Enabling incoming VoIP calls behind a network firewall

• US 7,826,602 B1
• Filed: 10/22/2004
• Issued: 11/02/2010
• Est. Priority Date: 10/22/2004
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Xie, Chunsheng, Zou, Feng, Hunyady, Attila J., Zhu, Xiaodong
• Primary Examiner(s): Anwah; Olisa
• Application Number:
  US10/970,735
• Time in Patent Office: 2,202 Days
• Field of Search: 370/466, 370/352, 370/401, 370/389, 726/1, 726/11, 726/12, 726/13, 726/14, 709/245, 709/227, 379/93.09
• US Class Current: 379/93.09
• CPC Class Codes: H04L 61/255 Maintenance or indexing of mapping tables
• CPC Class Codes: H04L 61/2564 for a higher-layer protocol, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 61/2585 through application level gateway [ALG]
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes

Abstract

A network device is configured to receive a registration message from a private user device including a private internet protocol (IP) address associated with the private user device. A public IP address and discrete port number are assigned to the private user device and private IP address and stored in an incoming call table. The registration message is translated to include the public IP address and discrete port number. The registration message is forwarded to a proxy server for registration. An incoming call invitation message is received from a public user device, where the call invitation message is directed to the public IP address and discrete port number associated with the private user device. The call invitation message is translated to include the private IP address associated with the private user device based on the received public IP address and discrete port number and the incoming call table. The call invitation message is forwarded to the private user device.

Claims

1. A method for enabling voice over internet protocol (VoIP) calls across a firewall, comprising:

receiving, by the firewall, a registration message from a private user device including a private internet protocol (IP) address associated with the private user device;

associating, by the firewall, the private user device and private IP address with a public IP address and discrete port number, the public IP address being further associated, by the firewall, with at least one other private user device;

modifying, by the firewall, the registration message to include the public IP address and discrete port number;

forwarding, by the firewall, the modified registration message to a proxy server for registration;

receiving, by the firewall and in response to forwarding the modified registration message, a call invitation message from the proxy server, the proxy server forwarding the call invitation message on behalf of a public user device, the call invitation message being directed to the public IP address and a different discrete port number associated with one private user device of the at least one private user device;

retrieving, by the firewall, a different private IP address associated with the one private user device;

translating, by the firewall, the call invitation message to include the different private IP address associated with the one private user device; and

forwarding, by the firewall, the call invitation message to the one private user device based on the different private IP address associated with the one private user device.

2. The method of claim 1, where the proxy server is a session initiation protocol (SIP) proxy and the registration message is a SIP Register message.

3. The method of claim 1, where the proxy server is an H.323 gatekeeper and the registration message is an H.323 Registration Request message.

4. The method of claim 1, further comprising:

generating an entry in an incoming call table including the private IP address and associated public IP address and discrete port number.

5. The method of claim 4, where the entry in the incoming call table associated with the private user device further includes an expiration time, after which the entry is removed from the incoming call table.

6. The method of claim 1, further comprising:

establishing a security policy to enable incoming call messages to pass the firewall based upon type.

7. The method of claim 1, further comprising:

receiving a call invitation message from a public user device, the call invitation message being directed to the public IP address and discrete port number associated with the private user device;

retrieving the private IP address associated with the private user device;

translating the call invitation message to include the private IP address associated with the private user device; and

forwarding the call invitation message to the private user device based on the private IP address associated with the private user device.

8. The method of claim 7, where retrieving the private IP address associated with the private user device, further comprises:

retrieving the private IP address associated with the private user device from an incoming call table generated when the private user device and private IP address were associated with the public IP address and discrete port number.

9. A device comprising:

a processor to;

receive a registration message from a private user device including a private internet protocol (IP) address associated with the private user device;

associate the private user device and private IP address with a public IP address and discrete port number, the public IP address being further associated, by the device, with at least one other private user device;

modify the registration message to include the public IP address and discrete port number;

forward the modified registration message to a proxy server for registration;

receive, in response to forwarding the modified registration message, a call invitation message from the proxy server, the proxy server forwarding the call invitation message on behalf of a public user device, the call invitation message being directed to the public IP address and a different discrete port number associated with one private user device of the at least one other private user device;

retrieve a different private IP address associated with the one private user device;

translate the call invitation message to include the different private IP address associated with the one private user device; and

forward the call invitation message to the one private user device based on the different private IP address associated with the one private user device.

10. The device of claim 9, where the proxy server is a session initiation protocol (SIP) proxy and the registration message is a SIP Register message.

11. The device of claim 9, where the processor is further to:

generate an entry in an incoming call table including the private IP address and associated public IP address and discrete port number.

12. The device of claim 9, where the processor is further to:

establish a security policy to enable incoming call messages to pass the device based upon type.

13. The device of claim 9, where the processor is further to:

receive a call invitation message from a public user device, the call invitation message being directed to the public IP address and discrete port number associated with the private user device;

retrieve the private IP address associated with the private user device;

translate the call invitation message to include the private IP address associated with the private user device; and

forward the call invitation message to the private user device based on the private IP address associated with the private user device.

14. The device of claim 13, where the processor, when retrieving the private IP address associated with the private user device, is further to:

retrieve the private IP address associated with the private user device from an incoming call table generated when the private user device and private IP address are associated with the public IP address and discrete port number.

15. A non-transient computer-readable memory device having stored thereon instructions, executable by a processor, where the processor, when executing the instructions, is to:

receive a registration message from a private user device including a private internet protocol (IP) address associated with the private user device;

associate the private user device and private IP address with a public IP address and discrete port number, the public IP address being further associated, by the device, with at least one other private user device;

modify the registration message to include the public IP address and discrete port number;

forward the modified registration message to a proxy server for registration;

receive, in response to forwarding the modified registration message, a call invitation message from the proxy server, the proxy server forwarding the call invitation message on behalf of a public user device, the call invitation message being directed to the public IP address and a different discrete port number associated with one private user device of the at least one other private user device;

retrieve a different private IP address associated with the one private user device;

translate the call invitation message to include the different private IP address associated with the one private user device; and

forward the call invitation message to the one private user device based on the different private IP address associated with the one private user device.

16. The non-transient computer-readable memory device of claim 15, where the proxy server is an H.323 gatekeeper and the registration message is an H.323 Registration Request message.

17. The non-transient computer-readable memory device of claim 15 where the processor, when executing the instructions, is further to:

generate an entry in an incoming call table including the private IP address and associated public IP address and discrete port number.

18. The non-transient computer-readable memory device of claim 17, where the entry in the incoming call table associated with the private user device further includes an expiration time, after which the entry is removed from the incoming call table.

19. The non-transient computer-readable memory device of claim 15, where the processor, when executing the instructions, is further to:

establish a security policy to enable incoming call messages to pass the device based upon type.

20. The non-transient computer-readable memory device of claim 15, where the processor, when executing the instructions, is further to:

receive a call invitation message from a public user device, the call invitation message being directed to the public IP address and discrete port number associated with the private user device;

retrieve the private IP address associated with the private user device;

translate the call invitation message to include the private IP address associated with the private user device; and

forward the call invitation message to the private user device based on the private IP address associated with the private user device.

21. The non-transient computer-readable memory device of claim 20, where the processor, when executing the instructions to retrieve the private IP address associated with the private user device, is further to:

retrieve the private IP address associated with the private user device from an incoming call table generated when the private user device and private IP address are associated with the public IP address and discrete port number.