JP3920788B2 - SIP communication control device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a SIP communication control device that performs IP address conversion in a SIP message and media transmission / reception control for a FW in cooperation with a NAT / FW device between networks having different address systems.
[0002]
[Prior art]
In SIP (Session Initiation Protocol), IP address information is also described in the application layer. Therefore, in order to perform SIP communication between networks having different address systems such as a global IP address and a private IP address, a NAT (Network Address Translation) device In addition to the network layer address translation performed by, the address translation in the SIP message needs to be performed. As such a method, a SIP address conversion method using an ALG (Application Level Gateway) device and cooperating with a NAT device has been proposed in RFC 3303 and the like (see Non-Patent Documents 1 to 4). As for the detailed functions of the ALG device, “ALG device capable of obtaining and calculating the lifetime of the address translation group (prior application 1)” “API and communication using it (prior application 2)” “address in application layer” A patent application is pending for "Conversion Device (Prior Application 3)" and "IP Address Translation Device (Prior Application 4)".
[0003]
Next, when performing SIP communication via a FW (firewall) device, media communication performed using RTP (Real-time Transport Protocol) is performed using a port number arbitrarily set by the terminal. Cannot pass through. As one method for solving this problem, the SDP (Session Description Protocol) portion of the SIP message in which the media transmission / reception information of the IP address and port number arbitrarily set by the terminal is described is extracted by AGL, and is transmitted to the FW device. A method of releasing the IP address and port number on the FW side and allowing the FW passage of media communication by notification is proposed in IETF (see Non-Patent Document 4).
[0004]
[Non-Patent Document 1]
H. Schulzrinne, GMD Fokus, S. Casner, R. Frederick, V. Jacobson, “IETF RFC 1889“ RTP: A Transport Protocol for Real-Time Applications ”” [online], January 1996, January 30, 2003. Day search, Internet <http://www.ietf.org/rfc/rfc1889.txt>
[Non-Patent Document 2]
M. Handley, H. Schulzrinne, E. Schooler, J. Rosenberg, “IETF RFC 2543“ SIP: Session Initiation Protocol ””, [online], March 1999, searched January 30, 2003, Internet <http: / /www.ietf.org/rfc/rfc2543.txt>
[Non-Patent Document 3]
J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston, J. Peterson, R. Sparks, M. Handley, E. Schooler, “IETF RFC 3261“ SIP: Session Initiation Protocol ””, [online], June 2002, January 30, 2003 search, Internet <http://www.ietf.org/rfc/rfc3261.txt>
[Non-Patent Document 4]
P. Srisuresh, J. Kuthan, J. Rosenberg, A. Molitor, A. Rayhan, “IETF RFC 3303“ Middlebox communication architecture and framework ””, [online], August 2002, January 30, 2003 search, Internet <Http://www.ietf.org/rfc/rfc3303.txt>
[Prior Application 1]
Japanese Patent Application No. 2002-330300 (ALG device that enables acquisition and calculation of lifetime of address translation group)
[Prior Application 2]
Japanese Patent Application 2002-332300 (API and communication using it)
[Prior Application 3]
Japanese Patent Application No. 2002-333541 (Address Translation Device in Application Layer)
[Prior Application 4]
Japanese Patent Application 2002-327085 (IP address translation device)
[0005]
[Problems to be solved by the invention]
However, when the above method is used, in the NAT / FW apparatus, when the FW function is deployed before and after the NAT function, that is, on the private side and the global side, the private side FW and the global side FW For each, it is necessary to notify the media transmission / reception information in two portions, and there is a concern about an increase in the processing amount.
[0006]
[Means for Solving the Problems]
The IP address and port number for media transmission / reception acquired by the media transmission / reception information extraction function, and the IP address and port number converted by the function for converting the IP address in the SIP message are held in the internal database, When notifying media transmission / reception information to the NAT / FW device, it is possible to notify all the information of media transmission / reception IP addresses and port numbers before and after conversion by referring to the internal database. .
[0007]
That is, according to the present invention, a firewall (FW) function that performs access control based on a network layer IP address and a transport layer port number, and “private IP address, private port number” and “global IP address global port number”. SIP (Session Initiation Protocol) communication for registering a pair of IP address and port number used for media transmission / reception in the NAT / FW device in cooperation with a NAT / FW device having a NAT (Network Address Translation) function for converting When the INVITE SIP message is received from the NAT / FW device , the control device obtains a set of IP address and port number used for media transmission / reception before address conversion described in the SDP portion of the INVITE SIP message. , De A means for storing in a database; a means for performing address conversion of a set of IP address and port number used for media transmission / reception in the SIP message of INVITE; and a set of IP address and port number used for media transmission / reception after address conversion Means for storing in a database, means for returning the address-converted SIP message of INVITE to the NAT / FW device, and receiving a 200 OK SIP message as a response message to the INVITE from the NAT / FW device; Means for acquiring a set of IP address and port number used for media transmission / reception described in the SDP part of the 200 OK SIP message and storing in the database, and media transmission / reception of the transmission source stored in the database before conversion Use A set of P address and port number, and a set of IP address and port number used for media transmission / reception of the source after conversion, and a set of IP address and port number used for transmission / reception of the destination media are stored in the NAT / FW device. And means for notifying at a time .
[0008]
DETAILED DESCRIPTION OF THE INVENTION
As an embodiment of the present invention, a case where VoIP communication is performed between networks having different address systems using the SIP communication control device and the NAT / FW device will be described in detail with reference to FIGS. explain.
[0009]
FIG. 1 is a block diagram for explaining an example of the overall configuration of a system for performing VoIP communication between networks having different IP address systems using the SIP communication control device and the NAT / FW device according to the present invention. is there.
[0010]
2 to 5 show general signal sequences when performing VoIP communication between networks having different IP address systems using the SIP communication control device and the NAT / FW device, and the SIP communication control device and the NAT / FW. It is a figure for demonstrating the operation | movement outline | summary of FW apparatus. Note that the sequences and SIP messages described in FIGS. 2 to 5 are simplified by describing only the portions necessary for the present invention.
[0011]
FIG. 6 shows the NAT after the media transmission / reception information is notified to the NAT / FW device when VoIP communication is performed between networks having different IP address systems using the SIP communication control device and the NAT / FW device. It is a figure for demonstrating the operation | movement outline | summary of a / FW apparatus.
[0012]
An example of the overall configuration of a system in which the SIP communication control device and the NAT / FW device according to the present invention are used will be described with reference to FIG. The SIP communication control device 10 is connected to the NAT / FW device 20, and the NAT / FW device 20 accommodates networks having different address systems, a network A (private network) 30 and a network B (global network) 31. It has become the composition.
[0013]
The SIP communication control apparatus 10 includes an information processing unit 100 and the database 110. The information processing unit 100 has a media transmission / reception information extraction function 101 and an IP address conversion function 102 in a SIP message. The information processing unit 100 performs processing for performing SIP address conversion in the application layer and processing for controlling the FW. When performing the FW control, the information is sent from the SIP message of 200 OK and ACK for INVITE and INVITE, The media transmission / reception information extraction function 101 obtained by converting the transmission destination and the IP address and port number converted by the IP address conversion function 102 in the SIP message is acquired by the media transmission / reception information extraction function 101, and stored in the database 110. It is characterized in that a function of notifying all the media information at once to the NAT / FW device 20 at a timing is realized.
[0014]
The NAT / FW device 20 has a NAT function 200 and an FW function. Here, the FW function is provided in each of an address system network before NAT conversion and an address system network after NAT conversion. In the example of FIG. 1, the FW function (A) 210 on the private side and the FW function (B) 211 on the global side correspond.
[0015]
A network A (private network) 30 and a network B (global network) 31 are connected to a plurality of IP telephone terminals A to F302-a to 302-c and 312-a to 312-c via routers 301 and 311, respectively. It is constituted by.
[0016]
Next, the operation of the SIP communication control device and the NAT / FW device will be described with reference to the sequence diagrams of FIGS.
First, the NAT / FW device 20 receives an INVITE message transmitted from the IP telephone terminal A 302-a belonging to the network A (private network) 30 to the IP telephone terminal D 312-a belonging to the network B (global network) 31. To do. The received message is transferred to the SIP communication control apparatus 10 for processing for performing SIP address conversion in the application layer and processing for controlling FW. In the SIP communication control apparatus 10 that has received INVITE, as shown in FIG. 2, the media transmission / reception information of the terminal A before the address conversion, that is, the IP address used by the terminal A for RTP transmission / reception described in the SDP portion of the SIP message ( 192.168.0.1) and Port number (54321) information is acquired using the media transmission / reception information extraction function 101 and stored in the internal database 110.
[0017]
Next, as shown in FIG. 3, the IP address conversion function 102 in the SIP message performs address conversion in the SIP message. For details on the SIP address translation method, refer to related patents, “AGL device capable of acquiring and calculating address translation set lifetime (prior application 1)”, “API and communication using the same (prior application 2)”, “ It is shown in “Address translation device in application layer (prior application 3)” and “IP address translation device (prior application 4)”. Here, since the IP address and Port number used by the terminal A for RTP transmission / reception described in the SDP are address-converted, the information after the address conversion (IP address (130.0.0.1), Port number ( 55555)) is also acquired using the media transmission / reception information extraction function 101 and stored in the internal database 110. After performing these processes, the address-converted INVITE message is returned to the NAT / FW device 20 and transferred from the NAT / FW device 20 to the IP telephone terminal D312-a belonging to the network B (global network) 31. The
[0018]
Next, as shown in FIG. 4, the IP telephone terminal D312-a belonging to the network B (global network) 31 that has received the INVITE generates 200OK as a response message to the INVITE and belongs to the network A (private network) 30 It returns to IP telephone terminal A302-a. At that time, the data is transferred to the SIP communication control device 10 as described above. Here, since 200 OK contains information on the IP address (140.0.0.1) and Port number (12345) used by terminal B for RTP transmission / reception in the SDP, media transmission / reception information is also included for these information. Obtained using the extraction function 101.
[0019]
After acquiring the transmission / reception information of the transmission source and the transmission / reception information of the transmission destination before and after the address conversion in this way, as shown in FIG. 5, all the information is notified to the NAT / FW device 20 at once. To do.
[0020]
In the notified NAT / FW device 20, as shown in FIG. 6, for the FW function (A) 210 on the private side in the received media transmission / reception information, the media information of the transmission source before transmission and the transmission destination are globally transmitted. The FW function (B) 211 on the side is notified of the media information of the transmission source and the transmission destination after conversion, thereby allowing the media to pass through each FW.
[0021]
Although the invention made by the present inventor has been specifically described based on the above-described embodiment, the present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the scope of the invention. Of course.
[0022]
【The invention's effect】
By using the SIP communication control device and the NAT / FW device according to the present invention, the media information of the transmission source and the transmission destination is obtained for the private side FW function (A) 210 after acquiring the media transmission / reception information as in the prior art. Can be sent to the FW function (B) 211 on the global side at once, without notifying the source and destination media information after address translation by the NAT device, respectively. It becomes possible. As a result, the number of accesses from the SIP communication control device to the NAT / FW device can be greatly reduced, and the processing performance of both the SIP communication control device and the NAT / FW device can be improved. Be expected.
[Brief description of the drawings]
FIG. 1 is a block diagram for explaining an example of the overall configuration of a system of the present invention.
FIG. 2 is a diagram (No. 1) for explaining a signal sequence and an operation outline of a SIP communication control device and a NAT / FW device according to an embodiment of the present invention;
FIG. 3 is a diagram (No. 2) for explaining a signal sequence and an operation outline of the SIP communication control device and the NAT / FW device in the embodiment of the present invention;
FIG. 4 is a diagram (No. 3) for explaining the signal sequence and the operation outline of the SIP communication control device and the NAT / FW device in the embodiment of the present invention;
FIG. 5 is a diagram (No. 4) for explaining the signal sequence and the operation outline of the SIP communication control device and the NAT / FW device in the embodiment of the present invention;
FIG. 6 is a diagram for explaining an operation outline of the NAT / FW apparatus after being notified of media transmission / reception information in the embodiment of the present invention.
[Explanation of symbols]
10: SIP communication control device 100: Information processing unit 101: Media transmission / reception information extraction function 102: IP address conversion function in SIP message 110: Database 20: NAT / FW device 200: NAT function 210: FW function (A) Private side 211: FW function (B) Global side 30: Network A (private network)
31: Network B (global network)
301, 311: Routers 302-a to 302-c, 312-a to 312-c: IP telephone terminals A to F

Claims (1)

A firewall (FW) function that performs access control based on a network layer IP address and a transport layer port number, and a NAT (Network that converts a “private IP address, private port number” and “global IP address global port number”) Address Translation) A SIP (Session Initiation Protocol) communication control device that registers a set of IP address and port number used for media transmission / reception in the NAT / FW device in cooperation with a NAT / FW device,
Means for acquiring a pair of IP address and port number used for media transmission / reception before address conversion described in the SDP portion of the INVITE SIP message when receiving the INVITE SIP message from the NAT / FW device and storing it in the database When,
Means for performing address conversion of a set of an IP address and a port number used for media transmission / reception in the INVITE SIP message;
Means for storing in the database a set of IP addresses and port numbers used for media transmission / reception after address conversion;
Means for returning the address-converted SIP message of INVITE to the NAT / FW device;
When a 200 OK SIP message, which is a response message to the INVITE, is received from the NAT / FW device, a set of IP address and port number used for media transmission / reception described in the SDP part of the 200 OK SIP message is obtained, and the database Means for storing in,
A set of IP addresses and port numbers used for transmission / reception of the transmission source media stored in the database, a set of IP addresses and port numbers used for transmission / reception of the transmission source media after conversion, and transmission / reception of transmission destination media Means for notifying the NAT / FW device at once the set of IP address and port number used for
A SIP communication control device comprising:

Images