Access and control system for network-enabled devices

• US 20050268334A1
• Filed: 06/02/2005
• Published: 12/01/2005
• Est. Priority Date: 12/02/1999
• Status: Active Grant

• Current Assignee: Western Digital Technologies Incorporated (Western Digital Corporation)
• Original Assignee: Western Digital Technologies Incorporated (Western Digital Corporation)
• Inventors: Rizal, Dharmarus, Hesselink, Lambertus, Bjornson, Eric S.
• Granted Patent: US 7,600,036 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

Systems and methods for remote access of network-enabled devices that provide seamless, firewall-compliant connectivity between multiple users and multiple devices, that allow collaborative operations by multiple users of remote devices, that allow point to multipoint control of multiple devices and which allow rapid, secure transmission of data between remote users and devices. In general terms, the system includes at least one connection server, and at least two computers operatively coupled to the connection server via a public or global network. In an example where at least one client computer is operatively connected to at least one network-enabled device through a connection sever via the public or global network, the connection server is configured to route control instructions from the client to the network-enabled device, and route data from the network-enabled device to the client.

Claims

1-113. -113. (canceled)

114. A method of load balancing communications among a plurality of connection servers networked in a publicly addressable distributed control infrastructure which multiple computers within multiple private networks may access for establishing communications over a public network, said method comprising:

determining a user type of each computer to be connected by communications through said publicly addressable distributed control infrastructure in a particular session;

determining a session type of the particular session to be established;

comparing user type and session type determinations with server type information stored in at least one database connected to said distributed control infrastructure;

selecting a connection server characterized by server type information that indicates the connection server is capable of handling the determined user types and session type;

determining if the selected server is active;

determining whether or not the selected server, if active, has adequate Power to handle the connections that will be required to establish the communications for the session; and

if the selected server is active and has adequate Power, determining whether the selected server has the best available Power level for carrying out the session, based upon a calculated average Power expected for the session and Utilization Ratios of each capable, active connection server which has adequate Power.

115. The method of claim 114, further comprising assigning the selected server determined to active and to have the best available Power level to establish connections between the computers to be included in the session.

116. A method of persistent, secure transfer of data between at least two computers over a public network, wherein the computers have separate privately addressed, firewall protected locations, said method comprising:

accessing a connection server operably connected to the public network by addressing a request from a first of the computers to a public address of the connection server;

establishing a secure connection between the first computer and the connection server, after which, the connection server establishes a secure connection between the connection server and at least a second of the computers, according to instructions received from the first computer as to which computers the first computer desires to communicate with;

wherein secure, full-duplex, persistent communications are established through the connection server without the need for any of the computers to know or address a private address of any of the other computers between which the communications take place.

117. The method of claim 116, wherein the first computer includes a first data control process, the second computer includes a second data control process and the connection server includes a third data control process;

and

wherein, after establishment of a secure communication channel between the first and second computers via the connection server, the first data control process adaptively polls a first sending buffer to determine whether any data to be communicated is contained in the first sending buffer, and sends the data, along with a request to the connections server when data is contained in the first sending buffer.

118. The method of claim 117, wherein the third data control process adaptively polls the first computer to determine whether a request has been sent;

and

upon receiving a request, the third data process reads the request and buffers any data that is included with the request, in a connection server sending buffer associated with the third data process;

the third data control process additionally adaptively polls the connection server sending buffer to determine whether any data to be sent to the first computer is contained in the connection server sending buffer; and

when data to be sent to the first computer is present, the third data control process sends the data along with a response to the request.

119. The method of claim 118, wherein the first data control process reads the response, buffers any data that is contained with the response, and notifies the first computer that data has been received.

120. The method of claim 119, wherein the process steps are iteratively repeated to maintain persistent communications.

121. The method of claim 117, wherein the third data control process adaptively polls the connection server sending buffer to determine whether any data to be sent to the second computer is contained in the connection server sending buffer;

and

when data to be sent to the second computer is present, the third data control process sends the data along with a response to the second computer.

122. The method of claim 117, wherein the third data control process adaptively polls the second computer to determine whether a request has been sent;

and

upon receiving a request, the third data process reads the request and buffers any data that is included with the request, in the connection server sending buffer;

the third data control process additionally adaptively polls the connection server sending buffer to determine whether any data to be sent to the second computer is contained in the connection server sending buffer; and

when data to be sent to the second computer is present, the third data control process sends the data along with a response to the request.

123. The method of claim 122, wherein the second data control process reads the response, buffers any data that is contained with the response, and notifies the second computer that data has been received.

124. The method of claim 122, wherein the process steps are iteratively repeated to maintain persistent communications.

125-129. -129. (canceled)

130. A system for remote communications between private users through a public network while providing seamless, firewall-compliant connectivity, said system comprising:

a tunneling protocol comprising a stateless application level protocol by which a first computer is securely connectable to the public network through a first firewall element, said first firewall element adapted to protect said client computer from hostile intrusion from the public network, and by which a second computer is securely connectable to the public network through a second firewall element, said second firewall element adapted to protect said second computer; and

means for iteratively polling the stateless application level protocol to maintain efficient and persistent, stateful tunnel connections.

131. The system of claim 130, wherein said stateless application protocol is deployed on top of HTTP.

132. The system of claim 130, further comprising a security protocol wherein encryption keys are exchanged only once during connection setup, and secure connections are maintained thereafter by said persistent, stateful tunnel connections.