Control of security application in a LAN from outside the LAN

• US 9,021,573 B2
• Filed: 11/15/2012
• Issued: 04/28/2015
• Est. Priority Date: 05/05/2010
• Status: Active Grant

• Current Assignee: Cradle Technologies
• Original Assignee: Cradle Technologies
• Inventors: Natarajan, Ramachandran, Patil, Suhas S.
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): BELL, KALISH K
• Application Number:
  US13/677,812
• Publication Number:
  US 20130074173A1
• Time in Patent Office: 894 Days
• Field of Search: 726 2- 3, 726/6, 726 11- 12, 726 14- 15, 713/150, 713/153, 709217-220, 709222-224, 709/227, 709/230, 709/238
• US Class Current: 726/11
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes

Abstract

A method and a system are disclosed that enable an address at the edge router to be used to establish a multi-pipe virtual private network (MVPN) connecting controllers to multiple web enabled end user devices (EUDs) inside a security protected local area network (LAN). The EUDs connect to a central server (CS) outside the LAN during configuration establishing registration and identity (ID) for each EUD. Once the EUDs establish connection from inside the LAN, the CS is enabled to communicate with the EUDs using the address and ID provided during registration. The CS then acts as a facilitator establishing secure VPN connection between controllers in the cloud and the EUDs inside the LAN. CS further acts as a pass through for those LANs that do not allow direct connections to controllers outside the LAN. The CS continues to monitor the health of the overall system once connectivity is established.

Claims

1. A secure method for connecting to web enabled devices inside a secure firewalled local area network (LAN) through a secure fire-walled edge router, without enabling port forwarding, at an interface between the secure LAN and an internet cloud, for monitoring and control of the web enabled devices within the secure LAN comprising:

providing a secure central server outside the LAN, wherein the secure central server immediately identifies problems within the LAN and either automatically takes remedial action or informs an administrator for manual action, wherein the secure central server oversees a security monitoring health of a system of the secure central server and transmits a short message service (SMS) message to an administrator of the system in order to indicate a failure of at least one of the web enabled devices;

providing at least one monitor and control device outside the secure LAN, wherein the secure central server is coupled to the at least one monitor and control device;

having the web enabled devices within the LAN connecting to and registering with the secure server; and

enabling establishment of a secure virtual pipe connection via the secure central server, for use by the at least one monitor and control device, outside the secure LAN, that is securely connected and pre-registered with the secure central server, wherein the at least one monitor and control device monitors and controls the web enabled devices inside the secure LAN.

2. The method of claim 1, wherein the secure central server is a secure domain name system server.

3. The method of claim 1, wherein the secure central server is enabled to accept connection and registration from web enabled devices within multiple secure LANs and to provide monitoring and control of connections to the web enabled devices within the multiple secure LANs from monitor and control devices securely connected and pre- registered with the secure central server.

4. A system for securely accessing web enabled devices in a secure firewalled local area network (LAN) from outside the secure LAN, through a secure firewalled edge router at an interface of the secure LAN and an internet cloud, the system comprising:

a secure central server outside the secure LAN, with proprietary software to act as a secure dedicated server;

at least one monitoring and control unit outside the secure LAN and registered with and securely linked to the secure server;

at least one web enabled device within the secure LAN enabled to connect to the secure central server through the secure firewalled edge router at the interface of the secure LAN and the internet cloud, to securely connect to and register with the secure LAN to establish a virtual pipe, wherein the at least one monitoring and control unit is enabled to connect to and provide monitoring and control of the at least one web enabled device within the secure LAN, wherein the secure central server oversees a security monitoring health of the system and transmits a short message service (SMS) message to an administrator of the system in order to indicate a failure of at least one of the web enabled devices.

5. The system of claim 4, wherein the secure central server transmits an email to indicate a failure of at least one of the web enabled devices.