Secure Remote Connections In Industrial Internet Of Things

A non-transitory computer readable medium comprising program instructions which, when run on a computing apparatus, causes the computing apparatus to perform at least the following steps:

• receiving a first connection request from a user device, said first connection request including an access token;
• validating the access token in an identity and access management (IAM) service;
• after successful validation, establishing a first tunnel between the user device and a target device via a chain of trusted certificate-based point-to-point connections through one or more intermediate gateways, wherein the first tunnel is established by using a reverse connection from the computing apparatus to the target device, said reverse connection being based on a pre-established connection from the target device to the computing apparatus via an outbound port in the target device and in each of the one or more intermediate gateways in the chain, said target device having no direct internet protocol connectivity to the user device without the first tunnel;
• establishing a second tunnel between the target device and the IAM service via the chain of trusted certificate-based point-to-point connections through the one or more intermediate gateways, wherein the second tunnel is established by using the reverse connection from the computing apparatus to the target device, said target device having no direct internet protocol connectivity to the IAM service without the second tunnel;
• and
• validating the access token in the IAM service via the second tunnel.

Equipment comprising at least one processor and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, with the at least one processor, perform the following steps:

• receiving a first connection request from a user device, said first connection request including an access token;
• validating the access token in an identity and access management (IAM) service;
• after successful validation, establishing a first tunnel between the user device and a target device via a chain of trusted certificate-based point-to-point connections through one or more intermediate gateways, wherein the first tunnel is established by using a reverse connection from the equipment to the target device, said reverse connection being based on a pre-established connection from the target device to the equipment via an outbound port in the target device and in each of the one or more intermediate gateways in the chain, said target device having no direct internet protocol connectivity to the user device without the first tunnel;
• establishing a second tunnel between the target device and the IAM service via the chain of trusted certificate-based point-to-point connections through the one or more intermediate gateways, wherein the second tunnel is established by using the reverse connection from the equipment to the target device, said target device having no direct internet protocol connectivity to the IAM service without the second tunnel;
• and
• validating the access token in the IAM service via the second tunnel.

A system comprising at least

• a user device,
• a target device, and
• three or more gateways;
• wherein one of the three or more gateways is a first gateway configured to receive a first connection request from the user device, said first connection request including an access token;
• wherein one of the three or more gateways is a device gateway directly connected to the target device or included in the target device;
• wherein at least one of the three or more gateways is an intermediate gateway between the first gateway and the device gateway;
• wherein the first gateway is further configured to have trusted bidirectional communication with the target device via a chain of trusted certificate-based point-to-point connections by using a reverse connection from the first gateway to the target device, said reverse connection being based on a pre-established connection from the target device to the first gateway via an outbound port in the target device and in the intermediate gateway;
• wherein the first gateway is further configured to send the access token to an identity and access management (IAM) service for validating the access token;
• wherein the three or more gateways are configured to establish a first tunnel between the target device and the user device by using the reverse connection from the first gateway to the target device, said target device having no direct internet protocol connectivity to the user device without the first tunnel;
• wherein the target device is further configured to receive a second connection request from the user device via the first tunnel, said second connection request including the access token;
• wherein the three or more gateways are further configured to establish a second tunnel between the IAM service and the target device via the chain of trusted certificate-based point-to-point connections by using the reverse connection from the first gateway to the target device, said target device having no direct internet protocol connectivity to the IAM service without the second tunnel;
• wherein the target device is further configured to send the access token to the IAM service via the second tunnel for validating the access token.