Firewall penetration system and method for real time media communications

• US 7,257,837 B2
• Filed: 07/26/2003
• Issued: 08/14/2007
• Est. Priority Date: 07/26/2003
• Status: Active Grant

• Current Assignee: Innomedia Pte Ltd
• Original Assignee: Innomedia Pte Ltd
• Inventors: Cheng, Shih-An, Xu, Chen, Pan, Huang-Ming, Huang, Jing-Yao
• Primary Examiner(s): SMITHERS, MATTHEW
• Application Number:
  US10/627,594
• Publication Number:
  US 20050033985A1
• Time in Patent Office: 1,480 Days
• Field of Search: 726/12, 726/14, 726/15
• US Class Current: 726/12
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes

Abstract

A system for initiating and maintaining a real time audio or video media session between two clients, at least one of which has a private network IP address and is supported by a NAT firewall, comprises a proxy server serving each client and a relay server. The first proxy server may receive an invite message from a caller client to initiate a media session with a callee client. The invite message will identify the IP address and media port number of the caller client. The proxy server queries the relay server to obtain a port number of the relay server that may be used for relaying the media session between the caller client and the callee client. The proxy server will replace the IP address and port number of the caller client with the IP address and port number of the relay server in the invite message before forwarding to the callee client. When the callee client generates a response message that includes the IP address and media port number of the callee client, the proxy server will replace the IP address and media port number of the callee client in the response message before forwarding the response message to the caller client.

Claims

1. A method of operating a proxy server for establishing a real time streaming media session between a first client served by the proxy server, the first client having been assigned an IP address which is a local area network address, and a second client served by a second proxy server, the method comprising:

receiving an invite message from the first client over an internet protocol channel, the invite message including session description protocol fields identifying the IP address assigned to the first client and a unique identifier of the second client;

comparing a source IP address extracted from the internet protocol channel to the IP address assigned to the first client;

if the IP address extracted from the internet protocol channel does not match the IP address identified in the session description protocol fields, providing identification of a relay server resource to each of the first client and the second client by;

sending a relay server invite message to a relay server;

receiving a relay server response message, the relay server response message identifying a relay server resource, comprising a relay server IP address and port number, from a relay server;

sending a redirect invite message to a redirect server, the redirect message including the identification of the second client;

receiving a redirect server response message, the redirect server response message including a network address of the second proxy server serving the second client;

sending a forwarding invite message to the network address of the second proxy server, the forwarding invite message comprising session description protocol fields identifying the relay server resource;

receiving an OK response message from the second proxy server;

sending, in response to receiving the OK response from the second proxy server, a second OK response to the first client, the second OK response comprising session description protocol fields identifying the relay server resource.

2. The method of claim 1, wherein the step of obtaining identification of a relay server resource comprises:

providing a relay server resource request message to a relay server; and

receiving a resource message from the relay server that includes identification of the relay server resource.

3. The method of claim 2, wherein:

the relay server request message is a SIP invite message;

the resource message is a SIP redirect message that includes a session description protocol payload that identifies the relay server resource.

4. The method of claim 1, wherein the step of providing the second OK response to the first client comprises including the session description protocol payload that identifies the relay server resource in a SIP OK message addressed to the IP address extracted from the internet protocol channel.

5. The method of claim 4, wherein the step of obtaining identification of a relay server resource comprises:

providing a relay server resource request message to a relay server; and

receiving a resource message from the relay server that includes identification of the relay server resource.

6. The method of claim 5, wherein:

the relay server request message is a SIP invite message;

the resource message is a SIP redirect message that includes a session description protocol payload that identifies the relay server resource.

7. The method of claim 1, further comprising:

providing identification of the IP address of the first client to the second client if the IP address extracted from the internet protocol channel matches the IP address of the first client by;

querying a redirect server to obtain a network address of the second proxy server serving the second client;

sending a forwarding invite message to the network address of the second proxy server, the forwarding invite message identifying the IP address of the first client; and

providing identification of an IP address of the second client to the first client by;

receiving an OK response message from the second proxy server, the OK response message including identification of the IP address of the second client; and

providing, in response to receiving the OK response from the second proxy server, a second OK response to the first client, the second OK response comprising identification of the IP address of the second client.

8. A proxy server for establishing a real time streaming media session between a first client served by the proxy server with a local area network address and a second client served by a second proxy server, the method comprising:

a network interface for exchanging session messaging with remote devices over an internet protocol network;

a session signaling module for receiving an invite message from the first client over a designated internet protocol channel, the invite message including identification of an IP address of the first client and a unique identifier of the second client;

a comparison engine for comparing a source IP address extracted from the internet protocol channel to the IP address of the first client; and

a messaging module for, if the IP address extracted from the internet protocol channel does not match the IP address of the first client;

obtaining, from a relay server, identification of a relay server resource comprising a relay server IP address and port number;

querying a redirect server to obtain a network address of the second proxy server serving the second client;

generating a forwarding invite message to the network address of the second proxy server, the forwarding invite message identifying client that the relay server resource; and

generating, in response to receiving an OK response from the second proxy server, a second OK response message to the first client, the second OK response comprising identification of the relay server resource.

9. The proxy server of claim 8, wherein the messaging module obtains identification of a relay server resource by:

providing a relay server resource request message to a relay server; and

receiving a resource message from the relay server that includes identification of the relay server resource.

10. The proxy server of claim 9, wherein:

the relay server request message is a SIP invite message;

the resource message is a SIP redirect message that includes a session description protocol payload that identifies the relay server resource.

11. The proxy server of claim 8, wherein the second OK response message to the first client is addressed to the IP address extracted from the internet protocol channel and comprises including the session description protocol payload that identifies the relay server resource.

12. The proxy server of claim 11, wherein the response message is a SIP OK message.

13. The proxy server of claim 11, wherein the invite message to the second client includes the session description protocol payload that identifies the relay server resource.

14. The proxy server of claim 8, wherein, if the IP address extracted from the internet protocol channel matches the IP address of the first client, the messaging module provides for:

querying a redirect server to obtain a network address of the second proxy server serving the second client;

sending a forwarding invite message to the network address of the second proxy server, the forwarding invite message identifying the IP address of the first client; and

providing identification of an IP address of the second client to the first client by;

receiving an OK response message from the second proxy server, the OK response message including identification of the P address of the second client; and

providing, in response to receiving the OK response from the second proxy server, a second OK response to the first client, the second OK response comprising identification of the IP address of the second client.