Remote Service Access (RSA) is a secure tunneling solution that enables authorized users to temporarily access services on IoT gateways deployed in the field. Unlike traditional VPN solutions that require permanent network infrastructure, RSA provides on-demand, time-limited access through automatically expiring access codes.

Typical Use Cases

Field Service Technicians

  • Access gateway diagnostics during on-site visits
  • Troubleshoot issues remotely without traveling
  • Configure gateway settings temporarily

Support Engineers

  • Investigate reported gateway issues
  • Access logs and system status
  • Perform remote maintenance

External Partners

  • Provide temporary access for collaboration
  • Enable third-party integration work
  • Support limited-time consulting engagements

Core Concepts

Access Codes

An access code is a unique, time-limited credential that grants access to a specific service on a gateway.

Key Properties:

  • Unique Identifier: Each code is system-wide unique
  • Time-Limited: Configurable expiration
  • Service-Specific: Tied to a specific device/service on a gateway
  • Single Gateway: Each code grants access to one gateway only

Tunnel Connection

A tunnel is a secure WebSocket-based connection that forwards traffic from the user's local machine to a service on the gateway.

How It Works:

  1. User runs pre-configured client application
  2. Client opens a local proxy port (e.g., localhost:8080)
  3. Client establishes WebSocket connection to Remote Manager
  4. Remote Manager validates access code and routes traffic to gateway
  5. User applications connect to localhost port as if gateway were local

Example:

User Browser → localhost:8443 → WebSocket Tunnel → Gateway HTTPS Service


Validity Period

The validity period determines how long an access code remains active.

Validity Options & Scenarios:

  • Field Visit: 2-4 hours for on-site troubleshooting
  • Remote Support: 30 minutes to 2 hours for diagnosis
  • Maintenance Window: 8-24 hours for planned work
  • Emergency Access: 15-30 minutes for critical issues
  • Unlimited: Code never expires (requires special permissions)

Device Metadata

Device metadata describes the service being accessed through the tunnel.

Components:

  • Scheme: Protocol type (HTTP, HTTPS, SSH, etc.)
  • Host: Gateway host-name or IP address
  • Port: Service port on gateway
  • Label: User-friendly connection name
  • Local Port: Port number on user's machine

Example Metadata:
```
Scheme: https
Host: localhost
Port: 8443
Label: "Gateway Web Console"
Local Port: 9443
```

User accesses: `https://localhost:9443` → Tunneled to gateway's port 8443