Secure communication network

• US 10,277,594 B2
• Filed: 07/22/2014
• Issued: 04/30/2019
• Est. Priority Date: 07/25/2013
• Status: Active Grant

• Current Assignee: KE2 Therm Solutions, Inc. (Acuity Brands, Inc.)
• Original Assignee: KE2 Therm Solutions, Inc. (Acuity Brands, Inc.)
• Inventors: Roberts, Steve, Sert, Cetin
• Primary Examiner(s): Schmidt, Kari L
• Application Number:
  US14/907,014
• Publication Number:
  US 20160164872A1
• Time in Patent Office: 1,743 Days
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

The present invention is directed to a secure communication network that enables multi-point to multi-point proxy communication over the network. The network employs a smart server that establishes a secure communication link with each of a plurality of smart client devices deployed on local client networks. Each smart client device is in communication with a plurality of agent devices. A plurality of remote devices can access the smart server directly and communicate with an agent device via the secure communication link between the smart server and one of the smart client devices.

Claims

1. A system comprising:

a server including one or more hardware processors on a first network configured to establish a secure communications link with a first application on a client on a second network, the client configured to communicate with a plurality of devices on the second network and remote to the server;

a second application on the server configured to receive from the first application on the client, via the secure communications link between the first network and the second network, identification of the plurality of devices on the second network that are detected by the first application on the client;

wherein the server is configured to provide, to one or more remote devices on the first network, a list of the plurality of devices on the second network that are detected by the first application on the client to be selected for communication with a remote device of the one or more remote devices and information on the plurality of devices on the second network to enable the remote device to selectively access one or more of the plurality of the devices on the second network;

wherein the server is configured to receive, from a first remote device of the one or more remote devices, a request to communicate with a device selected from the list of the plurality of devices on the second network; and

wherein responsive to the server receiving the request to communicate with the selected device, the server is configured to proxy communications between the remote device on the first network and the selected device that is selected from the plurality of devices on the second network, the server proxying the communications via the secure communications link between the server and the client over which the second application on the server received the list of the plurality of devices on the second network that are detected by the first application on the client.

2. The system of claim 1, wherein one or more devices of the plurality of devices on the second network comprise an Internet Protocol (IP) enabled device.

3. The system of claim 2, wherein the IP enabled device is a controller of a control system.

4. The system of claim 1, wherein the first application on the client is deployed as a smart client device on the second network.

5. The system of claim 1, wherein the first application is further configured to perform one or more of the following to detect and identify the plurality of devices:

discovery, port scanning, a watchdog process and protocol analysis.

6. The system of claim 1, wherein the first application is further configured to proxy communications between the server and the selected device.

7. The system of claim 1, wherein the server is further configured to provide via one of an application programming interface or a user interface on the first network the list of the plurality of devices available on the second network from which to select the selected device to which to connect with the remote device.

8. The system of claim 1, wherein the remote device comprises a remote application configured to communicate with the selected device via one of a communication protocol or an application programming interface supported by the selected device.

9. The system of claim 1, wherein the server on the first network is further configured to establish a second secure communications link with a second application on a second client on a third network, the second client configured to communicate with a second plurality of devices on the third network and remote to the server and to provide the server with identification of the second plurality of devices.

10. The system of claim 9, wherein the server is further configured to identify to one or more remote devices on the first network the identification of the second plurality of devices on the third network to be selected for communication with a second remote device of the one or more remote devices, and to proxy communications between the second remote device and a second selected device, selected from the identification of the second plurality of devices on the third network, via the second secure communications link between the server and the second client.

11. A method comprising:

establishing, by a server on a first network, a secure communications link with a first application on a client on a second network, the client configured to communicate with a plurality of devices on the second network and remote to the server;

receiving, by a second application on the server, from the first application on the client via the secure communications link between the first network and the second network, a list of the plurality of devices on the second network that are detected by the first application on the client;

providing, by the server, to one or more remote devices on the first network, the list of the plurality of devices on the second network to be selected for communication with a remote device of the one or more remote devices and information on the plurality of devices on the second network to enable the remote device to selectively access one or more devices of the plurality of the devices on the second network;

receiving, by the server, from a first remote device of the one or more remote devices, a request to communicate with a device selected from the plurality of devices on the second network responsive to providing the list of the plurality of devices on the second network and the information on the plurality of devices; and

proxying, responsive to the server receiving the request to communicate with the selected device, by the server, communications between the remote device on the first network and the selected device that is selected from the plurality of devices on the second network, via the secure communications link between the server and the client over which the second application on the server received the list of the plurality of devices on the second network that are detected by the first application on the client.

12. The method of claim 11, wherein one or more devices of the plurality of devices on the second network comprise an Internet Protocol (IP) enabled device.

13. The method of claim 12, wherein the IP enabled device is a controller of a control system.

14. The method of claim 11, wherein the first application on the client is deployed as a smart client device on the second network.

15. The method of claim 11, further comprising performing, by the first application, one or more of the following to detect and identify the plurality of devices:

discovery, port scanning, a watchdog process and protocol analysis.

16. The method of claim 11, further comprising proxying, by the first application, communications between the server and the selected device.

17. The method of claim 11, further comprising providing, by the server, via one of an application programming interface or a user interface on the first network, the list of the plurality of devices available on the second network from which to select the selected device to which to connect with the remote device.

18. The method of claim 11, further comprising communicating, by a remote application on the remote device with the selected device, via one of a communication protocol or an application programming interface supported by the selected device.

19. The method of claim 11, further comprising establishing, by the server on the first network a second secure communications link with a second application on a second client on a third network, the second client configured to communicate with a second plurality of devices on the third network and remote to the server and to provide the server with identification of the second plurality of devices.

20. The method of claim 19, further comprising identifying, by the server, to one or more remote devices on the first network the identification of the second plurality of devices on the third network to be selected for communication with a second remote device of the one or more remote devices, proxying communications between the second remote device and a second selected device, selected from the identification of the second plurality of devices on the third network, via the second secure communications link between the server and the second client.