Real-time media communications over firewalls using a control protocol
View Patent ↗In one embodiment of the invention, a real-time firewall processor includes a controller and a filter. The controller specifies a filtering characteristic based on a control protocol from a call server serving a firewall between a source and a destination networks. The filter is coupled to the controller to filter a packet in a call transmitted from the source network based on the filtering characteristic, the filter accepting the packet if the packet satisfies the filtering characteristic and rejecting the packet otherwise.
1. An apparatus comprising:
a controller to specify a filtering characteristic based on a control protocol from a call server serving a firewall between a source network and a destination networks; and
a filter coupled to the controller to filter a packet in a call transmitted from the source network based on the filtering characteristic, the filter accepting the packet if the packet satisfies the filtering characteristic and rejecting the packet otherwise.
2. The apparatus of claim 1 wherein the controller further specifies a modifying action based on the control protocol.
3. The apparatus of claim 2 further comprises: a
modifier coupled to the controller and the filter to modify the accepted packet based on the modifying action, the modified packet being sent to the destination network.
4. The apparatus of claim 3 wherein the modifying action is one of an address swapping, a port swapping, and a protocol conversion.
5. The apparatus of claim 4 wherein the protocol conversion is a conversion between an IPv4 and an IPv6.
6. The apparatus of claim 3 wherein the filter comprises:
an extractor to extract a packet characteristic from the packet;
a matcher coupled to the extractor to match the packet characteristic with the filtering characteristic; and
a packet router coupled to the matcher to route the packet to the modifier if the packet characteristic matches the filtering characteristic.
7. The apparatus of claim 1 wherein the source network is one of a public network,and a private network.
8. The apparatus of claim 1 wherein the destination network is one of a public network and a private network.
9. The apparatus of claim 1 wherein the filtering characteristic is one of a traffic characteristic, a network address, and a port identifier corresponding to the call.
10. The apparatus of claim 9 wherein the call is a voice over Internet protocol (VoIP) call.
11. The apparatus of claim 1 wherein the rejected packet is sent to an application firewall.
12. The apparatus of claim 1 wherein the control protocol is one of a megaco protocol and a Common Open Policy Service (COPS) protocol.
13. A method comprising:
specifying a filtering characteristic based on a control protocol from a call server serving a firewall between a source network and a destination network;
filtering a packet in a call transmitted from the source network based on the filtering characteristic; and
accepting the packet if the packet satisfies the filtering characteristic, and rejecting the packet otherwise.
14. The method of claim 13 wherein specifying further comprises specifying a modifying action based on the control protocol.
15. The method of claim 14 further comprises:
modifying the accepted packet based on the modifying action using a modifier, the modified packet being sent to the destination network.
16. The method of claim 15 wherein filtering comprises:
extracting a packet characteristic from the packet;
matching the packet characteristic with the filtering characteristic; and
routing the packet to the modifier if the packet characteristic matches the filtering characteristic.
17. The method of 14 wherein the modifying action is one of an address swapping, a port swapping, and a protocol conversion.
18. The method of claim 17 wherein the protocol conversion is a conversion between an IPv4 and an IPv6.
19. The method of claim 13 wherein the source network is one of a public network and a private network.
20. The method of claim 13 wherein the destination network is one of a public network and a private network.
21. The method of claim 13 wherein the filtering characteristic is one of a traffic characteristic, a network address, and a port identifier corresponding to the call.
22. The method of claim 21 wherein the call is a voice over Internet protocol (VoIP) call.
23. The method of claim 13 wherein the rejected packet is sent to an application firewall.
24. The method of claim 13 wherein the control protocol is one of a megaco protocol and a Common Open Policy Service (COPS) protocol.
25. A computer program product comprising:
a machine useable medium having computer program code embedded therein, the computer program product having:
computer readable program code to specify a filtering characteristic based on a control protocol from a call server serving a firewall between a source network and a destination network; and
computer readable program code to filter a packet in a call transmitted from the source network based on the filtering characteristic; and
computer readable program code to accept the packet if the packet satisfies the filtering characteristic and rejecting the packet otherwise.
26. The computer program product of claim 25 wherein the computer readable program code to specify further comprises specifying a modifying action based on the control protocol.
27. The computer program product of claim 26 further comprises:
computer readable program code to modify the accepted packet based on the modifying action using a modifier, the modified packet being sent to the destination network.
28. The computer program product of claim 27 wherein the computer readable program code to filter comprises:
computer readable program code to extract a packet characteristic from the packet;
computer readable program code to match the packet characteristic with the filtering characteristic; and
computer readable program code to route the packet to the modifier if the packet characteristic matches the filtering characteristic.
29. The computer program product of 26 wherein the modifying action is one of an address swapping, a port swapping, and a protocol conversion.
30. The computer program product of claim 29 wherein the protocol conversion is a conversion between an IPv4 and an IPv6.
31. The computer program product of claim 25 wherein the source network is one of a public network and a private network.
32. The computer program product of claim 25 wherein the destination network is one of a public network and a private network.
33. The computer program product of claim 25 wherein the filtering characteristic is one of a traffic characteristic, a network address, and a port identifier corresponding to the call.
34. The computer program product of claim 33 wherein the call is a voice over Internet protocol (VoIP) call.
35. The computer program product of claim 25 wherein the rejected packet is sent to an application firewall.
36. The computer program product of claim 25 wherein the control protocol is one of a megaco protocol and a Common Open Policy Service (COPS) protocol.
37. A system comprising:
a source network and destination network;
an application firewall coupled to the source and destination networks; and
a real-time firewall coupled to the source and destination networks to process real-time packets, the real-time fire-wall comprising:
a controller to specify a filtering characteristic based on a control protocol from a call server serving a firewall between the source and the destination networks, and
a filter coupled to the controller to filter a packet in a call transmitted from the source network based on the filtering characteristic, the filter accepting the packet if the packet satisfies the filtering characteristic and rejecting the packet otherwise.
38. The system of claim 37 wherein the controller further specifies a modifying action based on the control protocol.
39. The system of claim 38 further comprises:
a modifier coupled to the controller and the filter to modify the accepted packet based on the modifying action, the modified packet being sent to the destination network.
40. The system of claim 39 wherein the modifying action is one of an address swapping, a port swapping, and a protocol conversion.
41. The system of claim 40 wherein the protocol conversion is a conversion between an IPv4 and an IPv6.
42. The system of claim 37 wherein the source network is one of a public network and a private network.
43. The system of claim 39 wherein the filter comprises:
an extractor to extract a packet characteristic from the packet;
a matcher coupled to the extractor to match the packet characteristic with the filtering characteristic; and
a packet router coupled to the matcher to route the packet to the modifier if the packet characteristic matches the filtering characteristic.
44. The system of claim 37 wherein the destination network is one of a public network and a private network.
45. The system of claim 37 wherein the filtering characteristic is one of a traffic characteristic, a network address, and a port identifier corresponding to the call.
46. The system of claim 45 wherein the call is a voice over Internet protocol (VOIP) call.
47. The system of claim 37 wherein the rejected packet is sent to an application firewall.
48. The system of claim 37 wherein the control protocol is one of a megaco protocol and a Common Open Policy Service (COPS) protocol.
49. An apparatus comprising:
a controller to specify a filtering characteristic based on a control protocol from a call server serving a firewall between a source and a destination networks;
a filter coupled to the controller to filter a packet in a call transmitted from the source network based on the filtering characteristic, the filter accepting the packet if the packet satisfies the filtering characteristic and rejecting the packet otherwise; and
a modifier coupled to the controller and the filter to modify the accepted packet based on a modifying action, the modified packet being sent to the destination network.
50. The apparatus of claim 49 wherein the controller further specifies the modifying action based on the control protocol.
51. The apparatus of claim 49 wherein the source network is one of a public network and a private network.
52. The apparatus of claim 49 wherein the destination network is one of a public network and a private network.