Method and system for providing secure communications between proxy servers in support of interdomain traversal

1. A method for providing packetized communication services, the method comprising:

receiving a request specifying a directory number for establishing a communication session from a first endpoint to a second endpoint, wherein the first endpoint is behind a first network address translator of a first domain, and the second endpoint is within a second domain;

communicating with a service provider network to determine a network address for communicating with the second endpoint based on the directory number, to determine existence of a second network address translator within the second domain, and to establish, if the network address can be determined, a media path between the first endpoint and the second endpoint based on the network address to support the communication session; and

establishing an encrypted message data session between the first and second endpoints by establishing an encrypted message data session with a proxy server according to a cryptographic protocol to support the media path, the proxy server residing within the second domain and located behind the second network address translator, and further establishing an encrypted message data session between the second endpoint and the proxy server, wherein the service provider network includes an ENUM (Electronic Number) server to determine the network address, a STUN (Simple Traversal of UDP (User Datagram Protocol)) server to determine the second network address translator, and a TURN (Traversal Using Relay NAT (Network Address Translation)) server to establish the media path.

2. A method according to claim 1 , wherein the communication session is a Voice over IP (Internet Protocol) call.

3. A method according to claim 1 , wherein the first domain and the second domain correspond either to different enterprise networks or autonomous networks.

4. A method according to claim 1 , further comprising:

converting signaling from another proxy server associated with establishment of the communication session to a format compatible with the proxy server.

5. A method according to claim 4 , wherein the proxy server utilizes Session Initiation Protocol (SIP) signaling, and the other proxy server utilizes either a SIP-type signaling or a H.323 signaling.

6. A method according to claim 1 , wherein, if the network address cannot be determined, the proxy server communicates with a media gateway coupled to a circuit-switched telephone network for termination of the communication session.

7. A method according to claim 1 , wherein the cryptographic protocol includes a Transport Layer Security (TLS) protocol.

8. A network apparatus for providing packetized communication services, the apparatus comprising:

a first communication interface configured to receive a request specifying a directory number for establishing a communication session from a first endpoint to a second endpoint, wherein the first endpoint is behind a first network address translator of a first domain, and the second endpoint is within a second domain;

a second communication interface configured to communicate with a service provider network to determine a network address for communicating with the second endpoint based on the directory number, to determine existence of a second network address translator within the second domain, and to establish, if the network address can be determined, a media path between the first endpoint and the second endpoint based on the network address to support the communication session; and

a processor configured to establish an encrypted message data session between the first and second endpoints by establishing an encrypted message data session with a proxy server according to a cryptographic protocol to support the media path, the proxy server residing within the second domain and located behind the second network address translator, and further establishing an encrypted message data session between the second endpoint and the proxy server, wherein the service provider network includes an ENUM (Electronic Number) server to determine the network address, a STUN (Simple Traversal of UDP (User Datagram Protocol)) server to determine the second network address translator, and a TURN (Traversal Using Relay NAT (Network Address Translation)) server to establish the media path.

9. An apparatus according to claim 8 , wherein the communication session is a Voice over IP (Internet Protocol) call.

10. An apparatus according to claim 8 , wherein the first domain and the second domain correspond either to different enterprise networks or autonomous networks.

11. An apparatus according to claim 8 , wherein signaling is converted from another proxy server associated with establishment of the communication session to a format compatible with the proxy server.

12. An apparatus according to claim 11 , wherein the proxy server utilizes Session Initiation Protocol (SIP) signaling, and the other proxy server utilizes either a SIP-type signaling or a H.323 signaling.

13. An apparatus according to claim 8 , wherein, if the network address cannot be determined, the proxy server communicates with a media gateway coupled to a circuit-switched telephone network for termination of the communication session.

14. An apparatus according to claim 8 , wherein the cryptographic protocol includes a Transport Layer Security (TLS) protocol.

15. A system for providing packetized communication services, the system comprising:

an address server configured to receive a request for a network address for communicating with a destination endpoint based on a directory number, wherein the directory number is specified in a call establishment request to establish a communication session from a source endpoint behind a first network address translator of a first domain, and the destination endpoint is within a second domain;

an ENUM (Electronic Number) server to determine the network address;

a STUN (Simple Traversal of UDP (User Datagram Protocol)) server configured to support determination of existence of a second network address translator within the second domain; and

a TURN (Traversal Using Relay NAT (Network Address Translation)) server configured to establish, if the network address can be determined, a media path between the source endpoint and the destination endpoint based on the network address to support the communication session,

wherein the media path includes an encrypted message data session between the source endpoint and the destination endpoint by establishing an encrypted message data session between a first proxy server residing within the first domain and a second proxy server residing within the second domain and further establishing an encrypted message data session between the source endpoint and the first proxy server and an encrypted message data session between the destination endpoint and the second proxy server.

16. A system according to claim 15 , wherein the communication session is a Voice over IP (Internet Protocol) call, and the cryptographic protocol is a Transport Layer Security (TLS) protocol.

17. A system according to claim 15 , wherein the first domain and the second domain correspond either to different enterprise networks or autonomous networks.

18. A system according to claim 15 , further comprising:

a gateway configured to convert signaling from second proxy server associated with establishment of the communication session to a format compatible with the first proxy server.

19. A system according to claim 15 , wherein the first proxy server utilizes Session Initiation Protocol (SIP) signaling, and the second proxy server utilizes either a SIP-type signaling or a H.323 signaling.

20. A method for providing packetized communication services, the method comprising:

transmitting a request to a near-end proxy server for establishing a communication session with a destination endpoint, wherein the request is transmitted through a first network address translator of a first domain, and the destination endpoint is within a second domain,

wherein the near-end proxy server is configured communicate with a service provider network to determine a network address for communicating with the second endpoint based on the directory number, to determine existence of a second network address translator within the second domain, and to establish, if the network address can be determined, a media path with the destination endpoint based on the network address to support the communication session; and

establishing an encrypted message data session between a source endpoint in the first domain and the destination endpoint by establishing an encrypted message data session with the near-end proxy server according to a cryptographic protocol to support the media path, and further establishing an encrypted message data session between the destination endpoint and a far-end proxy server within the second domain, wherein the service provider network includes an ENUM (Electronic Number) server to determine the network address, a STUN (Simple Traversal of UDP (User Datagram Protocol)) server to determine the second network address translator, and a TURN (Traversal Using Relay NAT (Network Address Translation)) server to establish the media path.

21. A method according to claim 20 , wherein the near-end proxy server is further configured to establish an encrypted message data session with the far-end proxy server that is within the second domain.

22. A method according to claim 21 , wherein the near-end proxy server utilizes Session Initiation Protocol (SIP) signaling, and the far-end proxy server utilizes either a SIP-type signaling or a H.323 signaling.

23. A method according to claim 20 , wherein the communication session is a Voice over IP (Internet Protocol) call.

24. A method according to claim 20 , wherein the first domain and the second domain correspond either to different enterprise networks or autonomous networks.

25. A method according to claim 20 , wherein the cryptographic protocol includes a Transport Layer Security (TLS) protocol.