Routing VOIP calls through multiple security zones

Abstract

Call setup signaling is performed across at least a first security zone, a second security zone, and a third security zone to set up a call. At least one gate is then established between the first security zone and the third security zone to enable traffic flow for the call between the first security zone and the third security zone.

Description

BACKGROUND OF THE INVENTION[0001]A. Field of the Invention[0002]The principles of the invention relate generally to packet transmission, and more particularly, to transmission of multimedia related packets across multiple security zones.[0003]B. Description of Related Art[0004]With the increasing ubiquity of the Internet and Internet availability, there has been an increasing desire to leverage its robust and inexpensive architecture for voice telephony services, commonly referred to as voice over IP (internet protocol), or VoIP. Toward this end, standards for internet telephony have been promulgated by the both the International Telecommunication Union Telecommunication Standardization Sector (ITU-T) in the form of H.323 rev 5 (2003), “Packet based multimedia communications systems” as well as the Internet Engineering Task Force (IETF) in the form of RFC 3261 (2002), “Session Initiation Protocol (SIP)” to enable set-up and teardown of the media sessions.[0005]Under each of these st...

AI Technical Summary

Benefits of technology

The invention relates to a method and network device for routing voice packets across multiple security zones. The technical effect of the invention is to enable secure communication between users located in different security zones, while ensuring that sensitive information is not compromised. The network device dynamically routes call invitation messages between users, proxies, and devices in different security zones, ensuring that the communication is always secure.

Problems solved by technology

The existence of addressing information in packet payloads has caused difficulties with respect to both firewall and network address translation (NAT) implementation.

Unfortunately, it is the rigorous and strict nature of most conventional firewalls themselves that typically prevents successful establishment of VoIP sessions.

This information is dynamically assigned upon generation of the each message and cannot be adequately predicted by the firewall.

Accordingly, when media from either party is received at the firewall, its passage is denied because no enabling policy is identified.

Clearly, this is untenable from a security standpoint.

In addition to problems posed by the restrictive nature of firewalls alone, many firewalls also implement NAT.

Unfortunately, as discussed above, addressing information for VoIP traffic may be contained within the payload information as well as the header of outgoing packets.

Accordingly, conventional NATs fail to accurately translate all outgoing traffic, resulting in dropped or discarded failed connections.

Unfortunately, current ALGs fail to support scenarios involving more than two distinct security zones where call messages are routed through multiple zones between calling parties.

Images