Method for providing access to a web server

The invention provides for a method for providing access to a web server and an arrangement for performing said method. Access is provided by a first proxy server and a second proxy server on request.

FIELD OF THE INVENTION

The present invention relates to a method for providing access to a web server and an arrangement for performing said method. Furthermore, the invention relates to a computer program adapted for performing the method as described herein.

DESCRIPTION OF THE RELATED ART

A web server is an information technology that processes requests via hypertext transfer protocol (http), the basic network protocol used to distribute information on the World Wide Web. The term can refer either to the entire computer system, an appliance, or specifically to the software that accepts and supervises the http requests.

The primary function of a web server is to store, process and deliver web pages to clients. The communication between client and server takes place using the http. Pages delivered are most frequently html documents, which may include images, style sheets and scripts in addition to text content.

Web servers can be run on different technical devices as computers and machines within a production plant. To Request in contact with the web server on this machine this machine needs an IP address. To access a web server via the Internet this web server needs a public IP address. The problem is that in many cases the machine should not be available from the Internet for safety reasons. Furthermore, the number of public IP addresses is limited.

In a typical environment the hosts and servers of an internal network access the Internet via Net Address Translation (NAT) routers. NAT technology provides a method of accessing the Internet with hosts in a Local Area Network (LAN) solving the problem of insufficient IP addresses. Furthermore, the internal hosts in the LAN are invisible to the Internet, i.e., hosts in the Internet cannot proactively access internal hosts in the LAN.

Many organizations begin to use private addresses to establish internal LANs. Furthermore, some internal hosts in such a LAN are required to store resources and can be accessed by users on the Internet. For access from the Internet a so called proxy server can be used.

A proxy server is a computer system or an application running on a computer acting as an intermediary for requests from clients seeking resources from other servers. Therefore, a proxy server or proxy can be used for allowing communication between two computers through the proxy server. Proxy servers are used for facilitating access to content on the World Wide Web whereupon providing anonymity. For that matter proxy servers can forward http requests. Furthermore, proxy servers allow web sites to make web requests to externally hosted resources, when cross-domain restrictions prohibit the web site from linking directly to the outside domain. Proxy servers also allow the browser to make web requests to externally hosted content on behalf of a website when cross-domain restrictions prohibit the browser from directly accessing the outside domains.

Document EP 1 363 441 A1 discloses a method for reducing the number of global IP addresses required for servers located in private network comprising the steps of configuring corresponding relationship information between an external address as well as other characteristic information and an internal address as well as other characteristic information in the internal server, matching the relevant information carried by the messages exchanged between the internal network and the Internet with the configured corresponding relationship information, and processing the message according to the matching result.

Document CN 10 424 3210 A discloses a method and system for remotely having access to administrative web pages of routers. The method comprises the step of establishing a transmission control protocol (TCP) long connection between routers and a cloud server. The cloud server determines monitoring port numbers corresponding to the routers. The address of the cloud server and the monitoring port numbers are transmitted to the corresponding routers through TCP long connection.

Document CN 10 306 4979 A discloses a router and a method for implementing the same to process web page data. The method comprises the steps of storing web pages data from a web page server, receiving a web page browsing request from a client, judging whether contents of a requested web page are stored or not, and transmitting the stored contents of the web page to the client if the contents of the requested web page are stored.

Document CN 10 406 5749 A provides a method and device for accessing a web page through a proxy and is applied to management control over extranet accessing. The method described uses a router serving as the proxy.

Document GB 24 20 205 A shows a system for communicating process control information. The system comprises a first web service associated with a process control system, a second web service associated with a data consuming application and an information server communicatively coupled to the first and second web services via a network. The information server preferably includes a router that is adapted to convey messages between the first and second web services.

Document US 2008 298342 A1 discloses a computer-implemented method for performing inter-domain communication in a web browser including receiving first data from a first domain at a router.

Document MY 136816 A discloses an architecture for generating and maintaining a terminal device connecting from an external client to an internal intranet client behind a firewall or router.

SUMMARY OF THE INVENTION

In contrast thereto, the invention proposes a method according to claim1, an arrangement, and a computer program as disclosed herein. The computer program can be stored on a data carrier which is also subject of the present invention. Furthermore, the invention refers to a central server suitable for performing at least steps of an embodiment of the present invention.

The method described is suitable for providing access to a web server running on a machine. Access is provided by a first proxy server and a second proxy server on request of an entity, e.g. a computer used by a user, wherein a request is sent for providing access by an entity together with an identification representing the entity.

In one embodiment, content according to the request is sent from the web server through the second proxy server and the first proxy server to the entity.

Typically, a command for providing access is forwarded by the first proxy server and the second proxy server to the machine or web server of the machine to be accessed. Content according to the request is sent from the web server to the entity requesting access via the second proxy server and the first proxy server.

The first proxy server can be a http server. The second proxy server can be a socket server. The first proxy server forwards received relative links and changes received absolute links to relative links before forwarding.

In one embodiment, access is requested by a web window, e.g. provided by a web browser. A web browser also called a browser is a software application for retrieving, presenting and traversing information resources on the World Wide Web. Typically, the web browser uses the http protocol. The web browser can provide at least one web window.

In another embodiment, access is requested by a first web window, a second web window receives the requested content via the first proxy server. These web windows can be run on a computer, particularly on one computer, and can be provided by one web browser running on the computer. The second web window and the machine do not know each other. Only the first web window has knowledge of the machine and its web browser. The first web window provides the links, e.g. http links, for the second web window.

Access can be requested by the first web window by sending a Request command. Usually, the answer to a Request command is a so-called Response command sending the requested content.

In another embodiment, a central server is provided which can be connected to the first proxy server. In this case, content according to the request can be sent from the web server through the second proxy server, the central server and the first proxy server to the entity which has sent the request.

The central server can have knowledge of the identity of the second web window, e.g. with help of a cookie, and of the machine to be accessed. The connection or assignment between identity of the second web window and the machine can be contained within a table. This table can be stored on the central server.

Alternatively, the table can be stored within the computer sending the request. A central server is not necessary in performing the method as described herein but might be helpful for performing the method.

In case, a central server is provided, this central server can communicate with the first proxy server, the second proxy server and the computer or entity sending the request, e.g. the first web window.

Furthermore, data transferred second proxy server can be encrypted. In one embodiment, data transferred between the central server and the second proxy server is encrypted.

In case there is a data transfer between the first proxy server and the second proxy server, data transferred between the first proxy server and the second proxy server can be encrypted.

Additionally, to the encryption or instead of the encryption, a VPN connection (VPN; virtual private network) can be used.

In one embodiment, in a first step the first web window sends a Request command to the central server together with the identification, in a second step, the central server sends information needed, in a third step the second web window contacts the first proxy server giving the identification, in a fourth step, the second proxy server sends the request of the web windows to the machine.

In another embodiment, in a first step, the first web window sends a Request command to the central server together with the identification, In a second step, the central server sends information needed, In a third step, the second web window contacts the first proxy server giving the identification, in a fourth step, the second proxy server sends the request of the web windows to the machine.

The arrangement for performing access to a web server running on a machine is particularly suitable for performing the method as described herein. The arrangement comprises a first proxy server and a second proxy server. Typically, the second proxy server is in contact to the web server to be accessed. The arrangement can comprise more than one second proxy server, each second proxy server is in contact to at least one machine to be accessed. Furthermore the arrangement is suitable for access of more than one entity.

In one embodiment, a central server is provided which can be in contact to the first proxy server. In this case, the central server can be in contact to the second proxy server as well. The fist proxy server and the central server can communicate with each other.

The second proxy server can be an embedded system. An embedded system is a computer system having a dedicated function within an electronic system. In this case, the embedded system is suitable for allowing access to and control of a technical device, e.g. a machine, via an electronic data line. Furthermore, the second proxy server can be a software running on an electronic device.

Furthermore, the arrangement can comprise a firewall. This firewall can be provided between the central server and the second proxy server. In another embodiment, the firewall is provided between the first proxy server and the second proxy server.

The arrangement can comprise a computer as entity to request access. The computer can comprise a first web window and a second web window running on the computer. The second web window shows the content requested with help of the first web window. In this case, the first web window provides the link, e.g. the http link, for the second web window. In use, the entity, the computer, the first web window and/or the second web window can be identified by an identification, e.g. a cookie. That means that there is an identification which is sent when requesting access.

The arrangement can comprise a table or a chart containing assignments between identities of entities, e.g. a web browser, particularly the second web browser, requesting access and the machines to be accessed. This table can be stored on the central server.

The method shown is suitable for accessing a web server which is installed on a machine, e.g. an industrial machine running on a computing unit using at least two proxy servers. The machine does not need a public IP address, access can be provided in compliance with safety requirements.

A proxy server is a computer system or an application running on a computer acting as an intermediary for requests from clients seeking resources from other servers. Therefore, a proxy server or proxy can be used for allowing communication between two computers through the proxy server. Proxy servers are used for facilitating access to content on the World Wide Web whereupon providing anonymity. For that matter proxy servers can forward http requests. Furthermore, proxy servers allow web sites to make web requests to externally hosted resources, when cross-domain restrictions prohibit the web site from linking directly to the outside domain. Proxy servers also allow the browser to make web requests to externally hosted content on behalf of a website when cross-domain restrictions prohibit the browser from directly accessing the outside domains.

The web server usually comprises one or more web sites forming the content to be accessed. A web site is a set of related web pages typically served from a single web domain.

Within the communication lines routers and firewalls can be used. A router is a networking device that forwards data packets between computer and networks. Typically, a router is connected to two or more data lines from different networks. In case that a data packet comes in one of the data lines, the router reads the address information in the packet to determine its ultimate destination. A firewall forms a barrier provided to prevent unauthorized communication between computer networks or hosts.

Moreover, the invention refers to a central server suitable for performing at least one step of the method as described herein.

The identification, e.g. a cookie, represents the entity. Accordingly, the identification can represent or identify the entity, the computer run by the entity, the first web window and/or the second web window. The identification is sent to the first proxy server, e.g. directly on request or indirectly via the central server.

Further features and embodiments of the invention will become apparent from the description and the accompanying drawings.

It will be understood that the features mentioned above and those described hereinafter can be used not only in the combinations specified, but also in other combinations or on their own, without departing from the scope of the present invention.

DETAILED DESCRIPTION

The figures are described cohesively and in overlapping fashion, the same reference numerals denoting identical parts.

FIG. 1shows an embodiment of the arrangement for performing the method as described herein overall denoted with reference number10. The drawing shows a central server12connected to a first proxy server14, a firewall16, an embedded18serving as a second proxy server, a machine20, a first web window22running on a computer, and an internal second web window24running on the same computer within the first web window22. Furthermore, the drawing shows a computer26being in contact to the machine20by an internal line28allowing access to the machine20.

A web server30installed on the machine20is suitable for storing, processing and delivering web pages to clients, e.g. the computer26. The web server30can also refer to a link. As the machine20has no public IP address it cannot be accessed via the Internet. Anyway, the components shown inFIG. 1are connected via the Internet.

The communication between the components inFIG. 1visualized by the arrows is illustrated inFIG. 2.

FIG. 2illustrates an embodiment of the method proposed with help of a scenario diagram. Lines representing entities already shown inFIG. 1, namely the first web window22, the second web window24, the first proxy server14, the central server12, the embedded system18, the web server30running on the machine (reference number20inFIG. 1).

In a first step50the first web window22sends a Request command to the central server12specifying its identity and/or the identity of the second web window24, e.g. by a cookie or cookies, and the target, i.e. the machine or web server, the user of the first web window22wants to access. In a second step51, the central server12sends information needed and/or a confirmation. In a third step52, the second web window24contacts the first proxy server14giving the identification, particularly the cookie corresponding to the cookie of the first web window22. In a fourth step54, the first proxy server14forwards the information received in the second step52to the central server12.

A cookie is a small piece of data sent from a website and stored in a users web browser while the user is browsing that website. Cookies are a reliable mechanism, e. g. for websites, to remember stateful information or to record the users browsing activity. In the context of the method proposed herein, cookies can be used by the first proxy server to identify the second web browser.

In a fifth step56, the central server12sends the request of the web windows22and24to the embedded system18. In a sixth step58, the embedded system18sends the request to the web server30. The content requested by the web browser22and24is sent via the embedded system18(arrow60) to the central server12(arrow62) to the first proxy server14(arrow64) to the second web window24(arrow66).

The first proxy server can assign requests with help of a cookie. Furthermore, a table or chart can be used assigning identity, e.g. a cookie, of second web browser, to machine which is target of the second web browser. This table can be stored within the central server. Usually, a cookie is transferred only on request.

FIG. 3shows another embodiment of the arrangement200for performing the method described herein using the same reference numerals as inFIG. 2. The arrangement comprises a central server12, a first proxy server14, a firewall16, an embedded system18as a second proxy server, a machine20running a web browser30, a first web window22and a second web window24. Furthermore, VPN interfaces202for a secure data transfer.

The VPN interfaces202can be implemented in software running on the fist proxy server14and the second proxy server18. VPN interfaces can be used in the arrangement10shown inFIG. 2. In this case, the VPN interfaces202can be implemented in software running on the central server12and the second proxy server18.

In contrast toFIG. 2, there is no data transfer between the central server12an the first proxy server18(steps54and64). Furthermore, the fist proxy server14and the embedded system18as the second proxy server communicate with each other (steps56and62).

Data exchange between the first web window22an the central server12(steps50and51) is optional. Information provided by the central server12can be stored in a computer running the first web window22and the second web window24.

In a first step50the first web window22sends a Request command to the central server12specifying its identity and/or the identity of the second web window24, e.g. by a cookie or cookies, and the target, i.e. the machine or web server, the user of the first web window22wants to access. In a second step51, the central server12sends information needed and/or a confirmation. In a third step52, the second web window24contacts the first proxy server14giving the identification, particularly the cookie corresponding to the cookie of the first web window22.

In a fourth step56, the second proxy server14sends the request of the web windows22and24to the embedded system18. In a fifth step58, the embedded system18sends the request to the web server30. The content requested by the web windows22and24is sent via the embedded system18(arrow60) to the first proxy server14(arrow62) to the second web window24(arrow66).

As mentioned before, the first step50and the second step51are optional. However, in the embodiment shown information or data can be exchanged between the first proxy server13and the central server12.

FIG. 4shows in schematic views data packages which can be transferred within the method as described herein. Reference number100indicates a data package as transferred according to TCP/IP via the Internet. The data package100comprises a Media Access Control (MAC) address102, an IP address104, a target address106, a TCP/IP header108, and a http protocol header110. Furthermore, the data package100comprises the data112itself and optionally a check sum114.

Reference number120depicts a data package as sent in step52according toFIGS. 1 and 2. The data package comprises a Request command122and a data package100as shown above. A Request command indicates that the entity sending this command requests access to data.

Reference number130indicates a data package as sent in step54according toFIGS. 1 and 2comprising an identifier132, the Request command122, the data package100and check information134.

Reference number140depicts a data package as sent in step56according toFIGS. 1 and 2. The data package140comprises security data142, e.g. referring to an encryption, a target address144, namely the address of the machine as provided by the central server, the Request command122, data146comprising the data package100and the check information134and further check data148.

Reference number150indicates a data package as sent in step58according toFIGS. 1 and 2. The data package150comprises a MAC address152, an TCP/IP header154, a target address156, a TCP header158, a http protocol header160, the Request command122, the data146, and further check data162.

As a result, the machine performs its web server showing data180according to the requested http address182. This data is sent back to the second web window in steps60,62,64and66according toFIGS. 1 and 2using a Response command. This Response command replaces the Request command. Apart from that, the data transfer takes place as shown inFIG. 3.

A Response command is a command indicating that the entity sending data sends this data to another entity which has requested the data with help of a Request command.