HTTP-Based Remote Management for IP Terminals Behind Firewalls

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional conferencing systems face challenges in managing and administering IP terminals behind firewalls and NAT installations due to strict firewall policies and the limitations of protocols like SNMP, which pose security risks and hinder remote configuration and monitoring.

Innovation Solution

A method utilizing periodic HTTP connections to transmit requests and instructions through firewalls/NAT installations, employing HTTPS for secure communication, and extending DHCP to automatically configure equipment with the management system's IP address, allowing for remote management and monitoring without compromising security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If SNMP protocol is used for monitoring equipment behind firewall, then monitoring capability is improved, but security risk increases significantly

Engineering Contradiction:

Improvemonitoring capabilityVSAvoidsecurity risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces an HTTP/HTTPS protocol as an intermediary mechanism between the management system and equipment behind firewalls. Instead of using SNMP which requires opening security holes in firewalls, the system uses standard web protocols that are already permitted by firewall configurations, thus achieving monitoring capability without increasing security risks

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent creates a virtual copy of the management interface through web-based HTML forms that replicate SNMP functionality. The equipment generates HTTP requests containing monitoring data in HTML format, which the management system can process similarly to SNMP traps, providing monitoring capability through a secure alternative protocol

Inventive Principle:

Principle #26Copying

2Ease of operation

If management system initiates connections to equipment behind firewall, then configuration capability is improved, but firewall policy compliance deteriorates

Engineering Contradiction:

Improveconfiguration capabilityVSAvoidfirewall policy compliance

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent inverts the traditional initiation direction of communication. Instead of the management system initiating connections to equipment (which is blocked by firewall policies), the equipment is configured to initiate HTTP requests to the management system. This reversal allows configuration capability while maintaining firewall policy compliance, as outbound connections from equipment are permitted

Inventive Principle:

Principle #13The other way round (Inversion)

3Object-affected harmful factors

If NAT installation is used to protect internal network, then security is improved, but management system cannot determine actual device IP addresses

Engineering Contradiction:

Improvenetwork securityVSAvoidIP address information

Core Design Contradiction:

Object-affected harmful factorsVSLoss of information

Solution Approach 1:

The patent makes the equipment capable of performing multiple functions: it can both generate monitoring data and provide its own address information through the same HTTP request mechanism. The equipment includes its IP address and port information within the HTML request body, allowing the management system to identify the device without requiring NAT translation or additional configuration

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Reliability

If firewall ports are opened for SNMP communication, then monitoring functionality is improved, but network security deteriorates

Engineering Contradiction:

Improvemonitoring functionalityVSAvoidnetwork security

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent changes the protocol parameter from SNMP (which requires opening specific high-risk ports) to HTTP/HTTPS (which uses standard web ports already permitted by firewalls). This parameter change allows monitoring functionality to operate through existing firewall rules without creating additional security vulnerabilities associated with opening SNMP ports

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS8713662B2Method of monitoring and configuring

Publication Date: 2014.04.29 CISCO TECHNOLOGY INC

AI summary

A method for managing and monitoring communication devices in a firewall/NAT protected network from a Management system outside the firewall/NAT protected network includes periodically and at predefined events opening an http connection and transmitting a request from the respective communication devices to the Management system through a firewall/NAT installation protecting the network, and when receiving said request in the management system, transmitting instructions and data to the communication devices from the management system in a http response through said http connection.