Voice firewall

• US 7,100,202 B2
• Filed: 03/01/2002
• Issued: 08/29/2006
• Est. Priority Date: 03/02/2001
• Status: Expired due to Term

• Current Assignee: Broadsoft Incorporated (Cisco Systems, Inc.)
• Original Assignee: Tekelec
• Inventors: Bakke, Steve
• Primary Examiner(s): Revak, Christopher
• Assistant Examiner(s): SHIFERAW, ELENI A
• Application Number:
  US10/086,604
• Publication Number:
  US 20020124189A1
• Time in Patent Office: 1,642 Days
• Field of Search: 713/201, 709/220, 709/227, 709/738, 370/254, 726/11
• US Class Current: 726/11
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A voice firewall for providing communication between a user endpoint at a user location and a provider endpoint at a provider location is provided. The voice firewall includes a command input port for receiving a connect command that includes a private connection address embedded within a data portion of the connect command. The voice firewall is configured to manipulate the connect command by substituting a public connection address for the private connection address. The voice firewall also includes a voice communication port that is associated with the private connection address on a private side of the firewall and the public connection address on a public side of the voice firewall.

Claims

1. A method of providing communication between a provider endpoint at a provider location and a user endpoint at a user location behind a data firewall, the method comprising the steps of;

receiving, by a voice firewall, a connection signal from a soft switch at the provider location, wherein a data portion of the connection signal includes a private connection address associated with the provider endpoint, wherein the voice firewall provides authentication for the user endpoint and said soft switch provides a challenge-response mechanism and maintains a command session with the user endpoint when the user endpoint is authenticated by the voice firewall, and wherein the user endpoint comprises a voice over Internet Protocol device;

modifying the data portion of the connection signal by substituting a public connection address of the voice firewall for the private connection address; and

sending the modified connection signal to the user endpoint.

2. The method according to claim 1 further comprising the step of opening a voice communication port, wherein the voice communication port provides a voice line between the user endpoint and the provider endpoint.

3. The method according to claim 1 further comprising the step of opening a voice communication port, wherein the voice communication port is configured to receive signals from the user endpoint at the public connection address and is configured to receive signals from the provider endpoint at the private connection address.

4. The method according to claim 1, wherein the user endpoint is an IP telephone.

5. The method according to claim 4, wherein the IP telephone is behind a conventional firewall.

6. The method according to claim 1, wherein the provider endpoint is a gateway connected to a public switched telephone network.

7. The method according to claim 1, wherein the provider endpoint is an IP telephone.

8. A method of providing connection between a provider endpoint at a provider location and a user endpoint at a user location behind a data firewall, the method comprising the steps of:

receiving, by a voice firewall, a connection signal from a soft switch at the provider location, wherein a data portion of the connection signal includes a private connection address associated with the provider endpoint, wherein the soft switch provides a challenge-response authentication and maintains a command session with the user endpoint when the user endpoint is authenticated;

storing, by the voice firewall, the private connection address;

modifying, by the voice firewall, the connection signal by substituting a public connection address for the private connection address;

opening a voice communication port of the voice firewall to provide communications between the user endpoint and the provider endpoint; and

sending the modified connection signal to the user endpoint.

9. The method according to claim 8, wherein the voice communication port is configured to receive signals from the user endpoint at the public connection address and is configured to receive signals from the provider endpoint at the private connection address.

10. The method according to claim 8, wherein the user endpoint is an IP telephone.

11. The method according to claim 8, wherein the provider endpoint is a gateway connected to a public switched telephone network.

12. The method according to claim 8, wherein the provider endpoint is an IP telephone.

13. A voice firewall comprising:

a command input port;

a command output port;

a processor electrically connected to the command input port and the command output port, wherein the processor is configured to receive a connection signal through the command input port, wherein the processor is further configured to substitute a public connection address of the voice firewall for a private connection address of a provider endpoint embedded within a data portion of the connection signal thereby hiding the private connection address, wherein the voice firewall is adapted to authenticate a user endpoint located behind a data firewall and that is provided a challenge-response with a soft switch, and wherein the user endpoint is addressed in the connection signal; and

a voice communication port electrically connected to the processor, wherein the voice communication port is associated with the private connection address on a private side of the voice firewall and is associated with the public connection address on a public side of the voice firewall.

14. The voice firewall according to claim 13, wherein the voice communication port is opened by the processor after receipt of the connection signal.

15. The voice firewall according to claim 13, wherein the command input port and the command output port provide a conduit through the voice firewall for a command session between a soft switch at a provider location and a user endpoint at a user location.

16. The voice firewall according to claim 13, wherein:

the command input port and the command output port provide a conduit through the voice firewall for a command session between a soft switch at a provider location and a user endpoint at a user location; and

the processor authenticates signals from user endpoint prior to initiation of the command session.

17. The voice firewall according to claim 13, wherein:

the processor is electrically connected to a provider location on the private side of the voice firewall and is electrically connected to a user location on the public side of the voice firewall; and

the processor facilitates communication between a user endpoint at the user location and a provider endpoint at the provider location.

18. A computer program stored on a computer-readable medium comprising:

instructions for receiving, by a voice firewall, a connection signal from a provider endpoint at a provider location;

instructions for substituting a public connection address for a private connection address embedded within a data portion of the connection signal, wherein the voice firewall provides authentication for the a user endpoint that is provided a challenge-response by a soft switch and said soft switch maintains a command session with the user endpoint when the user endpoint is authenticated by the voice firewall; and

instructions for sending the modified connection signal to user endpoint at a user location behind a data firewall, wherein the user endpoint comprises a voice over Internet Protocol device.

19. The computer-readable medium according to claim 18 further comprising instructions for storing the private connection address.

20. The computer-readable medium according to claim 18 further comprising instructions for opening a voice communication port to provide communications between the user endpoint and the provider endpoint.

21. The computer-readable medium according to claim 18, wherein the provider endpoint is a gateway connected to a public switched telephone network.

22. The computer-readable medium according to claim 18, wherein the provider endpoint is an IP telephone.

23. A method of providing voice communication between two endpoints including an endpoint located behind a data firewall over a digital network, the method comprising the steps of:

providing, by a soft switch, a challenge-response to the endpoint;

receiving, by a voice firewall, a Connect command that includes a private connection address of a provider endpoint embedded in a data portion of the Connect command, wherein the voice firewall is adapted to authenticate the end point;

modifying, by the voice firewall, the Connect command to substitute a public connection address of the voice firewall for the private connection address thereby biding the private connection address; and

sending the modified Connect command to the endpoint.