The following figures illustrate the communication between the UMS Console, the VNC viewer, the UMS Server, and the device.

Internal VNC Viewer - Direct Connection

The UMS Console requests the device's certificate and the session password from the UMS Server. The UMS Console then establishes an SSL tunnel with the device using the session password. The device sends the certificate to the UMS Console; the UMS Console checks the certificate against the certificate it has received from the UMS Server. In return, the UMS Console sends the session password to the device. After that, the SSL tunnel between the UMS Console and device is established and can be used for exchanging VNC data. 

Internal VNC Viewer - Over ICG

Both the UMS Server and the device have established a websocket connection to the ICG; this websocket is used for commands from the UMS and messages from the device. 

The UMS Console and the device establish a dedicated websocket for secure shadowing with the ICG. 

External VNC Viewer - Direct Connection

The external VNC viewer runs on the same machine as the UMS Console. The UMS Console starts the external viewer and then acts as a proxy between the device and the external VNC viewer.

External VNC Viewer - Over ICG

The external VNC viewer runs on the same machine as the UMS Console. The UMS Console starts the external viewer and then acts as a proxy between the ICG and the external VNC viewer.