Method for securing RTS communications across middleboxes

• US 7,639,668 B2
• Filed: 05/31/2005
• Issued: 12/29/2009
• Est. Priority Date: 05/31/2005
• Status: Active Grant

• Current Assignee: LGS Innovations LLC (CACI International Incorporated)
• Original Assignee: Alcatel-Lucent USA, Inc. (Nokia Corporation)
• Inventors: Stott, David Thomas
• Primary Examiner(s): Lee, Andrew
• Application Number:
  US11/141,516
• Publication Number:
  US 20060272009A1
• Time in Patent Office: 1,673 Days
• Field of Search: 370/389, 370/392, 370/352, 370/401, 709/227, 709/228, 709/230
• US Class Current: 370/352
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]

Abstract

A new method is provided for establishing real-time services that can coexist with NAT and firewalls, even when the signaling protocol uses cryptography. A communication channel between the call server and the middlebox passes information between them about the bearer channels associated with each signaling session.

Claims

1. A method for a call server to support a media session between a local endpoint and a remote endpoint, the local endpoint belonging to a local network that includes a middlebox which comprises a NAT, the method comprising:

a) in a signaling session, receiving a message from the local endpoint or the remote endpoint, wherein the message requests to establish a connection for the media session and contains local and remote address information for the requested media session, and the local address information comprises private address information;

b) forwarding the local and remote address information to the middlebox so that the middlebox will be able to identify packets associated with the media session from at least said information and will thereby be able to appropriately process said packets;

c) receiving a mapping from the NAT which relates the private address information to public address information for the local endpoint;

d) forwarding the mapping to the local endpoint;

e) receiving a revised version of the message from the local endpoint, wherein the public address information has been substituted for the private address information; and

f) forwarding the revised version of the message to a host computer associated with, respectively, the remote endpoint or the local endpoint.

2. The method of claim 1, wherein at least part of the revised version of the message is encrypted.

3. The method of claim 1, wherein at least part of the revised version of the message has an appended digital signature.

4. A method for a call server to support a media session between a local endpoint and a remote endpoint, the local endpoint belonging to a local network that includes a middlebox which comprises a NAT, the method comprising:

a) in a signaling session, receiving a message from the local endpoint or the remote endpoint, wherein the message requests to establish a connection for the media session and contains local and remote address information for the requested media session, and the local address information comprises private address information;

b) selecting public address information for the local endpoint from a stored block of public address information;

c) creating a mapping which relates the private address information to the selected public address information;

d) forwarding the mapping and the local and remote address information to the middlebox so that the middlebox will be able to identify packets associated with the media session from at least said information and will thereby be able to appropriately process said packets;

e) causing the NAT to activate the mapping;

f) forwarding the mapping to the local endpoint;

g) receiving a revised version of the message from the local endpoint, wherein the public address information has been substituted for the private address information; and

h) forwarding the revised version of the message to a host computer associated with, respectively, the remote endpoint or the local endpoint.