# US 10,873,564 B2 · Cloud-based device manager based on message queues > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,564 B2 - Document ID: US10873564B2 - Status: Granted - Kind: B2 - Application number: 16/137,194 - Filed: 2018-09-20 - Published: 2020-03-26 - Granted: 2020-12-22 - Earliest claimed: 2018-09-20 - Assignees: Palo Alto Research Center Incorporated - Applicants: Palo Alto Research Center Incorporated - Inventors: Marc E. Mosko - Web page: https://patentgrep.com/patent/US10873564B2 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 41/0213: Standardised network management protocols, e.g. simple network management protocol [SNMP] - H04L 41/0266: using meta-data, objects or commands for formatting management information, e.g. using eXtensible markup language [XML] - H04L 41/0853: by actively collecting configuration information or by backing up configuration information - H04L 41/122: of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV] - H04L 61/2514: between local and global IP addresses - H04L 61/2517: using port numbers - H04L 61/256: NAT traversal - H04L 61/5007: Internet protocol [IP] addresses - H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/166: {at the transport layer} - H04L 41/5096: {wherein the managed service relates to distributed or central networked applications} - H04L 61/5046: Resolving address allocation conflicts; Testing of addresses (testing when self-assigning an address H04L61/5092) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments described herein provide a system. The system stores, in a storage device, a first and a second data structures. The first data structure maps a logical Internet Protocol (IP) address of a device to a site IP address of the device at a customer site. The second data structure maps the logical IP address to a message queue (MQ) name identifying a queue, which is associated with the customer site and facilitated by a message queuing service. During operation, the system identifies a command packet for the device. The destination address of the command packet can be the logical IP address. The system then replaces, in the command packet, the logical IP address with the site IP address based on the first data structure to generate a modified packet and forwards an MQ message comprising the modified packet to the queue using the message queuing service. ## Claims ### Claim 1 A method for facilitating a cloud-based device management service, comprising: storing, in a storage device of a computer system, a first data structure and a second data structure, wherein a first entry in the first data structure maps a logical Internet Protocol (IP) address of a device to a site IP address of the device at a customer site, and wherein a second entry in the second data structure maps the logical IP address to a message queue (MQ) name identifying a queue, wherein the queue is associated with the customer site and facilitated by a message queuing service; identifying a command packet comprising a management command issued by a device manager for the device, wherein the destination address of the command packet is the logical IP address; replacing, in the command packet, the logical IP address with the site IP address based on the first data structure to generate a modified packet; identifying the queue associated with the MQ name by looking up the logical IP address in the second data structure; and forwarding an MQ message comprising the modified packet to the identified queue using the message queuing service. ### Claim 2 (depends on 1) The method of claim 1, wherein identifying the queue further comprises obtaining the MQ name from the second data structure based on a mapping between the MQ name and the logical IP address. ### Claim 3 (depends on 1) The method of claim 1, wherein the MQ message is encrypted based on Transport Layer Security (TLS) protocol. ### Claim 4 (depends on 3) The method of claim 3, wherein the TLS facilitates one or more of: authentication of an MQ manager at the customer's site; and application of a service authorization based on a cryptographic identity. ### Claim 5 (depends on 1) The method of claim 1, wherein the device manager is a printer management system and the device is a printer. ### Claim 6 (depends on 1) The method of claim 1, wherein forwarding the MQ message further comprises one or more of: encapsulating the modified packet with an encapsulation header corresponding to the identified queue; and operating as an MQ broker of the message queuing service for determining the queue. ### Claim 7 (depends on 1) The method of claim 1, wherein the first and second entries are based on one or more of: a subnet-based mapping; and an individual IP-address based mapping. ### Claim 8 (depends on 1) The method of claim 1, further comprising facilitating a firewall service to one or more of: management traffic; and traffic associated with the logical IP address and the site IP address. ### Claim 9 A method for facilitating a cloud-based device management service, comprising: storing, in a storage device of a computer system, a data structure that maps a first IP address of a device manager to a second IP address of the computer system; determining whether a packet from a device is destined to a device manager managing the device, wherein the destination address of the packet is the second IP address; in response to determining that the packet is destined to the device manager, replacing, in the packet, the second IP address with the first IP address based on the data structure to generate a modified packet; identifying a queue, which corresponds to the device manager and is associated with a message queue (MQ) name, based on a mapping between the second IP address and the MQ name; and forwarding an MQ message comprising the modified packet to the queue corresponding to the device manager using a message queuing service. ### Claim 10 (depends on 9) The method of claim 9, further comprising: identifying a command packet comprising a management command issued by the device manager for the device, wherein the source address of the command packet is the first IP address; replacing, in the command packet, the first IP address with the second IP address based on the data structure; and forwarding the command packet to the device based on a destination address of the command packet. ### Claim 11 (depends on 9) The method of claim 9, wherein the MQ message is encrypted based on Transport Layer Security (TLS) protocol. ### Claim 12 (depends on 11) The method of claim 11, wherein the TLS facilitates one or more of: authentication of an MQ manager at the customer's site; and application of a service authorization based on a cryptographic identity. ### Claim 13 (depends on 9) The method of claim 9, wherein the device manager is a printer management system and the device is a printer. ### Claim 14 (depends on 9) The method of claim 9, wherein forwarding the MQ message further comprises: encapsulating the modified packet with an encapsulation header corresponding to the identified queue; and operating as an MQ broker of the message queuing service for determining the queue. ### Claim 15 (depends on 9) The method of claim 9, wherein determining whether the packet is destined to the device manager comprises processing the packet based on a set of rules that includes one or more of: a network address translation (NAT) rule that matches a rule of a reverse direction of the packet; a port address translation (PAT) rule that matches a rule of a reverse direction of the packet; and a signature rule that matches a packet signature. ### Claim 16 (depends on 9) The method of claim 9, wherein the data structure is based on NAT or PAT. ### Claim 17 (depends on 9) The method of claim 9, further comprising maintaining a state for a respective packet destined to the second IP address such that the packet can be sent back to the device manager. ### Claim 18 A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for facilitating a cloud-based device management service, the method comprising: storing, in a storage device of a computer system, a first data structure and a second data structure, wherein a first entry in the first data structure maps a logical Internet Protocol (IP) address of a device to a site IP address of the device at a customer site, and wherein a second entry in the second data structure maps the logical IP address to a message queue (MQ) name identifying a queue, wherein the queue is associated with the customer site and facilitated by a message queuing service; identifying a command packet comprising a management command issued by a device manager for the device, wherein the destination address of the command packet is the logical IP address; replacing, in the command packet, the logical IP address with the site IP address based on the first data structure to generate a modified packet; identifying the queue associated with the MQ name by looking up the logical IP address in the second data structure; and forwarding an MQ message comprising the modified packet to the identified queue using the message queuing service. ### Claim 19 (depends on 1) The method of claim 1, wherein the MQ message is encrypted based on Transport Layer Security (TLS) protocol. ### Claim 20 (depends on 1) The method of claim 1, wherein forwarding the MQ message further comprises one or more of: encapsulating the modified packet with an encapsulation header corresponding to the identified queue; and operating as an MQ broker of the message queuing service for determining the queue.