Middlebox control
View Patent ↗In order to carry out actions such as setting up a call from an entity in the address realm of one middlebox to an entity in the address realm of another middlebox, then a middlebox control node such as a call server is used. Previously, the middlebox control node has needed to have pre-configured information about all the middleboxes and which address realms they are associated with. The present invention provides one or more middlebox-identity-providing nodes which are separate from the middlebox control node, and which are more directly connected to the end users of the service than the middlebox control node. This provides greater flexibility in network design and removes the need for middlebox information to be pre-configured at the middlebox control node. Instead, this information is sent to the middlebox control node, as part of signalling messages, from middlebox-identity-providing nodes.
1. A method of controlling one of a plurality of middleboxes in a communications network, each of the middleboxes being connected to a plurality of entities in a respective one of a plurality of address realms of the communications network, said method comprising the steps of:
(i) receiving a control message at a middlebox-identity-providing node in the communications network, said control message comprising information about one of the entities in the communications network;
(ii) using the middlebox identity providing node to determine the identity of a first middlebox connected to said one entity in its respective one of the plurality of address realms;
(iii) sending said identity to a middlebox control node in the communications network in order to enable said middlebox control node to send middlebox control messages to said first middlebox, said middlebox control node being located in a different address realm than that of said one of the entities;
and wherein the middlebox-identity-providing node is separate from the middlebox control node and is located in a control signal path from said one of the entities to the middlebox control node.
2. A method as claimed in claim 1 wherein said step (iii) of sending said identity comprises adding said identity to a control message and sending said control message.
3. A method as claimed in claim 2 wherein additional information is also added to the control message.
4. A method as claimed in claim 2 wherein said control message is a session description protocol (SDP) message.
5. A method as claimed in claim 4 wherein said identity is added to an SDP message using a pre-specified SDP attribute.
6. A method as claimed in claim 1 wherein said control message is a call set-up message and said method further comprises sending middlebox control messages to said first middlebox in order to set-up a call from said one entity to another entity connected to a second middlebox in the communications network.
7. A method as claimed in claim 6 wherein said second middlebox is connected to a plurality of entities in a second address realm different from the first address realm of the entities connected to the first middlebox.
8. A method as claimed in claim 7 wherein the middlebox control node is within a third address realm different from the first and second address realms.
9. A method as claimed in claim 8 wherein the third address realm is public.
10. A method as claimed in claim 9 wherein the first and second address realms are private.
11. A method as claimed in claim 1 wherein the middlebox-identity-providing node is selected from: one of the middleboxes; a gateway in the communications network; said one entity, being a user terminal in the communications network; and a gateway comprising a business services channel manager (BSCM).
12. A method as claimed in claim 6 wherein said call passes through two or more middleboxes and wherein information about the identity of each such middlebox is added to said control message.
13. A method as claimed in claim 1 wherein said middlebox control node is a MIDCOM agent.
14. A method as claimed in claim 1 wherein each of the middleboxes is selected from a firewall, a network address translator (NAT), and a quality of service device.
15. A method as claimed in claim 1 wherein said middlebox-identity-providing node is arranged to determine the identity of the first middlebox by using pre-specified information.
16. A method as claimed in claim 1 wherein said middlebox-identity-providing node is arranged to determine the identity of the first middlebox by automatically analysing the communications network.
17. A communications network comprising:
(i) a plurality of middleboxes, each connected to a plurality of entities in a respective one of a plurality of address realms of the communications network;
(ii) a middlebox-identity-providing node arranged to receive a control message comprising information about one of the entities and to determine the identity of a first middlebox connected to said one entity in its respective one of the plurality of address realms;
(iii) a middlebox control node arranged to receive the determined identity of the first middlebox in order to enable said middlebox control node to send middlebox control messages to said first middlebox; said middlebox control node being located in a different address realm than that of said one of the entities, said middlebox-identity-providing node being separate from the middlebox control node and being located in a control signal path from said one of the entities to the middlebox control node.
18. A communications network as claimed in claim 17 wherein said middlebox-identity-providing node is further arranged to send said determined identity to the middlebox control node as part of a control message.
19. A communications network as claimed in claim 18 wherein said control message is a session description protocol message.
20. A middlebox control node arranged to control a plurality of middleboxes in a communications network, said middlebox control node comprising:
(i) an input arranged to receive a control message comprising information about the identity of one of the middleboxes;
(ii) a processor arranged to issue messages to the identified middlebox in order to control it; such that in use the middlebox control node is able to control the identified middlebox without the need to maintain its own store of information about the identities of the middleboxes and without the need to maintain its own discovery mechanism to discover the identities of the middleboxes.
21. A middlebox-identity-providing node for use in a communications network comprising a plurality of middleboxes, said middlebox identity providing node comprising:
(i) an input arranged to receive a control message comprising information about one of a plurality of entities in the communications network;
(ii) a processor arranged to determine the identity of a first middlebox connected to said one entity in a respective one of a plurality of address realms;
(iii) an output arranged to send said identity to a middlebox control node in the communications network, said middlebox control node being located in a different address realm than that of said one of the entities; and wherein said middlebox-identity-providing node is arranged to be located in a control signal path from said one of the entities to the middlebox control node.
22. A computer readable medium comprising program instructions arranged to control a middlebox control node, said middlebox control node comprising an input arranged to receive a control message comprising information about the identity of one of the middleboxes; and a processor arranged to issue messages to the identified middlebox in order to control it; such that in use the middlebox control node is able to control the identified middlebox without the need to maintain its own store of information about the identities of the middleboxes and without the need to maintain its own discovery mechanism to discover the identities of the middleboxes;
the computer program comprising program code executable by the processor in order to enable the middlebox control node to:
receive a control message comprising information about the identity of one of the middleboxes; and to
issue messages to the identified middlebox in order to control it.
23. A non-transitory computer readable medium comprising program instructions arranged to control a middlebox-identity-providing node, said middlebox identity providing node comprising an input arranged to receive a control message comprising information about one of a plurality of entities in the communications network; a processor arranged to determine the identity of a first middlebox connected to said one entity in a respective one of a plurality of address realms; and
an output arranged to send said identity to a middlebox control node in the communications network, said middlebox control node being located in a different address realm than that of said one of the entities; and wherein said middlebox-identity-providing node is arranged to be located in a control signal path from said one of the entities to the middlebox control node;
the computer program comprising program code executable by the processor in order to enable the middlebox identity-providing node to:
receive a control message comprising information about one of a plurality of entities in the communications network;
determine the identity of a first middlebox connected to said one entity; and
send said middlebox identity to a middlebox control node in the communications network.
24. A method as claimed in claim 1 , wherein the first middlebox is arranged to act as two or more independent middleboxes and wherein the step of providing the identity of the first middlebox to the middlebox control node comprises providing the identity of the first middlebox and the identity of a particular middlebox functionality relating to one of said two or more independent middleboxes that is to be used.
25. A method as claimed in claim 1 , wherein the middlebox identity providing node uses a discovery algorithm to automatically obtain information about the identity of middleboxes in the communications network.
26. A method as claimed in claim 1 , wherein the middlebox identity providing node uses a discovery algorithm to automatically obtain information about the identity of middleboxes in the communications network prior to one of the receiving and determining steps.