System Architecture and Network Access Control

System Architecture

Learn how QueryPie Server, QueryPie User Agent, Web Browser on User PC, and systems such as Database and Linux Server that users want to access are configured and connected.

System Architecture Diagram

This system architecture is for the case of installing QueryPie Service on a single Linux server. It does not include web services with TLS certificates applied, multi-configuration for high availability, etc.

Descriptions of each component are as follows.

Web Browser on User PC

Users access QueryPie web service through a web browser on their PC. A web browser is essential to use QueryPie. QueryPie administrators and security policy operators manage QueryPie services through QueryPie Web Console.

Also, QueryPie users can access target systems through QueryPie Web SQL Editor and Web Terminal.

QueryPie User Agent on User PC

When using Database Client Applications or SSH Client Applications running on User PC, QueryPie User Agent is required. QueryPie User Agent performs the role of a Local Proxy Agent running on User PC. You can download QueryPie User Agent by logging into QueryPie Web Console.

QueryPie User Agent supports most Database Client Applications and SSH Client Applications running on User PC. (Hereafter referred to as 3rd Party Tool.) For specific examples, please refer to this document: Supported 3rd Party Tools (KO)

QueryPie Server

QueryPie Server running on Linux VM provides Web Console, Web SQL Editor, and Web Terminal as web services. It also performs a core role of providing a Proxy server that understands SQL protocol and ssh protocol and performs access control.

QueryPie Server requires two components.

• QueryPie Database
• QueryPie Redis

QueryPie Database

QueryPie Database stores data for QueryPie Server operation. It stores QueryPie’s User Account, Admin Account, information about systems to connect to, access control policies, etc. It also stores Audit information such as User’s Query Log and System Access Log.

You can use MySQL, MariaDB, or compatible Databases as QueryPie Database.

• AWS Aurora MySQL
• GCP Cloud SQL for MySQL

QueryPie Redis

QueryPie Redis performs a Cache role for QueryPie Server operation. It is a component that is essential for QueryPie Server to operate.

Target Database

This is the Database server that users want to access. QueryPie Server performs an intermediary role between users and Target Database.

Target Server System

This is a system such as Linux Server or Windows Server that users want to access. QueryPie Server performs an intermediary role between users and Target Server System.

Network Access Control Settings

Network Access Types

Centered on the Linux VM where QueryPie is installed, network connections are divided into two types: Outbound and Inbound.

• Outbound: Network access from the Linux VM where QueryPie is installed to the external internet.
• Inbound: Network access from user PCs or customer’s internal network to the Linux VM where QueryPie is installed.

Network Access for Software Installation

Network Access for Product Use

The items below explain network access for product use. They are divided into Common, DAC, SAC, KAC, and WAC according to QueryPie product features.

Common

DAC

SAC

KAC

WAC

Load Balancer Settings

This table explains settings for applying Load Balancer to QueryPie Service for load distribution and fault tolerance.