JP3759488B2 - Voice communication method and gate device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a voice communication method for performing voice communication using an IP network such as the Internet and a gate device used therefor.
[0002]
[Prior art]
In recent years, VoIP (Voice over IP), which enables voice communication in IP networks such as the Internet, is becoming widespread, but in order to spread widely as well as telephone services, it depends on security and the user's private network environment It is necessary to solve the problem, which will be described with reference to FIG.
[0003]
FIG. 5 is a block diagram showing a configuration of a conventional VoIP communication system. User A, user B, and Service-to-Self X are connected to an IP network 1 that provides a VoIP service. The VoIP telephones DA1 to DA3 and DB1 of the user A and the user B are connected to the IP network 1 through firewalls (abbreviated as F / W) 2 and 3 for security, and the address on the network 1 side is GA and GB respectively. Each F / W 2 and 3 has an address translation function (NAT: Network Address Translation), and separates the address on the network 1 side and the private address on the user side.
[0004]
User A's VoIP telephones DA1 to DA3 each have three dial-in telephone numbers # A1, # A2 and # A3, and their private addresses are A1, A2 and A3, respectively. Further, the user side private address of F / W2 is A0. User B's VoIP telephone DB1 has a telephone number of # B1, and its private address is B1. A personal computer PC is connected to the same LAN, and its private address is B2. Furthermore, the user side private address of F / W3 is B0. The network address of Service-to-Self X is GX.
[0005]
The VoIP exchange 4 performs address resolution for the telephone number and performs call control of the VoIP call. Specific call control protocols include H.323 and SIP (Session Initiation Protocol).
[0006]
By the way, the above-described VoIP communication system has the following problems.
(1) In order to accept an incoming call from the VoIP exchange 4 at the user's F / W 2 or 3, it is necessary to always leave a specific port of the F / W 2 or 3, and this lowers the security. In F / W 2 and 3 of each user, there is a risk of intrusion from the port by the Service-to-Self X.
[0007]
(2) Since the VoIP protocol puts the address of itself and the other party in the data part of the IP packet, communication cannot be performed by normal NAT that converts only the address part of the IP packet. Taking # A1 to # B1 as an example, in this case, a call setup request is sent from the VoIP phone of # A1 with the calling party address A1 and the destination # B1, From the NAT function, it is sent to the VoIP exchange 4 as a request from the address GA on the IP network 1 side. In this case, there are problems in address resolution as follows.
(Problem 1) Since the originating address remains unchanged as the private address A1, the VoIP exchange 4 cannot identify the calling telephone number from this address information.
(Problem 2) When the exchange 4 obtains the address GB on the IP network 1 side of # B1 and sends a call setup request to # B1, the NAT of user B assigns it to which private address (B1, B2) I don't know if I can forward it.
(Open topic 3) Even if the call setup request can be transferred to B1, since the calling address is the private address A1 of user A, the reply destination is undefined.
[0008]
(3) In the IP protocol, since an address can be easily spoofed, it is possible to make a malicious call that pretends the caller. In FIG. 5, if the Service-to-Self X can obtain the address GB of the user B and the telephone number # B1, a VoIP call impersonating the user B can be made to the user A. In order to avoid this, it is necessary to perform user authentication using key information or the like in the application layer instead of authentication based on an address (in this case, GB), and costs for key management and authentication are high. Also, if the authentication information is stolen, an impersonation call pretending to be a caller can be made.
[0009]
Moreover, what is described in patent documents 1 and 2 is known as an invention related to conventional VoIP communication. All of these are for sending a connection request for an Internet telephone via a telephone line. Patent Document 1 is characterized by not using a gateway, and Patent Document 2 Is characterized in that a communication line can be easily established even when the receiving side is dial-up connection.
[0010]
[Patent Document 1]
JP 2000-1205040 A [Patent Document 2]
Japanese Patent Laid-Open No. 2001-358830
[Problems to be solved by the invention]
The present invention has been made in view of the above-described circumstances, and its object is to apply a protocol conventionally used for telephones to a user-to-network call control procedure in VoIP communication to establish a private network on the user side. It is an object of the present invention to provide a secure VoIP voice communication method and a gate device used therefor, which solve the address conversion problem at the time of connection.
[0012]
[Means for Solving the Problems]
The present invention has been made to solve the above-described problems, and the invention according to claim 1 is directed to transmitting a call connection request from a transmission source terminal device to a first gate device that manages the transmission source terminal device. The first gate device that has received the call connection request transmits the first call control information to the second gate device that manages the destination terminal device via the public telephone network, and the second gate device. Transmits a call connection request to the transmission destination terminal device, transmits a response as to whether or not the transmission destination terminal device is able to talk to the second gate device, and receives a reply indicating that the communication is possible from the transmission destination terminal device. The second gate device transmits second call control information to the first gate device via the public telephone network, and opens a port connected to the IP network. Gate device from the second gate device 2, the port connected to the IP network is opened, and the transmission source terminal device and the transmission destination terminal device are connected to the opened ports of the first and second gate devices and the IP A voice communication method characterized by performing a call by packet communication via a network.
[0013]
According to the second aspect of the present invention, a transmission source terminal device transmits a call connection request to a first gate device that manages the transmission source terminal device, and the first gate device that receives the call connection request A port on the IP network side used for a call is secured, and first call control information including the secured port number and the IP network side address of the first gate device is transmitted via the public telephone network. A second gate device that manages the terminal device, the second gate device transmits a call connection request to the destination terminal device, and a response indicating whether the destination terminal device is capable of making a call is sent to the second gate device. The second network device opens a port on the IP network side to be used for the call, and the number of the opened port. And second call control information including an address on the IP network side of the second gate device is transmitted to the first gate device via the public telephone network, and the first gate device transmits the second gate control information to the first gate device. Receiving the second call connection information from the gate device and opening the reserved port, and the transmission source terminal device and the transmission destination terminal device are connected to the opened ports of the first and second gate devices and the IP A voice communication method characterized by performing a call by packet communication via a network.
[0014]
According to a third aspect of the present invention, in the voice communication method according to the first or second aspect, the second gate device is connected to one or a plurality of terminal devices via a private network. It has a conversion table for telephone numbers and private addresses of the terminal device, and is connected to the destination terminal device based on the conversion table.
[0015]
According to a fourth aspect of the present invention, there is provided a gate device in which one or a plurality of terminal devices are connected via a private network and mediate a call between the terminal device and an external terminal device. In response to the call connection request, the first call control information is transmitted to the external gate device that manages the external terminal device via the public telephone network, and a port open command is output, and the call connection request from the external gate device The first control means for transmitting the second call connection information to the external gate device and outputting the port open command, and receiving the port open command from the first control means, Open a port and pass packets between the terminal device and the external terminal device via the opened port and the IP network. To a second control means for controlling a call by a gate apparatus according to claim.
[0016]
According to a fifth aspect of the present invention, in the gate device according to the fourth aspect, when the first control means receives a call connection request from the terminal apparatus, a port is secured to the second control means. When a command is output and a reply is received from the external gate device, a port open command is output to the second control means, and the second control means receives the port securing command and secures a port, A port secured in response to the port open command is opened.
[0017]
According to a sixth aspect of the present invention, in the gate device according to the fourth or fifth aspect, the first control means has a conversion table of telephone numbers and private addresses of the terminal devices, A destination terminal device that transmits a call received from the outside is detected based on a conversion table.
[0018]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the VoIP voice communication system according to the embodiment.
In the present embodiment, a Q.931 protocol, which is a protocol conventionally used in telephones, is applied to a call control procedure between a user and a network in VoIP communication, and a gate device (GW device) that terminates the Q.931 protocol. 11A and 11B are characterized by opening / closing ports and converting private addresses and IP network addresses. In other words, the present embodiment is characterized in that the call control signal is transmitted through the public telephone network 13 and the voice signal is transmitted through the IP network 14. Hereinafter, this embodiment will be described in detail.
[0019]
In FIG. 1, the network includes a public telephone network (SS # 7 network) 13 for transmitting call control signals and an IP network 14 for transmitting VoIP bearer signals (voice signals). The public telephone network 13 is connected with SP-less exchanges 15 and 16 that accommodate users as usual, but process only call control signals and do not perform speech path (SP). In the exchanges 15 and 16, the signal processing controls the Q.931 protocol on the user side and the ISUP (ISDN User Part) protocol between the exchanges as in the conventional exchange. The RTP protocol is used for bearer transmission. The user access line may be a physically separated line for transmission or a multiplexed access line.
[0020]
The gate devices 11A and 11B are devices installed on the user side, and their internal configurations are shown in FIG. Although FIG. 2 shows the gate device 11A, the gate device 11B has the same configuration. The Q.931 controller, SIP Proxy, telephone number-private address conversion table (conversion table), and F / W of the gate device 11B are 21B to 24B, respectively.
[0021]
In FIG. 2, the Q.931 controller 21A terminates the Q.931 protocol with the SP-less switch 15 and performs the following control.
(1) Interconversion between Q.931 protocol and SIP protocol in cooperation with SIP Proxy22A. Here, the SIP protocol is a communication protocol between the gate device 11A and the VoIP telephones DA1 to DA3.
(2) Referring to the conversion table 23A, mutual conversion between a telephone number and a private address is performed.
(3) Control the F / W24A.
[0022]
The SIP Proxy 22A terminates the SIP protocol with the VoIP telephones DA1 to DA3, and performs call control by the network side and the Q.931 protocol in cooperation with the Q.931 controller 21A. The F / W 24A performs opening / closing of ports and address conversion between the private address and the IP network 14 side according to an instruction from the Q.931 controller 21A. The address translation function has a NAPT (Network Address Port Translation) function that can map n private addresses to one IP network 14 side address.
[0023]
As described above, in this embodiment, the private address section from the VoIP telephones DA1 to DA3 on the user side to the gate device 11A uses the VoIP protocol such as SIP, and the Q. between the gate device 11A and the public telephone network 13 is Q. Use the 931 protocol. The gate device 11A that terminates Q.931 can open and close the port and perform address conversion on the IP network 14 side with the opening and closing of the port, thereby realizing secure VoIP communication that solves the address conversion problem.
[0024]
Next, the operation of the above embodiment will be described with reference to flowcharts shown in FIGS.
FIG. 3 is a flowchart illustrating a sequence from user A to the start of a call to user B. In the following text, the SIP signal is represented by “”, the Q.931 or ISUP signal is represented by <>, and the internal signal unique to the present embodiment is represented by [].
[0025]
Step 0: When the VoIP telephone DA1 is powered on, a “REGISTER” signal for login is output from the VoIP telephone DA1 and input to the Q.931 controller 21A via the SIP Proxy 22A. As a result, the Q.931 controller 21A associates the user's telephone number with the private address and writes it in the conversion table 23A. This correspondence may be set in the conversion table 23A in advance. Further, in the case of a VoIP terminal that is not always a power supply 0N, association may be set in advance and the usable state of the terminal may be recognized by a “REGISTER” signal.
[0026]
Step 1: Next, when the VoIP telephone DA1 makes a call to the VoIP telephone DB1, for example, an “INVITE” signal is output from the VoIP telephone DA1 to the SIP Proxy 22A. The “INVITE” signal includes the following data.
Source phone number: # A1
Calling phone number: # B1
Source private address: A1
Source VoIP phone port number: p1
Call identification number (Call-ID): Cid
The SIP Proxy 22A outputs this “INVITE” signal to the Q.931 controller 21A. The above-mentioned source private address A1 and port number p1 are the RTP transport address and port number on the transmission side designated by SDP (Session Description Protocol).
[0027]
Step 2: The Q.931 controller 21A that has received the “INVITE” signal requests the F / W 24A to notify the address on the IP network side used for RTP and to issue the port number. [Assign 0-port] in the figure is shown, and in this figure, the IP network side address GA and the port pa of the gate device 11A are returned. At this stage, the F / W 24A only secures the port in correspondence with the call identification number Cid and does not open the port.
[0028]
Step 3: The Q.931 controller 21A sets the address information returned from the F / W 24A in Step 2 in the <SETUP> signal (UUI: User-User Information etc.), and makes a call to the SP-less switch 15. Whether the caller telephone number # A1 included in the <SETUP> signal is appropriate as a dial-in number is checked by the subscriber data of the user A in the SP-less switch 15.
[0029]
Step4: If the above check is 0K, as in the case of a conventional telephone, a <CALL PROC> signal is sent to the calling side gate device 11A and to the SP-less switch 16 via the public telephone network 13 < Send IAM> signal. This signal includes
Source phone number: # A1
Calling phone number: # B1
Call identification number (Call-ID): Cid
IP network side address of the source gate device: GA
Port number of the source gate device: pa
Is included. This <IAM> signal arrives at the gate device 11B of the user B as the <SETUP> signal via the SP-less switch 16. At this time, the destination SP-less exchange 16 checks whether or not the telephone number # B1 is a accommodated subscriber.
[0030]
Step 5: Upon receiving the <SETUP> signal, the Q.931 controller 21B of the gate device 11B first confirms the correspondence between the telephone number # B1 and the private address B1 using the conversion table, and then sends the telephone number to the F / W 24B. Request communication of private side address and port number used when communicating with # B1. In the figure, as a result, B0 and p0 are returned.
[0031]
Step 6: The Q.931 controller 21B transfers the above information to the SIP Proxy 22B, and the SIP Proxy 22B sends an “INVITE” signal to the VoIP telephone DB1 (private address B0) having the telephone number # B1. This “INVITE” signal is transmitted from the VoIP telephone DA1 having the telephone number # A1, but by performing such address conversion, the VoIP telephone DB1 has a telephone number # as if it exists inside 24B. It looks like an “INVITE” signal has been received from the A1 VoIP phone.
[0032]
Step 7: When the Q.931 controller 21B sends an “INVITE” signal to the VoIP telephone DB1, it returns a <CALL PROC> signal to the SP-less switch 16. This signal is transmitted as an <ACM> signal to the originating SP-less switch 15 via the public telephone network 13.
[0033]
Step 8: Upon receipt of the “INVITE” signal, the VoIP telephone DB1 returns a “180 Ringing” signal indicating a state such as calling to the Q.931 controller 21B via the SIP Proxy 22B. The Q.931 controller 21B converts this signal into an <ALERT> signal and sends it to the SP-less switch 16. The SP-less switch 16 receives the <ALERT> signal, converts it to a <CPG> signal, and transmits it to the SP-less switch 15. The SP-less switch 15 returns the <CPG> signal to the <ALERT> signal and transmits it to the gate device 11A in the same manner as a normal telephone call. The Q.931 controller 21A of the gate device 11A converts the <ALERT> signal into a “180 Ringing” signal via the SIP Proxy 22A and sends it to the VoIP telephone DA1.
[0034]
Step 9: Next, when the user B picks up the handset of the VoIP telephone DB1 and responds, a “200 OK” signal is output from the VoIP telephone DB1 and transmitted to the Q.931 controller 21B via the SIP Proxy 22B. Q.931 Controller 21B requests F / W24B to notify F / W24B IP network 14 side address for RTP, port assignment and port open with [Assin & O-port Open] signal . Upon receiving this request, the F / W 24B notifies the Q.931 controller 21B of the address GB and the port number pb on the IP network side used for the call, and then opens the port of the port number pb.
[0035]
Step 10: The address GB and port number pb on the destination IP network side described above are transferred from the Q.931 controller 21B to the destination SP less switch 16 by the “CONN” signal, and from the destination SP less switch 16 <ANM The signal is sent to the originating SP less exchange 15 by the signal, and the gate SP 11A is notified from the originating SP less exchange 15 by the “CONN” signal.
[0036]
Step11: The Q.931 controller 21A of the calling side gate device 11A opens the port secured in Step2 to the F / W24A, and issues the port number used for RTP on the private side [Assign I-Port & Requested by Open signal. In the figure, as a result, the private address A0 and the port number p0 are returned from the F / W 24A. At this time, the F / W 24A opens both the port with the port number p0 and the port with the port number pa.
[0037]
Step 12: The “200 OK” signal is returned from the SIP Proxy 22A to the VoIP telephone DA1 together with the port number assigned in Step 11, and the call setup is completed. At this time, the VoIP telephone DA1 appears to have received the “200 OK” signal of the VoIP telephone DB1 from the inside of the gate device 11A.
Step13: In response to the “200 OK” signal, the VoIP telephone DA1 returns an “ACK” signal indicating confirmation, which is converted into a <CONN ACK> signal by the Q.931 controller 21A and SP-less. Returned to switch 15.
[0038]
Step 14: Thereafter, a voice call (bearer) by RTP is performed via the IP network 14 using the set session. At this time, the F / Ws 24A and 24B of both the gate devices 11A and 11B respectively perform the conversion of the address and port assigned at the time of call setting.
[0039]
FIG. 4 is a flowchart showing an operation when the user A is disconnected.
Step 15: When the VoIP telephone DA1 is disconnected, a “BYE” signal is output from the VoIP telephone DA1 and transmitted to the Q.931 controller 21A via the SIP Proxy 22A. The Q.931 controller 21A converts this into a <DISC> signal and transmits it to the originating SP-less switch 15. Thereafter, in the same manner as a normal telephone call, a <REL> signal is transmitted from the originating SP-less exchange 15 to the terminating SP-less exchange 16 via the public telephone network 13, and from the SP-less exchange 16 to the terminating-side gate device 11B. <DISC> signal is sent to the Q.931 controller 21B. Q.931 Controller 21B is <DISC
> The signal is converted into a “BYE” signal and sent to the VoIP telephone DB1 via the SIP Proxy 22B. The VoIP telephone DB1 receives the “BYE” signal and returns a “200 OK” signal indicating confirmation to the Q.931 controller 21B via the SIP Proxy 22B.
[0040]
Step16: The Q.931 controller 21A of the originating side gate device 11A closes and releases the IP network 14 side and private side ports assigned and opened in Step1 and Step11 to [Close & Free port] for F / W24A. To request. Upon receiving this request, the F / W 24A closes the ports pa and p0, releases them for later use, and sends an [OK] signal to the Q.931 controller 21A. The Q.931 controller 21A receives the [OK] signal, sends a “200 OK” signal to the VoIP telephone DA1 via the SIP Proxy 22A, and sends a <REL COM> signal to the originating SP-less switch 15.
[0041]
Step 17: The Q.931 controller 21B of the destination side gate device 11B receives “200 OK” via the SIP Proxy 22B, and the F / W 24B assigns and opens the private side and the IP network 14 side port assigned in Step 5 and Step 9. Close and release is requested by the Close & Free port signal. The F / W 24B receives this request, closes the ports of the port numbers pb and p0, and then outputs an [OK] signal to the Q.931 controller 21B. The Q.931 controller 21B receives the [0K] signal and sends a <RELEASE> signal to the destination SP-less exchange 16. The SP-less switch 16 returns a <REL COM> signal to the Q.931 controller 21B as a response to the <RELEASE> signal.
[0042]
As described above, in this embodiment, the Q.931 protocol of the normal public telephone network 13 is used as the VoIP call control protocol, and the port devices are terminated at the gate devices 11A and 11B that terminate Q.931. By performing opening / closing and address conversion between the private address and the IP network 14, secure VoIP communication that solves the address conversion problem can be realized.
[0043]
In addition, since the above gate devices 11A and 11B have a SIP Proxy inside, it is easy to deploy to a PBX that allows extension calls between a plurality of VoIP telephones within one user.
Note that the above-described sequence is merely an operation example, and there may be variations in port opening timing and the like. In the operation example, the address and port are dynamically assigned under Call-ID at the time of INVITE etc., but it is also possible to assign in advance at the time of REGISTER. In addition, modifications within a range not departing from the gist of the present invention are possible.
[0044]
【The invention's effect】
According to the present invention, the effects described below can be obtained.
(1) Since the port on the IP network side is opened only when an incoming call is received, it is not necessary to always open a specific port, and security is improved.
(2) Since the call control information is transmitted to the second gate device that manages the transmission destination terminal device via the public telephone network as in the case of the conventional telephone, it is impossible to make a malicious call that pretends the caller. is there. For this reason, processing such as user authentication becomes unnecessary compared to the case where communication is performed via an IP network.
(3) Since the gate device has a conversion table of the telephone number and private address of the terminal device and connects to the destination terminal device based on the conversion table, the address conversion problem when connecting to the terminal device is solved. , VoIP communication in F / W and NAPT environments becomes possible.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a voice communication system to which a voice communication method according to an embodiment of the present invention is applied.
FIG. 2 is a block diagram showing a configuration of a gate device 11A in FIG.
3 is a flowchart for explaining the operation of the voice communication system shown in FIG. 1;
4 is a flowchart for explaining the operation of the voice communication system shown in FIG. 1. FIG.
FIG. 5 is a block diagram illustrating a configuration example of a conventional voice communication system.
[Explanation of symbols]
11A, 11B ... Gate device (GW device)
13 ... Public telephone network
14 ... IP network
15, 16 ... SP-less switch
DA1-DA3, DB1 ... VoIP telephone
21A ... Q.931 controller
22A… SIP Proxy
23A ... Conversion table
24A ... F / W

Claims (6)

The transmission source terminal device transmits a call connection request to the first gate device that manages the transmission source terminal device,
The first gate device that has received the call connection request transmits the first call control information to the second gate device that manages the destination terminal device via the public telephone network,
The second gate device transmits a call connection request to the destination terminal device;
A response indicating whether or not the destination terminal device is capable of making a call is transmitted to the second gate device;
When receiving a call-capable response from the destination terminal device, the second gate device transmits second call control information to the first gate device via the public telephone network and an IP network. Open the port connected to
The first gate device receives the second call control information from the second gate device and opens a port connected to the IP network;
A voice communication method, wherein the transmission source terminal device and the transmission destination terminal device perform a call by packet communication via the opened ports of the first and second gate devices and the IP network. The transmission source terminal device transmits a call connection request to the first gate device that manages the transmission source terminal device,
The first gate device that has received the call connection request secures a port on the IP network side to be used for a call, and includes the secured port number and the IP network side address of the first gate device. To the second gate device that manages the destination terminal device via the public telephone network,
The second gate device transmits a call connection request to the destination terminal device;
A response indicating whether or not the destination terminal device is capable of making a call is transmitted to the second gate device;
When receiving a reply indicating that a call is possible from the destination terminal device, the second gate device opens a port on the IP network side used for the call, and the number of the opened port and the second gate device Transmitting second call control information including an address on the IP network side to the first gate device via the public telephone network;
The first gate device receives the second call connection information from the second gate device and opens the reserved port;
A voice communication method, wherein the transmission source terminal device and the transmission destination terminal device perform a call by packet communication via the opened ports of the first and second gate devices and the IP network. The second gate device is connected to one or a plurality of terminal devices via a private network, and has a conversion table of telephone numbers and private addresses of the terminal devices therein, and the transmission based on the conversion table The voice communication method according to claim 1, wherein the voice communication method is connected to a destination terminal device. In a gate device in which one or a plurality of terminal devices are connected via a private network and mediate a call between the terminal device and an external terminal device,
In response to a call connection request from the terminal device, the first call control information is transmitted to an external gate device that manages the external terminal device via a public telephone network, and a port open command is output. A first control means for receiving a call connection request from the first control means for transmitting second call connection information to the external gate device and outputting the port open command;
Upon receiving a port open command from the first control means, the port on the IP network side is opened, and the packet communication between the terminal device and the external terminal device is performed via the opened port and the IP network. A second control means for controlling a call;
A gate device comprising: When the first control means receives a call connection request from the terminal device, it outputs a port securing instruction to the second control means, and when it receives a reply from the external gate device, the second control means 5. A port open command is output to the means, and the second control means secures a port in response to the port securing command and opens the secured port in response to the port open command. The gate device according to. The first control means has a conversion table of telephone numbers and private addresses of the terminal device, and detects a destination terminal device that transmits a call received from the outside based on the conversion table. The gate device according to claim 4 or 5.

Images