Proxy server for internet telephony

• US 7,809,126 B2
• Filed: 03/03/2006
• Issued: 10/05/2010
• Est. Priority Date: 05/19/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Long, Paul, Comer, Robert Scott, Dixson, James, Chaney, Adam, Marascio, Louis R.
• Primary Examiner(s): Nguyen; Quynh H
• Application Number:
  US11/368,171
• Publication Number:
  US 20060262916A1
• Time in Patent Office: 1,677 Days
• Field of Search: 379/221.08, 709/222, 709/238, 709/202, 370/432
• US Class Current: 379/221.08
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 65/1043 Gateway controllers, e.g. media gateway control protocol [MGCP] controllers
• CPC Class Codes: H04L 65/1101 Session protocols

Abstract

An apparatus and a method are provided for proxying communications between devices on an IP telephony network. In a preferred embodiment, an appliance comprising a network server and proxy server software includes filtering rules which can be modified to enable proxied communication between an IP phone on a first data network, such as, for example, the internet, and a call processing server located on a second data network. In another embodiment, an appliance comprises a proxy server that proxies call-processing and signaling communications between an authenticated IP phone on a first data network and a call processing server located on a second data network. In another embodiment, the appliance relays voice traffic between IP phones. In another embodiment, the proxy server software operates in a secure mode to permit encryption and decryption of voice and control communications. In another embodiment, the proxy server enables proxied communications between a call processing server and an IP phone by modifying the provisioning data exchanged between the call processing server and the IP phone.

Claims

1. An apparatus for shielding a call processing server in an IP telephony network, the apparatus comprising:

a network server interposed between a first data network and a second data network, said first data network being an untrusted network, said second data network comprising said call processing server;

a proxy server interposed between said first data network and said second data network, said proxy server comprising filtering rules operative to restrict communication from said first data network to said call processing server, wherein said apparatus presents an external IP address to said first data network and an internal IP address to said second data network;

said proxy server operative to modify said filtering rules to permit proxied communications to said call processing server from a first device on said first data network after said first device is authenticated by said proxy server, wherein said call processing server uses said internal IP address of said apparatus as an IP address of said first device; and

a transport layer security (TLS) front end coupled to said proxy server to provide encryption and decryption of call control and signaling when said apparatus is in a secure mode of operation.

2. The apparatus of claim 1, wherein said first device comprises an IP phone that is authenticated via an HTTP module of said proxy server.

3. The apparatus of claim 2, wherein said proxy server comprises a plurality of phone signaling proxy modules to process said call control and signaling requests from said authenticated IP phone.

4. The apparatus of claim 1, wherein said proxy server is operative to relay communications between said first device and a second authenticated device using real-time transport protocol (RTP).

18. The apparatus of claim 1, further comprising a cluster of appliances to provide load management and fail-safe operation, wherein each appliance of said cluster presents a unique external IP address to said first data network and a unique internal IP address to said second data network.

19. The apparatus of claim 2, wherein said HTTP module is configured to set a timer and then send a subsequent message to close ports in said apparatus after said ports are opened to receive modifications to said filtering rules.

20. The apparatus of claim 3, wherein said TLS front end is coupled to said phone signaling proxy modules to provide said encryption and decryption of said call control and signaling when said apparatus is in said secure mode of operation.

5. An apparatus for enabling secure IP telephony, the apparatus comprising:

a network server interposed between a first data network and a second data network, said first data network being an untrusted network, said second data network comprising a call processing server;

a proxy server interposed between said first data network and said second data network, said proxy server comprising filtering rules operative to restrict communication from said first data network to said call processing server, wherein said apparatus presents an external IP address to said first data network and an internal IP address to said second data network;

said proxy server operative to modify said filtering rules to permit proxied communications between said call processing server and a first device on said first data network after said first device is authenticated by said proxy server, wherein said call processing server uses said internal IP address of said apparatus as an IP address of said first device; and

said proxy server operative to exchange communications with said first device in a secure mode, wherein said secure mode uses secure real-time transport protocol (RTP) and a private key encryption algorithm.

6. The apparatus of claim 5, wherein said private key encryption algorithm comprises at least 128 bit encryption.

7. The apparatus of claim 5, wherein said secure mode uses transport layer security (TLS).

8. An apparatus for shielding a call processing server in an IP telephony networking, the apparatus comprising:

a network server interposed between a first data network and a second data network, said first data network being an untrusted network comprising an IP phone, said second data network comprising said call processing server; and

a proxy server interposed with said network server between said first data network and said second data network, said proxy server being operative to proxy a provisioning of said IP phone by said call processing server by modifying provisioning data that is exchanged between said IP phone and said call processing server, wherein said apparatus presents an external IP address to said first data network and an internal IP address to said second data network, said proxy server further comprising a transport layer security (TLS) front end to provide encryption and decryption of call control and signaling when said apparatus is in a secure mode of operation.

9. A method for shielding a call processing server in an IP telephony network, the method comprising the steps of:

authenticating a first IP phone in a first data network of said IP telephony network, wherein said IP telephony network comprises a network sever and a proxy server that are interposed between said first data network and a second data network, said first data network being an untrusted network, said second data network comprising a call processing server;

using filtering rules in said network server for restricting communications between said first data network and said second data network;

modifying said filtering rules to enable proxied communications between said authenticated first IP phone and said call processing server; and

encrypting and decrypting call control and signaling related to said proxied communications for a secure mode of operation.

10. The method of claim 9, further comprising the step of relaying voice payload data between said authenticated first IP phone and a second IP phone.

11. A method for shielding a call processing server in an IP telephony network, the method comprising the steps of:

proxying a request to said call processing server to provision a first IP phone, wherein said first IP phone is in a first data network and said call processing server is in a second data network, said first data network being an untrusted network;

modifying the provisioning data exchanged between said IP phone and said call processing server using a network server and a proxy server that are interposed between said first data network and said second data network;

proxying communications between said IP phone and said call processing server via said proxy server; and

encrypting and decrypting call control and signaling related to said proxied communications for a secure mode of operation.

12. A method for enabling secure communications over an IP telephony network, the method comprising the steps of:

proxying provisioning of an IP phone by a call processing server using a network server and a proxy server that are interposed between a first data network and a second data network, said first data network being an untrusted network comprising said first IP phone, said second data network comprising said call processing server;

supplying a private key to said IP phone with provisioning data from said call processing server for a secure mode of operation; and

communicating with said IP phone using secure real-time transport protocol (RTP) and a private key encryption algorithm with said private key.

13. An IP telephony system, comprising:

a network server and a proxy server that are interposed between a first data network and a second data network, said first data network being an untrusted network;

an IP phone connected to said first data network, said IP phone being unauthenticated, wherein said network server and said proxy server present an external IP address to said first data network and an internal IP address to said second data network;

a call processing server connected to said second data network;

said proxy server comprising filtering rules restricting transmission of data from said first data network to said second data network, said proxy server operative to authenticate said first IP phone, and said proxy server operative to modify said filtering rules to enable proxied communication between said authenticated first IP phone and said call processing server; and

a transport layer security (TLS) front end coupled to said proxy server to provide encryption and decryption of call control and signaling when said apparatus is in a secure mode of operation.

14. A non-transitory computer-readable storage medium embedded with instructions that operate in an IP telephony environment for execution by a processor, and when executed operable to:

authenticate a first IP phone in a first data network of said IP telephony network, wherein said IP telephony network comprises a network sever and a proxy server that are interposed between said first data network and a second data network, said first data network being an untrusted network, said second data network comprising a call processing server;

use filtering rules in said network server for restricting communications between said first data network and said second data network;

modify said filtering rules to enable proxied transmission of data from said authenticated first IP phone to said call processing server; and

encrypt and decrypt call control and signaling related to said proxied transmission of data for a secure mode of operation.

15. An apparatus for shielding a call processing server in an IP telephony network, the apparatus comprising:

means for restricting communications between a first data network and a second data network according to filtering rules, said first data network being untrusted and comprising a first IP phone, said second data network comprising a call processing server, wherein a network server and a proxy server are interposed between said first data network and said second data network;

means for authenticating said first IP phone using said proxy server;

means for modifying said filtering rules to enable proxied communications between said authenticated first IP phone and said call processing server; and

means for providing a secure mode of operation for said proxied communications.

16. The apparatus of claim 15, further comprising means for relaying communications between said authenticated first IP phone and a second IP phone.

17. The apparatus of claim 15, further comprising means for communicating with said authenticated first IP phone via said call processing server in said secure mode using encryption and decryption.