Server system, communication method, computer, program and recording medium

Establishment of communication between client apparatuses and an arithmetic function unit is performed based on communication information acquired by communication using HTTP between the client apparatuses and the arithmetic function unit through a firewall function unit, where the client apparatuses download encrypted contents data from the arithmetic function unit by P2P without passing a firewall.

TECHNICAL FIELD

The present invention relates to a server system, a communication method, a computer, a program, and a storage media used in communication between a server and a client apparatus.

BACKGROUND ART

For example, a server, such as a sales site of the contents on a network is accessed from a terminal, contents are specified to be purchased, and electronic banking is performed. After this, the contents data may be downloaded.

In such a system, one or more firewalls are built at server site, and all of the communication between the server and the terminal is performed through a firewall. This is defending the server from the unjust attack from the computer on a network.

However, in the system of prior art, while the server can be defended from the unjust attack from the computer on the network, when just client apparatus downloads contents data etc, from the server, there is a disadvantage that passing firewall causes bad response.

Further, there is a disadvantage that flexibility of the application construction and execution between the client apparatus and the servers is not enough.

This invention is made in view of this situation, and purpose is to provide a computer, a program, and a storage media which have high safety and a high response.

SUMMARY OF THE INVENTION

In order to attain the purpose the first aspect of the present invention is a server system, comprising: a firewall; a first server for connecting with a client apparatus via said firewall; and a second server for connecting with said client apparatus without passing said firewall, wherein said first server communicates with said client apparatus via said firewall and transmits communication information used for communication with said second server to said client apparatus, said client apparatus communicates with said second server based on a communication protocol different from a communication protocol with said first server by using said communication information received from said first server.

In the server system of the present invention, first, a first server performs communication with a client apparatus through said firewall, and transmits said communication information used for communication with said second server to said client apparatus.

And said client apparatus communicates with said second server based on a different communications protocol from a communication protocol with said first server by using the received communication information.

The second aspect of the present invention is a communication method, comprising: a step in which a first server communicates with a client apparatus via a firewall and transmits communication information used for communication with said second server to said client apparatus, and a step in which said client apparatus communicates with said second server based on a communication protocol different from a communication protocol with said first server by using said communication information received from said first server.

The third aspect of the present invention is a computer, comprising: an interface for transmitting and receiving a data used for communication with a first server through a firewall at the side of server and a data used for communication with a second server not through said firewall, and a processing circuit for performing communication processing with said second server not through said firewall based on a communication protocol different from a communication protocol with said first server by using a communication information received from said first server, when receiving the communication information used for said second server from said first server via said interface by communication through said firewall.

The fourth aspect of the present invention is a program executed by a computer, comprising: a receiving step for receiving a communication information used for communication with a second server by communication with a first server through a firewall at server side, and a communication step for communicating with said second server through said firewall base on a communication protocol different from a communication protocol with said first server by using said communication information received at said receiving step.

The fifth aspect of the present invention is a storage media storing a program executed by a computer, said program comprising: a receiving step for receiving a communication information used for communication with a second server by communication with a first server through a firewall at server side, and a communication step for communicating with said second server through said firewall base on a communication protocol different from a communication protocol with said first server by using said communication information received at said receiving step.

According to the present invention, a computer, a program, and a storage media which have high safety and a high response can be provided.

DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION

Below a network system1of the present invention will be explained.

FIG. 1is a schematic view of a network system1in accordance with an embodiment of the present invention.

Referring toFIG. 1, the network system1, for example, includes client apparatus11-nand a server center21. Here “n” is an integer meeting the condition “1≦n≦N”.

The front end server function unit33is an example of a first server used in the present invention, the arithmetic function unit43is an example of a second server used in the present invention.

The client apparatuses11-nhave function of arithmetic operation and NAT.

The server center21includes a firewall function unit31, a front end server function unit33, a firewall function unit35, a back end server function unit37, a firewall function unit39, a Network Address Translation (NAT) function unit41, a mediator unit42and a arithmetic function unit43.

The firewall function unit31has a function of firewall in communication with the client apparatus via the network9.

In the present embodiment the function of firewall means a function which applies the policy (rule) specified beforehand to all of the communication which pass a firewall.

The firewall function has functions, such as access restrictions, address translation, user attestation, log collection/analysis, contents filtering, and routing, for example. The firewall function is realized with either Operation System (OS) or application.

The front end server function unit33has a server function of Simple Traversal of UDP Through NATs (STUN). That is, the front end server function unit33has a unique address (global IP address) in the network9.

The front end server function unit33assigns the global IP address to the arithmetic function unit43by communicating with the arithmetic function unit43to which the global IP address is not assigned through the communication lines in the server center21by using the STUN function. The global IP addresses are 128 bit data, for example.

The front end server function unit33transmits the above-mentioned global IP address which is assigned to the arithmetic function unit43as a connection information to the client apparatuses11-n.

The above-mentioned global IP address assigned to the arithmetic function unit43is mutually converted between the internal address which specifies the arithmetic function unit43for communication by the NAT function of the NAT function unit41while communicating between the client apparatuses11-nand the arithmetic function unit43.

Note that, the communication based on the STUN function between the front end server function unit33and the arithmetic function unit43is performed through the path in the server center21.

Further, preferably, a global IP address is assigned suitably to the client apparatuses11-nby using the NAT function of the NAT function unit41and is suitably used for communication.

Protocols, such as HyperText Transfer Protocol (HTTP), are used for communication between the client apparatuses11-nand front end server function unit33in the present embodiment. In the present embodiment, the communication between the client apparatuses11-nand the front end server function unit33is used for the processing in which high security, such as credit settlement of accounts, is required

The firewall function unit35has a firewall function in communication between the front end server function unit33and back end server function unit37.

The back end server function unit37executes programs, such as file system share related processing of the database access processing and NFS, etc. based on SQL etc.

The back end server function unit37transmits the contents data, predetermined contents space data, etc. to the arithmetic function unit43based on the above-mentioned program.

The firewall function unit39has a firewall function in communication between the back end server function unit37and the arithmetic function unit43.

The mediator unit42provides the client apparatuses11-nwith application information.

The arithmetic function unit43has two or more arithmetic function modules45-1to45-m, and each performs the application program AP-S.

The arithmetic function unit43transmits the contents data of image data, such as audio data of a musical piece etc., and an album jacket picture, etc. to the client apparatuses11-nbased on the application program AP-S.

Further, the arithmetic function unit43transmits the coordinates of each contents in predetermined space and the text data indicating a bibliographic matter, etc. to the client apparatuses11-n, for example.

At this time, transmission to the client apparatuses11-nfrom the arithmetic function unit43is performed by encrypting transmission data. For example the client apparatuses11-nacquires an encryption key by communication with the firewall function unit31, and performs communication with the arithmetic function unit43by using the encryption key.

In the present embodiment, P2P type communications protocols different from a communication protocol with the client apparatuses11-nand the firewall function unit31are used for communication between the client apparatuses11-nand the arithmetic function unit43. That is, a direct communication is performed between the client apparatuses11-nby using the above-mentioned global IP address assigned to the arithmetic function unit43.

This P2P direct communication is possible also to a plurality of the client apparatuses11-nor a plurality of the arithmetic function unit43. In that case, mutual address reference uses the Fully Connected Graph (FCG) system holding all references mutually. Of course, other methods, such as a Chord system by Distributed Hash Table (DHT) which manages a reference in a hash table and makes it distribute to nodes are available.

The arithmetic function unit43receives contents data etc. through the firewall function unit39by the database access processing and file system share related processing provided by the back end server function unit37.

The client apparatuses11-nis electric devices, such as a game machine, a personal computer, or a portable telephone.

FIG. 2is a block diagram of the client apparatuses11-nshown inFIG. 1.

As shown inFIG. 2, the client apparatuses11-nincludes an interface61, a display62, an operation unit63, a memory64and a processing circuit65, all coupled over a bus60.

The interface61is an interface for transmitting and receiving data through the network9.

The display62displays a screen according to the image data which the processing circuit65generates.

The operation unit63is an operation means such as a keyboard.

The memory64stores a client application program PRG-T executed by the [55]. The memory64is any of recording media such as a semiconductor memory, an optical disc, a magneto-optical disc, a magnetic disk, and so on.

The processing circuit65executes the client application program PRG-T and controls generally processing of the client apparatuses11-nexplained in the present embodiment.

[Front End Server Function Unit33]

FIG. 3is a block diagram of the front end server function unit33shown inFIG. 1.

As shown inFIG. 3, the front end server function unit33includes an interface71, a memory74and a processing circuit75, all coupled over a bus70.

The interface71is an interface for transmitting and receiving data through the network9.

The memory74stores a server application program PRG-SF executed by the processing circuit75. The memory74is any of recording media such as a semiconductor memory, an optical disc, a magneto-optical disc, a magnetic disk, and so on.

The processing circuit75executes the server application program PRG-SF and controls generally processing of the front end server function unit33explained in the present embodiment.

The processing circuit75executes the server application program PRG-SF and controls generally operation of the front end server function unit33.

FIG. 4is a block diagram of the client apparatuses45-1to45-mwhich exist in the arithmetic function unit43shown inFIG. 1.

As shown inFIG. 4, the client apparatuses45-1to45-minclude an interface81, a memory84and a processing circuit85, all coupled over a bus80.

The processing circuit85of the client apparatuses45-1to45-mare configured by at least one management processor and two or more calculation execution processors. Processing of two or more above-mentioned calculation execution processors is managed by the management processor, for example.

Here, as a communications protocol between the client apparatuses11-nand the front end server function unit33, the server initiative type of HTTP etc. is used, for example. On the other hand, as a communications protocol between the client apparatuses11-nand the arithmetic function unit43, a P2P type communications protocol etc. is used as mentioned above.

The arithmetic function unit43, for example, when processing while communicating with the client application program PRG-T of two or more client apparatuses11-n, makes each of the plurality of the calculation execution processors execute the server application program PRG-SA which performs communication with the client application program PRG-T which corresponds to each of the plurality of the calculation execution processors among the client application program PRG-T.

The processing circuit85encrypts the contents data concerned with a predetermined encryption key, when transmitting contents data etc. to for example, the client apparatuses11-n.

The processing circuit85uses the encryption key specified by communication between the client apparatuses11-nand the front end server function unit33. Thus, by encrypting the contents data, even when communication between the client apparatuses11-nand the arithmetic function unit43is monitored, the contents data can be protected.

The interface81is an interface for transmitting and receiving data through the network9.

The memory84stores a server application program PRG-SA executed by the processing circuit75. The memory84is any of recording media such as a semiconductor memory, an optical disc, a magneto-optical disc, a magnetic disk, and so on.

The processing circuit85executes the server application program PRG-SA and controls generally processing of the arithmetic function unit43explained in the present embodiment.

Connection operation between the client and the server:

FIG. 5is a flow chart for explaining connection operation between client and server.

The processing circuit65of the client apparatuses11-n, for example, communicates with the front end server function unit33through the network9and the firewall function unit31, and acquires the connection information with the mediator unit42by the function of the STUN server of the front end server function unit33.

The connection information is information on a global IP address, a port, etc. assigned to the mediator unit42, for example.

The above-mentioned communication is performed in the secure state through the firewall function unit31based on a communications protocols, such as HTTP.

Based on the connection information acquired at the step ST11, the processing circuit65of the client apparatuses11-naccesses the mediator unit42through the NAT function unit41to receive the application information from the mediator unit42.

Note that, the mediator unit42transmits the application information corresponding to the server application program which the arithmetic function unit43executes to the client apparatuses11-n. The application information concerned is introduction of the contents of application which is available to the client apparatuses11-n.

The processing circuit65of the client apparatuses11-ndownloads the client application program PRG-T from a predetermined site based on the application information acquired at the step ST12.

In addition, the client equipment client apparatuses11-nmay download the client application program PRG-T from the front end server function unit33or the mediator unit42.

The processing circuit65of the client apparatuses11-nperforms the client application program PRG-T downloaded by step ST13. The processing circuit65of the client apparatuses11-naccesses the front end server function unit33through the network9and the firewall function unit31, based on above-mentioned client application program PRG-T.

And the processing circuit65of the client apparatuses11-nacquires the global IP address and port information of the arithmetic function unit43, and establishes connection with the arithmetic function unit43by the STUN server function of the front end server function unit33.

Note that, the arithmetic function unit43has a plurality of the arithmetic function modules45-1to45-m. Each of the arithmetic function modules45-1to45-mexecutes a server application program individually. At this time, the combination of a unique IP address and a unique port is assigned to each of the arithmetic function modules45-1to45-m. Then the arithmetic function modules45-1to45-mperform communication with the client apparatuses11-nbased on the combination information on the IP address and port corresponding to the application program executed by the arithmetic function modules45-1to45-m.

Note that, the client apparatuses11-nand the arithmetic function unit43which communicates with the client apparatuses11-nacquires or specifies the encryption key used for communication between the client apparatuses11-nand the arithmetic function unit43by the communication at the step ST14.

The processing circuit65of the client apparatuses11-ncommunicates with the arithmetic function unit43based on the connection established at the step ST14. In the communication concerned, a P2P other than HTTP type communications protocol is used as mentioned above.

At this time, the arithmetic function unit43performs server application program PRG-SA corresponding to the client apparatuses11-n. The server application program PRG-SA concerned is started by the front end server function unit33. The timing to be started concerned is the timing when the client apparatuses11-nhas downloaded the client application program PRG-T, or the timing when starting.

By the communication concerned, the client apparatuses11-ndownloads the encrypted contents data from the arithmetic function unit43and writes it in cache memory.

The client apparatuses11-ndecodes the contents data using the encryption key acquired by the communication between the front end server function unit33at the time of download or use.

[Example of Automatic Cruise Operation]

The example of automatic cruise in which the download of the contents data mentioned above is adopted hereafter is explained.

Automatic cruise operation is operation which specifies the coordinates of the contents data concerned based on the attribute of contents data in predetermined space, and makes the user coordinates (camera position mentioned later) move automatically in the space concerned for example, and reproduces etc, the contents data corresponding to the user coordinates.

In the automatic cruise operation concerned, the contents data corresponding to the coordinates is downloaded with movement of the user coordinates in space. In addition, movement of the user coordinates in space may switch auto-cruise (automatic) and manual operation, and either is good.

FIG. 6is a block diagram in the case of carrying out automatic cruise operation in the network system1shown inFIG. 1.

As shown inFIG. 6, the client apparatuses11-nincludes a cruise management unit101, a cache management unit103, a local cache105, a automatic cruise processing unit107, a viewer109, a audio management unit111and a rendering unit113as functions, for example.

The processing circuit65shown inFIG. 2executes the client application program PRG-T, and the above-mentioned function of the client apparatuses11-nshown inFIG. 6is realized.

Further, the arithmetic function unit43in the server center21includes the space server function121, the space database122, and the contents database123as a function, for example.

The processing circuit85shown inFIG. 4executes the server application program PRG-SA, and the above-mentioned function of the arithmetic function unit43shown inFIG. 6is realized.

FIG. 7is a flow chart for explaining the above-mentioned automatic cruise operation.

The processing circuit65of the client apparatuses11-njudged whether connection between the server center21and the arithmetic function unit43has established or not by using the processing mentioned above, for example. And when the processing circuit65judged the connection has established, it progresses to step ST22.

The processing circuit65of the client apparatuses11-nstarts the client application program PRG-T downloaded at the step ST13shown inFIG. 5.

Starting of the client application program PRG-T by the processing circuit65may be performed by the command from the front end server function unit33, for example. Thereby, each functional block in the client apparatuses11-nshown inFIG. 6is started.

The cruise management unit101shown inFIG. 6receives space data and contents data from the space server function121. The space server function121acquires space data from the space database122, and acquires contents data from the contents database123.

Specifically, based on the server application program PRG-SA, the processing circuit85of the arithmetic function unit43shown inFIG. 4receives space data and contents data through the firewall function unit39from the back end server function unit37, and, encrypts this.

And the processing circuit85transmits the encrypted contents data to the client apparatuses11-n, based on the connection established at the step ST14ofFIG. 5.

The cruise management unit101of the client apparatuses11-nwrites the space data and contents data which were received in the local cache105based on the function of the cache management unit103.

The viewer109of the client apparatuses11-nreads space data and contents data from the local cache105, and displays the view (screen) according to it on a display62.

The cruise management department101of the client apparatuses11-nacquires the space data and contents data which are used for the next from the space server function121, and writes this in the local cache105.

If the cruise management unit101of the client apparatus11-njudged that the operation unit63shown inFIG. 2has not generated an operational signal (operation by a user is not performed) during a fixed period, it progresses to step ST27, and when that is not right, it will progress to step ST28.

The cruise management unit101switches to control by the automatic cruise processing unit107.

The viewer109of the client apparatuses11-nreads the contents data corresponding to the camera position (object in the contents space displayed as a view) determined by the automatic cruise processing unit107from the local cache105, and image reproduction is carried out in the rendering unit113.

The audio management unit111reproduces the audio data of the contents data corresponding to the above-mentioned camera position.

The cruise management unit101of the client apparatuses11-nacquires the space data and contents data which are used for the next from the space server function121according to the moved camera position, and writes this in the local cache105.

Then, the cruise management unit101returns to processing of step ST24.

[Example of Operation at the Time of a Client Addition]

FIG. 8is a flow chart for explaining an example of operation when a new client apparatuses11-nis added to the network system1shown inFIG. 1.

If the processing circuit75of the front end server function unit33judges that the new client apparatuses11-nhas been added by the demand from the client apparatuses11-n, it will progress to step ST32.

The processing circuit75of the front end server function unit33specifies the server application program PRG-SF corresponding to the client application program PRG-C which the added client apparatuses11-nexecutes.

And the processing circuit75makes the arithmetic function unit43start the specified server application program PRG-SF.

The arithmetic function unit43communicates with the client apparatuses11-nbased on the server application program PRG-SF started at the step ST32.

[Example of Operation for Switching Communication]

When the processing of settlement of accounts etc. occurs during communication between the client apparatuses11-nand the arithmetic function unit43, the communication will be switched to the communication between the client apparatuses11-nand the front end server function unit33via the firewall function unit31.

And after settlement of the accounts is completed by communication in secure state between the client apparatuses11-nand the front end server function unit33, the communication switches to the P2P communication between the client apparatuses11-nand the arithmetic function unit43again, and the encrypted contents data which has been settled accounts is downloaded from the arithmetic function unit43to the client apparatuses11-n.

As explained above, according to the network system1, the client apparatuses11-ndownloads the encrypted data from the arithmetic function unit43without passing a firewall, therefore the response is good.

Further, according to the network system1, establishment of communication between the client apparatuses11-nand the arithmetic function unit43is performed based on the communication information acquired by the communication between the client apparatuses11-nand the arithmetic function unit43through the firewall function unit31, therefore the safety of procedure can be increased.

Further, according to the network system1, the arithmetic function unit43may execute the server application program PRG-SA corresponding to the client application program PRG-T which the client equipment client apparatuses11-nperforms, therefore the flexibility of application composition increases

Further, according to the network system1, a construction of the application as a network including two or more client apparatuses11-nand a server becomes easy by operating individually the front end server function unit33and the arithmetic function unit43. That is, it is easy to construct the application including the function of the client apparatuses11-nand the server which is not the constitution for connecting the independent node and function thereof.

Note that, the network system1can realize the server center21as a server apparatus which functions as network OS or network middleware.

The server center21realizes an internal processor network effectively by combining a network connection between internal processors and a server network connection of conventional type.

The present invention is not limited to the above embodiments.

It will be appreciated by those skilled in the art which various modifications, combinations, sub-combinations, and replacements may be made in part or all of the components within the technical scope and its equivalents of the present invention.

For example, although the case where the firewall function unit31assigned a global IP address to the arithmetic function unit43by the STUN function is illustrated in the embodiment mentioned above, you may assign by functions other than a STUN function.

Although the case where the arithmetic function unit43receives contents data through the firewall function unit39from the back end server function unit37is illustrated in the embodiment mentioned above, it is not necessary to form the firewall function unit39or, and it may download contents data from servers other than the server center21.

Further, each function of the server center21shown inFIG. 1may be realized by the same or different any of hardware, as long as each exists as a functional module. For example, as shown inFIG. 9, you may form the server function unit200which realizes the function of the both sides of the arithmetic function unit43shown in the front end server function unit33andFIG. 4showing inFIG. 3.

In this case, the program PRG-SF and PRG-SA mentioned above will be memorized in the memory274of the server function unit200, and the processing unit275executes these programs to communicate with the client apparatuses11-nthrough the interface271to obtain the function of the both sides of the front end server function unit33and the arithmetic function unit43.

This invention is applicable to the communication system which performs communication via firewall.

EXPLANATION OF REFERENCE