JP2005204216A - Call-associated resource management method for sip-alg corresponding to multiple nat/fw devices connection, and the sip-alg - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To specify a call-associated resource which is to manage on an SIP-ALG, when referring to the resource, even if the resource is linked to a plurality of NAT/FW devices or the like, and to delete the call-associated resource which relates to the plurality of NAT/FW devices or the like, for each of the NAT/FW devices or the like. <P>SOLUTION: IP addresses of NAT/FW devices (12), (22) are set to encapsulating portions of encapsulated SIP signals transmitted from the NAT/FW devices of transmission sources. If an encapsulated SIP signal is received in an SIP-ALG (51), the IP address of a NAT/FW device is acquired from its encapsulated portion as counter device identifying information. Furthermore, call identification information, such as Call-ID which is set to a SIP layer, is acquired and a set of the counter device identifying information and the calling identifying information is defined as key information for calling-associated resource management. The calling-associated resource, such as address conversion information or pinhole setting information is managed, based on the key information acquired thereafter. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to transmission / reception of SIP signals (Session Initiation Protocol) between IP communication networks across a plurality of NAT / FW devices and the like, and more specifically, SIP-ALG calls in cooperation with a plurality of NAT / FW devices and the like. The present invention relates to a related resource management method and its SIP-ALG.

  The SIP-ALG (Session Initiation Protocol-Application Level Gateway) includes a network address translation (NAT) function and a firewall (FW) function as shown in Non-Patent Documents 1 and 2. The device is intended to perform pinhole settings required for media transmission / reception such as SIP layer address conversion and RTP (Real Time Transport Protocol) signals between the calling and receiving terminals in cooperation with NAT / FW devices. SIP signals are transmitted and received, and address conversion requests and pinhole setting requests are made to the NAT / FW device as necessary.

  Further, as shown in Non-Patent Document 3, the information is held as a call-related resource from the start of the call to the end of the call, and at the end of the call, based on the stored information, an address set, a pinhole is given to the NAT / FW device. Requests deletion of settings, and at the same time deletes resources managed by itself. In addition, in order to reduce the amount of processing and processing time when performing address translation, when performing similar address translation and pinhole setting, refer to the call-related resources managed on the SIP-ALG to obtain the results. To get. That is, the call related resource also has a role as a cache.

  In RFC2543 / 3261 of Non-Patent Documents 4 and 5, call state management such as transaction state management of SIP communication and information related to the call are managed using Call-ID described in the SIP layer as key information.

  Similarly, in SIP-ALG, when connected to one NAT / FW device, key information for managing call-related resources can be managed by using a Call-ID described in the SIP layer. Is possible.

  However, in the case of cooperation with a plurality of NAT / FW devices accommodating a plurality of different private IP communication networks, when a SIP signal is transmitted / received between terminals of each private IP communication network, the same Call-ID is transmitted from the plurality of NAT / FW devices. As a result, the address translation information obtained as a result of the address translation request to a plurality of NAT / FW devices is managed based on the same key information. . In particular, when address systems of a plurality of private IP communication networks overlap, when SIP-ALG refers to a call-related resource (cache) to convert a private IP address to a global IP address, there may be a plurality of address sets. There arises a problem that the address set cannot be specified.

  Further, when a call termination resource is received, call related resources are deleted. In the case of the above call related resource management method, an encapsulated SIP signal transmitted from one NAT / FW device is received, When it is determined that the call is terminated, call related resources related to all NAT / FW devices are also deleted.

Kazuhito Hayashi, 4 people, "A Study on Address Translation Entry Management Method in SIP Application Level Gateway (SIP-ALG)", IEICE Technical Report NS2002-188, PS2002-62 (2002-12), p25-28

Junichiro Kuroki and three others, “A Study on Firewall Control Method in SIP Application Level Gateway (SIP-ALG)”, IEICE Technical Report NS2002-248 (2003-03), p105-108 2 Kazuhito Hayashi, “A Study on Call State Model in SIP Application Level Gateway (SIP-ALG)”, IEICE Technical Report NS2003-33 (2003-6), p37-40 RFC2543, “SIP: Session Initiation Protocol”, M. Handley et al., March 1999, [online], [searched on January 7, 2004], Internet <http://www.ietf.org/rfc/rfc2543 .txt? number = 2543> RFC 3261, “SIP: Session Initiation Protocol”, 7 outside J. Rosenberg, June 2002, [searched January 7, 2004], Internet <http://www.ietf.org/rfc/rfc3261.txt?number = 3261>

  In the present invention, even when linked with a plurality of NAT / FW devices, the resource can be specified when referring to the call-related resource managed on the SIP-ALG, and at the time of call termination, It is an object of the present invention to be able to delete call related resources related to a plurality of NAT / FW devices and the like for each NAT / FW device and the like.

  Claims 1 and 6 show a SIP-ALG call-related resource management method and its SIP-ALG in cooperation with a plurality of NAT / FW devices.

  In the encapsulated SIP signal transmitted from the NAT / FW device, the IP address of the transmission source NAT / FW device is set in the encapsulation unit. Therefore, when the SIP-ALG receives the encapsulated SIP signal, the IP address of the NAT / FW device is acquired as the opposing device identification information from the encapsulated portion. In addition, call identification information such as Call-ID set in the SIP layer is acquired, and a set of opposite device identification information and call identification information is used as key information for managing call-related resources. By managing call related resources such as address translation information and pinhole setting information based on the acquired key information, the call related resources can be managed for each opposing NAT / FW device and for each call.

  Claims 2 to 4 and 7 to 9 show a specific SIP-ALG call-related resource management method and its SIP-ALG.

  The SIP-ALG has an “address conversion table” as a table for holding address conversion information, a “pinhole management table” as a table for holding pinhole setting information, and a “media information collection” as a table for collecting SDP information of arrival and departure terminals. Deploy a table.

  In Claims 2 and 7, when the SIP-ALG receives an encapsulated SIP signal in a state where the table is deployed, the IP address of the NAT / FW device is acquired as the opposing device identification information from the encapsulated portion, and the SIP A first means is provided for acquiring call identification information such as Call-ID from the layer and recording those sets as key information.

  After that, when there is an IP address and Port number to be converted in the SIP layer, an address conversion request is made to the NAT / FW device obtained from the opposing device identification information, and the result is obtained by the first means. A second means for registering in the address conversion table as a record for key information is provided.

  If the SIP body SIP body part is SDP, the IP address and port number for media transmission / reception described in the SDP are collected, and the information is recorded as a record for the key information acquired by the first means. Is provided in the media information collection table.

  Furthermore, when the media transmission / reception IP address and the port number of the arrival / departure terminal can be collected, a pinhole setting request is made to the NAT / FW device obtained from the opposite device identification information based on the information, A fourth means for registering the result in the pinhole management table as a record for the key information acquired by the first means is provided.

  By providing these first to fourth means, call-related resources such as address translation information, pinhole setting information, and media information can be registered for each call and for each opposing NAT / FW device.

  In Claims 3 and 8, when performing SIP layer address conversion and pinhole setting information registration with SIP-ALG, address conversion requests and pinhole setting requests are not immediately made to the NAT / FW device. First, means for referring to an address conversion table or a pinhole management table is provided using the opposite device identification information and call identification information set acquired when the encapsulated SIP signal is received as key information.

  If there is the address set or the pinhole setting information in the result obtained by reference, the result can be obtained. If there is no address set or the pinhole setting information, the key information An address conversion request or a pinhole setting request is made to the address of the opposing device acquired from the opposing device identification information.

  By referring to the call-related resources registered in claims 2 and 7 according to claims 3 and 8, address conversion information and pinhole setting information are referred to as a cache, and address conversion for the NAT / FW device is performed. The number of requests and pinhole setting requests can be reduced.

  Claims 4 and 9 show processing at the time of call termination. When SIP-ALG receives an encapsulated SIP signal, if it is determined that the call has ended, the opposite device identification information is obtained from the encapsulating unit, the call identification information is obtained from the SIP layer, and address conversion is performed using these sets as key information. Refer to the table, pinhole management table, SDP information collection table, and if there is a record in the address conversion table or pinhole management table, the address for each NAT / FW device IP address that can be obtained from the opposing device identification information. A group deletion request and a pinhole deletion request are made, and then the record hit in the search is deleted.

  According to claims 4 and 9, it is possible to delete resources related to each call and each opposing NAT / FW device.

  In the fifth and tenth aspects, the NAT / FW device according to the first to fourth and sixth to ninth aspects is a VPN (Virtual Private Network) of Japanese Patent Application No. 2003-101526 (not disclosed at the time of the present application) by the present applicant. About a call-related resource management method in a case where a plurality of private networks can be accommodated by a single device, such as a virtual private network), and a NAT / FW can be logically deployed for each private network Show.

  As shown in the above-mentioned Patent Application Publication No. 2003-101526, the VPN accommodating apparatus also adds the VPN number to which the logical NAT / FW is connected and transfers the encapsulated SIP signal. A function to receive and send the encapsulated signal back to the original SIP signal, and specify the address translation request, address group deletion request, pinhole setting request, pinhole deletion request, etc. by the device IP address and VPN number It has a function of receiving by a logical NAT / FW in the device to be assigned, giving out an address set, setting a pinhole, and the like.

  In SIP-ALG in cooperation with the VPN accommodating device, not only the opposite device identification information is obtained from the encapsulated portion of the encapsulated SIP signal transmitted from the VPN accommodating device, but also call identification information such as Call-D is obtained from the SIP signal. A VPN number is acquired as VPN identification information from the encapsulated portion, and the set of the acquired opposite device identification information, VPN identification information, and call identification information is recorded as key information for call-related resource management. That is, by replacing the key information of claims 1 to 4 and 6 to 9 with a pair of opposing device identification information, VPN identification information, and call identification information, each call, each opposing device, and each VPN-compatible logical NAT / FW In addition, it is possible to register, refer to, and delete call-related resources independently.

  According to the present invention, a plurality of NAT / FW devices can be accommodated by one SIP-ALG, and the number of SIP-ALGs required for each NAT / FW device, etc. And efficient equipment design becomes possible.

  A first embodiment will be described with reference to FIGS.

  FIG. 1 shows a network configuration. The private network 1 (10) has a network address of 192.168.0.0/24, and a terminal 1 (11) having an IP address of 192.168.0.1 is provided.

  The private network 2 (20) has a network address of 192.168.0.0/24, and a terminal 2 (21) having an IP address of 192.168.0.1 is provided.

  The global network (30) has a network address of 128.0.0.0/16, and an SIP server (31) having an IP address of 128.0.0.1 is provided.

  The private network 1 (10) is connected to the global network (30) via the NAT / FW device 1 (12), and the private network 2 (20) is connected to the global network via the NAT / FW device 2 (22). Connected to the network (30). The NAT / FW device 1 (12) and the NAT / FW device 2 (22) are connected to the SIP-ALG (51) through a management network (40) having a network address of 172.30.0.24. The NAT / FW device 1 (12) has an IP address of 172.30.0.1, the NAT / FW device 2 (22) has an IP address of 172.30.0.2, SIP-ALG (51). Has an IP address of 172.30.3.

  When the NAT / FW device 1 (12) and the NAT / FW device 2 (22) detect the SIP signal, the encapsulated SIP signal encapsulated by covering its own IP address is transferred to the transfer destination device, that is, the SIP-ALG (51). ), Decapsulates the encapsulated SIP signal returned from the transfer destination device, and returns it to the original SIP signal. For the IP address and Port number requested for address conversion from the transfer destination device The IP address and Port number of the conversion destination were issued, the address set before and after conversion was managed, the result was returned to the transfer destination device, and the address set deletion request from the transfer destination device was issued It has a function to delete an address set, and it is also possible to set a pin for the transmission / reception IP address, port number, etc. for which a pinhole setting request has been made by the transfer destination device Function for holes set, and the transfer destination pinhole deletion requested reception IP address from the device has a function to remove pinholes Port number.

  FIG. 2 shows a network address management table. This table is provided in the SIP-ALG and is referred to when extracting the translation target address of the SIP layer.

  This table is composed of the counter device identification information, the private network side address system, and the global network side address system. The IP address of the NAT / FW device is described in the counter device identification information, and the private network side address system And the global network address system describe the address system before and after address conversion managed by each NAT / FW device.

  In FIG. 2, the private network side address system is 192.168.0.0/24 when the opposing device identification information is 172.30.0.1, and the global network side address system is 130.0.0. 0/24, the private network side address system is 192.168.0.0/24, and the global network side address system is 131.0 when the opposing device identification information is 172.30.0.2. 0.0 / 24.

  FIG. 3 shows an address conversion table. This table is deployed in SIP-ALG and is used to store resources related to address translation.

  This table is composed of opposing device identification information, call identification information, private network side IP address, port number, global network side IP address, port number, and conversion ID.

  FIG. 4 shows a media information collection table. This table is provided in SIP-ALG, and is used to store resources related to transmission / reception of media information of the terminal.

  This table is composed of opposing device identification information, call identification information, private network side IP address, port number, global network side IP address, port number, and calling / receiving terminal type.

  FIG. 5 shows a pinhole management table. This table is provided in SIP-ALG, and is used to store resources related to pinhole setting necessary for media transmission / reception between the arrival and departure terminals.

  This table is composed of opposing device identification information, call identification information, private network side IP address, port number, global network side IP address, port number, destination IP address, port number, and pinhole ID.

  The pinhole is a filter for the firewall (FW) of the NAT / FW device, and the FW allows only packets having a matched transmission / reception IP address / transmission / reception port number pair to pass through. In the present embodiment, the SIP-ALG (51) sets pinholes in the FWs of the NAT / FW device 1 (12) and the NAT / FW device 2 (22), and the media signal (mainly RTP: Real Time Transport Protocol). ) Can be transmitted / received between the terminal 1 (11) and the terminal 2 (21), and when the transmission / reception of the media signal ends, the pinhole is deleted.

  When the SIP-ALG (51) deploys the above table and receives the encapsulated SIP signal, the SIP-ALG (51) obtains the IP address of the NAT / FW device from the encapsulated portion as counter device identification information, and calls the Call- If there is a first means for acquiring call identification information such as an ID and recording those sets as key information, and an IP address and a port number to be converted in the SIP layer, it is obtained from the opposing device identification information. A second means for registering the result in the address translation table as a record for the key information obtained by the first means, and the SIP body SIP body part in SDP. If there is, collect the IP address and port number for media transmission / reception described in the SDP, If the third means for registering the information as a record for the key information acquired in the stage in the media information collection table, and the media transmission / reception IP address and port number of the terminal, can be collected. The fourth means for making a pinhole setting request to the NAT / FW device obtained from the opposing device identification information and registering the result as a record for the key information acquired by the first means in the pinhole management table And.

  The SIP-ALG process for a REGISTER call will be described with reference to FIGS.

  FIG. 6 shows a REGISTER sequence from the terminal 1 (11) to the SIP server (31).

  The terminal 1 (11) transmits REGISTER (S1) to the NAT / FW apparatus 1 (12). REGISTER (S1) is a SIP signal as shown in FIG. As shown in FIG. 7, the SIP signal has a SIP layer, a UDP layer, and an IP layer. The same applies to other SIP signals described later. Note that details of the SIP signal are defined in RFC2543 (Non-Patent Document 4) and RFC3261 (Non-Patent Document 5).

  When the REGISTER (S1) as shown in FIG. 7 is transmitted from the terminal 1 (11), the NAT / FW device 1 (12) has its own IP address, Port number, and transfer destination SIP-ALG (51). The REGISTER (S1) is encapsulated with the IP address and the Port number as shown in FIG. 8, and transferred to the SIP-ALG (51). As shown in FIG. 8, the encapsulated SIP signal has a SIP signal part and an encapsulation part, and the encapsulation part has a UDP layer and an IP layer. In FIG. 8, the SIP signal portion is abbreviated as REGISTER (S1), but the SIP signal portion in FIG. 8 is the same as the SIP signal in FIG. The same applies to other encapsulated SIP signals described later.

  When the SIP-ALG (51) receives the encapsulated REGISTER (S2), the IP address of the NAT / FW device = 172.30.0.1 as the opposing device identification information from the encapsulation unit, and the call identification information from the SIP layer As a result, Call-ID value=12345678@192.168.0.1 is acquired, and those sets are recorded as key information for call-related resource management.

  Next, referring to the network address management table of FIG. 2 using the acquired counter device identification information as key information, 192.168.0.0/24 is acquired as the address system to be converted, and the received encapsulated SIP The conversion target address is extracted from the signal. As a result, 192.168.0.1:5060 is acquired from the Via and Contact headers. As shown in Japanese Patent Application No. 2002-330300 (not published at the time of this application) by the present applicant, the REGISTER Contact header is registered using the Timer, so that the Timer value is set as the Timer value from the Expires header. 3600 (seconds) is acquired. In the address conversion of the Via header, the Timer is not normally used, but when the Contact and the Via have the same address, the Contact is given priority and the address conversion request is made using the Timer.

  In the address translation request, first, the address translation table is searched using the previously obtained key information, the obtained translation source IP address = 192.168.0.1, and the translation source port number = 5060. However, since the record cannot be obtained, the conversion source IP address = 192.168.0.1, the conversion source port number = 5060, and Timer = 3600 are designated as shown in FIG. 9, and the NAT / FW device 1 (12) Address translation request (S3), and as a result, an address translation response (S4) as shown in FIG. 10 is obtained from the NAT / FW device 1 (12), and the translated IP address = 130.0.0. 1. Obtain converted Port number = 205060.

  In the SIP-ALG (51), the previously acquired key information and the result acquired from the address conversion response are registered in the address conversion table as shown in FIG. When Timer is used, an address group deletion request is not made, so that the fact that registration is performed by Timer is registered in the conversion ID portion.

  Thereafter, in the SIP-ALG (51), the Via header and the Contact header of the SIP layer are converted, and the transmission / reception IP address and the Port number of the encapsulated part are reversed, and the encapsulated REGISTER (S5) as shown in FIG. Is returned to the NAT / FW device 1 (12).

  The NAT / FW device 1 (12) decapsulates the received encapsulated REGISTER, converts the IP signal source and UDP layer sources of the SIP signal to 130.0.0.1 and 25060, respectively, and the SIP server (31 ) REGISTER (S6) as shown in FIG. 13 is transmitted.

  In the SIP server (31), the relationship between the SIP-URI (UA1@voip.ne.jp) of the From header, the IP address of the Contact header, and the Port number is registered, and 200 OK (S7) as shown in FIG. Returned to the FW device 1 (12).

  In the NAT / FW device 1 (12), the received 200 OK signal is encapsulated as shown in FIG. 15 and transferred to the SIP-ALG (51).

  When the SIP-ALG (51) receives the encapsulated 200 OK (S8), the IP address of the NAT / FW device = 172.30.0.1 as the opposing device identification information from the encapsulation unit, and the call identification from the SIP layer Call-ID value=12345678@192.168.0.1 is acquired as information, and those sets are recorded as key information for call-related resource management.

  Next, referring to the network address management table of FIG. 2 using the acquired opposing device identification information as key information, 130.0.0.0/24 is acquired as the address system to be converted, and the received encapsulated SIP The conversion target address is extracted from the signal. As a result, 130.0.0.1:25060 is acquired from the Via and Contact headers.

  In the address translation request, first, the address translation table is searched using the previously obtained key information, the obtained translation source IP address = 130.0.0.1, and the translation source port number = 256060. Since the record already exists, as a result, converted IP = 192.168.0.1 and converted Port number = 5060 can be obtained.

  Thereafter, in the SIP-ALG (51), the Via header and the Contact header of the SIP layer are converted, and the transmission / reception IP address and Port number of the encapsulated part are reversed, and the encapsulation 200 OK (S9) as shown in FIG. ) Is returned to the NAT / FW device 1 (12).

  The NAT / FW device 1 (12) decapsulates the received encapsulation 200 OK (S9), converts the IP signal destination and UDP layer destination of the SIP signal to 192.168.0.1 and 5060, respectively. A 200 OK (S10) as shown in FIG. 17 is transmitted to the terminal 1 (11).

  In SIP-ALG, after sending the encapsulated 200 OK (S9), it is determined that the call has ended, and a record related to the previously acquired key information is searched. As a result, a record of the address conversion table is obtained. Since the conversion ID of the record is Timer, the address group deletion request is not sent to the NAT / FW device 1 (12), only the record is deleted, and all the call related resources are cleared. An address conversion table at this time is shown in FIG.

  The SIP-ALG process for an INVITE call will be described with reference to FIGS.

  4 to 18 are REGISTER calls for the terminal 1 (11) on the private network 1 (10) side, but also for the terminal 2 (21) on the private network 2 (20) side. Assuming that the same processing has already been performed, the IP address = 192.168.0.1 and the Port number = 5060 of the terminal 2 (21) are IP address = 131. It is registered by Timer to be converted to 0.0.1, Port number = 35060, and also in the SIP server (31), the SIP-URI (UA2@voip.ne.jp) of terminal 2 and the IP address = Assume that the association of 131.0.0.1 and Port number = 5060 is held.

  19 to 24 show INVITE sequences from the terminal 1 (11) to the terminal 2 (21). In this sequence, the start and end of a call and the continuation process of one part of the call are shown, and normally transmitted temporary responses such as 100 Trying and 180 Ringing, and ACK and BYE are omitted.

  First, processing at the start of a call in INVITE will be described.

  When the INVITE (S11) as shown in FIG. 25 is transmitted from the terminal 1 (11), the NAT / FW device 1 (12) performs the encapsulation, and the encapsulated INVITE (S12) as shown in FIG. Transfer to ALG (51).

  When the SIP-ALG (51) receives the encapsulated INVITE (S12), the IP address of the NAT / FW device 1 (11) = 172.30.0.1 as the opposing device identification information from the encapsulation unit, and the SIP layer As a call identification information, Call-ID value=12345678@192.168.0.1 is acquired, and those sets are recorded as key information for call-related resource management.

  Next, referring to the network address management table of FIG. 2 using the acquired counter device identification information as key information, 192.168.0.0/24 is acquired as the address system to be converted, and the received encapsulated SIP The conversion target address is extracted from the signal. As a result, 192.168.0.1:5060 is obtained from the Via and Contact headers, and 192.168.0.1 and 10000 are obtained from the c and m fields of SDP (Session Definition Protocol), respectively.

  In the address conversion request, the previously acquired key information and the acquired conversion source IP address = 192.168.0.1, conversion source port number = 5060, conversion source IP address = 192.168.0.1, conversion First, the address conversion table is searched using each of the original Port number = 10000. However, since the record cannot be obtained, first, as shown in FIG. 27, the conversion source IP address = 192.168.0.1 and the conversion source Port number = 5060 are designated, and the NAT / FW device 1 (12) is designated. Address translation request (S13), and as a result, an address translation response (S14) as shown in FIG. 28 is obtained from the NAT / FW device 1 (12), and the translated IP address = 130.0.0.1, After conversion, Port number = 205060 and Conversion ID = 2 are acquired.

  Next, as shown in FIG. 29, the source IP address = 192.168.0.1 and the source port number = 10000 are designated, and an address translation request (S15) is made to the NAT / FW device 1 (12). As a result, an address translation response (S16) as shown in FIG. 30 is obtained from the NAT / FW device 1 (12), the translated IP address = 130.0.0.1, the translated Port number = 30000, and the translated ID. = 3 is acquired.

  In the SIP-ALG (51), the previously acquired key information and the result acquired from the address conversion response are registered in the address conversion table as shown in FIG. In addition, since the media transmission / reception address of the calling terminal can be collected from the SDP, the IP address and the Port number before and after conversion of the calling terminal are registered in the media information collection table as shown in FIG.

  Thereafter, in SIP-ALG, the Via header and Contact header of the SIP layer, and the c and m fields of the SDP are converted, and the IP address of the encapsulated part, the destination of the Port number, and the source of transmission are reversed, and FIG. The encapsulated INVITE (S17) is returned to the NAT / FW device 1 (12).

  The NAT / FW device 1 (12) decapsulates the received encapsulated INVITE, converts the IP signal and UDP layer transmission sources of the SIP signal to 130.0.0.1 and 25060, respectively, and the SIP server (31 ) Is sent to INVITE (S18) as shown in FIG.

  The SIP server (31) obtains 131.0.0.1 and 35060 as the IP address and the port number of the destination terminal from the Request-URI, rewrites the Request-URI, and also the Via and Record-Route headers. , IP layer, and UDP layer are edited, and INVITE (S19) as shown in FIG. 35 is transmitted.

  The NAT / FW device 2 (22) that received INVITE (S19) encapsulates it with its own IP address, Port number, and IP address and Port number of the forwarding SIP-ALG (51) as shown in FIG. The encapsulated INVITE (S20) is transmitted to the SIP-ALG.

  When the SIP-ALG (51) receives the encapsulated INVITE (S20), the IP address of the NAT / FW device = 172.30.0.2 as the opposing device identification information from the encapsulation unit, and the call identification information from the SIP layer As a result, Call-ID value=12345678@192.168.0.1 is acquired, and those sets are recorded as key information for call-related resource management.

  Next, referring to the network address management table of FIG. 2 using the acquired opposing device identification information as key information, 131.0.0.0/24 is acquired as the address system to be converted, and the received encapsulated SIP The conversion target address is extracted from the signal. As a result, 131.0.0.1:35060 is obtained from the Request-URI.

  In the address translation request, first, the address translation table is searched using the previously obtained key information, the obtained translation source IP address = 131.0.0.1, and the translation source port number = 35060. However, since the record cannot be obtained, the source IP address = 131.0.0.1 and the source port number = 35060 are designated as shown in FIG. 37, and the address is given to the NAT / FW device 2 (22). A translation request (S21) is made, and as a result, an address translation response (S22) as shown in FIG. 38 is obtained from the NAT / FW device 2 (22), and after translation IP address = 192.168.0.1, after translation Port number = 5060 and conversion ID = 4 are acquired.

  In the SIP-ALG (51), the previously acquired key information and the result acquired from the address conversion response are registered in the address conversion table as shown in FIG. In addition, the media transmission / reception address of the calling terminal can be collected from the SDP. In the NAT / FW device 2, the SDP is a transmission destination IP address and a Port number as viewed from the terminal 2 (destination terminal), and is necessary for pinhole setting. Therefore, the information is registered in the media information collection table as shown in FIG. 40 as the IP address and Port number on the global side of the calling terminal.

  Thereafter, in SIP-ALG, the IP address and Port number of Request-URI are converted to 192.168.0.1 and 5060, respectively, and the source and destination of the encapsulated IP address and Port number are reversed. Then, the encapsulated INVITE (S23) as shown in FIG. 41 is returned to the NAT / FW apparatus 2 (22).

  In the NAT / FW device 2 (22), the encapsulated INVITE received is decapsulated, and the destinations of the SIP signal IP layer and UDP layer are converted to 192.168.0.1 and 5060, respectively, as shown in FIG. INVITE (S24) is transmitted to the terminal 2 (21).

  Next, call continuation processing at 200 OK for INVITE will be described.

  When 200 OK (S25) as shown in FIG. 43 is transmitted from the terminal 2 (21), the NAT / FW device 2 (22) performs the encapsulation, and performs the encapsulation 200 OK (S26) as shown in FIG. Transfer to SIP-ALG (51).

  When the SIP-ALG (51) receives the encapsulated 200 OK (S26), the IP address of the NAT / FW device 2 (22) = 172.30.0.2 as the opposing device identification information from the encapsulation unit, and the SIP Call-ID value=12345678@192.168.0.1 is acquired from the layer as call identification information, and these sets are recorded as key information for call-related resource management.

  Next, referring to the network address management table of FIG. 2 using the acquired counter device identification information as key information, 192.168.0.0/24 is acquired as the address system to be converted, and the received encapsulated SIP The conversion target address is extracted from the signal. As a result, 192.168.0.1:5060 is obtained from the Contact header, and 192.168.0.1 and 10000 are obtained from the c and m fields of the SDP, respectively.

  In the address conversion request, the previously acquired key information and the acquired conversion source IP address = 192.168.0.1, conversion source port number = 5060, conversion source IP address = 192.168.0.1, conversion First, the address conversion table is searched using each of the original Port number = 10000.

  Among them, for the conversion source IP address = 192.168.0.1 and the conversion source Port number = 5060, since the record already exists, as a result, the converted IP = 131.0.0.1, After conversion, Port number = 35060 can be obtained.

  On the other hand, for the conversion source IP address = 192.168.0.1 and the conversion source Port number = 10000, the record cannot be obtained. First, the conversion source IP address = 192.168.8.0. 1. Specify the conversion source port number = 10000, and make an address conversion request (S27) to the NAT / FW device 2 (22). As a result, the NAT / FW device 2 (22) receives an address as shown in FIG. A conversion response (S28) is obtained, and a post-conversion IP address = 131.0.0.1, a post-conversion Port number = 40000, and a conversion ID = 5 are obtained.

  In the SIP-ALG (51), the previously acquired key information and the result acquired from the address conversion response are registered in the address conversion table as shown in FIG.

  Since the media transmission / reception address of the destination terminal can be collected from the SDP, the IP address and the Port number before and after conversion of the destination terminal are registered in the media information collection table as shown in FIG. As a result of registering the media information, the media transmission / reception information of the calling / receiving terminal can be collected in the same opposing device identification information and call identification information, so that pinhole setting is performed.

  In the pinhole setting, as shown in Japanese Patent Application No. 2003-041328 (not disclosed at the time of this application) by the present applicant, the transmission source IP address, the transmission source Port number, the transmission source (after conversion) IP address, It is necessary to set a transmission source (after conversion) Port number, a transmission destination IP address, and a transmission destination Port number. Therefore, the transmission source IP address, transmission source Port number, transmission source (after conversion) IP address, transmission source (after conversion) Port number are not changed before and after conversion of the terminal 2 on the private network side of the NAT / FW device 2 (22). The IP address and Port number of the terminal 1 are set as the address on the global network side of the NAT / FW device 2 (22) in the destination IP address and Port number. The pinhole setting request 1 (S29) as shown in FIG. 49 is transmitted to the NAT / FW device 2 (22). In the NAT / FW device 2 (22) that has received the pinhole setting request 1 (S29), the pinhole of the source, destination IP address, and port number is opened to allow the media signal to pass. The hole ID is given and the pinhole setting response 1 (S30) is returned, and the SIP-ALG (51) acquires the pinhole ID as a result. Based on the result of the pinhole setting, as shown in FIG. 51, each IP address, Port number, and pinhole ID are registered in the pinhole management table as a record for the previously obtained key information.

  Thereafter, in SIP-ALG, the SIP layer Contact header and SDP c and m fields are converted, and the IP address of the encapsulated part, the destination of the Port number, and the transmission source are reversed, as shown in FIG. The encapsulated 200 OK (S31) is returned to the NAT / FW device 2 (22).

  The NAT / FW device 2 (22) decapsulates the received encapsulated 200 OK, converts the IP signal and UDP layer sources of the SIP signal to 131.0.0.1 and 35060, respectively, and the SIP server ( 31), 200 OK (S32) as shown in FIG. 53 is transmitted.

  The SIP server (31) confirms its own IP address described in the highest Via header, deletes the Via header, acquires the destination IP address and Port number from the Via header below it, 200 OK (S33) like 54 is transmitted.

  The NAT / FW device 1 (12) that has received the 200 OK (S33) encapsulates it as shown in FIG. 55, and transmits the encapsulated 200 OK (S34) to the SIP-ALG (51).

  In the SIP-ALG (51), when the encapsulation 200 OK (S34) is received, the IP address of the NAT / FW device 1 (12) = 172.30.0.1 as the opposing device identification information from the encapsulation unit, and the SIP Call-ID value=12345678@192.168.0.1 is acquired from the layer as call identification information, and these sets are recorded as key information for call-related resource management.

  Next, referring to the network address management table of FIG. 2 using the acquired opposing device identification information as key information, 130.0.0.0/24 is acquired as the address system to be converted, and the received encapsulation 200 A conversion target address is extracted from OK (S34). As a result, 130.0.0.1:25060 is obtained from Via.

  In the address translation request, first, the address translation table is searched using the previously obtained key information, the obtained translation source IP address = 130.0.0.1, and the translation source port number = 256060. Since the record already exists, as a result, converted IP = 192.168.0.1 and converted Port number = 5060 can be obtained.

  Also, the media transmission / reception address of the called terminal can be collected from the SDP. In the NAT / FW device 1 (12), the SDP is a transmission destination IP address and a Port number as viewed from the terminal 1 (originating terminal), and therefore is necessary for pinhole setting. Therefore, the information is registered in the media information collection table as shown in FIG. 56 as the global-side IP address and Port number of the called terminal. As a result of registering the media information, the media transmission / reception information of the calling / receiving terminal can be collected in the same opposing device identification information and call identification information, so that pinhole setting is performed.

  In the pinhole setting, the source IP address, the source port number, the source (after conversion) IP address, and the source (after conversion) Port number are the terminals on the private network side of the NAT / FW device 1 (12). The IP address and the port number before and after the conversion of 1 are set, and the IP address after the conversion of the terminal 2 is set in the transmission destination IP address and the transmission destination Port number as the address of the NAT / FW device 1 (12) on the global network side. The Port number is set, and a pinhole setting request 2 (S35) as shown in FIG. 57 is transmitted to the NAT / FW device 1 (12). In the NAT / FW device 1 (12) that has received the pinhole setting request 2 (S29), the pinhole of the transmission source, the transmission destination IP address, and the port number is opened to allow the media signal to pass. The hole ID is assigned, and the pinhole setting response 2 (S36) is returned. The SIP-ALG acquires the pinhole ID as a result. Based on the result of the pinhole setting, as shown in FIG. 59, each IP address, Port number, and pinhole ID are registered in the pinhole management table as a record for the previously obtained key information.

  Thereafter, in SIP-ALG (51), the IP address and Port number of Via are converted to 192.168.0.1 and 5060, respectively, and the source and destination of the encapsulated part IP address and Port number are reversed. Then, the encapsulated 200 OK (S37) as shown in FIG. 60 is returned to the NAT / FW apparatus 1 (12).

  The NAT / FW device 1 (12) decapsulates the received encapsulation 200 OK, converts the IP signal destination and the UDP layer destination of the SIP signal to 192.168.0.1 and 5060, respectively, as shown in FIG. Such 200 OK (S38) is transmitted to the terminal 1 (11).

  Next, call termination processing for BYE at 200 OK will be described.

  When 200 OK (S39) as shown in FIG. 62 is transmitted from the terminal 2 (21), the NAT / FW device 2 (22) performs the encapsulation, and performs the encapsulation 200 OK (S40) as shown in FIG. Transfer to SIP-ALG (51).

  When the SIP-ALG (51) receives the encapsulated 200 OK (S40), the IP address of the NAT / FW device 2 (22) = 172.30.0.2 as the opposing device identification information from the encapsulation unit, and the SIP Call-ID value=12345678@192.168.0.1 is acquired from the layer as call identification information, and these sets are recorded as key information for call-related resource management. Further, since the SIP signal is 200 OK for BYE, it is understood that it is a call end signal.

  Next, referring to the network address management table of FIG. 2 using the acquired counter device identification information as key information, 192.168.0.0/24 is acquired as the address system to be converted, and the received encapsulated SIP The conversion target address is extracted from the signal. As a result, it is understood that there is no address to be converted.

  Next, pinhole deletion is performed as call termination processing. The pinhole management table is searched based on the previously acquired key information, and the record of pinhole ID = 1 is acquired. The pinhole ID obtained as a result is designated, and a pinhole deletion request 1 (S41) as shown in FIG. 64 is transmitted to the NAT / FW device 2 (22). The NAT / FW device 2 (22) The pinhole is closed and a response is transmitted to the SIP-ALG (51). The SIP-ALG (51) acquires a response from the NAT / FW device 2 (22), and deletes the record in the pinhole management table of the SIP-ALG (51) as shown in FIG.

  Thereafter, in SIP-ALG (51), the SIP layer is not particularly changed, and the encapsulated 200 OK (S43) as shown in FIG. 67 is made by reversing the IP address of the encapsulated part, the destination of the Port number, and the transmission source. Is returned to the NAT / FW device 2 (22).

  The NAT / FW device 2 (22) decapsulates the received encapsulated 200 OK, converts the IP signal and UDP layer sources of the SIP signal to 131.0.0.1 and 35060, respectively, and the SIP server ( Toward 31), 200 OK (S44) as shown in FIG. 68 is transmitted.

  In SIP-ALG, as a call termination process after sending encapsulation 200 OK (S43), the address translation table is searched based on the previously obtained key information, and records with translation IDs = 4 and 5 are obtained. To do. The conversion ID obtained as a result is designated, and an address set deletion request 1 (S45) as shown in FIG. 69 is transmitted to the NAT / FW apparatus 2 (22), and a response is received from the NAT / FW apparatus 2 (22). To get. After obtaining the response, the record in the address translation table of SIP-ALG (51) is deleted as shown in FIG.

  Similarly, the media information collection table is searched based on the previously acquired key information, and two records that hit the key information are acquired. These results are also deleted as shown in FIG.

  The SIP server (31) confirms its own IP address described in the highest Via header, deletes the Via header, obtains the destination IP address and Port number from the Via header below, 200 OK (S47) such as 73 is transmitted.

  The NAT / FW device 1 (12) that has received 200 OK (S47) encapsulates it as shown in FIG. 74, and transmits the encapsulated 200 OK (S48) to the SIP-ALG (51).

  When the SIP-ALG (51) receives the encapsulated 200 OK (S48), the IP address of the NAT / FW device 1 (12) = 172.30.0.1 as the opposing device identification information from the encapsulation unit, and the SIP Call-ID value=12345678@192.168.0.1 is acquired from the layer as call identification information, and these sets are recorded as key information for call-related resource management. Further, since the SIP signal is 200 OK for BYE, it is understood that it is a call end signal.

  Next, referring to the network address management table of FIG. 2 using the acquired opposite device identification information as key information, 130.0.0.0/24 is acquired as the address system to be converted, and the received encapsulation 200 The conversion target address is extracted from OK (S48). As a result, 130.0.0.1:25060 is obtained from Via.

  In the address translation request, first, the address translation table is searched using the previously obtained key information, the obtained translation source IP address = 130.0.0.1, and the translation source port number = 256060. Since the record already exists, the post-conversion IP address = 192.168.0.1 and post-conversion Port number = 5060 can be obtained as a result.

  Next, pinhole deletion is performed as call termination processing. The pinhole management table is searched based on the previously acquired key information, and a record with pinhole ID = 2 is acquired. The pinhole ID obtained as a result is designated, and a pinhole deletion request 2 (S49) as shown in FIG. 75 is transmitted to the NAT / FW device 1 (12). The NAT / FW device 1 (12) The pinhole is closed and a response is transmitted to the SIP-ALG (51). The SIP-ALG (51) acquires a response from the NAT / FW device 1 (12) and deletes the record in the pinhole management table of the SIP-ALG (51) as shown in FIG.

  Thereafter, the SIP-ALG converts the SIP layer Via header, and reverses the IP address of the encapsulated portion, the destination of the Port number, and the source of transmission, and encapsulates 200 OK as shown in FIG. 78 (S51). Is returned to the NAT / FW device 1 (12).

  In the NAT / FW device 1 (12), the encapsulated 200 OK received is decapsulated, the destinations of the SIP signal IP layer and UDP layer are converted to 192.168.0.1 and 5060, respectively, and the SIP server ( Then, 200 OK (S52) as shown in FIG. 79 is transmitted.

  In SIP-ALG, as a call termination process after encapsulated 200 OK (S51) transmission, the address conversion table is searched based on the previously acquired key information, and records with conversion ID = 2 and 3 are acquired. To do. The conversion ID obtained as a result is designated, and an address set deletion request 2 (S53) as shown in FIG. 80 is transmitted to the NAT / FW device 1 (12), and a response is sent from the NAT / FW device 1 (12). To get. After obtaining the response, the record in the address conversion table of SIP-ALG (51) is deleted as shown in FIG.

  Similarly, the media information collection table is searched based on the previously acquired key information, and two records that hit the key information are acquired. These results are also deleted as shown in FIG.

  As described above, by managing call-related resources such as address translation information, pinhole management information, and media information using opposing device identification information and call identification information as key information, each call and each opposing NAT / FW device Call related resources can be registered, referenced, and deleted. Further, for call-related resources that have already been registered, address conversion requests and pinhole setting requests to the NAT / FW device are not performed, and therefore processing can be reduced.

  Next, a second embodiment will be described with reference to FIGS. FIG. 84 shows the network configuration of this embodiment. As shown in FIG. 84, in this embodiment, the NAT / FW device 1 (12) and the NAT / FW device 2 (22) in the network configuration of the first embodiment shown in FIG. , VPN storage device 2 (22 '). The VPN accommodating apparatus 1 (12 ') and the VPN accommodating apparatus 2 (22') accommodate a plurality of virtual private networks (VPNs) and can logically set NAT / FW for the plurality of VPNs.

  As shown in FIG. 84, VPNs # 1 to # n-1 are connected to the logical NAT / FWs # 1 to # n-1 set in the VPN accommodating apparatus 1 (12 '). / FW # 1 to # n-1 are also connected to the global network (30). The VPN accommodating apparatus 1 (12 ′) is provided with an ALG transmission / reception function and an address conversion signal transmission / reception function (not shown) independently of the logical NAT / FW # 1 to # n−1, and all of them are logical NAT. It is possible to cooperate with # 1 to # n-1. The VPN accommodating apparatus 1 (12 ′) also adds the VPN number to which the logical NAT / FW is connected, transfers the encapsulated SIP signal, and receives the encapsulated signal transmitted from the transfer destination. Receives the function of decapsulating and returning to the original SIP signal, and the address conversion request, address group deletion request, pinhole setting request, pinhole deletion request, etc., with the logical NAT / FW specified by the device IP address and VPN number. It has a function to perform address set payout, pinhole setting, and the like.

  VPNs #n to #z are connected to the logical NAT / FW #n to #z set in the VPN accommodating apparatus 2 (22 ′), and each logical NAT / FW #n to #z is connected to the global network ( 30). The VPN accommodating apparatus 2 (22 ') has the same function as the VPN accommodating apparatus 1 (12').

  In the present embodiment, the SIP-ALG (51 ′) opposing device is a VPN accommodating device capable of setting a plurality of logical NAT / FW with one device as described above, and the VPN accommodating device 1 (12) which is the opposing device. ') The encapsulated SIP signal transmitted from the VPN accommodating apparatus 2 (22') is as shown in FIG. 85, and a unique encapsulated part for setting the VPN number of the encapsulated part is added.

  In the SIP-ALG (51 ′), when the encapsulated SIP signal received from the VPN accommodating apparatus 1 (12 ′) and the VPN accommodating apparatus 2 (22 ′) is acquired, it is acquired in the case of the NAT / FW apparatus. By including the VPN number as VPN identification information in addition to the opposing device identification information and call identification information, it is recorded as key information for call-related resource management.

  Further, VPN identification information is added to key information of a table for managing call-related resources such as an address conversion table as shown in FIG. 86, and when registering each resource, registration including VPN identification information is performed. Call-related resources can be managed for each call, for each opposing VPN accommodating device, and for each logical NAT / FW connected to the VPN, and reference processing and deletion processing can be performed.

  The second embodiment is the same as the first embodiment except for what has been described above.

  As mentioned above, the invention made by the present inventor has been specifically described based on the above embodiments. However, the present invention is not limited to the above embodiments, and various modifications can be made without departing from the scope of the invention. Of course.

It is a figure which shows the network structure of a 1st Example. It is a figure which shows the network address conversion table of a 1st Example. It is a figure which shows the address conversion table structure of a 1st Example. It is a figure which shows the media information collection table structure of a 1st Example. It is a figure which shows the pinhole management table structure of a 1st Example. It is a figure which shows the example of a REGISTER sequence (1/1). It is a figure which shows the example of REGISTER (S1). It is a figure which shows the example of encapsulation REGISTER (S2). It is a figure which shows the example of the address translation request | requirement 1 (S3). It is a figure which shows the example of the address translation response 1 (S4). It is a figure which shows the example of an address conversion table (P4). It is a figure which shows the example of encapsulation REGISTER (S5). It is a figure which shows the example of REGISTER (S6). It is a figure which shows the example of 200 OK (S7). It is a figure which shows the example of encapsulation 200 OK (S8). It is a figure which shows the example of encapsulation 200 OK (S9). It is a figure which shows the example of 200 OK (S10). It is a figure which shows the example of an address conversion table (P9). It is a figure which shows the example of an INVITE sequence (1/6). It is a figure which shows the example of an INVITE sequence (2/6). It is a figure which shows the example of an INVITE sequence (3/6). It is a figure which shows the example of an INVITE sequence (4/6). It is a figure which shows the example of an INVITE sequence (5/6). It is a figure which shows the example of an INVITE sequence (6/6). It is a figure which shows the example of INVITE (S11). It is a figure which shows the example of encapsulation INVITE (S12). It is a figure which shows the example of the address conversion request 2 (S13). It is a figure which shows the example of the address translation response 2 (S14). It is a figure which shows the example of the address translation request | requirement 3 (S15). It is a figure which shows the example of the address translation response 3 (S16). It is a figure which shows the example of an address conversion table (P16). It is a figure which shows the example of a media information collection table (P16). It is a figure which shows the example of encapsulation INVITE (S17). It is a figure which shows the example of INVITE (S18). It is a figure which shows the example of INVITE (S19). It is a figure which shows the example of encapsulation INVITE (S20). It is a figure which shows the example of the address translation request | requirement 4 (S21). It is a figure which shows the example of the address translation response 4 (S22). It is a figure which shows the example of an address conversion table (P22). It is a figure which shows the example of a media information collection table (P22). It is a figure which shows the example of encapsulation INVITE (S23). It is a figure which shows the example of INVITE (S24). It is a figure which shows the example of 200 OK (S25). It is a figure which shows the example of encapsulation 200 OK (S26). It is a figure which shows the example of the address translation request | requirement 5 (S27). It is a figure which shows the example of the address translation response 5 (S28). It is a figure which shows the example of an address conversion table (P28). It is a figure which shows the example of a media information collection table (P28). It is a figure which shows the example of the pinhole setting request | requirement 1 (S29). It is a figure which shows the example of the pinhole setting response 1 (S30). It is a figure which shows the example of a pinhole management table (P30). It is a figure which shows the example of encapsulation 200 OK (S31). It is a figure which shows the example of 200 OK (S32). It is a figure which shows the example of 200 OK (S33). Encapsulated 200 OK. It is a figure which shows the example of (S34). It is a figure which shows the example of a media information collection table (P34). It is a figure which shows the example of the pinhole setting request | requirement 2 (S35). It is a figure which shows the example of the pinhole setting response 2 (S36). It is a figure which shows the example of a pinhole management table (P36). It is a figure which shows the example of encapsulation 200 OK (S37). It is a figure which shows the example of 200 OK (S38). It is a figure which shows the example of 200 OK (S39). It is a figure which shows the example of encapsulation 200 OK (S40). It is a figure which shows the example of a pinhole deletion request | requirement (S41). It is a figure which shows the example of a pinhole deletion response (S42). It is a figure which shows the example of a pinhole management table (P42). It is a figure which shows the example of encapsulation 200 OK (S43). It is a figure which shows the example of 200 OK (S44). It is a figure which shows the example of the address group deletion request 1 (S45). It is a figure which shows the example of the address group deletion response 1 (S46). It is a figure which shows the example of an address conversion table (P46). It is a figure which shows the example of a media information collection table (P46). It is a figure which shows the example of 200 OK (S47). It is a figure which shows the example of encapsulation 200 OK (S48). It is a figure which shows the example of the pinhole deletion request 2 (S49). It is a figure which shows the example of the pinhole deletion response 2 (S50). It is a figure which shows the example of a pinhole management table (P50). It is a figure which shows the example of encapsulation 200 OK (S51). It is a figure which shows the example of 200 OK (S52). It is a figure which shows the example of the address group deletion request 2 (S53). It is a figure which shows the example of the address group deletion response 2 (S54). It is a figure which shows the example of an address conversion table (P54). It is a figure which shows the example of a media information collection table (P54). It is a figure which shows the network structure of a 2nd Example (when using a VPN accommodation apparatus). It is a figure which shows the example of the encapsulation SIP signal of a 2nd Example. It is a figure which shows the example of the table structure of a 2nd Example.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Private network 1, 11 ... Terminal 1, 12 ... NAT / FW apparatus 1, 12 '... VPN accommodation apparatus 1, 20 ... Private network 2, 21 ... Terminal 2, 22 ... NAT / FW apparatus 2, 22' ... VPN Accommodating apparatus 2, 30 ... Global network, 31 ... SIP server, 40 ... Management network, 51, 51 '... SIP-ALG

Claims (10)

In an IP communication network, there is a NAT / FW device provided with a network address conversion function and a firewall function. When the NAT / FW device detects a SIP signal, the encapsulation SIP signal is encapsulated by covering its own IP address. Is transferred to the transfer destination device, decapsulates the encapsulated SIP signal returned from the transfer destination device, and returns to the original SIP signal. In response to this, the function of issuing the conversion destination IP address and Port number, managing the address set before and after conversion, and responding the result to the transfer destination device, and the address set deletion request from the transfer destination device And a function to delete the address set issued to the transfer destination device. It has a function to set a pinhole for the requested transmission / reception IP address and Port number, and a function to delete the pinhole of the transmission / reception IP address and Port number requested to delete the pinhole from the transfer destination device. In state
For SIP communication between terminals placed between networks across a plurality of NAT / FW devices, the SIP layer address conversion request and address conversion information are linked as transfer destination devices of the plurality of NAT / FW devices. In addition, a pinhole setting request and pinhole setting information necessary for transmitting and receiving signals between the arrival and departure terminals are retained, and at the end of SIP communication, address conversion information and pinhole setting information are retained. In the SIP-ALG that deletes the resource, a resource related to the SIP call including the address translation information and the pinhole setting information is managed.
When the encapsulated SIP signal transmitted from the NAT / FW device is received by SIP-ALG, information for identifying the NAT / FW device is acquired as the opposing device identification information from the encapsulated portion, and the SIP layer of the SIP signal is obtained. Information for identifying the call is acquired as call identification information, and the set of the opposite device identification information and the call identification information is recorded as key information for call-related resource management in SIP-ALG, and the NAT / By managing address related information obtained as a result of making an address translation request to the FW device and call-related resources including pinhole setting information obtained as a result of making a pinhole setting request as a record for the key information SIP-AL that manages the call-related resources independently for each opposing NAT / FW device and for each call Call-related resource management method. The call-related resource management method of SIP-ALG according to claim 1,
The SIP-ALG is provided with an address conversion table for storing address conversion information, a pinhole management table for storing pinhole setting information, and a media information collection table for storing media transmission / reception addresses of calling / receiving terminals. In
When the encapsulated SIP signal transmitted from the NAT / FW device is received by SIP-ALG, the IP address of the NAT / FW device is acquired as the opposing device identification information from the encapsulated portion, and Call- from the SIP layer of the SIP signal. A first step of acquiring an ID as call identification information, and recording a set of the opposite device identification information and the call identification information as key information for managing call-related resources in SIP-ALG;
When making an address conversion request for the IP address and Port number of the SIP header to be converted, specify the IP address of the NAT / FW device acquired from the opposing device identification information of the key information, and make an address conversion request. As a result, a second step of acquiring IP addresses and port numbers before and after conversion, and storing the IP addresses and port numbers before and after conversion in an address conversion table as a record for the key information;
When the SIP body SIP body part is SDP, the media transmission / reception IP address and port number described in the SDP are collected, and the IP address, the port number, and the terminal type are recorded as a record for the key information. A third step described in the information collection table;
In the media information collection table, if the set of IP address and port number for sending and receiving terminals can be collected, specify the IP address of the NAT / FW device obtained from the device identification information of the key information and set the pinhole A fourth step of making a request and storing the transmission / reception IP address and Port number used in the request in the pinhole management table;
SIP-ALG call-related resource management method comprising: A call-related resource management method for SIP-ALG according to claim 2,
When performing the address conversion of the IP address and the Port number of the SIP header to be converted in the second step, the IP address is first referred to the address conversion table based on the key information acquired in the first step. , Confirms whether or not the converted IP address and the Port number corresponding to the Port number have already been stored, and if so, obtains the result; if not, the opposite device identification information of the key information The IP address of the NAT / FW device obtained from the above is designated and an address conversion request is made. As a result, the IP address and Port number before and after conversion are acquired, and the IP address and Port number before and after conversion are obtained as a record for the key information. Is stored in the address conversion table,
In performing the pinhole setting for the pinhole setting transmission / reception IP address and the Port number set in the fourth step, referring to the pinhole management table based on the key information acquired in the first step, It is confirmed whether or not the IP address / Port number group is already stored, and if it is stored, the result is obtained. If not, the NAT / FW device obtained from the opposing device identification information of the key information is obtained. SIP-ALG call-related resource management method for performing a process of storing a transmission / reception IP address and a Port number used at that time in a pinhole management table. A call-related resource management method for SIP-ALG according to claim 2,
As a result of analyzing the encapsulated SIP signal received by the SIP-ALG, the signal terminates the call.
The address translation table is searched using the opposing device identification information and call identification information obtained after performing the first step as key information, and when an address set is obtained as a result of the search, the address set deletion of the address set is performed. By sending a request to the IP address of the NAT / FW device acquired from the opposing device identification information of the key information, the address set of the NAT / FW device is deleted, and the address is also applied to the address conversion table. Delete the pair,
Based on the key information, a pinhole management table is searched. If the search result shows that a transmission / reception IP address and port number set are obtained, a pinhole deletion request for the IP address and port number set is sent to the key information. By transmitting to the IP address of the NAT / FW device acquired from the opposite device identification information, the pinhole information of the NAT / FW device is deleted, and the IP address, Port is also stored in the pinhole management table. Delete the number pair,
Based on the key information, the media information collection table is searched. When SDP information is obtained as a result of the search, the SDP information is deleted, so that resources related to each call and each NAT / FW device facing each other can be obtained. SIP-ALG call-related resource management method to be deleted. The SIP-ALG call-related resource management method according to any one of claims 1 to 4,
In place of the NAT / FW device, there is a VPN accommodation device that accommodates a virtual private network (VPN) and can logically set a plurality of NAT / FW for a plurality of VPNs, and the VPN accommodation device includes the capsule The encapsulated SIP signal is encapsulated by adding not only the IP address of the VPN device but also the VPN number connected to the logical NAT / FW, and transferring the encapsulated SIP signal to the transfer destination device. A function of receiving and decapsulating the encapsulated signal returned from the apparatus and returning it to the original SIP signal, and receiving the address conversion request, address group deletion request, pinhole setting request, and pinhole deletion request from the transfer destination apparatus Received by the logical NAT / FW in the VPN device specified by the IP address and VPN number of the VPN device, issued the address set, pin ho Has a function to be set,
The SIP-ALG that cooperates as the transfer destination device of the plurality of VPN accommodating devices acquires not only the counter device identification information but also the VPN number from the encapsulated part, and the address conversion request, address group deletion request, pinhole When making a setting request and a deletion request, include the VPN number in the opposite device identification information,
Instead of a pair of opposite device identification information and call identification information, which is key information for managing call-related resources according to claims 1 to 4, from an encapsulated SIP signal transmitted from the VPN accommodating device, Obtaining the opposite device identification information, obtaining the VPN number from the encapsulated portion as VPN identification information, obtaining information for identifying a call from a SIP signal as call identification information, the opposite device identification information, A set of the VPN identification information and the call identification information is collected as key information for managing call-related resources in SIP-ALG;
SIP-ALG call-related resource management method for independently registering, referring to, and deleting call-related resources including address translation information and pinhole setting information for each call, for each opposing device, and for each logical NAT / FW corresponding to VPN . In an IP communication network, there is a NAT / FW device having a network address conversion function and a firewall function, and when the NAT / FW device detects a SIP signal, the encapsulated SIP signal is covered with its own IP address and encapsulated. Is transferred to the transfer destination device, decapsulates the encapsulated SIP signal returned from the transfer destination device, and returns to the original SIP signal. In response to this, the function of issuing the conversion destination IP address and Port number, managing the address set before and after conversion, and responding the result to the transfer destination device, and the address set deletion request from the transfer destination device And a function to delete the address set issued to the transfer destination device. It has a function to set a pinhole for the requested transmission / reception IP address and Port number, and a function to delete the pinhole of the transmission / reception IP address and Port number requested to delete the pinhole from the transfer destination device. In state
For SIP communication between terminals placed between networks across a plurality of NAT / FW devices, it cooperates as a transfer destination device of the plurality of NAT / FW devices, and performs address conversion request and address conversion information of the SIP layer. It also holds the pinhole setting request and pinhole setting information necessary for transmitting and receiving signals between the arrival and departure terminals. Also, at the end of SIP communication, the address conversion information and pinhole setting information SIP-ALG that performs the deletion,
When the encapsulated SIP signal transmitted from the NAT / FW device is received, information for identifying the NAT / FW device is acquired from the encapsulated portion as the opposing device identification information, and the call is identified from the SIP layer of the SIP signal. Means for acquiring information for performing call identification information, and recording the set of the opposite device identification information and the call identification information as key information for call-related resource management in SIP-ALG,
Call-related resources including address translation information obtained as a result of making an address translation request to the NAT / FW device and pinhole setting information obtained as a result of making a pinhole setting request are managed as records for the key information. Thus, SIP-ALG manages the call-related resources independently for each opposing NAT / FW device and for each call. The SIP-ALG according to claim 6,
An address conversion table that stores address conversion information, a pinhole management table that stores pinhole setting information, and a media information collection table that stores media transmission / reception addresses of calling terminals,
When the encapsulated SIP signal transmitted from the NAT / FW device is received by SIP-ALG, the IP address of the NAT / FW device is acquired as the opposing device identification information from the encapsulated portion, and Call- from the SIP layer of the SIP signal. First means for acquiring an ID as call identification information, and recording a set of the opposite device identification information and the call identification information as key information for managing call-related resources in SIP-ALG;
When making an address conversion request for the IP address and Port number of the SIP header to be converted, specify the IP address of the NAT / FW device acquired from the opposing device identification information of the key information, and make an address conversion request. As a result, a second means for acquiring the IP address and Port number before and after conversion, and storing the IP address and Port number before and after conversion as a record for the key information in an address conversion table;
When the SIP body SIP body part is SDP, the media transmission / reception IP address and port number described in the SDP are collected, and the IP address, the port number, and the terminal type are recorded as a record for the key information. A third means of describing in the information collection table;
In the media information collection table, if the set of IP address and port number for sending and receiving terminals can be collected, specify the IP address of the NAT / FW device obtained from the device identification information of the key information and set the pinhole A fourth means for making a request and storing the transmission / reception IP address and the Port number used at that time in the pinhole management table;
SIP-ALG with The SIP-ALG according to claim 7,
When performing address conversion of the IP address and Port number of the SIP header to be converted in the second means, the IP address is first referred to the address conversion table based on the key information acquired by the first means. , Confirms whether or not the converted IP address and the Port number corresponding to the Port number have already been stored, and if so, obtains the result; if not, the opposite device identification information of the key information The IP address of the NAT / FW device obtained from the above is designated and an address conversion request is made. As a result, the IP address and Port number before and after conversion are acquired, and the IP address and Port number before and after conversion are obtained as a record for the key information. Is stored in the address conversion table,
When the transmission / reception IP address for setting the pinhole and the pinhole setting of the Port number set are set in the fourth means, the pinhole management table is referred to based on the key information acquired by the first means, It is confirmed whether or not the IP address / Port number group is already stored, and if it is stored, the result is obtained. If not, the NAT / FW device obtained from the opposing device identification information of the key information is obtained. SIP-ALG which designates the IP address of the server and makes a pinhole setting request and stores the transmission / reception IP address and the Port number used at that time in the pinhole management table. The SIP-ALG according to claim 7,
As a result of analyzing the received encapsulated SIP signal, the signal terminates the call.
The address translation table is searched using the opposing device identification information and call identification information obtained by the first means as key information, and when an address set is obtained as a result of the search, an address set deletion request for the address set is sent to the key By transmitting to the IP address of the NAT / FW device acquired from the opposite device identification information in the information, the address set of the NAT / FW device is deleted, and the address set is also deleted from the address conversion table. ,
Based on the key information, a pinhole management table is searched. If the search result shows that a transmission / reception IP address and port number set are obtained, a pinhole deletion request for the IP address and port number set is sent to the key information. By transmitting to the IP address of the NAT / FW device acquired from the opposite device identification information, the pinhole information of the NAT / FW device is deleted, and the IP address, Port is also stored in the pinhole management table. Delete the number pair,
Based on the key information, the media information collection table is searched. When SDP information is obtained as a result of the search, the SDP information is deleted, so that resources related to each call and each NAT / FW device facing each other can be obtained. SIP-ALG to delete. The SIP-ALG according to any one of claims 6 to 9,
In place of the NAT / FW device, there is a VPN accommodation device that accommodates a virtual private network (VPN) and can logically set a plurality of NAT / FW for a plurality of VPNs, and the VPN accommodation device includes the capsule The encapsulated SIP signal is encapsulated by adding not only the IP address of the VPN device but also the VPN number connected to the logical NAT / FW, and transferring the encapsulated SIP signal to the transfer destination device. A function of receiving and decapsulating the encapsulated signal returned from the apparatus and returning it to the original SIP signal, and receiving the address conversion request, address group deletion request, pinhole setting request, and pinhole deletion request from the transfer destination apparatus Received by the logical NAT / FW in the VPN device specified by the IP address and VPN number of the VPN device, issued the address set, pin ho Has a function to be set,
The SIP-ALG that cooperates as the transfer destination device of the plurality of VPN accommodating devices acquires not only the counter device identification information but also the VPN number from the encapsulated part, and the address conversion request, address group deletion request, pinhole A SIP-ALG that includes a VPN number in the opposing device identification information when making a setting request and a deletion request,
The encapsulated SIP signal transmitted from the VPN accommodating apparatus is replaced with the encapsulated portion instead of the pair of the opposite apparatus identifying information and the call identifying information which is key information for managing the call-related resources according to claims 6 to 9. The opposing device identification information is acquired, the VPN number is acquired as VPN identification information, information for identifying a call from a SIP signal is acquired as call identification information, the opposing device identification information, the VPN identification information , Collecting the set of call identification information as key information for managing call-related resources in SIP-ALG;
SIP-ALG that independently registers, references, and deletes call-related resources including address translation information and pinhole setting information for each call, for each opposing device, and for each logical NAT / FW corresponding to VPN.

Images