Gateway Server ID Extraction for Device ACL Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing device management systems face challenges in controlling access rights when a Gateway is present, as the device management client cannot determine whether to initiate a session with the device management server, leading to incomplete management of terminal devices.
Innovation Solution
A method where the Gateway receives a notification message from the device management server, generates a second notification message with the ID identifier of the server, and sends it to the device, allowing the device to parse and perform ACL right control by comparing the server ID with the ACL attribute value, thereby determining if a management session should be initiated.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the Gateway replaces the DM Server to manage the DM Client in proxy mode, then the Gateway can act as an intermediary for devices behind firewall, but the DM Client cannot determine whether to initiate a session with the DM Server, leading to access control failure
Solution Approach 1:
The Gateway acts as an intermediary that receives Notification messages from the DM Server, extracts the ServerID, and forwards it to the DM Client in the second Notification message. This allows the DM Client to obtain the DM Server's identity through the Gateway without breaking the proxy architecture, enabling proper ACL verification while maintaining gateway mediation.
2Reliability
If the DM Client directly accesses the DM Server, then ACL control can be implemented by comparing ServerID with ACL attribute values, but devices behind firewall or not supporting OMA DM protocol cannot access the server directly
Solution Approach 1:
The Gateway serves as a mediator that enables indirect access for devices behind firewalls or lacking OMA DM support. It receives messages from the DM Server, extracts the ServerID, and forwards it to the DM Client, allowing these restricted devices to participate in device management while maintaining security through ACL control.
Solution Approach 2:
The system segments the communication process into two parts: the Gateway handles the external communication with the DM Server and performs ServerID extraction, while the DM Client performs local ACL verification. This segmentation allows devices with limited capabilities to function properly behind firewalls while maintaining security controls.
3Ease of operation
If the Gateway sends only its own ID identifier to the DM Client, then the Gateway can maintain control as proxy, but the DM Client cannot perform ACL right control because it lacks the DM Server identifier
Solution Approach 1:
The Gateway, as an intermediary, performs ServerID extraction from the first Notification message and includes it in the second Notification message sent to the DM Client. This allows the DM Client to obtain the necessary ServerID information for ACL control while the Gateway maintains its proxy management role, resolving the information loss problem.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The present invention relates to a device management method and apparatus, where the method includes: receiving a first device management message sent by a device management server; generating a second device management message according to the received first device management message, where the second device management message includes identification information of the device management server; and sending the second management message to a terminal device. The device management method and apparatus provided by the present invention resolve a problem of right control in managing a device management client by a device management server in a case that a gateway exists, so that in the case that the gateway exists, a right control mechanism of device management may be normally used to perform right control.