FIELD OF THE INVENTION

The present invention relates to systems and methods suitable for establishing communication between secure and unsecure devices. In particular, the present invention relates to systems and methods that enables communication between secure and unsecure devices utilizing communication protocols that require implementation over secured connections.

BACKGROUND

The advent of the Internet and increased access to computer networks has facilitated the ability for service providers and end users to communicate seamlessly over the Internet to provide access to different services (e.g., streaming, gaming, communication, file transfer, etc.). Service providers and end users can communicate in a number of different ways utilizing different communication protocols. The Transmission Control Protocol (TCP) and the Internet Protocol (IP), for example, are foundational protocols for many protocols used to communicate over the Internet and networks. As the usage of the Internet has grown and different types of Internet enabled devices have become available, other communication protocols have been created to simplify secure communication between devices. For example, end users can access content and services through web browsers and/or mobile applications without having to coordinate a direct connection with another end user or service provider.

With services readily available to users and ease of connectivity between unknown devices, there is an increase in risk associated with communications between those devices. To protect service providers and end users from malicious behavior, a variety of security and restriction standards and protocols have been developed for use when communicating between devices. Internet open standards is an example of such a standard and places certain restrictions on connections (e.g., TCP and User Datagram Protocol (UDP) connections protocols) made from web browser clients. These restrictions are covered in the Cross-origin resource sharing (CORS) standard and can be interpreted differently across different web browsers. In one implementation of CORS, a browser client cannot establish a connection from a secure site to an unsecure endpoint. This requirement is becoming the standard through adoption by mainstream browsers (e.g., such as Google Chrome) and may apply to all browsers as a part of the official HTML5 specification. This has far reaching implications for how data can be shared between devices when a web browser is involved.

One example of such a limitation occurs when a web browser used on a device attempts to make a remote connection to an endpoint with a Web Real-Time Communication (WebRTC) because browser clients have limited access to publish multimedia (e.g., from camera or microphone) when connecting to a remote server. Access can be limited because the server endpoint needs to be secured with an SSL certificate. In particular, similar to CORS, the WebRTC architecture also comes with its own set of rules defined by open standards which define limitations and boundaries for the mechanism flow. One of the core policies being that a secured connection (SSL enabled) is required by WebRTC client to connecting to a remote media server endpoint (e.g., the connection must be established using a secure protocol (typically Secure WebSockets or WSS)). Thus, WebRTC connections require that an SSL certificate be installed on the remote server to which you connect. In situations where multiple media servers in a clustering and/or cloud configuration are needed to handle large amounts of media traffic, all server instances in the cluster which the browser needs to connect to are accessible over a secured connection (SSL enabled) to function under WebRTC. These restrictions have the potential to become a widespread issue because WebRTC offers an optimal low latency framework for communication which has seen a viral adoption over the recent years and usage continues to grow. Therefore, WebRTC is preferred for many implementations for sharing multimedia between devices but cannot currently be utilized efficiently in infrastructures that use cluster/cloud computing.

While the above search restrictions placed on publishing clients, browsers prohibit a connection between a secure client and an unsecure server, and because most web pages are delivered securely today, this means that you absolutely must use secure connections for all browser communication. As service providers begin scaling the architecture outwards (to handle Internet traffic larger than can be handled by a single instance), there will be issues with having to manage SSL certificates for multiple instances in the cluster, which in turn requires each instance to have its own domain name as well as an SSL certificate. More specifically, SSL uses domain names and authorizing entities to validate the certificates, and such that each server instance in the installation would normally require a different domain and its own SLL certificate.

The development of cloud computing also comes with similar issues. Cloud platforms offer dynamic instance management using their Application Program Interfaces (API)s and streaming setups using a stream manager, or other management tool, can utilize auto scaling features of the cloud platform and have server nodes added/removed dynamically in real time as network traffic changes. Irrespective of whether a cluster is manually setup or whether it's created by auto scaling, however, the problem remains the same. More specifically, it is tedious and not practical to set up domains and install certificates for each dynamic cloud instance and for instances being managed through auto scaling.

SUMMARY

There is a need for improvements for providing secure communication between secured and unsecured devices when implementing a protocol that requires secure connections. The present invention provides, in various embodiments solutions to address this need, in addition to having other desirable characteristics.

In accordance with example embodiments of the present invention, method for providing secure communication between secured and unsecured devices is provided. The method includes receiving, at a proxy service via a secure connection, a connection request from a client on a subscriber device, the connection request including a node address for a target publisher device, connecting, via an unsecure connection, the proxy service to the target publisher device, and establishing a bridge between the subscriber device and the target publisher device via the proxy service. The method also includes utilizing a proxy channel over the bridge to negotiate a connection between the subscriber device and exchanging data between the subscriber device and the publisher device over the connection.

In accordance with aspects of the present invention, the proxy service is implemented on a stream manager server configured with a domain name and an Secure Socket Layer (SSL) certificate. The stream manager can be implemented on a cloud infrastructure. The process for establishing the bridge can include negotiating session setup information between the subscriber device and the publisher device using an Interactive Connectivity Establishment (ICE) technique.

In accordance with aspects of the present invention, the bridge can include the connection between the subscriber device and the proxy service which uses a WebSocket secure (WSS) secure connection or a Hypertext Transfer Protocol Secure (HTTPS) connection and the connection between the publisher device and the proxy service which uses a WebSocket (WS) unsecure connection or a Hypertext Transfer Protocol (HTTP) connection. The bridge can enable secure data to flow from a secure subscriber device to an unsecure publisher device.

In accordance with aspects of the present invention, the subscriber device connects to the proxy service from a web browser client. The publisher device can be a media server without a domain or SSL certificate and is configured to broadcast multimedia to connected subscriber devices. The connection can be a direct connection between the subscriber device and the publisher device or the connection is a Network Address Translation (NAT) connection and the connection is configured to exchange multimedia data between the subscriber device and the publisher device.

In accordance with aspects of the present invention, the proxy service is configured to keep the bridge open during the exchange of the multimedia data between the subscriber device and the publisher device using a pinger mechanism. The method can further include balancing load between subscriber devices and publisher devices with a load balancer. The proxy service can provide WebRTC information exchange between the secured and unsecured devices for efficiency and reliability. The publisher device can include streaming clusters including plurality of physical nodes or virtual instances. The method can further include creating custom headers to track original client information for the subscriber device and the publisher device.

In accordance with example embodiments of the present invention, a system for providing secure communication between secured and unsecured devices is provide. The system includes a proxy service in electronic communication with a subscriber device via a secure connection and a target publisher device in electronic communication with the proxy service via an unsecure connection. The proxy service, in response to receiving a connection request from the client device, is configured to establish a bridge between the subscriber device and the target publisher device via the proxy service and utilize a proxy channel over the bridge to negotiate a connection between the subscriber device to facilitate an exchange of multimedia data between the subscriber device and the publisher device over the connection.

In accordance with aspects of the present invention, the proxy service is implemented on a stream manager server configured with a domain name and an Secure Socket Layer (SSL) certificate. The stream manager can be implemented on a cloud infrastructure. The process for establishing the bridge can include negotiating session setup information between the subscriber device and the publisher device using an Interactive Connectivity Establishment (ICE) technique. The bridge can include the connection between the subscriber device and the proxy service uses a WebSocket secure (WSS) secure connection or a Hypertext Transfer Protocol Secure (HTTPS) connection and the connection between the publisher device and the proxy service uses a WebSocket (WS) unsecure connection or a Hypertext Transfer Protocol (HTTP) connection. The bridge can enable secure data to flow from a secure subscriber device to an unsecure publisher device.

In accordance with aspects of the present invention, the subscriber device connects to the proxy service from a web browser client. The publisher device can be a media server without a domain or SSL certificate and is configured to broadcast multimedia to connected subscriber devices. The connection can be configured to exchange multimedia data between the subscriber device and the publisher device and the connection can be a direct connection between the subscriber device and the publisher device or a Network Address Translation (NAT) connection. In accordance with aspects of the present invention, the proxy service is configured to keep the bridge open during the exchange of the multimedia data between the subscriber device and the publisher device using a pinger mechanism.

The method can further include balancing load between subscriber devices and publisher devices with a load balancer. The proxy service can provide WebRTC information exchange between the secured and unsecured devices for efficiency and reliability. The publisher device can include streaming clusters including plurality of physical nodes or virtual instances. The method can further include creating custom headers to track original client information for the subscriber device and the publisher device.

