METHOD AND APPRATUS TO CONTROL APPLICATION MESSAGES BETWEEN CLIENT AND A SERVER HAVING A PRIVATE NETWORK ADDRESS

• US 20110019547A1
• Filed: 12/28/2006
• Published: 01/27/2011
• Est. Priority Date: 12/28/2006
• Status: Active Grant

• Current Assignee: Telecom Italia S.p.A.
• Original Assignee: Telecom Italia S.p.A.
• Inventors: Pistillo, Vito, Viale, Luca, De Lutiis, Paolo
• Granted Patent: US 8,670,316 B2
• Time in Patent Office: Days
• US Class Current: 370/231
• CPC Class Codes: H04L 61/2564 for a higher-layer protocol, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 61/50 Address allocation
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A method to control communication traffic in a communication network. The traffic includes application-level messages between a client and a server having a private network address. The method includes the steps of: sending by the client a request message requesting a service to the server using a first public network address associated with the server; processing the request message at an intermediate logic unit logically positioned between the client and the server; and receiving an alert signal at the intermediate unit. Upon receipt of said alert signal, the method provides for: mapping the private network address of the server to a second public network address associated with the server; and instructing the client to send the request message to the second public network address of the server, routing to the server only request messages directed to the second public network address.

Claims

1-20. -20. (canceled)

21. A method to control communication traffic in a communication network, said traffic comprising application-level messages between a client and a server having a private network address, comprising the steps of:

sending by said client a request message requesting a service to said server using a first public network address associated with said server;

processing said request message at an intermediate logic unit logically positioned between said client and said server;

receiving an alert signal at said intermediate unit; and

, upon receipt of said alert signal;

mapping said private network address of said server to a second public network address associated with said server at said intermediate unit;

instructing said client to send said request message to said second public network address of said server; and

routing to said server only request messages directed to said second public network address.

22. The method to control communication traffic according to claim 21, wherein said step of instructing said client to send said request message to said second public network address comprises the step of transmitting a redirection message to said client containing said second public network address of said server.

23. The method to control communication traffic according to claim 22, wherein the step of transmitting a redirection message to said client is performed upon receipt of a request message by said intermediate unit.

24. The method to control communication traffic according to claim 21, wherein said step of routing said request message directed to said second public network address to said server uses a network address translator mechanism.

25. The method to control communication traffic according to claim 21, comprising, before the step of sending said request message, a step of hiding said private network address of said server by mapping said first public network address of said server to said private network address of said server at said intermediate unit.

26. The method to control communication traffic according to claim 25, comprising, after the step of hiding said private network address of said server, a step of routing to said server, request messages directed to said first public network address.

27. The method to control communication traffic according to claim 26, wherein said step of routing said request message directed to said first public network address to said server uses a network address translator mechanism.

28. The method to control communication traffic according to claim 21, wherein said communication network is a wide-area network.

29. The method to control communication traffic according to claim 21, wherein said first and second public network address are public internet protocol addresses.

30. The method to control communication traffic according to claim 21, wherein said private network address is a private internet protocol address.

31. The method to control communication traffic according to claim 21, wherein said intermediate unit is a network-layer unit.

32. The method to control communication traffic according to claim 21, further comprising, before the step of receiving an alert signal, the step of generating an alert signal as a result of an event detection.

33. The method to control communication traffic according to claim 21, wherein said application-level message is a session initiation protocol request message.

34. The method to control communication traffic according to claim 21, wherein said redirection message is a session initiation protocol redirect message.

35. The method to control communication traffic according to claim 21, wherein said request message is a hypertext transfer protocol request message.

36. The method to control communication traffic according to claim 22, wherein said redirection message is a message comprising the new public network address of said server.

37. The method to control communication traffic according to claim 21, wherein said server is a web server.

38. A system for controlling communication traffic in a communication network, said traffic comprising application-level messages, comprising:

a server having a private network address;

a client capable of being configured to transmit a request message to a first public network address associated with said server;

an intermediate logic unit logically positioned between the client and the server, said intermediate unit capable of being configured to process said request message between said server and said client; and

an event detector capable of detecting an event and sending an alert signal to said intermediate unit,

wherein said intermediate unit is capable of being configured so as, upon receipt of said alert signal, to map said private network address of said server to a second public network address associated with said server at said intermediate unit, to instruct said client to send said request message to said second public network address of said server and to route to said server only request messages directed to said second public network address.

39. The system according to claim 38, wherein said instruction to said client to send said request message to said second public network address is a redirect message.

40. The system according to claim 38, wherein said intermediate unit is capable of being configured to hide said private network address of said server by mapping said first public network address of said server to said network address of said server.