METHOD OF COMMUNICATING PACKET MULTIMEDIA TO RESTRICTED ENDPOINTS

• US 20090135837A1
• Filed: 01/26/2009
• Published: 05/28/2009
• Est. Priority Date: 11/20/2003
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Mohaban, Shai
• Granted Patent: US 7,907,525 B2
• Time in Patent Office: Days
• US Class Current: 370/400
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

A method, performed in a network element, for communicating packet multimedia data between a first endpoint and a second endpoint, the method comprising the machine-implemented steps of receiving an outbound multimedia data packet; determining if the outbound multimedia data packet originated from a first endpoint that is logically behind a security device; determining and storing information identifying a logical pinhole in the security device, wherein the logical pinhole is associated with expected inbound multimedia data packets directed to the first endpoint; performing an action that keeps the logical pinhole open during all of a communication session between the first endpoint and the second endpoint; and forwarding inbound multimedia data packets directed from the second endpoint to the first endpoint via the logical pinhole.

Claims

1. A method, performed by a network element, for communicating packet multimedia data between a first endpoint and a second endpoint, the method comprising:

receiving an outbound multimedia signaling packet;

determining if the outbound multimedia signaling packet originated from a first endpoint that is logically behind a security device;

determining and storing information identifying a logical pinhole in the security device, wherein the logical pinhole is associated with expected inbound multimedia data packets directed to the first endpoint;

sending a command to the first endpoint to modify a frequency at which the first endpoint generates periodic messages towards a signaling controller in order to keep the logical pinhole open; and

forwarding inbound multimedia signaling messages directed towards the first endpoint via the logical pinhole.

2. The method of claim 1, wherein the first endpoint is configured to begin communications by first addressing the signaling controller which receives the outbound multimedia signaling packets.

3. The method of claim 1, further comprising instructing one or more media controllers to forward all subsequent multimedia packets from the first endpoint to the second endpoint.

4. The method of claim 1, further comprising:

determining that the first endpoint permits adding a software component that generates periodic messages for keeping the logical pinhole open;

installing the software component; and

activating the software component to generate the periodic messages,

wherein the command to the first endpoint causes the software component to modify the frequency at which it generates the periodic messages.

5. The method of claim 1, wherein sending a command to the first endpoint comprises sending a command to the first endpoint through the pinhole, wherein the command forces the endpoint to respond with a message that keeps the logical pinhole open.

6. The method of claim 1, further comprising:

determining, from the outbound multimedia signaling packet, address information identifying a local network address of the first endpoint and an address of a security device that the first endpoint is behind;

storing the address information in association with information identifying the first endpoint;

receiving a request to provide the physical location of the first endpoint; and

providing, in a response message, the address information for the first endpoint.

7. The method of claim 6, wherein providing the address information comprises:

embedding the address information associated with the first endpoint in the signaling packet; and

communicating the signaling packet towards a destination entity.

8. The method of claim 1, further comprising:

receiving a keep-alive message from the first endpoint;

determining that the keep-alive message originated from a registered endpoint; and

acknowledging the keep-alive message without forwarding the keep-alive message to a call-control server that services calls from and to the first endpoint.

9. The method of claim 8, further comprising maintaining separate keep-alive timeout values for communications from an endpoint to the signaling controller and from the signaling controller to the call control server.

10. The method of claim 1, further comprising:

receiving a signaling message from the first endpoint;

allocating a port pair on a media controller for the use of streams of media;

modifying the signaling message to point the streams of media to an address and port that have been allocated at the media controller for processing packets of a communication session between the second endpoint and the first endpoint;

forwarding the modified signaling message to a destination entity, wherein the media controller determines the logical pinhole based on receiving the streams of media from the second endpoint at the allocated address and port; and

waiting at the media controller for the streams of media to arrive from both endpoints so media pinholes can be detected and the streams of media can be relayed between the two endpoints.

11. An apparatus for communicating packet multimedia data between a first endpoint and a second endpoint, the apparatus comprising:

a communication interface that receives an outbound multimedia signaling packet;

a processor configured to;

determine if the outbound multimedia signaling packet originated from a first endpoint that is logically behind a security device;

determine and store information identifying a logical pinhole in the security device, wherein the logical pinhole is associated with expected inbound multimedia data packets directed to the first endpoint;

forward inbound multimedia signaling messages directed towards the first endpoint via the logical pinhole; and

a storage module that stores the information identifying the logical pinhole,

wherein the communication interface sends a command to the first endpoint to modify a frequency at which the first endpoint generates periodic messages towards a signaling controller in order to keep the logical pinhole open.

12. The apparatus of claim 11, wherein the first endpoint is configured to begin communications by first addressing a signaling controller which receives the outbound multimedia signaling packets.

13. The apparatus of claim 11, wherein the communication interface sends a command to one or more media controllers to forward all subsequent multimedia packets from the first endpoint to the second endpoint.

14. The apparatus of claim 11, wherein the processor is configured to:

determine that the first endpoint permits adding a software component that generates periodic messages for keeping the logical pinhole open;

install the software component; and

activate the software component to generate the periodic messages,

wherein the command to the first endpoint causes the software component to modify the frequency at which it generates the periodic messages.

15. The apparatus of claim 11, wherein the communication interface sends the command to the first endpoint through the pinhole to force the endpoint to respond with a message that keeps the logical pinhole open.

16. The apparatus of claim 11,

wherein the processor is configured to determine, from the outbound multimedia signaling packet, address information identifying a local network address of the first endpoint and an address of a security device that the first endpoint is behind, and

wherein the storage module stores the address information in association with information identifying the first endpoint, and wherein the communication interface:

receives a request to provide the physical location of the first endpoint, and sends, in a response to the request, the address information for the first endpoint.

17. The apparatus of claim 11,

wherein the communication interface receives a keep-alive message from the first endpoint,

wherein the processor is configured to determine that the keep-alive message originated from a registered endpoint, and

wherein the communication interface acknowledges the keep-alive message without forwarding the keep-alive message to a call-control server that services calls from and to the first endpoint.

18. The apparatus of claim 17, wherein the storage module stores separate keep-alive timeout values for communications from an endpoint to a signaling controller and from the signaling controller to the call control server.

19. The apparatus of claim 11, further comprising:

a media controller,

wherein the communication interface receives a signaling message from the first endpoint,

wherein the media controller allocates a port for the use of streams of media,

wherein the processor modifies the signaling message to point the streams of media to an address and port that have been allocated at the media controller for processing packets of a communication session between the second endpoint and the first endpoint,

wherein the communication interface forwards the modified signaling message to a destination entity, wherein the media controller determines the logical pinhole based on receiving the streams of media from the second endpoint at the allocated address and port, and

wherein the media controller waits for media to arrive from both endpoints so media pinholes can be detected and media can be relayed between the two endpoints.