Symmetric NAT Traversal via Relay Agent Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Symmetric Network Address Translators (NATs) pose challenges for VoIP communications by blocking SIP INVITE requests and SIP responses, and existing solutions like STUN and TURN either compromise security or are not scalable, particularly when dealing with symmetric NATs and firewalls.
Innovation Solution
A system comprising a relay agent, a NAT agent, a SIP proxy, and an application server is used to traverse symmetric NATs by routing SIP signaling messages and opening ports for media traffic, ensuring secure and scalable VoIP session establishment across symmetric NATs and firewalls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If STUN is used to traverse NAT, then VoIP communication can be established, but security is compromised
Solution Approach 1:
The patent introduces a relay agent as an intermediary component that mediates between the SIP client behind symmetric NAT and the SIP server. The relay agent performs NAT traversal by receiving SIP messages from the client, modifying their address information, and forwarding them through the symmetric NAT to the destination. This intermediary approach allows VoIP communication to establish while maintaining security, as the relay agent operates within the controlled environment of the private network rather than exposing the client directly to the public network.
2Ease of operation
If TURN is used to traverse NAT, then VoIP communication can be established, but scalability is poor
Solution Approach 1:
The patent segments the NAT traversal function by introducing a dedicated relay agent that operates independently from the SIP server. Instead of requiring the SIP server to handle all NAT traversal complexities (as in TURN), the relay agent is deployed locally at the SIP client's network, separating the traversal function from the signaling function. This segmentation enables better scalability, as multiple relay agents can be deployed across different networks without requiring a centralized scalable infrastructure.
3Object-affected harmful factors
If symmetric NAT is used for security, then unauthorized access is blocked, but SIP INVITE requests and responses are blocked
Solution Approach 1:
The patent applies preliminary action by having the relay agent modify SIP message address information before the messages encounter the symmetric NAT. The relay agent performs address translation and modification in advance, preparing the SIP messages with the correct public address information needed to traverse the symmetric NAT. This preliminary preparation ensures that when the modified SIP messages reach the symmetric NAT, they can be properly routed through the firewall without being blocked, while the symmetric NAT continues to block unauthorized access.
Data Source
AI summary
A system and method for traversing a firewall for a voice-over-IP session or other communication session uses four main components: a relay agent, and NAT 30Agent, a SIP proxy and a application server. The SIP proxy is located in the public network and SIP signaling messages are routed through the SIP proxy. The sever opens ports in the firewall for signaling between the SIP proxy and the relay agent behind the firewall. The application server also opens ports in the firewall for media traffic. The NAT 30Agent disposed in the path from the firewall to the Internet filters media packets and changes the public source address of the media packets to a predetermined address associated with the open media port.