Real-time media communications over firewalls using a control protocol

• US 6,922,786 B1
• Filed: 10/31/2000
• Issued: 07/26/2005
• Est. Priority Date: 10/31/2000
• Status: Expired due to Term

• Current Assignee: Avaya Incorporated
• Original Assignee: Nortel Networks Limited (Nortel Networks Corporation)
• Inventors: Ong, Lyndon
• Primary Examiner(s): HUA, LY
• Application Number:
  US09/704,187
• Time in Patent Office: 1,729 Days
• Field of Search: 713/201, 713/200, 709/227, 709/204, 709/206, 709/229, 704/270, 704/231, 704/246, 704/251, 370/238, 370/392, 712/300
• US Class Current: 713/154
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

In one embodiment of the invention, a real-time firewall processor includes a controller and a filter. The controller specifies a filtering characteristic based on a control protocol from a call server serving a firewall between a source and a destination networks. The filter is coupled to the controller to filter a packet in a call transmitted from the source network based on the filtering characteristic, the filter accepting the packet if the packet satisfies the filtering characteristic and rejecting the packet otherwise.

Claims

1. An apparatus comprising:

a controller to specify a filtering characteristic based on a control protocol from a call server serving a firewall between a source network and a destination networks; and

a filter coupled to the controller to filter a packet in a call transmitted from the source network based on the filtering characteristic, the filter accepting the packet if the packet satisfies the filtering characteristic and rejecting the packet otherwise.

2. The apparatus of claim 1 wherein the controller further specifies a modifying action based on the control protocol.

3. The apparatus of claim 2 further comprises:

a

modifier coupled to the controller and the filter to modify the accepted packet based on the modifying action, the modified packet being sent to the destination network.

4. The apparatus of claim 3 wherein the modifying action is one of an address swapping, a port swapping, and a protocol conversion.

5. The apparatus of claim 4 wherein the protocol conversion is a conversion between an IPv4 and an IPv6.

6. The apparatus of claim 3 wherein the filter comprises:

an extractor to extract a packet characteristic from the packet;

a matcher coupled to the extractor to match the packet characteristic with the filtering characteristic; and

a packet router coupled to the matcher to route the packet to the modifier if the packet characteristic matches the filtering characteristic.

7. The apparatus of claim 1 wherein the source network is one of a public network,and a private network.

8. The apparatus of claim 1 wherein the destination network is one of a public network and a private network.

9. The apparatus of claim 1 wherein the filtering characteristic is one of a traffic characteristic, a network address, and a port identifier corresponding to the call.

10. The apparatus of claim 9 wherein the call is a voice over Internet protocol (VoIP) call.

11. The apparatus of claim 1 wherein the rejected packet is sent to an application firewall.

12. The apparatus of claim 1 wherein the control protocol is one of a megaco protocol and a Common Open Policy Service (COPS) protocol.

13. A method comprising:

specifying a filtering characteristic based on a control protocol from a call server serving a firewall between a source network and a destination network;

filtering a packet in a call transmitted from the source network based on the filtering characteristic; and

accepting the packet if the packet satisfies the filtering characteristic, and rejecting the packet otherwise.

14. The method of claim 13 wherein specifying further comprises specifying a modifying action based on the control protocol.

15. The method of claim 14 further comprises:

modifying the accepted packet based on the modifying action using a modifier, the modified packet being sent to the destination network.

16. The method of claim 15 wherein filtering comprises:

extracting a packet characteristic from the packet;

matching the packet characteristic with the filtering characteristic; and

routing the packet to the modifier if the packet characteristic matches the filtering characteristic.

19. The method of claim 13 wherein the source network is one of a public network and a private network.

20. The method of claim 13 wherein the destination network is one of a public network and a private network.

21. The method of claim 13 wherein the filtering characteristic is one of a traffic characteristic, a network address, and a port identifier corresponding to the call.

22. The method of claim 21 wherein the call is a voice over Internet protocol (VoIP) call.

23. The method of claim 13 wherein the rejected packet is sent to an application firewall.

24. The method of claim 13 wherein the control protocol is one of a megaco protocol and a Common Open Policy Service (COPS) protocol.

17. The method of 14 wherein the modifying action is one of an address swapping, a port swapping, and a protocol conversion.

18. The method of claim 17 wherein the protocol conversion is a conversion between an IPv4 and an IPv6.

25. A computer program product comprising:

a machine useable medium having computer program code embedded therein, the computer program product having;

computer readable program code to specify a filtering characteristic based on a control protocol from a call server serving a firewall between a source network and a destination network; and

computer readable program code to filter a packet in a call transmitted from the source network based on the filtering characteristic; and

computer readable program code to accept the packet if the packet satisfies the filtering characteristic and rejecting the packet otherwise.

26. The computer program product of claim 25 wherein the computer readable program code to specify further comprises specifying a modifying action based on the control protocol.

27. The computer program product of claim 26 further comprises:

computer readable program code to modify the accepted packet based on the modifying action using a modifier, the modified packet being sent to the destination network.

28. The computer program product of claim 27 wherein the computer readable program code to filter comprises:

computer readable program code to extract a packet characteristic from the packet;

computer readable program code to match the packet characteristic with the filtering characteristic; and

computer readable program code to route the packet to the modifier if the packet characteristic matches the filtering characteristic.

31. The computer program product of claim 25 wherein the source network is one of a public network and a private network.

32. The computer program product of claim 25 wherein the destination network is one of a public network and a private network.

33. The computer program product of claim 25 wherein the filtering characteristic is one of a traffic characteristic, a network address, and a port identifier corresponding to the call.

34. The computer program product of claim 33 wherein the call is a voice over Internet protocol (VoIP) call.

35. The computer program product of claim 25 wherein the rejected packet is sent to an application firewall.

36. The computer program product of claim 25 wherein the control protocol is one of a megaco protocol and a Common Open Policy Service (COPS) protocol.

29. The computer program product of 26 wherein the modifying action is one of an address swapping, a port swapping, and a protocol conversion.

30. The computer program product of claim 29 wherein the protocol conversion is a conversion between an IPv4 and an IPv6.

37. A system comprising:

a source network and destination network;

an application firewall coupled to the source and destination networks; and

a real-time firewall coupled to the source and destination networks to process real-time packets, the real-time fire-wall comprising;

a controller to specify a filtering characteristic based on a control protocol from a call server serving a firewall between the source and the destination networks, and

a filter coupled to the controller to filter a packet in a call transmitted from the source network based on the filtering characteristic, the filter accepting the packet if the packet satisfies the filtering characteristic and rejecting the packet otherwise.

38. The system of claim 37 wherein the controller further specifies a modifying action based on the control protocol.

39. The system of claim 38 further comprises:

a modifier coupled to the controller and the filter to modify the accepted packet based on the modifying action, the modified packet being sent to the destination network.

40. The system of claim 39 wherein the modifying action is one of an address swapping, a port swapping, and a protocol conversion.

41. The system of claim 40 wherein the protocol conversion is a conversion between an IPv4 and an IPv6.

42. The system of claim 37 wherein the source network is one of a public network and a private network.

43. The system of claim 39 wherein the filter comprises:

an extractor to extract a packet characteristic from the packet;

a matcher coupled to the extractor to match the packet characteristic with the filtering characteristic; and

a packet router coupled to the matcher to route the packet to the modifier if the packet characteristic matches the filtering characteristic.

44. The system of claim 37 wherein the destination network is one of a public network and a private network.

45. The system of claim 37 wherein the filtering characteristic is one of a traffic characteristic, a network address, and a port identifier corresponding to the call.

46. The system of claim 45 wherein the call is a voice over Internet protocol (VOIP) call.

47. The system of claim 37 wherein the rejected packet is sent to an application firewall.

48. The system of claim 37 wherein the control protocol is one of a megaco protocol and a Common Open Policy Service (COPS) protocol.

49. An apparatus comprising:

a controller to specify a filtering characteristic based on a control protocol from a call server serving a firewall between a source and a destination networks;

a filter coupled to the controller to filter a packet in a call transmitted from the source network based on the filtering characteristic, the filter accepting the packet if the packet satisfies the filtering characteristic and rejecting the packet otherwise; and

a modifier coupled to the controller and the filter to modify the accepted packet based on a modifying action, the modified packet being sent to the destination network.

50. The apparatus of claim 49 wherein the controller further specifies the modifying action based on the control protocol.

51. The apparatus of claim 49 wherein the source network is one of a public network and a private network.

52. The apparatus of claim 49 wherein the destination network is one of a public network and a private network.