Method and apparatus for connecting packet telephony calls between secure and non-secure networks

• US 20030169859A1
• Filed: 03/08/2002
• Published: 09/11/2003
• Est. Priority Date: 03/08/2002
• Status: Active Grant

• Current Assignee: Tahoe Research Limited (f/k/a Learndale Limited) (Vector Capital Corporation)
• Original Assignee: Intel Corporation
• Inventors: Strathmeyer, Carl R., Illikkal, Rameshkumar G., Finnie, Donald K., Phomsopha, Bounthavivone K., Mercer, Hugh P.
• Granted Patent: US 7,668,306 B2
• Time in Patent Office: Days
• US Class Current: 379/88.17
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 61/50 Address allocation
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 65/1083 In-session procedures
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1106 Call signalling protocols; H.323 and related
• CPC Class Codes: H04L 65/65 Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion
• CPC Class Codes: H04L 69/085 specially adapted for interworking of IP-based networks with other networks
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention

Abstract

Described herein is a method and apparatus for connecting packet telephony calls between secure networks and non-secure networks.

Claims

1. A method, comprising:

receiving a first telephony stream representing and/or carrying information from a first network;

isolating the first telephony stream from a second network; and

sending a second telephony stream representing and/or carrying a replica of the information to the second network.

2. The method of claim 1, wherein at least one of the first network and the second network uses Internet protocol (IP) and the isolating includes isolating the first telephony stream from a physical network interface, a network protocol stack, and/or a telephony protocol stack of the second network.

3. The method of claim 1, further comprising transferring the information from the first telephony stream to the second telephony steam using a controller that insulates the first network and the first telephony stream from the second network and the second telephony stream.

4. The method of claim 3, wherein the first telephony stream has a different format and/or protocol than the second telephony stream.

5. The method of claim 1, wherein the first client is one of a trusted client and an untrusted client on a first network and the second client is a trusted client on a second network.

6. A method, comprising:

receiving a first telephony stream having information content from a first client on a first network;

terminating the first telephony stream at a boundary between the first network and a second network; and

establishing a second telephony stream having the information content for a second client on the second network.

7. The method of claim 6, further comprising:

receiving the first telephony stream formatted according to a first protocol; and

establishing the second telephony stream formatted according to a second protocol.

8. The method of claim 6, further comprising insulating the first telephony stream, the first client, and the first network from the second telephony stream, the second client, and the second network.

9. The method of claim 8, wherein at least one of the first and second telephony streams are IP telephony communications.

10. The method of claim 9, wherein the insulating includes isolating a first physical network interface, a first packet network protocol stack, and/or a first packet telephony protocol stack of the first network from a second physical network interface, a second packet network protocol stack, and/or a second packet telephony protocol stack of the second network.

11. The method of claim 10, further comprising transferring the information content from the first telephony communication to the second telephony communication using a controller connected to the first packet telephony protocol stack and the second packet telephony protocol stack, wherein the controller maintains the insulation between the first packet telephony protocol stack and the second packet telephony protocol stack.

12. A method, comprising:

receiving a first telephony stream, having information content, formatted according to a first protocol used by a first network;

terminating the first telephony stream at a boundary between the first network and a second network;

dynamically selecting a second protocol to match a protocol used by the second network; and

establishing for the second network a second telephony stream having the information content, wherein the second stream is formatted according to the second protocol.

13. The method of claim 12, further comprising:

sensing the first protocol used by the first network and dynamically selecting a reception protocol for receiving the first telephony stream;

sensing the second protocol used by the second network and dynamically selecting a transmission protocol for sending the second telephony stream; and

transferring the information content from the first telephony stream to the second telephony stream while insulating the first network from the second network.

14. The method of claim 13, further comprising using a controller attached to the first network and the second network to sense protocols, dynamically select protocols, insulate the networks, and/or transfer the content.

15. A method, comprising:

receiving a private address from a trusted client on a first network;

assigning a public address to the private address;

receiving a non-secure first telephony stream, having information content, for delivery to the public address;

terminating the non-secure first telephony stream at a boundary between the first network and a second network; and

sending a secure second telephony stream, having the information content, for delivery to the private address.

16. The method of claim 15, further comprising:

registering a plurality of private addresses from trusted clients on a private network;

assigning public addresses to the private addresses;

publicizing the public addresses on at least one public network;

receiving from a public network a first telephony stream, having the information content, for delivery to a public address corresponding to one of the private addresses;

terminating the first telephony stream at a boundary between the first network and the public network;

initiating a second telephony stream having the information content; and

delivering the second telephony stream to the private address.

17. The method of claim 16, further comprising sensing protocols used on the private network and the public network and dynamically selecting a receiving protocol for the public network and a transmitting protocol for the private network.

18. An apparatus, comprising:

a controller to transfer information content between a first telephony stream from a first network and a second telephony steam from a second network and to insulate the first network and the first telephony stream from the second network and the second telephony stream;

a stream transformer included in the controller to send and receive the first telephony stream on one side of a boundary between the first and second networks and to send and receive the second telephony stream on the other side of the boundary;

a protocol translator included in the controller to translate a first protocol used on one side of the boundary into a second protocol used on the other side of the boundary;

an address translator (AT) included in the controller to translate a first address used on one side of the boundary into a second address used on the other side of the boundary; and

a first interface coupled to the controller for interfacing with the first network; and

a second interface coupled to the controller for interfacing with the second network.

19. The apparatus of claim 18, wherein at least one of the first and second networks are Internet protocol (IP) networks.

20. The apparatus of claim 19, the stream transformer further comprising:

a first transceiver to communicate with the first network and a second transceiver to communicate with the second network;

a first terminator and a first initiator included in the first transceiver to terminate and initiate telephony streams for the first network;

a second terminator and a second initiator included in the second transceiver to terminate and initiate telephony streams with the second network;

an information content transferor coupled to the first transceiver and the second transceiver to transfer information content between a telephony stream of the first network and a telephony stream for the second network while insulating the first network from the second network; and

a connection permissioner coupled to the content transferor to enable a terminator in one transceiver to transfer contents of a telephony stream to an initiator in the other transceiver.

21. The apparatus of claim 19, the protocol translator further comprising:

a protocol sensor coupled to the first terminator and the second terminator to sense a first protocol used by the first network and a second protocol used by the second network; and

a dynamic protocol selector to implement use of the first protocol by the first initiator and to implement use of the second protocol by the second initiator.

22. The apparatus of claim 19, the AT further comprising:

a private address register coupled to at least one transceiver and to a call permissioner of a stream transformer;

a public address register coupled to at least one transceiver and to the call permissioner of the stream transformer; and

an address translator coupled to the private address register and to the public address register.

23. The apparatus of claim 19, wherein the first network and the second network are any combination of secured and non-secured networks.

24. The apparatus of claim 19, wherein the first network and the second network are any combination of private and public networks.

25. The apparatus of claim 19, wherein the first network and the second network use different packet protocols.

26. The apparatus of claim 19, further comprising:

a first packet network protocol stack coupled to the first interface;

a first packet telephony protocol stack coupled to the first packet network protocol stack and to the controller;

a second packet network protocol stack coupled to the second interface; and

a second packet telephony protocol stack coupled to the second packet network protocol stack and to the controller.

27. The apparatus of claim 26, wherein the stream transformer uses at least one of time division multiplexing (TDM) and exchange of data structures containing digitized segments of a telephony payload to exchange the information content and to maintain separation between the protocol stacks at the physical network interface level, the packet network protocol level, and the packet telephony protocol level.

28. The apparatus of claim 26, further comprising:

a packet inspection engine coupled to the controller to inspect a data stream between the first network and the second network and to remove the telephony data packets from the data stream; and

a packet disassembler/reassembler (PDR) to receive the telephony data packets from the packet inspection engine and read a header of each telephony data packet to direct each telephony data packet to a protocol stack responsible for a telephony stream.

29. A packet telephony transformer, comprising:

a controller to control the transfer of call content between a first network and a second network and to insulate a first telephony stream of the first network from a second telephony stream of the second network;

a first protocol engine communicatively coupled to the controller to process connection protocols and to transfer call content for the first telephony stream;

a second protocol engine communicatively coupled to the controller and to the first protocol engine to process connection protocols and to transfer call content for the second telephony stream;

a packet disassembler/reassembler (PDR) coupled to the controller and to the protocol engines to pass a telephony data packet to either the first protocol engine or the second protocol engine based on a header of the telephony data packet; and

a packet inspector coupled to the controller and to the PDR to inspect a data stream between the first network and the second network and to remove telephony data packets from the data stream for transfer to the PDR.

30. The packet telephony transformer of claim 29, wherein the first protocol engine and/or the second protocol engine include multiple protocol sub-engines for processing multiple protocols within one protocol engine.

31. The packet telephony transformer of claim 29, further comprising a first network interface coupled to the packet inspector and to the first network and a second network interface coupled to the packet inspector and to the second network.

32. An article of manufacture, comprising:

a machine-readable medium containing content, that when executed causes a machine to;

receive a first telephony stream having information content from a first client on a first network;

terminate the first telephony stream at a boundary between the first network and a second network; and

send a second telephony stream having the information content to a second client on the second network.

33. The article of manufacture of claim 32, further comprising content, that when executed causes a machine to:

receive the first telephony stream formatted according to a first protocol; and

send the second telephony stream formatted according to a second protocol.

34. The article of manufacture of claim 32, further comprising content, that when executed causes a machine to insulate the first telephony stream, the first client, and the first network from the second telephony stream, the second client, and the second network.

35. The article of manufacture of claim 34, wherein the insulating includes isolating a first physical network interface, a first packet network protocol stack, and a first packet telephony protocol stack of the first network from a second physical network interface, a second packet network protocol stack, and a second packet telephony protocol stack of the second network.

36. The article of manufacture of claim 35, further comprising content, that when executed causes a machine to transfer the information content from the first telephony stream to the second telephony stream using a controller connected to the first packet telephony protocol stack and the second packet telephony protocol stack, wherein the controller maintains the insulation between the first packet telephony protocol stack and the second packet telephony protocol stack.

37. A method for transforming packet telephony streams, comprising:

inspecting a stream of data packets for the presence of telephony data packets;

removing the telephony data packets from the stream of data packets;

reading at least one of a telephony data packet header and/or a telephony data packet payload to direct each telephony data packet into one of a first telephony stream and a second telephony stream; and

transferring information content between the first telephony stream and the second telephony stream while isolating the first telephony stream from the second telephony stream.

38. The method of claim 37, further comprising using a packet inspector to inspect the data stream and to remove the telephony data packets.

39. The method of claim 37, further comprising using a packet disassembler/reassembler (PDR) to read at least one of a telephony data packet header and/or a telephony data packet payload in order to direct each telephony data packet into one of a first telephony stream and a second telephony stream.

40. The method of claim 37, further comprising transferring information content between the first telephony stream and the second telephony stream while isolating the first telephony stream from the second telephony stream using a first protocol engine for the first telephony stream, a second protocol engine for the second telephony stream, and a controller coupled to the first and second protocol engines.