Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
  • H04L63/029—Firewall traversal, e.g. tunnelling or, creating pinholes
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
  • H04L63/1433—Vulnerability analysis
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
  • H04L65/1066—Session management
  • H04L65/1069—Session establishment or de-establishment
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
  • H04L65/60—Network streaming of media packets
  • H04L65/65—Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]

Definitions

• IP Internet Protocol
• communication equipment any equipment, radio or wired, fixed or mobile (or portable) capable of connecting to at least one IP network, in order to exchange data in the form of signals with other equipment. It may therefore be, for example, a SIP server or a communication terminal, such as a landline or mobile phone, or a computer or laptop or a personal digital assistant (or PDA) equipped with an IP communication module.
• IP communication application entity is understood to mean a module, generally of software type, enabling the communication equipment in which it is implanted to establish communications over IP with another communication equipment.
• These communications may relate to a media stream, such as for example a Voice over IP (VoIP) stream or a video stream, or to signaling, for example to enable the retrieval of electronic messages in a server. messaging or establishing a media flow communication.
• the entities may for example be of the SIP type (for "Session Initiation Protocol").
• SIP Session Initiation Protocol
• Such SIP entities make it possible to create and manage data exchange sessions (in any form) between devices in which they are located, regardless of the nature of the data and the transport protocol used to transport said data.
• most IP networks are interconnected to one another via one or more network equipment such as network address translators (or NATs for "network addresses").
• firewalls fire-walls
• These network devices are particularly useful because they are responsible for either addressing the depletion of available IPv4 addresses in the case of network address translators (NATs), or for protecting IP networks by controlling their access in the network. the case of firewalls.
• NATs network address translators
• these Network devices may be "hostile" for some IP applications, such as the SIP (Session Initiation Protocol) application.
• SIP Session Initiation Protocol
• hostile conditions is understood to mean an environment that prevents a calling application entity, for example implanted in a first communication terminal, from establishing a communication with a called application entity, implemented for example in a second communication terminal or a server. proxy type.
• the first solution is known by the acronym ICE (for "Interactive Connectivity Establishment”). It is dedicated to SIP. It consists in modifying the SIP entities so that they can determine and establish the best possible path for the transmission of media flows between the communication terminals that they equip.
• ICE Interactive Connectivity Establishment
• the disadvantage of this solution (ICE) lies in the fact, on the one hand, that it allows to cross only NATs (hostile), and on the other hand, that it introduces significant modifications of SIP that prohibit communications between a terminal equipped with an ICE modified SIP entity and a terminal equipped with a SIP entity (unmodified), even in the absence of a hostile condition.
• the second solution is known as Skype. It is dedicated to IP telephony (VoIP). It consists in using super-nodes to allow a client terminal to cross a Nat and / or a firewall (hostile (s)) to communicate in VoIP with another client terminal.
• VoIP IP telephony
• s hostile
• the disadvantage of this solution (Skype) lies in the fact that being of proprietary type it uses its own mechanisms to establish VoIP communications, and therefore can not be adapted to allow other applications, and in particular at SIP, to operate in hostile conditions.
• the model of nodes and super-nodes does not correspond at all to the semi-hierarchical client-server model of SIP, which relies on the use of a server of type SIP proxy to act as an intermediary in restoring communication between SIP clients. Since no known solution is entirely satisfactory, the purpose of the invention is therefore to improve the situation.
• connection management device between at least one client (communication) terminal and at least one (communication) server, each having an IP communication application entity and belonging to interconnected IP networks.
• This management system is characterized by the fact that it comprises: connected connectivity analysis means, when they receive a connection establishment request between the calling application entity of the client terminal (or the server), to which their device is associated, and the called application entity of the server (or the client terminal), to determine a transport protocol that is suitable for establishing this connection, and connection means responsible for establishing the connection between the calling and called application entities, in accordance with the transport protocol which has has been determined by the connectivity analysis means.
• the management device may comprise other characteristics that may be taken separately or in combination, and in particular: its connectivity analysis means may be responsible for successively transmitting to the application entity called test messages at the means of different transport protocols, according to a chosen sequence, and to analyze each test response message received following the transmission of a test message, so as to choose as transport protocol that which was used to transmit the message test that has been the subject of a positive test response message;
• its connectivity analysis means may be responsible for interrupting the transmission of the test messages as soon as they receive a positive test response message
• its connectivity analysis means may be responsible for selecting the transport protocol that is best suited to the requested connection after analyzing each test response message corresponding to each transmitted test message; the different transport protocols used to carry the test messages can be chosen from UDP (User Datagram Protocol), TCP (Transmission Control Protocol) and TCP via a tunnel passing through a proxy server for HTTP Internet applications ( S); its connectivity analysis means can be loaded, when they receive a connection establishment request between the calling application entity of the client terminal (with which its device is associated) and a called application entity of another client terminal.
• UDP User Datagram Protocol
• TCP Transmission Control Protocol
• S HTTP Internet applications
• connection management device to determine, on the one hand, a first transport protocol adapted to the establishment of a signaling connection between the calling application entity and the application entity of the server , and secondly, a second transport proto ⁇ le adapted to establish a media communication connection between the calling application entity and the called application entity.
• its connection means are responsible for establishing the signaling connections and media flow communication connection in accordance with, respectively, the first and second transport protocols determined by its connectivity analysis means; it can be arranged to be configured and / or updated remotely by means of another connection management device associated with the application entity of a server of a network operator; the entities can be of the SIP type or else dedicated to the management of electronic mail; its connectivity analysis means may be responsible for managing the restoration of a signaling connection with an application entity making it possible to register a client terminal with a registration module (or "registrar"); it can be connected to a proxy server belonging to the same communication network as its own.
• the invention also proposes a server of the proxy type or a communication terminal comprising a connection management device of the type of that presented above.
• the purpose of the invention is to enable the establishment of communications between at least one IP communication application entity, implanted in a client communication terminal connected to an IP network, and at least one IP communication application entity, installed in a a server connected to another IP network, in the presence of hostile conditions.
• IP communication application entities are SIP entities (for "Session Initiation Protocol” - RFC 3261). But, the invention is not limited to type of entity. It concerns indeed any application entity dedicated to IP communications, including those for retrieving electronic messages (or emails) in a mail server.
• SIP relies on a client / server type model, in which client SIP communication terminals T1, T2, respectively connected to first R1 and second R2 (sub) IP networks can establish communications between them via a SIP proxy server SP, connected to a third (sub) IP network R3.
• the different (sub) IP networks R1 to R3 are interconnected via each other via at least one other IP RP network, playing the role of main IP network, and network equipment N1, N2 and FW.
• the first (sub) IP network R1 is connected to the main IP network RP via a first Network Address Translator (NAT) N1
• the second (subnet) ) R2 IP networks is connected to the main IP network RP through a second network address translator (or NAT) N2
• the third (sub) IP networks R3 is connected to the main IP network RP by intermediary of a firewall PF.
• another SIP terminal regardless of the nature of the data and the transport protocol used to transport said data. This may be, for example, a landline or mobile phone, or a computer or laptop or a personal digital assistant (or PDA) equipped with an IP communication module.
• SIP proxy server means a communication server SP adapted to connect to the Internet, for example via an ADSL connection or an Ethernet local area network (WLAN type for "Wireless Local Area Network”), providing a "proxy” function and comprising a SIP entity E3, also responsible for creating and managing data exchange sessions with another SIP entity located in a SIP terminal Ti. It is recalled that according to the SIP model, the establishment of a communication between first T1 and second T2 SIP terminals is in two phases.
• the first phase firstly establishes a first connection between the calling SIP entity E1 of the first SIP terminal T1 and the SIP entity E3 of a SIP proxy server SP of its choice, so as to establish between these entities E1 and E3 a signaling communication allowing in particular the transmission of the SIP addresses of the first T1 and second T2 SIP terminals and a message requesting the registration of the calling SIP entity El
• a recording module or "registrar" R, for example installed in the SIP proxy server SP
• the latter locates the SIP entity called E2 of the second SIP terminal T2 and establishes therewith a second connection for to establish a signaling communication with a view in particular to its registration.
• the second phase occurs after the first phase. It consists in establishing a third connection between the calling SIP entity E1 of the first SIP terminal T1 and the SIP entity called E2 of the second SIP terminal T2, in order to establish between them a communication of media flow.
• the media stream is voice over IP (or VoIP for "Voice over IP"). But, it could be another media data stream, such as a video data stream.
• the invention proposes a connection management device Di enabling the establishment of the SIP connection (s) necessary for the establishment of a communication between a customer SIP terminal Ti and a SIP proxy server SP. or between first and second terminal T2 SIP clients via a SIP proxy server SP. It is important to note that for the invention to be implemented it is not essential for the called SIP entity to be coupled to a connection management device Di according to the invention. It is however essential that the calling SIP entity is coupled to a connection management device Di according to the invention. In the example illustrated in the single figure, the two SIP terminals T1 and T2 are each provided (internally) with a connection management device Di, while the SIP proxy server SP is connected to a connection management device Di (external).
• a SIP entity installed in a device, be associated with a connection management device Di implanted in this same equipment.
• the SIP entity must be located in a device that is connected to the same (sub) IP network as the one to which the associated connection management device Di is connected.
• a connection management device Di (for example D1), according to the invention, is responsible, on the one hand, for controlling the connectivity between its SIP entity E1, when it is calling, and any other SIP entity called E2 or E3, and on the other hand establish connections between its calling SIP entity E1 and each SIP entity called E2 or E3. To do this, it includes a connectivity analysis module MA coupled to a connection module MC.
• the connectivity analysis module MA intervenes whenever the SIP entity E1, which is associated with its device D1, wishes to establish a communication, signaling type or media flow, with a calling SIP entity E2 or E3. More specifically, each time that it receives from its calling SIP entity E1 a request to establish connection with a SIP entity called E2 or E3, the connectivity analysis module MA begins by determining the transport protocol which is (the better) suitable for establishing this connection. This determination is essential since it is the use of a particular type of transport protocol, for example UDP or TCP, which prevents the establishment of a connection via a Ni address translator or a firewall PF.
• the connectivity analysis module MA may for example successively transmit to the SIP entity called E2 or E3 test messages by means of different transport protocols, according to a chosen sequence.
• a first test message may be transmitted to the SIP entity called E2 or E3 with a first transport protocol, for example UDP.
• a first transport protocol for example UDP.
• the connection to establish is of virtual type. If the device D1 receives a first negative test response message, that is to say that the first test message has not arrived at its destination, the connectivity analysis module MA transmits to the destination.
• SIP entity called E2 or E3 a second test message with a second transport protocol different from the previous, for example TCP.
• connection to be established is of the real type.
• the connectivity analysis module MA preferentially stops transmitting messages. and chooses the first transport protocol for establishing the requested connection, and then reports it to the connection module MC.
• the connectivity analysis module MA transmits to the SIP entity called E2 or E3 a third test message with a third transport protocol different from the previous, for example TCP via a tunnel through a proxy-type Internet server.
• the connectivity analysis module MA preferentially stops transmitting messages. and chooses the second transport protocol for establishing the requested connection, and then reports it to the connection module MC. If the device D1 receives a third negative test response message, that is to say that the third test message has not arrived at its destination, the connectivity analysis module MA transmits to the SIP entity called E2 or E3 a fourth test message with a fourth transport protocol different from the previous one. If the MA connectivity analysis module has only three transport protocols to perform its tests, the determination is terminated and it sends the calling SIP entity E1 a message that the requested connection can not be established.
• the connectivity analysis module MA preferentially stops transmitting messages. and selects the third transport protocol for establishing the requested connection, and then reports it to the connection module MC.
• the test message that is transmitted may vary depending on the transport protocol that is used to transport it. For example in the case of the UDP protocol, the test message can satisfy the STUN protocol (for "Simple Traversal of UDP through NAT" - simple UDP traversal through an address translator - RFC 3489).
• Adaptations of this STUN protocol can be made for messages to be transmitted using other transport protocols, such as for example TCP and TCP via a tunnel passing through a proxy-type Internet server.
• transport protocols such as for example TCP and TCP via a tunnel passing through a proxy-type Internet server.
• the device Di can successively transmit test messages with different transport protocols, according to a chosen sequence, and choose the transport protocol that seems to be best suited to the situation after analyzing the messages of test response corresponding to each transmitted test message. Indeed, when at least two transport protocols can be used for the same connection, it may be preferable to use one rather than the other.
• the connection module is responsible for establishing the connection that has been requested by the calling SIP entity when the connectivity analysis module MA has authorized it to do so by signaling to it the identifier of the transport protocol having succeeded with successful test. This connection is therefore established between the calling SIP entities E1 and called E2 or E3, in accordance with the transport protocol that has been determined by the connectivity analysis module MA.
• a calling SIP entity E1 wishes to establish a connection with a SIP entity called E2, located in a SIP terminal T2 and not in a SIP proxy server SP (or any other SIP server), it transmits to device D1 associated with it a first connection request for establishing a first connection with the SIP entity E3 of the SIP proxy server SP which was chosen by the user of the terminal T1 in which it is installed.
• this first connection is intended to allow the calling SIP entity E1 to send to the SIP entity called E3 a SIP registration request, as well as the SIP address of the SIP entity E2 of the SIP terminal T2.
• the SIP entity Calling E1 is therefore able to perform all of its usual tasks (of course with the exception of those related to connectivity), and in particular those needed to establish a session with the SIP E2 entity. It can in particular transmit its SIP registration request, which is managed by the registration module (or "registrar") R, which is for example implemented in the SIP proxy server SP. It can also transmit the SIP address of the entity called E2, so that the proxy server SP locates it and tries to establish with it a second connection intended to establish a signaling communication in particular for its registration.
• the registration module or "registrar”
• the SIP entity E3 of the SIP proxy server sends a connection request to the device D3 so that it implements the same method as that described above in connection with the establishment of the first connection. .
• the communication of media flow between calling SIP entities E1 and called E2 can be done only if the second signaling connection between SIP entities E2 and E3 could be done. Therefore, the device connectivity analysis module MA D3 determines the transport protocol that is suitable for establishing the second connection, then the associated connection module MC proceeds to establish the second connection according to the protocol determined transport. If the second connection can not be established, the device D3 alerts the SIP entity E3 which in turn warns the calling SIP entity E1 of the impossibility of establishing the communication with the SIP entity called E2.
• the calling SIP entities E1 and called E2 may exchange signaling data via the first and second connections in order to proceed. establishment of a third connection between them.
• the calling SIP entity E1 of the SIP terminal T1 sends the device D1 a new connection request so that it implements the same method as that described above in the context of the establishment of the first connection. Therefore, the connectivity analysis module MA of the device D1 determines the transport protocol which is adapted to the establishment of the third connection, then the associated connection module MC proceeds to establish the third connection between the entities. SIP calling E1 and called E2, according to the determined transport protocol. It is important to note that the transport protocols that are determined for establishing the first, second and third connections may be the same or different.
• a connection management device Di can be arranged in such a way that it can be configured and / or remotely updated by means of another connection management device Di 'associated with the application entity of a server of a IP (subnetwork) operator, preferably the one containing the SIP registrar R.
• the configuration or update can for example relate to the types of transport protocol that can be tested and used to perform the connections.
• connection management device Di can be implemented in the form of electronic circuits, software (or computer) modules, or a combination of circuits and software.
• connection management device Di can be downloaded to a communication terminal.
• the tasks related to connectivity and connection establishment are now provided by the connection management device Di, while the application entity Ei only has to take on the tasks related to to recovery and management of a session.
• the invention can be implemented in the presence or absence of hostile conditions. It is therefore compatible with a standard operation of the application concerned, for example SIP.
• the invention makes it possible to dynamically take into account the evolution of the conditions within the interconnected IP networks, since it makes it possible to determine the transport protocol which is (the best) adapted taking into account the conditions in progress.
• the invention also relates to mobile communication terminals.
• connection management device not limited to the embodiments of connection management device, proxy server and communication terminal described above, only by way of example, but it encompasses all the variants that may be considered by the user. skilled in the art within the scope of the claims below.
• the invention relates to other IP communication applications, and in particular applications for retrieving electronic messages (or mails) in mail servers.
• the application entity needs to load the connection management device associated with it, only to establish a single connection (signaling) with the application entity that is located in the mail server. .

Landscapes

• Engineering & Computer Science (AREA)
• Multimedia (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Security & Cryptography (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Business, Economics & Management (AREA)
• General Business, Economics & Management (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Telephonic Communication Services (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=35539470

Family Applications (1)

Country Status (3)

Family Cites Families (2)

• 2005
  • 2005-06-28 FR FR0551783A patent/FR2887724B1/fr not_active Expired - Fee Related
• 2006
  • 2006-06-27 WO PCT/EP2006/063603 patent/WO2007000459A1/fr not_active Ceased
  • 2006-06-27 EP EP06777494A patent/EP1900177A1/de not_active Ceased

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events