SECURE COMMUNICATION NETWORK

• US 20150033319A1
• Filed: 07/11/2014
• Published: 01/29/2015
• Est. Priority Date: 07/25/2013
• Status: Active Grant

• Current Assignee: KE2 Therm Solutions, Inc. (Acuity Brands, Inc.)
• Original Assignee: KE2 Therm Solutions, Inc. (Acuity Brands, Inc.)
• Inventors: ROBERTS, STEVE, SERT, CETIN
• Granted Patent: US 8,930,576 B1
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04N 21/25875 involving end-user authentication restricting access to computer systems by authenticating users using a predetermined code G06F21/33; arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system H04L9/32; networks authentication protocols H04L63/08; authentication in wireless network security H04W12/06
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

The present invention is directed to a secure communication network that enables multi-point to multi-point proxy communication over the network. The network employs a smart server that establishes a secure communication link with each of a plurality of smart client devices deployed on local client networks. Each smart client device is in communication with a plurality of agent devices. A plurality of remote devices can access the smart server directly and communicate with an agent device via the secure communication link between the smart server and one of the smart client devices.

Claims

1. A secure communication network, comprising:

a plurality of local client networks each of which comprises a client device in communication with a plurality of agent devices, wherein the client device comprises an embedded IP (Internet Protocol) device;

a server that communicates over a secure communication link with the client device of each of the local client networks, wherein the server stores an agent list for the client device of each of the local client networks; and

a plurality of remote devices in communication with the server, wherein the server (a) receives from each remote device an identity of a client device of one of the client networks, (b) uses the agent list for the identified client device to present information on one or more agent devices to enable the remote device to selectively access one or more of the presented agent devices, and (c) proxies all communications between the remote device and the one or more of the presented agent devices via the secure communication link between the server and the client device.

2. A method of enabling secure communication between a plurality of remote devices and a plurality of local client networks, comprising:

causing a client device to be deployed within each local client network, wherein the client device comprises an embedded IP (Internet Protocol) device in communication with a plurality of agent devices within the local client network;

using a server to;

establish a secure communication link with the client device of each local client network;

store an agent list for each client device;

receive from each remote device an identity of a client device;

use the agent list for the identified client device to present information on one or more agent devices to enable the remote device to selectively access one or more of the presented agent devices; and

proxy all communications between the remote device and the one or more of the presented agent devices via the secure communication link between the server and the client device.

3. A system that enables secure communication between a plurality of remote devices and a plurality of local client networks, comprising:

a plurality of client devices each of which is deployed within one of the local client networks for communication with a plurality of agent devices within that local client network, wherein each of the client devices comprises an embedded IP (Internet Protocol) device;

a server operable to;

establish a secure communication link with each client device of each local client network;

store an agent list for each client device;

receive from each remote device an identity of a client device;

use the agent list for the identified client device to present information on one or more agent devices to enable the remote device to selectively access at least one of the presented agent devices; and

proxy all communications between the remote device and the at least one of the presented agent devices via the secure communication link between the server and the client device.

4. The system of claim 3, wherein each agent device is accessed by each remote device using one of the following modes of communication:

a web access mode, a raw access mode, and an application programming interface (API) mode.

5. The system of claim 4, wherein the web access mode is used when one of the remote devices communicates with one of the agent devices using a web browser application.

6. The system of claim 4, wherein the raw access mode is used when a client application on one of the remote devices communicates with a server application on one of the agent devices.

7. The system of claim 4, wherein the API mode is used when a remote application on one of the remote devices communicates with an API application on one of the agent devices.

8. The system of claim 7, wherein a unified API framework resides on the client device to enable communication between one of the remote devices and a plurality of API applications on a plurality of the agent devices.

9. The system of claim 7, wherein a unified API framework resides on the server to enable communication between one of the remote devices and a plurality of API applications on a plurality of the agent devices.

10. The system of claim 3, wherein one or more of the agent devices are HTML compliant.

11. The system of claim 3, wherein one or more of the agent devices are not HTML compliant.

12. The system of claim 3, wherein each client device includes (i) an Internet accessible port configured to connect for communication outside of the local client network, (ii) a port configured to connect to a management device operable to deploy the client device in the local client network, and (iii) a plurality of ports configured to connect to the agent devices of the local client network.

13. The system of claim 12, wherein the client device presents an HTML form on the management device for entry of information, wherein the information entered into the HTML form includes a plurality of user-defined port numbers and associated services of the agent devices.

14. The system of claim 13, wherein the information entered into the HTML form includes a user-defined exceptions list that denotes any agent devices to be ignored.

15. The system of claim 14, wherein the client device maintains the agent list for the local client network by periodically (i) scanning the user-defined port numbers of the agent devices to detect agent devices that acknowledge the scan, (ii) adding to the agent list information on the agent devices that acknowledge the scan, and (iii) ignoring the agent devices on the user-defined exceptions list.

16. The system of claim 3, wherein the client device periodically transmits the agent list and a user-defined password to the server, and wherein the server stores the agent list and the user-defined password in association with the identity of the client device.

17. The system of claim 3, wherein the server is located outside each of the local client networks.

18. The system of claim 3, wherein each client device sends a request for connection to the server and, if the server validates the identity of the client device, the secure communication link is established between the client device and the server.

19. The system of claim 18, wherein the server validates the identity of the client device by comparing the identity of the client device to a list of authorized client devices.

20. The system of claim 3, wherein all communications between the server and each client device are secured via a Secure Sockets Layer (SSL) connection.

21. The system of claim 3, wherein the client device transmits to the server a port number for use in all communications between the client device and the server.

22. The system of claim 3, wherein the server includes a plurality of Internet accessible ports configured to connect for communication with each client device and each remote device.

23. The system of claim 3, wherein the agent list includes a protocol number for each agent device that is accessible using a web access mode.

24. The system of claim 23, wherein the server uses the protocol number of each agent device to present a different web user interface for each of a plurality of communication protocols.

25. The system of claim 3, wherein the agent list includes connection parameters for each agent device that is accessible using a raw access mode.

26. The system of claim 25, wherein the server presents the connection parameters for each agent device to the remote device to thereby enable the remote device to access one or more of the agent devices via the secure communication link between the server and the client device.

27. The system of claim 3, wherein the agent list includes an API definition for each agent device that is accessible via an API mode.

28. The system of claim 27, wherein the API definition comprises a plurality of commands that can be used to query and control the agent device.

29. The system of claim 27, wherein the server presents the API definition for each agent device to the remote device to thereby enable the remote device to access one or more of the agent devices via the secure communication link between the server and the client device.

30. The system of claim 3, wherein the communications between the remote devices and the agent devices comprise port/application specific device communications.