JP2002312261A - Network service relay method and relay device - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To construct a firewall having both the ability to judge the validity of a service request and the short response time equivalent to "packet filtering", similarly to the "application gateway". A firewall (F) establishes and manages a firewall-server connection with a server (S) in advance and manages the server (S) when a connection request is issued from a client (C). The connection load on the server (S) and the client (C) is reduced, and only the rewriting of the SEQ number and the ACK number is performed when the TCP data packet is relayed between the server (S) and the client (C). In addition, a function for verifying the validity at the time of transferring a service request is provided, and an unauthorized request transfer is blocked.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network service relay method and a relay apparatus for providing a service provided by one computer to another computer via a firewall in a network which can be established between any two computers. About.

[0002]

2. Description of the Related Art As a network protocol standard for establishing a connection between two computers on a computer network, TCP (Transport Command) is used.
unication Protocol: transmission control protocol) <RFC7
61>. In TCP, a connection is established by a method called "3-way handshake". FIG. 6 shows this state.

[0003] In the header of a TCP packet, an SEQ (sequence) number indicating the number of data in a data packet, an ACK (acknowledgment) number for requesting the next data after data normally received, and a SYN (synchronous) flag,
An ACK flag and the like are included, and are used for establishing a TCP connection.

When establishing a connection using TCP,
First, the client (C) sends an S to the server (S).
Send the YN packet (P1). SYN packet (P1)
Contains an initial SEQ number “CS” randomly determined by the client, and at the same time, by validating the SYN flag, indicates that a connection has been requested.

When the server (S) receives the SYN packet (P1) from the client (C), the server (S) transmits a SYN / PIN to the client (C) to inform the client (C) that the SYN packet (P1) has been received. ACK packet (P
2) is generated and sent to the client (C). This SYN
In the generation of the / ACK packet (P2), a value “CS + 1”, which is obtained by adding 1 to the SEQ number from the client (C), is set to the ACK number, and the ACK flag is made valid. The initial SEQ number “SS” determined by the user is set and the SYN flag is made valid.

In the client (C), a connection is established when a SYN / ACK packet (P2) is received from the server (S). However, since a connection has not been established on the server (S) side, the client (C) generates an ACK packet (P3) and sends it to the server (S). In the generation of this ACK packet (P3), the SYN sent from the server (S) is added to the SEQ number.
/ ACK packet (P2) is set to the number “CS + 1” indicated in the ACK number, and the ACK number is added to the SYN / ACK packet (P2) SEQ number plus 1 to “SS +
1 "has been set.

The server (S) sends this ACK packet (P
When 3) arrives, the SEQ numbers on both sides of the client (C) and the server (S) are synchronized, and a connection is established on the server (S) side. After the connection is established, data can be sent from either the client (C) or the server (S).

For example, when the first data is sent from the client (C) to the server (S), the SEQ number is set to “CS + 1”, the ACK number is set to “SS + 1”, and the ACK flag is set. Is transmitted (P4). In addition, when sending additional data,
A data packet (P5) with the SEQ number "CS + 101" representing the next of the 100 bytes of data sent earlier and "SS + 1" set for the ACK number to enable the ACK flag
Send.

The server (S) having received the data sends an ACK packet (P6) to the client (C) at an appropriate timing. When sending the ACK packet (P6) at this time, “CS + 251” representing the next SEQ number of the data (CS + 250 in SEQ number) received at that time is set in the ACK number, and “SS +” is set in the SEQ number.
Set "1" to enable the ACK flag.

In a computer network, there are servers that provide services through the network and clients that receive the services. WW based on HTTP (Hypertext Transfer Protocol) <see RFC1945>
W (World Wide Web) server, WWW browser, FTP
FTP server and FTP client based on (file transfer protocol) <refer to RFC959> are good examples.

By the way, a server computer operating as a server that provides the above-mentioned services on a network requires an intrusion or denial of service attack (Denial of Denial of Service).
Service attacks). As a means to protect server computers from such attacks,
There is a method of installing a firewall in front of the server computer.

There are two main methods for protecting the server computer with the firewall, namely, "packet filtering" and "application gateway".

The former “packet filtering” is
This is a method that protects the server by checking packets, which are units of communication through the network. That is, this method focuses on the fact that the packet includes the IP address of the destination computer and the port number indicating the service type, and passes only the packet having the combination of the specific IP address and the port number. . For example, if the IP address is (10.0.0.1)
If the user wants to provide the WWW service on the server computer, the IP address of the server computer (1
(0.0.0.1) and the port number of the WWW service (80).

The latter “application gateway” receives all messages, such as a service request from a client, and determines whether the firewall complies with the rules of the service. This is a method of making and transferring it to a server computer, and relaying a reply from the server computer to the client.

[0015]

However, in the conventional "packet filtering" method of the firewall, only the packet is checked. Therefore, when an application-level service request is invalid, it is necessary to check this. Can not. For example,
WWW for performing denial of service attacks on WWW servers
Although often in the form of WWW service requests from clients, such attacks cannot be prevented by "packet filtering". Also, "packet filtering" cannot prevent a denial-of-service attack in which a large number of connection establishment requests are made to a server.

In the case of the method using the “application gateway”, it is determined whether or not the client's service request complies with the service rules, so that a denial of service attack as in the above example can be prevented. However, an “application gateway” is a form in which a server and a client relay communication between each other, and usually an OS (Operating System).
m), it is realized as an application above, so when compared to the former “packet filtering”,
The response time from when the client sends a service request to when it receives a response from the server becomes longer.

The present invention has been made in order to solve the above problems, and has as its object the ability to determine the legitimacy of a service request and the "packet filtering" as in the "application gateway". An object of the present invention is to provide a network service relay method and a relay device in which a firewall having the same short response time as that of the above is constructed.

Another object of the present invention is to provide a method and apparatus for relaying a network service, wherein a firewall can establish a connection with a client instead of a server, thereby establishing a new connection. The purpose is to reduce the load on the server.

Another object of the present invention is to provide a network service relay method and a relay device, wherein a firewall can manage the number of connections between a server and a client, thereby providing a server for providing services. The purpose is to manage the load.

[0020]

In order to achieve the above object, a network service relay method according to the present invention has the following characteristic configuration.

(1) A service which is applied to a network which can establish a connection between any two computers based on both connection keys, and which provides a service provided by a server on one computer to another computer Or a network service relay method provided to a client on another computer through a firewall provided by the same computer, wherein one or more firewall-servers are previously provided between the firewall and the server. A first step of establishing a connection and holding a connection key of the server side and the firewall side used for the connection, and a first step of holding a connection key between the client and the firewall. Before putting A second step of establishing a client-firewall connection using one of the server-side connection keys, and holding the client-side connection key and the firewall-side connection key used for establishing the connection; ,
A third step of coupling and relaying the client-firewall connection and the firewall-server connection.

(2) In the configuration of (1), in the third step, the connection key of the message arriving from the client is rewritten to the connection key on the firewall side of the firewall-server connection and transferred to the server. Then, the connection key of the message arriving from the server is rewritten to the connection key on the client side of the connection between the client and the firewall, and is transferred to the client side.

(3) In the configuration of (1), the first step is performed by setting an integer M (M ≧ 1) in advance as a management capacity.
Is specified, the connection between the client-firewall connection and the unconnected firewall-server connection, and the connection between the client-firewall connection and the already-connected firewall-server connection are combined. It is characterized in that the establishment of a firewall-server connection is limited so that the total is M or less.

(4) In the configuration of (3), the first step is to set an integer N (M
When (≧ N ≧ 1) is specified, an initialization process for establishing N unconnected firewall-server connections in an initial state is performed.

(5) In the configuration of (4), in the first step, when the total number of the firewall-server connections is M or less, the disconnection of the unbound firewall-server connection or the client-server connection is performed. When the number of unconnected firewall-server connections becomes less than N due to the connection with the firewall connection, a new unconnected firewall-server connection is established, and N unconnected firewall-server connections are established. It is characterized by maintaining.

(6) In the configuration of (1), the second step includes the step of connecting the unconnected client-firewall connection not connected to the firewall-server connection, and connecting the firewall-server connection. The total of the client-to-firewall connections including the already-existing firewall-to-client connections is equal to the first
The establishment of the client-firewall connection is limited so as not to exceed the total of the firewall-server connection established in the step (i).

(7) In the configuration of (1), in the second step, when a connection establishment request is newly issued from the client to the firewall, the number of unconnected firewall-server connections and the number Compare the number of unbound client-firewall connections, and if the number of client-side connections exceeds the number of server-side connections, establish a new client-firewall connection and reduce the number of client-side connections to the server side. If the number of connections is equal to or less than the number of connections, the connection establishment request from the client is discarded, or until the number of unbound firewall-server connections exceeds the number of unbound client-firewall connections. K Iento - wherein the delay between the firewall connection establishment.

(8) In the configuration of (1), the third step is a step of connecting the client-firewall connection and the firewall-server connection in the coupled state between the client-firewall connection and the client-firewall connection. When a message is received from the client, the message is verified to determine whether there is any fraud, and if it is determined to be fraudulent, the client-firewall connection is disconnected, and if it is determined that there is no fraud, The message is coupled to an uncoupled firewall-server connection, and the message is transferred to the server through the firewall-server connection.

(9) In the configuration of (8), the third step is a step of connecting the client-firewall connection and the firewall-server connection in the connection state between the client-firewall connection and the client-firewall connection. When an additional message is received from the client, this message is verified to determine whether there is any fraud. If the message is determined to be fraudulent, the client-firewall connection and the client-firewall connection have been combined. If it is determined that there is no fraud, the received additional message is passed through the firewall-server connection that is coupled to the client-firewall connection. Transfer to the server, and when it is determined that the message is not invalid but not an additional message, transfer the received message to the server as it is through the firewall-server connection coupled to the client-firewall connection. Features.

(10) In the configuration of (1), the third
In the step of connecting, when the client-firewall connection and the firewall-server connection are connected, when a message from the server is received through the firewall-server connection, the message is verified to determine whether there is any fraud. If it is determined that the connection is invalid, the firewall-server connection and the client-firewall connection already connected to the firewall-server connection are disconnected. -Forward the message to the client through the client-firewall connection coupled to the server-to-server connection, and if it is determined that the message is not invalid but not a message, Firewall - client is bound to the server inter-connection - characterized by transferring it to the client through the connection between the firewall.

(11) In any one of the constitutions (3), (4) and (5), the management capacity is designated and changed by a control signal from the server.

(12) In any one of the constitutions (3), (4) and (5), when the plurality of client groups in which one or more clients are put together exist, It is specified and changed for each group.

(13) In any one of the constitutions (3), (4), and (5), when the number of managed units is more than one server group in which one or more servers are grouped,
It is specified and changed for each server group.

The network service relay device according to the present invention has the following characteristic configuration.

(14) A network service relay device which is applied to a network system in which a server client service is performed, relays information transmitted between a server computer and a client computer, and functions as a firewall, A predetermined number between the client computer and the server computer;
Unbound connection management means for establishing and managing a firewall-server connection and an unbound firewall-server connection, and a client-firewall connection between the client computer and the client computer for which a new connection request has been made. New connection processing means for establishing, and a service request validity verification means for verifying the validity of the service request from the client computer coupled by the client-firewall connection established by the new connection processing means,
When the validity of the service request validity verifying means is recognized, the client-firewall connection and the firewall-server connection are combined and the verified service request is transferred to the server computer, and the validity is recognized. When there is no connection, there is provided inter-connection relay processing means for disconnecting the connection between the client-firewall connection and the firewall-server connection.

(15) In the configuration of (14), furthermore, the connection-to-connection relay processing means further comprises a client
Connections between firewalls and firewalls
Service connection verification means for verifying the validity of the service response sent from the server computer in connection with the connection between the servers; and the connection relay processing means, when the service response verification means finds the validity, to The verification service request is transferred to the client computer, and when the validity is not recognized, the connection between the client-firewall connection and the firewall-server connection is disconnected.

(16) In the configuration of (14), the uncoupled connection management means, when the maximum number of firewall-server connections is specified, specifies the unbound firewall-server connection with the client-firewall connection. It is characterized in that the number of inter-connections is limited within the maximum number of connections.

(17) In the configuration of (14), the network system is a TCP / IP (Transport Community).
communication protocol / Internet Protocol), the connection-to-connection relay processing means includes a TCP
The unconnected connection management means and the new connection processing means are arranged in a TCP layer, and the service request validity verification means is arranged in an application layer.

(18) In the configuration of (14), the network system is a TCP / IP (Transport Community).
communication protocol / Internet Protocol), the connection-to-connection relay processing means includes a TCP
The unconnected connection management means and the new connection processing means are disposed in a TCP layer, and the service request validity verification means and the service response validity verification means are disposed in an application layer. It is characterized by the following.

According to the present invention, the service relay can be performed at high speed after judging the legitimacy of the service request by the above configuration, the load on establishing a connection with the client can be reduced, and the client and the server can be connected. Provide a technology to realize a firewall that can manage the number of connections with the firewall.

[0041]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below in detail with reference to FIGS.

FIG. 1 is a conceptual diagram showing the configuration of a TCP network system to which the present invention is applied. In FIG. 1, reference numeral 11 denotes a server (S) connected to a network N1.
Server computer 12 is connected to the network N2 and is a client computer functioning as the client (C). A connection / relay functioning as a firewall (F) is provided on the path connecting the network N1 and the network N2. Module 13 is interposed.

Hereinafter, first to third embodiments in which the present invention is applied to the above system will be described.

(First Embodiment) As a first embodiment, a case where the service relay method according to the present invention is realized by sequence processing will be described with reference to the sequence diagram shown in FIG.

In FIG. 2, first, the firewall (F) communicates with the server (S) in advance with a SYN packet (P11), a SYN / ACK packet (P12),
A connection between the firewall and the server is established through the exchange of the K packet (P13).

The firewall (F) performs SYN based on a connection establishment request from the client (C).
Upon receiving the packet (P14), a connection between the client and the firewall is established through the exchange of the SYN / ACK packet (P15) and the ACK packet (P16). At this time, the SEQ number used by the firewall (F) is the same as the firewall number with the server (S).
The initial SEQ number “SS” used by the server (S) when the connection between the servers is established is used.

Thereafter, upon receiving the data packet (P17) from the client (C), the firewall (F) changes its SEQ number “CS + 1” to the initial SEQ of the firewall-server connection established by the firewall (F). Based on the number “FW”, the data is rewritten to the SEQ number “FW + 1”, and the data packet (P1
8) is relayed to the server (S). Subsequently, the ACK number “FW + 101” of the ACK packet (P19) from the server (S) is rewritten to the ACK number “CS + 101” based on the initial SEQ number of the client, and the data packet (P20) is rewritten to the client (C). It is realized by relay transfer to.

The firewall (F) in the above processing
3 is shown in FIG.

First, the firewall (F) establishes a new firewall-server connection with the server (S) as an initial setting, and sets an initial SEQ number on the firewall (F) side and the server (S) side. "F
W "and" SS "are held (S1), and the process waits for a connection request from the client (C) (S2). If there is a connection request from the client (C), the server-side initial SEQ number "SS" that has been retained is stored in the client (C).
A client-firewall connection is established using the connection establishment with the client, the client-side initial SEQ number "CS" is held (S3), and a TCP data packet from the client (C) is waited for a certain period of time. (S4).

Within a certain period, the client (C)
When the P data packet arrives, the TCP data packet uses the “CS + ΔCS” based on the client-side initial SEQ number “CS” of the client-firewall connection as the SEQ number. TC to the server (S) after rewriting the initial SEQ number “FW” on the firewall side of the inter-connection to the SEQ number “FW + @ CS” based on
The P data packet is transferred (S5). After the transfer, the process returns to step S4.

In step S4, if the TCP data packet has not arrived from the client (C) within a certain period, the TCP data from the server (S) is further sent for a certain period.
It waits for a data packet to arrive (S6). If a TCP data packet arrives from the server (S) within a certain period, the TCP data packet has an ACK number of "FW + @ FW" based on the firewall-side initial SEQ number "FW" of the firewall-server connection. Therefore, this is rewritten to "CS + @ CS" based on the client-side SEQ number "CS" of the client-firewall connection, and then the TCP data packet is transferred to the client (C) (S7).
After the transfer, the process returns to step S4.

In step S6, if a TCP data packet has not arrived from the server (S) within a certain period, a timeout or a request from the connection destination computer
It is determined whether one of the firewall-server connection and the client-firewall connection has been disconnected (S8). If it has not been disconnected, the process returns to step S4. If it has been disconnected, the other connection is disconnected, and the stored initial SEQ numbers "FW", "SS", and "CS" are cleared (S9), and the process returns to step S1.

As a result of the above processing, the firewall (F)
In the above, by securing a connection with the server (S) in advance, the server (S) at the time of connection from the client (C)
The load on the server (S) and the client (C) can be reduced, and the speed of the relay process can be increased by only rewriting the SEQ number and the ACK number when relaying the TCP data packet between the server (S) and the client (C).

(Second Embodiment) As a second embodiment, a case where the service relay method according to the present invention is applied to the combining / relay module 13 shown in FIG. 1 will be described with reference to a conceptual diagram shown in FIG. Will be explained.

The coupling / relay module 13 shown in FIG.
An uncoupled connection management unit 131 that sets and manages the number of firewall-server connections that are not coupled to the client-firewall connections to N out of the maximum number M of firewall-server connections with the server computer 11; An inter-connection relay processing unit 132 for relaying between a firewall-server connection and a client-firewall connection, a new connection processing unit 133 for processing a new connection establishment request from the client computer 12, or when a new connection is established or The service request validity verification unit 134 verifies the validity of the service request at the time of relaying, and the service response validity verification unit 135 verifies the validity of the service response at the time of relaying.

The operation of the above configuration will be described below along the flow of processing.

In the connection / relay module 13 for constructing the firewall, the unconnected connection management unit 13
1 establishes N firewall-server connections with the server computer 11 in advance,
Hold the connection key. If the number of unconnected connections is 1 or more when a connection request is received from the new client computer 12i, the new connection processing unit 133 uses the connection key held in the unconnected connection Establish a connection between the server and the firewall.

Next, the service request validity verification section 134
Are connected client computers 121 to 12n
When the service request is received from, the validity is verified. Upon receiving the service response from the server computer 11, the service response validity total verification unit 135 verifies the validity of the service response. Inter-connection relay processing unit 132
Relays between the server computer 11 and the connected client computers 121 to 12n only when the verification results of the service request validity verification unit 134 and the service response validity verification unit 135 are valid.

That is, the inter-connection relay processing unit 13
2 is verified by the service request validity verification unit 134. If the service request is not valid, the inter-connection relay processing unit 132 disconnects the connection between the client computer and the server computer. Do. Similarly, the service response relayed by the connection-to-connection relay processing unit 132 is the service response validity verification unit 1
If the connection is not valid, the relay processing unit 132 disconnects the connection between the client computer and the server computer, and if not, relays the data.

According to the above module configuration, as a result, the number of connections of the server computer 11 can be limited to M or less, and the load on the server computer can be limited. Further, the validity of the service request and the service response between the server computer and the client computer can be verified.

(Third Embodiment) As a third embodiment, when the system shown in FIG. 1 is configured by TCP / IP, the service relay method according to the present invention The case of realization in the IP layer will be described with reference to the TCP / IP layer structure diagram shown in FIG. In FIG. 5, blocks having the same functions as those in FIG. 4 are denoted by the same reference numerals.

The hierarchical structure shown in FIG. 5 includes a network interface layer, an IP layer, a TCP layer, and an application layer. An inter-connection relay processing unit 132 is arranged between the IP layer and the TCP layer. The processing unit 131 and the unconnected connection management unit 133 are arranged, and the service request validity verification unit 1 is provided in the application layer.
34, a service response validity verification unit 135 is disposed.

The unconnected connection management unit 131 establishes a server-firewall connection with the server computer 11 in advance, and holds a connection key. If there is a new connection establishment request from the client computer 12, first, the new connection processing unit 133 establishes a connection using the connection key held in the unconnected connection management unit 131.

Next, the service request validity verification section 134 verifies the service request. If the service request is valid, the inter-connection relay processing section 132 transfers the service request to the server computer 11. The service response validity verification unit 13
5 verifies the service request, and if it is valid, the inter-connection relay processing unit 132 transfers the service response to the client computer 12. Subsequent processing is performed only by rewriting the packet header by the inter-connection relay processing unit 132.

According to the above module configuration in the TCP / IP layer, as a result, a service request equivalent to that of the “application gateway” can be verified, and at the same time, subsequent relaying is performed only by rewriting the packet header. A response speed equivalent to "packet filtering" can be obtained.

In each of the above embodiments, the connection / function that functions as a firewall separately from the server computer.
Although the case where the present invention is applied to a system having a relay module has been described, the coupling / relay module of each embodiment may be incorporated in the server computer itself.

[0067]

As described above, according to the present invention, like the "application gateway", the ability to judge the validity of the service request and the "packet filtering"
It is possible to provide a network service relay method and a relay device in which a firewall having the same short response time as that of the above is constructed.

Further, in the above network service relay method and relay apparatus, the firewall can establish a connection with the client instead of the server, thereby reducing the load on the server for establishing a new connection. it can.

Further, in the above network service relay method, the firewall can manage the number of connections between the server and the client, thereby managing the load on the server for providing the service.

As a result, while having a robust service request verification capability equivalent to that of the “application gateway” system, relaying by simple processing after connection establishment is possible, and the load on the server at the time of connection establishment is reduced.
A network service relay method and a relay device capable of managing the number of connections between a client and a server can be provided.

[Brief description of the drawings]

FIG. 1 is a conceptual diagram showing the configuration of a TCP network system to which the present invention is applied.

FIG. 2 is a sequence diagram for explaining a case where the service relay method according to the present invention is implemented by sequence processing as the first embodiment.

FIG. 3 is a flowchart illustrating processing in a firewall (F) according to the first embodiment.

FIG. 4 is a conceptual diagram illustrating a case where a service relay method according to the present invention is applied to a combining / relay module as a second embodiment.

FIG. 5 is a diagram illustrating a TCP / IP layer structure for describing a case where a service relay method according to the present invention is implemented in a TCP / IP layer of a coupling / relay module 13 in a TCP / IP network system as a third embodiment; FIG.

FIG. 6 is a sequence diagram showing how a TCP connection is established.

[Explanation of symbols]

S: server C: client F: firewall 11: server computer 12: client computer 13: functioning connection / relay module (firewall) 131: unconnected connection management unit 132: connection relay processing unit 133: new connection processing unit 134: Service request validity verification unit 135: Service response validity verification unit

 ────────────────────────────────────────────────── ─── Continuing on the front page (72) Inventor Satoshi Morai 2-3-1 Otemachi, Chiyoda-ku, Tokyo Nippon Telegraph and Telephone Corporation F-term (reference) 5B089 GA04 GB01 HB18 KA05 KA17 KB13 KG03 KG07 5K030 GA02 GA15 HA08 HD03 JA11 JT06 LB01 LB19

Claims (18)

[Claims] 1. A service which is applied to a network capable of establishing a connection between any two computers based on both connection keys, and which provides a service provided by a server on one computer to another computer. Or a network service relay method provided to a client on another computer through a firewall provided by the same computer, wherein at least one firewall-server connection is previously established between the firewall and the server A first step of establishing a connection key on the server side and the firewall side used for the connection, and a first step between the client and the firewall.
Establishing a client-firewall connection using one of the server-side connection keys held in the step, and connecting the client-side connection key and the firewall-side connection used to establish the connection. A network service relay method, comprising: a second step of retaining a key; and a third step of combining and relaying the client-firewall connection and the firewall-server connection. 2. The method according to claim 1, wherein the third step is to rewrite a connection key of a message arriving from the client into a connection key on the firewall side of the firewall-server connection and transfer the connection key to the server. 2. The network service relay method according to claim 1, wherein a connection key is rewritten to a connection key on the client side of the connection between the client and the firewall and transferred to the client side. 3. The first step includes: when an integer M (M ≧ 1) is specified in advance as the management capacity, the client-firewall connection, the unconnected firewall-server connection, and the client The connection between the firewall and the server is limited so that the total number of connections between the firewall and the server, which is the sum of the connection between the firewall and the server and the connection between the connected firewall and the server, is M or less. Item 1
2. The network service relay method according to item 1. 4. The first step is to establish N unconnected firewall-server connections in an initial state when an integer N (M ≧ N ≧ 1) is specified in advance as an initial management capacity. 4. The network service relay method according to claim 3, wherein an initialization process is performed. 5. The method according to claim 1, wherein when the total number of the firewall-server connections is equal to or less than M, the unconnected firewall-server connection is disconnected or the client-firewall connection is connected. When the number of unconnected firewall-server connections becomes less than N, a new unconnected firewall-server connection is established and N unconnected firewall-server connections are maintained. Item 4
2. The network service relay method according to item 1. 6. The client-firewall connection not coupled to the firewall-server connection, the second step comprising:
The sum of the client-firewall connection, which is the sum of the firewall-server connection and the combined firewall-client connection, is the sum of the firewall-server connection established in the first step. 2. The network service relay method according to claim 1, wherein the connection between the client and the firewall is limited so as not to exceed the limit. 7. The method according to claim 7, wherein, when a connection request is newly issued from the client to the firewall, the number of the unbound firewall-server connections and the number of the unbound client-firewall connections are changed. If the number of client-side connections exceeds the number of server-side connections, a new connection between the client and the firewall is established, and the number of client-side connections is equal to or less than the number of server-side connections. If so, the connection establishment request from the client is discarded, or the client-firewall connection is continued until the number of the unbound firewall-server connections exceeds the number of the unbound client-firewall connections. Network service relaying method according to claim 1, characterized in that the delay between connection establishment. 8. The method according to claim 3, wherein the third step is a step of connecting the client-firewall connection and the firewall-server connection and receiving a message from the client through the client-firewall connection. This message is verified to determine whether there is any fraud. If determined to be fraudulent, the connection between the client and the firewall is disconnected. If determined to be fraudulent, a connection between the unbound firewall and server is determined. The method according to claim 1, wherein the message is transferred to the server through the firewall-server connection. 9. The third step includes receiving an additional message from the client through the client-firewall connection in a connection state between the client-firewall connection and the firewall-server connection. In this case, this message is verified to determine whether there is any fraud. If it is determined to be fraudulent, the client-firewall connection and the firewall-server connection already connected to the client-firewall connection are disconnected. If it is determined that there is no fraud, the additional message received is forwarded to the server through the firewall-server connection coupled to the client-firewall connection, However, if it is determined that the message is not an additional message, the received message is directly transferred to the server through the firewall-server connection coupled to the client-firewall connection. 2. The network service relay method according to item 1. 10. The method according to claim 10, wherein the third step is a step of receiving a message from the server through the firewall-server connection in a connection state between the client-firewall connection and the firewall-server connection. The message is verified to determine whether there is any fraud. If it is determined to be fraudulent, the firewall-server connection and the client-firewall connection that has been combined with the firewall-server connection are disconnected, and there is no fraud. If it is determined, the firewall
Forwards the message to the client through the client-firewall connection coupled to the server-to-server connection, and if it is determined that the message is not invalid but not a message,
2. The network service relay method according to claim 1, wherein the data is directly transferred to the client through a client-firewall connection coupled to the firewall-server connection. 11. The network service relay method according to claim 3, wherein the management capacity is designated and changed by a control signal from the server. 12. The method according to claim 3, wherein the management capacity is designated and changed for each client group when there are a plurality of client groups in which one or more clients are put together. 6. The network service relay method according to any one of 5. 13. The server according to claim 3, wherein the management capacity is designated and changed for each server group when there are a plurality of server groups in which one or more servers are grouped. A network service relay method according to any one of the above. 14. A network service relay device applied to a network system in which a server client service is performed, relaying information transmitted between a server computer and a client computer, and functioning as a firewall, An unconnected connection management means for establishing and managing a client-firewall connection and an unconnected firewall-server connection with a predetermined number of server computers, and a new connection request among the client computers New connection processing means for establishing a client-firewall connection with a client computer having a problem, and a client-firewall established by the new connection processing means. Service request validity verification means for verifying the validity of the service request from the client computer connected by the connection between the clients, and when the service request validity verification means finds validity, the client-firewall connection The connection is connected to the firewall-server connection and the service request to be verified is transferred to the server computer, and when the validity is not recognized, the connection between the client-firewall connection and the firewall-server connection is disconnected. A network service relay apparatus comprising: an inter-connection relay processing unit. 15. A service response verification means for verifying the validity of a service response sent from a server computer by the connection between a client-firewall connection and a connection between a firewall and a server in said connection relay processing means. The connection relay processing means transfers the service request to be verified to the client computer when the service response verification means finds the validity, and when the validity is not recognized, the connection between the client and the firewall. The network service relay device according to claim 14, wherein the connection with the firewall-server connection is disconnected. 16. The unbound connection management means,
15. The method according to claim 14, wherein when the maximum number of firewall-server connections is specified, the number of unbound firewall-server connections with the client-firewall connection is limited to the maximum number of connections. Network service relay device. 17. The method according to claim 17, wherein the network system is a TCP /
IP (Transport Communication Protocol / Internet P
When the connection request is established in a TCP / IP protocol, the inter-connection relay processing means is arranged between a TCP layer and an IP layer, the unconnected connection management means and the new connection processing means are arranged in a TCP layer, and the service request 15. The network service relay device according to claim 14, wherein the validity verification unit is arranged in an application layer. 18. The method according to claim 1, wherein the network system is a TCP /
IP (Transport Communication Protocol / Internet P
When the connection request is established by the protocol, the inter-connection relay processing means is arranged between the TCP layer and the IP layer, the unconnected connection management means and the new connection processing means are arranged in the TCP layer, and the service request 15. The network service relay device according to claim 14, wherein the validity verification unit and the service response validity verification unit are arranged in an application layer.