JP2011076504A - Virtual machine, program for ther same, system and method for providing application service - Google Patents

Abstract

An object of the present invention is to provide a virtual machine or the like capable of promoting the use of a cloud service while allowing an application provider to take security measures for confidential information within a company.
A virtual machine 13 _x, when via the Internet 2 accepts a request from the client terminal device 1 a to 1 c, based on the corporate confidential information including information of a user who uses the client terminal device 1 a to 1 c process Determine if necessary. If the virtual machine 13 _x determines that the process based on the confidential information in the company is necessary, the virtual machine 13 _x performs secure communication with the database server in the company connected to the corporate network, and the client is based on the confidential information in the company. Processing for requests from the terminal devices 1a to 1c is performed. On the other hand, if it is determined that the process based on the confidential information in the company is not necessary, the virtual machine 13 _x executes the process for the request from the client terminal device 1a to 1c.
[Selection] Figure 1

Description

  The present invention relates to a virtual machine that operates on a server connected via the Internet, a program for the virtual machine, an application service providing system including the virtual machine, and an application service providing method.

  Conventionally, computer resources such as server computers and databases have been owned by companies that use them. However, the hardware and applications are complex and expensive, and a specialized department that operates computer resources is also required.

  Therefore, a service form called cloud computing (hereinafter referred to as “cloud service”) has attracted attention as a form of using new computer resources based on the Internet. An example of such a cloud service is “Elastic Compute Cloud (EC2)” provided by Amazon.

  In the cloud service, the user does not need to hold or manage the computer resource, and can use the computer resource by paying the usage fee. On the other hand, on the cloud service provider side, virtual machines are arranged for each user on one or a plurality of servers, thereby improving server utilization efficiency and scalability. Therefore, the cloud service providing company can provide computer resources to the user at a relatively low cost (see, for example, Patent Document 1).

  In this way, because cloud users do not need to introduce computer resources, the introduction and operation costs are reduced, and the scalability is also excellent. It is expected to increase.

  In particular, it is expected that usage forms such as renting virtual machines from cloud service providers and providing applications to clients will increase.

  In other words, a company that intends to provide an application to a client via the Internet (hereinafter referred to as an “application provider”) rents a virtual machine as an application platform from a cloud service provider as a cloud service user, Run the application on this virtual machine. Since the application provider does not need to own and manage the application platform, the introduction cost and the operation cost are reduced, and the cost hurdle is lowered. Therefore, the application providing company can easily provide the application service to the client.

Japanese translation of PCT publication No. 2004-503011

  Data used in the application provided by the application provider includes important information such as confidential information within the application provider and personal information of the client (that is, the client of the application service provided by the application provider) "In-house confidential information").

  However, in the above cloud service, the application provider deposits data used in the provided application with the cloud service provider. In other words, the cloud service provider is to take security measures for data used in the provided application.

  However, when not only the virtual machine of the application provider but also the virtual machine of another user is placed on the same server, the data is stolen from other users due to hacking with a defect in the server program. There is a risk. Further, since the operation of the server is left to the cloud service provider, there is a risk that unauthorized copying from the inside of the cloud service provider will cause unauthorized copying or theft of the disk. As described above, when the confidential information in the company is deposited in the cloud service provider, there is a security problem that the confidential information in the company cannot be managed on the application provider side.

  In this way, the application providing company entrusts management of confidential information in the company such as client information to the cloud service providing company, and cannot manage information leakage. For this reason, there are many cases where he / she is anxious about depositing confidential company information at a cloud service provider and hesitates to use the cloud service. As described above, the cloud service has many advantages but is not sufficiently utilized.

  The present invention has been made in view of the above-described problems, and a virtual machine and a virtual machine that can promote the use of a cloud service while performing security measures for confidential information in the company on the application provider side. It is an object to provide a program, an application service providing system, and an application service providing method.

  In order to solve the above-mentioned object, the invention according to claim 1 is directed to a virtual machine that operates on a server connected to the Internet and processes a request from a client terminal device; A virtual machine in an application service providing system including an in-company database server that stores confidential information in a company including information about a user who uses the apparatus, and receives a request from a client terminal device via the Internet In response to a request from the client terminal device, a determination unit that determines whether or not processing based on the confidential information in the company is necessary, and processing based on the confidential information in the company is required by the determination unit. If it is determined that there is, it is connected to the corporate network and the company First communication means for performing secure communication with an in-company database server that performs processing for storing confidential information and processing the request based on the confidential information in the company; When it is determined that the process based on the information is not necessary, a second processing unit that executes a process for the request is provided.

  The invention according to claim 2 is the virtual machine according to claim 1, wherein the in-company database server stores user authentication information of the client terminal device, and the determination unit includes When the authentication information is acquired from the client terminal device, it is determined that a process based on the confidential information in the company is necessary, and the first processing means has the authentication information that matches the acquired authentication information in the in-company database. An inquiry is made to the in-company database server as to whether it is stored in the server, and authentication processing of the client terminal device is performed.

  The invention according to claim 3 is the virtual machine according to claim 1 or 2, wherein when the confidential information in the company is received from the client terminal device, the virtual machine is secure with the database server in the company. The third processing means for performing communication and storing the confidential information in the company in the in-company database server is provided.

  The invention according to claim 4 is the virtual machine according to any one of claims 1 to 3, wherein the first processing unit uses information acquired from the client terminal device as the confidential information within the company. And processing and transmission to the client terminal device.

  The invention according to claim 5 is a program of a virtual machine that operates on a server connected to the Internet, the receiving step receiving a request from a client terminal device via the Internet, and the client terminal device In response to the request, a determination step for determining whether or not a process based on in-company confidential information including user information of the client terminal device is necessary, and a process based on the in-company confidential information by the determination step is required. If it is determined, secure communication is performed with an in-company database server that is connected to the in-company network and stores the in-company confidential information, and the request is processed based on the in-company confidential information. A process based on the confidential information in the company is required by the first processing step and the determination step. Was assumed to be executed when it is determined to be not, a second processing step of executing processing for the request, the.

  According to a sixth aspect of the present invention, there is provided a virtual machine that operates on a server connected to the Internet and performs processing according to a request from a client terminal device, an in-company database server connected to an in-company network, In the application service providing system, the in-company database server stores in-company confidential information including user information of the client terminal device, in response to a request from the virtual machine, in the storage unit Storage processing means for searching, changing or deleting stored confidential information within the company, or adding the confidential information within the company to the storage means, and the virtual machine is connected to the client terminal device via the Internet. In response to a request from a reception means for receiving a request and the client terminal device, A determination unit that determines whether or not processing based on confidential information is necessary, and if the determination unit determines that processing based on the confidential information in the enterprise is necessary, secure communication with the in-company database server A first processing unit that performs a process for the request based on the in-company confidential information, and the determination unit determines that the process based on the in-company confidential information is not necessary. And a second processing means for executing the processing.

  The invention according to claim 7 is based on a virtual machine that operates on a server connected to the Internet and performs processing according to a request from a client terminal device, and an in-company database server connected to the in-company network. An application service providing method, wherein the virtual machine receives a request from a client terminal device via the Internet, and the virtual machine responds to a request from the client terminal device. A determination step for determining whether or not processing based on in-company confidential information including user information is necessary, and the virtual machine determines that processing based on the in-company confidential information is required in the determining step , Perform secure communication with the corporate database server, A request step for performing processing in response to a request from the client terminal device to the in-company database server, and the in-company database server stores the in-company confidential information in response to a request from the virtual machine The storage processing step of searching for, changing or deleting the confidential information in the company from the storage means performed, or adding the confidential information in the company to the storage means, and the virtual machine, to the confidential information in the company by the determination step If it is determined that the processing based on the request is not necessary, the processing step includes processing steps for performing processing according to the request from the client terminal device.

  According to the present invention, an application provider that is a user of a cloud service uses a virtual machine that operates on a server connected via the Internet to reduce the introduction cost and operation cost of a computer resource, It is possible to take security measures in-house without leaving the information including confidential information to the cloud service provider.

It is a figure which shows the structure of the application service provision system which concerns on one Embodiment of this invention. It is a figure which shows schematic operation | movement of an application service provision system. It is a figure which shows the structure of the client terminal device shown in FIG. It is a figure which shows the flow of a process of the client terminal device shown in FIG. It is a figure which shows the structure of the server system shown in FIG. It is a figure which shows the architecture on the blade server shown in FIG. FIG. 6 is a functional block diagram of the blade server shown in FIG. 5. It is a figure which shows the flow of a process of a virtual AP server. It is a functional block diagram of a DB server. It is a figure which shows the flow of a process of DB server. It is a figure which shows the flow of a registration process of the system of a web conference service. It is a figure which shows an example of the data structure of a 1st table. It is a figure which shows an example of the data structure of a 2nd table. It is a figure which shows an example of the data structure of a 3rd table. It is a figure which shows the flow of the participation preparation process of the system of a web conference service. It is a figure which shows the flow of the conference process of the system of a web conference service. It is a figure which shows the flow of a process of a client terminal device. It is a figure which shows the flow (the 1) of a process of a SIP server. It is a figure which shows the flow (the 2) of a process of a SIP server. It is a figure which shows the flow of a process of DB server.

[1. Overview of application service provision system]
The application service providing system of the present embodiment is an application service providing system in which an application providing company, which is a company that intends to provide an application to the client via the Internet, can provide the application service to the client using the cloud service. It is.

  As described above, in the application service provided by the application providing company using the cloud service, the client using the application service is not aware of the cloud service. The client receives an application service from the application provider in the same way as a normal application service. Examples of application services include a web conference service, a database service, an e-learning service, and an image distribution service described later.

  A cloud service provider, which is a company that provides a cloud service, rents a virtual machine serving as an application platform to the application provider. The application providing company executes an application program on the virtual machine and provides an application service to the client. Hereinafter, a client terminal device that receives application service from an application provider is referred to as a client terminal device.

  As shown in FIG. 1, a computer system 3 on the cloud service provider side includes a router 10 connected to the Internet 2 with a LAN input / output port and a server system 11 connected to the LAN 10 input / output port of the router 10. Have.

As will be described later, the server system 11 is composed of a plurality of blade servers connected to the Internet, and can operate a large number of virtual machines on these blade servers. Here, among a large number of virtual machines, an application provider executes an application program on a single virtual machine and provides an application service to a client. However, an application service using a plurality of virtual machines is used. Application services can also be provided. Hereinafter, the virtual machine that executes the application program in this way is referred to as a virtual AP server 13 _x . In the example shown in FIG. 1, and using the virtual machines running first on the blade server 12 ₁ as a virtual AP server 13 _x.

The application service of the application providing company, the client terminal device 1a, 1b, 1c, ... are user subscribes, each client terminal devices 1a, 1b, 1c, and access to virtual AP server 13 _x from ... application Receive application services from the provider. Note that, for convenience, the client terminal device 1 is referred to as any one of the client terminal devices 1a, 1b, 1c,...

The server system 11 is arranged in the network area for the cloud service in the corporate network of the cloud service provider. When a communication packet via the Internet is transmitted from the client terminal device 1 to the virtual AP server 13 _x operating on the server system 11, the router 10 transmits the communication packet from the client terminal device 1 to the virtual AP server 13 _x. Relay to. Communication packets from the virtual AP server 13 _x to the client terminal device 1 are also relayed to the client terminal device 1 by the router 10. The client terminal device 1 receives the application service by transmitting / receiving a communication packet corresponding to the service to be provided to / from the virtual AP server 13 _x .

  The computer system 4 of the application provider company includes a VPN router 20, a storage 21, a database server 22 that manages data in the storage 21, and a management terminal device 23 that manages the storage 21. The management terminal device 23 can add data to the storage 21 and update data through the database server 22. In the following, the database server is also referred to as a DB server.

The DB server 22 can be accessed from the virtual AP server 13 _x via the VPN router 20. Secure communication is established between the virtual AP server 13 _x and the network within the computer system 4 by VPN connection. That is, the virtual AP server 13 _x stores a VPN connection program, and performs VPN connection with the VPN router 20. A firewall in the VPN router 20 is set so that the DB server 22 can receive only communication packets that pass through the VPN router 20. Thus, only the virtual AP server 13 _x can access the DB server 22 via the Internet.

In the application service providing system according to the present embodiment, the virtual AP server 13 _x accessed from the client terminal device 1 communicates with the DB server 22 as necessary, and performs processing according to a request from the client terminal device 1. Like to do.

  Both the DB server 22 and the storage 21 are arranged in an in-company network of an application provider, and the storage 21 stores application information including company confidential information. The confidential corporate information includes important information such as personal information of the client and confidential information in the company of the application provider.

  As described above, in the application service providing system according to the present embodiment, the company confidential information can be managed in the in-company network of the application providing company, so that the application providing company does not leave the cloud service providing company. Confidential information can be managed.

  Accordingly, the application providing company can use the cloud service without worrying about the security measures of the cloud service providing company side by strictly performing in-house security management. Therefore, an application provider can operate an application service at a relatively low cost by using a cloud service as a part of computer resources while strictly performing security management.

  A schematic operation of the application service providing system configured as described above will be described with reference to FIG.

As shown in FIG. 2, first, the client that receives the application service performs a predetermined operation for receiving the application service using the client terminal device 1. Upon receiving this operation, the client terminal device 1 makes a request according to the operation to the virtual AP server 13 _x via the Internet 2 (step S11).

When the client terminal device 1 receives the request, the virtual AP server 13 _x determines whether it is necessary to communicate with the corporate database server (step S12). In the virtual AP server 13 _x , a DB server 22 connected to the corporate network of the application providing company is registered as the corporate database server, and the virtual AP server 13 _x needs to communicate with the DB server 22. It is determined whether or not there is. In the virtual AP server 13 _x , for example, when the request from the client terminal device 1 is a registration request or connection request to the application service and includes personal information such as a client password, ID, name, address, and occupation, It is determined that communication with the in-company database server is necessary. That is, the virtual AP server 13 _x determines that communication with the DB server 22 is necessary when it receives the confidential information within the company. On the other hand, when the virtual AP server 13 _x does not include the client personal information, the virtual AP server 13 _x determines that communication with the in-company database server is not necessary. Here, the registration request to the application service is a request made in advance by the client in order to use the application service using the client terminal device 1, and personal information such as a client password, ID, name, address, and occupation. Is a request for registering. The connection request to the application service is a request made when the client uses the application service by using the client terminal device 1 and includes a client password and ID. The virtual AP server 13 _x authenticates the client using the client password and ID (authentication information) included in the connection request. As described above, since the personal information of the client of the application providing company is held in the application providing company, it can be managed by the application providing company. Therefore, application providers can provide application services by using virtual machines to reduce the cost of introducing and operating computer resources while taking security measures for personal information of extremely important clients. Can do.

If it is determined in the process of step S12 that communication with the in-company database server is not necessary (step S12: NO), the virtual AP server 13 _x performs an internal process (step S13). As this internal processing, the virtual AP server 13 _x performs necessary processing in response to a request from the client terminal device 1.

On the other hand, if it is determined that it is necessary to communicate with the corporate database server (step S12: YES), the virtual AP server 13 _x is the DB server 22 transmits a request corresponding to the received request (step S14). At this time, since the communication path in the Internet among the communication paths between the virtual AP server 13 _x and the DB server 22 is VPN-connected, the virtual AP server 13 _x is secure with the DB server 22. Communication can be performed. Here, in order to perform secure communication between the virtual AP server 13 _x and the DB server 22, VPN connection is performed, but the HTTPS (Hypertext Transfer Protocol over Secure Socket Layer) protocol is used. Secure communication may be performed.

The DB server 22 receives a request transmitted from the virtual AP server 13 _x via the Internet 2 and performs processing based on this request (step S15). For example, when the received request is a request corresponding to a registration request to the application service, the DB server 22 stores personal information such as a client ID, password, address, and name included in the received request in the storage 21. And register the client's personal information. When the received request is a request corresponding to a connection request to the application service, the DB server 22 stores the personal information such as the client ID and password included in the received request in the storage 21. Is determined.

The DB server 22 transmits the result of the process performed in step S15 to the virtual AP server 13 _x via the Internet 2 (step S16). For example, in response to a request in response to a registration request to the application service, information indicating that registration of client personal information in the storage 21 is completed is transmitted to the virtual AP server 13 _x as a processing result. In response to a request corresponding to the connection request to the application service, if the client personal information is registered in the storage 21, information indicating authentication OK is transmitted to the virtual AP server 13 _x as a result of the processing. On the other hand, the personal information of the client is not registered in the storage 21, and transmits to the virtual AP server 13 _x the information indicating the authentication NG as the result of the processing.

The virtual AP server 13 _x receives the processing result transmitted from the DB server 22 via the Internet 2 (step S17).
Virtual AP server 13 _x as a result of internal processing performed in step S13, or the processing result received in step S17, and transmits to the client terminal device 1 (step S18).

The client terminal device 1 receives the result of the process transmitted from the virtual AP server 13 _x via the Internet 2 (step S19), and then performs a predetermined process based on the result (step S20).

[2. Specific configuration of each component]
Next, the configuration and operation of each element constituting the application service providing system will be described.

[2.1. Configuration and Operation of Client Terminal Device 1]
First, a specific configuration of the client terminal device 1 will be described. The client terminal device 1 can be a general personal computer in addition to a dedicated computer. The client terminal device 1 is owned by a user who is a user of the client terminal device 1, that is, a client. As shown in FIG. 3, the client terminal device 1 includes a control unit 41, a storage unit 42, a communication unit 43, an operation unit 44, an information acquisition unit 45, and a presentation unit 46. Are connected to each other via a system bus 47.

  The control unit 41 controls the entire client terminal device 1 and includes a CPU (Central Processing Unit), an internal memory, and the like. The storage unit 42 is a rewritable storage device having a storage area for storing various types of information, and is composed of, for example, a flash memory. The communication unit 43 is a communication interface for communicating with other devices via the Internet 2. The operation unit 44 is an operation unit for inputting various settings. The information acquisition unit 45 includes a camera and a microphone, outputs video information captured from the camera, and outputs audio information acquired from the microphone. The presentation unit 46 includes a liquid crystal display (LCD) and a speaker, and reproduces video information and audio information.

  The operation of the client terminal device 1 configured as described above will be described based on the flowchart of FIG. The processing in the client terminal device 1 is started and repeated when a power switch (not shown) is turned on in the client terminal device 1 or when a reset switch (not shown) is operated. At this time, the CPU of the control unit 41 puts the program stored in the internal memory into the execution state and puts the function as the control unit 41 into the operation state.

First, the control unit 41 determines whether or not a processing execution instruction has been received via the operation unit 44 (step S21). If it is determined that the execution instruction has not been received (step S21: NO), the control unit 41 repeats the determination in step S21 until the execution instruction is received. On the other hand, if it is determined that accepts execution instruction (step S21: YES), the control unit 41, a request based on the received instruction, and transmits the virtual AP server 13 _x (step S22). Thereafter, the control unit 41 receives a processing result for the request transmitted in step S22 (step S23), and performs a predetermined process based on the processing result (step S24).

[2.2. Configuration and operation of virtual AP server 13 _x ]
The virtual AP server 13 _x is a virtual machine formed on the server system 11 as described above.

As shown in FIG. 5, the server system 11 includes a plurality of blade servers 12 _{1 to} 12 _n , storages 14 _{1 to} 14 _n, and a server management device 15. For the sake of convenience, the blade server 12 will be referred to when any one or all of the blade servers 12 _{1 to} 12 _n are shown. Further, when any one or all of the storages 14 _{1 to} 14 _n are shown, the storage 14 is referred to for convenience.

  Each blade server 12 includes a CPU 401, a ROM 402, a RAM 403, an input / output unit 404, a communication unit 405, and a hard disk (HDD) 406, which are connected to each other via a system bus 407. ing. The input / output unit 404 is a communication interface for transmitting / receiving data to / from the server management apparatus 15, and the communication unit 405 is a communication interface for connecting to a LAN that is an in-company network within a cloud service provider company. .

A plurality of virtual machines 13 _{1 to} 13 _n operate on the blade servers 12 _{1 to} 12 _n configured as described above. In addition, when showing any virtual machine or all the virtual machines among the plurality of virtual machines 13 _{1 to} 13 _n , they are referred to as virtual machines 13 for convenience.

  FIG. 6 shows the architecture on the blade server 12. As shown in the figure, in the blade server 12, a main OS as a base program operates. Then, a virtual machine program that is a program for operating the virtual machine on the main OS operates. A plurality of guest OSs can be operated on the virtual machine program. One or more application programs can be operated on each guest OS.

  The server management device 15 is a device that controls and manages each blade server 12, and manages resources (CPU 401, ROM 402, RAM 403, HDD 406, etc.) allocated to the guest OS. For example, the server management apparatus 15 can change the resource allocated to the virtual machine 13 according to the resource utilization rate by the virtual machine 13. Further, the server management device 15 can control the start and stop of execution of the application program. Furthermore, it is possible to add, delete, or update a guest OS or application program by communicating with each blade server 12.

In the present embodiment, among the virtual machine 13 running on blade servers 12, using a virtual machine that runs first on the blade server 12 ₁ as a virtual AP server 13 _x (see FIG. 1).

As illustrated in FIG. 7, the virtual AP server 13 _x operating on the blade server 12 functions as a control unit 411, a storage unit 412, a communication unit 413, and the like by using resources of the blade server 12, and is used for applications. Run the program. The control unit 411 functions as a reception unit, a determination unit, a first processing unit, a second processing unit, a third processing unit, and the like.

Next, the processing in the virtual AP server 13 _x will be specifically described based on the flowchart of FIG. Treatment with virtual AP server 13 _x starts when the operation of the virtual AP server 13 _x on the blade server is authorized by the server management apparatus 15.

  First, the control unit 411 determines whether a request is received from the client terminal device 1 (step S31). In this process, if it is determined that a request has not been received (step S31: NO), the control unit 411 repeats the determination in step S31 until a request is received from the client terminal device 1. On the other hand, if it is determined that the request has been received (step S31: YES), the control unit 411 determines whether communication with the DB server 22 is necessary (step S32).

In this process, if it is determined that there is no necessary communication with the DB server 22 (step S32: NO), the control unit 411, a process corresponding to the received request, the virtual AP server 13 _x running inside (step S33 ). On the other hand, when determining that communication with the DB server 22 is necessary (step S32: YES), the control unit 411 generates a request for the DB server 22 in response to a request from the client terminal device 1, and sends the generated request to the request. The data is transmitted to the DB server 22 (step S34). Thereafter, the control unit 411 receives the processing result for the request transmitted in step S34 (step S35). When this process ends or when the process of step S33 ends, the control unit 411 sends the processing result (the result of the internal process in step S33, to the client terminal device 1 that has transmitted the request received in step S31). Alternatively, the processing result received in step S35 is transmitted (step S36).

[2.3. Configuration and operation of DB server 22]
Next, a specific configuration of the DB server 22 will be described. A general server computer can be applied to the DB server 22. The DB server 22 is managed by the user's company. As shown in FIG. 9, the DB server 22 includes a control unit 61, a storage unit 62, a communication unit 63, and an operation unit, which are connected to each other via a system bus 64. The control unit 61 controls the storage 21. The storage unit 62 is a rewritable storage device having a storage area for storing various information. The communication unit 63 is a communication interface for communicating with the DB server 22 and the like.

  The control unit 61 includes a CPU (Central Processing Unit), an internal memory, and the like. The CPU functions as a storage processing unit or the like by reading and executing a program stored in the internal memory.

  Next, the processing in the DB server 22 will be specifically described based on the flowchart of FIG. Processing in the DB server 22 is started and repeated when a power switch (not shown) is turned on or a reset switch (not shown) is operated in the DB server 22. At this time, the CPU of the control unit 61 operates the function as the control unit 61 with the program stored in the internal memory as the execution state.

First, the control unit 61 determines whether a request has been received from the virtual AP server 13 _x (step S41). If it determines with not having received the request (step S41: NO), the control part 61 will repeat the determination of step S41 until a request is received. On the other hand, when it determines with having received the request (step S41: YES), the control part 61 performs the process based on the content of the request in step S42. At this time, the confidential information in the company stored in the storage 21 is used as necessary. Thereafter, in step S43, the control unit 61, to the virtual AP server 13 _x that has transmitted the request received in step S41, and transmits the result of the processing.

As described above, the application service providing system operates when the client terminal device 1, the virtual AP server _13x , and the DB server 22 repeat the above-described processing.

[4. Web conference system to which this embodiment is applied]

Next, a Web conference service system (hereinafter, “Web conference system”) using the application service providing system having the above-described configuration will be specifically described. This Web conference system is executed by operating application software for Web conference on the virtual machine 13 set on the blade server 12. Here, as an example, the application providing company, a virtual machine that operates on the second blade server 12 ₂ rent, with a SIP server 13 _x2, be described as providing a Web conferencing service.

In the following description, this Web conference system enables a conference between remote locations by transmitting and receiving video information and audio information between the client terminal devices 1 via the SIP server 13 _x2 . In the following, although the audio information process is omitted, it is the same process as the video information process.

In the configuration shown in FIG. 1, when three clients A to C using the client terminal devices 1 a to 1 c conduct a Web conference, the presentation unit 46 of the client terminal device 1 a used by the client A includes the client terminal device 1 b. And the video information acquired in 1c is presented. Further, the video information acquired by the client terminal devices 1a and 1c is presented to the presentation unit 46 of the client terminal device 1b used by the client B. Further, the video information acquired by the client terminal devices 1a and 1b is presented to the presentation unit 46 of the client terminal device 1c used by the client C. Further, the SIP server 13 _x2 processes and transmits video information to be transmitted to each client terminal device 1 based on the video information acquired from each client terminal device 1.

  Further, in the storage 21, a first table (see FIG. 12) in which information for each client terminal device 1 is registered, and a second table (in FIG. 12) in which information such as the start time and end time of a conference to be held is registered. 13) and a third table (see FIG. 14) in which information of the client terminal device 1 participating in the conference is registered. In order to conduct a Web conference, it is necessary to register conference information to be described later in the storage 21 from the client terminal device 1 of the organizer in advance. In order to participate in the web conference, it is necessary to perform an operation for preparing for participation in each participating client terminal device 1.

In this Web conference system, the following three processes are performed.
(1) “Registration process” for registering a conference to be hosted in the DB server 22
(2) “Participation preparation process” for the procedure to participate in the conference
(3) “Conference processing” for conducting a web conference
Each process will be specifically described below.

[4.1. registration process]
First, the registration process will be described with reference to FIG. This process is executed by the client terminal device 1 of the client that hosts the conference, the SIP server 13 _x2, and the DB server 22.

First, the client terminal device 1 receives a base ID and password input and an authentication processing execution instruction from the conference organizer via the operation unit 44. Note that if the base ID and password are stored in the storage unit 42 in advance, the input via the operation unit 44 is not necessary. Then, the client terminal device 1 transmits an authentication processing request based on the received information to the SIP server 13 _x2 (step S51). This request includes information indicating an execution request for authentication processing, a base ID, and a password. At this time, a predetermined encryption process may be applied to the base ID and password.

When receiving the request for the authentication process, the SIP server 13 _x2 transmits an authentication process request corresponding to the request for the authentication process to the DB server 22 (step S52). The authentication processing request includes identification information for identifying the SIP server 13 _x2 in addition to the information transmitted from the client terminal device 1.

  When the DB server 22 receives the authentication process request, the DB server 22 performs the authentication process (step S53). The DB server 22 performs an authentication process with reference to the first table (FIG. 12) stored in the storage 21. That is, in this authentication process, the DB server 22 collates whether or not the combination of the base ID and the password included in the received authentication process request is registered in the first table of the storage 21. When the combination of the site ID and the password is registered in the first table, the DB server 22 determines that the authentication has succeeded, and otherwise determines that the authentication has failed. Note that the base ID and password stored in the storage 21 may also be encrypted as in the processing in the client terminal device 1, and in this case, they are decrypted at the time of collation.

  Here, the data structure of the first table stored in the storage 21 will be described. As shown in FIG. 12, in the first table, the setting for each client terminal device 1 includes “site ID”, “IP address”, “password”, “person in charge”, “phone number”, “company name”. "," Service contents ", and" Mail address "are stored.

Thereafter, the SIP server 13 _x2 transmits an authentication result to the SIP server 13 _x2 that has transmitted the authentication processing request (step S54). The authentication result includes information indicating whether or not the authentication is successful, that is, information indicating authentication OK or information indicating authentication NG.

When the SIP server 13 _x2 receives the authentication result from the DB server 22, the SIP server 13 _x2 transmits the authentication result to the client terminal device 1 that has transmitted the request accepted in step S52 (step S55).

Upon receiving an authentication result including information indicating authentication OK, the client terminal device 1 accepts an input of conference information (hereinafter referred to as “conference information”) hosted via the operation unit 44 from the conference organizer. The conference information registration process execution process is accepted. Then, a request for conference information registration processing based on the received information is transmitted to the SIP server 13 _x2 (step S56). Here, the conference information includes the identification number (hereinafter referred to as “conference participation base number”) of the client terminal device 1 used by the client participating in the conference, and the scheduled start time / scheduled end time of the conference. Yes. The display layout setting information (described later) on each client terminal device 1 participating in the conference is also included in this request.

SIP server 13 _x2 accepts the request for the meeting information registering process, to the DB server 22 transmits a registration processing request including the identification information of the SIP server 13 _x2 (Step S57). When receiving the registration process request, the DB server 22 performs a conference information registration process (step S58). In the conference information registration process, the conference information is registered in the second table and the third table of the storage 21 based on the received registration process request. That is, the DB server 22 includes the conference ID included in the registration processing request, the scheduled start time of the conference, the scheduled end time, and the location ID (host location ID) of the client terminal device 1 that has requested the conference information registration processing. And the identification information of the SIP server 13 _x2 are registered in the second table in association with the newly issued conference ID. Also, the DB server 22 registers the conference participation base number and the setting information in the third table in association with the newly issued conference ID among the conference information included in the registration processing request.

Here, the data structures of the second table and the third table stored in the storage 21 will be described. As shown in FIG. 13, the second table uses the conference ID as a key, “host ID” indicating the organizer's client terminal device 1, “scheduled start time” indicating the conference start time, and conference end time. "Scheduled end time" indicating is registered. In the second table, the identification information of the SIP server 13 _x2 is also registered using the conference ID as a key, but it is not shown here. Further, as shown in FIG. 14, “conference participation base ID” and “setting information” indicating the identification number of the client terminal device 1 participating in the conference are registered in the third table using the conference ID as a key. . The setting information includes the quality of video information to be displayed (video information compression method and the like) and display layout information. In the present embodiment, this setting information is also handled as confidential information within the company.

When the registration of the conference information in step S58 ends, the DB server 22 transmits completion information indicating that the conference information registration processing has been completed to the SIP server 13 _x2 (step S59). When the SIP server 13 _x2 receives the completion information from the DB server 22, the SIP server 13 _x2 transmits the completion information to the client terminal device 1 (step S60).

[4.2. Preparation for participation]
Next, the participation preparation process will be described with reference to FIG. This process is a process for notifying each client terminal device 1 used by a client participating in the Web conference that the Web conference is performed and for authenticating each client terminal device 1.

First, the SIP server 13 _x2 transmits a conference information request to the DB server 22 (step S61). This conference information request includes the identification number of the SIP server 13 _x2 . The process of step S61 is repeatedly performed at predetermined time intervals.

The DB server 22 extracts conference information with reference to the first to third tables stored in the storage 21 based on the identification number of the SIP server 13 _x2 included in the received conference information request (step S62). Specifically, the DB server 22 refers to the second table, and extracts a conference ID that is associated with the identification number of the SIP server 13 _x2 and started within a predetermined time from the current time. The DB server 22 extracts the conference participation base ID and the setting information with reference to the third table using the extracted conference ID as a search key. Then, the DB server 22 extracts a mail address by referring to the first table using the extracted conference participation base ID as a search key. The DB server 22 uses the extracted information as conference information. Thereafter, the DB server 22 transmits the extracted conference information to the SIP server 13 _x2 that has transmitted the conference information request received in Step S62 (Step S63).

When the SIP server 13 _x2 receives the conference information (step S64), the SIP server 13 _x2 sends conference notification information indicating that the conference is to be performed to the client terminal device 1 of the conference participation base number included in the received conference information by e-mail. Transmit (step S65).

When the meeting notification information is received, the client terminal device 1 receives an input of a base ID and a password and an execution instruction for an authentication process from the client via the operation unit 44. Then, a request for authentication processing based on the received information is transmitted to the SIP server 13 _x2 (step S66). When receiving the request for the authentication process, the SIP server 13 _x2 transmits an authentication process request to the DB server 22 (step S67).

When the DB server 22 receives the authentication process request, the DB server 22 performs the authentication process (step S68). This authentication process is performed with reference to the first table and the third table stored in the storage 21. That is, the DB server 22 determines whether the combination of the base ID and the password included in the authentication processing request is registered in the first table. If the combination is registered in the first table, the DB server 22 further stores the combination in the third table. It is determined whether the base ID is registered. When registered in both, the DB server 22 determines that the authentication has succeeded, and otherwise determines that the authentication has failed. Thereafter, the DB server 22 transmits an authentication result to the SIP server 13 _x2 that has transmitted the authentication processing request (step S69). When the authentication is successful, the DB server 22 acquires setting information corresponding to the site ID included in the authentication processing request from the third table stored in the storage 21, and uses this setting information together with information indicating authentication OK. Transmit to the SIP server 13 _x2 .

When the SIP server 13 _x2 receives the authentication result from the DB server 22 (step S70), the combination of the base ID and the setting information of each client terminal device 1 included in the received authentication result is stored in the storage unit 412 or the storage 14. (Step S71). Furthermore, the SIP server 13 _x2 transmits an authentication result to the client terminal device 1 that has transmitted the request for authentication processing (step S72). The client terminal device 1 has a conference flag in the storage unit 42, and the flag is turned ON when the conference disclosure time comes.

[4.3. Meeting processing]
Next, the conference process will be described with reference to FIG. This process is a process executed between each client terminal device 1 participating in the Web conference and the SIP server 13 _x2 . In FIG. 16, for convenience of explanation, two client terminal devices, the client terminal device 1a and the client terminal device 1b, are shown. However, in reality, the same processing is performed for the number of client terminal devices 1 participating in the conference. Repeated throughout the meeting.

First, the client terminal device 1a transmits the video information acquired via the information acquisition unit 45 to the SIP server 13 _x2 (step S75a). Similarly, the client terminal device 1b transmits the video information acquired via the information acquisition unit 45 to the SIP server 13 _x2 (step S75b).

When the SIP server 13 _x2 receives video information from each client terminal device 1 (step S76), the SIP server 13 _x2 generates video information to be transmitted to each client terminal device 1 based on the received video information (step S77). At this time, the setting information for each client terminal device 1 stored in the storage unit 412 or the storage 14 is referred to. Thereafter, the SIP server 13 _x2 transmits the generated video information to each client terminal device 1 (step S78).

Receiving the video information from the SIP server 13 _x2, the client terminal devices 1a and 1b display the video on the presentation unit 46 based on the received video information (steps S79a and S79b).

  Next, specific processing for each element in the Web conference system that performs the above operation will be described.

[4.4. Processing in Client Terminal Device 1]
First, the processing in the client terminal device 1 will be specifically described with reference to FIG.

First, the control unit 41 determines whether or not an instruction to execute authentication processing has been received from the client via the operation unit 44 (step S81). If it is determined that an authentication process execution instruction has been received (step S81: YES), the control unit 41 transmits an authentication process request to the SIP server 13 _x2 (step S82). This request for registration processing includes a base ID and a password. Thereafter, the control unit 41 receives the authentication result from the SIP server 13 _x2 (step S83).

On the other hand, if it is determined in step S81 that the authentication process execution instruction has not been received (step S81: NO), the control unit 41 determines in step S84 whether or not the conference information registration process execution instruction has been received. If it is determined that the conference registration process execution instruction has been received (step S84: YES), the control unit 41 transmits a conference information registration process request to the SIP server _13x2 based on the received input in step S85. Thereafter, the control unit 41 receives completion information indicating registration of conference information transmitted from the SIP server 13 _{x2 in} response to the conference information registration processing request (step S86).

  On the other hand, if it is determined in step S84 that an instruction to execute the conference information registration process has not been received (step S84: NO), the control unit 41 determines whether it is a meeting start time (step S87). In this process, the control unit 41 determines that there is a meeting instruction when the meeting start time comes. This determination is made based on whether the in-conference flag stored in the storage unit 42 is ON. If it determines with it not being the meeting start time (step S87: NO), the control part 41 will transfer a process to step S81, and will repeat the process after step S81. On the other hand, if it determines with it being a meeting start time (step S87: YES), the control part 41 will transfer a process to step S88.

In step S88, the control unit 41 transmits the video information acquired via the information acquisition unit 45 to the SIP server 13 _x2 . Also, the control unit 41 presents the video information acquired from the SIP server 13 _x2 to the presentation unit 46 (step S89). Thereafter, the control unit 41 determines whether or not the conference is over (step S90). This determination is made based on whether or not the in-conference flag stored in the storage unit is turned off. If it determines with it not being the meeting completion (step S90: NO), the control part 41 will transfer a process to step S88, and will repeat the process from step S88. On the other hand, if it determines with it being the meeting end (step S90: YES), the control part 41 will transfer a process to step S81, and will repeat the process from step S81.

[4.5. Processing in SIP server 13 _x2 (part 1)]
Next, the process (part 1) in the SIP server 13 _x2 will be specifically described with reference to FIG. In this processing, processing corresponding to the request received from the client terminal device 1 is performed.

  First, the control unit 411 determines whether an authentication processing request has been received from any of the client terminal devices 1 (step S101). If it determines with having received the request | requirement of the authentication process (step S101: YES), the control part 411 will transmit an authentication process request to the DB server 22 (step S102). In response to this authentication processing request, when the authentication result is received from the DB server 22 (step S103), the control unit 411 transmits the authentication result to the client terminal device 1 (step S104).

  On the other hand, if it is determined in step S101 that a request for authentication processing has not been received (step S101: NO), the control unit 411 determines whether a request for conference information registration processing has been received (step S105). If it determines with having received the request | requirement of a meeting registration process (S105: YES), the control part 411 will transmit a registration process request to DB server 22 (step S106). In response to this registration processing request, when the processing result is received from the DB server 22 (step S107), the processing result is transmitted to the client terminal device 1 (step S108).

  On the other hand, if it is determined in step S105 that the request for the conference information registration process has not been received (step S105: NO), the control unit 411 determines whether video information has been received (step S109). If it is determined that the video information is not received (step S109: NO), the control unit 411 shifts the process to step S101 and repeats the processes after step S101. On the other hand, when determining that the video information has been received (step S109: YES), the control unit 411 temporarily stores the received video information in the storage unit 412 or the storage 14 (step S110).

  Thereafter, the control unit 411 generates video information to be transmitted to the client terminal device 1 that has transmitted the video information received in step S109 (step S111). This video information is generated by processing the video information received from the storage unit 412 or another client terminal device 1 stored in the storage 14. Further, at the time of processing, setting information that is one of the confidential information in the company stored in the storage unit 412 or the storage 14 is referred to. When the video information is generated, the control unit 411 transmits the generated video information to the client terminal device 1 (step S112).

[4.6. Processing in SIP server 13 _x2 (part 2)]
Next, the process (part 2) in the SIP server 13 _x2 will be specifically described with reference to FIG. This process is a process of inquiring the DB server 22 whether or not there is a meeting that starts within a predetermined time from the current time, and is repeatedly executed at predetermined time intervals. It is executed in parallel with the above-described “Processing in SIP Server 13 _x2 (Part 1)”.

  First, the control unit 411 transmits a conference information request to the DB server 22 (step S121). When receiving a response to the conference information request (step S122), the control unit 411 determines whether the received response includes conference information (step S123). If there is no meeting information corresponding to the meeting information request transmitted in step S121, the received response does not include the meeting information.

  If it is determined that the conference information is not included (S123: NO), the control unit 411 ends this process. On the other hand, when determining that the conference information is included (S123: YES), the control unit 411 notifies the client terminal device 1 of the conference participation base number included in the conference information that the conference is performed. Information is transmitted by electronic mail (step S124).

[4.7. Processing in DB Server 22]
Next, processing in the DB server 22 will be specifically described with reference to FIG.

First, the control unit 61 of the DB server 22 determines whether or not an authentication processing request has been received from the SIP server 13 _x2 (step S131). If it determines with having received the authentication process request (step S131: YES), the control part 61 will perform an authentication process (step S132). This authentication process is performed with reference to the first table and the third table stored in the storage 21, as described in the process of step S68. When this authentication process is completed, the control unit 61 transmits the authentication result to the SIP server 13 _x2 (step S133).

On the other hand, if it is determined in step S131 that an authentication process request has not been received (step S131: NO), the control unit 61 determines whether a registration process request has been received (step S134). If it is determined that the registration processing request has been received (step S134: YES), the control unit 61 registers the conference information in the second table and the third table of the storage 21 as described in the processing of step S58 described above ( Step S135). Thereafter, the control unit 61 transmits completion information indicating that registration of the conference information has been completed to the SIP server 13 _x2 (step S136).

On the other hand, if it is determined in step S134 that a registration processing request has not been received (step S134: NO), the control unit 61 determines whether a conference information request has been received (step S137). If it determines with not having received the meeting information request (step S137: NO), the control part 61 will transfer a process to step S131, and will repeat the process after step S131. On the other hand, if it is determined that the conference information request has been received (step S137: YES), the control unit 61 refers to the first to third tables stored in the storage 21 as described in step S62 above. Meeting information is extracted (step S138). Thereafter, the control unit 61 transmits the extracted conference information to the SIP server 13 _x2 (step S139).

  In addition, description of each embodiment mentioned above is an example of this invention, and this invention is not limited to the above-mentioned embodiment. For this reason, it is needless to say that various modifications other than the above-described embodiments can be made according to the design and the like as long as they do not depart from the technical idea of the present invention.

DESCRIPTION OF SYMBOLS 1 Client terminal device 11 Server system 12 Blade server 13 _x Virtual AP server 13 _x2 SIP server 14, 21 Storage 22 Database server 23 Management terminal device

Claims (7)

A virtual machine that operates on a server connected to the Internet and processes requests from the client terminal device, and stores confidential information in the company including information related to a user who is connected to the corporate network and uses the client terminal device. The virtual machine in an application service providing system comprising an in-company database server,
Receiving means for receiving a request from a client terminal device via the Internet;
In response to a request from the client terminal device, a determination unit that determines whether or not processing based on the confidential information in the company is necessary;
When it is determined by the determination means that processing based on the confidential information in the company is necessary, a secure connection is established with an in-company database server connected to the corporate network and performing storage processing of the confidential information in the company. First processing means for performing communication and processing for the request based on the confidential information in the company;
A virtual machine comprising: second processing means for executing processing in response to the request when the determination means determines that processing based on the confidential information in the company is not necessary. The in-company database server stores user authentication information of the client terminal device,
The determination unit determines that processing based on the in-company confidential information is necessary when obtaining authentication information from the client terminal device;
The first processing means inquires of the in-company database server whether or not authentication information matching the acquired authentication information is stored in the in-company database server, and performs the authentication process of the client terminal device. The virtual machine according to claim 1.   Third processing means for performing secure communication with the in-company database server and storing the in-company secret information in the in-company database server when receiving the in-company secret information from the client terminal device The virtual machine according to claim 1, wherein the virtual machine is provided.   The said 1st processing means processes the information acquired from the said client terminal device based on the said confidential information in a company, and transmits to the said client terminal device, The any one of Claims 1-3 characterized by the above-mentioned. Virtual machine. To a virtual machine running on a server connected to the Internet,
An accepting step for accepting a request from a client terminal device via the Internet;
A determination step for determining whether or not processing based on confidential information in the company including user information of the client terminal device is necessary for the request from the client terminal device;
If it is determined in the determination step that processing based on the confidential information in the company is necessary, secure communication is performed with an internal database server connected to the internal network and storing the confidential information in the company. And a first processing step for performing processing for the request based on the in-company confidential information;
A program for executing a second processing step for executing processing for the request when it is determined in the determination step that processing based on the confidential information in the company is not necessary. A virtual machine that runs on a server connected to the Internet and performs processing in response to a request from a client terminal device;
In an application service providing system comprising an in-company database server connected to an in-company network,
The corporate database server is
Storage means for storing confidential information within the company including user information of the client terminal device;
In response to a request from the virtual machine, storage processing means for searching, changing or deleting the confidential information in the company stored in the storage means, or adding the confidential information in the company to the storage means,
The virtual machine is
Receiving means for receiving a request from a client terminal device via the Internet;
In response to a request from the client terminal device, a determination unit that determines whether or not processing based on the confidential information in the company is necessary;
When it is determined by the determination means that processing based on the confidential information in the company is necessary, secure communication is performed with the database server in the company, and processing for the request is performed based on the confidential information in the company. First processing means to perform,
An application service providing system comprising: a second processing unit that executes a process for the request when the determination unit determines that the process based on the confidential information in the company is not necessary. An application service providing method by a virtual machine that operates on a server connected to the Internet and performs processing according to a request from a client terminal device, and an in-company database server connected to the in-company network,
An accepting step in which the virtual machine accepts a request from a client terminal device via the Internet;
A determination step of determining whether or not the virtual machine requires processing based on in-company confidential information including user information of the client terminal device in response to a request from the client terminal device;
When it is determined that the process based on the confidential information in the company is necessary in the determination step, the virtual machine performs secure communication with the database server in the company, and A request step for performing processing in response to a request from the client terminal device;
In response to a request from the virtual machine, the in-company database server retrieves, changes or deletes the in-company secret information from the storage unit storing the in-company secret information, or the in-company secret information to the storage unit A storage processing step for adding
And a processing step of performing processing in response to a request from the client terminal device when the virtual machine determines that processing based on the confidential information in the company is not necessary in the determination step. Service provision method.

Images