Patent Description:
The Internet of Things, or "IoT" for short, represents an evolution of computer networks that seeks to connect many everyday objects to the Internet. Notably, there has been a recent proliferation of 'smart' devices that are Internet-capable such as thermostats, lighting, televisions, cameras, and the like. In many implementations, these devices may also communicate with one another. For example, an IoT motion sensor may communicate with one or more smart lightbulbs, to actuate the lighting in a room when a person enters the room. Vehicles are another class of 'things' that are being connected via the IoT for purposes of sharing sensor data, implementing self-driving capabilities, monitoring, and the like.

As devices are increasingly added to the IoT and IIoT, the number of external users and services that require access to them has also increased. For instance, a remote technician may wish to connect to a particular IoT/IIoT device so that they can perform maintenance on it (e.g., updating its firmware, running diagnostics, etc.). However, the very nature of the IoT/IIoT presents unique challenges that make traditional remote access approaches largely unsuitable. For instance, it is a common occurrence in industrial settings for endpoint devices to share the same Internet Protocol (IP) address, leading to cases in which a remote user needs to access multiple devices simultaneously that share the same IP address. In addition, the level of access actually needed by the remote user may be limited to a specific set of devices, protocol(s), port(s), time period, etc.
<CIT> discloses a method implemented in a cloud-based system of privileged remote access to Internet of Things infrastructure. Responsive to determining whether a user can access an application associated with the infrastructure, the user's security and access policies are determined and a session for the user is created. A secure connection to the application via a lightweight connector connected to the application is then established and a connection between the user's device and the application through the lightweight connector is brokered, enabling the user to interact with the application for the infrastructure, based on the user's security and access policies. <CIT> discloses an approach to the issuance of application tokens in which an authorization module receives a request for an access token associated with a second mobile application from a first mobile application where the request includes an identifier associated with the second mobile application and a first random verification identifier. The authorization module then provides a signal representing an authorization code associated with the access token to the first mobile application. The authorization module then receives a signal representing an authorization code from the second mobile application, the identifier associated with the second mobile application, and a second random verification identifier. The authorization module then responds by providing a signal representing the access token to the second mobile application based in part on the first random verification identifier being equal to the second random verification identifier.

Features of one aspect may be applied to each aspect alone or in combination with other features.

According to one or more implementations of the disclosure, a device receives a login request from a web browser executed by a client endpoint in a first network. The device provides a one-time password to the web browser that causes the client endpoint to invoke a local handler process associated with an access service executed by the client endpoint or invoke access by the web browser to a particular uniform resource locator on the device. The device receives a remote connection request from the access service that includes the one-time password to access a target endpoint in a second network. The device configures, based on the remote connection request, a remote access connection between the client endpoint in the first network and the target endpoint in the second network.

There is also described herein an apparatus, comprising one or more network interfaces, a processor coupled to the one or more network interfaces and configured to execute one or more processes, and a memory configured to store a process that is executable by the processor, the process when executed configured to implement the methods described and claimed herein.

There is also described herein a tangible, non-transitory, computer-readable medium storing program instructions that cause a server to execute a process comprising the methods described and claimed herein.

A computer network is a geographically distributed collection of nodes interconnected by communication links and segments for transporting data between end nodes, such as personal computers and workstations, or other devices, such as sensors, etc. Many types of networks are available, ranging from local area networks (LANs) to wide area networks (WANs). LANs typically connect the nodes over dedicated private communications links located in the same general physical location, such as a building or campus. WANs, on the other hand, typically connect geographically dispersed nodes over long-distance communications links, such as common carrier telephone lines, optical lightpaths, synchronous optical networks (SONET), synchronous digital hierarchy (SDH) links, and others. Other types of networks, such as field area networks (FANs), neighborhood area networks (NANs), personal area networks (PANs), etc. may also make up the components of any given computer network.

In various embodiments, computer networks may include an Internet of Things network. Loosely, the term "Internet of Things" or "IoT" (or "Internet of Everything" or "IoE") refers to uniquely identifiable objects (things) and their virtual representations in a network-based architecture. In particular, the IoT involves the ability to connect more than just computers and communications devices, but rather the ability to connect "objects" in general, such as lights, appliances, vehicles, heating, ventilating, and air-conditioning (HVAC), windows and window shades and blinds, doors, locks, etc. The "Internet of Things" thus generally refers to the interconnection of objects (e.g., smart objects), such as sensors and actuators, over a computer network (e.g., via IP), which may be the public Internet or a private network.

Often, IoT networks operate within a shared-media mesh networks, such as wireless or wired networks, etc., and are often on what is referred to as Low-Power and Lossy Networks (LLNs), which are a class of network in which both the routers and their interconnect are constrained. That is, LLN devices/routers typically operate with constraints, e.g., processing power, memory, and/or energy (battery), and their interconnects are characterized by, illustratively, high loss rates, low data rates, and/or instability. IoT networks are comprised of anything from a few dozen to thousands or even millions of devices, and support point-to-point traffic (between devices inside the network), point-to-multipoint traffic (from a central control point such as a root node to a subset of devices inside the network), and multipoint-to-point traffic (from devices inside the network towards a central control point).

Edge computing, also sometimes referred to as "fog" computing, is a distributed approach of cloud implementation that acts as an intermediate layer from local networks (e.g., IoT networks) to the cloud (e.g., centralized and/or shared resources, as will be understood by those skilled in the art). That is, generally, edge computing entails using devices at the network edge to provide application services, including computation, networking, and storage, to the local nodes in the network, in contrast to cloud-based approaches that rely on remote data centers/cloud environments for the services. To this end, an edge node is a functional node that is deployed close to IoT endpoints to provide computing, storage, and networking resources and services. Multiple edge nodes organized or configured together form an edge compute system, to implement a particular solution. Edge nodes and edge systems can have the same or complementary capabilities, in various implementations. That is, each individual edge node does not have to implement the entire spectrum of capabilities. Instead, the edge capabilities may be distributed across multiple edge nodes and systems, which may collaborate to help each other to provide the desired services. In other words, an edge system can include any number of virtualized services and/or data stores that are spread across the distributed edge nodes. This may include a master-slave configuration, publish-subscribe configuration, or peer-to-peer configuration.

Low power and Lossy Networks (LLNs), e.g., certain sensor networks, may be used in a myriad of applications such as for "Smart Grid" and "Smart Cities. " A number of challenges in LLNs have been presented, such as:.

In other words, LLNs are a class of network in which both the routers and their interconnect are constrained: LLN routers typically operate with constraints, e.g., processing power, memory, and/or energy (battery), and their interconnects are characterized by, illustratively, high loss rates, low data rates, and/or instability. LLNs are comprised of anything from a few dozen and up to thousands or even millions of LLN routers, and support point-to-point traffic (between devices inside the LLN), point-to-multipoint traffic (from a central control point to a subset of devices inside the LLN) and multipoint-to-point traffic (from devices inside the LLN towards a central control point).

An example implementation of LLNs is an "Internet of Things" network. Loosely, the term "Internet of Things" or "IoT" may be used by those in the art to refer to uniquely identifiable objects (things) and their virtual representations in a network-based architecture. In particular, the next frontier in the evolution of the Internet is the ability to connect more than just computers and communications devices, but rather the ability to connect "objects" in general, such as lights, appliances, vehicles, HVAC (heating, ventilating, and air-conditioning), windows and window shades and blinds, doors, locks, etc. The "Internet of Things" thus generally refers to the interconnection of objects (e.g., smart objects), such as sensors and actuators, over a computer network (e.g., IP), which may be the Public Internet or a private network. Such devices have been used in the industry for decades, usually in the form of non-IP or proprietary protocols that are connected to IP networks by way of protocol translation gateways. With the emergence of a myriad of applications, such as the smart grid advanced metering infrastructure (AMI), smart cities, and building and industrial automation, and cars (e.g., that can interconnect millions of objects for sensing things like power quality, tire pressure, and temperature and that can actuate engines and lights), it has been of the utmost importance to extend the IP protocol suite for these networks.

<FIG> is a schematic block diagram of an example simplified computer network <NUM> illustratively comprising nodes/devices at various levels of the network, interconnected by various methods of communication. For instance, the links may be wired links or shared media (e.g., wireless links, wired links, etc.) where certain nodes, such as, e.g., routers, sensors, computers, etc., may be in communication with other devices, e.g., based on connectivity, distance, signal strength, current operational status, location, etc..

Specifically, as shown in the example IoT network <NUM>, three illustrative layers are shown, namely cloud layer <NUM>, edge layer <NUM>, and IoT device layer <NUM>. Illustratively, the cloud layer <NUM> may comprise general connectivity via the Internet <NUM>, and may contain one or more datacenters <NUM> with one or more centralized servers <NUM> or other devices, as will be appreciated by those skilled in the art. Within the edge layer <NUM>, various edge devices <NUM> may perform various data processing functions locally, as opposed to datacenter/cloud-based servers or on the endpoint IoT nodes <NUM> themselves of IoT device layer <NUM>. For example, edge devices <NUM> may include edge routers and/or other networking devices that provide connectivity between cloud layer <NUM> and IoT device layer <NUM>. Data packets (e.g., traffic and/or messages sent between the devices/nodes) may be exchanged among the nodes/devices of the computer network <NUM> using predefined network communication protocols such as certain known wired protocols, wireless protocols, or other shared-media protocols where appropriate. In this context, a protocol consists of a set of rules defining how the nodes interact with each other.

Those skilled in the art will understand that any number of nodes, devices, links, etc. may be used in the computer network, and that the view shown herein is for simplicity. Also, those skilled in the art will further understand that while the network is shown in a certain orientation, the network <NUM> is merely an example illustration that is not meant to limit the disclosure.

Data packets (e.g., traffic and/or messages) may be exchanged among the nodes/devices of the computer network <NUM> using predefined network communication protocols such as certain known wired protocols, wireless protocols (e.g., IEEE Std. <NUM>, Wi-Fi, Bluetooth®, DECT-Ultra Low Energy, LoRa, etc.. ), or other shared-media protocols where appropriate. In this context, a protocol consists of a set of rules defining how the nodes interact with each other.

<FIG> is a schematic block diagram of an example node/device <NUM> (e.g., an apparatus) that may be used with one or more embodiments described herein, e.g., as any of the nodes or devices shown in <FIG> above or described in further detail below. The device <NUM> may comprise one or more network interfaces <NUM> (e.g., wired, wireless, etc.), at least one processor <NUM>, and a memory <NUM> interconnected by a system bus <NUM>, as well as a power supply <NUM> (e.g., battery, plug-in, etc.).

Network interface(s) <NUM> include the mechanical, electrical, and signaling circuitry for communicating data over links coupled to the network. The network interfaces <NUM> may be configured to transmit and/or receive data using a variety of different communication protocols, such as TCP/IP, UDP, etc. Note that the device <NUM> may have multiple different types of network connections, e.g., wireless and wired/physical connections, and that the view herein is merely for illustration.

The memory <NUM> comprises a plurality of storage locations that are addressable by the processor <NUM> and the network interfaces <NUM> for storing software programs and data structures associated with the embodiments described herein. The processor <NUM> may comprise hardware elements or hardware logic adapted to execute the software programs and manipulate the data structures <NUM>. An operating system <NUM>, portions of which are typically resident in memory <NUM> and executed by the processor, functionally organizes the device by, among other things, invoking operations in support of software processes and/or services executing on the device. These software processes/services may comprise an illustrative remote access process <NUM>, as described herein.

It will be apparent to those skilled in the art that other processor and memory types, including various computer-readable media, may be used to store and execute program instructions pertaining to the techniques described herein. Also, while the description illustrates various processes, it is expressly contemplated that various processes may be embodied as modules configured to operate in accordance with the techniques herein (e.g., according to the functionality of a similar process). Further, while the processes have been shown separately, those skilled in the art will appreciate that processes may be routines or modules within other processes.

Many industrial IoT (IIoT)/operations technology (OT) networks are now deployed using a 'cookie-cutter' approach whereby discrete manufacturing or other control segments are deployed using duplicate IP addresses. In other words, the network may comprise a plurality of units, such as cells, zones, bays, etc., with addresses being repeated across units. As a result, different devices may belong to overlapping subnets. In addition, these devices may be located behind one or more firewalls and/or network address translation (NAT) devices.

By way of example, <FIG> illustrates an example <NUM> of a remote access manager <NUM> (e.g., a device <NUM>) being used to configure remote access to an endpoint device in a network, according to various embodiments. As shown, assume that there are various endpoints <NUM> (e.g., IIoT devices) that are on a local network of a particular location, such as a factory, warehouse, or the like. In addition, assume that any or all of endpoints <NUM> each execute their own web application servers, allowing a technician to perform various functions such as reviewing diagnostic information, making configuration changes, and the like.

For instance, endpoints 320a-320b may be behind gateway 318a, which utilizes a cellular connection with a cell tower <NUM> and is behind NAT <NUM>. Endpoints 320c-320d are behind gateway 318b, which is connected to an enterprise network <NUM> and behind a firewall <NUM>. Likewise, endpoint 320f is behind gateway 318d. Gateway 318d and endpoint 320e are both behind gateway 318c, which is also connected to enterprise network <NUM> and behind firewall <NUM>.

Remotely accessing the application web server of a particular endpoint <NUM> is quite challenging under normal circumstances. For instance, assume that the user of client <NUM> wishes to access the web server of endpoint 320b. To enable such a connection, a remote access manager <NUM> may configure the various networking devices between client <NUM> and endpoint 320b, according to various embodiments. Typically, this is done by configuring backdoor access to the specific endpoint <NUM> and a virtual private network (VPN) connection between client <NUM> and that endpoint <NUM>. However, the operational overhead in configuring VPN connections and creating rules to access the different endpoints <NUM> by the myriad of external/remote clients can be quite cumbersome for network administrators. This burden will only continue to grow as the number of IoT/IIoT devices and manufacturers also increases.

The techniques introduced allow for secure, remote access connections to be formed dynamically with endpoints located in one or more remote networks. In some aspects, the architecture herein allows for the automated configuration of remote connections with one or more endpoints at the same time, even if those devices share the same network addresses.

Illustratively, the techniques described herein may be performed by hardware, software, and/or firmware, such as in accordance with remote access process <NUM>, which may include computer executable instructions executed by the processor <NUM> (or independent processor of interfaces <NUM>) to perform functions relating to the techniques described herein.

Specifically, in various embodiments, a device receives a login request from a web browser executed by a client endpoint in a first network. The device provides a one-time password to the web browser that causes the client endpoint to invoke a local handler process associated with an access service executed by the client endpoint or invoke access by the web browser to a particular uniform resource locator on the device. The device receives a remote connection request from the access service that includes the one-time password to access a target endpoint in a second network. The device configures, based on the remote connection request, a remote access connection between the client endpoint in the first network and the target endpoint in the second network.

Operationally, <FIG> illustrates an example of remote access to a device using a web application, according to various embodiments. In one specific implementation, different remote access protocols such as Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), and Secure Shell Protocol (SSH) are delivered to the remote host via their web browser. Such protocols work in conjunction with the various networking equipment in the remote network through a set of services to configure a remote connection across remote gateways, routers, network address translation (NAT) boundaries, and the like. To do so, Apache Guacamole can be used, to build a multi-tenant, scalable set of services that provide high availability.

Thus, three layers are implemented in the architecture <NUM> shown in <FIG>:.

More specifically, in various embodiments, architecture <NUM> may have any or all of the following features:.

By way of example, consider the case shown in diagram <NUM> in <FIG> in which a remote user host <NUM> leverages architecture <NUM> to access a plurality of endpoint devices <NUM> in a local network or set of local networks (e.g., a local network that is remote from that of remote user host <NUM>), some of which may have the same IP address. Such a scenarios is fairly common in an OT/IIoT environment, as industrial devices are often deployed with overlapping IP addresses (e.g., across different subnets, factories/local networks, etc.).

As shown, assume that the remote user host <NUM> wishes to connect to a number of endpoint devices <NUM>: device <NUM>-<NUM>, device <NUM>-<NUM>, device <NUM>-<NUM>, and device <NUM>-<NUM> (e.g., two sets of endpoints located across two different local networks). Each of the two local networks may have corresponding networking equipment <NUM>, such as corresponding gateway (GW), router, switch, or other networking equipment configured to execute the SEA app shown in architecture <NUM>.

Here, device <NUM>-<NUM> and device <NUM>-<NUM> may share the same IP address of <NUM>. <NUM> in their respective networks. According to various embodiments, from the standpoint of remote user host <NUM>, a custom "SEA-Plus" TUN/virtual interface (e.g., in the case of the host being a Windows device) may generate a random link-local address of <NUM>. <NUM>, according to the user account of the user with the remote access system. After configuring the remote connections, remote user host <NUM> may also maintain the following addresses in its routing table:.

From the standpoint of applications running on each networking device in networking equipment <NUM>, they may each perform a NAT function such that the address of the application (e.g., of the form '<NUM>. x') is exposed to the endpoint devices, rather than the <NUM>. <NUM> address of the remote host. In this manner, the system can not only allow for the simultaneous access to endpoints that are located at different remote sites, but also automatically configure the networking equipment <NUM> at both sites. In other words, the applications executed by the respective gateways or other networking equipment at both sites are able to handle the address translations needed for purposes of forming the multiple remote connections. For instance, say a remote engineer wishes to review the configurations of four pieces of equipment simultaneously, to ensure that each has the same configuration. The system introduced herein would allow for the engineer to do so by remotely accessing all four devices, despite the fact that they are located at different locations and some share the same internal address.

To be able tunnel network messages from the remote host, the SEA plus service (e.g., SEAPlus service <NUM> in <FIG>) on remote user host <NUM> needs to be able to securely connect to the backend cloud <NUM> (e.g., the remote access manager <NUM> and/or remote access cloud service <NUM> shown in <FIG>, respectively). In addition, any or all of the following should also be met, preferably:.

In various embodiments, the techniques herein may entail the performance of the steps shown in example diagram <NUM> in <FIG> using architecture <NUM>. First, at installation time, the user may operate host <NUM> to log into the SEA cloud service/remote access manager <NUM> (e.g., by providing their username, password, MFA info. In response, the backend may generate a random secret and save it on both host <NUM> and in the cloud. To then initiate a remote connection, the following steps may be performed, in various embodiments:.

As would be appreciated, using the approach described above will make the remote access very secure. More specifically, to be able to circumvent this approach, a malicious entity would need to mount simultaneous man-in-the-middle (MIM) attacks on browser-local service communications, as well as gain access to the secret/key store of the host device, all within a very short period of time (e.g., on the order of seconds).

To be able tunnel network messages from the remote host, the SEA Plus service on the host needs to be able to "catch" packets which are destined to the IoT device, to be forwarded to the cloud using the tunnel and from the cloud to the gateway. To do so, the system my perform the following:.

<FIG> illustrate examples of a user interface for a remote access system, such as the web browser-based UI shown in <FIG> and <FIG>. As shown, a particular user (e.g., a technician user) may be able to use the system introduced herein to connect to a plurality of different endpoints across different sites/local networks, remotely, using their web browser and across any number of different protocols.

<FIG> illustrates an example simplified procedure <NUM> (e.g., a method) for web browser-based secure equipment access, in accordance with one or more embodiments described herein. For example, a non-generic, specifically configured device (e.g., device <NUM>) may perform procedure <NUM> by executing stored instructions (e.g., application experience optimization process <NUM>). The procedure <NUM> may start at step <NUM>, and continues to step <NUM>, where, as described in greater detail above, the device may receive a login request from a web browser executed by a client endpoint in a first network. In some instances, the device is part of a cloud-hosted remote access service external to the first network and the second network. In various implementations, the second network is an industrial network and the target endpoint comprises a sensor or actuator. In addition, the device may also provide a user interface to the web browser that allows a user of the client endpoint to select from among a set of target endpoints to which the user is authorized to access remotely.

At step <NUM>, as detailed above, the device may provide a one-time password to the web browser that causes the client endpoint to invoke a local handler process associated with an access service executed by the client endpoint or invoke access by the web browser to a particular uniform resource locator on the device. In some implementations, the device may provide a temporary identifier in conjunction with the one-time password, wherein the remote connection request includes the temporary identifier. In various implementations, the device associates the one-time password with the target endpoint, based on an authentication of the login request. In some instances, the client endpoint executes the local handler process and the access service transparently to a user of the client endpoint.

At step <NUM>, the device may receive a remote connection request from the access service that includes the one-time password to access a target endpoint in a second network, as described in greater detail above. In turn, the device may verify that the one-time password matches that sent to the endpoint client in step <NUM>.

At step <NUM>, as detailed above, the device may configure, based on the remote connection request, a remote access connection between the client endpoint in the first network and the target endpoint in the second network. In some implementations, the device may do so by establishing a tunnel between the client endpoint and the target endpoint. In further implementations, the device may do so by configuring a networking device in the second network to perform network address translation for the target endpoint. In various cases, the device may configure at least one networking device in the second network to issue a request to the target endpoint, such as an IP-based request.

Procedure <NUM> then ends at step <NUM>.

It should be noted that while certain steps within procedure <NUM> may be optional as described above, the steps shown in <FIG> are merely examples for illustration, and certain other steps may be included or excluded as desired. Further, while a particular order of the steps is shown, this ordering is merely illustrative, and any suitable arrangement of the steps may be utilized without departing from the scope of the embodiments herein.

While there have been shown and described illustrative embodiments for the remote access of IoT devices in a secure manner, it is to be understood that various other adaptations and modifications may be made within the intent and scope of the embodiments herein. For example, while specific protocols are used herein for illustrative purposes, other protocols and protocol connectors could be used with the techniques herein, as desired. Further, while the techniques herein are described as being performed by certain locations within a network, the techniques herein could also be performed at other locations, such as at one or more locations fully within the local network, etc.).

Claim 1:
A method (<NUM>) comprising:
generating a random secret, at a device (<NUM>), and storing the generated random secret on a client endpoint (<NUM>) in a first network;
receiving (<NUM>), at the device (<NUM>), a login request from a web browser (<NUM>) executed by the client endpoint (<NUM>);
providing (<NUM>), by the device (<NUM>), a temporary identifier and a one-time, time-limited password to the web browser (<NUM>) that causes the client endpoint (<NUM>) to invoke a local handler process (<NUM>) associated with an access service (<NUM>) executed by the client endpoint (<NUM>); generating, by the access service (<NUM>) executed by the client endpoint (<NUM>), a time-based one-time password using the random secret stored on the client endpoint (<NUM>) and sending a remote connection request (<NUM>) to the device (<NUM>) that includes, as credentials, the temporary identifier and the one-time password provided by the device (<NUM>) to the web browser (<NUM>) and the time-based one-time password generated by the access service (<NUM>) to access a target endpoint (<NUM>) in a second network;
receiving the remote connection request (<NUM>) to access the target endpoint (<NUM>) in the second network, at the device (<NUM>); and
upon validation of the credentials, configuring (<NUM>), by the device (<NUM>) and based on the remote connection request, a remote access connection between the client endpoint (<NUM>) in the first network and the target endpoint (<NUM>) in the second network.