# US 8,543,818 B2 · Controlling communications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,818 B2 - Document ID: US8543818B2 - Status: Granted - Kind: B2 - Application number: 12/941,648 - Filed: 2010-11-08 - Published: 2011-05-19 - Granted: 2013-09-24 - Earliest claimed: 2009-11-09 - Assignees: Skype - Applicants: Madis Kaal; Henn Ruukel - Inventors: Madis Kaal; Henn Ruukel - Web page: https://patentgrep.com/patent/US8543818B2 ## CPC - H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 65/1053: IP private branch exchange [PBX] functionality entities or arrangements (circuit switched PBXs H04M3/00) - H04L 65/1069: Session establishment or de-establishment - H04L 65/1094: Inter-user-equipment sessions transfer or sharing - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A gateway, program and method for use in a packet-based communication system. The gateway comprises: a connection to a public packet-based network comprising a public-network server and a plurality of public-network user terminals; a connection to a private packet-based network comprising a private-network server and a plurality of private-network user terminals each installed with a public-network communication client; a processing device arranged to receive a login request from a public-network client of a private-network user terminal, and in response to initiate both a private-network authentication procedure involving the private-network server and a public-network authentication procedure involving the public-network server, so as subject to both authentication procedures to enable establishment of a communication channel between one of the public-network user terminals and the public-network client of the private-network user terminal; wherein the processing device is further configured to apply a control policy to communications occurring over said channel. ## Claims ### Claim 1 A gateway for use in a packet-based communication system, the gateway comprising: a connection to a public packet-based network comprising a public-network server and a plurality of public-network user terminals; a connection to a private packet-based network comprising a private-network server and a plurality of private-network user terminals each installed with a public-network communication client; processing device having one or more processor arranged to receive a login request from a public-network client of a private-network user terminal, and in response to initiate both a private-network authentication procedure involving the private-network server and a public-network authentication procedure involving the public-network server, so as subject to both authentication procedures to enable establishment of a communication channel between one of the public-network user terminals and the public-network client of the private-network user terminal; wherein the processing device is further configured to apply a control policy to communications occurring over said channel, the control policy configured to include: a policy associated with blocking a communication associated with at least one identified user; and a policy associated with blocking at least one identified type of communication. ### Claim 2 (depends on 1) The gateway of claim 1, for use in a packet-based voice or video communication system, wherein the processing device is arranged so as subject to both authentication procedures to enable establishment of a live voice or video call between one of the public-network user terminals and the public-network client of the private-network user terminal, and to apply the control policy to said call. ### Claim 3 (depends on 1) The gateway of claim 1, for integrating the private network with a peer-to-peer communication system implemented over the public network, wherein the public-network authentication procedure comprises retrieval of an authentication certificate from the public-network server for use in peer-to-peer certificate exchange with said public-network user terminals. ### Claim 4 (depends on 1) The gateway of claim 1, wherein the initiation of the public-network authentication procedure is conditional upon successful completion of the private-network authentication procedure. ### Claim 5 (depends on 1) The gateway of claim 1, wherein the processing device is arranged to receive a login request from a public-network client of a private-network user terminal temporarily connected outside of the private network to the public network, and in response to initiate said authentications. ### Claim 6 (depends on 1) The gateway of claim 1, wherein said control policy comprises one or more configurable settings. ### Claim 7 (depends on 1) The gateway of claim 1, wherein the control policy is stored at the private-network server, and the processing device is configured to apply the control policy by referring to said private-network server. ### Claim 8 (depends on 1) The gateway of claim 1, wherein the processing device is configured to apply the control policy by triggering the private-network server to transfer a copy of at least a part of the control policy to the private-network user terminal, such that the control policy is set at the private-network server but applied at least in part at the private-network user terminal. ### Claim 9 (depends on 8) The gateway of claim 8, wherein the processing device is configured to apply the control policy by triggering the private-network server to transfer said copy of at least part of the control policy to the private-network user terminal upon login. ### Claim 10 (depends on 1) The gateway of claim 1, wherein the processing device is configured to apply the control policy by receiving a query signal from the private-network user terminal upon call set-up, and responding with a response signal determined by the control policy. ### Claim 11 (depends on 1) The gateway of claim 1, wherein the processing device is configured to apply the control policy by mediating in call set-up signalling between the public-network user terminal and the public-network client of the private-network user terminal. ### Claim 12 (depends on 1) The gateway of claim 1, wherein the processing device is configured to publish the public-network address of all private-network terminals as an address of the gateway, such that a call initiated by a public-network terminal is at least initiated via the gateway. ### Claim 13 (depends on 1) The gateway of claim 1, wherein the gateway is a separate unit from the private-network server. ### Claim 14 (depends on 1) The gateway of claim 1, wherein the gateway is incorporated into the same unit as the private-network server. ### Claim 15 A method for use in a packet-based communication system implemented over a public packet-based network comprising a public-network server and a plurality of public-network user terminals, and a private packet-based network comprising a private-network server and a plurality of private-network user terminals each installed with a public-network communication client, the method comprising: receiving a login request from a public-network client of a private-network user terminal; in response to the login request, initiating both a private-network authentication procedure involving the private-network server and a public-network authentication procedure involving the public-network server; subject to both authentication procedures, enabling establishment of a communication channel between one of the public-network user terminals and the public-network client of the private-network user terminal; and applying a control policy to communications occurring over said channel, the control policy originating from the private-network and configured to include at least one policy associated with identifying at least one condition associated with blocking a communication over said channel. ### Claim 16 (depends on 15) The method as recited in claim 15, wherein the at least one condition is configured to identify blocking a communication associated with Instant Messaging (IM). ### Claim 17 (depends on 15) The method as recited in claim 15, further comprising retrieving the control policy from the private-network server. ### Claim 18 A computer program product for use in a packet-based communication system implemented over a public packet-based network comprising a public-network server and a plurality of public-network user terminals, and a private packet-based network comprising a private-network server and a plurality of private-network user terminals each installed with a public-network communication client, the computer program product comprising code embodied on computer-readable storage memory and configured so as, responsive to execution on a gateway between the public and private networks, to: receive a login request from a public-network client of a private-network user terminal; in response to the login request, initiate both a private-network authentication procedure involving the private-network server and a public-network authentication procedure involving the public-network server; subject to both authentication procedures, enable establishment of a communication channel between one of the public-network user terminals and the public-network client of the private-network user terminal; and ensure a control policy is applied to communications occurring over said channel, wherein to ensure the control policy is applied to communications comprises an ability to transfer the control policy to at least one private-network user terminal of the plurality of private-network user terminals. ### Claim 19 (depends on 18) The computer program product as recited in claim 18, wherein the control policy comprises at least one policy configured to identify at least one user whose communication to the private-network is blocked. ### Claim 20 (depends on 18) The computer program product as recited in claim 18, wherein the control policy comprises at least one policy configured to identify at least one call forwarding policy associated with a communication using the private-network.