IP application service providing system

• US 20080075097A1
• Filed: 02/12/2007
• Published: 03/27/2008
• Est. Priority Date: 09/26/2006
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Kitada, Atsushi
• Granted Patent: US 7,706,358 B2
• Time in Patent Office: Days
• US Class Current: 370/401
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2517 using port numbers
• CPC Class Codes: H04L 61/2567 for reachability, e.g. inquiring the address of a correspondent behind a NAT server
• CPC Class Codes: H04L 61/2578 without involvement of the NAT server

Abstract

An IP application service providing method enabling inbound communication in IP application communication intended between an internal node concealed from an outside network and belonging to an inside network and an external node belonging to the outside network through a gateway device set to permit only outbound communication, includes periodically transmitting a control packet aiming at notifying of a control channel port and at maintaining a communication permission entry of a control channel path to a connection support device on the outside network from the internal node subordinated to the gateway device; notifying the internal node of a connecting destination address/port pair associated with the external node via the control channel from the connection support device; and actively opening a data channel of an IP application to the notified connecting destination address/port pair.

Claims

1. An IP application service providing system enabling inbound communication from the outside toward the inside in IP application communication intended between an internal node concealed from an outside network and belonging to an inside network and an external node belonging to the outside network through a gateway device set to permit only outbound communication from the inside toward the outside,

the internal node subordinated to the gateway device, comprising:

a unit periodically transmitting a control packet aiming at notifying of a control channel port and at maintaining a communication permission entry of a control channel path to a connection support device on the outside network;

a unit receiving notification of a connecting destination address/port pair associated with the external node via the control channel from the connection support device; and

a unit actively opening a data channel of an IP application to the notified connecting destination address/port pair.

2. An IP application service providing method enabling inbound communication from the outside toward the inside in IP application communication intended between an internal node concealed from an outside network and belonging to an inside network and an external node belonging to the outside network through a gateway device set to permit only outbound communication from the inside toward the outside, the method comprising:

a first step of periodically transmitting a control packet aiming at notifying of a control channel port and at maintaining a communication permission entry of a control channel path to a connection support device on the outside network from the internal node subordinated to the gateway device;

a second step of notifying the internal node of a connecting destination address/port pair associated with the external node via the control channel from the connection support device; and

a third step of actively opening a data channel of an IP application to the notified connecting destination address/port pair.

3. An IP application service providing method according to claim 2, wherein any one of UDP, ICMP and TCP is used as a protocol of the control channel.

4. An IP application service providing method according to claim 2, wherein the first step and the second step are asynchronously carried out, and the second step is executed without depending on control packet transmission timing in the first step.

5. An IP application service providing method according to claim 2, wherein the second step is carried out as a response to the control packet periodically transmitted in the first step.

6. An IP application service providing method according to claim 2, wherein validity, confidentiality and integrity are verified in the first step and the second step, thereby having security durability.

7. An IP application service providing method according to claim 2, further comprising a fourth step of checking whether the gateway device exists or not,

wherein the first step, the second step and the third step are executed only when it proves that the internal node is situated as a subordinate to the gateway device.

8. An IP application service providing method according to claim 2, further comprising a fifth step of checking a communication permission entry timer of the gateway device,

wherein the control packet transmission interval in the first step is optimized corresponding to a timer value.