Multimedia communication control unit as a secure device for multimedia communication between lan users and other network users

• US 20040114612A1
• Filed: 10/06/2003
• Published: 06/17/2004
• Est. Priority Date: 08/15/2000
• Status: Active Grant

• Current Assignee: Polycom Israel Limited (Plantronics, Inc.)
• Original Assignee: Polycom Israel Limited (Plantronics, Inc.)
• Inventors: Rabinerzon, Uri, Even, Roni
• Granted Patent: US 8,706,893 B2
• Time in Patent Office: Days
• US Class Current: 370/401
• CPC Class Codes: H04L 12/2801 Broadband local area networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 65/1043 Gateway controllers, e.g. media gateway control protocol [MGCP] controllers
• CPC Class Codes: H04L 65/1046 Call controllers; Call servers
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/1106 Call signalling protocols; H.323 and related
• CPC Class Codes: H04L 65/60 Network streaming of media packets
• CPC Class Codes: H04L 65/65 Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
• CPC Class Codes: H04L 65/70 Media network packetisation

Abstract

A system and method for providing multimedia communication between a firewall protected, LAN based endpoint and an endpoint that is external to the LAN. A logical port of a multimedia communications control unit is attached to the LAN behind the firewall. Another logical port of the multimedia communications control unit is attached to the external endpoint. Multimedia communication data, consisting of call management data and media data, can be exchanged between the endpoints via the multimedia communications control unit. The multimedia communications control unit allows only multimedia communication data that strictly adheres to a particular communications protocol to pass through. Thus, the security afforded by the firewall is not compromised.

Claims

1. An apparatus for providing multimedia data streams to a first endpoint communicatively coupled to a secured network and a second endpoint external to the secured network, wherein said multimedia data streams are formatted in accordance with a particular communications protocol, the apparatus comprising:

a first logical port communicatively coupled to the first endpoint through the secured network and operative to transmit multimedia communication data streams to the first endpoint;

a second logical port communicatively coupled to the second endpoint and operative to receive input data from the second endpoint and to accept only multimedia data streams; and

a common interface communicatively coupling the second logical port to the first logical port and enabling the second logical port to provide the multimedia data streams to the first logical port.

2. The apparatus of claim 1, wherein the first logical port and the second logical port each have a unique Internet protocol address.

3. The apparatus of claim 1, wherein said particular protocol is H.323.

4. The apparatus of claim 1, wherein said particular protocol is SIP.

5. The apparatus of claim 1, wherein the call setup data stream is transferred to the first logical port via a firewall.

6. The apparatus of claim 1, further comprising a control unit for controlling the internal routing of data between the logical ports.

7. An apparatus for communicating multimedia data streams between a first endpoint communicatively coupled to a secured network and a second endpoint external to the secured network, wherein said multimedia data streams are formatted in accordance with a particular communications protocol, the apparatus comprising:

a first logical port;

a second logical port; and

a common interface communicatively coupling the first logical port to the second logical port;

the first logical port being communicatively coupled to the first endpoint through the secured network and operative to extract multimedia data streams from the common interface and transmit them to the first endpoint, and to receive multimedia data streams from the first endpoint and inject them into the common interface;

a second logical port communicatively coupled to the second endpoint and operative to receive input data from the second input port, filter the input data allowing only multimedia data streams to be accepted and to inject the multimedia data streams into the common interface, and, to extract multimedia data streams from the common interface and transmit them to the second endpoint.

8. The apparatus of claim 7, wherein the first input/output logical port and the second input/output logical port each have a unique Internet Protocol address.

9. The apparatus of claim 7, wherein said particular protocol is H.323.

10. The apparatus of claim 7, wherein said particular protocol is SIP.

11. An apparatus for communicating multimedia data streams between a first endpoint communicatively coupled to a network, the network being secured by a firewall and being connected through the firewall to a public network, and a second endpoint within the public network, wherein said multimedia data streams are formatted in accordance with a particular communications protocol and include call management data streams and media data streams, the apparatus comprising:

a first logical port;

a second logical port communicatively coupled to the second endpoint; and

a common interface communicatively coupling the first logical port to the second logical port;

the first logical port being communicatively coupled to the secured network and operative to receive call management data streams from said network and to establish a multimedia communications session between the first endpoint and the second endpoint;

the first logical port being communicatively coupled to the first endpoint through the network and being further operative to extract media data streams from the common interface and transmit them to the first endpoint, and to receive media data streams from the first endpoint and inject them into the common interface;

a second logical port communicatively coupled to the second endpoint and operative to receive input data from the second input port, filter the input data allowing only media data streams to be accepted and to inject the media data streams into the common interface and, to extract media data streams from the common interface and transmit them to the second endpoint.

12. The apparatus of claim 11, wherein the first logical port and the second logical port each have a unique Internet protocol address.

13. The apparatus of claim 11, wherein said particular protocol is H.323.

14. The apparatus of claim 11, wherein said particular protocol is SIP.

15. A method for providing multimedia communication data between a first endpoint communicatively coupled to a secure network and a second endpoint external to the secure network without compromising the security of the secure network, the method comprising the steps of:

communicatively coupling a multimedia communications control unit to the secure network and to a public network;

receiving control data from the first endpoint targeted for the second endpoint;

if the control data does not conform to a particular protocol, filtering the control data;

if the control data conforms to the particular protocol, process the control data to establish a multimedia communications session between the first endpoint and the second endpoint; and

receiving media data from the second endpoint targeted for the first endpoint;

if the media data does not conform to the particular protocol, filtering the media data; and

if the media data conforms to the particular protocol, pass the media data to the first endpoint.

16. The method of claim 15, wherein the multimedia control unit having a first IP address to be used by the first endpoint and a second IP address to be used by the second endpoint.

17. The method of claim 15, wherein said particular protocol is H.323.

18. The method of claim 15, wherein said particular protocol is SIP.

19. A system for providing secured multimedia communication between a plurality of endpoints belonging to more then one network, wherein each of said plurality of endpoints includes a video screen and a video camera, each of endpoint of said plurality of endpoints being operative to send compressed multimedia packets via its network and to receive compressed multimedia packets from said network, the system comprising:

a plurality of input/output logical ports, wherein each said input/output logical port has its own IP address for receiving compressed input packets from at least one endpoint of said plurality of endpoints, operative for processing said compressed input packets into control streams and media streams, transferring the processed streams to a routing unit, receiving the appropriate processed streams from said routing unit, process said processed streams into packets, and sending the compressed output packets to the appropriate end point;

the routing unit, operative for internal routing of said processed streams to and from said input/output logical ports; and

a control unit, communicatively coupled to said routing unit and said input/output logical ports, and operative to control said multimedia communication.

20. The system of claim 19, wherein more then one endpoint includes a computer.

21. The system of claim 20, wherein at least one of said plurality of input/output logical ports is connected to different network then one of the other of said plurality of input/output logical ports, whereby using this configuration the multimedia communication control unit secures the multimedia communication between said networks.

22. The system of claim 19, wherein the communication is based on communication protocol standard selected from a group consisting of:

H.323; and

proposed standard SIP RFC 2543.

23. The system of claim 19 wherein the multimedia processed streams are composed of at least one of the type of streams selected from the group of streams comprising:

compressed video;

compressed audio; and

compressed data.

24. A method of performing secured multimedia communication between at least two separate networks by a multimedia communication control unit, the multimedia communication control unit including a plurality of input/output logical ports, the method comprising the steps of:

assigning different input/output logical ports to each network;

assigning different IP address to each input/output logical port;

reading compressed input data packets at the input/output logical ports based on the 1P address associated with said compressed input data packet;

processing said compressed input data packet;

transferring said processed data streams to the appropriate input/output logical ports.;

processing said data into packets; and

transferring the compressed packets to the appropriate endpoint based on the IP address, whereby using this method the multimedia communication control unit secures the multimedia communication between two networks.