Edge Device Remote Access via Cloud-Triggered Secure Tunnel

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional secure solutions for remote access to edge devices behind network firewalls require physical access and are cumbersome for managing multiple devices or those in difficult-to-reach areas, especially when using encrypted tunnels initiated from the edge device.

Innovation Solution

A cloud-hosted management system establishes a secure tunnel from edge devices to a cloud service, using a web-socket tunnel triggered by edge devices, enabling remote configuration and management through a cloud-hosted interface with multiple authentication layers and secure shell sessions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If an encrypted tunnel is initiated from an edge device to enable secure remote access, then security is improved, but physical access to the device console is required which increases operational complexity and time consumption

Engineering Contradiction:

ImprovesecurityVSAvoidremote access configuration

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

Instead of initiating the encrypted tunnel from the edge device as in conventional solutions, the patent inverts the approach by having the cloud service initiate the tunnel connection to the edge device. This allows remote access without requiring physical console access at the edge device, resolving the contradiction between security and ease of operation.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent introduces a cloud service as an intermediary between the remote user and the edge device. The cloud service acts as a mediator that establishes the encrypted tunnel connection, manages authentication, and facilitates remote access without requiring direct physical access to the edge device console, thereby improving operational ease while maintaining security.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If conventional encrypted tunnel solutions are used for remote access, then security is maintained, but the process is cumbersome when managing multiple devices or devices in difficult-to-reach areas

Engineering Contradiction:

ImprovesecurityVSAvoiddevice configuration time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The edge device is configured with a pre-provisioned identity (such as a certificate or credential) that enables it to autonomously establish encrypted connections with the cloud service without requiring manual physical access or configuration. This self-service capability allows multiple devices to be managed efficiently, reducing the time and effort required for remote configuration while maintaining security.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The edge device is pre-configured with necessary authentication credentials and identity information before deployment. This preliminary action eliminates the need for physical console access during initial setup and enables automated tunnel establishment, significantly reducing configuration time for multiple devices or those in hard-to-reach locations while preserving security.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If physical access to edge device console is required to initiate encrypted tunnel, then secure connection is established, but scalability to multiple devices is reduced

Engineering Contradiction:

Improveconnection securityVSAvoiddevice management efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent inverts the conventional tunnel initiation approach by having the cloud service (remote end) initiate the connection to the edge device rather than requiring the edge device to initiate from physical console access. This inversion enables scalable remote access to multiple devices without compromising connection security, as the cloud service can automatically manage connections to numerous devices simultaneously.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The cloud service is designed with universal functionality to manage encrypted tunnel connections to multiple edge devices through a single interface. This multi-functional capability allows the system to handle security establishment and remote access for numerous devices efficiently, improving productivity and scalability while maintaining the same security standards across all device connections.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12500867B2Cloud-hosted remote access using secure tunnel triggered by edge devices

Publication Date: 2025.12.16 NVIDIA CORP

AI summary

Systems and methods include a cloud-hosted management plane where an authenticated user can initiate a request to establish a remote session to an edge device. A request may be transmitted to create a secure tunnel between the edge device and the cloud-based management plane. The edge device may receive and use a set of credentials to trigger a web-socket tunnel from the edge device to the cloud-hosted management plane. This connection may be used for management of an edge device(s), troubleshooting edge inferencing, access/use of edge applications, and various other applications.