Patent ID: 8307420
Filing Date: 2012-11-06
Classification: H04L

Abstract:
1. A security gateway system for connecting a plurality of networks each of which uses a standard protocol the standardized specifications of which have been published, wherein the security gateway system comprises: two sub-gateways individually realized as virtual machines each of which is constituted of a virtual hardware unit constructed on a physical hardware unit of a real machine and an operating system working on the virtual hardware unit, and the two sub-gateways being individually connected to two networks to be connected, wherein: each of said sub-gateways has a standard protocol communication portion which communicates with said network to which the same sub-gateway is connected using said standard protocol, a nonstandard protocol communication portion which communicates with the other sub-gateway using a nonstandard protocol the specifications of which have not been published, a protocol conversion portion which performs protocol conversion of communication data between the standard protocol and the nonstandard protocol, and a relay permission setting information storage portion which stores relay permission setting information used to confirm relay permission for communication data; said two sub-gateways are configured such that data can be exchanged between the nonstandard protocol communication portions using said nonstandard protocol; said nonstandard protocol communication portion of each of said sub-gateways is an original communication portion which has an implemented application layer which is a seventh layer of the Open Systems Interconnection (OSI) model, and which has unpublished and original communication layers implemented for the range corresponding to first through sixth layers, so that data exchange between the nonstandard protocol communication portion and said standard protocol communication portion within the same sub-gateway is performed only in the application layer which is the seventh layer, and data exchange is not possible in the range corresponding to the first through sixth layers; and when performing protocol conversion of communication data, said protocol conversion portion of each of said sub-gateways refers to said relay permission setting information to confirm relay permission for the communication data, and performs protocol conversion of the communication data only when relay is permitted, wherein: the standard protocol communication portion of each of said sub-gateways, is constituted of two parts which are individually constructed by individual construction methods different from each other, such that the first layer part is realized by a physical hardware unit for standard communication which is added to said physical hardware unit, and such that a part of the second through seventh layers is realized by said virtual machine, the nonstandard protocol communication portion of each of said sub-gateways, is constituted of two parts which are individually constructed by individual construction methods different from each other, such that the first layer part is realized by a physical hardware unit having an original configuration for original communication which is added to said physical hardware unit, and such that a part of the second through seventh layers is realized by said virtual machine.