Private cloud connected device cluster architecture

1. A system for secure cloud-based management of private cloud connected devices, the system comprising:

one or more on-site cloud connected devices located within an untrusted customer site;

a multi-tenant cloud-based management service configured to manage the one or more on-site cloud connected devices; and

a user interface to facilitate access to the one or more on-site cloud connected devices located within the untrusted customer site by a user associated with the untrusted customer site;

wherein the user interface and the one or more on-site cloud connected devices are located within an untrusted domain, the multi-tenant cloud-based management service is located within a trusted domain, and the trusted domain and the untrusted domain are separated by a firewall; and

wherein the multi-tenant cloud-based management service is further configured to:

perform a discovery loop operation for identifying and registering the one or more on-site cloud connected devices, wherein the discovery loop operation includes receiving a handshake message from the one or more on-site cloud connected devices, generating a post handshake message including data associated with the one or more on-site cloud connected devices, and storing the post handshake message in a database of the multi-tenant cloud-based management service;

receive a service identifying data from the user interface;

in response to the service identifying data, provide a web application to the user interface, so that the user interface is associated with a public address;

compare the public address of the user interface to an address of the cloud connected device to correlate the service identifying data to the one or more on-site cloud connected devices;

search for one or more candidate unbound on-site cloud connected devices by filtering all the one or more on-site cloud connected devices, in which the filtering includes using at least some of the data from the handshake message used in the discovery loop;

cause displaying, on the user interface, the one or more candidate unbound on-site cloud connected devices;

receive, from the user interface, a user selection of an unbound on-site cloud connected device from the one or more candidate unbound on-site cloud connected devices;

generate and send a machine-generated message to the unbound on-site cloud connected device, so that the unbound on-site cloud connected device causes the machine-generated message to be displayed on the user interface;

receive a user input from the user interface;

authenticate the user by comparing the user input to the machine-generated message; and

based on the authentication, operatively bind the unbound on-site cloud connected device to the multi-tenant cloud-based management service.

2. The system of claim 1 , wherein the multi-tenant cloud-based management service includes:

a website domain configured to manage the user interface; and

a backend domain configured to manage the one or more on-site cloud connected devices.

3. The system of claim 2 , wherein the website domain includes a controller configured to coordinate requests associated with the user interface.

4. The system of claim 2 , wherein the user interface and one or more on-site cloud connected devices use security protocols to communicate to the trusted domain.

5. The system of claim 2 , wherein the backend domain includes:

a backbone configured to manage data transmission associated with the one or more on-site cloud connected devices utilizing a first data transmission protocol;

a rendezvous module configured to manage data transmission between the website domain and the backbone utilizing a second data transmission protocol;

a supervisor configured to associate one or more on-site cloud connected devices of the user with the on-site cloud connected devices based on predetermined rules; and

a proxy configured to be associated with the one or more on-site cloud connected devices.

6. The system of claim 5 , wherein the rendezvous module includes a mailbox configured to store identification of the one or more on-site cloud connected devices.

7. The system of claim 5 , wherein the backbone includes a mailbox configured to store identification of the one or more on-site cloud connected devices.

8. The system of claim 5 , wherein the first data transmission protocol includes Hypertext Transfer Protocol Secure (HTTPS), and the second data transmission protocol includes JavaScript Object Notation Remote Procedure Call (JSON-RPC).

9. The system of claim 5 , wherein the proxy runs on a separate machine to provide scalability.

10. The system of claim 1 , wherein the user interface includes a single-page application running within a web browser.

11. The system of claim 1 , wherein the one or more on-site cloud connected devices and the user interface are located on a Local-Area Network (LAN).

12. A method for secure cloud-based management of private cloud connected devices, the method comprising:

providing a multi-tenant cloud-based management service configured to manage one or more on-site cloud connected devices located within an untrusted customer site; and

providing a user interface to facilitate access to the one or more on-site cloud connected devices located within the untrusted customer site by a user associated with the untrusted customer site;

wherein the user interface and the one or more on-site cloud connected devices are located within an untrusted domain, the multi-tenant cloud-based management service is located within a trusted domain, and the trusted domain and the untrusted domain are separated by a firewall; and

wherein the multi-tenant cloud-based management service is further configured to:

perform a discovery loop operation for identifying and registering the one or more on-site cloud connected devices, wherein the discovery loop operation includes receiving a handshake message from the one or more on-site cloud connected devices; generating a post handshake message including data associated with the one or more on-site cloud connected devices, and storing the post handshake message in a database of the multi-tenant cloud-based management service;

receive a service identifying data from the user interface;

in response to the service identifying data, provide a web application to the user interface, so that the user interface is associated with a public address;

compare the public address of the user interface to an address of the cloud connected device to correlate the service identifying data to the one or more on-site cloud connected devices;

search for one or more candidate unbound on-site cloud connected devices by filtering all the one or more on-site cloud connected devices, in which the filtering includes using at least some of the data from the handshake message used in the discovery loop;

cause displaying, on the user interface, the one or more candidate unbound on-site cloud connected devices;

receive, from the user interface, a user selection of an unbound on-site cloud connected device from the one or more candidate unbound on-site cloud connected devices;

generate and send a machine-generated message to the unbound on-site cloud connected device, so that the unbound on-site cloud connected device causes the machine-generated message to be displayed on the user interface;

receive a user input from the user interface;

authenticate the user by comparing the user input to the machine-generated message; and

based on the authentication, operatively bind the unbound on-site cloud connected device to the multi-tenant cloud-based management service.

13. The method of claim 12 , wherein the providing of the multi-tenant cloud-based management service includes:

providing a website domain configured to manage the user interface; and

providing a backend domain configured to manage the one or more on-site cloud connected devices.

14. The method of claim 13 , wherein the providing of the backend domain includes:

providing a backbone configured to manage data transmission associated with the one or more on-site cloud connected devices utilizing a first data transmission protocol, wherein the first data transmission protocol includes Hypertext Transfer Protocol Secure (HTTPS);

providing a rendezvous module configured to manage data transmission between the website domain and the backbone utilizing a second data transmission protocol, the second data transmission protocol includes JavaScript Object Notation Remote Procedure Call (JSON-RPC);

providing a supervisor configured to associate one or more on-site cloud connected devices of the user with the one or more on-site cloud connected devices based on predetermined rules; and

providing a proxy configured to be associated with the one or more on-site cloud connected devices.

15. The method of claim 14 , wherein the providing of the rendezvous module includes providing a mailbox configured to store identification of the one or more on-site cloud connected devices, and wherein the providing of the backbone includes providing a mailbox configured to store identification of the one or more on-site cloud connected devices.

16. The method of claim 14 , wherein the proxy runs on a separate machine to provide scalability.

17. The method of claim 14 , wherein the user interface and the one or more on-site cloud connected devices are located on a Local-Area Network (LAN).

18. The method of claim 14 , wherein the user interface and the one or more on-site cloud connected devices use security protocols to communicate to the trusted domain.

19. A non-transitory processor-readable medium having instructions stored thereon, which when executed by one or more processors, cause the one or more processors to perform the following operations:

provide a multi-tenant cloud-based management service configured to manage a user interface; and

provide a backend domain configured to manage one or more on-site cloud connected devices,

wherein the multi-tenant cloud-based management service is further configured to:

perform a discovery loop operation for identifying and registering the one or more on-site cloud connected devices, wherein the discovery loop operation includes receiving a handshake message from the one or more on-site cloud connected devices; generating a post handshake message including data associated with the one or more on-site cloud connected devices, and storing the post handshake message in a database of the multi-tenant cloud-based management service;

receive a service identifying data from the user interface;

in response to the service identifying data, provide a web application to the user interface, wherein the user interface is associated with a public address;

compare the public address of the user interface to an address of the cloud connected device to correlate the service identifying data to the one or more on-site cloud connected devices;

search for one or more candidate unbound on-site cloud connected devices by filtering all the one or more on-site cloud connected devices, in which the filtering includes using at least some of the data from the handshake message used in the discovery loop;

cause displaying, on the user interface, the one or more candidate unbound on-site cloud connected devices;

receive, from the user interface, a user selection of an unbound on-site cloud connected device from the one or more candidate unbound on-site cloud connected devices;

generate and send a machine-generated message to the unbound on-site cloud connected device, wherein the unbound on-site cloud connected device causes the machine-generated message to be displayed on the user interface;

receive a user input from the user interface;

authenticate the user by comparing the user input to the machine-generated message; and

based on the authentication, operatively bind the unbound on-site cloud connected device to the multi-tenant cloud-based management service;

wherein the providing of the multi-tenant cloud-based management service includes:

provide a website domain configured to manage the user interface, wherein the providing of the backend domain includes:

provide a backbone configured to manage data transmission associated with the one or more on-site cloud connected devices utilizing a first data transmission protocol, wherein the first data transmission protocol includes Hypertext Transfer Protocol Secure (HTTPS);

provide a rendezvous module configured to manage data transmission between the website domain and the backbone utilizing a second data transmission protocol, the second data transmission protocol includes JavaScript Object Notation Remote Procedure Call (JSON-RPC);

provide a supervisor configured to associate one or more unbound on-site cloud connected devices of the user with the one or more on-site cloud connected devices based on predetermined rules;

provide a proxy configured to be associated with the one or more on-site cloud connected devices; and

provide a mailbox for storing identification of the one or more on-site cloud connected devices and identification of the one or more unbound on-site cloud connected devices, wherein the mailbox is configured to provide the one or more candidate unbound on-site cloud connected devices to the multi-tenant cloud-based management service.