System for performing remote operation between firewall-equipped networks or devices

• US 5,960,177 A
• Filed: 03/12/1996
• Issued: 09/28/1999
• Est. Priority Date: 05/19/1995
• Status: Expired due to Term

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Tanno, Kazuhira
• Primary Examiner(s): Rinehart, Mark H.
• Application Number:
  US08/614,060
• Time in Patent Office: 1,295 Days
• Field of Search: 395/200.55, 395/200.58, 395/187.01, 395/200.59, 395/200.57, 395/200.79, 395/186, 370/402, 370/401, 380/49, 340/825.34
• US Class Current: 709/229
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network

Abstract

A remote operation system is disclosed which is used with a network environment in which a unit that provides remote operation services through networks and a unit that receives the services are each safeguarded by a firewall (or "each equipped with a firewall for") from an external network. The remote operation service receiving unit sets up a connection A with the firewall installed on the remote operation service providing unit side and transmits security check information to that firewall. The firewall checks this security check information and then sets up a connection B with the remote operation service providing unit via its associated internal network when it is determined that the security check information has been sent from a contract user unit. Thereby, information used for remote operation can be transmitted between the two units over a logical path composed of the connections A and B.

Claims

1. A system which is provided with a servicing unit connected to a first internal network in which a first firewall is installed for an external network and a serviced unit connected to a second internal network in which a second firewall is installed for said external network, wherein said servicing unit performs a remote operation on said serviced unit through said external network, said serviced unit comprising:

packet communications means for transmitting an identifier specifying the address of said servicing unit connected to said first internal network, setting up a connection with said servicing unit via said second firewall and said first firewall, and transmitting packets to or from said servicing unit over said connection; and

remote operation execution means for fetching remote operation directive information from packets received by said packet communications means and performing a remote operation on said serviced unit as indicated by said remote operation directive information.

2. A system which is provided with a servicing unit connected to a first internal network in which a first firewall is installed for an external network and a serviced unit connected to a second internal network in which a second firewall is installed for said external network, wherein said servicing unit performs a remote operation on said serviced unit through said external network, said serviced unit comprising:

packet communications means for setting up a connection with said first firewall via said second firewall and transmitting packets to or from said first firewall over said connection; and

security check means for checking remote operation directive information contained in packets received by said packet communications means for validity;

remote operation execution means for performing a remote operation on said serviced unit as indicated by said remote operation directive information which has been validated by said security check means; and

execution result return means for returning the result of execution of said remote operation by said remote operation execution means to said first firewall through said packet communications means.

3. A system which is provided with a servicing unit connected to a first internal network in which a first firewall is installed for the Internet and a serviced unit connected to a second internal network in which a second firewall is installed for the Internet, wherein said servicing unit performs a remote operation on said serviced unit through said Internet, said serviced unit comprising:

packet communications means for transmitting an identifier specifying the address of said servicing unit connected to said first internal network, setting up a connection with said servicing unit via said second firewall and said first firewall, and transmitting packets to or from said servicing unit over said connection; and

remote operation execution means for fetching remote operation directive information from packets received by said packet communications means and performing a remote operation on said serviced unit as indicated by said remote operation directive information.

4. A system which is provided with a servicing unit connected to a first internal network in which a first firewall is installed for the Internet and a serviced unit connected to a second internal network in which a second firewall is installed for said Internet, wherein said servicing unit performs a remote operation on said serviced unit through said Internet, said serviced unit comprising:

packet communications means for setting up a connection with said first firewall via said second firewall and transmitting packets to or from said first firewall over said connection; and

security check means for checking remote operation directive information contained in packets received by said packet communications means for validity;

remote operation execution means for performing a remote operation on said serviced unit as indicated by said remote operation directive information which has been validated by said security check means; and

execution result return means for returning the result of execution of said remote operation by said remote operation execution means to said first firewall through said packet communications means.

5. A central unit which functions as a second firewall against access to a servicing unit via an external network by a serviced unit connected to a first internal network in which a first firewall is installed for said external network, comprising:

first packet communications means for setting up a first connection with said serviced unit via said first firewall and said external network and transmitting packets to or from said serviced unit over said first connection;

security check means for determining whether or not packets received by said packet communications means after said first connection has been set up are packets transmitted from a serviced unit of a contract user; and

second packet communications means for, when the determination by said security check means is that said packets are packets from said serviced unit of a contract user, setting up a second connection with said servicing unit via a second internal network connected to said central unit and transmitting packets to or from said servicing unit connected to said second internal network over said second connection.

6. The central unit according to claim 5, further comprising:

a database into which contract user validation information has been entered, and wherein

said security check means checks received packets as to whether said received packets contain said user validation information in said database, thereby determining whether or not said received packets are packets from a contract user.

7. The central unit according to claim 5, further comprising:

a database into which servicing unit identification information used to set up said second connection has been entered, and wherein

said second packet communications means retrieves servicing unit identification information corresponding to identification information in packets received by said first packet communications means from said database and sets up said second connection using said servicing unit identification information.

8. A central unit which functions as a second firewall against access to a servicing unit via the Internet by a serviced unit connected to a first internal network in which a first firewall is installed for said Internet, comprising:

first packet communications means for setting up a first connection with said serviced unit via said first firewall and said Internet and transmitting packets to or from said serviced unit over said first connection;

security check means for determining whether or not packets received by said packet communications means after said first connection has been set up are packets transmitted from a serviced unit of a contract user; and

second packet communications means for, when the determination by said security check means is that said packets are packets from said serviced unit of contract user, setting up a second connection with said servicing unit via a second internal network connected to said central unit and transmitting packets to or from said servicing unit connected to said second internal network over said second connection.

9. The central unit according to claim 8, further comprising:

a database into which contract user validation information has been entered, and wherein

said security check means checks received packets as to whether said received packets contain said user validation information entered in said database, thereby determining whether or not said received packets are packets from a contract user.

10. The central unit according to claim 8, further comprising:

a database into which IP addresses of servicing units used to set up said second connection have been entered, and wherein

said second packet communications means retrieves an IP address corresponding to service identification information in packets received by said first packet communications means from said database and sets up said second connection using said IP address.

11. A unit to be serviced which is connected to a first internal network in which a first firewall is installed for an external network and receives a remote operation service from a servicing unit connected to a second internal network in which a second firewall is installed for the external network, comprising:

packet communications means for transmitting an identifier specifying an address of the servicing unit connected to the second internal network, establishing a connection to the servicing unit through the first and second firewalls, and transmitting a packet to and from the servicing unit through the connection; and

remote operation execution means for retrieving remote operation directive information from the packet received by said packet communications means, and performing a remote operation on the unit to be serviced.

12. The unit to be serviced according to claim 11, wherein

said external network is Internet.

13. A unit to be serviced which is connected to a first internal network in which a first firewall is installed for an external network and receives a remote operation service from a servicing unit connected to a second internal network in which a second firewall is installed for the external network, comprising:

packet communications means for establishing a connection to the second firewall through the first firewall, and transmitting a packet to and from the second firewall through the connection;

security check means for checking security of remote operation directive information stored in the packet received by said packet communications means;

remote operation execution means for performing a remote operation on the unit to be serviced according to the remote operation directive information whose security is checked by said security check means; and

execution result return means for returning an execution result of the remote operation performed by said remote operation execution means to the second firewall through said packet communications means.

14. The unit to be serviced according to claim 13, wherein

said external network is Internet.

15. A system having a servicing unit connected to a first internal network and a serviced unit connected to a second internal network, the servicing unit performing a remote operation on the serviced unit through an external network, the serviced unit comprising:

a packet communication unit setting up a connection with the servicing unit and transmitting packets of information including an identifier specifying remote operation directive information; and

a remote operation execution unit fetching the remote operation directive information from the packets received by the packet communication unit and performing a remote operation based on the remote operation directive information.

16. The system of claim 15, wherein the remote operation directive information includes a service ID, a user ID, a password and a serviced unit ID.