WO2024091017A1

WO2024091017A1 - Client asset management system and client asset management method

Info

Publication number: WO2024091017A1
Application number: PCT/KR2023/016736
Authority: WO
Inventors: 김태훈; 김동주; 나완규
Original assignee: 주식회사 안랩
Priority date: 2022-10-28
Filing date: 2023-10-26
Publication date: 2024-05-02
Also published as: KR102618291B1

Abstract

The present invention presents a technology for enabling server-based client asset management without additional equipment construction even for clients, belonging to a network (hereinafter, a closed network) having limited connectivity with the outside, through a particular technical configuration by which a data packet of each client belonging to the closed network is delivered to an asset management server outside the closed network in a distinguishable form.

Description

Client Asset Management System and Client Asset Management Method

The present invention relates to a technology that enables server-based client asset management outside the network even for clients in a network whose connection to the outside of the network is limited.

This application claims priority from Korean Application No. 10-2022-0141233, filed on October 28, 2022, and the entire contents of this application are incorporated herein by reference for all purposes.

Operational Technology (OT) refers to a method of monitoring/controlling industrial equipment/facilities, processes, and events using hardware and software, in various industries and environments such as manufacturing, energy, healthcare, building management, smart cities, and smart factories. It is a system that is in operation.

And, in this OT environment, efficient asset management becomes a very important basis.

In other words, in an OT environment, assets can refer to each equipment/facility that makes up the system, and asset management refers to the status of each equipment/facility that makes up the system (e.g. IP, operating system, host name, NIC card information, patch information, usage port/communication node information, etc.) and visualize each equipment/facility by visualizing interconnectivity or network connection information based on the status, etc., defined for the operational efficiency of each equipment/facility. It refers to all management functions.

Meanwhile, among the existing asset management technologies for managing OT assets, there is a method in which each asset is managed by the asset management server based on the connection between the asset management server and the client (asset), that is, a server-based client asset management method. .

For this server-based client asset management, a network connection between the asset management server and the client is essential.

Meanwhile, in the OT environment, due to various issues such as security, there are cases where assets are configured into an independent network (hereinafter referred to as a closed network) where connectivity to the outside of the network is restricted.

Therefore, in an OT environment in which OT assets are composed of a closed network, since the clients (assets) to be managed by the asset management server installed in the external network (hereinafter referred to as open network) belong to the closed network, the asset management server and client Interconnection is impossible, and therefore server-based client asset management is impossible.

The present invention proposes a technical solution that enables server-based client asset management outside the closed network, even for clients belonging to a closed network.

The problem to be solved by the present invention is to provide a client asset management system and a client asset management method that enable server-based client asset management outside the network even for network clients with limited connectivity to the outside of the network. .

A client asset management method according to an embodiment of the present invention includes a confirmation step of identifying a specific client that can also connect to a second network outside the first network among a plurality of clients connected to a first network with limited connectivity to the outside of the network. ; A port forwarding setting step of configuring port forwarding for data packet transfer between the asset management server connected to the second network and the first network in the specific client; An address change setting step of setting an address change in clients other than the specific client among the plurality of clients so that a data packet transmitted to the asset management server is transmitted through the specific client; And an asset management step of managing, in the asset management server, each client asset of the first network based on a data packet transmitted from the specific client.

Specifically, in the port forwarding setting step, an incoming port number is set to distinguish data packets to be forwarded among data packets received from the first network, and a destination IP address is selected from the data packets received through the set incoming port number. and port, can be set to use the IP address and port number of the asset management server.

Specifically, the address change setting step can be set to change the destination IP and port in the data packet transmitted to the asset management server to the first network address and the incoming port number of the specific client.

Specifically, the data packet of the remaining clients transmitted from the specific client to the asset management server may include a unique value that specifies the remaining clients among the plurality of clients connected to the first network.

Specifically, in the asset management step, data packets transmitted from the specific client are classified for each client of the first network according to a unique value included in the data packet, and based on the data packets classified for each client, , It is possible to manage each client asset of the first network.

A client asset management system according to an embodiment of the present invention includes a confirmation unit that verifies a specific client that can also connect to a second network outside the first network among a plurality of clients connected to a first network with limited connectivity to the outside of the network. ; a port forwarding setting unit that sets port forwarding for data packet transfer between the asset management server connected to the second network and the first network in the specific client; An address change setting unit that sets an address change so that a data packet transmitted to the asset management server is transmitted through the specific client in the clients other than the specific client among the plurality of clients; and, in the asset management server, an asset management unit that manages each client asset of the first network based on the data packets of the remaining clients transmitted through the specific client.

Specifically, the port forwarding setting unit sets an incoming port number to distinguish data packets to be forwarded among data packets received from the first network, and sets the destination IP and In Port, you can set to use the IP address and port number of the asset management server.

Specifically, the address change setting unit may be configured to change the destination IP and port in the data packet transmitted to the asset management server to the first network address and the incoming port number of the specific client.

Specifically, the asset management unit classifies data packets transmitted from the specific client for each client of the first network according to a unique value included in the data packet, and based on the data packets classified for each client, Each client asset of the first network can be managed.

According to embodiments of the present invention, through a specific technical configuration that ensures that the data packets of each client belonging to a network with limited external connectivity (hereinafter referred to as a closed network) are delivered to an asset management server outside the closed network in a distinguishable form. , It enables server-based client asset management even for clients belonging to a closed network.

In particular, according to embodiments of the present invention, as server-based client asset management becomes possible without building additional equipment for a closed network, the burden of changing the network environment and configuration, problems of rising costs, and an environment in which it is difficult to build additional equipment Regardless, it has the effect of transparently managing client assets belonging to a closed network.

1 is a configuration diagram showing the configuration of a client asset management system according to an embodiment of the present invention.

Figure 2 is an example diagram showing a server-based client asset management structure to which the proposed technology of the present invention is applied.

3 and 4 are flow charts showing the operational flow of a client asset management method according to an embodiment of the present invention.

Since the present invention can make various changes and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all changes, equivalents, and substitutes included in the spirit and technical scope of the present invention. While describing each drawing, similar reference numerals are used for similar components.

When a component is said to be “connected” or “connected” to another component, it should be understood that it may be directly connected to the other component or may be connected to the other component with another component in the middle. something to do. On the other hand, when it is mentioned that a component is “directly connected” or “directly connected” to another component, it should be understood that there are no other components in between.

The terms used in this application are only used to describe specific embodiments and are not intended to limit the invention. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this application, terms such as “comprise” or “have” are intended to designate the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but are not intended to indicate the presence of one or more other features. It should be understood that this does not exclude in advance the possibility of the existence or addition of elements, numbers, steps, operations, components, parts, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as generally understood by a person of ordinary skill in the technical field to which the present invention pertains. Terms defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and unless explicitly defined in the present application, should not be interpreted in an ideal or excessively formal sense. No.

Hereinafter, the present invention will be described with reference to the attached drawings.

In other words, in an OT environment, assets can refer to each equipment/facility that makes up the system.

Asset management in an OT environment means identifying the status of each equipment/facility that makes up the system (e.g. IP, operating system, host name, NIC card information, patch information, port used/communication node information, etc.) Based on this, it refers to all management functions defined for the operational efficiency of each equipment/facility, such as visualizing each equipment/facility by visualizing interconnectivity or network connection information.

In an OT environment where OT assets are composed of a closed network, the client (asset) to be managed by the asset management server installed on an external network (hereinafter referred to as an open network) belongs to the closed network, so the connection between the asset management server and the client This is impossible and therefore server-based client asset management is impossible.

If client asset management is impossible due to environmental problems such as OT assets being comprised of a closed network, it is difficult to determine the status of client assets belonging to the closed network, and it is especially difficult to secure asset visibility, which is most necessary for security, which can lead to a major problem situation. You can.

Accordingly, in order to solve the tactical environmental problem, a solution has been used to build additional management equipment that can be connected to the asset management server in a closed network.

However, in the case of these existing solutions, there is a problem of the burden of changing the existing network environment and physical configuration and the resulting cost increase.

In addition, in the case of a large equipment/facility system, the structure is already fixed, so it may be impossible to build additional management equipment internally, and in this case, there are limitations in which existing solutions cannot be used. have

Due to this point, the present invention proposes a technical solution that enables server-based client asset management even for clients belonging to a closed network.

In particular, the key to the present invention is to realize a technical configuration that enables server-based client asset management for clients without building additional management equipment in a closed network.

In the following, specific configurations for realizing the technical solution proposed by the present invention, that is, a new type of asset management technology, will be described.

First, Figure 1 shows the configuration of a client asset management system 100, which implements the asset management technology proposed in the present invention.

In Figure 1, each component within the client asset management system 100 that implements the asset management technology of the present invention is conceptually diagrammed, and in actual implementation, each component can be distributed and implemented across clients and asset management servers.

Described with reference to FIG. 1, the client asset management system 100 according to an embodiment of the present invention includes a confirmation unit 110, a port forwarding setting unit 120, an address change setting unit 130, and an asset management unit ( 140) may be included.

Ultimately, the client asset management system 100 according to an embodiment of the present invention, through the above-described configuration, enables server-based client asset management for clients belonging to the technical method proposed by the present invention, that is, a closed network. A new way of asset management technology can be realized.

Below, each component in the client asset management system 100 for realizing the proposed technology of the present invention will be described in more detail.

Prior to detailed description, each component in the client asset management system 100 of the present invention is installed in the form of a program or application on a terminal (e.g., PC, equipment/facility, etc.) corresponding to each asset constituting the OT environment. It can be distributed and implemented across installed/operated clients and asset management servers.

For example, as shown in Figure 2, in the client asset management system 100 of the present invention, an "asset" consisting of a confirmation unit 110, a port forwarding setting unit 120, and an address change setting unit 130. The “management function 150” may be implemented in the client.

In other words, the “asset management function 150” that realizes the asset management technology of the present invention is in the form of a program or application, and is a terminal (e.g. PC, equipment/facility, etc.) corresponding to each asset constituting the OT environment. It may be a client installed/operated on .

Accordingly, hereinafter, for convenience of explanation, the client on which the asset management function 150 is implemented will be referred to as reference number 150, and the asset management function 150, which is a component of the present invention, and the client 150 are assumed and explained to be the same. would.

Additionally, as shown in FIG. 2, in the client asset management system 100 of the present invention, the asset management unit 140 may be implemented in an asset management server.

Hereinafter, for convenience of explanation, the asset management server on which the asset management unit 140 is implemented will be referred to as reference number 140, and it will be assumed and explained that the asset management unit 140 and the management asset server 140, which are components of the present invention, are the same. .

The confirmation unit 110 is in charge of the function of confirming a specific client that can also connect to a second network outside the first network among a plurality of clients connected to a first network with limited connection to the outside of the network.

At this time, the first network with limited connection to the outside of the network can be expressed as a network with various names such as a closed network, a private network, and a private network, and will be referred to as a “closed network” in the following description.

In addition, the second network outside the first network is a network in which the asset management server 140, described later, is located, and is a network of various names such as open network, open network, public network, etc., where external (e.g., Internet) connection is not limited. It can be expressed as, and in the following description, it will be referred to as an “open network”.

That is, if explained with reference to FIG. 2, the confirmation unit 110 can confirm a specific client (eg, client A) that can also connect to an open network among a plurality of clients connected to a closed network.

In the present invention, there must be a client that belongs to a closed network and can also be connected to the asset management server 140, thereby indirectly connecting the client assets belonging to the closed network with the asset management server 140.

In other words, a specific client that is connected to a closed network but can also connect to an open network can be said to be a client in this role.

Accordingly, in the present invention, among a plurality of clients connected to a closed network, there are two or more network adapters, one network adapter is connected to an open network, and one network adapter is connected to a closed network. A client (e.g., client A) that is installed/operated in can be selected as a specific client.

Regarding the method in which a specific client is selected, an example will be described. Among the multiple clients connected to the closed network, a specific client that satisfies the above-mentioned selection conditions may be selected by the operator.

That is, in each client 150, whether or not it is selected as a specific client can be manipulated by the operator.

Accordingly, the confirmation unit 110 of the client (e.g., client A) selected as a specific client among the plurality of clients can recognize/confirm that the client to which it belongs (e.g., client A) is in charge of the role of the specific client. there is.

And, when a specific client (e.g., client A) is selected among the plurality of clients, the confirmation unit 110 of the remaining clients (e.g., clients B, C, D,..., H) is selected through closed network-based communication. , it is possible to recognize/check which client (e.g., client A) is acting as a specific client.

Meanwhile, to explain another example of how a specific client is selected, a specific client that satisfies the above-mentioned selection conditions among multiple clients connected to the closed network will be automatically selected through consultation between clients through the closed network. It may be possible.

That is, each client 150 determines whether the terminal it is installing/operating satisfies the selection conditions described above and shares the judgment result with other clients to satisfy the selection conditions through a sharing-based consultation process. One client can be selected as a specific client.

In addition, the confirmation unit 110 of the remaining clients (e.g., clients B, C, D,..., H) that were not selected as a specific client among the plurality of clients determines which client (e.g., client A) in the above-described negotiation process. ) can be recognized/checked to see if it is acting as a specific client.

In the following description, for convenience of explanation, it will be assumed that client A is selected as a specific client.

The port forwarding setting unit 120 is responsible for setting up port forwarding for data packet transfer between the asset management server connected to the second network and the first network in the specific client.

To be more specific, the port forwarding setting function of the port forwarding setting unit 120 can be operated only on a specific client, that is, client A 150 serving as a specific client among multiple clients.

Accordingly, the port forwarding setting unit 120 of client A (150), which serves as a specific client, is configured to transfer data packets between the asset management server 140 connected to the second network, that is, an open network, and the first network, that is, a closed network. You can set up port forwarding.

Below, an embodiment of port forwarding settings will be described.

The port forwarding setting unit 120 may set an incoming port number to distinguish data packets to be forwarded among data packets received in the first network, that is, a closed network.

For example, the port forwarding setting unit 120 can set any port number among the available port numbers assigned to the closed network as the incoming port number, and in the following embodiment, “36500” is set as the incoming port number. Let's assume one case.

And, the port forwarding setting unit 120 can be set to use the IP address and port number of the asset management server 140 as the destination IP and port in the data packet received through the previously set incoming port number.

In the following embodiment, it will be explained assuming that the IP address and port number of the asset management server 140 are 10.2.1.39 and 443.

Port forwarding settings of the port forwarding setting unit 120 may be performed according to the terminal operating system of client A (150).

For example, if the terminal operating system of client A (150) is a Windows operating system, the port forwarding setting unit 120 may perform/configure the port forwarding settings described above through the netsh command included in the operating system.

Alternatively, if the terminal operating system of client A 150 is a Linux-based operating system, the port forwarding setting unit 120 may perform/configure the port forwarding settings described above through iptables included in the operating system.

The address change setting unit 130 is responsible for setting an address change so that data packets transmitted to the asset management server from the remaining clients other than the specific client among the plurality of clients are delivered through the specific client.

To be more specific, the address change setting function of the address change setting unit 130 can be operated only on the remaining clients B, C, D,...H 150, excluding a specific client among the plurality of clients.

Accordingly, the address change setting unit 130 of each of the remaining clients B, C, D,...H (150) allows the data packet transmitted to the asset management server 140 to be transmitted through a specific client, that is, client A (150). You can set up an address change to allow it to be forwarded.

Below, an embodiment of address change settings will be described.

The address change setting unit 130 is set to change the destination IP and port in the data packet transmitted to the asset management server 140 to the first network address and the above-described incoming port number of a specific client, that is, client A (150). You can.

For example, as described above, when port forwarding settings are performed in the port forwarding setting unit 120 of client A (150), the related information (including the incoming port number (e.g., 36500)) is used for closed network-based communication. It can be delivered/shared to each remaining client B, C, D,...H (150).

Accordingly, the address change setting unit 130 of each of the remaining clients B, C, D,...H (150) sets the destination IP and port in the data packet transmitted to the asset management server 140, and sets the destination IP and port to client A (150). )'s closed network address (e.g., 192.168.0.1) and the aforementioned incoming port number (e.g., 36500).

Here, the data packet transmitted to the asset management server 140 may refer to all types of data packets transmitted from each client 150 to the asset management server 140 for server-based client asset management. .

Hereinafter, among the remaining clients B, C, D,...H, client D (150) is mentioned as an example, and the data packet of client D (150) is sent to the asset management server 140 through client A (150). I will explain the delivery process.

Various data transmission events predefined for server-based client asset management may occur in the client D (150), such as when an information transmission request is received from the asset management server 140 or an information reporting cycle arrives.

In this case, client D (150) may generate and transmit a data packet to be transmitted to the asset management server (140).

At this time, in the case of a data packet generated by client D (150), the IP address and port number of the asset management server (140) included in the destination IP and port (e.g., 10.2.1.39: 443) will be changed to the first network address and incoming port number of client A (150) (e.g., 192.168.0.1:36500) and then transmitted.

To be more specific, the data packet transmitted from the remaining clients (e.g., client D (150)) to the asset management server (140) is a specific client (e.g., changed according to the previously set address change settings) as the destination IP and port. It will include the closed network address of client A (150) and the incoming port number (e.g. 36500).

In particular, the data packet transmitted from the remaining clients (e.g., client D (150)) to the asset management server 140 may include the client (e.g., client D (150))'s own unique value within the data (payload). there is.

This is used to distinguish which client in the closed network transmitted the data packet when the asset management server 140 receives a data packet from the first network, that is, a closed network.

In the present invention, a MAC (Media Access Control Address) address can be used as this unique value.

Of course, in the present invention, it would be possible to utilize various types of information other than the MAC address as a unique value, as long as it is unique information that can specify each of a plurality of clients connected to the first network, that is, a closed network.

However, in the following explanation, we will continue the explanation by mentioning an example of using the MAC address as a unique value.

Continuing the explanation again, the data packet generated and transmitted by client D (150) will be delivered to client A (150) through a closed network and received through an incoming port number (e.g., 36500).

In client A (150), data packets received through the incoming port number (e.g., 36500) can be classified as objects to be forwarded to the asset management server (140), according to the previously set port forwarding settings.

In addition, client A (150) uses the IP address and port number of the asset management server 140 as the destination IP and port according to the previously set port forwarding settings for the corresponding data packet classified as a delivery target. It can be transmitted to the management server 140.

In this way, the data packet generated and transmitted by the client D (150) may be delivered to the asset management server 140 of the open network through the client A (150) of the closed network.

Meanwhile, Client A (150), which acts as a specific client, can also generate and transmit data packets for transmission to the asset management server (140) when various data transmission events predefined for server-based client asset management occur. there is.

At this time, since client A (150) is also connected to the open network, it can directly transmit the generated data packet to the asset management server (140) through the open network.

The asset management unit 140, in the asset management server, is responsible for managing each client asset of the first network based on the data packets of the remaining clients transmitted through the specific client.

To be more specific, as mentioned above, the asset management unit 140 may be implemented in the management asset server 140.

Accordingly, referring to the management asset server 140, the asset management server 140 can manage each client asset in a closed network based on a data packet transmitted from a specific client, for example, client A (150).

As described above, in the case of the present invention, a structure is proposed in which the data packets of each client are delivered to the asset management server 140 through one of the clients (specific client) belonging to the closed network, so from the perspective of the asset management server 140 In , all connections from clients belonging to a closed network appear as one IP (a specific client).

Accordingly, in the present invention, client assets belonging to a closed network must be able to be distinguished through unique information of each client asset.

To this end, as described above, the closed network data packet transmitted to the asset management server 140 through a specific client, that is, client A (150), includes the transmitting entity (e.g., the remaining clients B, C) that transmitted the data packet. ,D,...H)'s unique values (e.g. MAC address) are included.

Accordingly, the asset management server 140 can distinguish data packets transmitted from a specific client, that is, client A (150), for each remaining client of the closed network according to a unique value (e.g., MAC address) included in the data packet. .

That is, the asset management server 140 uses the unique value (e.g., MAC address) in the received data packet to connect the data packet delivered from client A 150 to the remaining clients B, C, and D of the closed network. Among ..H, you can distinguish which client it was transmitted from.

Of course, since the asset management server 140 is connected to client A (150) through an open network, it will be able to distinguish between data packets generated and transmitted by client A (150).

Accordingly, the asset management server 140 can manage each client asset of the closed network based on data packets classified for each client A, B, C,...,H.

Meanwhile, the scenario in which data packets are delivered from the asset management server 140 to each client A, B, C,..., H in the closed network is through the port proxy program of the operating system (e.g., netsh for Windows, and netsh for Linux). This can be performed through the relay function by iptables).

As described above, in the present invention, the data packets of each client in the closed network are stored in a distinguishable form through one of the clients (specific client) belonging to a network with limited external connectivity (hereinafter referred to as a closed network). It presents a structure and specific technical configuration that allows it to be transmitted to an external asset management server.

Because of this, according to the present invention, it is possible to realize a new type of asset management technology that enables server-based client asset management for clients belonging to a closed network without building additional equipment.

Accordingly, according to the present invention, server-based client asset management becomes possible without building additional equipment for a closed network, regardless of the burden of changing the network environment and configuration, the problem of increased costs, or the environment in which it is difficult to build additional equipment. This has the effect of transparently managing client assets belonging to a closed network.

With reference to Figures 3 and 4, the operational flow of the client asset management method according to an embodiment of the present invention will be described in detail.

With reference to FIG. 3, the preparation process for the asset management technology proposed in the present invention will be described.

First, a component within the client asset management system 100 of the present invention is sent to a terminal (e.g., PC, equipment/facility, etc.) corresponding to each asset configured in a first network (hereinafter referred to as a closed network) with limited connection to the outside. Install the asset management function (150) (S10).

In this case, as shown in FIG. 2, a client of the asset management function 150 for server-based asset management is installed in the terminal (e.g., PC, equipment/facility, etc.) corresponding to each asset constituting the OT environment. Can be installed/operated.

In the following description, it will be assumed and explained that the asset management function 150 and the client 150, which are components of the present invention, are the same.

Meanwhile, the asset management unit 140, which is a component of the client asset management system 100 of the present invention, is implemented in an asset management server existing in a second network (hereinafter referred to as an open network) where connection to the outside is not restricted.

In the following description, it will be assumed and explained that the asset management unit 140 and the management asset server 140, which are components of the present invention, are the same.

According to the client asset management method of the present invention, among the multiple clients connected to the closed network, a specific client that can also connect to the open network is identified (S20).

Accordingly, a client (e.g., client A) selected as a specific client among multiple clients may recognize/confirm that the client to which it belongs (e.g., client A) takes on the role of the specific client (S20).

And, among the multiple clients, the remaining clients (e.g., clients B, C, D,..., H) that have not been selected as specific clients are connected to a specific client (e.g., client A) through closed network-based communication. You can recognize/check whether it is playing a role (S20).

According to the client asset management method of the present invention, a specific client, that is, client A (150), can set port forwarding for data packet transfer between the asset management server 140 connected to an open network and a closed network (S30). .

Specifically, client A (150) can set an incoming port number to distinguish data packets to be delivered among data packets received in a closed network.

For example, client A (150) can set any port number among the available port numbers assigned to the closed network as the incoming port number, and in the following embodiment, "36500" is set as the incoming port number. Let's assume that

And, client A (150) can be set to use the IP address and port number of the asset management server 140 as the destination IP and port in the data packet received through the previously set incoming port number.

Meanwhile, according to the client asset management method of the present invention, each of the remaining clients B, C, D,...H (150), except for a specific client among the plurality of clients, has a data packet transmitted to the asset management server (140). The address change can be set to be delivered through a specific client, that is, client A (150) (S40).

Specifically, each of the remaining clients B, C, D,...H (150) enters the destination IP and port in the data packet transmitted to the asset management server (140) and the closed network of client A (150). You can perform address change settings to change the address (e.g., 192.168.0.1) and the aforementioned incoming port number (e.g., 36500).

Below, with reference to FIG. 4, the process by which a data packet transmitted by a client of a closed network is delivered to an asset management server of an open network by the asset management technology proposed in the present invention will be described.

For convenience of explanation, client D (150) among the remaining clients B, C, D,...H will be mentioned as an example.

In the client D (150), various predefined data transmission events may occur for server-based client asset management, such as when an information transmission request is received from the asset management server 140 or an information reporting cycle arrives.

Accordingly, according to the client asset management method of the present invention, client D (150) can generate and transmit a data packet for transmission to the asset management server (140) when a data transmission event occurs (S100).

In particular, the data packet transmitted from the client D (150) to the asset management server 140 may include the client's (e.g., client D (150)) own unique value (e.g., MAC address) within the data (payload). there is.

Accordingly, the data packet generated and transmitted by client D (150) will be delivered to client A (150) through a closed network and received through an incoming port number (e.g., 36500) (S110).

According to the client asset management method of the present invention, in client A (150), according to the previously set port forwarding settings, the data packet received through the incoming port number (e.g., 36500) is forwarded to the asset management server (140). Can be distinguished (S120).

And, according to the client asset management method of the present invention, in the client A (150), for the data packets classified as delivery targets, the asset management server (140) is sent to the destination IP and port according to the previously set port forwarding settings. It can be transmitted to the asset management server 140 using the IP address and port number (S130).

In this way, the data packet generated and transmitted by client D (150) may be delivered to the asset management server 140 of the open network through client A (150) of the closed network (S140).

Accordingly, according to the client asset management method of the present invention, the asset management server 140 delivers/receives all data packets from the closed network from client A (150).

According to the client asset management method of the present invention, the asset management server 140 divides data packets transmitted from client A 150 into each remaining client of the closed network according to a unique value (e.g. MAC address) within the data packet. Can be distinguished (S150).

That is, the asset management server 140 uses the unique value (e.g., MAC address) in the received data packet to determine which client (e.g., client D) the data packet delivered from client A (150) was transmitted from. Can be distinguished (S150).

Of course, since the asset management server 140 is connected to client A (150) through an open network, client A (150) will be able to distinguish the data packets generated and transmitted by client A (150).

As described above, in the present invention, the structure and specific technology allow data packets of each client belonging to a network with limited external connectivity (hereinafter referred to as a closed network) to be delivered to an asset management server outside the closed network in a distinguishable form. By presenting the configuration, we are realizing a new type of asset management technology that enables server-based client asset management for clients belonging to a closed network.

The client asset management method according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc., singly or in combination. Program instructions recorded on the medium may be specially designed and constructed for the present invention or may be known and usable by those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -Includes optical media (magneto-optical media) and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include machine language code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. The hardware device may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with specific details such as specific components and limited embodiments and drawings, but this is only provided to aid understanding of the present invention, and the present invention is not limited to the above embodiments. Various modifications and variations can be made from this description by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be limited to the described embodiments, and the scope of the patent claims described later as well as all modifications equivalent to or equivalent to the scope of the claims will be considered to fall within the scope of the spirit of the present invention.

Claims

A confirmation step of identifying a specific client that can also connect to a second network outside the first network among a plurality of clients connected to a first network with limited connectivity to the outside of the network;

A port forwarding setting step of configuring port forwarding for data packet transfer between the asset management server connected to the second network and the first network in the specific client;

An address change setting step of setting an address change in clients other than the specific client among the plurality of clients so that a data packet transmitted to the asset management server is transmitted through the specific client; and

A client asset management method comprising an asset management step of managing, in the asset management server, each client asset of the first network based on a data packet transmitted from the specific client.
According to claim 1,

The port forwarding setting step is,

Setting an incoming port number to distinguish data packets to be delivered among data packets received from the first network,

A client asset management method, characterized in that setting the IP address and port number of the asset management server to be used as the destination IP and port in the data packet received through the set incoming port number.
According to claim 2,

The address change setting step is,

A client asset management method, characterized in that setting the destination IP and port in the data packet transmitted to the asset management server to be changed to the first network address and the incoming port number of the specific client.
According to claim 1,

The data packets of the remaining clients transmitted from the specific client to the asset management server are,

A client asset management method comprising a unique value that specifies the remaining clients among the plurality of clients connected to the first network.
According to claim 4,

The asset management step is,

Classifying data packets transmitted from the specific client for each client of the first network according to a unique value included in the data packet,

A client asset management method, characterized in that managing each client asset of the first network based on data packets classified for each client.
a confirmation unit that identifies a specific client that can also connect to a second network outside the first network, among a plurality of clients connected to a first network with limited connectivity to the outside of the network;

a port forwarding setting unit that sets port forwarding for data packet transfer between the asset management server connected to the second network and the first network in the specific client;

An address change setting unit that sets an address change so that a data packet transmitted to the asset management server is transmitted through the specific client in the clients other than the specific client among the plurality of clients; and

In the asset management server, a client asset management system comprising an asset management unit that manages each client asset of the first network based on data packets of the remaining clients transmitted through the specific client.
According to claim 6,

The port forwarding setting unit,

Setting an incoming port number to distinguish data packets to be delivered among data packets received from the first network,

A client asset management system, characterized in that setting the IP address and port number of the asset management server to be used as the destination IP and port in the data packet received through the set incoming port number.
According to claim 7,

The address change setting unit,

A client asset management system, characterized in that setting the destination IP and port in the data packet transmitted to the asset management server to be changed to the first network address and the incoming port number of the specific client.
According to claim 6,

The data packets of the remaining clients transmitted from the specific client to the asset management server are,

A client asset management system comprising a unique value that specifies the remaining clients among the plurality of clients connected to the first network.
According to clause 9,

The asset management department,

Classifying data packets transmitted from the specific client for each client of the first network according to a unique value included in the data packet,

A client asset management system, characterized in that it manages each client asset of the first network based on data packets classified for each client.
A confirmation step of identifying a specific client that is capable of connecting to a second network outside the first network among a plurality of clients connected to a first network that is coupled with hardware and has limited connectivity to the outside of the network;

A port forwarding setting step of configuring port forwarding for data packet transfer between the asset management server connected to the second network and the first network in the specific client;

An address change setting step of setting an address change in clients other than the specific client among the plurality of clients so that a data packet transmitted to the asset management server is transmitted through the specific client; and

A computer program stored in a medium for executing, in the asset management server, an asset management step of managing each client asset of the first network based on a data packet transmitted from the specific client.