JP2009017471A - Information communication method - Google Patents

Abstract

A web client can access a web server via a tunnel connection between the external proxy server and the internal proxy server.
After establishing a tunnel connection between an external proxy server 105 and an internal proxy server 205, a web client 111 connects to the external proxy server 105 and transmits an HTTP request, and the external proxy server 105 receives the received HTTP. A step of transmitting a request to the internal proxy server 205 via the tunnel connection, a step of the internal proxy server 205 transmitting the received HTTP request to the web server 211, and the web server 211 sending an HTTP response to the internal proxy server 205. The internal proxy server 205 returns an HTTP response to the external proxy server 105, and the external proxy server 105 returns an HTTP response to the web client 111.
[Selection] Figure 1

Description

  The present invention relates to an information communication method in an information communication system in which an external proxy server and a web client are installed outside a firewall, and an internal proxy server and a web server are installed inside the firewall.

  In recent years, as the functions of various computer devices such as PCs (personal computers), including those incorporated in various electronic devices such as home appliances and office equipment, have become endorsed, Support operations for users are becoming more important. In order to provide support for equipment maintenance, etc., it has been necessary to bring PCs to a support center or dispatch support staff to the installation location of PCs, etc., which is currently very expensive. Met. As a method for solving this problem, there is considered a method in which a support center operator performs remote access to a PC or the like using a communication network connection such as the Internet.

  On the other hand, with the spread of broadband communication in recent years, it has become possible to always connect to the Internet at low cost in ordinary homes and companies. In the Internet, there are security problems such as unauthorized access to a PC or the like over a network, and a DoS (Denial of Service attack) / ping / RIP (Routing Information Protocol) attack. For this reason, in general, devices having a NAT (Network Address Translation) function and a firewall function are widely used in equipment such as a so-called broadband router used for Internet connection.

  The NAT function is a function that converts a private IP address that can be communicated only at home or within a company and a unique global IP address that can be communicated on the Internet, and the firewall function is a specific function between the Internet and the internal network. This function allows only communication. Both functions allow legitimate communication that occurs from the internal network toward the Internet, but communication that occurs from the Internet side toward the internal network is blocked as illegal except for preset communication. Such a function is common in equipment such as a broadband router used for Internet connection.

  Against this background, a remote operation method and system for performing remote operation and the like by specifying a computer to be supported based on a call signal from a computer that receives the remote operation are provided.

  In addition, a support system is also provided in which a client-side computer is temporarily connected to a WWW server to specify the IP address of the client-side computer, and the client-side computer is remotely operated (see, for example, Patent Document 1).

The remote access system described in Patent Document 1 is a system that maintains and manages a user-side PC connected to a communication network by remote operation from an operator terminal of a support center, and includes an unspecified number of user-side PCs and users A support center server that allows a user side PC to be remotely operated from an operator terminal by establishing a connection between the user side PC and the support center in response to a connection request from the side PC and performing a tunnel connection within the connection, and a user side PC It is composed of an operator terminal having a Web browser that is remotely operated. The user side PC is a remote access Web server that accepts remote operation from the operator terminal through a tunnel connection, and the user side PC is maintained and operated by remote operation from the operator terminal. Remote for management And it has a configuration that includes a port applications.
Japanese Patent Laying-Open No. 2005-26856

  As a method for acquiring information in the firewall, a method for permitting access from a specific outside by setting the firewall and a software for tunneling communication in the firewall as described in the above-mentioned Patent Document 1 are executed. There is a VPN (Virtual Private Network) method for virtually connecting the inside and outside of the firewall.

  However, in the case of a method of permitting access from a specific outside in the firewall setting, it is necessary to teach the access method to the outside. In this case, a normal HTTP proxy server can access an external website from the inside of the firewall, but there is a problem that information on the website inside the firewall cannot be acquired from the outside. In the VPN method, it is necessary to match the VPN to a network outside the firewall.

  The present invention was devised to solve such problems. The purpose of the present invention is to arrange an external proxy server (main body) and a web client (terminal) outside the firewall, and an internal proxy server (Dejima) inside the firewall. By installing a web server (target), establishing a tunnel connection, and allowing access to the web server (target) from the web client (terminal), there is no need to show open port information to the outside Therefore, a highly secure information communication method will be provided.

  In order to solve the above problems, an information communication method of the present invention is an information communication method in an information communication system in which an external proxy server and a web client are installed outside a firewall, and an internal proxy server and a web server are installed inside the firewall. A first step of establishing a tunnel connection between the external proxy server and the internal proxy server; and after the tunnel connection is established, the web client connects to the external proxy server according to a user operation. A second step of transmitting an HTTP request, a third step of the external proxy server receiving an HTTP request from the web client and transmitting the HTTP request to the internal proxy server via the tunnel connection; A proxy server from the external proxy server A fourth step of receiving an HTTP request and transmitting it to the web server; a fifth step of returning an HTTP response in response to the HTTP request to the internal proxy server; and the internal proxy server comprising: A sixth step of returning the HTTP response to the external proxy server and a seventh step of returning the HTTP response to the web client are provided.

  According to the present invention, since the tunnel connection is established between the external proxy server installed outside the firewall and the internal proxy server installed inside the firewall, the open port is compared with the method of opening a specific port of the firewall. It is not necessary to show the information to the outside, and safety is improved. In addition, establishing a tunnel connection from the internal proxy server inside the firewall to the external proxy server outside the firewall has the effect of blocking access from unspecified clients. Furthermore, the information providing side manages the internal proxy server and stops the internal proxy server, whereby access from the outside can be completely blocked.

  According to the information communication method of the present invention, the address of the web server that permits connection is recorded in advance in the internal proxy server. In the fourth step, the external proxy is connected via a tunnel connection. Only when the address of the HTTP request received from the server matches the permitted address recorded inside, the HTTP request can be transmitted to the web server having the matched address. According to this configuration, it is possible to prevent an unnecessary server from being accessed from the outside by holding the address information permitting connection in the internal proxy server and rejecting other information.

  According to the information communication method of the present invention, the address of the web server that prohibits connection is recorded in advance in the internal proxy server, and in the fourth step, the external proxy is connected via a tunnel connection. When the address of the HTTP request received from the server matches the prohibited address recorded in the server, the transmission to the web server may not be performed. According to this configuration, when there are a large number of web servers to be monitored, it is only necessary to set addresses for which access is prohibited.

  According to the information communication method of the present invention, the internal proxy server records in advance a specific pattern indicating the address of the web server that is prohibited or permitted to transmit, and in the fourth step, the tunnel connection When the address pattern of the HTTP request received from the external proxy server via the URL matches the address pattern forbidden or permitted recorded inside, the address of the matched pattern is transmitted to the web server. Can be prohibited or permitted. According to this configuration, since it is possible to set permission or prohibition for a plurality of addresses at once, setting becomes easy.

  According to the information communication method of the present invention, the internal proxy server includes a step of detecting that the tunnel connection is disconnected other than the normal disconnection operation, and the tunnel connection is disconnected other than the normal disconnection operation. If this is detected, it can be configured to try to establish a tunnel connection again. Usually, connection on the Internet is not guaranteed. Also, if an unexpected problem occurs on the external firewall or external proxy server side, the tunnel connection may be disconnected. At this time, a stable communication path can be maintained by automatically reconnecting.

  According to the information communication method of the present invention, the internal proxy server records information on a tunnel connection start time and a tunnel connection disconnection time. In the first step, when the tunnel connection start time is reached, A tunnel connection with an external proxy server is established, and the tunnel connection is disconnected when the tunnel connection disconnection time comes. According to this configuration, it is possible to connect only for a specific time recorded in the internal proxy server, and the possibility of unauthorized access from the outside can be reduced.

  According to the information communication method of the present invention, in the third step, the external proxy server encrypts an HTTP request from a web client, transmits the encrypted HTTP request to the internal proxy server, and In step 4, the internal proxy server decrypts the received HTTP request and transmits the decrypted HTTP request to the web server. In step 5, the internal proxy server encrypts the HTTP response from the web server. The encrypted HTTP response is transmitted to the external proxy server, and in the sixth step, the external proxy server decrypts the encrypted HTTP response and transmits the decrypted HTTP response to the web client. It can be configured. According to this configuration, since the external proxy server and the internal proxy server mutually perform encryption and decryption, spoofing of the external proxy server and the internal proxy server can be prevented.

  According to the information communication method of the present invention, the internal proxy server holds in advance a key corresponding to the identifier of the external proxy server, and in the first step, the internal proxy server establishes a tunnel connection. When the key corresponding to the identifier of the external proxy server is received from the external proxy server, the received key is compared with the pre-stored key, and if the comparison result matches, the establishment of the tunnel connection is permitted. It can be set as the structure to do. According to this configuration, spoofing of the external proxy server can be prevented. In other words, if a malicious person constructs an unauthorized external proxy server for the external proxy server address by any means, the internal proxy server may access it without knowing it and leak information inside the firewall. However, according to the present invention, such information leakage can be avoided.

  According to the information communication method of the present invention, the external proxy server holds in advance a key corresponding to the identifier of the internal proxy server that requests connection, and in the first step, the external proxy server When establishing a connection, a key corresponding to the identifier of the internal proxy server is received from the internal proxy server, and the received key is compared with a previously held key. It can be set as the structure which permits establishment of a connection. According to this configuration, impersonation of the internal proxy server can be prevented. In other words, if a malicious person creates an internal proxy server and tries to connect to an external proxy server illegally, the external proxy server may permit the connection without knowing it and access inaccurate information. However, according to the present invention, such inaccurate access can be avoided.

Further, according to the information communication method of the present invention, the external proxy server can analyze an HTTP request from a web client and use a part of the HTTP request as an address specification inside the firewall. According to this configuration, when setting the external proxy server by the proxy setting function of the web client, normally only one external proxy server can be set. However, according to the present invention, a plurality of independent proxy servers can be set without depending on the proxy setting of the client. In addition, according to the information communication method of the present invention, the proxy server (internal proxy server and external proxy server) analyzes the HTTP response received from the web server, and receives the HTTP response. It can be set as the structure which adds the address of the said web server to the inside hyperlink part. According to this configuration, it becomes possible to access via the external proxy server by clicking a hyperlink in the HTTP response on the web client, and the operability for the user is improved.

  According to the information communication method of the present invention, the proxy server (internal proxy server and external proxy server) encrypts the decryption key for decrypting the encrypted HTTP response generated by the web server, and the HTTP response. The web client holds a second decryption key for decrypting an HTTP response encrypted with the first encryption key in the proxy server, and receives an HTTP response from the web server. The HTTP response is decrypted with the decryption key, the hyperlink in the decrypted HTTP response is modified, encrypted with the first encryption key, and transmitted to the web client; The server decrypts the received HTTP response with the second decryption key and displays it; It can be configured to include. According to this configuration, in the case of a response encrypted by SSL (Secire Socket Layer), the content is encrypted and cannot be modified. However, once the decryption key is registered in the proxy server, it is decrypted. Make clear text. In this state, it is possible to modify the hyperlink in the HTTP response, and the operability for the user is improved. And the security is also ensured by re-encrypting the modified HTTP response and sending it to the web client.

  Further, according to the information communication method of the present invention, the external proxy server includes a transfer destination information table storing addresses of web servers installed inside the firewall, and a normal proxy server different from the internal proxy server. In the third step, when an HTTP request is received, the content is sent to the internal proxy server by comparing the content of the HTTP request with the content of the transfer destination information table, or the normal It can be set as the structure which determines whether it transmits to a proxy server. According to this configuration, a task of accessing the web server (target) inside the firewall and a task of accessing the other can be performed simultaneously without changing the proxy setting of the web client.

  According to the present invention, since the tunnel connection is established between the external proxy server installed outside the firewall and the internal proxy server installed inside the firewall, the open port is compared with the method of opening a specific port of the firewall. It is not necessary to show the information to the outside, and safety can be improved. Further, by establishing a tunnel connection from the internal proxy server inside the firewall to the external proxy server outside the firewall, it is possible to block access from unspecified clients. Furthermore, the information providing side manages the internal proxy server, and by stopping the internal proxy server, it is possible to completely block access from the outside.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a block diagram illustrating a hardware configuration example of a communication system for implementing the information communication method of the present invention.

  In this communication system, an external proxy server 105 and a plurality of web clients 111, 112,... Are installed outside the firewall 100, and an internal proxy server 205 and a plurality of web servers 211, 212,. Are connected to the external proxy server 105 and each of the web clients 111, 112,... Via the Ethernet (registered trademark) 106, and the internal proxy server 205 and each of the web servers 211, 212,. Are connected by an Ethernet 206.

  The web servers 211, 212,... Generally wait for an HTTP request from the web clients 111, 112,..., And when an HTTP request is received, an HTTP response corresponding to the HTTP request is sent to the HTTP request. Are returned to the web clients 111, 112,. In this system, an HTTP request is transmitted from the internal proxy server 205 to the web servers 211, 212,.

  The user operates the web clients 111, 112,... To transmit an HTTP request. A general web client transmits an HTTP request to the web server, and receives and displays an HTTP response from the web server. On the other hand, in this system, the web clients 111, 112,... Transmit an HTTP request to the external proxy server 105 and receive and display an HTTP response from the external proxy server 105.

  After being activated, the internal proxy server 205 connects to the external proxy server 105, establishes a tunnel connection, and waits for an HTTP request from the external proxy server 105. When an HTTP request transmitted from the external proxy server 105 via the tunnel connection is received, the HTTP request is transmitted to the web server corresponding to the HTTP request. Thereafter, an HTTP response from the web server is transmitted to the external proxy server 105 via the tunnel connection.

  The firewall 100 generally permits connection from the inside to the outside of the firewall, and does not permit connection from the outside to the inside.

  The external proxy server 105 waits for a tunnel connection request from the internal proxy server 205 after activation. If there is a tunnel connection request from the internal proxy server 205 through the firewall 100, the tunnel connection is established. The external proxy server 105 waits for an HTTP request from each of the web clients 111, 112,. When an HTTP request transmitted from an arbitrary web client 111, 112,... Is received, the received HTTP request is transmitted to the internal proxy server 205 via a tunnel connection. When an HTTP response is received from the internal proxy server 205, the HTTP response is transmitted to the web client that has previously transmitted the HTTP request.

  Next, an example of the information communication method of the present embodiment using the communication system configured as described above will be described.

<Example>
This example is an example showing the most basic processing of the information communication method of this embodiment, and FIG. 2 is a flowchart for explaining the information communication method of this example. The processing procedure of the basic communication method of this embodiment will be described below with reference to the flowchart shown in FIG.

  First, the external proxy server 105 is activated (step S201), and then the internal proxy server 205 is activated (step S202).

  Next, the internal proxy server 205 makes a tunnel connection request to the external proxy server 105 (step S203). The external proxy server 105 establishes a tunnel connection from the internal proxy server 205 in accordance with this request (step S204).

  Next, the external proxy server 105 starts waiting for an HTTP request from any web client 111, 112,... (Step S205). The request indicates that the URL address is processed and selected.

  On the other hand, for example, when the web client 111 is activated by the user (step S206), the web client 111 transmits an HTTP request to the external proxy server 105 according to the operation of the user (step S207).

  When the external proxy server 105 receives the HTTP request from the web client 111, the external proxy server 105 transmits the received HTTP request to the internal proxy server 205 via the tunnel connection (step S208). However, it is assumed that the web server (for example, the web server 211) corresponding to the HTTP request has already been activated (step S209).

  When receiving the HTTP request from the external proxy server 105, the internal proxy server 205 transmits the HTTP request to the corresponding web server 211 (step S210). The web server 211 receives the HTTP request transmitted from the internal proxy server 205 (step S211), and transmits an HTTP response corresponding to the received HTTP request to the internal proxy server 205 (step S212).

  The internal proxy server 205 receives the HTTP response from the web server 211 and transmits it to the external proxy server 105 (step S213).

  The external proxy server 105 receives the HTTP response from the internal proxy server 205, and transmits it to the web client 111 that has transmitted the HTTP request first (step S214).

  The web client 111 receives the HTTP response from the external proxy server 105 (step S215), and displays the received HTTP response (step S216). Thereafter, if there is a next HTTP request, the process returns to step S207 (step S217).

<Application example 1>
In this application example 1, the address of the web server that permits connection is registered in advance in the internal proxy server 205 of the communication system shown in FIG. 1, and the address of the HTTP request received from the external proxy server 105 via the tunnel connection is This is an application example configured to send an HTTP request to the web server of the matched address only when it matches the connection permission address registered inside, and the basic operation of the information communication method is the same as the above embodiment is there.

  That is, in the above embodiment, the internal proxy server 205 has unconditionally transmitted the HTTP request received from the external proxy server 105 to the corresponding web server (step S210 in FIG. 2). At the stage of receiving the HTTP request, first, the address included in the HTTP request is confirmed, and if it matches the connection permission address registered inside, the HTTP request is transmitted to the web server of the matching address, If they do not match, the transmission is prohibited. That is, this determination step is first performed before the step S210 of FIG.

  More specifically, for example, it is assumed that five web servers 211, 212, 213, 214, 215 are connected to the internal proxy server 205 via the Ethernet 206, and the address of the web server 211 is “aaa”, The address of the web server 212 is “bbbb”, the address of the web server 213 is “cccc”, the address of the web server 214 is “dddd”, and the address of the web server 215 is “eeee”. In the internal proxy server 205, as shown in FIG. 3, the addresses “aaaa” and “cccc” of the two web servers 211 and 213 are registered as addresses that are permitted to be connected. .

  Here, if an HTTP request to the web server 211 is transmitted from the web client 111 to the external proxy server 105, the external proxy server 105 transmits this HTTP request to the internal proxy server 205. At this time, the internal proxy server 205 acquires the address “aaaa” of the web server included in the transmitted HTTP request, and compares it with the address registered inside. As a result of the comparison, in this case, they match, so the received HTTP request is transmitted to the corresponding web server 211.

  On the other hand, if an HTTP request to the web server 212 is transmitted from the web client 111 to the external proxy server 105, the external proxy server 105 transmits this HTTP request to the internal proxy server 205. At this time, the internal proxy server 205 acquires the address “bbbb” of the web server included in the transmitted HTTP request and compares it with the address registered inside. As a result of the comparison, there is no match in this case, so the process ends without transmitting the received HTTP request to the web server 212.

  As described above, according to the configuration of the first application example, information on an address to which connection is permitted is registered in the internal proxy server 205, and an HTTP request is transmitted to an address other than the registered address. By rejecting the acceptance, it is possible to prevent an unnecessary web server (a web server that is not desired to be connected) from being accessed unexpectedly from the outside.

<Application example 2>
In this application example 2, the address of the web server that prohibits connection is registered in advance in the internal proxy server 205 of the communication system shown in FIG. 1, and the address of the HTTP request received from the external proxy server 105 via the tunnel connection is This is an application example configured to prohibit sending an HTTP request to the web server of the matched address when it matches a connection prohibited address registered inside, and the basic operation of the information communication method is This is the same as the above embodiment.

  That is, in the above embodiment, the internal proxy server 205 has unconditionally transmitted the HTTP request received from the external proxy server 105 to the corresponding web server (step S210 in FIG. 2). At the stage of receiving the HTTP request, first, the address included in the HTTP request is confirmed, and if it matches the connection prohibition address registered inside, the HTTP request is transmitted to the web server of the matched address. Is prohibited, and transmission is permitted only when they do not match. That is, this determination step is first performed before the step S210 of FIG.

  More specifically, for example, it is assumed that five web servers 211, 212, 213, 214, 215 are connected to the internal proxy server 205 via the Ethernet 206, and the address of the web server 211 is “aaa”, The address of the web server 212 is “bbbb”, the address of the web server 213 is “cccc”, the address of the web server 214 is “dddd”, and the address of the web server 215 is “eeee”. The internal proxy server 205 registers the addresses “bbbb”, “dddd”, and “eeee” of the three web servers 212, 214, and 215, as shown in FIG. It is assumed that

  Here, if an HTTP request to the web server 211 (address “aaaa”) is transmitted from the web client 111 to the external proxy server 105, the external proxy server 105 sends the HTTP request to the internal proxy server 205. Send. At this time, the internal proxy server 205 acquires the address “aaaa” of the web server included in the transmitted HTTP request, and compares it with the address registered inside. As a result of the comparison, in this case, since it does not match the prohibited address, the received HTTP request is transmitted to the corresponding web server 211.

  On the other hand, when an HTTP request to the web server 212 (address “bbbb”) is transmitted from the web client 111 to the external proxy server 105, the external proxy server 105 transmits this HTTP request to the internal proxy server 205. To do. At this time, the internal proxy server 205 acquires the address “bbbb” of the web server included in the transmitted HTTP request and compares it with the address registered inside. As a result of the comparison, in this case, since it matches the prohibited address, the process is terminated without transmitting the received HTTP request to the web server 212.

  As described above, according to the configuration of this application example 2, information on an address for which connection is prohibited is registered in the internal proxy server 205, and when an HTTP request is transmitted to the registered address, By rejecting the acceptance, it is possible to prevent an unnecessary web server (a web server that is not desired to be connected) from being accessed unexpectedly from the outside.

<Application example 3>
In this application example 3, a specific pattern indicating a web server address that is prohibited or permitted to be transmitted is registered in advance in the internal proxy server 205 of the communication system shown in FIG. When the pattern of the received HTTP request address matches a specific pattern registered inside, the HTTP request transmission is prohibited or permitted (sent) to the web server of the matched address. This is a configured application example, and the basic operation of the information communication method is the same as in the above embodiment.

  That is, in the above embodiment, the internal proxy server 205 unconditionally transmits the HTTP request received from the external proxy server 105 to the corresponding web server (step S210 in FIG. 2). When the HTTP request is received, the address pattern included in the HTTP request is first confirmed, and if it matches a specific pattern registered in the HTTP request, the HTTP request for the web server of the matched address is checked. Transmission is prohibited or permitted (transmission). That is, this determination step is first performed before the step S210 of FIG.

  More specifically, as a specific pattern indicating the web server address, for example, when “www.sharp.co.jp/path/to/data enable” is registered in the setting file, this “www .sharp.co.jp / path / to / data enable ”is permitted. On the other hand, if `` server.sharp.co.jp/path/to/page disable '' is registered in the configuration file, this `` server.sharp.co.jp/path/to/page disable '' Prohibit access.

  Thus, according to this application example 3, since it is possible to set permission or prohibition collectively for a plurality of addresses of the web server, setting becomes easy.

<Application Example 4>
In this application example 4, the internal proxy server 205 includes a detection step of detecting that the tunnel connection is disconnected other than the normal disconnection operation. Then, when it is detected that the tunnel connection is disconnected other than the normal disconnection operation, this is an application example in which the establishment of the tunnel connection is tried again.

  Usually, connection on the Internet is not guaranteed. Further, when an unexpected problem occurs on the outside of the firewall 100 or the external proxy server 105, the tunnel connection may be disconnected. At this time, it is possible to maintain a stable communication path by configuring the internal proxy server 205 to automatically reconnect.

  Here, the regular cutting operation will be described. In the normal disconnection operation, the operator operates the internal proxy server 205 and transmits a disconnection request to the external proxy server 105. When the external proxy server 205 receives the disconnection request, the external proxy server 205 transmits an approval response to the internal proxy server 205 to disconnect the tunnel connection. On the other hand, when the internal proxy server 205 receives the approval response, the internal proxy server 205 disconnects the tunnel connection. The case of cutting by the above procedure is a normal cutting operation.

  Next, an unauthorized cutting operation will be described. The external proxy server 105 transmits an existence confirmation request for determining whether or not communication is possible to the internal proxy server 205 at regular intervals. When the internal proxy server 205 receives the presence confirmation request, the internal proxy server 205 transmits a response to the external proxy server 105. The external proxy server 105 waits for a response from the internal proxy server 205 for a predetermined time, and disconnects the tunnel connection with the internal proxy server 205 if there is no response within a predetermined time. On the other hand, the internal proxy server 205 disconnects the tunnel connection if the presence confirmation request from the external proxy server 105 is not longer than a predetermined period longer than the predetermined interval. The case of being cut by the above procedure is an unauthorized cutting operation.

<Application Example 5>
In this application example 5, tunnel connection start time and disconnection time information is registered in advance in the internal proxy server 205 of the communication system shown in FIG. 1, and the tunnel connection is established only from the start time to the disconnection time. This is an application example configured as described above, and the information communication method after the establishment of the tunnel connection is the same as the basic operation of the above embodiment.

  In other words, in the above-described embodiment, the internal proxy server 205 is configured to transmit a tunnel connection request to the external proxy server 105 unconditionally after startup and establish a tunnel connection (step S203 in FIG. 2). Although not described, the tunnel connection is blocked when the internal proxy server 205 is powered off. On the other hand, in this application example 5, when the internal proxy server 205 is activated, first the tunnel connection start time and disconnection time registered inside are compared with the current time, and the current time is disconnected from the start time. If it is between the times, step S203 of FIG. 2 is performed. If the current time is not between the start time and the disconnection time, a tunnel connection request is not transmitted to the external proxy server 105 (ie, The tunnel connection request is not transmitted until the start time is reached), and the tunnel connection is not established. That is, before the step S203 of FIG. 2 is performed, the determination step for establishing the tunnel connection is first performed.

  More specifically, for example, as shown in FIG. 5, the internal proxy server 205 has “07:00 (7:00 am)” as the tunnel connection start time and “20:00 ( 8:00 pm) "is registered.

  Here, if the internal proxy server 205 is started at 09:00 (9:00 am) (step S202 in FIG. 2), the internal proxy server 205 first starts with the time “09: 0” at the time of start Are compared with the start time “07: 0” and the disconnection time “20:00”. As a result of comparison, in this case, since the start time “09: 0” is between the start time “07:00” and the disconnection time “20:00”, the internal proxy server 205 Step S203 is executed, and a tunnel connection request is transmitted to the external process server 105 to establish a tunnel connection.

  On the other hand, if the internal proxy server 205 is activated at 06:00 (6:00 am) (step S202 in FIG. 2), the internal proxy server 205 first includes the time “06:00:00” at the time of activation. The registered start time “07: 0” and the disconnection time “20:00” are compared. As a result of the comparison, in this case, since the start time “06:00” is not between the start time “07:00” and the disconnection time “20:00”, the internal proxy server 205 The processing in step S203 is not executed, and the tunnel connection request is not transmitted to the external process server 105. Thereafter, the internal proxy server 205 monitors the current time by a clock means (not shown). When the current time reaches the start time “09: 0”, the internal proxy server 205 executes the process of step S203 in FIG. A tunnel connection request is established to establish a tunnel connection.

  Further, the internal proxy server 205 monitors the time keeping of the current time by the clock means even after the tunnel connection is established, and cuts off the tunnel connection when the current time becomes the disconnection time.

  As described above, according to the configuration of this application example 5, it is possible to establish a tunnel connection with the external proxy server 105 only in a specific time zone registered in the internal proxy server 205, and unauthorized access from the outside. The possibility of access can be reduced.

<Application Example 6>
In this application example 6, when the process of step S208 of FIG. 2 is performed, the external proxy server 105 encrypts the HTTP request received from an arbitrary web client, and transmits the encrypted HTTP request to the internal proxy server 205. On the other hand, when the process of step S211 in FIG. 2 is performed, the internal proxy server 205 is configured to decrypt the received HTTP request and transmit the decrypted HTTP request to the corresponding web server. In addition, when performing the process of step S213 of FIG. 2, the internal proxy server 205 encrypts the HTTP response from the web server and transmits the encrypted HTTP response to the external proxy server 105, while step S214 of FIG. When performing the process, the external proxy server 105 decrypts the encrypted HTTP response and transmits the decrypted HTTP response to the corresponding web client.

  As described above, according to the sixth application example, since the external proxy server 105 and the internal proxy server 205 mutually perform encryption and decryption, it is possible to prevent impersonation of the external proxy server and the internal proxy server. Can do.

<Application example 7>
In this application example 7, the internal proxy server 205 is configured to hold a key corresponding to the identifier of the external proxy server 105 in advance. In step S203 of FIG. 2, when the internal proxy server 205 establishes a tunnel connection, the internal proxy server 205 receives a key corresponding to the identifier of the external proxy server from the external proxy server 105, and receives the received key and a previously held key. And the tunnel connection is established when the comparison results match.

  Thus, according to the seventh application example, the external proxy server 105 can be prevented from being spoofed. In other words, if a malicious person constructs an unauthorized external proxy server at some external means at the address of the external proxy server, the conventional proxy system accesses the internal proxy server without knowing it, and accesses the information inside the firewall. Although there is a risk of leakage, according to the seventh application example, since the tunnel connection is established after confirming the coincidence of the keys, such information leakage can be avoided.

<Application Example 8>
In this application example 8, the external proxy server 105 is configured to hold in advance a key corresponding to the identifier of the internal proxy server 205 that requests tunnel connection. In step S204 of FIG. 2, when the external proxy server 105 establishes a tunnel connection, the external proxy server 105 receives a key corresponding to the identifier of the internal proxy server 205 from the internal proxy server 205, and holds the received key in advance. The configuration is such that the tunnel connection is established when the comparison result matches the key.

  Thus, according to this application example 8, it is possible to prevent impersonation of the internal proxy server 205. In other words, if a malicious person creates an internal proxy server and attempts to connect to an external proxy server illegally, in the conventional communication system, the external proxy server allows the connection without knowing it and inaccurate information. However, according to the eighth application example, since the tunnel connection is established after confirming the coincidence of the keys, such inaccurate access can be avoided. Further, by combining the application example 7 and the application example 8, it is possible to more reliably prevent information leakage and access to inaccurate information.

<Application example 9>
In this application example 9, the external proxy server 105 is an application example that analyzes an HTTP request from a web client and uses a part of the HTTP request as address specification inside the firewall 100. More specifically, the internal proxy server 205 and the external proxy server 105 are application examples in which an HTTP response received from a web server is analyzed, and the address of the web server is added to a hyperlink portion in the HTTP response.

  FIG. 6 is a flowchart for explaining the information communication method of the ninth application example. Hereinafter, the processing procedure of the communication method of the application example 9 will be described with reference to the flowchart shown in FIG.

  The initial state is the tunnel connection establishment state (step S205) in FIG.

  First, an HTTP request “here (webserver.customr.co.jp/path/to/data.html)” is transmitted from an arbitrary web client to the external proxy server 105 and the internal proxy server 205 (step S301). In the following description, the external proxy server 105 and the internal proxy server 205 are simply referred to as “proxy servers” without being distinguished from each other.

  The proxy server receives HTTP requests from web clients, and separates the received HTTP requests into address information (webserver.customer.co.jp) and subsequent HTTP request bodies (path / to / data.html) In step S302, the HTTP request body is transmitted to the web server indicated by the address information (webserver.customer.co.jp) (step S303).

  The target web server receives the HTTP request body transmitted from the proxy server (step S304), generates an HTTP response corresponding to the HTTP request, and transmits it to the proxy server (step S305).

The proxy server receives the HTTP response transmitted from the web server (step S306), and inserts the web server address acquired in step S302 into the hyperlink portion in the received HTTP response. here,
<a href="path/to/data.html">… </a>
<a href="webserver.customer.co.jp/path/to/data.html"> ... </a>
And is transmitted to the web client (step S307).

  The web client receives and displays the HTTP response transmitted from the proxy server (step S308).

  When setting an external proxy server by the proxy setting function of the web client, normally only one external proxy server can be set. However, according to the application example 9, a plurality of external proxy servers can be set without depending on the proxy setting of the client. Can be selected. Moreover, it becomes possible to access via an external proxy server by clicking a hyperlink in the HTTP response on the web client, and the user operability can be improved.

<Application Example 10>
In this application example 10, the proxy server (internal proxy server and external proxy server) includes a first decryption key for decrypting the HTTP response generated and encrypted by the web server, and a first encryption key for encrypting the HTTP response. The web client is configured to hold a second decryption key for decrypting the HTTP response encrypted with the first encryption key in the proxy server. When the HTTP response is received from the web server, the proxy server decrypts the HTTP response with the first decryption key, modifies the hyperlink in the decrypted HTTP response, and then uses the first encryption key. While being encrypted and transmitted to the web client, the web server is configured to decrypt and display the received HTTP response with the second decryption key.

  FIG. 7 is a flowchart for explaining the information communication method of the tenth application example. Hereinafter, the processing procedure of the communication method of the application example 9 will be described with reference to the flowchart shown in FIG.

  The initial state is the tunnel connection establishment state (step S205) in FIG.

  First, an HTTP request (here, (webserver.customr.co.jp/path/to/data.html)) is transmitted from an arbitrary web client to the proxy server (step S401). At this time, the web client encrypts the HTTP request with the encryption key 1 at the time of transmission (step S402).

  When the proxy server receives the encrypted HTTP request from the web client, the proxy server decrypts the received HTTP request with the decryption key 1 corresponding to the encryption key 1, and converts the decrypted HTTP request into address information (webserver.customer .co.jp) and the subsequent HTTP request body (path / to / data.html) (step S403). Then, the HTTP request body is transmitted to the web client (target) indicated by the address information (webserver.customer.co.jp) (step S404). At this time, the proxy server encrypts the HTTP request body with the encryption key 2 at the time of transmission (step S405).

  The target web server receives the HTTP request body transmitted from the proxy server, and decrypts it with the decryption key 2 corresponding to the encryption key 2 (step S406). Then, an HTTP response corresponding to the decrypted HTTP request is generated and transmitted to the proxy server (step S407). At that time, the web server encrypts the HTTP response with the encryption key 3 (step S408).

The proxy server receives the HTTP response transmitted from the web server, and decrypts the received HTTP response with the decryption key 3 corresponding to the encryption key 3 (step S409). And the address of the web server acquired by step S403 is inserted in the hyperlink part in the decoded HTTP response. here,
<a href="path/to/data.html"> ... </a>
<a href="webserver.customer.co.jp/path/to/data.html"> ... </a>
And is transmitted to the web client (step S410). At that time, the proxy server encrypts with the encryption key 4 at the time of transmission (step S411).

  When receiving the HTTP response transmitted from the proxy server, the web client decrypts it with the decryption key 4 corresponding to the encryption key 4 and displays it (step S412).

  According to this application example 10, in the case of a response encrypted by SSL (Secire Socket Layer) or the like, the content is encrypted and cannot be modified, but once decrypted by registering the decryption key with the proxy server To clear text. In this state, it is possible to modify the hyperlink in the HTTP response, and the operability for the user is improved. Then, by re-encrypting the modified HTTP response and transmitting it to the web client, safety is ensured.

<Application Example 11>
In the application example 11, the external proxy server 105 includes a transfer destination information table 108 (see FIG. 8) storing addresses of web servers 211, 212,... Installed inside the firewall, an internal proxy server 205, Holds the address of another normal proxy server, and when an HTTP request is received from an arbitrary web client, it compares the content of the HTTP request with the content of the transfer destination information table, and sends it to the internal proxy server Or, it is usually configured to determine whether to transmit to a proxy server.

  That is, in the system configuration of FIG. 1, the external proxy server 105 and the internal proxy server 205 have a one-to-one correspondence. However, in this application example 11, as shown in FIG. In addition to the internal proxy server 205, a normal proxy server 305 is also connected, and a normal web server 311 is connected to the normal proxy server 305.

  For example, address data as shown in FIG. 9 is stored in the transfer destination information table 108 held by the external proxy server 105. Here, “host-1.local.domain.jp” is the address of the web server (target 1) 211, and “host-2.local.domain.jp” is the address of the web server (target 2) 212. Then, the external proxy server 105 compares the address of the HTTP request with the contents of the transfer destination information table 108, and if there is an address that matches the HTTP request destination address in the transfer destination information table 108, the external proxy server 105 Send a request. On the other hand, if there is no address that matches the HTTP request destination address in the transfer destination information table 108, the request is transmitted to the normal proxy server 305.

  As described above, according to the application example 11, the business to access the web server (target) inside the firewall and the business to access the other can be performed simultaneously without changing the proxy setting of the web client. .

It is a block diagram which shows the hardware structural example of the communication system for enforcing the information communication method of this invention. It is a flowchart for demonstrating the information communication method used as the basis of this invention. 12 is an explanatory diagram illustrating a configuration example of a connection permission table corresponding to Application Example 1. FIG. 12 is an explanatory diagram illustrating a configuration example of a connection prohibition table corresponding to application example 2. FIG. It is explanatory drawing which shows the structural example of the registration table of the connection start time and cutting | disconnection time corresponding to the application example 5. FIG. 10 is a flowchart for explaining an information communication method of application example 9; 10 is a flowchart for explaining an information communication method of application example 10. FIG. 25 is a block diagram illustrating a hardware configuration example of a communication system for performing an information communication method corresponding to Application Example 11. 22 is an explanatory diagram illustrating a configuration example of a transfer destination information table corresponding to Application Example 11. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Firewall 105 External proxy server 106 Ethernet 108 Transfer destination information table 111, 112, ... Web client 205 Internal proxy server 206 Ethernet 211, 212, ... Web server 305 Normal proxy server 311, ... Normal web server

Claims (13)

An information communication method in an information communication system in which an external proxy server and a web client are installed outside the firewall, and an internal proxy server and a web server are installed inside the firewall,
A first step of establishing a tunnel connection between the external proxy server and the internal proxy server;
After the tunnel connection is established, the web client connects to the external proxy server in response to a user operation, and transmits an HTTP request;
A third step in which the external proxy server receives an HTTP request from the web client and transmits it to the internal proxy server via the tunnel connection;
A fourth step in which the internal proxy server receives an HTTP request from the external proxy server and transmits the HTTP request to the web server;
A fifth step in which the web server returns an HTTP response corresponding to the HTTP request to the internal proxy server;
A sixth step in which the internal proxy server returns the HTTP response to the external proxy server;
And a seventh step in which the external proxy server returns an HTTP response to the web client. The information communication method according to claim 1,
In the internal proxy server, the address of the web server that permits connection in advance is recorded,
In the fourth step, only when the address of the HTTP request received from the external proxy server via the tunnel connection matches the permitted address recorded inside, the HTTP server receives the HTTP address of the matching address. The information communication method according to claim 1, wherein the request is transmitted. In the information communication method according to claim 1 or 2,
In the internal proxy server, the address of the web server that prohibits connection in advance is recorded,
In the fourth step, when the address of the HTTP request received from the external proxy server via the tunnel connection matches the prohibited address recorded inside, the transmission to the web server is not performed. An information communication method characterized by the above. In the information communication method according to any one of claims 1 to 3,
In the internal proxy server, a specific pattern indicating the address of the web server that prohibits or permits transmission is recorded in advance.
In the fourth step, if the HTTP request address pattern received from the external proxy server via the tunnel connection matches the prohibited or permitted address pattern recorded inside, the matched pattern An information communication method characterized by prohibiting or permitting transmission of an address to a web server. In the information communication method according to any one of claims 1 to 4,
The internal proxy server includes a step of detecting that the tunnel connection is disconnected other than a normal disconnection operation,
An information communication method characterized by re-establishing a tunnel connection when it is detected that the tunnel connection is disconnected by a method other than a normal disconnection operation. In the information communication method according to any one of claims 1 to 5,
In the internal proxy server, information of a tunnel connection start time and a tunnel connection disconnection time is recorded,
In the first step, a tunnel connection with the external proxy server is established at the tunnel connection start time, and the tunnel connection is disconnected at the tunnel connection disconnect time. The information communication method according to any one of claims 1 to 6,
In the third step, the external proxy server encrypts an HTTP request from a web client, sends the encrypted HTTP request to the internal proxy server,
In the fourth step, the internal proxy server decrypts the received HTTP request, transmits the decrypted HTTP request to the web server,
In the fifth step, the internal proxy server encrypts an HTTP response from a web server, transmits the encrypted HTTP response to the external proxy server,
In the sixth step, the external proxy server decrypts the encrypted HTTP response and transmits the decrypted HTTP response to the web client. The information communication method according to any one of claims 1 to 7,
The internal proxy server holds in advance a key corresponding to the identifier of the external proxy server;
In the first step, when the internal proxy server establishes a tunnel connection, the internal proxy server receives a key corresponding to the identifier of the external proxy server from the external proxy server, and receives the received key and a previously held key. An information communication method comprising: comparing, and permitting establishment of a tunnel connection when a comparison result matches. The information communication method according to any one of claims 1 to 8,
The external proxy server holds in advance a key corresponding to the identifier of the internal proxy server that requests connection;
In the first step, when the external proxy server establishes a tunnel connection, the external proxy server receives a key corresponding to the identifier of the internal proxy server from the internal proxy server, and receives the received key and a previously held key. An information communication method characterized in that, when the comparison results match, establishment of a tunnel connection is permitted. The information communication method according to any one of claims 1 to 9,
The external proxy server analyzes an HTTP request from a web client and uses a part of the HTTP request as address designation inside the firewall. The information communication method according to claim 10,
The proxy server analyzes an HTTP response received from a web server, and adds the address of the web server to a hyperlink portion in the HTTP response. The information communication method according to claim 11,
The proxy server holds a decryption key for decrypting the encrypted HTTP response generated by the web server, and a first encryption key for encrypting the HTTP response,
The web client holds a first decryption key for decrypting an HTTP response encrypted with the first encryption key in the proxy server;
When an HTTP response is received from the web server, the HTTP response is decrypted with the decryption key, a hyperlink in the decrypted HTTP response is modified, and then encrypted with the first encryption key to be a web client Sending to
A method in which the web server decrypts and displays the received HTTP response with the second decryption key. The information communication method according to any one of claims 1 to 12,
The external proxy server holds a transfer destination information table storing the address of a web server installed inside the firewall, and an address of a normal proxy server different from the internal proxy server,
In the third step, when an HTTP request is received, whether the content is transmitted to the internal proxy server or to the normal proxy server by comparing the content of the HTTP request with the content of the transfer destination information table Determining an information communication method.

Images