Security and support for flexible conferencing topologies spanning proxies, firewalls and gateways

• US 8,346,849 B2
• Filed: 06/05/2008
• Issued: 01/01/2013
• Est. Priority Date: 03/02/1999
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Giloi, Claus T., Maclin, Markham, Morris, Max
• Primary Examiner(s): Maung, Zarni
• Application Number:
  US12/134,171
• Publication Number:
  US 20080298279A1
• Time in Patent Office: 1,671 Days
• Field of Search: 709/203, 709/204, 709/227, 709/249, 709/250
• US Class Current: 709/203
• CPC Class Codes: G06F 2203/04804 Transparency, e.g. transparent or translucent windows
• CPC Class Codes: G06F 3/038 Control and interface arrangements therefor, e.g. drivers or device-embedded control circuitry
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: H04L 12/1822 Conducting the conference, e.g. admission, detection, selection or grouping of participants, correlating users to one or more conference sessions, prioritising transmission
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1106 Call signalling protocols; H.323 and related
• CPC Class Codes: H04L 65/403 Arrangements for multi-party communication, e.g. for conferences data switching systems for conference H04L12/18; arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities H04M3/56; television conferencing systems H04N7/15
• CPC Class Codes: H04L 65/4038 with floor control
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04M 2203/609 Secret communication
• CPC Class Codes: H04M 3/567 Multimedia conference systems
• CPC Class Codes: H04M 7/006 Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42

Abstract

A method and system for setting up and managing secure data/audio/video conferences with a wide range of topologies is described. The disclosed method and system allow extending the range of topologies possible with the H.323 conferencing standards while overcoming T.120 negotiating constraints. Security in such conferences may be based on a trusted node system or on more complex security procedures. Furthermore, the taught conference topologies fully utilize the T.120 standards while also permitting the reach of the conferences to the extent enabled by the H.323 standards by implementing additional modules to manage the setting up and tearing down of one or more conference connections. In addition, the method and system allow for dynamically adjusting conference connections to improve bandwidth usage and utilize H.323 support for gatekeepers.

Claims

1. A system for setting up a conference over a computer network, said system comprising:

a processor; and

memory encoding computer-executable instructions that, when executed by the processor perform the steps of;

communicating with a potential-new-node using a decentralized protocol for establishing a link and a discovered address spanning gateways, proxies or firewalls;

using the discovered detailed address to invoke a centralized protocol to add the potential-new-node to the conference; and

setting up a plurality of tear-down procedures for releasing resources in accordance with the centralized protocol.

2. The system of claim 1 wherein a neighbor of a particular-conference node is either upstream or downstream of the particular-conference node.

3. The system of claim 2 further having the step of causing, responsive to a node exiting the conference, conference nodes downstream to the exiting node to exit the conference.

4. The system of claim 1 wherein the system is H.323 compliant.

5. The system of claim 4 wherein a gatekeeper may alter the discovered address of the potential-new node transparently.

6. The system of claim 1 wherein the conference is a secure conference requiring authentication of a new entrant to the conference.

7. The system of claim 6 further having the step of issuing, by a trusted certificate authority, an authenticating-certificate for the new entrant to the conference.

8. The method system of claim 1 wherein a proxy simulates the potential-new-node in the step of communicating.

9. The system of claim 8 wherein the proxy is located inside a firewall.

10. The system of claim 9 wherein a secure-encrypted port is dynamically assigned by the firewall to expand the conference.

11. The system of claim 1 wherein the conference has a daisy-chain, cascade or star topology.

12. The system of claim 11 wherein encryption/decryption is carried out at each leg of the conference.

13. The system of claim 12 wherein the conference uses a commonly shared set of keys.

14. The system of claim 1 wherein the conference has a T.120 compliant topology.

15. The system of claim 1 wherein at least one leg of the secure conference permits audio and/or video communications.

16. The system conference of claim 15 wherein the audio and/or video communications are encrypted.

17. A computer storage medium not consisting of a propagated data signal, the computer storage medium comprising computer-executable instructions that, when executed by at least one processor, perform a method for setting up a conference over a computer network, the method comprising:

communicating with a potential-new-node using a decentralized protocol for establishing a link and a discovered address spanning gateways, proxies or firewalls;

using the discovered detailed address to invoke a centralized protocol to add the potential-new-node to the conference; and

setting up a plurality of tear-down procedures for releasing resources in accordance with the centralized protocol.

18. The computer storage medium of claim 17 wherein a neighbor of a particular-conference node is either upstream or downstream of the particular-conference node.

19. The computer storage medium of claim 18 comprising instructions that, when executed by the processor, for causing, responsive to a node exiting the conference, conference nodes downstream to the exiting node to exit the conference.

20. The computer storage medium of claim 17, wherein the conference is a secure conference requiring authentication of a new entrant to the conference.