JP2000151693A - System control system and method by way of firewall - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a system that controls a system by way of a firewall. SOLUTION: A client terminal 1a (1b, 1c,...) has a request generating section 15a (15b, 15c,...) that generates a request file denoting a processing request to a host server 5a (5b, 5c,...), a transmission section 17a (17b, 17c,...) that transmits its request file to an FTP server 13, and a file acquisition section 19a (19b, 19c,...) that acquires a file registered on the FTP path of the FTP server 13 by using a communication protocol passing through the firewall, with leadership. The host server 5a (5b, 5c,...) has a request acquisition section 21a (21b, 21c,...) that acquires a request file registered on the FTP path of the FTP server 13, an information processing section 23a (23b, 23c,...)that conducts processing denoted by the acquired request file and generates a processing result file relating to the processing result, and a file presentation section 25a (25b, 25c,...) that transmits the generated processing result file to the FTP server 13.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a technique for controlling a remote host through a firewall provided between computer networks.

[0002]

2. Description of the Related Art A firewall (hereinafter referred to as F) is provided between a LAN (local area network) or the like and the Internet.
W). This FW separates the LAN and the Internet at the IP (Internet Protocol) level.

[0003]

Normally, the FW sends and receives SMTP to the top mail server, and from the LAN side (hereinafter, inside the FW) via the proxy server to the Internet side (hereinafter, outside the FW). In most cases, only HTTP and FTP are permitted, and the passage of telnet for the purpose of logging in to a remote host or the like is not normally permitted. Therefore, the terminal included in the FW passes through the FW and the WWW outside the FW
There is a problem that start and stop of services such as a server cannot be remotely controlled. In addition, even if the FW allows the passage of telnet and passes, WindowsN of the currently popular OS
Since T does not have the telnet function, terminals in the FW
Unless a trust relationship is established with a server outside W, there is a disadvantage that the server cannot be controlled.

[0004] Therefore, an object of the present invention is to use a communication protocol that is permitted to pass through a FW, and from the inside of the FW to the WW outside the FW.
It is an object of the present invention to provide a system control method capable of controlling a remote host such as a W server.

[0005]

According to the system control method of the present invention, an internal system is provided inside a firewall, and an external system is provided outside the firewall with the internal system separated by a firewall. The internal system includes a request creating unit that creates request information indicating a processing request to the external system, a request sending unit that sends the request information to the external system using a communication protocol that can pass through a firewall, and a request sending unit that sends the request information to the external system. A processing result acquisition unit for initiatively acquiring processing result information relating to the result of the processing executed in response to the information request from an external system. The external system includes: a request acquisition unit that acquires request information from the internal system; an information processing unit that executes a process requested by the request information and creates processing result information related to the processing result; A processing result registration unit that registers the processing result information created by the unit at a predetermined location in the external system.

In a preferred embodiment, the external system generates a request information acquisition notification indicating that the request information has been received from the internal system and a processing completion notification indicating that the processing indicated by the request information has been completed. A portion. Then, the processing result registration unit of the external system registers the request information acquisition notification and the processing completion notification at the predetermined location, and the processing result acquisition unit of the internal system transmits the request information acquisition notification and the processing completion notification from the predetermined location of the external system. Get completion notification initiative.

In a preferred embodiment, the communication protocol that can pass through the firewall is FTP, and the request creation unit of the internal system writes the request information to the file name of the file communicated by FTP.

In a preferred embodiment, the communication protocol that can pass through the firewall is HTTP, and the request creation unit
Writes request information to the destination URL of the hypertext file communicated by HTTP.

In a preferred embodiment, the internal system in the firewall comprises an internal e-mail server, and the external system outside the firewall, which is separated from the internal system by a firewall, comprises an external e-mail server. The internal system includes: a request creating unit that creates a request mail indicating a processing request to the external system; a request sending unit that sends a request email addressed to the external system to the internal email server; And a processing result receiving unit that receives a processing result mail relating to the result of the processing executed by the internal mail server from the internal mail server. The external system includes a request receiving unit that receives a request mail from the internal system, an information processing unit that executes a process requested by the request mail, and creates a processing result mail related to the processing result, and an internal system. A processing result transmitting unit for transmitting the processing result mail addressed to the external e-mail server.

[0010] In a preferred embodiment, the request creating section of the internal system writes the contents of the processing request in the subject field of the request mail.

[0011]

FIG. 1 shows an overall configuration diagram of a system control system according to an embodiment of the present invention. The communication protocol that passes through the FW (firewall) 9 is FTP (File
Transfer Protocol), HTTP (Hyper Text Transfer)
Protocol) and SMTP (Simple MailTransfer Prot)
ocol) and the like, but in the present embodiment, description will be first made using FTP.

A plurality of client terminals 1a, 1b, 1c
There is a LAN (Local Area Network) 3 including ... and an Internet 7 including various host servers 5a, 5b, 5c ... such as WWW servers, and a FW (Firewall) separating the LAN 3 and the Internet 7 from each other. 9 are installed. Hereinafter, the LAN 3 side of the FW 9 is referred to as “inside the FW”, and the Internet 7 side of the FW 9 is referred to as “outside the FW”. A proxy server 11 is arranged inside the FW, and an FTP server 13 is arranged outside the FW.

The client terminals 1a, 1b, 1c,.
, Which create request files indicating processing requests to the host servers 5a, 5b, 5c,... Outside the FW, and the request files via the proxy server 11 using FTP. FTP server 13
, And a file acquisition unit 19a that proactively acquires a file registered on the FTP path of the FTP server 13 via the proxy server 11 as needed or periodically. , 19b, 19c ...
And

The proxy server 11 receives request files from the client terminals 1a, 1b, 1c,... And provides the files to the FTP server 13 using FTP,
Acquire a file from the FTP path of the FTP server 13 in response to a request from the client terminals 1a, 1b, 1c,... And provide the file to the client terminals 1a, 1b, 1c,.

In the case of FTP, when a file is sent from the proxy server 11 in the FW to outside the FW,
FW from outside of FW by request from proxy server 11 in FW
Only when the file is sent into the FW 9, the FW 9 permits the passage of the file. Therefore, the client terminals 1a, 1b,
When transmitting and receiving files between the FTP server 13 and 1c..., The files must pass through the proxy server 11 without fail.

The FTP server 13 outside the FW receives the request file from the proxy server 11 inside the FW, and transfers it to its own.
It receives a file of the processing result from the host server 5a, 5b, 5c,... Which executes the requested processing, and registers it on its own FTP path.

Each of the host servers 5a, 5b, 5c,... Outside the FW periodically obtains a request file registered on the FTP path of the FTP server 13, and executes a process requested by the obtained request file. Request acquisition units 21a and 21 that issue
, b, 21c,..., and an information processing section 23a, 23b, 23c,.
File providing units 25a, 25b, 25c for sending the processing result files created by 23b, 23c.
... Further, each of the host servers 5a, 5b, 5c... Sends a processing execution file indicating that the information processing units 23a, 23b, 23c. Notification creation units 27a, 2 that create a processing completion file indicating that
7b, 27c... The created processing in-progress file and the processing completion file are stored in the file providing unit 25.
are sent to the FTP server 13 by a, 25b, 25c,.

Next, referring to FIG.
The process flow for establishing a connection between the FTP server 5a, 5b, 5c,... and the FTP server 5a, 5b, 5c.

For example, the client terminal 1a (IP address: 1.1.1.10) is substituted by the proxy server 11 (IP address: 1.1.1.15) and passes through the FW 9 to the FTP server 13 (IP address: 1.1.1.10). : 10.10.10.10) to the FTP control port (port number: 21) using FTP, and the FTP server 13 receives the packet 29. Next, the FTP server 13 sends the packet 2
The packet 29 is transmitted to the data transfer port (assumed to be port number 2000) of the client terminal 1a designated by 9. When the client terminal 1a receives the packet 29, a connection between the client terminal 1a and the FTP server 13 is established. After this connection is established, the request file from the client terminal 1a is:
The data is transmitted to the control port of the FTP server 13 and registered on the FTP path of the FTP server 13. Further, a processing result file, a processing completion file, and the like corresponding to the request file are obtained from the FTP path of the FTP server 13 using the data transfer port of the client terminal 1a. In addition,
In this case, since FTP is activated in the passive mode and the data transfer port is established by the client terminal 1a, no session request is generated from outside the FW 9.

The operation of this method will be described with reference to FIG. It should be noted that the proxy server 11 is merely provided for convenience of transmission and reception of packets between the client terminals 1a, 1b, 1c.
Since the operation other than the operation described in FIG. 2 is not performed, it is not illustrated here.

The user is, for example, a client terminal 1a
Is used to input a request for a specific process to the host server 5a, for example. The request creating unit 15a of the client terminal 1a creates a request file indicating the input request. The request file has only a file name but no content, and the processing content requested by the user is written in the file name. Since there is no content in the request file, the capacity of the request file is naturally 0 bytes. Also,
The recipient of the request file does not need to obtain a file handle to recognize the request. Request transmission unit 17a
Sends the request file to the FTP server 13 (S
1). The FTP server 13 receives the request file and registers it on its own FTP path.

On the other hand, the request acquisition unit 21 of the host server 5a
a periodically accesses the FTP path of the FTP server 13 to check for the presence or absence of the requested file on the FTP path (S2), and obtains the requested file, if any (S2).
3). Next, the request acquisition unit 21a activates the information processing unit 23a that executes the process written in the file name of the acquired request file (S4). For example, if the processing is the acquisition of a log, the log collection process is started as the information processing unit 23a. Subsequently, the request acquisition unit 2
1a deletes the request file from the FTP path of the FTP server 13 (S5). The activated information processing unit 23a
Executes the requested processing and creates a processing result file indicating the result. For example, when a log collection process is started, this process collects logs from the host server 5a and creates a log file as a processing result file. With the start of this processing, the notification creating unit 27a
Creates a processing-in-progress file indicating that the information processing unit 25a is processing, and the file providing unit 25a transmits the processing-in-progress file to the FTP server 13 (S
6). The file being executed is similar to the above-mentioned request file, but has only a file name and has no content. The file name includes the processing content requested by the client terminal 1a and the effect that the processing is being executed. Has been written. Also, the capacity of the file being processed is of course 0 bytes. The FTP server 13 registers the processing-in-progress file received from the file providing unit 25a on its own FTP path.

The file acquisition unit 19a of the client terminal 1a accesses the FTP server 13 periodically to
The presence or absence of a file on the TP path is confirmed, and if there is a file related to itself (for example, the above-described processing-executing file), it is acquired (S7). File acquisition unit 19a
Determines that an error has occurred such as the requested file not reaching the host server 5a if the file being processed cannot be obtained for a certain period of time after issuing the requested file. Then (S
8) Notify the user to that effect or, again, send the same request file as the specific request file to the FTP server 1
Send to 3. When the file acquiring unit 19a acquires the file being processed, the file acquiring unit 19a deletes the file being processed from the FTP path of the FTP server 13 (S9).

When the information processing section 23a of the host server 5a completes the processing and creates a processing result file, the file providing section 25a transmits the processing result file to the FTP server 13. When the transmission is completed, the notification creation unit 2
7a creates a processing completion file indicating that the processing requested by the user is completed, and the file providing unit 25a transmits the processing completion file to the FTP server 13 (S1).
1). This processing completion file has a file name only and has no content, similarly to the above-mentioned request file. The file name contains the processing content requested by the client terminal 1a and the fact that the processing has been completed. I have. Also, the capacity of the processing completion file is naturally 0 byte. The FTP server 13 registers the received processing result file and the transmission completion file on its own FTP path.

File acquisition unit 1 of client terminal 1a
9a, as described above, periodically checks whether there is a file related to itself on the FTP path of the FTP server 13 (S7). As a result, if there is a processing completion file (S12), the processing ends. It is determined that the processing has been completed, and a processing result file corresponding to the processing completion file is obtained (S
13) Achieve the intended purpose. Thereafter, the file acquisition unit 19a deletes the acquired processing result file and the processing completion file from the FTP path of the FTP server 13 (S14).

In this system control method, HTTP may be used instead of FTP used in the above description. In this case, an HTTP server that exchanges a request file, a processing result file, and the like with the client terminal is installed outside the FW, similarly to the above-described FTP server. In this case, various messages indicating the contents of the processing request, the fact that the processing is being executed, and the fact that the processing has been completed are written in the URL at the time of transmission of the request file, the processing execution file, and the processing completion file. As a result, the capacity of these files also becomes 0 bytes. Each machine constituting the system using HTTP performs the same operation as the system using FTP described above.

Next, an embodiment of a system control system using SMTP will be described with reference to FIG. SMTP is a communication protocol that is allowed to pass through the FW in both directions.

There is an internal mail server 31 in the FW, and this internal mail server 31 handles mails of a plurality of client terminals 1a, 1b, 1c... In the FW. Also, FW
There is an external mail server 33 outside, and the external mail server 33 handles mail from various host servers 5a, 5b, 5c such as a WWW server on the Internet 7.

Each of the client terminals 1a, 1b, 1c,... Has a request creating section 35a, 35 for creating a request mail indicating a processing request addressed to the host server 5a, 5b, 5c,.
b, 35c... and the request mail to the internal mail server 3.
Request transmission units 37a, 37b, 37c,...
Have a mail receiving unit 39a, 39b, 39c,... Which receives mail addressed to itself transmitted from the host servers 5a, 5b, 5c,. Request creator 3
5a, 35b, 35c... Do not write anything in the e-mail body column of the request mail, write the processing request content in the subject column, and in the destination column of the request mail, the host server 5a, 5b as the destination of the request , 5c ... are written. Since nothing is described in the mail body column, the capacity of the body of this mail is 0 bytes.

The internal mail server 31 and the external mail server 33 receive mail from the client terminals 1a, 1b, 1c... Or the host servers 5a, 5b, 5c.

The proxy server 11 receives the request mail from the internal mail server 31 and
3 or receives an e-mail addressed to the FW from the external mail server 33 and transmits it to the internal mail server 31. In other words, when sending and receiving mail between the internal mail server 31 and the external mail server 33, the mail always passes through the proxy server 11.

Each of the host servers 5a, 5b, 5c ...
The request receiving units 41a, 41b, 41c,... Which receive a request mail addressed to themselves from the external mail server 33 and issue an execution instruction of the processing indicated by the received request mail, perform the processing indicated by the request mail according to the instruction, and perform the processing. Information processing units 43a, 43b, 4 for writing the result of
, And the mail transmission units 45a, 45 that transmit the processing result mail to the external mail server 33 with any of the client terminals 1a, 1b, 1c,.
b, 45c... In addition, the host servers 5a, 5
Each of the information processing units 43a, 43b, 43c
.. Are executing a requested process, and a notification creating unit 47a that creates a process completion file indicating that the information processing units 43a, 43b, 43c,... Have completed the requested process. , 47b, 47c... In the processing-in-progress mail and the processing-completed mail, the contents of the requested processing, the fact that the processing is being performed, and the fact that the processing is completed are described in the subject column of the mail, and the mail text is blank. The processing-in-progress mail and the processing-completed mail are also transmitted to the mail transmitting units 45a, 45b, 45c,.
Thus, the request is sent to the external mail server 33 with the client terminal as the destination.

The operation of this system will be described below.

For example, the client terminal 1a creates a request mail requesting the host server 5a to perform a specific process (for example, obtaining a log) and sends the request mail to the internal mail server 31 as the host server 5a. Next, the internal mail server 31 transmits the received request mail to the proxy server 1
The data is transmitted to the external mail server 33 through the firewall 9 by proxy 1. The external mail server 33
The received request mail is transmitted to the destination host server 5a.

The mail receiving section 41a of the host server 5a
Receives the request mail, recognizes the process written in the subject column of the received request mail, and activates the information processing unit 43a that executes the process. Information processing unit 4 started
3a starts the requested processing. When this process is started, the notification mail creation unit 47a creates a process execution mail and transmits it to the external mail server 33 with the requesting client terminal 1a as the destination. If the client terminal 1a does not seem to be able to obtain the processing in-progress mail for a certain period of time after issuing the request mail, an error such as the request mail has not reached the host server 5a has occurred. Then, the user is notified of this fact, or the same request mail as the specific request mail is transmitted to the internal mail server 31 again addressed to the host server 5a.

When the requested processing is completed, the information processing section 47a writes the result in the text of the processing result mail,
The destination is sent to the external mail server 33 as the client terminal 1a. The external mail server 33 transmits the processing result mail to the internal mail server 31. The internal mail server 31 transmits the received processing result mail to the client terminal 1a, and the client terminal 1a receives the processing result mail to achieve the intended purpose.

When a LAN having an e-mail function is introduced, one top mail server that centrally manages the transmission and reception of mail with a mail server outside the FW and each department in the company are assigned. In many cases, a plurality of sub-mail servers are provided. Therefore, in that case,
The client terminals 1a, 1b, 1c ... and the host server 5
a, 5b, 5c ... for sending and receiving mail
Within, it goes through multiple mail servers.

Although the preferred embodiment of the present invention has been described above, the above-described embodiment is an exemplification for describing the present invention, and is not intended to limit the scope of the present invention only to this embodiment. Without departing from the spirit of the invention, those skilled in the art
The present invention can be implemented in various other forms in which various modifications, improvements, modifications, simplifications, and the like are added to the above-described embodiment.

[Brief description of the drawings]

FIG. 1 is an overall configuration diagram of a system using FTP according to an embodiment of a system control method of the present invention.

FIG. 2 is a diagram showing an operation of establishing a connection between a client terminal and an FTP server.

FIG. 3 is a view for explaining the operation of a system using FTP according to an embodiment of the system control method of the present invention.

FIG. 4 is an overall configuration diagram of a system using SMTP according to an embodiment of the system control method of the present invention.

[Description of Signs] 1 Client terminal 3 Local area network (LAN) 5 Host server 7 Internet 9 Firewall (FW) 11 Proxy server 13 FTP server 15 Request creation unit 17 Request transmission unit 19 File acquisition unit 21 Request acquisition unit 23 Information processing Unit 25 file providing unit 27 notification creating unit 29 packet 31 internal mail server 33 external mail server 35 request creating unit 37 request sending unit 39 mail receiving unit 41 request receiving unit 43 information processing unit 45 mail sending unit 47 notification creating unit

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) H04L 12/54 12/58 (72) Inventor Akihiro Fukuda 3-3-3 Toyosu, Koto-ku, Tokyo Stock Association F-term in NTT DATA (reference)

Claims (12)

[Claims] 1. A method in which an internal system arranged inside a firewall controls an external system arranged outside a firewall across a firewall, wherein the internal system indicates a processing request to the external system. A request creating unit that creates information, a request sending unit that sends the request information to the external system using a communication protocol that can pass through the firewall, and the external system executes the request information in response to the request for the request information. A processing result acquisition unit for initiatively acquiring processing result information relating to a result of the processing from the external system using the communication protocol, wherein the external system acquires the request information from the internal system A request acquisition unit that performs a process requested by the request information, The processing result and an information processing unit for creating information, the processing result information which the information processing unit is created, the system control method and a processing result registration unit for registering in place of the external system. 2. A notification creation that creates a request information acquisition notification indicating that the external system has obtained the request information from the internal system, and a processing completion notification indicating that the processing indicated by the request information has been completed. The processing result registration unit of the external system further registers the request information acquisition notification and the processing completion notification at the predetermined location, and the processing result acquisition unit of the internal system, from the predetermined location 2. The system control method according to claim 1, wherein the request information acquisition notification and the processing completion notification are proactively acquired using the communication protocol. 3. The system control method according to claim 1, wherein the communication protocol is FTP, and the request creation unit of the internal system writes the request information to a file name of a file communicated by the FTP. 4. The system control method according to claim 1, wherein the communication protocol is HTTP, and the request creating unit writes the request information to a destination URL of a hypertext file communicated by the HTTP. 5. A method in which an internal system disposed in a firewall controls an external system disposed outside a firewall separated by the firewall, wherein the internal system has an internal e-mail server, An external system having an external e-mail server, wherein the internal system generates a request e-mail indicating a processing request for the external system, and a request e-mail addressed to the external system, the internal e-mail server And a processing result receiving unit that receives, from the internal mail server, a processing result e-mail related to a result of the processing executed by the external system in response to the request for the request e-mail. A request receiving unit that receives the request email from the external email server; An information processing unit that executes the processing requested by the request mail and creates the processing result mail related to the processing result, and transmits the processing result mail addressed to the internal system to the external e-mail server A system control method having a result transmitting unit. 6. The request creating unit writes the contents of the processing request in a subject field of the request mail.
The described system control method. 7. An internal system which is disposed in a firewall and controls an external system disposed outside the firewall with a firewall interposed therebetween, wherein a request creating unit which creates request information indicating a processing request for the external system; A request transmitting unit that transmits the request information to the external system using a communication protocol that can pass through the outside of the firewall; and a processing result related to a result of a process performed by the request of the request information by the external system. An internal system comprising: a processing result acquisition unit for initiatively acquiring information from the external system using the communication protocol. 8. An external system comprising: a system in which an internal system disposed inside a firewall controls an external system disposed outside a firewall separated by a firewall. A request acquisition unit that acquires request information indicating a processing request, an information processing unit that executes processing requested by the request information, and creates processing result information related to the processing result, and the information processing unit An external system comprising: a processing result registration unit that registers processing result information in a predetermined location of the external system. 9. An internal system which is disposed in a firewall and controls an external system disposed outside the firewall with a firewall interposed between the external system and an external e-mail server in the external system.
An internal e-mail server for exchanging e-mails, a request creation unit for creating a request e-mail indicating a processing request for the external system, and a request transmission for transmitting the request e-mail addressed to the external system to the internal e-mail server An internal system, comprising: a processing result receiving unit configured to receive, from the internal mail server, a processing result mail related to a result of processing performed by the external system in response to the request for the request mail. 10. An external system in which an internal system disposed in a firewall controls an external system disposed outside a firewall across a firewall, wherein an internal e-mail server in the internal system is provided. Between
An external e-mail server that exchanges e-mails, a request receiving unit that receives a request e-mail indicating a processing request for the external system from the external e-mail server, and executes a process requested by the request e-mail. An external system comprising: an information processing unit that generates a processing result mail relating to a result; and a processing result transmitting unit that transmits the processing result mail addressed to the internal system to the external email server. 11. A process in which an internal system arranged in a firewall creates request information indicating a processing request for an external system arranged outside the firewall across a firewall, and Transmitting the request information to the external system by using a communication protocol capable of passing the request, and processing result information relating to a result of a process executed by the external system in response to the request for the request information. A computer-readable recording medium recording a program for causing a computer to execute an information processing method including a step of initiatively acquiring from a location using the communication protocol. 12. A process in which an internal system arranged inside a firewall creates a request mail indicating a processing request for an external system arranged outside a firewall separated by a firewall; and Transmitting the request mail addressed to the system to an internal e-mail server arranged in the firewall; and processing related to a result of a process executed by the internal system in response to the request for the request information by the external system. A computer-readable recording medium storing a program for causing a computer to execute an information processing method including a step of receiving a result mail from the internal mail server.