RU2690752C1 - Method, apparatus, computer-readable information media and a system for building connections between a client and a destination device or terminal - Google Patents

Abstract

FIELD: information technology.SUBSTANCE: invention relates to a system, a service component, a method and an information medium for building connections between a client and a destination device or a terminal. System comprises: a client, a server, one or more service components and one or more terminals which are associated with service components; server for each of terminals provides host name, which is assigned to corresponding terminal, as well as corresponding service component; server is configured to be redirected as a response to a request for connection with a host with a given name from a client request for connection to one of the service components, which are assigned a host name; wherein each service component is configured to check, as a response to the request for connection, whether the terminal has a certificate, wherein if the certificate is absent, the service component requests the certificate from the external certifying organization, and based on certificate establishes server connection with client and sends further data packet between client and terminal.EFFECT: high security of accessing local terminals.15 cl, 2 dwg

Description

TECHNICAL FIELD

This patent application relates to a method, device, storage media read by computer and a system for building connections between a client and a destination device or terminal, such as a web server.

BACKGROUND

To encrypt connection requests, especially over HTTP, SSL or TLS protocols prevail. SSL certificates are issued by independent certifying organizations to website administrators. For connection requests, a certificate can be used to authenticate the website.

Web servers located on the local network have no other access than from the local network. Conventional technologies, such as virtual private VPNs, make this type of connection possible, but have a complex configuration. In particular, it is necessary to set the VPN configuration again if the location of the web servers on the local network changes. The configuration is set by the system administrator, usually manually. Encryption, for example, with certificates, is usually not performed for such web servers.

ESSENCE OF INVENTION

The basis of the invention disclosed herein lies in the task of providing secure access to local terminals, where possible without maintenance.

The first embodiment relates to a system comprising a client, a server, one or more service components and one or more terminals connected with one or more service components, wherein the server for each terminal provides the host name that is assigned to that terminal and the corresponding components, the server is configured to send a request for connection to this one or several service computers as a response to a request to connect a client to a host with the specified name Onentam, which are tied to the host, and each service component is configured to, as an answer to a connection request, check whether the terminal with which the host name is associated has a certificate, and the service component requests a certificate from an external certifying organization if there is no certificate, and based on the certificate through the server, establishes a connection with the client and sends further a data packet between the client and the terminal.

In particular, the server can later be performed with the ability to extract the first character string from the host name and determine the address of the corresponding terminal by the first character string.

In particular, the system may include a service component, which with the ability to extract the second character string from the host name and determine the address of the corresponding terminal by the second character string.

According to another embodiment, the determination of the address is performed by searching for the corresponding character string in the table.

Alternatively or additionally, the determination of the address may be based on the separation of the host name.

The following embodiments relate to a service component that is configured to check, as a response to a client connection request to a host with the specified name, to check whether there is a certificate for the terminal to which the host is assigned, while the service component requests a certificate from an external certification authority if There is no certificate, but based on the certificate, it establishes a connection with the client through the server and further sends the data packet between the client and the terminal.

In particular, the service component can later be performed with the ability to extract the first character string from the host name and determine the address of the corresponding terminal by the first character string.

According to an embodiment having particular preference, the determination of the address can be performed by searching for a character string in the table.

Alternatively or additionally, the determination of the address may be based on the separation of the host name.

The following embodiments relate to a method, including providing the server with a host name for each of a number of terminals, wherein the host name is assigned to the corresponding terminal and the service component to which the corresponding terminal is associated; as a response to a request to connect the client to the host, while the server redirects the connection request to one or more service components that are given the host name; and as a response to the connection request, the service component checks whether there is a certificate for the terminal that has been assigned a host name and a certificate request from an external certification authority, if there is no certificate, as well as establishing a connection with the client and forwarding data packets between the client and the terminal.

In particular, the method may include an action when the server retrieves the first character string from the host name and determines the address of the corresponding service component by the first character string.

The service component preferably extracts the second character string from the host name and determines from the second character string the address of the corresponding terminal.

For example, the address is determined by searching for the corresponding character string in the table.

Alternatively or additionally, the determination of the address may be based on the separation of the host name.

The following embodiments relate to computer-readable media using instructions that are executed by the method in accordance with the invention, as explained above, if they are executed by one or more processors.

The inventive step is achieved by sending a connection request to a local terminal based on identification, and also by requesting a certificate only for those terminals for which a connection request was received.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a system in accordance with embodiments of the invention.

FIG. 2 shows a method in accordance with embodiments of the invention.

DETAILED DESCRIPTION

According to the first embodiment of the invention, the client sends a connection request to the host name provided by the server. Host names are the domain name service, DNS names that can be assigned by DNS servers to an IP address and redirected to their destination device using routing. The host name is assigned to a terminal that is directly or indirectly connected to the server and does not necessarily have its own global IP address. A connection request can be initiated, for example, by interacting with a web browser and executed as an HTTP request. Alternatively, a connection request may be made using another protocol, such as FTP, SSH, or another protocol suitable for addressing host names.

The server is connected to at least one service component. Each service component has one or more terminals connected to it. Service components can be part of a server or can be separate units and can be a schema.

The server is connected to at least one service component. Each service component has one or more terminals connected to it. Service components can be an integral part of a server or can be made as separate units and can be made as a diagram or software. Terminals can be implemented as web servers or servers that operate in accordance with the client's connection request protocol. Any connection between these terminals and service components, respectively, with the server associated with the client, occurs through the service components. For example, a service component can be configured as a proxy server or a firewall of a local network through which information is exchanged between terminals and external devices, such as a client.

The server provides the corresponding unique host name for each of the terminals connected to it through a service component that can be used by the client. IP protocol and makes it possible to assign an IP address to one or even several host names.

In accordance with a particular embodiment, the server receives all packets that are directed to its assigned IP address or one or more DNS names / hosts assigned to it. In the first embodiment, the server retrieves the first character string from the host name to determine the local address of the terminal, for example, the IP address to which the connection request should be sent. Preferably, an initial character string of the host name is considered for this purpose. Host names are usually separated by dots (.), With the line after the last point representing the top-level domain (TLD), for example “.de”. For example, the initial character string precedes the first point in the node name and can be extracted, for example, from a regular expression. To distinguish between an IP address in a host name, it can contain other separating characters inside the host name besides the usual point.

An example of such a host name is 192-168-137-12.my-sda.net, where the initial character string is 192-168-137-12. According to one embodiment, the service component that is connected to the corresponding terminal may be determined by the server based on this initial character string. For this, the address or identifier of the service component can be obtained in the server table.

The server forwards the connection request to the service component based on its address. The hostname is redirected further along with the connection request.

After receiving a connection request, the service component determines the terminal to which the request is addressed. This is accomplished, for example, by replacing the separating characters in the initial character string of a point so that a common IP address is formed.

According to one embodiment, the identifier of the service component is not viewed from the source string, but is included in the host name, for example, in a predefined field. The corresponding hostname might look like 192-168-137-12.isyyyyyyp8.my-sda.net, with the service component identifier being isyyyyyyp8. In this embodiment, the server retrieves the second field of the dotted host name and thus determines the identifier of the service component. After that, the connection request is sent to a specific service component. The service component determines from the initial character string the full address of the terminal, that is, 192.168.137.12.

In addition, the service component rechecks the presence of a certificate on the host name for the terminal to which the connection request should be sent. The type of certificate is determined by the protocol based on which the connection request is processed. For example, a connection request for HTTPS requires an SSL or TLS certificate. Such certificates are also required for VPN, FTPS and other protocols. It is possible to determine whether a certificate is available, for example, by searching the local data table, which is stored in the memory of the service component. Alternatively, the corresponding request can be sent directly to an external certification authority. If there is no certificate for the terminal, then the service component requests a certificate for this terminal from an external certifying authority. In some embodiments, a separate certificate is required for each terminal. Alternatively, for several terminals one certificate can be used, for example, a certificate for all terminals connected to this service component.

After receiving the certificate, the service component returns a connection request by establishing a connection with the client through the server. This connection is established in accordance with the usual procedure when using a certificate. For example, a certificate is sent to the client so that it can verify the authenticity of the server. From this point on, the client can exchange data packets with the service component through the server. In some embodiments, a certificate may be used to encrypt the connection.

FIG. 1 shows, by way of example, system 100. Server 120 is configured to receive client connection requests nos. After receiving a connection request, the server 120 in one embodiment retrieves the terminal address from a portion of the host name in the connection request. For example, the server determines, as described above, the local network address of the terminal by extracting a string from the host name. In one embodiment, this is the initial character string containing the address fields separated by separating characters. Alternatively, the terminal address may be in another character string, located in the Nth position of the host name or in the Nth name field. In the last example, the N-e field is defined when viewing host name fields separated by dots. In this way, server 120 may determine the network addresses of terminals 151, 152, 153, or 154. The host name does not necessarily contain the actual address, but may contain an identifier to which the server uses the table to reproduce the actual address. Such embodiments are advantageous in that they do not give these addresses out. Another advantage is that the internal address change only requires updating the table in order to use the new address with the same host name. The identifier or address of the service component to which the terminal is connected can be determined by searching for the terminal address in the table. In some embodiments, the address or identifier of the service component is also determined by the host name. The identifier of the service component can be obtained in the next field of the host name.

The server 120 sends a request to the service component 131 or 132 previously defined. Service Component 131 or 132 checks if there is a certificate for the target address. For example, it checks whether there is already a certificate for the current combination of the service component and the terminal. It also checks if a certificate exists for the service component.

If there is no certificate, then it is requested by the service component from an external certification authority (not shown). If there is a certificate, the service component returns a connection request by establishing a connection with the client but through the server 120. For this, the certificate is first transmitted to the client but to enable it to establish the identity of the server 120. Such identification is performed, for example, by checking the certificate using verification algorithms or through information exchange between the client, but also an external certification organization. At this point, data packets may be transmitted between the client and the service component. The service component sends incoming data packets to the server-specified addresses of the specified terminals. There, the data packets are processed and answered, and the terminal response packets are sent through the corresponding service component and the server 120 back to the client but.

Shown in FIG. The 1 terminals 141, 142, 143, and 144, as well as the service components 131 and 132, are extremely symbolic. The invention encompasses systems in which an arbitrary number of service components and terminals are interconnected. In particular, the invention also works without terminals. In this case, the certified connection is established only between the service component 131 or 132 and the customer no. Also, connections can be established between other clients as between the client and the server 120. In embodiments without a terminal, the address determined from the host name is assigned only to the service component to which it should be forwarded.

FIG. 2 illustrates an exemplary method for establishing a connection between a client and a terminal.

First, a server, such as server 120, provides a host name 210 for each of a number of terminals.

The server at step 220 receives a connection request from the client, for example, from the client but that is sent to one of the provided host names. In response to receiving this connection request, the server first determines the actual recipient of the connection request. For this server to find the first part of the host name in the table to get the local addresses for the service component and / or terminal. Alternatively, the server can extract these addresses directly from the component part of the host name, for example, for the initial character string, by parsing the component into additional character strings.

Based on the received address of the service component, at step 230, the connection request is redirected to it. Then, the service component checks at step 240 whether there is a certificate for the respective recipients, that is, either for the service component itself or for the terminal called at the address. If this is not the case, then at step 250 a certificate is requested for the addressee from the external certification authority.

If the certificate is available, then the service component starts a connection at step 260. To do this, the certificate is first sent to the client so that it can verify the authenticity of the server. Subsequent data packets that are sent from the client to the same recipients reach the service component in the manner described above and are sent from there to the appropriate terminal. The terminal processes the data packet and sends the response to the service component. The response is sent through the server to the client.

Thus, the invention allows to establish certified point-to-point connections between an external client and a terminal that is not assigned its own global IP address. This is especially useful for those terminals that are part of a local network whose nodes do not have global IP addresses. The invention minimizes the cost of drawing up certificates, as they are requested only when necessary. If a certificate is present once, it does not need to be compiled a second time during its validity period.

Claims (28)

1. A system for building connections between a client and a destination device or terminal (100), containing customer (110), server (120), one or more service components (131, 132) and one or more terminals (141, 142) that are connected to one or more service components (131, 132); wherein the server (120) for each of the terminals (141, 142) provides the host name, which is assigned to the corresponding terminal (141, 142), as well as to the corresponding service component (131, 132); wherein the server (120) is configured to redirect as a response to a request to connect to a host with a given name from a client (110) to request a connection to one of one or more of the service components (131, 132) assigned to the host name; and each service component (131, 132) is configured to check, as a response to a connection request, whether the terminal (141, 142) with which the host name is associated has a certificate, while if there is no certificate, the service component ( 131, 132) requests a certificate from an external certification authority, and on the basis of the certificate establishes a connection with the client (110) through the server (120) and sends a data packet between the client (110) and the terminal (141, 142). 2. The system (100) of claim 1, wherein the server (120) is further configured to extract from the host name the first character string and determine from the first character string the address of the corresponding terminal (141, 142). 3. The system (100) of claim 2, in which the service component (131, 132) is additionally configured to extract the second character string from the host name and to determine the address of the corresponding terminal (141, 142) from the second character string. 4. System (100) according to claim 2 or 3, in which the determination of the address is performed by searching for the corresponding character string in the table. 5. The system (100) of claim 2 or 3, in which the address determination is performed by splitting the host name. 6. The service component (131, 132) contains an element for checking the presence of a certificate, configured to verify, as a response to a request to connect a client (100) with a host, whether there is a certificate for the terminal (141, 142) with which the host name is associated; an element for requesting a certificate, configured to request a certificate from an external certification authority in the event that there is no certificate; an element for establishing a connection, configured to establish a connection with the client (110) through the server (120) based on a certificate and forward the data packet between the client (110) and the terminal (141, 142). 7. The service component (131, 132) of claim 6, in which the service component (131, 132) is further provided with an element for extracting a character string, configured to extract the character string from the host name and identify it with the character string of the address of the corresponding terminal (141 , 142). 8. The service component (131, 132) of claim 7, which is equipped with a search element, is configured to identify the terminal address by searching for the corresponding character string in the table. 9. The service component (131, 132) of claim 7, which is provided with a partitioning element configured to identify the address of the terminal based on the division of the host name. 10. A method of building connections between a client and a destination device or terminal (200), comprising: providing (210) a server (120) host name to each of a number of terminals (141, 142), with the host name assigned to the corresponding terminal (141, 142) and service component (131, 132) to which the corresponding terminal is connected (141, 142); as a response to a request to connect to a host with a given name from a client (110), the connection request is sent (230) by the server (120) to one of one or more service components (131, 132), which is assigned a host name; and as a response to the connection request, the service component (131, 132) checks (240) whether the certificate has a terminal (141, 142) that is assigned a host name, and if there is no certificate, a service component (131, 132) performs a certificate request (250) from an external certification authority, and establishes (260) a connection with a client (110) and forwards data packets between the client (110) and the terminal (141, 142). 11. The method (200) of claim 10, wherein the server (120) extracts the first character string from the host name and determines from the first character string the address of the corresponding service component (131, 132). 12. The method (200) of claim 10, wherein the service component (131, 132) extracts the second character string from the host name and determines the address of the corresponding terminal (141, 142) from the second character string. 13. The method (200) of claim 11 or 12, wherein the address is determined by searching for the corresponding character string in the table. 14. The method (200) of claim 11 or 12, wherein the address is determined by splitting the host name. 15. A storage medium readable by a computer using commands that, when executed by one or more processors, perform the method according to any one of claims. 10-12.

Images