Patent ID: 12250098

DETAILED DESCRIPTION

A method is described. The method includes receiving, by a network device via a persistent control channel established between the network device and a server device connected to a first network, a first message that includes: (1) information indicating a tunneling protocol, and (2) information associated with a first tunneling payload. The persistent control channel is for communicating: (1) messages including control information, and (2) messages including tunneling payloads. The method also includes transmitting, by the network device to an endpoint device connected to a second network, a second message including the information associated with the first tunneling payload.

The control information may be associated with a first frame type of the persistent control channel and the tunneling protocol may be associated with a second frame type of the persistent control channel. The first frame type may be a TEXT frame type and the second frame type may be a BINARY frame type. The persistent control channel may be a Web Socket channel.

The method may include determining the information associated with the tunneling payload according to removing, by the network device, framing information from the first message. The second message may include information indicating an open channel command.

The first tunneling payload may be carried over a first Secure Sockets Layer or Transport Layer Security (SSL/TLS) connection between a client device and the server device on the first network. The method may further include transmitting, by the network device, information associated with establishing a second SSL/TLS connection with the endpoint device on the second network based on the first message. The persistent control channel may carry the tunneling payload over a TLS connection between the first network and the second network.

The method may include receiving, by the network device, a third message including information associated with a response payload from the endpoint device. The method may also include determining, by the network device, framing information for a fourth message that includes the information associated with the response payload. The method may further include transmitting, by the network device, the fourth message to the server device via the persistent control channel.

The network device may be a switch, router, or automation controller that is linked to a plurality of endpoint devices on the second network. The network device may be the endpoint device.

A network device is also described. The network device includes a processor. The network device also includes memory in electronic communication with the processor. Instructions stored in the memory are executable to receive, via a persistent control channel established between the network device and a server device connected to a first network, a first message that includes: (1) information indicating a tunneling protocol, and (2) information associated with a first tunneling payload. The persistent control channel is for communicating: (1) messages including control information, and (2) messages including tunneling payloads. The instructions stored in the memory are also executable to transmit, to an endpoint device connected to a second network, a second message including the information associated with the first tunneling payload.

A server device is also described. The server device includes a processor. The server device also includes memory in electronic communication with the processor. Instructions stored in the memory are executable to transmit, via a persistent control channel established between a network device and the server device connected to a first network, a first message that includes: (1) information indicating a tunneling protocol, and (2) information associated with a first tunneling payload. The persistent control channel is for communicating: (1) messages including control information, and (2) messages including tunneling payloads. The instructions stored in the memory are also executable to receive, from the network device via the persistent control channel, information associated with a response payload from an endpoint device connected to a second network.

Some examples of the systems and methods described herein may provide mechanisms and/or structures (e.g., protocols) for tunneling network traffic (e.g., arbitrary network traffic, hypertext transfer protocol (HTTP) traffic, Web Socket traffic, a video stream, an audio stream, and/or interface data, etc.) across a control channel for a network device. Some examples of the systems and methods described herein may allow a client device (e.g., computing device, smartphone, tablet device, game console, remote device, etc.) to access an endpoint device inside of a network (e.g., private unexposed network, local area network (LAN), and/or network in a residential or commercial environment, etc.), by leveraging a control channel from a network device at a site. For instance, some of the techniques described herein may provide a smartphone access with fast and reliable remote access to a home automation system from a mobile application, may provide remote configuration capability for a home automation system, and/or may provide remote access to endpoint devices inside of a network.

Various configurations are now described with reference to the Figures, where like reference numbers may indicate functionally similar elements. The systems and methods as generally described and illustrated in the Figures herein could be arranged and designed in a wide variety of different configurations. Thus, the following more detailed description of several configurations, as represented in the Figures, is not intended to limit scope, as claimed, but is merely representative of the systems and methods.

FIG.1is a block diagram of a system100for control channel tunneling. The system100may include a first network118and/or a second network110. A network may be a group of devices interconnected by a communication link or links. For instance, groups within a network may communicate using a communication link or links.

In some examples, the first network118may be a wide area network (WAN). For instance, the first network118may be the Internet. The communication link(s) of the first network118may be implemented with one or more wired links and/or wireless links (e.g., communications over metallic wire(s), coaxial cable(s), Ethernet cable(s), fiber optic cable(s), radio frequency (RF) transmission and reception, etc.) with electronic devices. For instance, the first network118may include one or more server devices102, one or more client devices108, and/or one or more other devices (e.g., router(s), switch(es), hub(s), server(s), etc.). In some examples, a client device108may transmit a message to the server102and/or may receive a message from the server device102via a first connection134in the first network118. In some examples, the first connection134may be a non-persistent connection. For instance, the first connection134may be a Hypertext Transfer Protocol (HTTP) (e.g., Hypertext Transfer Protocol Secure (HTTPS)) connection.

The server device102may include a processor (e.g., first processor116) and a memory (e.g., first memory120). The first processor116may be logic circuitry to perform operations. For instance, the first processor116may execute instructions stored in the first memory120to perform one or more operations. Examples of the first processor116may include integrated circuitry, a central processing unit (CPU), microprocessor, application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), state machine, a combination thereof, and/or other circuitry, etc.

In some examples, the server device102may include a first communication interface (not shown inFIG.1). The first communication interface may include hardware (e.g., circuitry, socket(s), and/or antenna(s), etc.) and/or instructions to enable communication between the server device102and another device or devices (e.g., the network device104and/or client device108). The first communication interface may be a wired and/or wireless interface. For instance, the first communication interface may be an Ethernet interface, coaxial interface (e.g., Data Over Cable Service Interface Specifications (DOCSIS) interface), Universal Serial Bus (USB) interface, Institute of Electrical and Electronics Engineers (IEEE) 802.11 (Wi-Fi) interface, cellular interface (e.g., 3rd Generation Partnership Project (3GPP), Long Term Evolution (LTE), 5G, CDMA2000, etc.), fiber optic interface, or a combination thereof, etc. In some examples, the server device102may include multiple communication interfaces. The communication interface(s) may be utilized to transmit and/or receive messages.

The first memory120may be a device to electronically store data (e.g., information and/or instructions). Examples of the first memory120may include random access memory (RAM), read-only memory (ROM), non-volatile random access memory (NVRAM), synchronous dynamic random-access memory (SDRAM), double data rate SDRAM (DDR SDRAM), programmable read-only memory (PROM), erasable programmable read only memory (EPROM), electrically erasable PROM (EEPROM), flash memory, magnetic or optical data storage, registers, etc. In some examples, the first memory120may include (e.g., store) first connection instructions121, first control instructions122and/or first tunneling protocol instructions124.

In some examples, the one or more server devices102may include a public-facing server device or public-facing server devices. A public-facing server device is a server device that is generally accessible (e.g., accessible on a public network). For instance, the server device102may be accessible to the client device108(e.g., one or more client devices108) connected to the first network118(e.g., the Internet). For instance, a public-facing server device may have a publicly accessible domain name and/or Internet Protocol (IP) address. Examples of a client device108may include a desktop computer, laptop computer, tablet device, netbook, cellular phone, smart phone, or personal digital assistant (PDA), etc.

In some examples, multiple server devices may be utilized. For instance, one or more proxy server devices and/or one or more management server devices may be utilized. The proxy server device(s) and/or the management server device(s) may be a public-facing service device(s) (e.g., may be publicly accessible on the Internet). For instance, the proxy server device(s) and/or the management server device(s) may be located in the cloud. As used herein, the term “cloud” may refer to an Internet-based computing network of one or more server devices. For instance, the one or more server devices102in the cloud may store, manage, and/or process data (at the request of a client device, such as a personal computer, laptop computer, smartphone, tablet device, local server, etc., for example). In some examples, one or more of the operations described herein in relation to the server device102may be distributed across multiple server devices (e.g., proxy server device(s) and/or management server device(s)).

The second network110may be implemented in one or more configurations. For example, the second network110may be implemented as a local area network (LAN), a wireless LAN (WLAN), a personal area network (PAN), intranet, a combination thereof, or another configuration. Devices within the second network110may communicate using wired technologies (e.g., coaxial, Ethernet, fiber optic, etc.), wireless technologies (e.g., microwave, RF (e.g., cellular, Wi-Fi, Bluetooth), infrared, etc.), or a combination thereof. In some examples, the second network110may be a private network. For instance, one or more addresses of the one or more network devices104and/or of the one or more endpoint devices106may not be publicly available and/or publicly accessible. For instance, the one or more endpoint devices106may have one or more unpublished IP addresses and/or one or more unpublished media access control (MAC) address(es). In some examples, the second network110may be used within a residential home or a business enterprise.

The second network110may include one or more network devices104and one or more endpoint devices106. Examples of an endpoint device106may include a smart appliance, a light, a lighting system, thermostat, climate control system, a security camera, an alarm system, a smart television, an AV receiver, computing device (e.g., desktop computer, laptop computer, game console, etc.), sprinkling system, garage door opener, electronic lock, etc. In some examples, an endpoint device106may transmit a message to the network device104and/or may receive a message from the network device104via a second connection130in the second network110.

The network device104may be an electronic device to control the one or more endpoint devices106. Examples of a network device104may include a network switch, a router, an automation controller (e.g., home automation controller), an Internet of Things (IoT) device, or a combination thereof, etc. For instance, the network device104may be a switch, router, or automation controller that is linked to a plurality of endpoint devices on the second network110. The network device104may have a communication link or links to the one or more endpoint devices106on the second network110. The network device104may be configured to communicate with the one or more endpoint devices106within the second network110. In some examples, one or more of the operations described herein in relation to the network device104may be distributed across multiple network devices.

The network device104may include a processor (e.g., second processor112) and a memory (e.g., second memory114). The second processor112may be logic circuitry to perform operations. For instance, the second processor112may execute instructions stored in the second memory114to perform one or more operations. Examples of the second processor112may include integrated circuitry, a CPU, microprocessor, ASIC, FPGA, state machine, a combination thereof, and/or other circuitry, etc.

In some examples, the network device104may include a second communication interface (not shown inFIG.1). The second communication interface may include hardware (e.g., circuitry, socket(s), and/or antenna(s), etc.) and/or instructions to enable communication between the network device104and another device or devices (e.g., the server device102and/or endpoint device106). The second communication interface may be a wired and/or wireless interface. For instance, the second communication interface may be an Ethernet interface, coaxial interface (e.g., DOCSIS interface), USB interface, IEEE 802.11 (Wi-Fi) interface, cellular interface (e.g., 3GPP, LTE, 5G, CDMA2000, etc.), fiber optic interface, or a combination thereof, etc. In some examples, the network device104may include multiple communication interfaces. The communication interface(s) may be utilized to transmit and/or receive messages.

The second memory114may be a device to electronically store data (e.g., information and/or instructions). Examples of the second memory114may include RAM, ROM, NVRAM, SDRAM, DDR SDRAM, PROM, EPROM, EEPROM, flash memory, magnetic or optical data storage, registers, etc. In some examples, the second memory114may include (e.g., store) second connection instructions125, second control instructions126and/or second tunneling protocol instructions128.

In some examples, the network device104may initiate the establishment of a persistent control channel132with the server device102on the first network118. For example, the second processor112may execute the second connection instructions125to initiate the establishment of the persistent control channel132(e.g., transmit an open connection request to the server device102). For instance, the network device104(e.g., a switch, router, home automation controller, and/or an IoT device, etc.) may make an outbound connection (e.g., Web Socket channel) with the server device102(e.g., management server device in the cloud). In some examples, the first processor116may execute the first connection instructions121to respond to the open connection request sent from the network device104(e.g., to negotiate with the network device104to open the persistent control channel132). In some examples, making the outbound connection (e.g., transmitting a message to establish an outbound connection) may avoid a firewall, access control list (ACL), and/or or network address translation (NAT) routing limitation(s) of the second network110from preventing (e.g., blocking) connectivity. In some examples, once the outbound call is established, the network device104may be managed by the server device102over the persistent control channel132.

In some examples, the persistent control channel132may be (and/or may be supported on) a connection that persists indefinitely. For instance, the persistent control channel132may be opened initially and/or may not be closed (while Internet access is available, while power is available, and/or while the server device102and the network device104are functioning, for example). In some examples, the persistent control channel132may not be opened and closed with each request and response cycle (e.g., the persistent control channel132may not be opened and closed with each transaction as with basic HTTP connections). For instance, the persistent control channel132may remain open with or without payload traffic. In some examples, the persistent control channel132may not carry connection establishment overhead (e.g., connection opening information, port negotiation information, etc.) of the persistent control channel132after the persistent control channel132is established. In some examples, the persistent control channel132may be a WebSocket channel.

In some examples, the persistent control channel132may be used to communicate messages including control information. Control information may be a set of rules and/or a set of instructions (e.g., commands) that the server device102may utilize to control the network device104. For instance, the server device102may transmit specific messages (e.g., commands) from the first network118that instruct the network device104to perform an operation(s). In some examples, the set of instructions may be limited to a defined set of commands corresponding to a defined set of functions that are executable by the network device104. For instance, the set of instructions may include a set of keywords, where each keyword may instruct the network device104to perform a certain function. Examples of functions may include rebooting an endpoint device106, controlling an endpoint device106to activate or deactivate (e.g., turn a light on or off, lock or unlock an electronic lock, etc.), get a status indicator from an endpoint device106, etc. For instance, the first control instructions122may include a limited set of functions that the server device102may command the network device104to perform. In some examples, the first processor116may execute the first control instructions122to select and/or transmit a command to the network device104for execution.

The network device104may transmit one or more responses and/or one or more unsolicited status events back to the server device102. In some examples, the network device104may directly execute a function indicated by a command sent from the server device102(without passing the payload of the command and/or without transmitting the command itself to an endpoint device106, for instance). In some examples, the second control instructions126may include a set of functions (e.g., executable instructions) corresponding to the limited set of commands that may be sent by the server device102. For instance, the network device104may receive a command from the server device102and the second processor112may execute a function (from the second control instructions126) corresponding to the command (from the set of commands).

In some examples, the persistent control channel132may be used for communicating tunneling payloads. A tunneling payload may be information for tunneling through another network and/or another network protocol. For instance, a tunneling payload may be encapsulated, using a tunneling protocol, within one or more frames of another network protocol. For instance, a client device108may transmit information indicating a tunneling protocol and/or information associated with a tunneling payload to the server device102. For instance, the client device108may transmit an instruction (e.g., GET), host information (e.g., web address of the server device102, uniform resource locator (URL) of the server device102, etc.), agent information (e.g., information identifying a browser utilized on the client device108), and/or header information (e.g., site identification information, endpoint device identification information, a local IP address (in the second network110, for instance) of the endpoint device106, Media Access Control (MAC) address, and/or port information), etc. In some examples, the client device108may receive addressing information of one or more endpoint devices from the server device102and/or from the network device104. For instance, the client device108may login to the server device102and/or network device104, which may provide the addressing information (e.g., address information internal to the second network110, local IP address(es), port(s), MAC address(es), etc.) via a login, sign-in, and/or authentication procedure.

The information sent from the client device108may be targeted to the endpoint device106via the server device102. The server device102may encapsulate the information associated with a tunneling payload in one or more frames for the persistent control channel132and/or may transmit the one or more frames to the network device104over the persistent control channel132. For instance, the first processor116may execute the first tunneling protocol instructions124to produce a first message. The first message may include information indicating a tunneling protocol and/or information associated with a first tunneling payload. For instance, the server device102may add framing information to the information received from the client device108to produce the first message. For example, the server device102may wrap the information from the client device in a frame (e.g., BINARY frame).

In some examples, information indicating a tunneling protocol may be header information and/or a frame type. For instance, a network protocol may allow and/or support different frame types. In some examples, control information may be associated with a first frame type of the persistent control channel132and/or the tunneling protocol may be associated with a second frame type of the persistent control channel. For instance, the first frame type may be a TEXT frame type and/or the second frame type may be a BINARY frame type. In some examples, the persistent control channel132(e.g., a network protocol of the persistent control channel132, WebSocket, etc.) may support only a TEXT frame type and a BINARY frame type for data frames. In some examples, the persistent control channel132may support one or more other frame types for control frames. For instance, the Internet Engineering Task Force (IETF) Request for Comments (RFC) 6455 may support only a TEXT frame type and a BINARY frame type for data frames, while supporting “Ping,” “Pong,” and “Close” frame types for control frames. In some examples, the network device104may detect a tunneling protocol and/or a tunneling payload based on a received frame type. For instance, if a received frame type is a second frame type (e.g., BINARY frame type), the network device104may detect that the received frame includes information associated with a tunneling payload. In some examples, if a received frame type is a first frame type (e.g., TEXT frame type), the network device104may detect that the received frame includes control information.

In some examples, information indicating a tunnel protocol may be header information. For instance, a frame (e.g., BINARY frame) may include header information indicating a local IP address (e.g., an IP address that is local to the second network110, an IP address of an endpoint device106, etc.), local port information (e.g., a port indicator corresponding an endpoint device106), and/or other information indicating the tunneling protocol. In some examples, the network device104may detect a tunneling protocol and/or a tunneling payload based on the header information.

In some examples, the network device104may receive, via the persistent control channel132established between the network device104and the server device102connected to the first network118, a first message. The first message may include information indicating a tunneling protocol and/or information associated with a first tunneling payload. In some examples, the network device104may determine the information associated with the tunneling payload according to removing framing information from the first message.

The network device104may transmit, to the endpoint device106connected to the second network110, a second message including the information associated with the first tunneling payload. For example, the network device104may remove (e.g., strip) the framing information from the first message to produce the second message. In some examples, the network device104may modify (e.g., generate, edit, and/or reformat) header information to produce the second message. The network device104may transmit the second message to the endpoint device106via the second network110. In some examples, the tunneling protocol may enable a message (e.g., tunneling payload) sent from the client device108via the first network118to be received by the endpoint device106as if the client device108were included in the second network110, though the client device108is not actually included in the second network110.

In some examples, the network device104itself may be an endpoint device. For instance, the network device104may loop the second message to itself. In some examples, the network device104may serve to route a tunneled payload to itself (after the framing is removed from the first message, for instance). In some examples, looping the second message (e.g., looping or “transmitting” the second message from the network device104to the network device104) may include providing (e.g., sending) the second message (e.g., deframed packet, first message after removing the framing information, etc.) to a communication interface with a loopback address. For instance, the deframed packet may be provided to the second communication interface (similar to another communication to another endpoint device106, for example, but addressed to a loopback address (e.g., 127.0.0.1 for an IP network)).

In some examples, the second message includes information indicating an open channel command. For instance, the information associated with the tunneling payload (e.g., data of the tunneling payload) may be sent with an open channel command to the endpoint device106. In some approaches, an open channel command is sent separately from payload data. Transmitting the information associated with the tunneling payload together with the open channel command may enable payload data to be received at the endpoint device106concurrently with the open channel command (e.g., may enable payload data to be received before channel opening procedures are complete), which may expedite data communications (e.g., may reduce communication latency). For example, transmitting the open channel command with the information associated with the tunneling payload may front load the open channel command.

In some examples, the first tunneling payload is carried over a Secure Sockets Layer or Transport Layer Security (SSL/TLS) connection between a client device108and the server device102on the first network118. For instance, the first connection134may be an SSL/TLS connection between the client device108and the server device102. For example, the client device108and/or the server device102may establish an SSL/TLS connection that terminates at the client device108and/or at server device102.

In some examples, the persistent control channel132may carry the tunneling payload over a TLS connection on the first network118(or between the first network118and the second network110, for example). For instance, the persistent control channel132may be a TLS connection and/or may be carried on a TLS connection. For example, the server device102and the network device104may establish a TLS connection that terminates at the server device102and/or at the network device104. The tunneling payload may be carried over the TLS connection.

In some examples, the network device104may transmit information associated with establishing an SSL/TLS connection with the endpoint device106on the second network110based on the first message. In some examples, the tunneling protocol may support one or more open indicators (e.g., codes to establish a connection with or without encryption). For instance, the tunneling protocol may support OPEN and OPEN SECURE codes, which may direct the network device104on how to contact an endpoint device106(where OPEN SECURE may direct the network device104to establish an SSL/TLS connection with an endpoint device106, for instance). For example, the network device104and/or the endpoint device106may establish an SSL/TLS connection that terminates at the network device104and/or at endpoint device106(e.g., the second connection130may be an SSL/TLS connection). The tunneling payload may be sent over the SSL/TLS connection in some examples. In some examples, the tunneling payload may be carried over multiple different SSL/TLS connections. For instance, the tunneling payload may be carried over a first SSL/TLS connection between the client device108and the server device102(in the first network118), over a second SSL/TLS connection between the server device102and the network device104(in the first network118), and/or over a third SSL/TLS connection between the network device104and the endpoint device106(in the second network110). In some examples, the tunneling payload may not be carried over only a single SSL/TLS connection between the client device108and the endpoint device106, as the tunneling may trigger detection of a security risk (e.g., man-in-the-middle attack) for some agents (e.g., browsers).

The endpoint device106may receive the second message. In some examples, the endpoint device106may generate a response to the second message. For instance, the endpoint device106may generate and/or transmit a third message to the network device104. In some examples, the third message may include information associated with a response payload. A response payload may be information and/or data produced in response to a message (e.g., tunneled payload). For instance, the information associated with the response payload may include HyperText Markup Language (HTML) information, Extensible Markup Language (XML) information, a web page, a web application, user interface, video data, textual data, image data, object data, and/or other information in response to the second message (e.g., in response to the tunneling payload).

In some examples, the network device104may receive a third message including information associated with a response payload from the endpoint device106. The network device104may determine framing information for a fourth message that includes the information associated with the response payload. For example, the second processor112may execute the second tunneling protocol instructions128to determine the framing information for the fourth message. In some examples, the framing information may indicate the client device108(e.g., an IP address, port number, etc., of the client device108). The network device104may transmit the fourth message to the server device102via the persistent control channel132.

In some examples, the server device102may remove (e.g., strip) framing information from the fourth message to produce a fifth message. The fifth message may include the response payload. The server device102may transmit the fifth message to the client device108. In some examples, an application executed on the client device may interpret and/or utilize the response payload. In an example, the client device108may render a web interface from the endpoint device106in a browser. In another example, the client device108may display video from the endpoint device106(e.g., a security camera). In some examples, additional messages may be sent and/or received between the client device108and the endpoint device106. For instance, the client device108may receive an input (e.g., mouse click, tap on a touchscreen, etc.) that modifies a control on a web interface of the endpoint device106. The modification may be indicated in a tunneled payload via the server device102, persistent control channel132, and network device104to the endpoint device106, which may execute and/or respond to the modification.

FIG.2is a flow diagram illustrating one configuration of a method200for control channel tunneling. In some examples, the method200may be performed by the network device104described in relation toFIG.1or another network device.

A network device may receive202, via a persistent control channel established between the network device and a server device connected to a first network, a first message that includes information indicating a tunneling protocol, and information associated with a first tunneling payload. For example, receiving202the first message including information indicating a tunneling protocol and information associated with a first tunneling payload may be performed as described in relation toFIG.1.

The network device may transmit204, to an endpoint device connected to a second network, a second message including the information associated with the first tunneling payload. In some examples, transmitting204the second message including the information associated with the first tunneling payload may be performed as described in relation toFIG.1. For instance, the network device may remove framing information from the first message to produce the second message and may transmit the second message to the endpoint device via the second network. In some examples, the framing information may indicate internal addressing information (e.g., an IP address) of the endpoint device in the second network.

In some examples, the method200may include one or more of the operations and/or procedures described in relation toFIG.1. For instance, the network device may determine that the first message corresponds to a tunneling protocol based on a frame type (e.g., BINARY frame type). In some approaches, the network device may front load an open channel command with the information associated with the tunneling payload and/or may transmit the open channel command to the endpoint device. In some approaches, the network device may receive the first message via a TLS connection of the persistent control channel and may transmit the second message via another SSL/TLS connection in the second network. In some examples, the network device may loop the second message back to itself (when the tunneled payload is directed to the network device as an endpoint device, for instance).

FIG.3is a diagram illustrating an example of tunneling over a persistent control channel332. Specifically,FIG.3illustrates client device A308a, client device B308b, a server device302, a network device304, an endpoint device306, and a persistent control channel332. In some examples, client device A308a, client device B308b, the server device302, the network device304, the endpoint device306, and/or the persistent control channel332may be examples of respective elements described in relation toFIG.1.

The persistent control channel332may be established between the server device302and the network device304. The persistent control channel332may carry a first frame type344(e.g., a TEXT frame type) and a second frame type354(e.g., a BINARY frame type). The first frame type344may carry control information and/or the second frame type354may carry tunneling information. In some examples, tunneling information may not be carried by the first frame type344and/or control information may not be carried by the second frame type354. In some examples, the persistent control channel332may not be a virtual private network (VPN) connection. In some examples, the persistent control channel332may be connected over the Internet. In some approaches, if a device (e.g., a client device) connects a network (e.g., first site) via a VPN to a second network (e.g., second site), information (e.g., information for a control channel) may travel via VPN to the second network, but then may connect to the server302via the Internet. In some examples, a device (e.g., a client device) may not be allowed to VPN to the same network as the server device302.

In the example illustrated inFIG.3, client device A308atransmits a control request336to the server device302. In response to the control request336, the server device302may generate and transmit a command340to the network device304using the first frame type344on the persistent control channel332. In response to receiving the command340, the network device304may control346the endpoint device306. For instance, the network device304may execute a function indicated by the command340. For instance, the control346may be a code to modify the functioning of the endpoint device306. The endpoint device306may respond to the control346. For instance, the endpoint device306may perform an operation (e.g., activate, deactivate, change a thermostat setting, reboot, etc.).

The endpoint device306may report a status348to the network device304. The status348may indicate a result of the operation and/or may indicate a current status of the endpoint device306. In response to the status348, the network device304may generate a status report342and transmit the status report342to the server device302. The status report342may indicate a result in response to the command340. For instance, the status report342may indicate whether the command340was completed successfully (e.g., reboot complete) and/or a resulting state of the endpoint device306(e.g., power on, etc.).

In response to receiving the status report342, the server device302may transmit a status indicator338to client device A308a. The status indicator338may indicate whether the control request336was fulfilled (e.g., reboot complete) and/or a resulting state of the endpoint device306(e.g., power on, etc.).

In the example illustrated inFIG.3, client device B308btransmits a tunneling payload352to the server device302. For instance, the tunneling payload352may be sent to the server device302(at the web address of the server device302, for example) with local addressing information for the endpoint device306. In some examples, the tunneling payload352may be sent over a first SSL/TLS connection350between client device B308band the server device302. In response to receiving the tunneling payload352, the server device302may add framing information to the tunneling payload352and may transmit the tunneling payload352on the persistent control channel332using the second frame type354.

In response to receiving the tunneling payload352, the network device304may remove the framing information and transmit the tunneling payload352to the endpoint device306using the local addressing information. For instance, the network device304may transmit the tunneling payload352with a header (e.g., modified header). The endpoint device306may respond to the tunneling payload352. For instance, the tunneling payload352may include a GET instruction. The endpoint device306may respond with a response payload358. For instance, the endpoint device306may send a web interface, video data, and/or other information to the network device304as the response payload358. In some examples, the tunneling payload352and/or the response payload358may be sent over a second SSL/TLS connection356between the network device304and the endpoint device306.

In response to receiving the response payload358, the network device304may add framing information to the response payload358and may transmit the response payload358on the persistent control channel332using the second frame type354. In response to receiving the response payload358, the server device302may remove the framing information and transmit the response payload358to client device B308b. Client device B308bmay utilize the response payload358. For instance, client device B308bmay display a web interface from the endpoint device306, may display video from the endpoint device306, may display a webpage from the endpoint device306, may display programmatic objects from the endpoint device306, and/or may provide other information from the endpoint device306. In some examples, a tunneling protocol described herein may enable tunneling a Web Socket (e.g., Web Socket traffic) within another Web Socket (e.g., the persistent control channel332).

In some examples, the persistent control channel332may carry control information (e.g., a command340and/or status report342with the first frame type344) transparently and/or concurrently with tunneling information (e.g., a tunneling payload352and/or response payload358with the second frame type354). In some examples, the control information (e.g., first frame type344) may be exclusively used by one or more service provider devices and payload information (e.g., second frame type354) may be exclusively used by one or more consumer devices. For instance, client device A308amay be a service provider device (e.g., a device owned and/or operated by a service provider that installed and/or maintains the network device304and/or endpoint device306). In some examples, client device B308bmay be a consumer device (e.g., a device owned and/or operated by a consumer that uses the network device304and/or endpoint device306).

FIG.4is a flow diagram illustrating one configuration of a method400for control channel tunneling. In some examples, the method400may be performed by the server device102described in relation toFIG.1or another server device.

A server device may transmit402, via a persistent control channel established between a network device and the server device connected to a first network, a first message that includes information indicating a tunneling protocol, and information associated with a first tunneling payload. For example, transmitting402the first message including information indicating a tunneling protocol and information associated with a first tunneling payload may be performed as described in relation toFIG.1.

The server device may receive404, from the network device via the persistent control channel, information associated with a response payload from an endpoint device connected to a second network. In some examples, receiving404the information associated with the response payload may be performed as described in relation toFIG.1. In some examples, the server device may remove framing information from the response payload to produce a message and may transmit the message to a client device via the first network.

FIG.5is a diagram illustrating an example of a first frame type560. The first frame type560may be an example of the first frame type described in relation toFIG.1and/or of the first frame type344described in relation toFIG.3. For instance, the first frame type560may be a TEXT frame of a WebSocket connection. In some examples, the first frame type560may include and/or carry control information. For instance, the first frame type560may indicate a command562and/or one or more parameters564(if any). The command562may indicate a function to be performed by a network device. In the example ofFIG.5, the command562is a reboot command. The network device may perform a reboot function on an endpoint device. For instance, the network device may send a reboot control message to an endpoint device, which may reboot in response to the reboot control message. In some examples, one or more parameters564may indicate one or more values that may be utilized (by the network device and/or the endpoint device, for instance) to perform the function.

FIG.6is a diagram illustrating an example of a second frame type666. The second frame type666may be an example of the second frame type described in relation toFIG.1and/or of the second frame type354described in relation toFIG.3. For instance, the second frame type666may be a BINARY frame of a Web Socket connection. In some examples, a client device may send a message672to a server device. In the example ofFIG.6, the message672includes information indicating a tunneling protocol and information associated with a tunneling payload. For instance, the message672includes a header that indicates “Site 1,” “Device 1,” and “192.168.0.2,” which may indicate a tunneling protocol. For example, “Site 1” may indicate a site where an endpoint device (“Device 1”) is located with a local IP address of “192.168.0.2.” The message672also includes an instruction670(“GET spooler.htm HTTP/1.1”), which may be an example of information associated with a tunneling payload.

The server device may generate the second frame type666based on the message672. For example, the server device may add framing information668(e.g., frame header information) to generate the second frame type666. In this example, the framing information668includes version information, destination information, an IP address, a port indicator, and content length information. In this example, the information associated with a tunneling payload may include the instruction (“GET spooler.htm HTTP/1.1”), which may instruct a printer to return spooler information.

FIG.7is a thread diagram illustrating an example of control channel tunneling in accordance with some examples of the systems and methods described herein.FIG.7illustrates an example of a client device701, a proxy server device703, a management server device705, a network device707, and an endpoint device709. The client device701may be an example of one or more of the client devices (e.g., client device108, client device308b, etc.) described herein. The proxy server device703and/or the management server device705may be examples of one or more of the server devices (e.g., serve device102, server device302, etc.) described herein. For instance, some of the server device functions described herein may be performed by the proxy server device703and/or the management server device705. In some examples, a proxy server and a management server may be included in a single server device. The network device707may be an example of one or more of the network devices (e.g., network device104, network device304, etc.) described herein. The endpoint device709may be an example of one or more of the endpoint devices (e.g., endpoint device106, endpoint device306, etc.) described herein.

The network device707may send a channel setup message711to the management server device705. For instance, network device707may make an outbound connection (e.g., a WebSocket) to the management server device705server in the cloud, thus preventing any firewall, ACL, or NAT routing limitations of the destination network from preventing connectivity. Once the outbound call is established, the network device707may be managed over a persistent control channel, where specific messages from the cloud may command the network device to perform a function(s) and/or the network device707sends responses and unsolicited status events back to the cloud.

The client device701may send a message713to the proxy server device703. For instance, the client device701may access the proxy server device703in the cloud. The message713may indicate a specific endpoint device709(e.g., IP address and network port combination) inside of the network of the network device707. The proxy server device703may route the packet(s) to the management server device705(or route the packet(s) internally to a management server, for instance). The proxy server device703may frame the packets with tunneling protocol information to produce a framed message715, which may be transmitted to the management server device705. The management server device705may forward the framed message717across the persistent control channel to the network device707.

The network device707may use the tunneling protocol information to inform routing to the target endpoint device709. For instance, the network device707may strip the framing, and forward the tunneling payload to the endpoint device709in an endpoint message719. The network device707may monitor for any return traffic from the endpoint device709. For instance, the network device707may receive a response message721and reverse the procedure by framing the packets to produce a framed message723that is sent to the management server device705. The management server device705may strip the framing to produce a message725(e.g., packets). The message727(e.g., packets) may be routed back to the client device701via the proxy server device703.

By leveraging the persistent control channel as a tunnel medium, some examples of the systems and methods described herein may securely provide remote access to network endpoint devices with full end-to-end encryption, with role based access control (RBAC), with reduced overhead, and/or without additional connections from a private network to the public Internet. Some examples of the systems and methods described herein may provide for a remote device (e.g., client device) to access network endpoints in the form of web-based user interfaces (e.g., access a printer's configuration page), application programming interfaces (APIs) (either local to a network device itself such as loopback or within a local area network, for instance), and/or non-IP network mediums such as internal UNIX domain sockets. Some examples of the techniques described herein may allow for a remote client device and/or a remote cloud-based system to access endpoint devices in a private network (e.g., LAN).

Some examples of the tunneling protocol may work in conjunction with (and/or without interference to) existing protocol information on the control channel. Some examples of the systems and methods described herein may allow for concurrent multiplexing of isolated channels of communication within a control channel, such that multiple remote devices may access distinct network endpoints at the same time, while a control protocol remains useable.

Some examples of the techniques described herein may be utilized instead of other tunneling approaches that utilize a separate connection from a control channel. Some other tunneling approaches utilize a negotiation and new connection establishment out-of-band as well as utilizing separate software and infrastructure to work. These out-of-band solutions may be difficult to integrate, may consume more overhead, and/or may not provide a means of monitoring the connection or the connection's health from the perspective of an IoT application.

Some examples of the techniques described herein may utilize a Web Socket connection from a network device to a cloud-based server device. A control protocol may run across TEXT frames, while the tunneling protocol may run across BINARY frames of the Web Socket connection. Some examples of the tunneling protocol provides one or more operations to:1. OPEN a channel of communication to a network endpoint (with data);2. OPEN a channel of communication to a network endpoint that uses SSL/TLS negotiation;3. SEND data across an existing channel;4. RECEIVE data across an existing channel; and/or5. CLOSE an existing channel.
An OPEN operation may allow data to be loaded into the initial communication, which reduces transactional overhead and/or amplifies speed (as a proxy server may already identify what the initial SEND operation will be, for example).

In some examples, the server device (e.g., proxy server) is protocol aware. This allows the server device to implement authentication and security controls and/or alter traffic. The server device may alter traffic between itself and a client device, or between itself and an endpoint device. This may allow for HTTP headers to be manipulated, content encoding to be changed, and other changes to be made that may improve experience and/or efficiency. For instance, the server device may add compression to content or decode content that a client device may not be able to handle.

In some examples, heuristics may be utilized to determine packet sizes at various stages to improve network efficiency of the tunnel. In some examples, the chain of devices supports end-to-end encryption. For instance, a proxy server may terminate SSL/TLS between the proxy server and a client device. A management server device and a network device may be connected by a Web Socket over TLS. In this way, traffic between the network device and an endpoint device may not be transmitted over the Internet unencrypted.

FIG.8is a block diagram illustrating various components that may be utilized in a server device829. The server device829may be an example of one or more of the server devices (e.g., server device102, server device302, etc.) described herein. Although one server device829is shown, some configurations herein may be implemented in a distributed system using multiple electronic devices. A server device829may include a broad range of digital computers, including microcontrollers, hand-held computers, personal computers, servers, mainframes, supercomputers, minicomputers, workstations and any variation or related device thereof.

The server device829is shown with a processor831and memory833. The processor831may control the operation of the server device829and may be embodied as a microprocessor, a microcontroller, a digital signal processor (DSP) or other device known in the art. The processor831typically performs logical and arithmetic operations based on program instructions835aand/or data837astored within the memory833. The instructions835ain the memory833may be executable to implement one or more of the functions, operations, and/or methods described herein.FIG.8illustrates instructions835band/or data837bbeing loaded onto the processor831. The instructions835band/or data837bmay be the instructions835aand/or data837a(or portions thereof) stored in memory833.

The server device829may also include one or more communication interfaces839and/or network interfaces845for communicating with other electronic devices. The communication interface(s)839and the network interface(s)845may be based on wired communication technology and/or wireless communication technology, such as ZigBee®, WiMax®, WiFi®, Bluetooth® and/or cellular protocols, such as Global System for Mobile communications (GSM®), etc.

The server device829may also include one or more input devices841and one or more output devices847. The input devices841and output devices847may facilitate user input/user output. Other components843may also be provided as part of the server device829.

Instructions835aand data837amay be stored in the memory833. The processor831may load and execute instructions835bfrom the instructions835ain memory833to implement various functions. Executing the instructions835amay involve the use of the data837athat is stored in the memory833. The instructions835band/or data837bmay be loaded onto the processor831. The instructions835are executable to implement the one or more methods shown herein and the data837may include one or more of the various pieces of data described herein.

The memory833may be any electronic component capable of storing electronic information. The memory833may be embodied as random access memory (RAM), read-only memory (ROM), magnetic disk storage media, optical storage media, flash memory devices in RAM, on-board memory included with the processor, EPROM memory, EEPROM memory, an ASIC (Application Specific Integrated Circuit), registers and so forth, including combinations thereof. The various components of the server device829may be coupled together by a bus system849, which may include a power bus, a control signal bus and a status signal bus, in addition to a data bus. However, for the sake of clarity, the various buses are illustrated inFIG.8as the bus system849.

FIG.9is a block diagram illustrating various components that may be utilized in a network device971. The network device971may be an example of one or more of the network devices (e.g., network device104, network device304, etc.) described herein. Although one network device971is shown, some configurations herein may be implemented in a distributed system using multiple electronic devices. A network device971may include a range of electronic devices, including microcontrollers, hand-held computers, personal computers, servers, mainframes, supercomputers, minicomputers, workstations, routers, switches, firewalls, automation controllers, and any variation or related device thereof. In some configurations, the network device971may be an appliance. Additionally or alternatively, the network device971may be an embedded device inside an otherwise complete device (e.g., within an appliance).

The network device971is shown with a processor951and memory953. The processor951may control the operation of the network device971and may be embodied as a microprocessor, a microcontroller, a digital signal processor (DSP) or other device known in the art. The processor951typically performs logical and arithmetic operations based on program instructions955aand/or data957astored within the memory953. The instructions955ain the memory953may be executable to implement one or more of the functions, operations, and/or methods described herein.FIG.9illustrates instructions955band/or data957bbeing loaded onto the processor951. The instructions955band/or data957bmay be the instructions955aand/or data957a(or portions thereof) stored in memory953.

The network device971may also include one or more communication interfaces959and/or network interfaces965for communicating with other electronic devices. The communication interface(s)959and the network interface(s)965may be based on wired communication technology and/or wireless communication technology, such as ZigBee®, WiMax®, WiFi®, Bluetooth® and/or cellular protocols, such as GSM®, etc.

The network device971may also include one or more input devices961and one or more output devices967. The input devices961and output devices967may facilitate user input/user output. Other components963may also be provided as part of the network device971.

Instructions955aand data957amay be stored in the memory953. The processor951may load and execute instructions955bfrom the instructions955ain memory953to implement various functions. Executing the instructions955amay involve the use of the data957athat is stored in the memory953. The instructions955band/or data957bmay be loaded onto the processor951. The instructions955are executable to implement the one or more methods shown herein and the data957may include one or more of the various pieces of data described herein.

The memory953may be any electronic component capable of storing electronic information. The memory953may be embodied as random access memory (RAM), read-only memory (ROM), magnetic disk storage media, optical storage media, flash memory devices in RAM, on-board memory included with the processor, EPROM memory, EEPROM memory, an ASIC (Application Specific Integrated Circuit), registers and so forth, including combinations thereof. The various components of the network device971may be coupled together by a bus system969, which may include a power bus, a control signal bus and a status signal bus, in addition to a data bus. However, for the sake of clarity, the various buses are illustrated inFIG.9as the bus system969.

In the above description, reference numbers have sometimes been used in connection with various terms. Where a term is used in connection with a reference number, it may refer to a specific element that is shown in one or more of the Figures. Where a term is used without a reference number, it may refer generally to the term without limitation to any particular Figure.

The term “determining” encompasses a wide variety of actions and, therefore, “determining” can include calculating, computing, processing, deriving, investigating, looking up (e.g., looking up in a table, a database or another data structure), ascertaining and the like. Also, “determining” can include receiving (e.g., receiving information), accessing (e.g., accessing data in a memory) and the like. Also, “determining” can include resolving, selecting, choosing, establishing and the like.

The phrase “based on” does not mean “based only on,” unless expressly specified otherwise. In other words, the phrase “based on” describes both “based only on” and “based at least on.”

The term “processor” should be interpreted broadly to encompass a general purpose processor, a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a controller, a microcontroller, a state machine and so forth. Under some circumstances, a “processor” may refer to an application specific integrated circuit (ASIC), a programmable logic device (PLD), a field programmable gate array (FPGA), etc. The term “processor” may refer to a combination of processing devices e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.

The term “memory” should be interpreted broadly to encompass any electronic component capable of storing electronic information. The term memory may refer to various types of processor-readable media such as random access memory (RAM), read-only memory (ROM), non-volatile random access memory (NVRAM), programmable read-only memory (PROM), erasable programmable read only memory (EPROM), electrically erasable PROM (EEPROM), flash memory, magnetic or optical data storage, registers, etc. Memory is said to be in electronic communication with a processor if the processor can read information from and/or write information to the memory. Memory that is integral to a processor is in electronic communication with the processor.

The terms “instructions” and “code” should be interpreted broadly to include any type of computer-readable or processor-readable statement(s). For example, the terms “instructions” and “code” may refer to one or more programs, routines, sub-routines, functions, procedures, etc. “Instructions” and “code” may comprise a single computer-readable statement or many computer-readable statements.

The term “computer-readable medium” refers to any available medium that can be accessed by a computer or processor. By way of example, and not limitation, a computer-readable medium may comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. A computer-readable medium may be tangible and non-transitory. Disk and disc, as used herein, includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray® disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers.

Software or instructions may also be transmitted over a transmission medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio and microwave are included in the definition of transmission medium.

The methods disclosed herein comprise one or more steps or actions for achieving the described method. The method steps and/or actions may be interchanged with one another without departing from the scope of the claims. In other words, unless a specific order of steps or actions is required for proper operation of the method that is being described, the order and/or use of specific steps and/or actions may be modified without departing from the scope of the claims.

It is to be understood that the claims are not limited to the precise configuration and components illustrated above. Various modifications, changes and variations may be made in the arrangement, operation and details of the systems, methods and apparatus described herein without departing from the scope of the claims.