Patent Application
20090019523
This patent application is based on and claims priority under 35 U.S.C. § 119 to Japanese Patent Application No. 2007-159009, filed on Jun. 15, 2007, in the Japanese Patent Office, the disclosure of which is hereby incorporated by reference.
Example embodiments of the present invention include an apparatus, method, system, and computer program and product, each capable of controlling network communications.
In a network system based on a server-client model, a server apparatus sends a response to a request received from a client apparatus through a network. For example, the client may send the request in the form of uniform resource locator (URL), which indicates the location of a desired resource on the network. The URL mainly includes a scheme name defining the type of the desired resource, a host name identifying a server apparatus providing the desired resource, and a path name specifying the location of a html document in the server apparatus. The scheme name of the URL may be generally referred to as a communication protocol such as Hypertext Transfer Protocol (HTTP) or file transfer protocol (FTP), as the scheme name is designed to be used with a specific protocol.
In order to securely exchange data over the network, various techniques of controlling network communications have been applied, for example, as described in the Japanese Patent Application Publication No. 2001-298449, or the Japanese Application Patent No. 3796496. In another example, the server apparatus may change the host name of the URL, which may be provided by the client apparatus, to the host name of another server apparatus.
Alternatively, in order to securely exchange data over the network, the server apparatus may change the scheme name of the URL, or the communication protocol, which may be provided by the client apparatus. For example, the server apparatus may automatically switch the communication protocol from HTTP to Hypertext Transfer Protocol over Secure Socket Layer (HTTPS).
Referring to
Still referring to
The URL generator 66 refers to the security settings table 67 to generate an URL using HTTPS. The URL being generated is sent to the web browser of the client apparatus 50 with the 302 error code. The client apparatus 50 sends a request to the server apparatus 60 with the URL being received from the server apparatus 60. When the request is received from the client apparatus 50 through the httpd 61, libhttp 62, libgwww 63, and libacacia 64, the WPF 65 of the server apparatus 60 generates a html document according to the request, and sends the html document to the client apparatus 50 via the network. The web browser of the client apparatus 50 analyzes the html document, and displays the contents of the html document to the user.
Recently, the server apparatus may be provided with a plurality of IP addresses each providing a different level of security. In such case, if the client apparatus specifies the server apparatus by its host name as described above referring to
Alternatively, the client apparatus may access the server apparatus with the IP address, which may be used for the previous communication. However, the IP address previously used may not be the IP address that satisfies the desired security level of network communications.
Even when the IP address previously used satisfies the desired security level, there is no guarantee that such IP address will be used every time the client apparatus communicates with the server apparatus.
Further, the security level of network communications may be affected by various other factors. For example, the IP security (IPsec), which is a suite of protocols for securing network communications, may improve the security level of network communications when implemented.
The server apparatus may refuse to communicate with the client apparatus when the client apparatus accesses the server apparatus with the IP address providing the security level lower than the desired security level or when the client apparatus accesses the server apparatus using a connection method not desired. In such case, the user may need to search for an IP address or a connection method that satisfies the desired security level. This may decrease the usability of the network system.
In view of the above-described and other limitations, example embodiments of the present invention provide a technique of establishing communication between a server apparatus and a client apparatus in a manner that satisfies a desired security level of network communications.
Example embodiments of the present invention include a communication apparatus coupled to a counterpart apparatus via a network. The communication apparatus includes a network interface and a network controller. The network interface receives a request generated by the counterpart apparatus, which includes address information regarding an address currently used for communication between the communication apparatus and the counterpart apparatus. The network controller determines whether the address information obtainable from the request satisfies a desired security level specified by settings information to generate a determination result, obtain a desired address that satisfies the desired security level when the determination result indicates that the address information does not satisfy the desired security level, and send a response including address information regarding the desired address being obtained to the counterpart apparatus
Example embodiments of the present invention include a communication control method of controlling communication between a communication apparatus and a counterpart apparatus, which may be performed by the communication apparatus. The communication control method includes: receiving a request generated by the counterpart apparatus, the request including address information regarding an address currently used for communication between the communication apparatus and the counterpart apparatus; determining whether the address information obtainable from the request satisfies a desired security level specified by settings information to generate a determination result; obtaining a desired address that satisfies the desired security level when the determination result indicates that the address information does not satisfy the desired security level; and sending a response to the counterpart apparatus, the response including address information regarding the desired address being obtained.
Example embodiments of the present invention include a communication system including a server apparatus and a client apparatus that are communicable via a network. The client apparatus generates a request including address information regarding an address currently used for communication with the server apparatus. When the request is received, the server apparatus determines whether the address information obtainable from the request satisfies a desired security level specified by settings information to generate a determination result. The server apparatus obtains a desired address that satisfies the desired security level when the determination result indicates that the address information does not satisfy the desired security level, and sends a response to the client apparatus, which includes address information regarding the desired address being obtained. When the response is received, the client apparatus sends a request including the address information regarding the desired address.
The above-described communication system may additionally include a DNS server, which may be coupled to the server apparatus via the network. The DNS server may send one or more client addresses to the server apparatus. The server apparatus may select a desired client address from the one or more client addresses obtained from the DNS server, and use the selected address as the desired address.
Example embodiments of the present invention include a computer readable recording medium including computer program instructions which cause a communication apparatus to execute a communication control method of controlling communication between the communication apparatus and a counterpart apparatus. The communication control method includes: receiving a request generated by the counterpart apparatus, the request including address information regarding an address currently used for communication between the communication apparatus and the counterpart apparatus; determining whether the address information obtainable from the request satisfies a desired security level specified by settings information to generate a determination result; obtaining a desired address that satisfies the desired security level when the determination result indicates that the address information does not satisfy the desired security level; and sending a response to the counterpart apparatus, the response including address information regarding the desired address being obtained.
In addition to the above-described example embodiments, the present invention may be practiced in various other ways.
A more complete appreciation of the disclosure and many of the attendant advantages and features thereof can be readily obtained and understood from the following detailed description with reference to the accompanying drawings, wherein:
The accompanying drawings are intended to depict example embodiments of the present invention and should not be interpreted to limit the scope thereof. The accompanying drawings are not to be considered as drawn to scale unless explicitly noted.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the present invention. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “includes” and/or “including”, when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
In describing example embodiments shown in the drawings, specific terminology is employed for the sake of clarity. However, the present disclosure is not intended to be limited to the specific terminology so selected and it is to be understood that each specific element includes all technical equivalents that operate in a similar manner. Referring now to the drawings, wherein like reference numerals designate identical or corresponding parts throughout the several views,
The network system of
For example, when the first router 13 provides the prefix information, which may be expressed as “2001:1:2:3::/64”, respectively to the server apparatus 10 and the client apparatus 11, the server apparatus 10 and the client apparatus 11 may be respectively assigned with the IP address of “2001:1:2:3::2” and the IP address of “2001:1:2:3::3”. When the second router 14 provides the prefix information, which may be expressed as “2001:1:2:5::/64”, respectively to the server apparatus 10 and the client apparatus 11, the server apparatus 10 and the client apparatus 11 may be respectively assigned with the IP address of “2001:1:2:5::2” and the IP address of “2001:1:2:5::3”. The DNS server 12 stores one or more IP addresses for each one of the server apparatus 10 and the client apparatus 11. In the example case described above, the DNS server 12 may store the IP address “2001:1:2:3::2” and the IP address “2001:1:2:5::2” as the registered address of the server apparatus 10. The DNS server 12 may store the IP address “2001:1:2:3::3” and the IP address “2001:1:2:5::3” as the registered address of the client apparatus 11.
Alternatively, the server apparatus 10 and the client apparatus 11 may be each provided with more than two IP addresses depending on the configuration of the network system and/or the apparatus. In another example, any one of the server apparatus 10 and the client apparatus 11 may be provided with more than one network interfaces, each of which may be assigned with a specific IP address.
Further, in this example, the server apparatus 10 may store settings information, which may be previously set by default or according to the user preference. In one example, the settings information may include information regarding an address to be used for communication between the server apparatus 10 and the client apparatus 11, such as a version of an IP address to be used for the server apparatus 10 or the client apparatus 11. In another example, the settings information may include information regarding a connection method to be used between the server apparatus 10 and the client apparatus 11, such as whether the use of IPsec communication is preferred or required. In another example, the settings information may include information indicating whether changing of an address or a connection method, each of which may be used for communication between the server apparatus 10 and the client apparatus 11, is allowed or prohibited. As described below, the settings information may be used to manage the security level of network communications such that the server apparatus 10 and the client apparatus 11 communicate with each other while satisfying the desired security level.
In one example, when the server apparatus 10 receives a request from the client apparatus 11, the server apparatus 10 determines whether an address obtainable from the request satisfies the desired security level specified by the settings information stored in the server apparatus 10. In this example, the address obtainable from the request may correspond to an address to be used for communication between the server apparatus 10 and the client apparatus 11, such as an IP address of the server apparatus 10 (“the server IP address”), and/or an IP address of the client apparatus 11 (“the client IP address”). When it is determined that the address obtainable from the request does not satisfy the desired security level, the server apparatus 10 may search for a desired address, such as a desired server IP address and/or a desired client IP address, that satisfies the desired security level. In one examples the server apparatus 10 may search through a plurality of addresses stored in the server apparatus 10. In another example, the server apparatus 10 may request the DNS server 12 to perform name resolution to obtain one or more addresses, and return the obtained addresses to the server apparatus 10. When the desired address that satisfies the desired security level is found, the server apparatus 10 generates an URL specifying the desired address being obtained, and sends a response including the URL to the client apparatus 11. The client apparatus 11 may automatically send a request with the URL obtained from the server apparatus 10. The desired address being obtained may be stored in any one of the server apparatus 10 and the client apparatus 11 for later use. The above-described operation of changing the address or connection method may be performed, for example, when the settings information indicates that changing of the address or connection method is allowed.
In another example, when the server apparatus 10 receives a request from the client apparatus 11, the server apparatus 10 determines whether an address obtainable from the request satisfies the desired security level specified by the settings information stored in the server apparatus 10. When it is determined that the address obtainable from the request does not satisfy the desired security level, the server apparatus 10 may send a response with the error code to the client apparatus 11, such as the 404 error code which indicates that the requested page is not found. The above-described operation of prohibiting access from the client apparatus 11 may be performed, for example, when the settings information indicates that changing of the address or connection method is prohibited.
In order to perform one or more functions described above or below, the server apparatus 10 may have a software structure, which includes an application 100, user interface (I/F) 110, network controller 120, and operation system (OS) 130 including a network protocol 131 and a network communication driver 132, for example, as illustrated in
Referring now to
The server apparatus 10 of
The URL generator 20 of the server apparatus 10 determines whether an IP address obtainable from the request generated by the client apparatus 11 satisfies the desired security level specified by the settings information, which may be obtainable, for example, from the security settings table 21. When it is determined that the IP address obtained from the request does not satisfy the desired security level, the URL generator 20 searches for a desired IP address that satisfies the desired security level, for example, using information obtainable from any one of the local address table 23, secure address settings table 22, and DNS server 12. When the desired IP address is obtained, the URL generator 20 generates an URL including information regarding the desired IP address, and sends a response that requests the client apparatus 11 to send a request using the URL including information regarding the desired IP address being obtained. In this example, the URL generator 20 includes an address version converter 29, a secure settings request obtainer 30, and a secure address obtainer 31.
The security settings table 21 stores settings information, such as various parameters specifying the security level of communication between the server apparatus 10 and the client apparatus 11. As illustrated in
The secure address settings table 22 stores information regarding the settings of secure communication using IPsec. As illustrated in
The local address table 23 stores information regarding one or more server IP addresses available for use by the server apparatus 10. In this example, as illustrated in
The server apparatus 10 of
In example operation, when a request is received from the client apparatus 11, the httpd 24 of the server apparatus 10 receives the request, and sends the request to the URL generator 20 through the libhttp 25, libgwww 26, and libacacia 27. In response to the request, the WPF 28 may generate a html document according to the request sent from the client apparatus 11, and sends the html document to the client apparatus 11 through the libacacia 27, libgwww 26, libhttp 25, and httpd 24.
Referring to
At S901, a web browser of the client apparatus 11 is requested by the user through the user I/F 110 (
At S902, the libhttp 25 analyzes the contents of the request. For example, from the header portion of the request shown in
Based on the analysis made by the libhttp 25, at S903, the libgwww 26 sends the request to a module capable of processing the request, such as the libacacia 27.
At S904, the libacacia 27 may apply common processing such as log-in management or data conversion. Further, in this example, at S905, the libacacia 27 may refer to security settings information stored in the security settings table 21 to determine whether the security level needs to be managed for the server apparatus 10. When the security settings information indicates that security management is necessary, at S906, the libacacia 27 requests the URL generator 20 to determine whether the IP address being obtained from the request satisfies the desired security level specified by the settings information stored in the security settings table 21. In this example, at S906, the libacacia 27 may request the URL generator 20 to generate a URL including the desired address that satisfies the desired security level.
At S907, the URL generator 20 refers to the security settings table 21 to determine the security level specified by the security settings information. At S908, the URL generator 20 may obtain, from the local address table 23, a plurality of server IP addresses available for use by the server apparatus 10. The URL generator 20 determines whether any one of the plurality of server IP addresses being obtained satisfies the desired security level specified by the security settings information. Based on the determination result, the URL generator 20 may select one or more server IP addresses each satisfying the desired security level.
Further, at S909, the URL generator 20 may request the DNS server 12 to obtain a plurality of client IP addresses each corresponding to the client apparatus 11.
At S910, the URL generator 20 may obtain the desired IP address to be assigned to the server apparatus 10 and the desired IP address to be assigned to the client apparatus 11, for example, by using the information stored in the secure address settings table 22.
At S911, the URL generator 20 generates a URL including the desired IP addresses of the server apparatus 10 and the client apparatus 11, and sends the URL with the 302 error code. At S912, the client apparatus 11 sends a request using the URL being obtained from the server apparatus 10 to the server apparatus 10. For example, when the desired IP address of 1234.1234.222 is obtained for the server apparatus 10, the client apparatus 11 accesses the server apparatus 10 with the IP address of 1234.1234.222.
The request received by the httpd 24 is sent to the libacacia 27 in a substantially similar manner as described above referring to S902, S903, and S904. Further, at S913, the libacacia 27 may determine whether security management is necessary in a substantially similar manner as described above referring to S905. When it is determined that security management is necessary, at S914, the libacacia 27 requests the URL generator 20 to check for the IP address being obtained from the request in a substantially similar manner as described above referring to S906. At S915, the URL generator 20 determines whether the IP address obtained from the request satisfies the desired security level by referring to the security settings information stored in the security settings table 21 in a substantially similar manner as described above referring to S907. When it is determined that the IP address obtained from the request satisfies the desired security level, at S916, the libacacia 27 requests the WPF 28 to generate a html document according to the request. At S917, the html document is sent from the WPF 28 to the client apparatus 11 through the libacacia 27, libgwww 26, libhttp 25, and httpd 24.
As described above, the server apparatus 10 sends a resource requested by the client apparatus 11 only when the security level of communication between the server apparatus 10 and the client apparatus 11 satisfies the desired security level previously set. Further, when it is determined that the means for communication, such as the address or connection method, needs to be changed to satisfy the desired security level, the server apparatus 10 may automatically change the means for communication, for example, by obtaining a desired address to be used for communication, without the need for human intervention.
The operation of
Referring now to
S1001 refers to the local address table 23, for example, the local address table 23 shown in
S1002 generates a search table using information stored in the local address table 23 and information stored in the secure address settings table 22. In this example, the search table may be generated for temporary use by the URL generator 20 for the purpose of obtaining the desired server IP address and/or the desired client IP address. For example, the URL generator 20 may generate a search table illustrated in
Referring back to
S1006 determines whether the determination result of S1003 indicates that the address version needs to be changed from the version 4 to the version 6. When it is determined that the address version needs to be changed from the version 4 to the version 6 at S1006 (“YES” at S1006), the operation proceeds to S1007. At S1007, information regarding the IP address having the version number of 4 is deleted from the search table, thus leaving only information regarding the IP address having the version number of 6.
When it is determined that the address version does not need to be changed from the version 4 to the version 6 at S1006 (“NO” at S1006), the operation proceeds to S1008. S1008 determines whether the determination result of S1003 indicates that the address version needs to be changed from the version 6 to the version 4. When it is determined that the address version needs to be changed from the version 6 to the version 4 at S1008 (“YES” at S1008), the operation proceeds to S1009. At S1009, information regarding the IP address having the version number of 6 is deleted from the search table, thus leaving only information regarding the IP address having the version number of 4. When it is determined that the address version does not need to be changed from the version 6 to the version 4 at S1008 (“NO” at S1008), the operation proceeds to S1010 to determine that no change is required.
S1011 determines whether the connection method currently used between the server apparatus 10 and the client apparatus 11 needs to be changed. For example, whether the use of IPsec communication is required or preferred may be determined. For example, the secure settings request obtainer 30 of
Referring to
S1013 determines whether the determination result of S1011 indicates that the connection method needs to be changed according to the settings information. When it is determined that the connection method needs to be changed at S1013 (“YES” at S1013), the operation proceeds to S1014 to obtain a desired IP address that uses the connection method satisfying the settings information. For example, the secure address obtainer 31 of
When it is determined that the connection method does not need to be changed at S1013 (“NO” at S1013), the operation proceeds to S1015.
S1015 generates a search result table, which includes one or more IP addresses obtained as a desired IP address. For example, the search result table shown in
The search result table of
S1016 determines whether any desired IP address is obtained that satisfies the security level specified by the security settings information. When it is determined that no desired IP address is obtained at S1016 (“NO” at S1016), the operation proceeds to S1005 to return the “404 Not Found error” to the client apparatus 11. When it is determined that the desired IP address is obtained at S1016 (“YES” at S1016), the operation proceeds to S1017.
S1017 determines whether the desired IP address is the same as the IP address obtained from the request. When it is determined that the desired IP address is the same as the IP address obtained from the request (“YES” at S1017), the operation determines that no error needs to be returned to the client apparatus 11 at S1018, and the operation ends. In such case, the URL including information regarding the desired address is not generated.
When it is determined that the desired IP address is different from the IP address obtained from the request (“NO” at S1017), the operation proceeds to S1019 to generate a URL including information regarding the desired IP address obtained at S1015. For example, the URL may include the IP address of “1234:1234::222”. S1020 returns the URL generated at S1019 with the “302 error” code to the client apparatus 11, and the operation ends. The client apparatus 11 may send a request using the URL being received from the server apparatus 10.
Further, the client apparatus 11 may store information regarding the desired address obtained by the server apparatus 10. Once the information regarding the desired IP address to be used for communication is stored, the client apparatus 11 may access the server apparatus 10 using the desired IP address.
Alternatively, the server apparatus 10 may store information regarding the desired address being obtained. Once the information regarding the desired IP address is stored, the server apparatus 10 may use such information to establish communication with the client apparatus 11 in a manner that satisfies the desired security level, even when a request sent from the client apparatus 11 contains no information regarding the desired address. For example, the client apparatus 11 may access the server apparatus 10 using a relative URL rather than a full URL to request a html document on the server apparatus 10. In another example, the client apparatus 11 may access the server apparatus 10 by specifying a host name of the server apparatus 10.
In this manner, the server apparatus 10 and the client apparatus 11 are able to always communicate in a manner that satisfies the desired security level. For example, as described above or below, the server apparatus 10 may obtain a desired IP address that satisfies the desired security level specified by the settings information, and cause the client apparatus 11 to communicate using the desired IP address. Since the security level is kept at the desired level, flow of the contents or information through the network may be easily managed, for example, by restricting access to the entire webpage or a selected webpage according to the desired security level. Further, since operation of obtaining the desired address may be automatically performed without human intervention, usability of the system may be kept relatively high.
Referring now to
S1201 analyzes the request received from the client apparatus 11 to obtain the version of an IP address currently used for communication between the server apparatus 10 and the client apparatus 11. More specifically, from the request received from the client apparatus 11, the URL generator 20 obtains the version of an IP address of the server apparatus 10 and the version of an IP address of the client apparatus 11. In this example, it is assumed that the IP addresses of the server apparatus 10 and the client apparatus 11 both have the version number of 4. The IPv4 address has a 32 bit address field, while the IPv6 address has a 128 bit address field with the security function.
S1202 refers to the security settings table 21 to obtain information indicating whether the version obtained at S1201 satisfies the desired security level. In this example, since it is assumed that the version of the IP address is 4, the “web version” information indicating whether IPv4 is opened or closed is obtained.
S1203 determines whether the version of the IP address obtained at S1201 satisfies the desired security level specified by the settings information, by referring to the “web version” information obtained at S1202. When it is determined that the “web version” information is open indicating that the version 4 is allowed (“YES” at S1203), the operation proceeds to S1204 to determine that no change in address version is necessary. When it is determined that the “web version” information is closed indicating that the version 4 is not allowed (“NO” at S1203), the operation proceeds to S1205.
S1205 refers to the security settings table 21 to obtain information indicating whether the forward option is selected such that the version of the IP address may be changed, for example, by referring to the “Web address version forward option” information. S1206 determines whether information obtained at S1205 indicates that the forward option is selected. When it is determined that the forward option is selected (“YES” at S1206), the operation proceeds to S1208. When it is determined that the forward option is not selected (“NO” at S1206), the operation proceeds to S1207 to return the “404 Not Found” error to the client apparatus 11.
S1208 refers to the security settings table 21 to obtain information indicating whether the version other than the version of the address obtained from the request satisfies the desired security level. In this example, it is assumed that the version 4 will be changed to the version 6, and the “web version” information indicating whether IPv6 is opened or closed is obtained.
S1209 determines whether the version of the IP address other than the version 4, specifically, the version 6, satisfies the desired security level specified by the settings information, by referring to the “web version” information obtained at S1208. When it is determined that the “web version” information indicates that the IPv6 is open (“YES” at S1209), the operation proceeds to S1210 to determine that the version of the address is changed from the version 4 to the version 6, and further to S1211 to return the determination result indicating that the version needs to be changed from the version 4 to 6. In such case, error is not returned. When it is determined that the “web version” information indicates that the IPv6 is closed (“NO” at S1209), the operation proceeds to S1207 to return the “404 Not Found error” to the client apparatus 11.
As the version of IP address may be easily changed according to the settings information, the security level of network communication, which may vary depending on the version of address, may be easily managed. For example, the settings information may be set so as to require the use of IP address having the version 6. This may simplify management of each apparatus or management of resource stored in each apparatus, as a part of the IPv6 address such as the interface ID may be generally derived from a MAC address of a host apparatus.
Referring now to
IPsec, which is a suite of protocols for securing network communications by authenticating and/or encrypting an IP packet, operates at the network layer, which is the layer 3 of the OSI model having seven layers. Compared to the other security protocols such as SSL, which operates at the layer higher than the layer 3, IPsec may be used to protect layer 4 protocols such as TCP or UDP.
Further, the security level of IPsec communication may be set with respect to each one of a plurality of client apparatuses, for example, when the server apparatus communicates with the plurality of client apparatuses.
In this example, the server apparatus 10 and the client apparatus 11 may each be provided with one or more IP addresses previously set to use IPsec communication and one or more IP addresses previously set no to use IPsec communication. By switching between the IP address using IPsec communication and the IP address not using IPsec communication, the security level of communication between the server apparatus 10 and the client apparatus 11 may be switched, for example, between secure communication using IPsec and unsecure communication not using IPsec. For improved security, the settings information may be set so as to require or recommend the use of IPsec communication, thus protecting the contents or information stored in the server apparatus 10.
S1301 analyzes the request received from the client apparatus 11 to obtain an IP address of the client apparatus 11.
S1302 refers to the secure address settings table 22, which stores information regarding the settings of IPsec communication.
S1303 obtains information regarding the connection method currently used by the client apparatus 11 to communicate with the server apparatus 10. For example, referring to
S1304 refers to the security settings table 21 of
S1305 determines whether the IPsec option information, obtained at S1304, indicates that the use of IPsec communication is required. Referring back to
S1309 searches a desired IP address that uses IPsec communication from the search table of
S1310 determines whether the desired IP address that uses IPsec communication is found at S1309. When it is determined that the desired IP address using IPsec communication is found (“YES” at S1310), it is determined that the current IP address will be changed to the desired IP address that uses IPsec communication, and the operation proceeds to S1308 to successfully end the operation without error. When it is determined that the desired IP address using IPsec communication is not found (“NO” at S1310), the operation proceeds to S1311 to end the operation with error.
At S1305, when it is determined that the use of IPsec communication is not required (“NO” at S1305), the operation proceeds to S1313 to determine whether the use of IPsec communication is preferred by referring to the IPsec option information obtained at S1304. Referring back to
S1316 searches a desired IP address that uses IPsec communication from the search table of
At S1313, when it is determined that the use of IPsec communication is not preferred (“NO” at S1313), the operation proceeds to S1317 to determine whether either one of IPsec communication and non-IPsec communication is recommended for use. Referring back to
In this manner as described above referring to
Referring to
S1501 analyzes the request received from the client apparatus 11 to obtain an IP address of the client apparatus 11.
S1502 obtains a host name corresponding to the IP address of the client apparatus 11, for example, by sending the request for name resolution to the DNS server 12.
S1503 requests the DNS sever 12 to obtain a list of a plurality of IP addresses each corresponding to the client apparatus 11.
S1504 selects one of the plurality of IP addresses from the list as a selected client IP address.
S1505 determines whether the selected client IP address is stored in the security address settings table 22. When it is determined that the selected client IP address is not found in the security address settings table 22 (“NO” at S1505), the operation proceeds to S1507. When it is determined that the selected client IP address is stored in the security address settings table 22 (“YES” at S1505), the operation proceeds to S1506 to add information regarding the selected client IP address to the search result table.
S1507 determines whether all client IP addresses in the list have been considered. When it is determined that all client IP addresses have not been considered (“NO” at S1507), the operation returns to S1504 to select the client IP address that has not been selected as a selected client IP address. When it is determined that all client IP addresses have been considered (“YES” at S1507), the operation proceeds to S1508.
S1508 obtains information regarding the security level comparing function, which may be provided by the server apparatus 10. The security level comparing function is a function to select a desired IP address, for example, according to the level of security. The security level comparing function may be described below, for example, referring to
S1509 determines whether the security level comparing function is available for use. When it is determined that the security level comparing function is not available (“NO” at S1508), the operation proceeds to S1510 to select the client IP address firstly obtained from the search result table as a desired IP address, and the operation ends.
When it is determined that the security level comparing function is available (“YES” at S1508), the operation proceeds to S1511 to compare the security level of at least two IP addresses obtainable from the search result table. For example, the IP address listed first in the table and the IP address listed second in the table may be compared to determine one of the IP addresses having higher security level. The IP address being obtained as having higher security level is then compared with the IP address listed third in the table to determine one of the IP addresses having higher security level. By repeating this operation, the IP address having the highest security level may be selected from the search result table. With this selected IP address having the highest security level, the security level of network communications may be further improved.
S1512 selects the client IP address having the highest security level, which is obtained at S1511, as a desired IP address, and the operation ends.
Referring now to
The security policy storage 221 stores security policy information, which may be set by the user through the user I/F 210. The network controller 220 controls communication according to the security policy information stored in the security policy storage 221. For example, referring to
The log data storage 222 stores log data, which may be obtained as information regarding previous communication performed by the server apparatus 10. For example, referring to
Still referring to
In this example, the third log data may be obtained when one of the first and second routers 13 and 14 shown in
With the log data being stored, the user may be able to obtain information regarding previous communication, such as information regarding the use of IPsec communication or the priority order of security policy being used. Based on the information being obtained, the user may be able to review the settings information to determine whether the settings information is set so as to satisfy the actual need of the user. Further, the user may be able to detect an error which may be caused by the device, such as the router.
Further, in this example, the log data storage 222 may store a warning table, such as a warning table shown in
As illustrated in
At S1703, the DNS server 12 sends a list of a plurality of client IP addresses each corresponding to the host name “hostA” to the network controller 220 through the OS 230 via the network 15.
At S1705, the network controller 220 selects one of the plurality of client IP addresses from the list as a desired client IP address. At S1707, the network controller 220 sends the desired client IP address to the application 200.
At S1709, the application 200 of the server apparatus 10 communicates with the client apparatus 11 with the desired client IP address.
Referring to
At S2101, the application 200 sends a name resolution request to the DNS server 12, which requests the DNS server 12 to obtain one or more client IP addresses corresponding to the host name of the client apparatus 11. The DNS server 12 returns a list of a plurality of client IP addresses to the server apparatus 10.
At S2102, the network controller 220 obtains the list of the plurality of client IP addresses from the DNS server 12.
At S2103, the network controller 220 selects one of the plurality of client IP addresses from the list, and sends the selected client IP address to the application 200 as a desired client IP address.
At S2104, the application 200 communicates with the client apparatus 11 using the desired client IP address, and the operation ends.
Referring to
At S2201, the application 200 sends a name resolution request to the DNS server 12, which requests the DNS server 12 to obtain one or more client IP addresses corresponding to the host name of the client apparatus 11. The DNS server 12 returns a list of a plurality of client IP addresses to the server apparatus 10.
At S2202, the network controller 220 obtains the list of the plurality of client IP addresses from the DNS server 12.
At S2203, the network controller 220 selects one of the plurality of client IP addresses from the list, and sends the selected client IP address to the application 200 as a desired client IP address.
At S2204, the log data storage 222 stores various information including, for example, time, host name, security policy priority order, IPsec communication settings, selected IP address, and the list of IP addresses obtained from the DNS server 12, as log data.
At S2205, the application 200 communicates with the client apparatus 11 using the desired client IP address, and the operation ends.
Referring to
At S2301, the application 200 sends a name resolution request to the DNS server 12, which requests the DNS server 12 to obtain one or more client IP addresses corresponding to the host name of the client apparatus 11. The DNS server 12 returns a list of the plurality of client IP addresses to the server apparatus 10.
At S2302, the network controller 220 obtains the list of the plurality of client IP addresses from the DNS server 12.
At S2303, the network controller 220 selects one of the client IP addresses from the list, and sends the selected client IP address to the application 200 as a desired client IP address.
At S2304, the network controller 220 determines whether the selection of the desired client IP address made at S2303 is subjected to warning. When it is determined that the selection of S2303 is subjected to warning (“YES” at S2304), the operation proceeds to S2305 to output warning. When it is determined that the selection of S2303 is not subjected to warning (“NO” at S2304), the operation proceeds to S2306 without outputting warning.
In one example, the user I/F 210 may cause a display 107 (
At S2306, the application 200 communicates with the client apparatus 11 using the desired client IP address, and the operation ends.
Referring to
S2401 initializes the setting of the desired client IP address A, and the setting of the security policy priority order B that corresponds to the desired client IP address A.
S2402 obtains a plurality of client IP addresses A1 to Am from the DNS server 12, for example, by sending a name resolution request as described above.
S2403 selects one client IP address Ax from the plurality of client IP addresses A1 to Am.
S2404 determines a priority order y, which is assigned to the selected client IP address Ax, for example, as described below referring to
S2405 determines whether the desired client IP address A has been set. When it is determined that the desired client IP address A has not been set, the operation proceeds to S2406 to set the desired client IP address A to the selected client IP address Ax. Alternatively, when the priority order B has been set, S2405 may determine whether the numerical value indicated by the priority order y of the selected client IP address Ax is less than the numerical value indicated by the priority order B. When it is determined that the numerical value of the priority order y is less than the numerical value of the priority order B, the operation proceeds to S2406 to set the priority order B to be equal to the numerical value of the priority order y.
S2407 determines whether the priority order B is equal to 1, or the value of the priority order indicating the highest security level. When it is determined that the priority order B is not equal to 1 (“NO” at S2407), the operation proceeds to S2408 to determine whether the selected client IP address Ax is equal to the client IP address Am, which is considered last. When it is determined that the selected client IP address Ax is not equal to the client IP address Am (“NO” at S2408), the operation proceeds to S2409 to select a next client IP address from the plurality of client IP addresses, and returns to S2404. When it is determined that the priority order B is equal to 1 (“YES” at S2407), the operation proceeds to S2410 to set the desired client IP address A to be equal to the selected client IP address Ax, and the operation ends.
At S2408, when it is determined that the client IP address Ax is equal to the client IP address Am (“YES” at S2408), the operation proceeds to S2410 to select the client IP address Ax as a desired client IP address, and the operation ends.
Referring to
S2501 reads out security policy information from the security policy storage 221 for each one of the security policy priority orders 1 to n.
S2502 selects one of the priority orders 1 to n, in the order from 1 to n, as a selected priority order z, and obtains security policy information regarding the selected priority order z. For the descriptive purpose, the security policy information for the security policy priority order z may be referred to as the security policy information SPz, with z being equal to 1 to n.
S2503 determines whether the client IP address Ax, which is obtained at S2403 of
S2505 determines whether the security policy information SPz is equal to the security policy information SPn, which will be considered last. When it is determined that the security policy information SPz is not equal to the security policy information SPn (“NO” at S2505), the operation proceeds to S2506 to select security policy information SPz+1, which is to be considered next, and further to S2503 to determine whether the selected IP address Ax matches the IP address specified by the security policy information SPz+1.
When it is determined that the security policy information SPz is equal to the security policy information SPn (“YES” at S2505), the priority order y is set to n+1, and the operation ends.
As described above referring to
For example, when all or at least two IP addresses obtained from the DNS server 12 have different security levels, the server apparatus 10 may select the IP address having the highest security level.
In another example, when all or at least two IP addresses obtained from the DNS server 12 have the same security levels, the server apparatus 10 may select the IP address firstly obtained.
By combining the above-described selection methods, the desired address that satisfies the desired security level may be obtained more efficiently, with reduced processing time.
Referring now to
S2601 refers to the warning table stored in the log data storage 222, such as the warning table of
S2602 determines whether any information regarding the client apparatus 11 is found in the warning table of
At S2602, when it is determined that information regarding the client apparatus 11 is found in the warning table (“YES” at S2602), the operation proceeds to S2605 to determine whether the found information regarding the client apparatus 11 indicates that IPsec communication is used. When it is determined that the found information does not indicate the use of IPsec communication (“NO” at S2605), the operation proceeds to S2606 to update information stored in the warning table with the information regarding the communication to be performed using the desired address. The operation further proceeds to S2604 to determine that the selection of IP address is not subjected to warning, and the operation ends.
When it is determined that the found information indicates the use of IPsec communication (“YES” at S2605), the operation proceeds to S2607 to determine whether information regarding the communication to be performed using the desired address indicates the use of non-IPsec communication. When it is determined that the use of IPsec communication is indicated (“NO” at S2607), the operation proceeds to S2606 to update the warning table with the information regarding the communication to be performed using the desired address, and further to S2604 to determine that the selection of IP address is not subjected to warning. When it is determined that the use of non-IPsec communication is indicated (“YES” at S2607), the operation proceeds to S2608 to update the warning table with the information regarding the communication to be performed using the desired address. The operation further proceeds to S2609 to determine that the selection of IP address is subjected to warning, and the operation ends.
Referring now to
S2701 obtains the security policy priority order y of the selected IP address, for example, as described above referring to
S2702 refers to the warning table stored in the log data storage 222, such as the warning table of
S2703 determines whether any information regarding the client apparatus 11 is obtained at S2702. When it is determined that no information is obtained (“NO” at S2703), the operation proceeds to S2704 to add information regarding the communication to be performed using the desired address to the warning table. The operation further proceeds to S2705 to determine that the selection of IP address is not subjected to warning, and the operation ends.
At S2703, when it is determined that information regarding the client apparatus 11 is obtained (“YES” at S2703), the operation proceeds to S2706 to compare the priority order y corresponding to the communication to be performed and the priority order x of the security policy information being obtained at S2702, and determine whether the numerical value x is less than the numerical value y. When it is determined that the numerical value x is not less than the numerical value y (“NO” at S2706), the operation proceeds to S2707 to update the warning table with the information regarding the communication to be performed using the desired address. The operation further proceeds to S2705 to determine that the selection of IP address is not subjected to warning, and the operation ends.
When it is determined that the numerical value x is less than the numerical value y (“YES” at S2706), the operation proceeds to S2708 to update the warning table with the information regarding the communication to be performed using the desired address. The operation further proceeds to S2709 to determine that the selection of IP address is subjected to warning, and the operation ends.
As described above referring to
As described above, the server apparatus 10 is capable of managing access from the client apparatus 11 such that the server apparatus 10 and the client apparatus 11 are able to communicate while maintaining the desired security level, for example, by restricting access to the entire resource provided by the server apparatus 10 according to the settings information previously set for the server apparatus 10. In another example, one or more webpages provided by the server apparatus 10 may require the client apparatus 10 to access the server apparatus 10 in a manner different from the manner specified by the settings information previously set for the server apparatus 10.
The WPF security settings table 32 may store settings information, which may be previously set by default or according to the user preference for each webpage of a plurality of webpages provided by the server apparatus 10. The URL generator 20 may obtain a desired address to be used for communication that satisfies the settings information stored in the WPF security settings table 32 in a substantially similar manner as described above, and generate a URL including address information regarding the desired address.
Referring to
In prior to S2905, the server apparatus 10 obtains a desired address that satisfies the desired security level specified by the settings information previously set for the server apparatus 10. Using the desired address, the client apparatus 11 establishes communication with the server apparatus 10. In some cases, a webpage accessed by the user at the client apparatus 10 may contain a link to another webpage, which requires the security level higher than the security level specified by the settings information of the server apparatus 10. In such case, the server apparatus 10 may perform the following steps to obtain a desired address that satisfies the desired security level specified by the setting information previously set for the webpage to be linked.
At S2905, the WPF 28 may refer to security settings information stored in the WPF security settings table 32 to determine whether the security level needs to be managed for a selected webpage in a substantially similar manner as described above referring to S905 of
When the security settings information indicates that security management is necessary, at S2906, the WPF 28 requests the URL generator 20 to determine whether the IP address being obtained satisfies the desired security level specified by the settings information stored in the WPF security settings table 32.
At S2907, the URL generator 20 refers to the WPF security settings table 32 to determine the security level specified by the security settings information. At S2908, the URL generator 20 may obtain a desired server IP address in a substantially similar manner as described above referring to S908 of
At S2909, the URL generator 20 may request the DNS server 12 to obtain a plurality of client IP addresses each corresponding to the client apparatus 11.
At S2910, the URL generator 20 may obtain the desired IP address to be used for communication, in a substantially similar manner as described above referring to S910 of
At S2911, the URL generator 20 generates a URL having address information regarding the desired address, and sends a response including the URL to the client apparatus 11 without the error code.
Alternatively, when the settings information indicates that access to the selected webpage by the client apparatus 11 is prohibited, the URL generator 20 may return the 404 error code to the client apparatus 11.
As described above referring to
Any one of the server apparatus 10 and the client apparatus 11, shown in
Referring to
The CPU 301 controls operation of the server apparatus 10. The ROM 302 stores various kinds of computer program including a program, which causes the server apparatus 10 to perform operation of controlling network communications, such as causing the client apparatus 11 to access using a desired address that satisfies the desired security level specified by the settings information. The RAM 303 may function as a work area of the CPU 301, or an area to store various data including, for example, the settings information specifying the desired security level, information regarding a communication security level that may be dependent on an address or a connection method to be used for communication, log information regarding previously performed communication, etc. In this example, the RAM 303 may be volatile and/or involatile depending on one or more functions to be provided by the RAM 303. The HDD 304 may control operation of reading or writing data from or onto the HD 105 under control of the CPU 301. The HD 305 may store data such as a plurality of webpages. The FDD 306 may control operation of reading or writing data from or onto the FD 312 under control of the CPU 301. The FD 312, which is removable, may store data written by the FDD 306.
The display 307 may display various data including, for example, a curser, menu, window, text data or image data. The keyboard 309 may input various data, such as a user instruction provided by a user. The mouse 310 may be used to input various data, such as a user instruction, for example, by moving the curser displayed on the display 307, selecting the menu displayed on the display 307, or opening and/or closing the window displayed on the display 307. As described above, the display 307 may output warning to the user when the security level is changed. Any one of the keyboard 309 and the mouse 310 may be used to input various information, such as the settings information.
The network board 308, which may function as a network interface, connects the server apparatus 10 to the network 15 via a communication cable 313. For example, the network board 308 may allow the server apparatus 10 to communicate with one or more client apparatuses 11 via the network 15.
The client apparatus 11 may have a hardware structure similar to the hardware structure shown in
Numerous additional modifications and variations are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims, the disclosure of the present invention may be practiced otherwise than as specifically described herein.
With some embodiments of the present invention having thus been described, it will be obvious that the same may be varied in many ways. Such variations are not to be regarded as a departure from the spirit and scope of the present invention, and all such modifications are intended to be included within the scope of the present invention.
For example, elements and/or features of different illustrative embodiments may be combined with each other and/or substituted for each other within the scope of this disclosure and appended claims.
Further, as described above, any one of the above-described and other methods of the present invention may be embodied in the form of a computer program stored in any kind of storage medium. Examples of storage mediums include, but are not limited to, flexible disk, hard disk, optical discs, magneto-optical discs, magnetic tapes, involatile memory cards, ROM (read-only-memory), etc.
Alternatively, any one of the above-described and other methods of the present invention may be implemented by ASIC, prepared by interconnecting an appropriate network of conventional component circuits or by a combination thereof with one or more conventional general purpose microprocessors and/or signal processors programmed accordingly.
| Number | Date | Country | Kind |
|---|---|---|---|
| JP2007-159009 | Jun 2007 | JP | national |
