# US 12,010,116 B2 · Secure access of remote device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,116 B2 - Document ID: US12010116B2 - Status: Granted - Kind: B2 - Application number: 18/320,320 - Filed: 2023-05-19 - Published: 2023-09-14 - Granted: 2024-06-11 - Earliest claimed: 2020-12-03 - Assignees: Zpe Systems, Inc. - Applicants: ZPE Systems, Inc. - Inventors: Arnaldo Zimmermann; Livio Ceci - Web page: https://patentgrep.com/patent/US12010116B2 ## CPC - H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A cloud-based communication framework. A first secure channel may be established for communication between an IT device and a cloud-computing platform. A request for a device user interface may be received over the first secure channel. A second secure channel for communication between the IT device and the cloud-computing platform may be established in response to the request for the device user interface. The device user interface may then be forwarded over the second secure channel to the cloud-computing platform. ## Claims ### Claim 1 An information technology (IT) device, comprising: one or more non-transitory computer-readable media for storing computer-readable program code; and a processor in communication with the one or more non-transitory computer-readable media, the processor being operative with the computer-readable program code to perform operations including establishing a first secure channel for communication between the IT device and a cloud-computing platform, in response to a request received over the first secure channel for a device user interface of the IT device, establishing a second secure channel on-demand for communication between the IT device and the cloud-computing platform, and forwarding the device user interface over the second secure channel to the cloud-computing platform. ### Claim 2 (depends on 1) The IT device of claim 1, wherein the processor is operative with the computer-readable program code to establish the first and second secure channels by performing mutual authentication. ### Claim 3 (depends on 2) The IT device of claim 2 wherein the processor is operative with the computer-readable program code to perform the mutual authentication using a same trust certificate for the first and second secure channels. ### Claim 4 (depends on 2) The IT device of claim 2 wherein the processor is operative with the computer-readable program code to perform the mutual authentication using different trust certificates for the first and second secure channels. ### Claim 5 (depends on 2) The IT device of claim 2 wherein the processor is operative with the computer-readable program code to generate and validate one or more trust certificates for the mutual authentication with authentication information stored in the IT device. ### Claim 6 (depends on 5) The IT device of claim 5 wherein the authentication information comprises a unique IT device identifier and a hash of a public hardware-based key. ### Claim 7 (depends on 1) The IT device of claim 1 wherein the processor is operative with the computer-readable program code to retrieve the device user interface using a web server implemented in the IT device. ### Claim 8 (depends on 1) The IT device of claim 1 wherein the second secure channel comprises a full-duplex communication channel. ### Claim 9 A method for cloud-based communication, comprising: receiving, by a cloud-computing platform, from a user device a request for a device user interface of an information technology (IT) device; sending, by the cloud-computing platform, over a first secure channel the request for the device user interface to the IT device; in response to the request for the device user interface, establishing a second secure channel on-demand for communication between the IT device and the cloud-computing platform; receiving, by the cloud-computing platform, over the second secure channel the device user interface from the IT device; and sending, by the cloud-computing platform, the device user interface to the user device for presentation. ### Claim 10 (depends on 9) The method of claim 9 further comprises starting a cloud session between the user device and the cloud-computing platform upon a first successful user authentication via a cloud user interface. ### Claim 11 (depends on 10) The method of claim 10 further comprises starting a device session between the user device and the IT device upon a second successful user authentication via the device user interface. ### Claim 12 (depends on 11) The method of claim 11 further comprises monitoring the device session independently from the cloud session. ### Claim 13 (depends on 11) The method of claim 11 further comprises implementing, by the cloud-computing platform, different session timeouts for the device session and the cloud session. ### Claim 14 (depends on 9) The method of claim 9 wherein the request for the device user interface is sent in response to a user selection of an element within a cloud user interface for the cloud-computing platform. ### Claim 15 (depends on 9) The method of claim 9 further comprises establishing the first secure channel using mutual authentication. ### Claim 16 (depends on 9) The method of claim 9 further comprises establishing the second secure channel using mutual authentication. ### Claim 17 (depends on 9) The method of claim 9 further comprises sending, to the user device, a uniform resource locator (URL) that is unique to the IT device for accessing the device user interface. ### Claim 18 (depends on 9) The method of claim 9 further comprises receiving, over the first secure channel, a session identification token that is associated with the device user interface. ### Claim 19 A cloud-based communication system, comprising: a cloud-computing platform; a user device communicatively coupled to the cloud-computing platform; and at least one information technology (IT) device communicatively coupled to the cloud-computing platform, wherein the at least one IT device receives a request from the user device for a device user interface of the IT device over a first secure channel established between the cloud-computing platform and the at least one IT device, wherein a second secure channel is established on-demand between the cloud-computing platform and the at least one IT device in response to the request from the user device, wherein the IT device sends the device user interface over the second secure channel to the cloud-computing platform for communication to the user device. ### Claim 20 (depends on 19) The cloud-based communication system of claim 19 wherein the first and second secure channels are established by mutual authentication using a trust certificate.