.

It is also an object of the present invention to provide a method for public access to data in an internal area which, despite the provision of public access, enables protection against attacks on and against theft of data in the internal area.

The above object is achieved by a method for public access to data in an internal area, which comprises the features of claim 9.

The system according to the invention enables secure public access to data in an internal area. The system includes a public area, such as the Internet, and a closed area. The closed area is from one internal area, a DMZ and a data center. The internal area includes a variety of devices. The DMZ has at least one proxy, each with an assigned pool. The data center comprises at least one server, with each of the servers being assigned a hive. Any combination of hive and server can provide a protocol-free connection to the public area and a

Provide a protocol-free connection to the DMZ of the closed area. The internal area of the closed area also provides a protocol-free connection to the DMZ of the closed area. The connections provided can enable an incoming data flow through outgoing connections.

The internal area and the devices of the internal area are sources. Likewise, the data center and the at least one combination of one server each with a hive provided in the data center are designed as a source.

The DMZ and the at least one proxy, each with an assigned pool, and the public area are sinks. The sources of the system are connected to the sinks via the connections. The designation as a source does not refer to data, but to the possibility of establishing a connection from the source to a sink. The other direction from the valley to the source is not possible.

This means that two sources cannot connect to each other. Likewise, two sinks cannot connect to each other. A sink is required to connect two sources. With this constellation, data from one source can be exchanged via the sink.

Computers in the sense of the description can be virtual or physical. Private computers are sources. Private networks are also sources. Private computers are in private networks (internal areas). Public computers (such as servers) are sinks. Public networks are also sinks. Public computers are in public networks. A DMZ is public and therefore a sink. Likewise, the Internet with all of its applications is public and therefore a sink. According to a possible embodiment, the DMZ can be provided with a first firewall and a second firewall. The first firewall is a sink for that

Connections from the internal area. The second firewall represents a sink for the connections from the data center.

According to the invention, the hives that are assigned to the corresponding servers are each clones from a hive previously installed in the data center. The clone of a hive (computer) can be created by simply copying. The clone of the hives can reconnect to the pool of the proxy because the configuration of the clone of the hives has not been changed by copying.

Cloning the hives has the advantage that a "hot update" of the server service and / or the operating system is possible. Cloning and updates can run multiple versions at the same time. It is possible to switch off the "old" versions at any time.

With every combination of hive and server, each hive has access to the server assigned to it. According to a possible embodiment, the at least one server and the hive assigned to it can be installed on two separate computers. Likewise, and software for the corresponding hive must be installed on the separate, separate computer. The hive and the server are connected via the access.

According to a possible further embodiment, the at least one server and the hive assigned to it can be a single computer. The hive and the server are installed as software on the single computer.

According to a possible embodiment of the invention, the internal area can comprise at least one server which represents a sink for the hive. Likewise, the pool and the proxy of the DMZ as well as the hive of the internal area can comprise a server or a virtual server. The pool of the DMZ sends a request to the hive to occupy at least one of the free corridors. If access to the internal area is permitted, a port connects to at least one server in the internal area. The internal area is a sink. According to the system according to the invention, a connection to the DMZ can be established by means of a port through the first firewall via at least one external device in the public area that is a source.

The proxy of the DMZ sends a message to the pool through the connection to the DMZ established by the first firewall. The pool initiates a message

Occupancy of one of the free corridors provided by Hive, so that the at least one corridor is occupied.

The hive forwards the at least one request from the public area to the server in the internal area via the port and the connection to the at least one server.

The inventive method for public access to data in a closed area is characterized by several steps. First, a public area is provided that is configured as a sink. A closed area is assigned to the public area. The closed area includes an internal area that is a source. A DMZ is a sink. A

Data center is a source. Protocol-free connections to the sinks are formed by the sources to access data.

The advantage of this method is that the connections to the sinks can only be established from sources and data can be exchanged via the connections, so that external access to data or data theft from the internal area (of the sources) is not possible. Data security is thus increased by the invention.

According to the invention, the data center comprises at least one server, with each server being assigned a hive via an access. The data center can thus establish at least one protocol-free connection to the public area and at least one protocol-free connection to at least one proxy of the DMZ. The internal area consists of a variety of devices (such as e.g.

Mobile phones, tablets, laptops, desktops, control computers and the like), of which at least one protocol-free connection to at least one proxy to the DMZ is established. In the event that the devices are designed as computers, this can be implemented physically or virtually.

The DMZ enables data exchange between the data center and the internal area. A pool is assigned to at least one proxy of the DMZ. The at least one hive connects to the pool and the pool configures the at least one proxy of the DMZ. Only proxies and no data are provided in the DMZ. Since the DMZ is configured as a sink, external access can only take place through an open port of the proxy. The DMZ is closed from the inside (sink). A connection to a source is not possible. A notification is sent when a port of the at least one proxy is dynamically closed or opened.

Access by the at least one hive to the respectively assigned server is also monitored. If a service is not available, this access of the corresponding server and / or the dynamically opened port of the at least one proxy is closed if there are no connections.

The dynamically created ports of a proxy can be closed automatically if there are no connections for the port of the proxy. This is e.g. the case when the combination of server and hive is "down".

A particularly advantageous embodiment of the present invention is when the hives used in the system are the clones of a previous hive. Each of the cloned hives can thus connect itself to the pool of the at least one proxy.

The DMZ can also be a single computer, e.g. a calculator from one

Internet provider.

The invention and its advantages will now be explained in more detail by means of exemplary embodiments with reference to the accompanying drawings, without thereby restricting the invention to the exemplary embodiment shown. The proportions in the figures do not always correspond to the real size relationships, as some shapes are simplified and other shapes are shown enlarged in relation to other elements for better illustration. Show:

Figure 1 is a schematic representation of a single-stage firewall concept

State of the art;

Figure 2 is a schematic representation of a two-stage firewall concept

State of the art;

Figure 3 is a schematic representation of a source in the sense of the invention;

Figure 4 is a schematic representation of a sink in the sense of the invention;

Figure 5A is a schematic representation of an allowed or possible

Connection establishment;

FIG. 5B shows a schematic illustration of a not permitted or not possible

Connection establishment;

Figure 6 is a schematic view of the connection of two sources;

FIG. 7 shows a schematic representation of a pool in the sense of the invention;

FIG. 8 shows a schematic illustration of a hive in the sense of the invention;

Figure 9 is a schematic representation of the switching of connections to the

Pool;

FIG. 10 shows a schematic illustration of the assignment of public inquiries according to the invention;

Figure 11 is a schematic representation of the system according to the invention and

its interaction of sinks and sources;

Figure 12 is a schematic illustration of an embodiment of the

system according to the invention; FIG. 13 shows a schematic illustration of a further embodiment of the system according to the invention; and

Figure 14 is a schematic representation of the combination of server and hive.

Identical or identical elements of the invention become identical

Reference numerals used. Furthermore, for the sake of clarity, only reference numerals are shown in the individual figures which are necessary for the description of the respective figure. The figures only show exemplary embodiments of the invention, but without restricting the invention to the exemplary embodiments shown.

Figure 1 shows the representation of a single-stage firewall concept of the prior art. A demilitarized zone 4 (DMZ) is connected to an intranet 2 (such as LAN) via a firewall 6. The intranet 2 is protected by the firewall 6 against other networks 8, e.g. Internet or LAN, shielded. The separation allows access to publicly accessible services (bastion hosts with e.g. e-mail, www, etc.) and at the same time protects the intranet 2 (internal network) against unauthorized access from the other networks 8. The protective effect of the DMZ 4 is achieved by isolating a system from two or more networks. In the embodiment shown here, the DMZ 4 can have three servers or systems, e.g. WWW 1 1, SMTP 12 and DNS 13 include.

FIG. 2 shows a schematic illustration of a single-stage firewall concept of the prior art. In this embodiment, the DMZ 4 is protected by a first firewall 6 and a second firewall 7. The first firewall 6 separates the DMZ 4 from the external networks 8 or the Internet. The second firewall 7 separates the intranet 2 from the DMZ 4.

FIG. 3 shows a schematic illustration of a source 20 in the sense of the invention. A source 20 in the sense of the invention can establish connections 21. The source 20 is shown schematically with a solid line 18 and a dashed line 19. A connection 21 can only be established starting from the source 20. In other words, the connection 21 can only come from the dashed line 19 starting out. An acceptance of connections 21 by the source 20 via the solid line 18 is not possible. Via connection 21, data from a sink 22 (see FIG. 4) of the system according to the invention can be sent to the source 20.

FIG. 4 schematically shows a depression 22 as used in the system according to the invention. The sink 22 can accept connections 21. It is not possible to set up connections 21 to other elements of the system. The depression 22 can also be represented schematically with a solid line 18 and a dashed line 19. A connection 21 can only be accepted by the sink 22. As illustrated in FIG. 5, the dashed line 19 surrounds the solid line 18.

FIG. 5A illustrates the direction in which the establishment of a connection 21 is possible. It does not matter whether sink 22 or source 20, the connection 21 can only from the

Dashed line 19 take place over the solid line 18.

FIG. 5B illustrates the direction in which the establishment of a connection 21 is not possible. The solid line 18 does not allow a connection 21 to be established. Consequently, a connection 21 from the solid line 18 via the dashed line 19 is not possible.

FIG. 6 shows a schematic view of the connection of two sources 20. Two sources 20 can only connect via a sink 22. It is not possible for two sources 20 or two sinks 22 to connect to one another. One of the sources 20 establishes a connection 21 with the sink 22. Likewise, the other source 20 establishes a connection 21 with the sink 22. Via the established connections 21, data about the sink 22 can now be transmitted from one source 20 to the other source 20

be replaced. There is no data in the sink 22.

FIG. 7 shows a pool 23 which is used in the system according to the invention. A pool 23 is a sink 22 and can accept, collect and manage at least one connection 21. The number of connections shown is 21 merely by way of example and should not be construed as a limitation of the invention.

A hive 24 is shown in FIG. The hive 24 is a source 20 of the system, which can establish at least one connection 21.

FIG. 9 shows a pool 23 which accesses the proxy 25 with an internal access 26 in order to enable ports of the proxy 25 for the connections (not shown) from the sources 20. 9 shows the basic structure of a DMZ 4. It goes without saying that a DMZ 4 can comprise more than one proxy 25 with pool 23. The illustration shown here is for the purpose of description and is not to be interpreted as a limitation of the invention.

FIG. 10 shows a schematic illustration of a possible embodiment of the system 1 of the invention. The DMZ 4 is a sink 22. The DMZ 4 comprises, as already mentioned, the pool 23 and the proxy 25. The pool 23 collects the connections 21 from the internal area 2 (source 20), e.g. Intranet. The management and assignment of the connections 21 (see FIG. 12) from the public area 8 (public networks, Internet; source 20) are carried out by the proxy 25 of the DMZ 4.

FIG. 11 shows a schematic and simplified illustration of the system 1 according to the invention and the interaction of sinks 22 and sources 20. From the internal area 2 (source 20), the data 28 arrive via the connection 21 to a sink 22 which the DMZ 4 (sink 22) with the at least one proxy 25. Upon request from the public area 8, the data 28 from the internal area 2 can be routed to the data center 5 (source 20) by means of the connections 21 established via the DMZ 4, which is also a sink 22. The DMZ 4 manages the inquiries (see FIGS. 12 and 13) from the public area 8 and provides the necessary ones

Connections 21. If, for example, the sink 22 is compromised, it is not possible to create data to the outside, since a sink 22 cannot establish a connection 21 (escape route) to the sources 20 to the outside. FIG. 12 shows a possible embodiment of the system 1 according to the invention. Between a source 20, which is an internal area 2 (such as a local area network (LAN) or intranet) and a data center 5, which is also a source 20, is the DMZ 4 is provided, which is a depression 22. A closed area 100 of the system 1 according to the invention comprises the internal area 2 (such as a local area network (LAN) or intranet), which is DMZ 4 and the data center 5.

The internal area 2 can comprise a multiplicity of devices 32i, 32 ₂ ,... 32 _N , which are also sources 20. The devices 32i, 32 ₂ ,... 32 _{N of} the internal area 2 can be, for example, mobile telephones, tablets, laptops, desktop computers, a control computer or a device that requires remote maintenance. An example of a 32i device,

32 ₂ .... 32 _n that requires remote maintenance can be an X-ray device, for example. Public access is defined as access that does not belong to internal area 2. The firewall setting of the individual devices 32i, 32 ₂ , ... 32 _N is static. As defined for a source 20, it is closed from the outside and open from the inside. The source 20 is therefore only possible to establish a connection 21.

The DMZ 4 can comprise at least one proxy 25i, 25 ₂ , ..., 25 _P. The at least one proxy 25i, 25 ₂ , ..., 25 _P can be designed as a server and / or a virtual server.

No data is available in DMZ 4. On the at least one proxy 25i,

25 ₂ .... .25 _P can be accessed from the outside. The devices 32i, 32 ₂ ,... 32 _{N of} the internal area 2 can make the connections 21 to the at least one proxy 25i,

25 ₂ ...., build up 25 _P. Thus, as defined for a sink 22, the at least one proxy 25i, 25 ₂ , ..., 25 _{P is} open from the outside and closed from the inside. A pool 23 (not shown here; see FIG. 10) can also be assigned to each of the proxy 25i, 25 ₂ ,... 25 _P. The proxy 25i, 25 ₂ , ..., 25 _P are port proxy. The pools 23 are pool proxies.

The data center 5 is a source 20 which comprises at least one server 30i, 30 ₂ , ..., 30 _s , each with an associated hive 24i, 24 ₂ , ..., 24 _s . Each of the servers 30i,

30 ₂ ..... 30 _S can establish a connection 21 to the at least one proxy 25i, 25 ₂ , ..., 25 _{P of} the DMZ 4. Likewise, each server 30i, 30 ₂ , ..., 30 _{s of} the data center 5 can establish a connection 21 to a public area 8, which is, for example, the Internet build up. The public area 8 (Internet) comprises a large number of applications 40i, 40 ₂ , ..., 40 _k , which the system 1 according to the invention can access.

The connection from the data center 5 (source 20) to the DMZ 4 is established in such a way that at least one hive 24i, 24 ₂ , ..., 24 _s connects to the pool 23 (pool proxy). The at least one hive 24i, 24 ₂ , ..., 24 _s dynamically configures the at least one proxy 25i, 25 ₂ , ..., 25 _P (port proxy) via the pool 23.

The following example illustrates the connection setup described above for pool 23 (pool proxy) and the at least one proxy 25i, 25 ₂ , ..., 25 _P (port proxy). Pool 23 (pool proxy) listens to port 8001, for example. One of the Hives 24i,

24 ₂ ...., 24 _s , such as Hive 24i, connects to port 8001. Hive 24i opens port 443 on proxy 25i (port proxy). Hive 24i is connected to port 443 on the assigned server 30i . This enables data exchange from port 443 of proxy 25i (port proxy) to port 443 of server 30i.

The at least one hive 24i, 24 ₂ , ..., 24 _s and the at least one proxy 25i, 25 ₂ , ..., 25 _P are independent of a protocol, such as http. The configuration of the at least one proxy 25i, 25 ₂ , ..., 25 _P is static. The configuration of the at least one assigned hive 24i, 24 ₂ , ..., 24 _s is semi-static, only the port of the at least one proxy 25i, 25 ₂ , ..., 25 _P (port proxy) and the port of the at least one Servers 30i,

30 ₂ .... .30 _S can be changed.

When opening a port for at least one proxy 25i, 25 ₂ , ..., 25 _{P there} is a

Notification. There is also a notification when a port is closed for at least one proxy 25i, 25 ₂ , ..., 25 _P. Each hive 24i, 24 ₂ , ..., 24 _s that is assigned to the corresponding server 30i, 30 ₂ , ..., 30 _{S of} the data center can be monitored via an internal access. The access of the corresponding hives 24i, 24 ₂ , ..., 24 _s to the server 30i, 30 ₂ , ..., 30 _{s assigned to it} can be closed if the

corresponding server 30i, 30 ₂ , ..., 30 _{s is} not available.

The dynamically configured port of the at least one proxy 25i, 25 ₂ , ..., 25 _P (port proxy) can be automatically closed if the Number of connections of at least one proxy 25i, 25 ₂ , ..., 25 _P (port proxy) is zero. This is the case, for example, if the combination of the at least one server 30i, 30 ₂ , ..., 30 _S with the corresponding hive 24i, 24 ₂ , ..., 24 _{s is} "down", for example due to a power failure .

If further assignments from server 30i, 30 ₂ , ..., 30 _s (computer) and Hive 24i,

24 ₂ .... .24 _{S is} required, this is done by cloning one of the existing Hives 24i,

24 ₂ ..... 24 _s . The cloned Hive 24i, 24 ₂ , ..., 24 _s reconnects to Pool 23 (pool proxy) because the configuration of the cloned Hives 24i, 24 ₂ , ..., 24 _{s has} not been changed.

The public area 8, for example the Internet, comprises a large number of external devices and services (not shown). The public area 8 is a sink 22 and is shielded from the data center 5, which is a source 20, by a firewall 6. The data center 5 builds a connection to a proxy server if there are requests from the internal area 2 (such as an intranet) 40 in the public area 8. The applications 40i, 40 ₂ , ..., 40 _K (devices and / or services) of the public area 8 establish connections 21 to the proxy server 40, which is not public. connect to make inquiries to internal area 2. In order that the requests from the public area 8 to the internal area 2 of the closed area, the corresponding connections 21, the first firewall 6 and the second firewall 7 (see FIG. 13) of the DMZ 4 have to be created by the system 1.

FIG. 13 shows a further possible embodiment of the system 1 in FIG

current invention. The structure of the embodiment in FIG. 13 differs from the structure already described in FIG. 12 in that a second firewall 7 is provided. The proxy server 40 is thus shielded by the first firewall 6 and the second firewall 7. The configuration corresponds to that of a DMZ 4. All other features of the system 1 according to the invention have already been described in detail in the description of FIG. 12.

It is believed that the system and method of the present

Disclosure and many of its attendant advantages through the foregoing description is understandable. Furthermore, it is apparent that various changes in the shape, number, construction and arrangement of the components can be made without departing from the subject matter disclosed or without sacrificing all of their material advantages. The form described is only explanatory.

The invention has been described in terms of preferred embodiments. It will be understood by those skilled in the art that modifications and changes to the invention can be made without departing from the scope of the following claims.

System reference number list

internal area, intranet

demilitarized zone, DMZ

Data center

first firewall

second firewall

public area (Internet, networks) WWW SMTP DNS

solid line

dashed line

source

connection

Sink

pool

Hive

i, 24 ₂ , ..., 24 _S Hive

Proxy

i, 25 ₂ , ..., 25 _P proxy

internal access

Data

server

i, 30 ₂ , ..., 30 _s server

i, 32 ₂ , ... 32 _N devices

Proxy server

i, 40 ₂ , ..., 40 _K application

0 closed area

Claims

A system (1) for accessing data, comprising: a public area (8), a closed area (100) which has an internal area (2), a DMZ (4) and a data center (5), wherein the internal area (2) a large number of devices (32i, 32 ₂ , ... 32 _N ), the DMZ (4) at least one proxy (25i,

25 ₂ ..... 25 _P ) each with an assigned pool (23) and a data center (5) with at least one server (30i, 30 ₂ , ..., 30 _s ),

characterized by, each a hive (24i, 24 ₂ , ..., 24 _s ), each of which a server (30i, 30 ₂ , ..., 30 _s ) of

Data center (5) is assigned, each combination of hive (24i,

24 ₂ ..... 24 _s ) and server (30i, 30 ₂ , ..., 30 _s ) a protocol-free connection (21) to the public area (8) and a protocol-free connection (21) to the DMZ (4) des provides closed area (100) and wherein the internal area (2) of the closed area (100) provides a protocol-free connection (21) to the DMZ (4) of the closed area (100).

2. System (1) according to claim 1, wherein the internal area (2) and the devices (32i,

32 ₂ .... 32 _n ) of the internal area (2) are sources (20), whereby the

Data center (5) and the at least one combination of a server (30i, 30 ₂ , ..., 30 _s ) with a hive (24i,

24 ₂ ...., 24 _s ) is a source (20).

3. System (1) according to one of the preceding claims, wherein the DMZ (4) and the at least one proxy (25i, 25 ₂ , ..., 25 _P ), each with an associated pool (23) and the public area (8 ) Are sinks (22) and the sources (20) of the system are connected to the sinks (22) via the connections (21).

4. System (1) according to claim 3, wherein the DMZ (4) is provided with a first firewall (6) and a second firewall (7), the first firewall (6) being a sink (22) for the connections (21 ) from the internal area (2) and the second firewall (7) is a sink (22) for the connections (21) from the data center (5).

5. System (1) according to any one of the preceding claims, wherein the hives (24i,

24 ₂ ...., 24 _s ), which are assigned to the corresponding servers (30i, 30 ₂ , ..., 30 _s ), clones from a previously installed hive (24i, 24 ₂ , ..., 24 _s ) are.

6. System (1) according to any one of the preceding claims, wherein each

Combination of hive (24i, 24 ₂ , ..., 24 _s ) and server (30i, 30 ₂ , ..., 30 _s ) of each hive (24i, 24 ₂ , ..., 24 _s ) on the assigned ones Server (30i, 30 ₂ , ..., 30 _s ) has an internal access 26.

7. System (1) according to claim 6, wherein the at least one server (30i, 30 ₂ , ..., 30 _s ) and the hive assigned to it (24i, 24 ₂ , ..., 24 _s ) on two separate computers are installed and software for the corresponding hive (24i, 24 ₂ , ..., 24 _s ) is installed on the separate computer.

8. System (1) according to any one of the preceding claims 1 to 6, wherein the

at least one server (30i, 30 ₂ , ..., 30 _s ) and the hive assigned to it (24i,

24 ₂ ..... 24 _s ) is a single computer and the hive (24i, 24 ₂ , ..., 24 _s ) and the server (30i, 30 ₂ , ..., 30 _s ) as software on the only computers are installed.

9. Procedure for access to data, characterized by the steps:

• that a public area (8) is provided which acts as a depression (22)

is configured;

• That a closed area (100) is provided, the internal area (2), which is a source (20), a DMZ (4), which is a sink (22) and a data center (5), which is a source (20) is included; and

• to access data are protocol-free from the sources (20)

Connections (21) to the sinks (22) are formed.

10. The method according to claim 9, wherein the data center (5) at least one

Server (30i, 30 ₂ , ..., 30 _s ), each server (30i, 30 ₂ , ..., 30 _s ) having a hive (24i, 24 ₂ , ..., 24 _s ) is assigned and via the

Data center (5) at least one protocol-free connection (21) to public area (8) and at least one protocol-free connection (21) to at least one proxy (25i, 25 ₂ , ..., 25 _P ) is set up to the DMZ (4) and the internal area (2) contains a large number of devices ( 32i, 32 ₂ , ... 32 _N ), of which at least one protocol-free connection (21) to at least one proxy (25i, 25 ₂ , ..., 25p) to the DMZ (4) is established.

11. The method according to claim 10, wherein by means of the DMZ (4) a data exchange

between the data center (5) and the internal area (2) is made possible.

12. The method according to claim 10, wherein the at least one proxy (25i, 25 ₂ , ..., 25 _P ) of the DMZ (4) is each assigned a pool (23) and the at least one hive (24i, 24 ₂ ,. .., 24 _s ) connects to the pool (23) and the pool (23) den

at least one proxy (25i, 25 ₂ , ..., 25 _P ) of the DMZ (4) configured.

13. The method according to any one of the preceding claims 9-12, wherein one

Notification when a port of at least one proxy (25i, 25 ₂ , ..., 25 _P ) is dynamically closed or opened.

14. The method according to any one of the preceding claims 10-13, wherein the access (26) of the at least one hive (24i, 24 ₂ , ..., 24 _s ) to the server (30i, 30 ₂ , ..., 30 _s ) is monitored and, if a service of the corresponding server (30i, 30 ₂ , ..., 30 _s ) is not available, and / or the dynamically opened port of the at least one proxy (25i, 25 ₂ , ..., 25 _P ) is closed when there are no connections (21).

15. The method according to any one of claims 9-14, wherein each hive (24i, 24 ₂ , ..., 24 _s ) is a clone of a previous hive (24i, 24 ₂ , ..., 24 _s ) and each cloned Hive (24i, 24 ₂ , ..., 24 _s ) even with the pool (23) of the at least one proxy (25i,

25 ₂ , ..., 25 _P ) connects.