Method and device for implementation of a firewall application for communication data

• US 20040255035A1
• Filed: 03/19/2004
• Published: 12/16/2004
• Est. Priority Date: 09/25/2001
• Status: Active Grant

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Klaghofer, Karl, Totzke, Jurgen, Muller, Harald, Volkmann, Gerald
• Granted Patent: US 7,752,319 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/1106 Call signalling protocols; H.323 and related

Abstract

A method for implementation of a firewall application is disclosed, whereby, in one step (S1, S2, S3) of the initiation of a connection from the first to the second terminal (1, 2), authentication data for authentication of the first terminal is transmitted and, after successful authentication a selected address is communicated to the firewall device (9). An arrangement for carrying out the method is given.

Claims

1-10. -10 (canceled)

11. A method for implementing a firewall application for communication data transmitted between terminal devices, comprising:

disposing a first communication network in a first terminal device;

disposing a second communication network in a second terminal device;

initiating a data connection between the first terminal device and the second terminal device;

sending data for authenticating the first terminal device from a first network interworking device with a know address to a second network interworking device with a known address;

communicating a further address of the first terminal device or a first gatekeeper connected to the first terminal device, to the firewall device;

communicating the second network interworking device to the firewall device; and

activating the firewall device for signaling data to be sent by the first terminal device.

12. The method according to claim 11, further comprising sending the further address from the second network interworking device to the first network interworking device.

13. The method according to claim 12, wherein the further address is composed of an IP address and a port number.

14. The method according to claim 12, wherein a call setup from the first terminal device to the second terminal device is performed via the first gatekeeper, the firewall device, the second network interworking device and a second gatekeeper.

15. The method according to claim 14, wherein the call setup is performed by sending a SETUP message or an SIP INVITE message.

16. The method according to claim 14, wherein an ALERT message to confirm the acceptance of the call setup is sent by the selected further address from the second terminal device to the first terminal device.

17. The method according to claim 11, further comprising sending an activation message to activate the firewall device for user data from the second network interworking device to the firewall device.

18. The method according to claim 11, wherein the authentication data is transmitted by means of PKI.

19. The method according to claim 11, wherein the communication data is transmitted via Internet telephony or Internet multimedia connections.

20. A firewall arrangement for communication data transmitted between terminal devices, comprising:

a firewall device disposed between a first communication network and a second communication network;

a first terminal device disposed in the first communication network;

a second terminal device disposed in the second communication network;

a first network interworking device disposed in the first communication network; and

a second network interworking device with a known address for performing an authentication on the basis of authentication data transmitted by the first terminal device and for sending a selected further address of the second terminal device to the firewall device for activating the firewall device for the signaling data to be sent from the first terminal device to the second terminal device.

21. The arrangement according to claim 20, wherein an activation device for activating the firewall device is used for signaling data and/or user data.