Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
  • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
  • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
  • H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
  • H04L69/329—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the application layer [OSI layer 7]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
  • H04L41/02—Standardisation; Integration
  • H04L41/0246—Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols
  • H04L41/0273—Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols using web services for network management, e.g. simple object access protocol [SOAP]
  • H04L41/028—Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols using web services for network management, e.g. simple object access protocol [SOAP] for synchronisation between service call and response
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
  • H04N7/00—Television systems
  • H04N7/18—Closed-circuit television [CCTV] systems, i.e. systems in which the video signal is not broadcast
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L43/00—Arrangements for monitoring or testing data switching networks
  • H04L43/12—Network monitoring probes
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
  • H04L63/029—Firewall traversal, e.g. tunnelling or, creating pinholes
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/01—Protocols
  • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
  • H04L67/025—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP] for remote control or remote monitoring of applications
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/14—Session management
  • H04L67/143—Termination or inactivation of sessions, e.g. event-controlled end of session
  • H04L67/145—Termination or inactivation of sessions, e.g. event-controlled end of session avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
  • H04L41/34—Signalling channels for network management communication

Definitions

• the present invention relates to a monitoring system including a public network, a private network, and an access limiting device arranged to limit the access of the private network from the public network. Further the present invention relates to a method for accessing a monitoring device of such a monitoring system from the public network.
• Monitoring systems for monitoring of premises , areas of particular interest and processes by means of cameras connected directly to computer networks are increasingly popular .
• One reason for this may be that these systems in great extent may utilize an existing network, if a computer network already is in place .
• Another reason may ⁇ be that the network that has to be built for the monitoring system may be used to connect other types of equipment, e . g . computers, servers and peripherals .
• the users of the monitoring system or a central control centre responsible for the monitoring of the premises, areas of particular interest or processes are located remotely from the monitored site .
• a remote user or a remote control centre may be easily connected to the monitoring system via the Internet .
• IP-addresses are connected to the Internet via some device that limits the access to the network from the Internet .
• an access limiting device may be a firewall, a router implementing NAT (Network Address Translation) to provide additional IP addresses on the private network, a proxy server or an Internet Service Provider (ISP) providing dynamic IP-addresses .
• NAT Network Address Translation
• ISP Internet Service Provider
• one problem of such a monitoring system is that many functions, e . g . control of the monitoring device or devices, require transactions initiated by either the control centre or the remote user and that the monitoring device or devices are arranged in a private network behind an access limiting device . Accordingly, the control centre or the remote user either are unable to penetrate the protection installed or do not have knowledge of the address of the monitoring device or devices .
• a firewall may be modified to pass through communication originating from outside the private network. Such modifications may however be difficult, either because the firewall is not within the control of the user, because the user do not want to open the firewall, or because the user do not know how or do not want to go through the trouble of modifying the firewall .
• One obj ect of the present invention is to provide an improved computer network based monitoring system.
• the obj ect is achieved by means of a method for accessing at least one monitoring device of a monitoring system according to claim 1 and by means of a monitoring system according to claim 11.
• Embodiments of the invention are disclosed in the dependent claims .
• the obj ect is accomplished by means of a method for accessing at least one monitoring device of a monitoring system wherein the monitoring system comprises a public network, a private network, an access limiting device arranged to limit the access to the private network from the public network, a monitoring device connected to the private network, and a control server connected to the public network.
• the method comprises sending an http request from the monitoring device to the control server, sending, in response to said http request, an http response in which the content length is not defined or in which the content length is set to a number that is large enough to enable transport of a plurality of future control messages as part of an over time stretched http response, thereby achieving an open path from the server to the monitoring device through the access limiting device, and sending a plurality of control messages to the monitoring device from the control server via said open path .
• the obj ect is accomplished by means of a monitoring system comprising a public network, a private network, an access limiting device arranged to limit the access of the private network from the public network, and a control server connected to the public network.
• the monitoring system being characterized by a monitoring device connected to the private network and being arranged to send an http request to the control server, said control server being arranged to send a http response to the monitoring device in response to the http request, wherein the content length of the http response is not defined or wherein the content length is set to a number that is large enough to enable transport of a plurality of future control messages as part of an over time stretched http response resulting in an open path from the control server to the monitoring device through the access limiting device and wherein the control server is arranged to send control messages to the monitoring device via said open path .
• One advantage of providing an open path from the control server to the monitoring device by means of responding to an http (Hyper Text Transport Protocol) request with an http response as described above is that the http request is a type of message that almost always are allowed to be sent out through a firewall or any other access limiting device . Therefore, the creating of the open path by sending the http request from the monitoring device to the control server and responding from the control server with said http response results in a simple and effective way to create the open path through the access limiting device from the control server to the monitoring device . Accordingly, the setup of the monitoring system becomes simple because there is no need for tampering with access limiting devices in order to make control server initiated transactions possible .
• the setup of the monitoring device becomes simple and the security of the private network do need to be affected.
• the http request initiating the setup of the open path is sent from the monitoring device as soon as a network connection is detected. This makes it even more simple to setup the monitoring devices .
• the simplicity of setting up the monitoring device may be particularly interesting for small business or monitoring systems for homes .
• said http request is sent to a control server indicated as a first choice in a list of control servers stored in the monitoring device .
• This feature also contribute to simplifying the installation of the monitoring device . Further, this may facilitate load control of the system.
• the method further comprises the acts of : sending a control message from a first server, which is currently enabled to send control messages to the monitoring device via the open path, wherein the control message includes instructions to the monitor device to move the open path from the first control server to a second control server, terminating the connection that generated the open path and, thus , terminating the open path .
• control server to move the open path to are selected by the monitoring device from a list of control servers stored in the monitoring device .
• the selected control server is then set to be the control server of first choice and the setting is stored in the list in the monitoring device .
• FIG. 1 is a schematic diagram of one embodiment of a monitoring system according to the present invention
• Fig 2 is a timing diagram over one embodiment of the signaling between the monitoring device and the control server resulting in the open path
• Fig 3 is a timing diagram presenting a possible signaling scheme for checking the open path
• Fig 4 is a schematic diagram of one embodiment of a monitoring system according to the present invention.
• Fig 5 is a schematic block diagram of one embodiment of the monitoring device .
• the monitoring system includes a private network 2, e . g. a Local Area Network 2, e . g. a Local Area Network
• the private network 2 is connected to a public network 4 , e . g . the Internet, via an access limiting device 6, e . g . a firewall, a NAT (Network Address Translation) , a proxy server, an ISP (Internet Service Provider) providing dynamic addresses .
• the access limiting device 6 is limiting the access to the private network 2 from the public network 4 in different ways depending on the specific type of limiting device . For example, a firewall is generally arranged to prohibit access to devices in the private network from a public network.
• the system includes at least one monitoring device 10 , which is associated with a specific area or a process , connected to the private network 2 for providing monitoring information via the private network.
• the monitoring device 10 is arranged to be controlled by a user by means of a terminal 14 , 16 and the monitoring device may, for example, be a camera, a central unit of an alarm system, an IR-detector, a temperature sensor etc . , which is enabled to communicate over the private network 2.
• the terminal 14, 16 may be a computer 14, a workstation 14 , a computerized control centre, a mobile telephone 16, a PDA (Personal Digital Assistant) , etc . and is connected to the public network 4. Further, in order to enable the terminal 14 , 16 to control and access the monitoring device 10 through the access limiting device 6 at least one control server 20 is connected to the public network 4.
• the access to the devices on the private network 2 from devices on the public network 4 is barred by the access limiting device 6.
• the terminal 14, 16 of the user has to be able to initiate communication with the monitoring device 10. This should be enabled without affecting the available bandwidth on the network to any greater extent and, thus, this function should not involve unnecessary usage of bandwidth .
• a control connection from the server 20 to the monitoring device 10 through the access limiting device is set up by making the monitoring device 10 send an http request 52 to a control server 20 see Figs 1 and 2.
• the http request may be sent by the monitoring device 10 upon power up 50, upon detection of a network connection, upon pressing a button, upon keying a code, upon receipt of detection event indicating an alarm, etc .
• An event indicating an alarm may be a signal from an internally or externally, in relation to the monitoring device, arranged sensor or a state in a program triggering an alarm.
• the control server 20 then respond to this request by sending an "endless" http response 54 to the monitoring device 10.
• the length of the content of the endless http response 54 is not specified or may be specified as a large number in the http response and, thereby, the underlying TCP connection is not terminated by the control server .
• the response is not terminated until the amount of data corresponding to the large number has been sent .
• the control server utilizes the open path to control the monitoring device 10 by sending control messages 56 (control message 1-N) to the monitoring device, wherein N is an unlimited number .
• the control messages 56 may be initiated by the control server 20 by it self or by a user terminal 14 , 16.
• the control server 20 is able to send control messages 56 at any time, i . e . the server do not have to wait for any polling signal from the monitoring device and, thus , there is essentially no latency .
• a user requesting monitoring data from a monitoring device 10 using a user terminal 14 , 16 would essentially only experience the latency resulting from the transport of the request, the processing in the monitoring device and the transport back to the terminal . This also results in less traffic being transported in the network.
• the http response which is creating the open path, may also be described as an http response including a plurality of control messages 56 dispersed in time or as an http response in which the content length is set to a number that is large enough to enable transport of a plurality of future control messages as part of an over time stretched http response .
• This may be achieved by not defining the length of the content of the http response or by setting the length of the content of the http response to a large number . In the case of setting the length of the content to a large number, the large number is to be selected so large as a plurality of control messages 56 may be sent by means of the http response without termination of the http response and consequently the open path .
• such a large number may be 18 kilobytes, if the initial packet of the http response only is some bytes and if the subsequent control messages also are rather small . However, such a large number may also be two megabytes or greater if the control messages are of larger size . Additionally, the size of the length of the content also depends on the desired duration of the open path . In some applications the network load is not much affected if a new open path is set up once every hour, but in other applications it may be desirable to keep the open path open for a day or more in order not to noticeably affect the network load.
• the open path is the communication link into the private network 2 for control server 20 or terminal 14 , 16 initiated messaging, as depicted by the control message 56 1-N in Fig 2.
• the control messages 56 may be utilized to control the monitoring device from a terminal of the user, such instructions are relayed or translated and sent via the open path by the control server . Further, the control messages 56 may be utilized to check the status of the monitoring device 10, to test that the monitoring device is operating correctly, to control the status of the open path connection, to provide configuration data to the monitoring device, to request the monitoring device 10 to set up a new or other connection or to request the monitoring device to deliver data, e . g . monitoring data or other data of interest, to a specific destination .
• control server 20 is arranged to frequently initiate a check of the open path connection in order to determine if the connection has been broken or for any reason terminated .
• the check is initiated by the control server which sends a control message 56, including instructions and data associated with the check, via the open path .
• the monitoring device is programmed to expect frequent reception of such a control message .
• the server may be provided with a timer 106 triggering the sending of the control message 100 , including check data, see Fig 3.
• the period set for the timer 106 may be t s .
• the monitoring device may also be provided with a timer 108 that will be reset 104 each time the monitoring device receives the control message 100 including control data .
• a control message 100 including checking data At the same time as the control message 100 is sent the timer 106 is started.
• the timer 108 at the monitoring device is started.
• t s time units after the timer 106 of the control server was started the timer 106 triggers the sending of the next control message 101, including checking data, and the timer 106 of the control server is restarted .
• the control message 101, including checking data is received at the monitoring device the timer 108 at the monitoring device is reset and restarted, before it has timed out .
• the timer 106 triggers the sending of the next control message 102 , including checking data, and the timer 106 of the control server is restarted once more .
• the control message 102 does not reach the monitoring device for some reason and this leads to the timer 108 of the monitoring device timing out after t m time units .
• the timer 108 of the monitoring device has timed out the sending of a new http request 52 is triggered in order to try to re-establish the open path between the control server and the monitoring device . If the control server is down or the http request is not arriving at the control server the monitoring device may try to connect to another control server, e . g .
• an address to the control server 20 is stored in the monitoring device 10 and the address is used by the monitoring device 10 when sending the http request for setting up the open path for the control messages described in relation to Fig 2.
• the address may be an IP address ( Internet Protocol address ) or an URL (Uniform Resource Locator) .
• This embodiment may ⁇ be used independently of how many control servers there are available on the public network.
• a monitoring system including a plurality of control servers .
• the monitoring system is identical to the system presented in Fig 1 with the difference that it includes a first control server 20 , a second control server 22 and a third control server 24.
• the monitoring device 10 may be arranged to send the initiating message to one of the control servers 20, 22 , 24 in accordance with the description above or in accordance with any of the descriptions below .
• three control servers 20 , 22 , 24 may only include two control servers or the system may include four control servers . Depending on the circumstances it may be optimal to provide more than four control servers to the monitoring system.
• a change of the control server associated with the monitoring device includes sending of a control message from the present control server 20 , i . e . a first control server 20, to the monitoring device 10 including a request to terminate the connection to the first control server 20 and initiate a connection to an address provided in the control message, which may be the address of the second control server 22. Then the monitoring device 10 terminates the connection, including the open path, to the first control server and sends an http request to the address provided by the first control server . Then the second control server receives the http request and sets up the open path in accordance with the description of Fig 2.
• One advantage of providing a plurality of control servers and the method of changing control servers is that it makes it possible balance the load of different parts of the network.
• control servers may always be available even if some are not available .
• a control server may be unavailable because of overload, because it is out of order, because of interrupted network connection, etc .
• another advantage may be the use of specialized control servers . For instance, one subset of control servers may be specialized in handling video and one subset may be specialized for other purposes . In this way there is no need to pay for licenses relating to some specific functions , programs or hardware for all control servers .
• a plurality of control server 20 addresses are stored in a list in the monitoring device 10. The addresses in the list are prioritized, i . e .
• the number of addresses in the list are equal to or less than the number of control servers 20 on the public network associated with the monitoring system.
• the monitoring device is arranged to make the initial http request to the control server 20 that is the first choice according to the list in order to establish the open path from the control server 20, i . e . the first control server 20, to the monitoring device . If this attempt fails the monitoring device is arranged to make the initial http request to the control server 22 which is the second choice according to the list, i . e . the second control server . If there are more failures with the initial http request and if there are additional control servers in the list the procedure may continue until there is no further control servers or the open path has been established.
• the first control server may send a control message to the monitoring device requesting it to connect to the second control server 22 by requesting the monitoring device to change control server .
• the monitoring device then terminates the connection and sends the initial http request to the second choice in the list stored in the monitoring device 10.
• the prioritized list may be amended .
• the second control server 22 may, for example, be entered as the control server of first choice and accordingly the first control server is entered as a control server of lower priority .
• the amended list is then stored in the monitoring device 10. The advantage of such an amendment of the prioritized list is that if the monitoring device is powered down or disconnected from the network and then powered up or reconnected to the network the setup sequence of the open path does not have to be performed towards a control server that possibly still is experiencing a high load but to the same control server from which the latest open path was established successfully.
• a redirecting message including instructions ordering the monitoring device to connect to another control server, may be provided in a control message or in the http response initiating the open path .
• the monitoring device is a network enabled camera .
• the load balancing becomes even more important because of the large amount of monitoring data, i . e . a video sequence, images , streaming video, etc . , it may send to the control server upon request and, thus , introducing large loads to the portion of the public network where the control server is connected or to the control server itself .
• a monitoring device which may be a camera, may comprise the following features, in addition to the features required to perform the specific task of the monitoring device : a control server communication program 202 , a web-server 204 , URL addressable storage means 205, and a network interface 211, see Fig 5.
• the web-server 204 and the control server communication program 202 may be implemented as software functions processed by a processor of the monitoring device, but may also be implemented by means of hardware .
• the control server communication program 202 is arranged to send the initial http request for setting up the open path and to translate instructions received via said open path to http messages for sending to the web-server 204.
• the monitoring device and, thus , the control server communication program 202 and the web-server 204 are connected to the private network 212 , via the network interface 211.
• the web-server 204 handles the http requests by either loading or storing data in the URL addressable storage means 205 :
• the URL addressable storage means may include a URL for first monitoring data 206, which may be one type of data generated by the monitoring device 10 , a URL for second monitoring data 208 , which may be another type of data generated by the monitoring device 10 , and an URL for configuration data 210.
• Monitoring data may, for example, be video images or sequences .
• the monitoring device additionally may include a media server implementing RTSP (Real Time Streaming Protocol ) or the web-server 204 may be replaced by such a media server .
• RTSP Real Time Streaming Protocol
• An embodiment of a method to request monitoring information from a monitoring device 10 by means of a terminal 14 , 16 by referring to Fig 1 will now be described .
• the method may be used in systems comprising a plurality of control servers 20, a plurality of monitoring devices and a plurality of terminals as well as in a system as depicted in Fig 1.
• the open path between the control server 20 and the monitoring device 10 has been set up in accordance with the description of Fig 2.
• the user of the terminal 16 decides that he wants monitoring data from a specific monitoring device .
• the terminal 16 sends an http get to the control server 20 specifying the wanted data .
• the control server 20 receives the http get, assigns the connection established by the http get from the terminal a session identity, and translates the http get to a control message for sending via an open path to the specified monitoring device .
• the control message includes a command specifying the action to be taken, in this example the action is to retrieve data, a URL identifying the data to retrieve and a destination URL, specifying an address at a control server 20 to which the data are to be returned and specifying the session identity .
• the control message is sent to the monitoring device and the monitoring device performs the specified action by retrieving the monitoring data identified by the URL identifying the data to retrieve .
• the monitoring device then generates an http post directed to the destination URL included in the control message, thereby sending the data to the control server 20.
• the control server receives the http post including the monitoring data .
• the control server 20 uses the session identity of the URL in the http post from the monitoring device 10 to generate a response to the http get from the terminal 16 including the requested data .
• the monitoring device may include a program that interprets the control message sent from the control server in the example above .
• a program may be arranged to identify the action to perform, in the above case to retrieve data, and then translate the URL identifying the data to retrieve to a location within the monitoring device from which the requested data is retrievable . Then the requested monitoring data is included in a http post message sent to the destination URL, as described in the above example .
• the monitoring device may be a monitoring device that is designed as the one described in Fig 5.
• the monitoring device receives the data of the control message, at the control server communication program 202 , and translates the data to an http get to the URL identifying the data to retrieve .
• the http get is then sent to the embedded web-server 204.
• the web-server 204 then handles the http get in a way known to the person skilled in the art and returns the requested monitoring data to the control server communication program 202 which generates and sends a http post, including the monitoring data, to the destination URL .
• the monitoring device 10 is provided with an electronic serial number identifying the device .
• the serial number may be stored in the monitoring device 10 during manufacturing and may be used to identify the monitoring device 10 during the setup of the connection resulting in the open path .
• the monitoring device may be provided with a unique key for encrypting messages to be sent or for decrypting received messages .
• This key may also be utilized to authenticate the camera during the setup of the connection resulting in the open path .
• the control server is also provided with a key in order to be able to decrypt messages from the monitoring device, to encrypt messages sent to the monitoring device and to authenticate the monitoring device 10. Thereby all communication between the monitoring device and the control server may be encrypted .
• a unique key for each monitoring device produced and the key may be stored in the monitoring device during manufacturing of the device .
• the keys may be keys of a shared secret system or a public key system.
• a very large list of different keys are generated before the manufacturing of the cameras which are to be provided with these keys .
• the list should be of such a size that no new list has to be generated for years .
• Each control server is provided with the list of keys and during the manufacturing of a monitoring device the device will be provided with one of the keys .

Landscapes

• Engineering & Computer Science (AREA)
• Signal Processing (AREA)
• Computer Networks & Wireless Communication (AREA)
• Computer Security & Cryptography (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Computer Hardware Design (AREA)
• Multimedia (AREA)
• Health & Medical Sciences (AREA)
• Cardiology (AREA)
• General Health & Medical Sciences (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Computer And Data Communications (AREA)
• Telephonic Communication Services (AREA)

Priority Applications (2)

Applications Claiming Priority (2)

Publications (1)

Family

ID=36647768

Family Applications (1)

Country Status (6)

Cited By (7)

Families Citing this family (6)

Citations (5)

• 2005
  • 2005-01-10 SE SE0500071A patent/SE530217C2/sv not_active IP Right Cessation
  • 2005-12-22 KR KR1020077015774A patent/KR20070093417A/ko not_active Application Discontinuation
  • 2005-12-22 CN CNA2005800462902A patent/CN101103608A/zh active Pending
  • 2005-12-22 JP JP2007550325A patent/JP2008527842A/ja not_active Abandoned
  • 2005-12-22 WO PCT/SE2005/002026 patent/WO2006073348A1/en active Application Filing
  • 2005-12-22 EP EP05819824A patent/EP1836826A1/en not_active Withdrawn

Patent Citations (5)

Also Published As

Similar Documents

Legal Events