FR2838593A1 - Internet protocol remote maintenance/administration/file transfer having client connection responding server demands with first demand containing protocol/limiting response repetition. - Google Patents

Abstract

The establishment process has a client connection to a server unit with the client unit responding to demands received from the server. The first demand sent out contains the protocol used, so as to limit response repetition.

Description

color. It is common to have multiple computer installations

  (hereinafter called "client sites") physically dispersed, which can be of various types and natures and belong to different administrative entities, and which must be accessed from one or a few central IT sites. This occurs in particular during the installation or updating of software, file transfer, correction of malfunctions, and more generally during all administration operations, maintenance, operation, handling of distance,

  or others on customer sites. An operation of this type is hereinafter called remote intervention.

  Usually IT competence is weak on client sites, at least in the field concerned by the intervention, and intervening remotely allows in particular to motivate 0 the rare and expensive IT competence of qualified operators, reduce costs and / or

provide better service.

  This situation is encountered in particular in the case of IT services companies and IT vendors before

  provide support and assistance to an installed fleet.

  Access to the customer site must be secure, in particular to avoid intrusions, offer a data rate adapted to the operations to be carried out, in particular to provide good comfort - of use, be reliable and available (intervention possible at any time, emergency character ...), not requiring intervention from the staff of client sites, being of an installation and an easy and flexible implementation even in heterogeneous IT environments, and being economical, especially during implementation and operation, especially in the case of long interventions or on sites

geographically distant. -

  There is currently no access method fully satisfying these constraints.

  For example, a private corporate network cannot be used for multiple -. private virtual networks offered by telecommunication companies are expensive, leaving a machine on each client site with open incoming access from the Internet is very dangerous without excellent local IT skills to protect and avoid it. intrusions, etc. In practice, the majority of remote control systems use the standard telephone network, with modems, and sometimes encryption, passwords and / or automatic call back. This solution has many disadvantages, in particular a limited and non-adaptable data rate, an unreliable link both during the establishment and in the

  duration, significant establishment time, random security and significant cost.

  The process which is the subject of the invention allows such access to be achieved without the drawbacks indicated.

  It allows client sites to be connected to the Internet in a reasonably secure manner

  by allowing central sites to access it.

  -2 For this, the client site includes at least one machine (the client) with at least outgoing access (direct or via firewall, etc.) and the central site includes a machine (the server) with at least inbound access to the Internet or to a network or environment using the TCP / IP protocol, an object executing an instruction sequence on a machine is called execution unit; depending on the environment, this corresponds to a process, a task, a ttread, a daemon, etc. On the initiative of the client (at startup for example), a client thread establishes a connection according to Internet protocols to a thread located on the server, creates a two-way communication channel (called by the suite socket) between the two, and sends a data stream simulating a question. The two execution units can be physically on the same site or the same machine. Thus, seen from the network and security systems of the customer site, we are dealing with a usual outgoing communication. As long as the central site does not wish to connect, the server does not respond, or can also periodically send back filling data to keep the socket open. If, for some reason, for example due to too long a period of inactivity, the socket closes, the client can recreate a new one in the same way; in this case, on receipt of this incoming call from the same client, the server can close the old one, and consider the new one to be the active socket. When the central office wants to connect, the server responds by sending the desired request to the active socket, by dressing it so that it becomes, seen from the outside, the payload of the response to the request from the client site. The client replies to this question with an answer dressed to be the payload of a question within the meaning of the protocol used. The rest of the dialogue is carried out either via the socket that remains open, so * thanks to new sockets created similarly by the client, or by a mixture of these methods. Depending on the embodiments and the protocols used, certain questions, both real and within the meaning of the protocol used, may contain no or more answers, and certain questions and answers within the meaning of the protocol used may not be used and may only serve to

filling for example.

  A connection is thus created physically at the initiative of the customer site, but logically at the initiative of the central site, in which questions transmitted within the meaning of the protocol used are sent by the customer, at least some of which include in their payload answers to questions housed in the response payload within the meaning of the protocol used

issued by the server.

  The first question within the meaning of the protocol used sent by the client may include in its

  payload information about the state of the client thread and its environment.

  In addition, the client can initialize as many connections as necessary at judiciously chosen times (for example and without limitation during the first reception of

  data from the server) so that there is always an available link.

  - 3 Doing so allows the customer site to prohibit (via a firewall for example) any incoming connection without impacting the operation of the process, which is a very important security advantage because it eliminates the vast majority of possibilities of 'intrusion. This also avoids all the constraints of addressing, routing and resolution of names linked to the implementation

s from an incoming connection.

  The central site accepts incoming communications, but this does not pose any crucial security problems because, in general, the central site has computer skills to make a correct configuration, and moreover, it is much easier to secure a single site.

that a multitude.

  This process is very economical because, unlike the telephone for example, TCP / IP connections are not usually priced either by duration, volume, distance, or the number of active links but according to the available bandwidth of the link. When no remote control operation is in progress, all of this bandwidth is available for other uses (typically e-mail and access to the world wide web); in the event of activity, the bandwidth is easily shared without any particular operation to be carried out. In addition, very frequently, a permanent Internet link already exists on the client site, and can be used by the remote control system, thus eliminating all investments and expenses.

  additional telecoms linked to remote intervention.

  This process provides much better user comfort than the telephone, because, unlike the latter, Internet connections are generally permanent, and moreover available in multiple classes of relaxation, thus allowing a flexible and easy adjustment to needs. In addition, these types of connections are identical worldwide without specific variants or licenses

  local, unlike telephone or ISDN networks.

  It is possible to use any protocol on the socket, therefore in particular standard 2s protocols such as HITP, HI1PS or SOAP. Doing so allows the customer in particular through the use of judicious syntaxes, protocols and / or addresses to generate links similar to those usually made by the customer site, and therefore difficult to discern from them, at least by the devices local security. For example, it is possible to simulate the behavior of an ordinary user connected to the Internet via his workstation, a type of connection almost always authorized by the protection devices (firewalls for example) and the computer network of the customer site. . Thus, no modification of said devices

  is not necessary during installation on the customer site.

  Likewise, connections can be authenticated and encrypted, for example through the use of protocols or algorithms with public or private key, and / or certificates, and / or

  3rd party certifiers, and / or digital signatures.

  - 4 - The connections can also encapsulate any other protocol, thus allowing in particular in the payload the multiplexing (case of the PPP protocol for example) of several incoming and / or outgoing information flows, and / or the creation of gateways between programs, etlou

  the transmission of information of any kind (for example audio or video) between sites.

  Similarly, the client and / or server execution units can play the role of dispatchers by routing and / or multiplexing and demultiplexing the requests and / or data received to and / or from an operator and from any devices (non-limiting. Cameras, microphones, sensors, actuators, systems sound, image or video acquisition / reproduction ...)

  andlou other processing units andlou other systems, and returning the responses to them.

  The link may also not be permanent. In this case, the client is free to establish the connection, for example according to time slots or the occurrence of any type of event

  (alarms, malfunctions ...), or request from a customer site operator.

  It is possible to redundate the connections and / or execution units, client side and / or server,

  in order to guard against possible malfunctions and improve the availability of the whole.

  In this case, according to a prerential embodiment of the invention, the assembly is judiciously arranged so that in the event of a unit and / or a loose connection, another

  unit and / or another connection takes over, in order to maintain and / or re-establish the link.

  A nonlimiting example of implementation of the invention is shown in Figure 1). The client site includes the client machine (1) connected to the Internet (11) via a router and a firewall (not shown) preventing any incoming connection, on which runs a daemon (2) activated when the machine starts, supporting the protocols SOAP and HTIP. The operator (9) accesses the central site via standard navigation software (WEB browser) using the HP and HTML protocols, via the Internet (11). The central site consists of a server (10) operating under multitasking operating system connected to the Internet (11) via a router and a firewall not shown. On this server operates a standard WEB server (4), the set being configured so that a process (5) is executed upon receipt of a SOAP request received on the URL (3) sent by the daemon (2) and that the process (7) is executed on reception of an HTML request received on the URL (8) sent by the operator (9), thanks to a CGI interface for example. A daemon (6) is activated on (10) at startup, at which

  can connect processes (5) and (7) by a mechanism based on sockets for example.

  The steps of the exchanges and actions of the different components are as follows: In Step 1): At startup, (2) sends an empty SOAP request (X) to the URL (3) managed by the WEB server (4), which active (5) which connects to (6) via a socket, transmits the request and 3s waits for a response on this one. The result of this action is that (6) notes in its internal tables the coordinates of (2) - 5 - At Step 2): Some time after (9) sends an actual HTML request (Y) to the URL (8) managed by 14), which activates (7) which connects to (6) via a socket, transmits the request and waits

an answer on this one.

  In Step 3): (6) code and format this HTML request so that it is syntactically seen as the response to the SOAP request (Xj, and returns the result to (5), which transmits it to

  WEB server (4) which in turn forwards it to (2).

  In Step 4): (2) receives this pseudo SOAP response, which is actually the question contained in the HML request (Y), calculates the answer to this question, codes it and formats it so that it is syntactically seen as a SOAP () request, and returns this result on 0 the URL (3) managed by (4), which activates (5) which transmits it to (6). (2) is then in the same state

at the end of step l).

  In Step 5): (6) decodes and formats this pseudo request in order to make an HTML response which is transmitted to (4) which returns it to the operator (9) as a response to the

HTML request (Y).

  Steps 2) to 5) can be repeated indefinitely. Processes (4) 7 (5), (6), and (7) can

  be implemented separately or not depending on IT environments.

  Regarding steps l) to 5): Seen from the operator, (9) sent an H1tML question to (l), and received shortly after an HTML response. Seen from the WEB server, (l) sent a SOAP request to (l0), received a SOAP response shortly after, then returned another SOAP request which is awaiting response. Seen from the Internet, (l) received no incoming calls or requests and made two. We therefore realize the object and of the invention, that is to say a communication physically

  at the initiative of the client, but logically at the initiative of the server.

  This process can be used in particular in software, solutions and systems for remote maintenance, remote operation, file transfer, remote administration, remote monitoring, remote broadcasting or remote collection of files, software or other, remote site updating,

  applications or others, consolidation of information and / or data.

-6

Claims (8)

  1) Method for establishing and running a computer link according to Internet protocols between a client execution unit located on a client site and a server execution unit located on a server site, said units being able to be physically on the same site and / or the same machine, characterized in that the client unit establishes the connection to the server unit, that the client unit sends questions within the meaning of the protocol used and receives within the meaning of the protocol used zero or more answers to each question, and that the payload of at least some answers is actually a question of the server unit, and the payload of at least some questions is actually an answer of a question of the server unit , the first question within the meaning of the protocol used sent by the client unit serving as filling for respect the protocol used.   2) Method according to the preceding claim, characterized in that it is used in software, solutions and systems for remote maintenance, remote operation, transfer of files, remote administration, remote monitoring, television broadcasting or remote collection of files, software or other, television -update of sites, applications or other, consolidation of information and / or data.   3) Method according to any one of the preceding claims, characterized in that the charge   useful of the first question within the meaning of the protocol used issued by the client unit actually contains at least partially information on the state of the client execution unit and its environment.   4) Method according to any one of the preceding claims, characterized in that the unit   client initializes multiple bindings at judiciously chosen times so that there are always at least one available.   ) Method according to any one of the preceding claims, characterized in that the   protocols and / or syntax and / or addresses used make binding similar to others   links usually take place on the client site and / or are difficult to discern from them.   6) Method according to any one of the preceding claims, characterized in that all or   part of the incoming and / or outgoing data is encrypted and! or authenticated and all digitally signed.   7) Method according to any one of the preceding claims, characterized in that the   payloads of questions and / or answers within the meaning of the protocol used are organized   so as to multiplex several incoming and / or outgoing information flows.   8) Method according to any one of the preceding claims, characterized in that the unit of   server processing and / or the client processing unit performs routing and / or multiplexing / demultiplexing of data from and / or to devices and / or   human processing systems and / or units and / or operators.   9) Method according to any of the preceding claims, characterized in that there is   additional processing units on the client site and / or the server site, and / or that there are several possibilities of connection between said units, and that the assembly is agency so that in the event of unit and / or connection a different unit and / or another connection