Method and system for TCP turn operation behind a restrictive firewall
View Patent ↗A method at a computing client located behind a NAT and restrictive-access firewall, including establishing a control connection with a TCP TURN server utilizing a port capable of traversing the restrictive-access firewall; requesting an allocation of an client service identity from the TCP TURN server; and receiving, from the TCP TURN server, a response containing the client service identity, the client service identity being independent of any port used to communicate with the TCP TURN server. Further a method at a TCP TURN server, including listening on a first port for communications from a computing client, the computing client being behind a restrictive access firewall and the first port capable of traversing the restrictive-access firewall; establishing a control connection with the client on the first port; receiving a request for an allocation of an client service identity from the computing client; and sending a response containing the client service identity.
1. A method at a computing client located behind a network address translator (NAT) and restrictive-access firewall, the method comprising:
establishing a control connection with a transmission control protocol (TCP) Traversal Using Relays Around NAT (TURN) server utilizing a port capable of traversing the restrictive-access firewall;
requesting, over the control connection, an allocation of a client service identity from the TCP TURN server, the requesting including an indication to the TCP TURN server that the computing client prefers to be allocated the client service identity rather than a port number; and
receiving, over the control connection from the TCP TURN server, a response containing the client service identity,
wherein the client service identity is independent of any port used to communicate with the TCP TURN server, wherein the client service identity identifies at least one of the computing client and a service on the computing client to the TCP TURN server.
2. The method of claim 1 , wherein the client service identity uniquely identifies at least one of:
the computing client at the TCP TURN server and
a service on the computing client.
3. The method of claim 1 , wherein the receiving includes determining whether the response includes the client service identity.
4. The method of claim 1 , further comprising advertising the client service identity to at least one peer computing device.
5. A computing device comprising:
a processor; and
a communications subsystem,
wherein the computing device is located behind a network address translator (NAT) and restrictive-access firewall and is configured to:
establish a control connection, via the communications subsystem, with a transmission control protocol (TCP) Traversal Using Relays Around NAT (TURN) server utilizing a port capable of traversing the restrictive-access firewall;
request, over the control connection, an allocation of an client service identity from the TCP TURN server, the request including an indication to the TCP TURN server that the computing, client prefers to be allocated the client service identity rather than port number; and
receive, over the control connection from the TCP TURN server, a response containing the client service identity,
wherein the client service identity is independent of any port used to communicate with the TCP TURN server, and wherein the client service identity identifies at least one of the computing device and a service on the computing device to the TCP TURN server.
6. The computing device of claim 5 , wherein the client service identity uniquely identifies at least one of:
the computing device at the TCP TURN server and
a service on the computing device.
7. The computing device of claim 5 , further configured to determine whether the response includes the client service identity.
8. The computing device of claim 5 , further configured to advertise the client service identity to at least one peer computing device.
9. A method at a TCP Traversal Using Relays Around Network Address Translator (TURN) server, the method comprising:
listening on a first port for communications from a computing client, the computing client being behind a restrictive access firewall and the first port capable of traversing the restrictive-access firewall;
accepting a control connection with the computing client on the first port;
receiving, over the control connection, a request for an allocation of a client service identity from the computing client;
sending, over the control connection, a response containing the client service identity;
receiving a first message after connection establishment, wherein the control connections between the computing client and the TURN server use the same port on the TURN server as data connections and peer connections, and the connection type is a peer connection if a first message after connection establishment is not one of: an allocate request and a connection bind request; and
if the first message identifies a peer connection, extracting the client service identity from the first message in a session protocol layer or above,
wherein the client service identity is independent of any port used to communicate with the TCP TURN server, and wherein the client service identity identifies at least one of the computing client and a service on the computing client to the TCP TURN server.
10. The method of claim 9 , wherein a first message after connection establishment at the TCP TURN server determines a connection type.
11. The method of claim 9 , wherein if the first message is an allocate request, the connection type is a control connection.
12. The method of claim 9 , wherein if the first message is a connection bind request then the connection type is a data connection.
13. The method of claim 9 , wherein the first message is the client service identity.
14. The method of claim 13 , wherein the client service identity is associated with an attribute value.
15. The method of claim 9 , wherein the client service identity is embedded in one of:
a uniform resource identifier; and
a uniform resource locator.
16. The method of claim 9 , wherein the client service identity is embedded in a host request-header of an HTTP message.
17. The method of claim 16 , wherein the client service identity is a fully qualified domain name (FQDN), and the DNS resolution of the client service identity returns the IP address of the TCP TURN server.
18. The method of claim 9 , wherein the TCP TURN server buffers the message that has the client service identity embedded and sends the buffered message to the computing client upon binding the data connection and peer connection.
19. The method of claim 9 , wherein the request received at the TURN server includes an indication that the computing client prefers to be allocated the client service identity rather than a port number.
20. The method of claim 9 , wherein the client service identity uniquely identifies at least one of:
the computing client; and
a service on the computing client.
21. The method of claim 9 , further comprising advertising the client service identity to at least one peer computing device.
22. The method of claim 21 , wherein the advertising comprises receiving a query from the at least one peer computing device and providing the client service identity to the at least one peer computing device.
23. The method of claim 9 , further comprising accepting a peer connection with a peer computing device, receiving a first message with the client service identity from the peer computing device, and sending a connection attempt request to the computing client identified by the client service identity.
24. The method of claim 23 , wherein the peer connection is accepted on the first port.
25. The method of claim 23 , wherein the peer connection is accepted on a second port, wherein the second port is capable of traversing a restrictive access firewall between the TURN server and the peer computing device.
26. The method of claim 9 , further comprising receiving a connect request at the TCP TURN server from a computing client, the connect request containing an address for a peer computing device and the TCP TURN server uses an unspecified source port to establish a TCP connection to the peer.
27. The method of claim 9 , the network upon which the peer resides is a restrictive access IP network.
28. The method of claim 9 , the TCP TURN server can serve a plurality of Clients and a plurality of Peers with one of:
one port and
two ports.
29. A TCP Traversal Using Relays Around Network Address Translator (TURN) server comprising:
a processor;
a communications subsystem,
wherein the TCP TURN server is configured to:
listen, via the communications subsystem, on a first port for communications from a computing client, the computing client being behind a restrictive access firewall and the first port capable of traversing the restrictive-access firewall;
accept a control connection with the computing client on the first port;
receive, over the control connection, a request for an allocation of an client service identity from the computing client;
send, over the control connection, a response containing the client service identity;
receive a first message after connection establishment, wherein the control connections between the computing client and the TURN server use the same port on the TURN server as data connections and peer connections, and the connection type is a peer connection if a first message after connection establishment is not one of: an allocate request and a connection bind request; and
if the first message identifies a peer connection, extract the client service identity from the first message in a session protocol layer or above,
wherein the client service identity is independent of any port used to communicate with the TCP TURN server, and wherein the client service identity identifies at least one of the computing client and a service on the computing client to the TCP TURN server.
30. The TCP TURN server of claim 29 , wherein a first message after connection establishment at the TCP TURN server determines a connection type.
31. The TCP TURN server of claim 30 , wherein if the first message is an allocate request, the connection type is a control connection.
32. The TCP TURN server of claim 30 , wherein if the first message is a connection bind request then the connection type is a data connection.
33. The TCP TURN server of claim 29 , wherein the first message is the client service identity.
34. The TCP TURN server of claim 33 , wherein the client service identity is associated with an attribute value.
35. The TCP TURN server of claim 29 , wherein the client service identity is embedded in one of:
a uniform resource identifier and
a uniform resource locator.
36. The TCP TURN server of claim 29 , wherein the client service identity is embedded in a host request-header of an HTTP message.
37. The TCP TURN server of claim 36 , wherein the client service identity is a fully qualified domain name (FQDN), and the DNS resolution of the client service identity returns the IP address of the TCP TURN server.
38. The TCP TURN server of claim 29 , wherein the TCP TURN server buffers the message that has the client service identity embedded and sends the buffered message to the computing client upon binding the data connection and peer connection.
39. The TCP TURN server of claim 29 , wherein the request received at the TURN server includes an indication that the computing client prefers to be allocated the client service identity rather than a port number.
40. The TCP TURN server of claim 29 , wherein the client service identity uniquely identifies at least one of:
the computing client and
a service on the computing client.
41. The TCP TURN server of claim 29 , further configured to advertise the client service identity to at least one peer computing device.
42. The TCP TURN server of claim 41 , further configured to advertise by receiving a query from the at least one peer computing device and providing the client service identity to the at least one peer computing device.
43. The TCP TURN server of claim 29 , further configured to accept a peer connection with a peer computing device, receiving a first message with the client service identity from the peer computing device, and sending a connection attempt request to the computing client identified by the client service identity.
44. The TCP TURN server of claim 43 , wherein the peer connection is accepted on the first port.
45. The TCP TURN server of claim 43 , wherein the peer connection is accepted on a second port, wherein the second port is capable of traversing a restrictive access firewall between the TURN server and the peer computing device.
46. The TCP TURN server of claim 29 , further configured to receive a connect request at the TCP TURN server from a computing client, the connect request containing an address for a peer computing device and the TCP TURN server uses an unspecified source port to establish a TCP connection to the peer.
47. The TCP TURN server of claim 29 , the network upon which the peer resides is a restrictive access IP network.
48. The TCP TURN server of claim 29 , the TCP TURN server can serve a plurality of Clients and a plurality of Peers with one of:
one port and
two ports.