Network system

• US 20040054779A1
• Filed: 02/10/2003
• Published: 03/18/2004
• Est. Priority Date: 09/13/2002
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Takeshima, Yoshiteru, Nakahara, Masahiko
• Granted Patent: US 7,219,134 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 16/258 Data format conversion from or to a database
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The disclosed network system comprises a client which sends an access request to a server, the server which receives the access request from the client and distributes content, application servers, each of which performs, upon reception of the content, additional processing of the content and returns processed content and data to a unit that sent the content to it, and a proxy server which relays data to be communicated between the client and the server. The proxy server comprises a unit that relays communication data which receives the access request from the client and forwards it to the server and receives the content from the server and a unit that calls out application server which receives content from the unit that relays communication data, encapsulates the content into a predetermined format message, forwards the message to one of the application servers, and receives the content and result of additional processing performed by the application server. The unit that relays communication data sends data based on the result to the client.

Claims

1. A network system comprising:

a client which sends an access request to a server;

the server which receives the access request from the client and distributes content;

application servers, each of which performs, upon reception of content, additional processing of the content and returns processed content and data to a unit that sent the content to it; and

a proxy server which relays data to be communicated between the client and the server; and

wherein the proxy server comprises;

a unit that relays communication data which receives the access request from the client and forwards it to the server and receives the content from the server; and

a unit that calls out application server which receives content from the unit that relays communication data, encapsulates the content into a predetermined format message, forwards the message to one of the application servers, and receives the content and result of additional processing performed by the application server; and

wherein the unit that relays communication data sends data based on the result to the client.

2. A network system according to claim 1, wherein:

the proxy server includes a transfer control database for storing conditions by which the content is forwarded to one of the application servers and information about the application servers, required for forwarding the content; and

the unit that relays communication data passes the content to the unit that calls out application server if the access request and the content-associated information satisfy the conditions stored in the transfer control database.

3. A network system according to claim 1, wherein:

the unit that relays communication data caches the content sent back from the server, and, when having received a request for access to the cached content from the client, sends back the cached content to the client if it is within its expiry date which has been indicated by the metadata of the content or set on the proxy server beforehand.

4. A network system according to claim 3, wherein:

in response to the result of additional processing returned from one of the application servers, the unit that relays communication data sends back the content received as a response from the server, processed data returned from the application server, cached content, or an error message to the client.

5. A network system according to claim 3, wherein:

the unit that relays communication data caches the processed content received from one of the application servers or content retrieved via the network, according to information indicating a processed content location on the network.

6. A network system according to claim 5, further comprising:

a content registration server which accepts content from a content manager;

a content registrant terminal on which a program runs to provide an interface for registering content with the content registration server; and

a content verification server which receives content from the content registration server and checks the content data by a predetermined method,

wherein the content registration server creates signed content by attaching a signature to content received from the content registrant terminal if the content verification server has verified that the content satisfies predetermined conditions.

7. A network system according to claim 6, wherein:

the content registration server comprises;

a unit that generates signatures which generates the signature, based on the content ID that uniquely identifies the content;

a unit that manages keys which manages private key and corresponding public key certificates for generating the signature; and

a unit that manages registration information which assigns the content ID to content and registers signed content into a registration database.

8. A network system according to claim 7, wherein:

the content registration server requests the proxy server to cache the signed content.

9. A network system according to claim 6, wherein:

the content verification server includes a database for management of a plurality of security levels and performs content verification according to the security levels.

10. A network system according to claim 6, wherein:

the network system includes a master content registration server and one or more slave content registration servers, and

the master content registration server communicates with the slave content registration servers so that the databases of all the content registration servers are synchronized.

11. A network system according to claim 6, wherein:

one of the application servers is a signature verification server which verifies the signature of the signed content;

the server stores the signed content created by the content registration server; and

the proxy server forwards the signed content received from the server to the signature verification server and determines whether the signed content should be sent to the client, according to the result of verification returned.

12. A network system according to claim 11, wherein:

the signature verification server comprises;

a unit that acquires signatures which takes out a signature from signed content that is unverified received from the proxy server;

a unit that verifies certificates which verifies the validity of a public key certificate to be used for verifying the signature;

a certificate revocation list database for management of a certificate revocation list to be used for verifying the validity of a public key certificate;

a unit that verifies signatures for verifying signatures;

a registration database for storing registration information per content ID included in a signature; and

a unit that manages registration information for managing the registration information per content ID.

13. A network system according to claim 12, wherein:

the signature verification server communicates with the content registration server so that the registration database is synchronized with the same database on the content registration server.

14. A network system according to claim 11, wherein:

the proxy server sends the client verified signed content as is or content after removing its signature if the result of verification is valid;

otherwise, an error if the result of verification is invalid.

15. A network system according to claim 11, wherein:

a signature to a second content item is included in a first content item;

when verifying the first content item, the signature verification server stores the signature of the second content item included in the first content item; and

when verifying the second content item, the signature verification server performs verification, using the stored signature of the second content item.