Method of communicating packet multimedia to restricted endpoints

• US 7,483,437 B1
• Filed: 11/18/2004
• Issued: 01/27/2009
• Est. Priority Date: 11/20/2003
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Mohaban, Shai
• Primary Examiner(s): Orgad; Edan
• Assistant Examiner(s): PARK, JUNG H
• Application Number:
  US10/993,665
• Time in Patent Office: 1,531 Days
• Field of Search: None
• US Class Current: 370/400
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

A method, performed in a network element, for communicating packet multimedia data between a first endpoint and a second endpoint, the method comprising the machine-implemented steps of receiving an outbound multimedia data packet; determining if the outbound multimedia data packet originated from a first endpoint that is logically behind a security device; determining and storing information identifying a logical pinhole in the security device, wherein the logical pinhole is associated with expected inbound multimedia data packets directed to the first endpoint; performing an action that keeps the logical pinhole open during all of a communication session between the first endpoint and the second endpoint; and forwarding inbound multimedia data packets directed from the second endpoint to the first endpoint via the logical pinhole.

Claims

1. A method, performed by a network element, for communicating packet multimedia data between a first endpoint and a second endpoint, the method comprising:

receiving an outbound multimedia signaling packet;

determining if the outbound multimedia signaling packet originated from a first endpoint that is logically behind a security device;

determining and storing information identifying a logical pinhole in the security device, wherein the logical pinhole is associated with expected inbound multimedia data packets directed to the first endpoint;

performing an action that keeps the logical pinhole open for future communication with the first endpoint by (i) determining that the first endpoint has a keep-alive timeout value that is configurable and (ii) configuring the pinhole keep-alive value of the first endpoint to modify a frequency at which the first endpoint generates periodic messages towards a signaling controller in order to keep the logical pinhole open, wherein configuring the pinhole keep-alive value comprises sending, at a particular time before a keep-alive timeout value of the first endpoint has been reached, an inquiry message to the first endpoint, determining whether the inquiry message was received;

sending a command to the first endpoint that increases the keep-alive timeout value of the first endpoint based on a determination that the inquiry message was received, and sending, in response to determining that the inquiry message was not received, a second command to the first endpoint that sets the keep-alive timeout value of the first endpoint to a smaller value; and

forwarding inbound multimedia signaling messages directed towards the first endpoint via the logical pinhole.

2. The method of claim 1, wherein the security device comprises one or more of a network address translator and a firewall.

3. The method of claim 1, wherein the first endpoint is configured to begin communications by first addressing the signaling controller which receives the outbound multimedia signaling packets.

4. The method of claim 1, further comprising instructing one or more media controllers to forward all subsequent multimedia packets from the first endpoint to the second endpoint.

5. The method of claim 1, wherein performing the action that keeps the logical pinhole open for future communication comprises:

determining that the first endpoint has a pinhole keep-alive value that is not configurable; and

determining whether the first endpoint permits adding a software component that generates periodic messages for keeping the logical pinhole open.

6. The method of claim 1, wherein performing the action that keeps the logical pinhole open for future communication comprises:

determining that the first endpoint has a pinhole keep-alive value that is not configurable;

determining that the first endpoint permits adding a software component that generates periodic messages for keeping the logical pinhole open;

installing the software component; and

activating the software component to generate the periodic messages.

7. The method of claim 1, wherein performing the action that keeps the logical pinhole open for future communication comprises:

determining that the first endpoint has a pinhole keep-alive value that is not configurable;

determining that the first endpoint does not permit adding a software component that generates periodic messages for keeping the logical pinhole open; and

sending periodic messages to the endpoint through the pinhole, wherein the periodic messages force the endpoint to respond with a message that keeps the logical pinhole open.

8. The method of claim 1, further comprising:

determining, from the outbound multimedia signaling packet, address information identifying a local network address of the first endpoint and an address of a security device that the first endpoint is behind;

storing the address information in association with information identifying the first endpoint;

receiving a request to provide the physical location of the first endpoint; and

providing, in a response message, the address information for the first endpoint.

9. The method of claim 8, wherein providing the address information comprises:

embedding the address information associated with the first endpoint in the signaling packet; and

communicating the signaling packet towards a destination entity.

10. The method of claim 1, wherein performing the action that keeps the logical pinhole open for future communication further comprises:

receiving a keep-alive message from the first endpoint;

determining that the keep-alive message originated from a registered endpoint; and

acknowledging the keep-alive message without forwarding the keep-alive message to a call-control server that services calls from and to the first endpoint.

11. The method of claim 10, wherein performing the action that keeps the logical pinhole open for future communication further comprises maintaining separate keep-alive timeout values for communications from an endpoint to the signaling controller and from the signaling controller to the call control server.

12. The method of claim 1, further comprising:

receiving a signaling message from the first endpoint;

allocating a port pair on a media controller for the use of streams of media;

modifying the signaling message to point the streams of media to an address and port that have been allocated at the media controller for processing packets of a communication session between the second endpoint and the first endpoint;

forwarding the modified signaling message to a destination entity, wherein the media controller determines the logical pinhole based on receiving the streams of media from the second endpoint at the allocated address and port; and

waiting at the media controller for the streams of media to arrive from both endpoints so media pinholes can be detected and the streams of media can be relayed between the two endpoints.

13. The method of claim 1, further comprising:

determining that the first endpoint and the second endpoint both are logically behind the security device; and

instructing the first endpoint and the second endpoint to communicate directly.

14. The method of claim 1, further comprising:

determining that one of the endpoints is logically behind a full-cone or restricted cone security device and another of the endpoints is one of global, logically behind a full-cone, or logically behind a restricted cone security device;

instructing both the endpoints to send media to a media controller;

determining one or more values identifying logical pinholes for the multimedia streams in the security device; and

providing the pinhole values to the endpoints and instructing the endpoints to send media directly towards the pinholes.

15. The method of claim 1, wherein performing the action that keeps the logical pinhole open for future communication comprises:

determining that the first endpoint is initiating or receiving a unidirectional call; and

modifying signaling messages of the unidirectional call so that the communication becomes bi-directional.

16. The method of claim 1, further comprising:

modifying a payload of one or more signaling messages to conform the one or more signaling messages to any of (a) one or more network requirements and (b) a signaling protocol; and

forwarding the modified signaling messages.

17. The method of claim 16, wherein modifying the payload comprises modifying a reply to a register message towards the first endpoint so that a registration expiration timeout (RET) is shorter than a logical pinhole timeout (PHT).

18. An apparatus for communicating packet multimedia data between a first endpoint and a second endpoint, the apparatus comprising:

means for receiving an outbound multimedia signaling packet;

means for determining if the outbound multimedia signaling packet originated from a first endpoint that is logically behind a security device;

means for determining and storing information identifying a logical pinhole in the security device, wherein the logical pinhole is associated with expected inbound multimedia signaling packets directed to the first endpoint;

means for performing an action that keeps the logical pinhole open for future signaling messages sent towards the first endpoint by (i) sending, at a particular time before a keep-alive timeout value of the first endpoint has been reached, an inquiry message to the first endpoint and (ii) based on a determination of whether the inquiry message was received, sending a command to the first endpoint that increases the keep-alive timeout value of the first endpoint, wherein the means for performing the action that keeps the logical pinhole open for future communication further comprises means for sending, in response to determining that the inquiry message was not received, a second command to the first endpoint that sets the keep-alive timeout value of the first endpoint to a smaller value; and

means for forwarding inbound multimedia signaling packets directed from the second endpoint to the first endpoint via the logical pinhole.

19. The apparatus of claim 18, wherein the security device comprises one or more of a network address translator and a firewall.

20. The apparatus of claim 18, wherein the first endpoint is configured to begin communications by first addressing a signaling controller which receives the outbound signaling packets.

21. The apparatus of claim 18, further comprising means for instructing one or more media controllers to forward all subsequent multimedia packets from the first endpoint to the second endpoint.

22. The apparatus of claim 18, wherein the means for performing the action that keeps the logical pinhole open for future communication comprises:

means for determining that the first endpoint has a keep-alive timeout value that is configurable; and

means for configuring the pinhole keep-alive value of the first endpoint to keep the logical pinhole open for future inbound signaling messages, by generating periodic messages towards a signaling controller.

23. The apparatus of claim 18, wherein the means for performing the action that keeps the logical pinhole open for future communication comprises:

means for determining that the first endpoint has a pinhole keep-alive value that is not configurable; and

means for determining whether the first endpoint permits adding a software component that generates periodic messages for keeping the logical pinhole open.

24. The apparatus of claim 18, wherein the means for performing the action that keeps the logical pinhole open for future communication comprises:

means for determining that the first endpoint has a pinhole keep-alive value that is not configurable;

means for determining that the first endpoint permits adding a software component that generates periodic messages for keeping the logical pinhole open;

means for installing the software component; and

means for activating the software component to generate the periodic messages.

25. The apparatus of claim 18, wherein the means for performing the action that keeps the logical pinhole open for future communication comprises:

means for determining that the first endpoint has a pinhole keep-alive value that is not configurable;

means for determining that the first endpoint does not permit adding a software component that generates periodic messages for keeping the logical pinhole open; and

means for sending periodic messages to the endpoint through the pinhole, wherein the periodic messages force the endpoint to respond with a message that keeps the logical pinhole open.

26. The apparatus of claim 18, further comprising:

means for determining, from the outbound multimedia signaling packet, address information identifying a local network address of the first endpoint and an address of a security device that the first endpoint is behind;

means for storing the address information in association with information identifying the first endpoint;

means for receiving a request to provide the physical location of the first endpoint; and

means for providing, in a response message, the address information for the first endpoint.

27. The apparatus of claim 26, wherein the means for providing the address information comprises:

means for embedding the address information associated with the first endpoint in the signaling packet; and

means for communicating the signaling packet towards a destination entity.

28. The apparatus of claim 18, wherein the means for performing the action that keeps the logical pinhole open for future communication comprises:

means for receiving a keep-alive message from the first endpoint;

means for determining that the keep-alive message originated from a registered endpoint; and

means for acknowledging the keep-alive message without forwarding the keep-alive message to a call-control server that services calls from and to the first endpoint.

29. The apparatus of claim 28, wherein the means for performing the action that keeps the logical pinhole open for future communication further comprises means for maintaining separate keep-alive timeout values for communications from an endpoint to a signaling controller and from the signaling controller to the call control server.

30. The apparatus of claim 18, further comprising:

means for receiving a signaling message from the first endpoint;

means for allocating a port pair on a media controller for the use of streams of media;

means for modifying the signaling message to point the streams of media to an address and port that have been allocated at the media controller for processing packets of a communication session between the second endpoint and the first endpoint;

means for forwarding the modified signaling message to a destination entity, wherein the media controller determines the logical pinhole based on receiving the streams of media from the second endpoint at the allocated address and port; and

means for waiting at the media controller for media to arrive from both endpoints so media pinholes can be detected and media can be relayed between the two endpoints.

31. The apparatus of claim 18, further comprising:

means for determining that the first endpoint and the second endpoint both are logically behind the security device; and

means for instructing the first endpoint and the second endpoint to communicate directly.

32. The apparatus of claim 18, further comprising:

means for determining that one of the endpoints is logically behind a full-cone or restricted cone security device and another of the endpoints is one of global, logically behind a full-cone, or logically behind a restricted cone security device;

means for instructing both the endpoints to send media to a media controller;

means for determining one or more values identifying logical pinholes for the multimedia streams in the security device; and

means for providing the pinhole values to the endpoints and instructing the endpoints to send media directly towards the pinholes.

33. The apparatus of claim 18, wherein the means for performing the action that keeps the logical pinhole open for future communication comprises:

means for determining that the first endpoint is initiating or receiving a unidirectional call; and

means for modifying signaling messages of the unidirectional call so that the communication becomes bi-directional.