Soft switch using distributed firewalls for load sharing voice-over-IP traffic in an IP network

• US 20030058839A1
• Filed: 02/28/2002
• Published: 03/27/2003
• Est. Priority Date: 09/27/2001
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: DʼSouza, Maurice G.
• Granted Patent: US 7,072,332 B2
• Time in Patent Office: Days
• US Class Current: 370/352
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 65/1043 Gateway controllers, e.g. media gateway control protocol [MGCP] controllers
• CPC Class Codes: H04L 65/1083 In-session procedures
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/1106 Call signalling protocols; H.323 and related
• CPC Class Codes: H04M 7/00 Arrangements for interconnection between switching centres
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04Q 3/0025 Provisions for signalling

Abstract

A switch capable of handling voice-over-IP (VoIP) traffic between calling devices and called devices. The switch comprises: 1) call application nodes for executing call process server applications, wherein a first call process server application and a similar second call process server application form a first load sharing group server application; and 2) network address translation nodes for executing firewall server applications. A first firewall server application executed on a first network address translation node is associated with a similar second firewall server application executed on a second network address translation nodes separate from the first network address translation node. The first and second firewall server applications form a second load sharing group server application. The second load sharing group server application receives VoIP traffic and selects one of the first and second firewall server applications to verify that the VoIP traffic is authorized to access at least one of the call process server applications in the call application nodes according to a load distribution algorithm.

Claims

1. A switch capable of handling voice-over-IP (VoIP) traffic between calling devices and called devices, said switch comprising:

a plurality of call application nodes capable of executing call process server applications, wherein a first call process server application is executed on a first one of said plurality of call application nodes and is associated with a similar second call process server application executed on a second one of said plurality of call application nodes separate from said first call application node, said first and second call process server applications thereby forming a first load sharing group server application; and

a plurality of network address translation nodes capable of executing firewall server applications, wherein a first firewall server application is executed on a first one of said plurality of network address translation nodes and is associated with a similar second firewall server application executed on a second one of said plurality of network address translation nodes separate from said first network address translation node, said first and second firewall server applications thereby forming a second load sharing group server application, wherein VoIP traffic associated with VoIP calls is received by said second load sharing group server application and said second load sharing group server application selects one of said first and second firewall server applications to verify that said VoIP traffic is authorized to access at least one of said call process server applications in said call application nodes according to a load distribution algorithm.

2. The switch as set forth in claim 1 wherein said load distribution algorithm distributes said VoIP traffic in an alternating manner between said first and second firewall server applications.

3. The switch as set forth in claim 1 wherein said load distribution algorithm distributes said VoIP traffic according to a current traffic load of said first firewall server application and a current traffic load of said second firewall server application.

4. The switch as set forth in claim 3 wherein said load distribution algorithm distributes said VoIP traffic in order to maintain said current traffic load of said first firewall server application at a level substantially equal to said current traffic load of said second firewall server application.

5. The switch as set forth in claim 1 wherein said first firewall server application comprises a first primary-backup group server application, wherein said first primary-backup group server application comprises a first primary firewall process executed on said first network address translation node and a first backup firewall process associated with said first primary firewall process.

6. The switch as set forth in claim 5 wherein state information associated with said first primary firewall process is mirrored to said first backup firewall process associated with said first primary firewall process.

7. The switch as set forth in claim 6 wherein said first backup firewall process resides on said first network address translation node.

8. The switch as set forth in claim 6 wherein said first backup firewall process resides on a network address translation node separate from said first network address translation node.

9. The switch as set forth in claim 1 wherein said second firewall server application comprises a second primary-backup group server application, wherein said second primary-backup group server application comprises a second primary firewall process executed on said second network address translation node and a second backup firewall process associated with said second primary firewall process.

10. The switch as set forth in claim 9 wherein state information associated with said second primary firewall process is mirrored to said second backup firewall process associated with said second primary firewall process.

11. The switch as set forth in claim 10 wherein said second backup firewall process resides on said second network address translation node.

12. The switch as set forth in claim 10 wherein said second backup firewall process resides on a call application node separate from said second network address translation node.

13. A telecommunications network comprising:

a plurality of switches capable of handling voice-over-IP (VoIP) traffic between calling devices and called devices, each of said plurality of switches comprising;

a plurality of call application nodes capable of executing call process server applications, wherein a first call process server application is executed on a first one of said plurality of call application nodes and is associated with a similar second call process server application executed on a second one of said plurality of call application nodes separate from said first call application node, said first and second call process server applications thereby forming a first load sharing group server application; and

a plurality of network address translation nodes capable of executing firewall server applications, wherein a first firewall server application is executed on a first one of said plurality of network address translation nodes and is associated with a similar second firewall server application executed on a second one of said plurality of network address translation nodes separate from said first network address translation node, said first and second firewall server applications thereby forming a second load sharing group server application, wherein VoIP traffic associated with VoIP calls is received by said second load sharing group server application and said second load sharing group server application selects one of said first and second firewall server applications to verify that said VoIP traffic is authorized to access at least one of said call process server applications in said call application nodes according to a load distribution algorithm; and

an Internet protocol (IP) packet network for interconnecting said plurality of switches; and

at least one media gateway coupled to said IP packet network.

14. The telecommunications network as set forth in claim 13 wherein said load distribution algorithm distributes said VoIP traffic in an alternating manner between said first and second firewall server applications.

15. The telecommunications network as set forth in claim 13 wherein said load distribution algorithm distributes said VoIP traffic according to a current traffic load of said first firewall server application and a current traffic load of said second firewall server application.

16. The telecommunications network as set forth in claim 15 wherein said load distribution algorithm distributes said VoIP traffic in order to maintain said current traffic load of said first firewall server application at a level substantially equal to said current traffic load of said second firewall server application.

17. The telecommunications network as set forth in claim 13 wherein said first firewall server application comprises a first primary-backup group server application, wherein said first primary-backup group server application comprises a first primary firewall process executed on said first network address translation node and a first backup firewall process associated with said first primary firewall process.

18. The telecommunications network as set forth in claim 17 wherein state information associated with said first primary firewall process is mirrored to said first backup firewall process associated with said first primary firewall process.

19. The telecommunications network as set forth in claim 18 wherein said first backup firewall process resides on said first network address translation node.

20. The telecommunications network as set forth in claim 18 wherein said first backup firewall process resides on a network address translation node separate from said first network address translation node.

21. The telecommunications network as set forth in claim 13 wherein said second firewall server application comprises a second primary-backup group server application, wherein said second primary-backup group server application comprises a second primary firewall process executed on said second network address translation node and a second backup firewall process associated with said second primary firewall process.

22. The telecommunications network as set forth in claim 21 wherein state information associated with said second primary firewall process is mirrored to said second backup firewall process associated with said second primary firewall process.

23. The telecommunications network as set forth in claim 22 wherein said second backup firewall process resides on said second network address translation node.

24. The telecommunications network as set forth in claim 22 wherein said second backup firewall process resides on a call application node separate from said second network address translation node.