Method and apparatus to scale authenticated firewall traversal using trusted routing point
AssigneeCisco Technology, Inc.
InventorsRam Mohan Ravindranath, Muthu Arul Mozhi Perumal
Life of this patent
Estimating the term…
Abstract
A Trusted Routing Point (TROP) generates a signaling message that includes an authorization token used to authorize a firewall to open a pinhole. The signaling message contains a first indicator that indicates whether a data field in the signaling message represents a source address of a media flow. The signaling message also includes a second indicator that indicates whether the firewall should derive the source address of the media flow from the data field. The authorization token is generated using a one-way hash function over information that may be included in the signaling message, including the first indicator and the second indicator.
Claims20
A method comprising:
- receiving a signaling message comprising:
- a token that authorizes a network device to open a pinhole that allows a media flow to traverse the network device toward a destination endpoint;
- and
- a data field identifying a source transport address of the media flow;
- deriving the source transport address of the media flow based on a first indicator and a second indicator,
- wherein the first indicator indicates whether the data field represents the source transport address of the media flow;
- and
- wherein the second indicator indicates whether the network device should derive the source transport address of the media flow from the data field;
- determining whether the token was generated by an authorized call controller;
- and
- opening the pinhole to allow the media flow to traverse the network device from the derived source transport address of the media flow toward the destination endpoint after determining that the token was generated by the authorized call controller.
A system comprising:
- a first network device configured to:
- receive a signaling message comprising:
- a token that authorizes the first network device to open a pinhole that allows a media flow to traverse the first network device toward a destination endpoint;
- and
- a data field that identifies a source transport address of the media flow;
- derive the source transport address of the media flow based on at least one of a first indicator and a second indicator,
- wherein the first indicator indicates whether the data field represents the source transport address of the media flow;
- and
- wherein the second indicator indicates whether the first network device is to derive the source transport address of the media flow from the data field;
- evaluate whether the token was generated by an authorized call controller;
- and
- open the pinhole to allow the media flow to traverse the first network device from the derived source transport address of the media flow toward the destination endpoint after determining that the token was generated by the authorized call controller;
- and
- a second network device configured to:
- receive the token from the authorized call controller;
- generate the signaling message;
- and
- send the signaling message to the first network device.
In a computer readable storage media encoded with software comprising computer instructions executable by a processor, the instructions comprising:
- receiving a Session Traversal Utilities for Network Address Translator (STUN) message comprising:
- a token authorizing a network device to open a pinhole that allows a media flow to traverse the network device;
- a data field comprising a source transport address;
- a first indicator indicating whether the data field represents the source transport address of the media flow;
- and a second indicator indicating whether the network device should derive the source transport address of the media flow from the data field;
- deriving the source transport address of the media flow based on the first indicator and the second indicator;
- validating the token;
- and
- validating the source transport address of the media flow based on validating the token.
Dependencies are inferred from the claim text.