Secure communication network

• US 8,850,072 B1
• Filed: 07/25/2013
• Issued: 09/30/2014
• Est. Priority Date: 07/25/2013
• Status: Active Grant

• Current Assignee: KE2 Therm Solutions, Inc. (Acuity Brands, Inc.)
• Original Assignee: KE2 Therm Solutions, Inc. (Acuity Brands, Inc.)
• Inventors: Roberts, Steve, Sert, Cetin
• Primary Examiner(s): Eskandarnia, Arvin
• Application Number:
  US13/950,365
• Time in Patent Office: 432 Days
• Field of Search: 709/246, 709/223
• US Class Current: 709/246
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

The present invention is directed to a secure communication network that enables multi-point to multi-point proxy communication over the network. The network employs a smart server that establishes a secure communication link with each of a plurality of smart client devices installed on local client networks. Each smart client device is in communication with a plurality of agent devices. A plurality of remote devices can access the smart server directly and communicate with agent devices via the secure communication link between the smart server and one of the smart client devices. This communication is enabled without complex configuration of firewall or network parameters by the user.

Claims

1. A secure communication network, comprising:

a plurality of local client networks each of which comprises a client device in communication with a plurality of agent devices, wherein the client device comprises an embedded IP (Internet Protocol) device;

a server that communicates over a secure communication link with the client device of each of the local client networks, wherein the server stores an agent list for the client device of each of the local client networks, wherein each agent list comprises a list of available agent devices associated with the client device; and

a plurality of remote devices in communication with the server;

wherein the server receives from each of the remote devices a request to connect with one of the agent devices of one of the local client networks by (a) receiving an identity of a client device from the remote device, (b) displaying the agent list associated with the identified client device, and (c) receiving from the remote device a selection of one of the agent devices from the agent list, and, for each request, the server proxies all communications between the remote device and the selected agent device via the secure communication link between the server and the client device associated with the selected agent device.

2. A method of enabling secure communication between a plurality of remote devices and a plurality of agent devices located within a plurality of local client networks, comprising:

causing a client device to be deployed within each local client network, wherein the client device comprises an embedded IP (Internet Protocol) device, wherein the client device is in communication with a plurality of agent devices within the local client network;

using a server to;

(1) establish a secure communication link with the client device of each local client network;

(2) store an agent list for each client device, wherein each agent list comprises a list of available agent devices associated with the client device;

(3) receive from each of the remote devices a request to connect with one of the agent devices of one of the local client networks by;

(a) receiving an identity of a client device from the remote device;

(b) displaying the agent list associated with the identified client device;

(c) receiving from the remote device a selection of one of the agent devices from the agent list; and

(4) for each request received in step (3), proxy all communications between the remote device and the selected agent device via the secure communication link between the server and the client device associated with the selected agent device.

3. A system that enables secure communication between a plurality of remote devices and a plurality of agent devices located within a plurality of local client networks, comprising:

a plurality of client devices each of which is deployed within one of the local client networks for communication with a plurality of agent devices within that local client network, wherein each of the client devices comprises an embedded IP (Internet Protocol) device;

a server operable to;

(1) establish a secure communication link with each client device of each of the local client networks;

(2) store an agent list for each of the client devices, wherein each agent list comprises a list of available agent devices associated with the client device;

(3) receive from each of the remote devices a request to connect with one of the agent devices of one of the client networks by;

(a) receiving an identity of one of the client devices from the remote device;

(b) displaying the agent list associated with the identified client device;

(c) receiving from the remote device a selection of one of the agent devices from the agent list, and

(4) for each request received in step (3), proxy all communications between the remote device and the selected agent device via the secure communication link between the server and the client device associated with the selected agent device.

4. The system of claim 3, wherein each agent device comprises an IP (Internet Protocol) device.

5. The system of claim 4, wherein at least one of the agent devices comprises a controller for an embedded control system.

6. The system of claim 5, wherein the embedded control system comprises one of the following:

a heating, ventilation, air conditioning and refrigeration (HVAC&

R) system, an energy management system, a building automation system, an automotive system, a transportation system, a lighting control system, a security system, a surveillance system, an IP camera, and a kiosk.

7. The system of claim 3, wherein each client device includes (i) an Internet accessible port configured to connect for communication outside of the local client network, (ii) a port configured to connect to a management device, and (iii) a plurality of ports configured to connect to the agent devices of the local client network.

8. The system of claim 7, wherein the management device is operable to deploy the client device in the local client network.

9. The system of claim 8, wherein the client device presents an HTML form on the management device for entry of information, wherein the information entered into the HTML form includes one or more of a user-defined password, a plurality of user-defined port numbers of the agent devices, and a user-defined exceptions list that denotes any agent devices to be ignored.

10. The system of claim 9, wherein the client device maintains the agent list for the local client network.

11. The system of claim 10, wherein the client device maintains the agent list by periodically (i) scanning the user-defined port numbers of the agent devices to detect agent devices that acknowledge the scan, (ii) adding to the agent list the IP addresses of the agent devices that acknowledge the scan, and (iii) ignoring the agent devices on the user-defined exceptions list.

12. The system of claim 10, wherein the client device periodically transmits the agent list and the user-defined password to the server, and wherein the server stores the agent list and the user-defined password in association with the identity of the client device.

13. The system of claim 3, wherein the server is located outside each of the local client networks.

14. The system of claim 3, wherein each client device sends a request for connection to the server and, if the server validates the identity of the client device, the secure communication link is established between the client device and the server.

15. The system of claim 14, wherein the server validates the identity of the client device by comparing the identity of the client device to a list of authorized client devices.

16. The system of claim 3, wherein the server transmits to each client device a port number for use in communication with the server.

17. The system of claim 3, wherein all communications between each client device and the server are secured via a Secure Sockets Layer (SSL) connection.

18. The system of claim 3, wherein the client device transmits to the server a port number for use in communication with the remote devices connected to the server.

19. The system of claim 3, wherein the server includes a plurality of Internet accessible ports configured to connect for communication with each client device and each remote device.

20. The secure communication network of claim 3, wherein each remote device comprises a smart phone or a computer/tablet.

21. The system of claim 3, wherein each remote device submits to the server a request to connect with one of the agent devices of one of the local client networks by (i) accessing the server, (ii) providing the identity of the client device and a password, and (iii) selecting the agent device from the agent list associated with the client device.

22. The system of claim 21, wherein the server authenticates the identity of the client device and the password and presents a web interface that displays the agent list associated with the client device.

23. The system of claim 22, wherein the server proxies all requests from the remote device to the selected agent device via the secure communication link between the server and the client device, and proxies all responses from the selected agent device back to the remote device via the secure communication link between the client device and the server.

24. The system of claim 3, wherein the communications between the remote device and the selected agent device comprise port/application specific device communications.