Data communication method and system

• US 20060095768A1
• Filed: 10/26/2005
• Published: 05/04/2006
• Est. Priority Date: 10/26/2004
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Hoshino, Kazuyoshi, Fujishiro, Takahiro, Takata, Osamu, Kaji, Tadashi, Takeuchi, Keisuke
• Granted Patent: US 8,010,793 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

A data communication method for forwarding a session control message designating a destination server with an IP address to the destination server via a session management server, wherein, when an application program or encrypted communication software on a client issues a connection request designating a destination server with an IP address, the client or the session management server automatically converts the IP address into a desired resource identifier identifiable a domain, thereby to determine the domain to which the received connection request message should be forwarded.

Claims

1. A data communication method for communication between a client and a server via a communication network to which session management servers are connected, comprising:

a first step of sending from said client to first one of said session management servers a query, in which an IP address of a destination server is specified, to search for a resource identifier including a domain name assigned to the destination server;

a second step of retrieving by said first one of said session management servers a resource identifier corresponding to the IP address of said destination server from a location table indicating the correspondence of IP addresses to resource identifiers, and notifying said client of the resource identifier;

a third step of transmitting a connection request message from said client to said first one of said session management servers, said connection request message designating a request resource with the resource identifier of said destination server; and

a fourth step of determining, by said first one of said session management servers having received the connection request message, a forwarding destination of the received message based on a domain name included in the resource identifier specified in the received message, and forwarding the received message to the destination server or second one of said session management servers managing a domain to which the destination server belongs.

4. The data communication method according to claim 1, further comprising:

a fifth step of replying, in response to receiving said connection request message, a connection response message including parameters required for encrypted data communication from said destination server to said client via said first or second one of said session management servers; and

a sixth step of communicating packets of messages encrypted in accordance with the parameters specified in said connection response message between said client and said destination server.

7. The data communication method according to claim 1, wherein said first and second one of said session management servers are Session Initiation Protocol (SIP) servers, and messages to be communicated between said client and said first and second one of said session management servers are encrypted according to Transport Layer Security (TLS) defined in RFC 3261.

10. The data communication method according to claim 4, wherein data to be communicated between said client and said destination server is encrypted according to Internet Protocol Security (IPsec) defined in RFC 2401.

2. A data communication method for communication between a client and a server via a communication network to which session management servers are connected, comprising:

a first step of transmitting a connection request message from said client to first one of said session management servers, said connection request message specifying a request resource with an IP address of a destination server;

a second step of retrieving, by said first one of said session management servers having received said connection request message, a resource identifier corresponding to the IP address of said destination server from a location table indicating the correspondence of IP addresses to resource identifiers;

a third step of changing by said first one of said session management servers the IP address specifying the request resource in the received message to the resource identifier retrieved from said location table; and

a fourth step of determining by said first one of said session management servers a forwarding destination of the received message based on a domain name included in the resource identifier, and forwarding the received message to the destination server or second one of said session management servers managing a domain to which the destination server belongs.

5. The data communication method according to claim 2, further comprising:

a fifth step of replying, in response to receiving said connection request message, a connection response message including parameters required for encrypted data communication from said destination server to said client via said first or second one of said session management servers; and

a sixth step of communicating packets of messages encrypted in accordance with the parameters specified in said connection response message between said client and said destination server.

8. The data communication method according to claim 2, wherein said first and second one of said session management servers are Session Initiation Protocol (SIP) servers, and messages to be communicated between said client and said first and second one of said session management servers are encrypted according to Transport Layer Security (TLS) defined in RFC 3261.

11. The data communication method according to claim 5, wherein data to be communicated between said client and said destination server is encrypted according to Internet Protocol Security (IPsec) defined in RFC 2401.

3. A data communication method for communication between a client and a server via a communication network to which session management servers are connected, comprising:

a first step of sending from said client to a destination server a query for a resource identifier including a domain name assigned to the server;

a second step of sending the resource identifier from said server to said client;

a third step of transmitting a connection request message from said client to first one of said session management servers, said connection request message designating a request resource with the resource identifier of said destination server; and

a fourth step of determining, by said first one of said session management servers having received the connection request message, a forwarding destination of the received message based on a domain name included in said resource identifier specified in the received connection request message, and forwarding the received message to the destination server or second one of said session management servers managing a domain to which the destination server belongs.

6. The data communication method according to claim 3, further comprising:

a fifth step of replying, in response to receiving said connection request message, a connection response message including parameters required for encrypted data communication from said destination server to said client via said first or second one of said session management servers; and

a sixth step of communicating packets of messages encrypted in accordance with the parameters specified in said connection response message between said client and said destination server.

9. The data communication method according to claim 3, wherein said first and second one of said session management servers are Session Initiation Protocol (SIP) servers, and messages to be communicated between said client and said first and second one of said session management servers are encrypted according to Transport Layer Security (TLS) defined in RFC 3261.

12. The data communication method according to claim 6, wherein data to be communicated between said client and said destination server is encrypted according to Internet Protocol Security (IPsec) defined in RFC 2401.

13. A session management server for communicating with a client and a server via a communication network, comprising:

first means for retrieving, when a connection request message designating a request resource with an IP address of a destination server is received from said client, a resource identifier of said destination server corresponding to the IP address from a location table indicating the correspondence of IP addresses to resource identifiers, and changing the IP address designating the request resource in the received message to said resource identifier; and

second means for determining a forwarding destination of the received message based on a domain name included in said resource identifier, and forwarding the received message to the destination server or another session management server managing a domain to which the destination server belongs.

14. The session management server according to claim 13, further comprising:

a network interface connected to said communication network;

a message processing module for processing session control messages; and

a security module for decrypting an encrypted message received from said network interface to transfer a decrypted message to said message processing module and for encrypting a session control message received from said message processing module to output an encrypted message to said network interface,

wherein said message processing module is provided with the functions of said first means for changing the description of said request resource and said second means for forwarding the received message.

15. A client terminal for communicating with a session management server and a server via a communication network, comprising:

a network interface connected to said communication network;

a message processing module for processing session control messages;

a first security module for encrypting a transmission message generated by an application program and addressed to a destination server to output an encrypted message to said network interface and decrypting an encrypted message received from said network interface to transfer a decrypted message to said application program; and

a security information control module for outputting, when a request to exchange encryption parameters with a destination server occurs, a connection request message designating the destination server with an IP address to said message processing module and for transferring, when a connection response message is received from said message processing module, encryption parameters extracted from the received message to said first security module,

wherein said message processing module obtains, when the connection request message is received from said security information control module, a resource identifier of the destination server from said session management server or the destination server based on the IP address, and transmits said connection request message, in which a request resource is specified with the resource identifier, to said session management server.

16. The client terminal according to claim 15, further comprising

a second security module for decrypting an encrypted session control message received from said network interface to transfer a decrypted message to said message processing module and encrypting a session control message received from said message processing module to output an encrypted message to said network interface module,

wherein data to be communicated with said destination server is encrypted by said first security module and messages to be communicated with said session management server are encrypted by said second security module.