Managing peer-to-peer access to a device behind a firewall

• US 20030084162A1
• Filed: 10/31/2001
• Published: 05/01/2003
• Est. Priority Date: 10/31/2001
• Status: Abandoned Application

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Anderson, Bradley J., Johnson, Bruce L.
• Application Number:
  US09/999,707
• Publication Number:
  US 20030084162A1
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2553 Binding renewal aspects, e.g. using keep-alive messages
• CPC Class Codes: H04L 61/2567 for reachability, e.g. inquiring the address of a correspondent behind a NAT server
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04L 69/164 Adaptation or special uses of UDP protocol
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The described arrangements and procedures provide for peer-to-peer communications with a device that is protected by a firewall. To accomplish this, a receiving device receives a communication from the firewall protected device. The communication includes device access information necessary to communicate with the firewall protected device. The receiving device determines whether the device access information identifies a valid communication pathway to the firewall protected device. The receiving device receives a request from a different device for the information needed to communicate with the firewall protected device. Responsive to receiving the request and responsive to determining that the communication pathway to the device is valid, the device access information is communicated to the different device. The different device can use the communicated device access information to initiate a peer-to-peer communication session with the firewall protected device.

Claims

1. A method comprising:

receiving a communication from a device that is behind a firewall, the communication comprising a set of device access information to communicate with the device;

determining whether or not the device access information identifies a valid communication pathway to the device;

receiving, from a different device, a request for the device access information; and

responsive to receiving the request and responsive to determining that the communication pathway to the device is valid, communicating at least one subset of the device access information to the different device such that the different device can initiate a peer-to-peer communication session with the device.

2. A method as recited in claim 1, wherein the different device is not behind a firewall.

3. A method as recited in claim 1, wherein the firewall is a first firewall, and wherein the different device is behind a second firewall that is not the first firewall.

4. A method as recited in claim 1, wherein the different device is an authorized device.

5. A method as recited in claim 1, wherein the device access information comprises a public network address, a public port number, a private network address, a private port number, and a substantially unique device name.

6. A method as recited in claim 1, wherein determining whether or not the device access information identifies a communication pathway to the device is valid further comprises determining at predetermined periodic time intervals whether or not the device access information identifies a communication pathway to the device that is valid.

7. A method as recited in claim 1, wherein the method further comprises:

responsive to receiving the communication, generating a table to identify the device access information; and

wherein communicating the device access information to the different device further comprises communicating the table or a reference to the table to the different device.

8. A method as recited in claim 1, wherein receiving the communication from the device, the communication is received at predetermined periodic time intervals, and wherein determining whether or not the device access information identifies a valid communication pathway to the device further comprises:

responsive to determining that the communication from the device was received before expiration of the predetermined periodic time interval since a last communication from the device was received, indicating that the device access information identifies a valid communication pathway; and

responsive to determining that the communication from the device was not received before expiration of the predetermined periodic time interval since a last communication from the device was received, indicating that the device access information does not identify a valid communication pathway.

9. A method as recited in claim 1, wherein determining whether or not the device access information identifies a valid communication pathway to the device further comprises:

forwarding a request message to the device, the request message requiring a response from the device;

receiving the response from the device; and

responsive to the receiving, validating the communication pathway.

10. A method as recited in claim 1, wherein determining whether or not the device access information identifies a valid communication pathway to the device further comprises:

forwarding a request message to the device, the request message requiring a response from the device;

determining that the response will not be forwarded from the device; and

responsive to the determining that the response will not be forwarded, invalidating the communication pathway.

11. A method as recited in claim 1:

wherein the device access information comprises a private network address and public information comprising a public network address and a public port; and

wherein communicating the device access information to the different device further comprises;

assigning a unique ID to the device, the unique ID being independent of the private address and the public information; and

communicating the public information and the unique ID to the different device.

12. An address server comprising:

a memory comprising a plurality of computer program modules and data, the computer program modules comprising computer-executable instructions; and

a processor operatively coupled to the memory, the processor being configured to fetch and execute the computer-executable instructions, the computer-executable instructions comprising instructions for;

receiving a communication from a device that is behind a firewall, the communication comprising a set of information to communicate with the device;

determining whether or not the information identifies a valid communication pathway to the device;

receiving, from a different device, a request for the information; and

responsive to receiving the request, if the information identifies a valid communication pathway, communicating the information to the different device such that the different device can establish peer-to-peer communication to the device.

13. An address server as recited in claim 12, wherein the different device is an authorized device.

14. An address server as recited in claim 12, wherein the information comprises a public network address, a public port number, a private network address, a private port number, and a substantially unique device name.

15. An address server as recited in claim 12, wherein the computer-executable instructions for determining whether or not the information identifies a valid communication pathway to the device further comprise instructions for determining at predetermined periodic time intervals whether or not the information identifies a valid communication pathway to the device.

16. An address server as recited in claim 12, further comprising computer-executable instructions for:

responsive to receiving the communication, generating a table to identify the information; and

wherein the instructions for communicating the information to the different device further comprise instructions for communicating the table or a reference to the table to the different device.

17. An address server as recited in claim 12:

wherein the communication is received at predetermined periodic time intervals; and

wherein the instructions for determining whether or not the information identifies a valid communication pathway further comprise instructions for;

responsive to determining that the communication from the device was received before expiration of the predetermined periodic time interval since a last communication from the device was received, indicating that the information identifies a valid communication pathway; and

responsive to determining that the communication from the device was not received before expiration of the predetermined periodic time interval since a last communication from the device was received, indicating that the information does not identify a valid communication pathway.

18. An address server as recited in claim 12, wherein the computer-executable instructions for determining whether or not the information identifies a valid communication pathway to the device further comprise instructions for:

forwarding a request message to the device, the request message requiring a response from the device; and

receiving the response from the device; and

responsive to receiving the response, validating the communication pathway.

19. An address server as recited in claim 12, wherein the computer-executable instructions for determining whether or not the information identifies a valid communication pathway to the device further comprise instructions for:

forwarding a request message to the device, the request message requiring a response from the device; and

determining that the response will not be forwarded from the device; and

responsive to the determining, invalidating the communication pathway.

20. An address server as recited in claim 12, wherein the information comprises a private network address and public information, the public information comprising a public network address and a public port, and wherein the instructions for communicating the information to the different device further comprise instructions for:

assigning a unique ID to the device, the unique ID being independent of the private address and the public information; and

communicating the public information and the unique ID to the different device.

21. A system comprising:

a first device that is behind a firewall in a private network, the first device being operatively coupled to an address server and a second device that is not in the private network, the first device being configured to periodically communicate a datagram message to the address server, the datagram message comprising device access information to communicate with the device,

the address server being configured to store the device access information into a mapping table in response to receiving the datagram message, the address server being further configured to communicate at least one subset of the mapping table to a second device in response to receiving a request from the second device, the at least one subset of the mapping table enabling the second device to initiate a peer-to-peer communication session with the first device.

22. A system as recited in claim 21, wherein the different device is an authorized device.

23. A system as recited in claim 21, wherein the device access information comprises a public network address, a public port number, a private network address, a private port number, and a substantially unique device name.

24. A system as recited in claim 21, wherein the address server is further configured to determine, at predetermined periodic time intervals, whether or not the device access information that is stored in the device access-mapping table identifies a valid communication pathway to a particular device.

25. A system as recited in claim 21, wherein the address server is further configured to determine whether or not a particular device'"'"'s information that is stored in the device access-mapping table identifies a valid communication pathway to the particular device by:

forwarding a request message to the particular device, the request message requiring a response from the particular device;

receiving the response from the particular device; and

responsive to receiving the response, validating the communication pathway.

26. A system as recited in claim 21, wherein the address server is further configured to determine whether or not a particular device'"'"'s information that is stored in the device access-mapping table identifies a valid communication pathway to the particular device by:

forwarding a request message to the particular device, the request message requiring a response from the particular device;

determining that the response will not be forwarded from the particular device; and

responsive to determining that the response will not be forwarded, invalidating the particular device'"'"'s information in the device access-mapping table.

27. Computer readable media comprising computer executable instructions for:

receiving a communication from a protected device that is behind a firewall, the communication comprising information to communicate with the protected device;

determining whether or not the information identifies a valid communication pathway to the protected device;

receiving, from a different device that is not behind the firewall, a request for information; and

responsive to receiving the request, if the information identifies a valid communication pathway, communicating the information to the different device such that the different device can establish peer-to-peer communication to the protected device.

28. Computer-readable media as recited in claim 27, wherein the different device is an authorized device.

29. Computer-readable media as recited in claim 27, wherein the information comprises a public network address, a public port number, a private network address, a private port number, and a substantially unique device name.

30. Computer-readable media as recited in claim 27, wherein the computer-executable instructions for determining whether or not the information identifies a valid communication pathway to the protected device further comprises instructions for determining at predetermined periodic time intervals whether or not the information identifies a valid communication pathway to the protected device.

31. Computer-readable media as recited in claim 27, further comprising the computer-executable instructions for:

responsive to receiving the communication, generating a table to identify the information; and

wherein communicating the information to the different device further comprises communicating the table or a reference to the table to the different device.

32. Computer-readable media as recited in claim 27, wherein the communication is received at predetermined periodic time intervals, and wherein the instructions for determining whether or not the information identifies a valid communication pathway to the protected device further comprise instructions for:

responsive to determining that the communication from the protected device was received before expiration of the predetermined periodic time interval since a last communication from the protected device was received, indicating that the information identifies a valid communication pathway; and

responsive to determining that the communication from the protected device was not received before expiration of the predetermined periodic time interval since a last communication from the protected device was received, indicating that the information does not identify a valid communication pathway.

33. Computer-readable media as recited in claim 27, wherein the computer-executable instructions for determining whether or not the information identifies a valid communication pathway to the protected device further comprise instructions for:

forwarding a request message to the protected device, the request message requiring a response from the protected device;

receiving the response from the protected device; and

responsive to receiving the response, validating the communication pathway.

34. An Computer-readable media as recited in claim 27, wherein the computer-executable instructions for determining whether or not the information identifies a valid communication pathway to the protected device further comprise instructions for:

forwarding a request message to the protected device, the request message requiring a response from the protected device;

determining that the response will not be forwarded from the protected device; and

responsive to determining that the response will not be forwarded, invalidating the communication pathway.

35. Computer-readable media as recited in claim 27, wherein the information comprises a private network address and a set of public information, the public information comprising a public network address and a public port, and wherein the instructions for communicating the information to the different device further comprise instructions for:

assigning a unique ID to the protected device, the unique ID being independent of the private address and the public information; and

communicating the public information and the unique ID to the different device.