Pin-hole firewall for communicating data packets on a packet network

• US 8,015,294 B2
• Filed: 05/31/2007
• Issued: 09/06/2011
• Est. Priority Date: 08/22/2006
• Status: Active Grant

• Current Assignee: CenturyLink Intellectual Property LLC (Lumen Technologies, Inc.)
• Original Assignee: Embarq Holdings Company LLC (Lumen Technologies, Inc.)
• Inventors: Bugenhagen, Michael K., Wiley, William L.
• Primary Examiner(s): Patel; Ashok B
• Assistant Examiner(s): COSBY, LAWRENCE V
• Application Number:
  US11/809,539
• Publication Number:
  US 20080052401A1
• Time in Patent Office: 1,559 Days
• Field of Search: 709/227, 709/224
• US Class Current: 709/227
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1403 Architecture for metering, charging or billing
• CPC Class Codes: H04L 41/0677 Localisation of faults
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5051 Service on demand, e.g. definition and deployment of services in real time
• CPC Class Codes: H04L 41/5087 wherein the managed service relates to voice services management of VoIP services H04M7/0081
• CPC Class Codes: H04L 41/509 wherein the managed service relates to media content delivery, e.g. audio, video or TV
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 47/22 Traffic shaping
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04Q 3/0062 Provisions for network management

Abstract

A pin-hole firewall network communications device that includes a first port configured to communicate data packets over a packet network and a first counter module in communication with the first port. A pin-hole firewall module may be in communication with the first counter module. A call control module may be in communication with the first counter module and the pin-hole firewall function. A second counter module may be in communication with the pin-hole firewall function and the call control module. A second port may in communication with the second counter module and the packet network and be configured to communicate data packets over a second node segment of the packet network.

Claims

1. A pin-hole firewall network communications device comprising:

a first port configured to communicate data packets over a first node segment of a packet network;

a first counter module in communication with said first port;

a pin-hole firewall module in communication with said first counter module;

a call control module in communication with said first counter module and said pin-hole firewall function, the first counter module configured to count data packets communicated over the first node segment for generating a first set of network performance information associated with the first node segment;

a second counter module in communication with said pin-hole firewall module and said call control module;

a second port in communication with said second counter module, the second port configured to communicate data packets over a second node segment of the packet network;

the second counter module configured to count data packets communicated over the second node segment for generating a second set of network performance information associated with the second node segment; and

the call control module configured to communicate with the pin-hole firewall module to alter the communication of data packets between the first node segment and the second node segment, through a firewall pinhole, in response to the first set of network performance information and the second set of network performance information.

2. The device according to claim 1, further comprising a pseudo utilization counter that indicates bandwidth reservation use information to be passed along with real bandwidth utilization performance information, the bandwidth reservation use information providing an indication of bandwidth use for calls that are being setup, on hold, or reserved.

3. The device according to claim 2, wherein the call control module is configured to communicate the first set of network performance information over the second node segment.

4. The device according to claim 3, wherein the call control module is configured to communicate the second set of network performance information over the first node segment.

5. The device according to claim 1, wherein the call control module is configured to communicate the first set of network performance information and the second set of network performance information to a network management system.

6. The device according to claim 1, wherein the first node segment is a first network operated by a first service provider, and the second node segment is second network operated by a second service provider that is different from the first service provider.

7. The device according to claim 1, wherein said call control module is configured to read values of said first and second counters and communicate the values over the packet network.

8. The device according to claim 1, wherein the first and second set of network performance information include a total bandwidth value and a real-time content bandwidth value.

9. The device according to claim 1, wherein altering the communication of data packets between the first node segment to the second node segment includes decreasing communication of non-real-time content to increase communication of real-time content.

10. The device according to claim 1, wherein altering the communication of data packets between the first node segment to the second node segment includes halting communication of non-real-time content to increase communication of real-time content.

11. A method for providing communications between a first node segment and a second node segment through a firewall pinhole, the method comprising:

receiving data packet communications from a first node segment of a packet network via a first port;

counting data packets received via the first port to generate a first set of network performance information associated with the first node segment;

receiving data packet communications from a second node segment of the packet network via a second port;

counting data packets received via the second port to generate a second set of network performance information associated with the second node segment; and

altering the communication of data packets between the first node segment and the second node segment through the pinhole firewall in response to the first set of network performance information and the second set of network performance information.

12. The method according to claim 11, further comprising determining bandwidth reservation use information, the bandwidth reservation use information providing an indication of bandwidth use for calls that are being setup, on hold, or reserved.

13. The method according to claim 12, further comprising communicating the first set of network performance information over the second node segment.

14. The method according to claim 13, further comprising communicating the second set of network performance information over the first node segment.

15. The method according to claim 11, further comprising communicating the first set of network performance information and the second set of network performance information to a network management system.

16. The method according to claim 11, wherein the first node segment is a first network operated by a first service provider, and the second node segment is second network operated by a second service provider that is different from the first service provider.

17. The method according to claim 11, further comprising:

reading values from the first and second counters; and

communicating the values the packet network.

18. The method according to claim 11, wherein the first and second set of network performance information include a total bandwidth value and a real-time content bandwidth value.

19. The method according to claim 11, wherein altering the communication of data packets between the first node segment to the second node segment includes decreasing communication of non-real-time content to increase communication of real-time content.

20. The method according to claim 19, wherein altering the communication of data packets between the first node segment to the second node segment includes halting communication of non-real-time content to increase communication of real-time content.