SYSTEM AND METHOD FOR TRAVERSING A NAT DEVICE FOR PEER-TO-PEER HYBRID COMMUNICATIONS

• US 20090262742A1
• Filed: 06/30/2009
• Published: 10/22/2009
• Est. Priority Date: 06/29/2004
• Status: Active Grant

• Current Assignee: Damaka, Inc.
• Original Assignee: Damaka, Inc.
• Inventors: RAVIKUMAR, SIVAKUMAR, GUNDABATHULA, SATISH
• Granted Patent: US 8,139,578 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/54 Organization of routing tables
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2567 for reachability, e.g. inquiring the address of a correspondent behind a NAT server
• CPC Class Codes: H04L 61/2575 using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
• CPC Class Codes: H04L 61/2578 without involvement of the NAT server
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04W 12/06 Authentication

Abstract

An improved system and method are disclosed for peer-to-peer communications. In one example, the method enables an endpoint to traverse a NAT device using a stateless reflector.

Claims

1. A method for enabling a first endpoint to traverse a network address translation (NAT) device associated with a second endpoint in a peer-to-peer communications system, wherein the NAT device includes a pinhole maintained between the NAT device and a server, the method comprising:

determining whether a message sent to the second endpoint from an external source will only pass through the NAT device if the second endpoint has first sent a message to the external source;

if the determining indicates that the second endpoint must first send a message, sending a first message to a stateless reflector for reflection to the second endpoint, wherein the first message includes a message header identifying the stateless reflector as the message destination and the first endpoint as the message source;

modifying the message header by the stateless reflector, wherein the modifying inserts the second endpoint as the message destination and the server as the message source; and

sending the modified first message to the second endpoint via the pinhole in the NAT device.

2. The method of claim 1 further comprising:

receiving a second message from the second endpoint by the first endpoint in response to the modified first message, wherein the second message is sent directly from the second endpoint to the first endpoint; and

sending additional messages directly from the first endpoint to the second endpoint via a pinhole opened in the NAT device by the second message.

3. The method of claim 1 further comprising:

receiving a second message from the second endpoint by the first endpoint in response to the modified first message, wherein the second message is sent directly from the second endpoint to the first endpoint; and

capturing a port associated with the NAT device from the second message, wherein the port is needed by the first endpoint for sending a message directly to the second endpoint.

4. The method of claim 1 further comprising:

sending a second message directly to the second endpoint from the first endpoint prior to sending the first message to the stateless reflector, wherein the second message opens a pinhole for the second endpoint through a NAT device associated with the first endpoint.

5. The method of claim 4 further comprising:

receiving a third message from the second endpoint by the first endpoint in response to the modified first message, wherein the third message is sent directly from the second endpoint to the first endpoint; and

capturing a port associated with the NAT device from the third message, wherein the port is needed by the first endpoint for sending a message directly to the second endpoint via the NAT device.

6. The method of claim 1 further comprising:

sending a second message from the second endpoint to the stateless reflector for reflection to the first endpoint, wherein the second message includes a message header identifying the stateless reflector as the message destination and the second endpoint as the message source;

modifying the message header by the stateless reflector, wherein the modifying inserts the first endpoint as the message destination and the server as the message source; and

sending the modified second message to the first endpoint via a pinhole maintained between a NAT device associated with the first endpoint and the server.

7. The method of claim 6 wherein all messages between the first and second endpoints are reflected via the stateless reflector.

8. The method of claim 6 wherein all signaling messages between the first and second endpoints are reflected via the stateless reflector and all non-signaling messages are transferred directly between the first and second endpoints.

9. The method of claim 1, wherein modifying the message header by the stateless reflector includes decrypting a portion of the first message that contains the second endpoint as the message destination and the server as the message source.

10. The method of claim 1 further comprising encrypting the portion of the first message that contains the second endpoint as the message destination and the server as the message source with a first encryption key associated with the stateless reflector and encrypting a payload portion of the message with a second encryption key associated with the second endpoint.

11. The method of claim 1 further comprising:

if the determining indicates that the second endpoint does not need to first send a message, sending the first message directly to the second endpoint.

12. The method of claim 11 wherein determining whether a message sent to the second endpoint from an external source will only pass through the NAT device if the second endpoint has first sent a message to the external source includes identifying the NAT device as being of a type selected from the group consisting of a full cone type, a restricted cone type, a port restricted cone type, and a symmetric type.

13. A stateless reflector for a communications system, the stateless reflector comprising:

a processor;

a memory accessible to the processor; and

a plurality of instructions stored on the memory for execution by the processor, the instructions including;

instructions for receiving a message from a first endpoint, wherein the message has a first header portion identifying a first endpoint as the message source and the stateless reflector as the message destination, a second header portion identifying a server as the message source and a second endpoint as the message destination, and a payload portion;

instructions for modifying the message source and destination of the first header portion to equal the message source and destination of the second header portion; and

instructions for sending the modified message to the second endpoint.

14. The stateless reflector of claim 13 further comprising instructions for decrypting the second header portion prior to modifying the message source and destination of the first header portion.

15. A system for peer-to-peer communications, the system comprising:

a first endpoint coupled to a packet-based communications network and separated from the network by a network address translation (NAT) device having an internal address for communication with the first endpoint and an external address for communication with the network, wherein the NAT device includes a pinhole maintained with a server on the network;

a second endpoint coupled to the network, the second endpoint configured to execute a plurality of instructions stored therein for establishing a communication session with the second endpoint, the instructions including;

instructions for determining whether the NAT device is of a restricted type, port restricted type, or symmetric type, instructions for, if the NAT device is of a restricted type, port restricted type, or symmetric type, sending a first message to a stateless reflector for reflection to the first endpoint, wherein the first message includes a first header identifying the stateless reflector as the destination and the second endpoint as the source, and a second header identifying the first endpoint as the destination and the server as the source;

instructions for receiving a second message directly from the first endpoint in response to the first message; and

instructions for sending additional messages directly to the first endpoint after receiving the second message.

16. The system of claim 15 wherein the stateless reflector comprises:

a processor;

a memory accessible to the processor; and

a plurality of instructions stored on the memory for execution by the processor, the instructions including;

instructions for receiving the first message from the second endpoint;

instructions for replacing the first header with the second header; and

instructions for sending the modified first message to the first endpoint.

17. The system of claim 16, wherein the second endpoint further includes instructions for capturing a port associated with the NAT device from the second message.

18. The system of claim 16 further comprising:

a NAT device associated with the second endpoint, wherein the second endpoint is unable to receive a message directly from the first endpoint unless the second endpoint has first sent a message to the first endpoint; and

instructions for sending a third message directly to the first endpoint from the second endpoint prior to sending the first message to the stateless reflector.

19. The system of claim 16, wherein the second endpoint further includes instructions for sending the first message directly to the first endpoint if the NAT device is not a restricted type, port restricted type, or symmetric type.

20. The system of claim 16 further comprising a second endpoint coupled directly to the first endpoint and coupled to the network via the NAT device associated with the first endpoint, wherein the first and third endpoints are configured to send messages directly to one another.