WO2005062546A1 - Procede de conversion et de traversee d'une adresse reseau et son systeme - Google Patents

Procede de conversion et de traversee d'une adresse reseau et son systeme Download PDF

Info

Publication number
WO2005062546A1
WO2005062546A1 PCT/CN2004/001516 CN2004001516W WO2005062546A1 WO 2005062546 A1 WO2005062546 A1 WO 2005062546A1 CN 2004001516 W CN2004001516 W CN 2004001516W WO 2005062546 A1 WO2005062546 A1 WO 2005062546A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
network
port
signaling
message
Prior art date
Application number
PCT/CN2004/001516
Other languages
English (en)
French (fr)
Inventor
Li Yuan
Jun Yan
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Priority to EP04802529A priority Critical patent/EP1693998B1/en
Priority to DE602004019807T priority patent/DE602004019807D1/de
Priority to US10/584,212 priority patent/US7787459B2/en
Publication of WO2005062546A1 publication Critical patent/WO2005062546A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2521—Translation architectures other than single NAT servers
    • H04L61/2528—Translation at a proxy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/256—NAT traversal
    • H04L61/2564—NAT traversal for a higher-layer protocol, e.g. for session initiation protocol [SIP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/256—NAT traversal
    • H04L61/2578—NAT traversal without involvement of the NAT server
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/029—Firewall traversal, e.g. tunnelling or, creating pinholes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/10—Architectures or entities
    • H04L65/102—Gateways
    • H04L65/1023—Media gateways
    • H04L65/103—Media gateways in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/10—Architectures or entities
    • H04L65/102—Gateways
    • H04L65/1033—Signalling gateways
    • H04L65/104—Signalling gateways in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/1066—Session management
    • H04L65/1069—Session establishment or de-establishment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/1066—Session management
    • H04L65/1101—Session protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/1066—Session management
    • H04L65/1101—Session protocols
    • H04L65/1104—Session initiation protocol [SIP]

Definitions

  • the present invention relates to the field of communication technologies in a Next Generation Network (NNG), and in particular, to a method and system for implementing network address translation traversal in NGN.
  • NNG Next Generation Network
  • NGN is a milestone in the history of telecommunications, and it marks the arrival of a new generation of telecommunications network era. From a development perspective, NGN has gradually taken the step from packet switching to public switched telephone networks ("PSTN"). All the services of the original PSTN network were downloaded, and a large amount of data transmission was offloaded to the Internet Protocol (Internet Protocol, "IP”) network to reduce the load of the PSTN network. It also added and enhanced many new features of the IP technology. New and old business. In this sense, NGN is a product of the fusion of PSTN voice network based on Time Division Multiplexing (“TDM" for short) and packet network based on Internet Protocol / Asynchronous Transmission Mode (IP / ATM). It enables integrated services such as voice, video, and data on a new generation of networks. At present, NGN has become a research hotspot.
  • TDM Time Division Multiplexing
  • IP / ATM Internet Protocol / Asynchronous Transmission Mode
  • NGN can be divided into four levels in function: access and transmission layer, media transmission layer, network control layer, and network service layer.
  • SoftSwitch provides call control and connection control functions for services with real-time requirements for NGN. It is the core of NGN call and control.
  • SoftX is a key component of the network control layer of NGN, and is a device that provides integrated services and call control. Its main functions include: call control, signaling gateway, gateway control, Comprehensive business, enhanced business, etc.
  • NGN network based on packet networks
  • IP addresses access users are addressed by IP addresses.
  • NAT egress network address translation / firewall
  • the firewall is used to restrict the unrestricted entry of data packets into the network.
  • the firewall checks the source address, destination address, source port, destination port, and protocol of the packet to determine whether the packet meets the filtering principle. Only the packets that meet the requirements can pass through the firewall.
  • some servers that require external access such as Web servers, are usually placed in this area, and a firewall is configured so that all data packets destined for the corresponding ports of these servers can pass through.
  • the firewall When performing multimedia communication, even if the firewall can let the data packets originally sent to the fixed port to enter, because the audio / video communication needs to establish a channel for sending and receiving data through dynamic port allocation, its range is large and cannot be predicted in advance For the internal terminal's IP address and port information, the firewall cannot ignore the security of the local area network and open such a large packet filtering range.
  • NAT is used to hide the LAN IP address and protect the hosts in the LAN from external attacks. Because the addresses in the LAN cannot be routed on the public network, when the destination address of the data packet When it is an intra-LAN address, the data packet can only be dropped. During multimedia communication, if the address of the H.323 called party is a LAN address, the data packet of the call cannot reach the terminal in the LAN at all. When a call is initiated from the LAN, the caller's IP address, that is, the LAN IP address, and port information are loaded into the payload of the data packet. After the called party receives the data packet, it is based on the source IP address in the payload of the data packet. And the port send audio and video streams.
  • NAT also enables multiple terminals in a local area network to share a smaller number of public IP addresses through network address / port translation. For example, when an application is executed on a terminal in a local area network, the local area network IP address and port are mapped to the gateway's external network IP address and port.
  • the NAT device In multimedia communication, only when the multimedia stream channel is established from the inside to the outside, the NAT device can establish the corresponding port mapping relationship, and the multimedia stream transmitted to the external IP address of the gateway can be correctly transmitted to the terminal of the local area network. If the multimedia stream channel is established from the outside to the inside, the NAT device cannot establish a mapping relationship, and the transmission of the multimedia stream will fail. Furthermore, if these channels are maintained using a timeout mechanism, if no data is transmitted on the channel within the timeout period, this mapping relationship will be canceled. During multimedia communication, if it takes a long time to stop multimedia data on the channel When transmitting, certain measures need to be taken to maintain the establishment of the channel.
  • ACG Application Layer Gateway
  • MIDCOM Middlebox Communication
  • UDP User Datagram Protocol
  • STUN NAT Simple Traversal of UDP Through Network Address Translators
  • Ordinary NAT implements address translation by modifying UDP or Transfer Control Protocol (TCP) packet headers, but part of it is carried by TCP UDP applications such as multimedia sessions, file sharing, games, etc.
  • TCP UDP applications such as multimedia sessions, file sharing, games, etc.
  • End-to-end applications also need to carry address information in the TCP / UDP payload. Under normal circumstances, the application program fills its own address in the TCP UDP payload. This address information is modified to the external address on the NAT when passing NAT, which is the ALG method we often say.
  • the ALG function currently resides in some NAT / Firewall devices, and requires these devices to have application-recognized intelligence. At the same time, every new application needs to be upgraded to NAT / Firewall.
  • ALG needs to support the identification of IP voice and video protocols such as H323, SIP, MGCP / H.248, and control of NAT / Firewall, so that NGN services can pass through smoothly.
  • the key points of ALG are: The internal terminal of the enterprise network / resident network can register with the public network SoftX through NAT / ALG, and perform protocol analysis and call processing through SoftX.
  • Public network SoftX and enterprise network terminals communicate through SIP / H.323 / MGCP / H.248 protocols.
  • NAT / ALG needs to identify SIP / H.323 / MGCP / H.248 protocol signaling and establish media stream channels to support media. Smooth Leap through NAT / FW.
  • ALG is the simplest way to support NGN applications, but due to the actual situation of the network, a large number of NAT / FW devices that do not support NGN service applications have been deployed.
  • MIDCOM is different from ALG.
  • the framework structure of MIDCOM is a trusted third-party MIDCOM agent (Agent) to control the middle box (Middlebo) mechanism.
  • Agent trusted third-party MIDCOM agent
  • the application business intelligence is also transferred from the Middlebox to the external MIDCOM Agent, so the application Xie Yiyi is transparent to Middlebox.
  • the Middlebox function can reside in NAT / FW, and the MIDCOM Agent function can reside in SoftX.
  • the MIDCOM Agent in the softswitch device, it recognizes IP voice and video protocols such as H.323, SIP, MGCP / H.248 and controls NAT / FW. It can be used as a solution for NGN service traversal: NAT / FW Program.
  • SoftX of the public network controls the NAT / FW devices at the edge of the private network through the MIDCOM protocol
  • SoftX does not have SIP / H323 / MGCP / H248 protocols on the calling and called sides, such as the calling and called sides.
  • SoftX needs to control the NAT / FW on both sides of the calling party and the called party through the MIDCOM protocol. After the media stream channel is created on the NAT / FW, the media stream can pass through the NAT / FW smoothly.
  • SoftSwitch device SoftX has realized the identification of the SIP / H323 / MGCP / H248 protocol, it is only necessary to add the MIDCOM protocol to the NAT / FW device, and the new application service identification will be supported by the softswitch in the future. Support, so this scheme is a kind of Solution, but existing NAT / FW equipment needs to be upgraded to support the MIDCOM protocol.
  • Another idea to solve the NGN NAT problem is that the user terminal in the local area network obtains an external address whose address corresponds to the egress NAT in advance through a mechanism, and then the address information described in the packet load is directly filled in the egress NAT.
  • the external address instead of the IP address of the user terminal in the local area network, so that the content of the packet does not need to be modified when passing through NAT. You only need to convert the IP address of the packet header according to the ordinary NAT process.
  • the IP address information in the packet is consistent with the IP address information in the packet header.
  • the STUN protocol is based on this idea to solve the problem of address translation at the application layer.
  • the user's application program as a STUN client (CLIENT), sends a request STUN message to a STUN server (SERVER) outside the NAT through UDP.
  • the STUN SERVER receives the request message and generates a response message.
  • the response message carries the source port of the request message, that is, STUN CLIENT's corresponding external port on NAT.
  • STUN CLIENT learns its corresponding external address on NAT through the content of the response message body, and fills it in the UDP payload of the calling protocol in the future, and informs the peer,
  • the real-time transfer protocol (RealTime Transfer Protocol, RTP) receiving address and port number are addresses and port numbers outside NAT. Because the NAT mapping entry of the media stream is pre-established on the NAT through the STUN protocol, the media stream can pass through the NAT smoothly.
  • the biggest advantage of the STUN protocol is that there is no need to make any changes to the existing NAT / FW equipment. Because there are a large number of NAT / FW in the actual network environment, and these NAT / FW do not support the application of Voice over IP (VoIP), if you use MIDCOM or NAT / ALG to solve this problem, you need to replace With existing NAT / FW, this is not easy.
  • VoIP Voice over IP
  • the STUN method does not require modification of NAT / FW, which is its biggest advantage.
  • the STUN method can be used in a network environment where multiple NATs are connected in series, but the MIDCOM method cannot achieve effective control of multi-level NAT.
  • the STUN SERVER must be placed on the public network and can be embedded in the public network.
  • SoftX since the NAT mapping entry of the media stream is pre-established on the NAT through the STUN protocol, the media stream can pass through the NAT smoothly.
  • STUN The limitation of STUN is that the application needs to support the STUN CLIENT function, that is, the NGN network terminal must have the STUN CLIENT function. At the same time, STUN is not suitable for supporting the traversal of TCP connections, so it does not support the H.323 application protocol. In addition, the STUN method does not support traversal of firewalls by NGN services, and the STUN method does not support symmetric NAT traversal.
  • TURN mode The TURN method is similar to STUN.
  • the idea of solving the NAT problem is also based on that private network access users obtain their private address corresponding to the public network address in advance through a mechanism, and then fill in the address letter described in the message payload directly.
  • the public network address The difference is that the address obtained in advance in the STUN mode is the address on the egress NAT, and the address obtained in advance in the TURN mode is the address on the TURN server (SERVER).
  • the TURN application model is shown in Figure 1.
  • the system and system for implementing the TURN method include grouped user terminals 10, 11, NAT FW 20, 21, SoftX 40, 41, and TURN SERVER50. It assigns the address and port of the TURN Server as the external receiving address and port of the TURN client (TURN CLIENT), that is, the packets sent by the user terminals in the local area network must be relayed and forwarded by the TURN server. It is worth pointing out that this is the biggest difference between the STUN method and the TURN method.
  • this method can also solve the defects that the STUN method cannot penetrate Symmetric NAT and firewall equipment, that is, no matter what type of NAT / FW the corporate network / resident network exit is, Both can achieve NAT penetration, and TURN supports TCP-based applications, such as the H.323 protocol.
  • the TURN SERVER controls the allocation of addresses and ports, and can allocate a RealTime Transfer Protocol (RTP) / RealTime Transfer Control Protocol (RTC) address pair as the receiving address of the local client.
  • RTP RealTime Transfer Protocol
  • RTC RealTime Transfer Control Protocol
  • the egress NAT arbitrarily allocates RTP / RTCP addresses and port numbers, so that clients cannot receive RTCP packets from the peer.
  • TURN The limitation of TURN is that the terminal needs to support TURN CLIENT, which has the same requirements for network terminals as STUN. In addition, all packets must be forwarded through the TURN server, which increases the delay of packets and the possibility of packet loss.
  • network terminals that require NGN have the TURN Client function.
  • the signaling receiving port and the sending port of the multimedia terminal are inconsistent, the RTP / RTCP receiving port and the sending port are inconsistent, which may cause a problem that the NAT cannot be traversed.
  • the main object of the present invention is to provide a method and a system for implementing network address translation traversal, so that the existing NAT / FW and user terminal are transformed.
  • the present invention provides a method for implementing network address translation traversal, which includes the following steps:
  • a network address translation server or a proxy server other than a firewall receives a signaling message from a packet user terminal in the first network, it parses the signaling payload information and records the call signaling in the message payload.
  • the address and port, and the media stream real-time transmission protocol and real-time transmission control protocol address and port and modify the call signaling address and port in the message load information to the proxy server for Call signaling address and port in the network, modify the media stream real-time transmission protocol and real-time transmission control protocol address and port in the message load information to the address in the second network allocated by the proxy server for the media stream And port;
  • the proxy server sends the modified signaling message to a packet voice signaling processing device or a service processing device;
  • the proxy server When the proxy server receives a response signaling message sent to the packet user terminal in the first network, analyze the load information of the response signaling message, and respond to the signaling in the message load information.
  • the address and port are modified to the call signaling address and port recorded in step A, and the media stream real-time transmission protocol, protocol, and real-time transmission control protocol address and port carried in the message load information are modified to the address and port recorded in step A Media stream real-time transmission protocol and real-time transmission control protocol address and port;
  • the proxy server sends the modified response signaling message to the packet user terminal in the first network.
  • the method may further include:
  • the packet user terminal in the first network sends a signaling message to the proxy server, and the signaling message is first sent to a network address translation server or a firewall, and the network address translation server or firewall allocates a public network to the signaling message.
  • Address / port, and the source of the IP header of the signaling packet The address is changed from the address / port of the first network to the public network address / port assigned to it, and the first network address / port and the public network address assigned by the network address translation server or firewall are recorded in a signaling address mapping relationship / Port correspondence, and then forward the signaling message to the proxy server.
  • step A After performing step A, it may include:
  • the proxy server periodically initiates messages to the grouped user terminals in the first network, and updates the signaling address mapping relationship on the network address translation server or firewall.
  • Step A may further include:
  • the proxy server When the proxy server receives the call signaling from the packet user terminal in the first network, it records the IP header address and port of the call signaling packet, and modifies it to the proxy server to allocate the call for the call.
  • the call signaling address and port in the second network
  • step C further includes:
  • the proxy server When the proxy server receives a call signaling addressed to a packet user terminal in the first network, change the templet IP header address and port 4 of the call signaling to the recorded call signaling. Packet IP header address and port.
  • the packet voice signaling processing device or service processing device is a softswitch device or an IP voice gatekeeper device.
  • a system for implementing network address translation traversal includes:
  • Grouped user terminals located in the first network for initiating and receiving services
  • a proxy server located in the second network is configured to receive a signaling message from the packet user terminal in the first network, analyze the message load information of the signaling message, and record a call in the message load.
  • the media stream address and port in the message payload are modified to the address and port in the second network that the proxy server assigned to the media stream.
  • the modified signaling message to the softswitch device, and when the proxy server receives the response signaling sent to the packet user terminal in the first network, the response Parse the signaling message load information, modify the response signaling address and port in the message load to the recorded call signaling address and port, and change the media stream address and port carried in the message load, Modify it to the recorded media stream address and port, and then send the changed response signaling to the packet user terminal in the first network;
  • the soft switching device is configured to provide integrated services and call control, and forward it to the proxy server when receiving a response signaling message sent to the group user terminal.
  • the system may further include:
  • a network address translation server or firewall is configured to provide the packet user terminal with a service for accessing the second network, and forward packets between the packet user terminal and the proxy server.
  • the packet user terminal may be a user terminal that uses the ⁇ .323 protocol, or the session initiation protocol, or the media gateway control protocol, or the ⁇ .248 protocol for audio and video communications.
  • the proxy server can also be used to charge according to the traffic.
  • the proxy server can also be used for user access control, bandwidth management, and encryption of the quality of service tag, virtual private network tag, and information of the media stream.
  • the proxy server is further used for setting multiple first network and second network address pairs, and simultaneously traversing multiple network address translation servers or firewalls.
  • the proxy server may also use the first packet refresh method to update the session entries or address translation relationship entries of the media stream.
  • the proxy server not only converts the address / port of the IP header of the message, but also carries the The signaling address / port and RTP / RTCP address / port are also converted.
  • FIG. 1 is a system structure diagram in a TURN mode
  • FIG. 2 is a system structure diagram of a FULL PROXY mode according to an embodiment of the present invention
  • FIG. 3 is a flowchart of a method for implementing NAT / FW traversal in a FULL PROXY mode according to an embodiment of the present invention. Modes for Carrying Out the Invention To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be described in further detail below with reference to the accompanying drawings.
  • the full proxy (FULL PROXY) method is used to implement NAT / FW traversal by relaying call signaling and media streams of user terminals in the private network at the same time.
  • FIG. 2 is a schematic structural diagram of a specific embodiment of a FULL PROXY-type system according to the present invention. In order to highlight the present invention, only the parts which are closely related to the present invention are marked in FIG.
  • the system in this embodiment includes packet user terminals 10 and 11, NAT / FW 20 and 21, a proxy server (PROXY SERVER) 30, and a soft switching device (SoftX) 40. And 41.
  • the grouped user terminals 10 and 11 belong to different networks and are connected to PROXY SERVER 30 through NAT FW 20 and 21 respectively; PROXY SERVER 30 is connected to SoftX 40 and 41.
  • the solid line is the media stream, and the dotted line is the signaling stream.
  • the packet user terminals 10 and 11 communicate using audio / video protocols such as H.323, Session Initation Protocol (SIP), Media Gateway Control Protocol (MGCP), and H.248.
  • the packet user terminal is the initiator and receiver of the multimedia service.
  • the private network the public network is accessed through NAT / FW20 and 21 respectively.
  • the private network and the public network mentioned in the present invention are only a specific special case. Essentially, as long as they are two networks, they can be different local networks, one can be a local network, and the other is an external public network. As long as one network is within the NAT / FW, the network is considered a private network, and the other network is outside the NAT / FW, the network is considered a public network.
  • NAT / FW 20 and 21 refer to devices that implement the NAT function and the firewall function, and are usually configured at the location where the private network accesses the public network. On the one hand, it is used to prevent data packets from entering the private network without restrictions, and to protect the hosts on the private network from external attacks; on the other hand, through network address port translation, private IP addresses are hidden to enable multiple user terminals in the private network. Able to share a small number of public IP addresses.
  • PROXY SERVER 30 is similar to the TURN SERVER in the prior art and is placed in the metropolitan area network convergence layer, and is used to implement the functions of FULL PROXY, that is, the signaling agent and media relay functions.
  • the specific functions are as follows: When receiving the signaling message from the packet user terminal 10, PROXY SERVER 30 analyzes and processes the signaling message load, and obtains the IP header address / port of the signaling message and the signaling message.
  • the call signaling addresses / ports in the payload and the user terminal's receiving media stream addresses / ports, these addresses / ports are private network addresses / ports.
  • PROXY SERVER 30 allocates call signaling addresses / ports in the public network for the signaling message, the call signaling in the payload of the signaling message, and the user terminal receiving the media stream. And record the above private network Correspondence between address / port and public network address / port.
  • Header address / port call signaling address / port in the private network corresponding to the call signaling address / port in the signaling message payload, and private address corresponding to the address / port of the media stream in the signaling message payload
  • the address / port of the media stream in the network modify the IP header address / port of the signaling packet to the IP header address / port of the signaling packet in the private network; call the signaling address / Modify the call signaling address / port in the private network on the port; modify the media stream address / port carried in the signaling message to the media stream address / port in the private network; and finally, follow the repaired signaling message IP
  • the header address forwards the message. In this way, call signaling and media streams can be relayed between the caller and the callee through PROXY SERVER30.
  • PROXY SERVER 30 can be configured with multiple IP address pairs. If PROXY SERVER30 is configured with multiple private network IP addresses or multiple public network IP addresses, you can use a single device to simultaneously traverse multiple enterprise network / resident network egress FW / NAT or proxy multiple softswitches at the same time . In this way, it is ensured that no matter in which networking mode the PROXY SERVER30 is, whether the NAT is symmetric or not, the media flow can be correctly forwarded.
  • PROXY SERVER 30 In addition, through processing and analysis of signaling, PROXY SERVER 30 not only obtains the address conversion of this session, but also obtains quality of service such as bandwidth requirements (Quality of Service (referred to as "QoS”) information. Therefore, it can control the passage and close of the media stream through the session state information to protect the network and prevent bandwidth theft.
  • QoS Quality of Service
  • PROXY SERVER30 can provide access control functions and bandwidth management functions for users, provide QoS marking for media streams, virtual local area network (Virtual Local Area Network, "VLAN”) marking and information encryption.
  • VLAN Virtual Local Area Network
  • the present invention may also introduce a timing refresh mechanism of the NAT address binding relationship, that is, PROXY SERVER 30 periodically sends packets to the packet user terminal 10 after the address is parsed to obtain the address, to refresh the enterprise exit NAT /
  • the mapping relationship of the signaling address on the FW20 is the correspondence between the private network IP address / port and the IP address / port on the public network allocated by the NAT / F W20.
  • PROXY SERVER30 After resolving the traversal of the signaling address to the enterprise egress NAT, for the interaction of the media stream, PROXY SERVER30 uses the first packet refresh method to update the session entry or address translation entry of the media stream, that is, after the media stream is sent by the terminal, The NAT / FW20 of the enterprise exit is converted to PROXY SERVER30, and the first packet is learned to obtain the dynamically assigned address / port information on the NAT / FW20 of the exit, thereby updating the media stream session entry, establishing a complete media stream session entry, and completing the Media forwarding function when the public network accesses multiple enterprises. '
  • PROXY SERVER30 After the introduction of PROXY SERVER30 in the system, since the media streams of the calling party and the called party both pass through PROXY SERVER30, PROXY SERVER30 can accurately obtain the media traffic, thereby realizing the billing based on the message traffic, not just the traditional Duration-based billing.
  • SoftX40 and 41 are softswitch devices. As key components of the NGN network control layer, they are used to provide integrated services and call control. When receiving the signaling message sent from the public network to the packet user terminal in the private network, the received message is forwarded to PROXY SERVER30.
  • Step 200 The packet user terminal 10 in the private network sends a signaling message to the PROXY SERVER 30.
  • the signaling message contains registration and call information, and the source address of the IP header of the signaling message is a private network address.
  • the group user terminal 10 regards the PROXY SERVER 30 as a soft switching device. Specifically, the signaling message originating from the packet user terminal 10 is first sent to the NAT / FW 20, and the NAT / FW 20 assigns a public network address / port to the signaling message, and sends the message to the IP header.
  • the source address is changed from the private network address / port to the public network address / port assigned to it, but the internal information of the message is not changed. Record the above private network address / port and the public network address assigned by NAT / FW 20 / Correspondence between ports, and then forward the signaling message to PROXY SERVER30.
  • Step 210 After receiving the signaling message, PROXY SERVER 30 analyzes and processes the information carried in the signaling message payload, and obtains the IP header address / port of the signaling message, and the call message in the message payload. Let the address / port and the media stream address / port requested by the user terminal, and PROXY SERVER 30 allocate the signaling message, the call signaling in the signaling payload, and the media stream requested by the user terminal, respectively. Address / port in the public network. Then, the IP header address / port of the routing message of PROXY SERVER30 is changed to the address / port in the public network allocated by PROXY SERVER30 for the call, and the call signaling address in the payload is changed to PROXY SERVER30 for the call.
  • Assign the call signaling address / port in the public network modify the media stream address / port in the packet payload to the public network address / port allocated by PROXY SERVER30 for this media stream, and record the private network Correspondence between the IP header address / port of the signaling message, the call signaling address / port in the message payload, and the media stream address / port requested by the user terminal, and the address / port in the public network allocated by PROXY SERVER30 relationship.
  • Step 220 Forward the modified signaling message in step 210 to the softswitch device SoftX40o
  • Step 230 When SoftX40 receives the response signaling message to be sent to the packet user terminal 10, it forwards the response signaling message to PROXY SERVER30.
  • Step 240 When the PROXY SERVER 30 receives the response signaling message sent to the packet user terminal 10 in the private network, it parses the response signaling message load information to obtain the IP header address / port and response of the response signaling message. The address / port, media stream address / port of the response signaling in the signaling message payload, and then the IP header address / port of the response command message, the address / port, and media of the response signaling in the response signaling message payload.
  • the stream address / port obtains the corresponding IP address, call signaling address / port, and media stream address / port from the corresponding relationship recorded by itself, and then changes the IP header address / port of the response signaling to 4
  • the corresponding IP header address / port in the private network modify the response signaling address / port in the response signaling packet load to the corresponding call signaling address / port in the private network, and modify the media stream carried in the response signaling
  • the address / port is changed to the corresponding media stream address / port in the private network.
  • the media stream address / port can be an RTP / RTCP address / port.
  • NAT FW traversal By recording and modifying the signaling and media stream addresses / ports in the packet payload in steps 210 and 240, the NAT FW traversal is realized, and the existing traversal in any networking form does not require the existing traversal. NAT / FW and user terminal for transformation.
  • Step 250 PROXY SERVER 30 sends the modified response signaling message to the packet user terminal 10 in the private network.
  • PROXY SERYER30 first sends the modified response signaling message to NAT / FW20, and the destination address of the message is the public network address / port allocated by NAT / FW20 for the call of packet user terminal 10, NAT / FW20 Query the private network address / port corresponding to the public network destination address / port of the packet from the correspondence table between the private network address / port and public network address / port recorded by itself, and then use the queried private network address / The port replaces the public network destination address / port of the message, and then forwards the response signaling message after address / port translation to the packet User terminal 10.
  • the FULL PROXY mode of the present invention has the following differences compared with the TUR mode relay:
  • the TURN method is to assign an address / port when the TURN server interacts with the user terminal through the TURN protocol.
  • the internal address information of the message is generated by the terminal.
  • the TURN server performs address conversion on the subsequent message based on the assigned address / port information.
  • the device that relays the message parses and processes the call protocol, rewrites the media stream address information carried in the message, and forwards the signaling message. At the same time, the media message is transmitted based on the rewritten media stream address information. After doing the address translation, the relay is forwarded.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • General Business, Economics & Management (AREA)
  • Business, Economics & Management (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)
  • Computer And Data Communications (AREA)
  • Communication Control (AREA)

Description

实现网络地址转换穿越的方法及其系统 技术领域 本发明涉及下一代网络（Next Generation Network, 筒称 "NGN" ) 中通信技术领域， 特别涉及 NGN中实现网络地址转换穿越的方法及其 系统。 发明背景
NGN是电信史的一块里程碑， 它标志着新一代电信网络时代的到 来。从发展的角度来看， NGN是从传统的以电路交换为主的公用电话交 换网 （ Public Switched Telephone Network, 筒称 "PSTN" ) 中逐渐迈出 了向以分组交换为主的步伐， 它承载了原有 PSTN网络的所有业务， 把 大量的数据传输卸载到网间互联协议（Internet Protocol, 简称 "IP" ) 网 络中以减轻 PSTN网络的重荷，又以 IP技术的新特性增加和增强了许多 新老业务。 从这个意义上讲， NGN是基于时分多路复用 （ Time Division Multiplexing, 简称 "TDM" ) 的 PSTN语音网络和基于网间互联协议 / 异步传输模式（IP/ATM )的分组网络融合的产物， 它使得在新一代网络 上语音、视频、 数据等综合业务成为了可能。 目前， NGN成为了研究的 热点。
NGN在功能上可分为四个层次: 接入和传输层、媒体传送层、 网络 控制层、 网络服务层。 软交换（SoftSwitch )为 NGN提供具有实时性要 求的业务的呼叫控制和连接控制功能， 是 NGN呼叫与控制的核心。 软 交换构件（SoftX )为 NGN的网络控制层的关键构件， 是提供综合业务 和呼叫控制的设备。 其主要作用包括： 呼叫控制、信令网关、 网关控制、 综合业务、 增强业务等。
随着 NGN网絡逐步从实验走向商用， NGN用户的接入问题越来越 成为一个严重的问题。 由于 NGN是一个基于分组网承载的网络， 接入 用户都是通过 IP地址来寻址， 而当前网络由于 IP地址紧缺以及安全等 各种原因，大量的企业网和驻地网基本上都采用了私有 IP地址通过出口 的网络地址转换 /防火墙（NAT/FW )接入公网。
然而，目前 NGN中，在 IP上承载诸如 H.323、会话初始协议（ Session Initiationl Protocol , SIP )、 网关控制协议 ( Media Gateway Control Protocol , MGCP )、 H.248 等语音和视频协议时， 由于报文的负载中有 与报头不一样的地址，使得这些协议的控制通道 /媒体通道难以穿越传统 的 NAT/FW设备与公网进行互通。 其具体原因可通过对 NAT/FW的分 析得知：
防火墙， 即 FW, 用于限制数据包无限制的进入网络内。 一般是设 定一些包过滤原则， 防火墙通过检查数据包的源地址、 目标地址、 源端 口、 目标端口和协议来判断数据包是否符合过滤原则， 符合的数据包才 可以通过防火墙。 在实际应用时， 通常将一些需要外界访问的服务器， 如 Web服务器等放在这个区域内， 配置防火墙， 使所有发往这些服务器 的对应端口的数据包可以通过。 在进行多媒体通信时， 即使防火墙可以 让最初建立呼叫的发往固定端口的数据包进入，由于音 /视频通信需要通 过动态分配端口来建立发送和接收数据的通道， 其范围较大且无法事先 预知内部终端的 IP地址和端口信息， 防火墙不可能不顾局域网的安全， 开放这么大的包过滤范围。
另一方面， 再从 NAT考察有关原因：
NAT用于隐藏局域网 IP地址、 保护局域网内主机不受外界攻击。 由于局域网内的地址无法在公网上进行路由寻址， 当数据包的目标地址 是 LAN 内地址时， 数据包只能被丟弃掉。 在进行多媒体通信时， 如果 H.323 被叫方的地址是局域网地址， 则该呼叫的数据包根本无法到达局 域网内终端。 当从局域网内向外发起呼叫时， 呼叫方的 IP地址， 即局域 网 IP地址，和端口信息会加载在数据包的负载中，被叫方接收到数据包 后， 根据数据包负载中的源 IP地址和端口发送音频、 视频流， 当这个 IP地址是一个无法进行路由寻址的 IP时， 即上述局域网 IP地址无法进 行路由寻址的情况， Internet上的路由器只能将这些数据包丟掉。 因此， 表面上看起来呼叫已经建立，但实际上在： NAT内的终端是无法接收到外 面终端的音频和视频的。 另外， NAT还通过网络地址 /端口转换使局域 网内的多个终端能够共享较少数量的公网 IP地址。如在局域网内的某个 终端执行某个应用时， 将其局域网 IP地址和端口映射成网关的外网 IP 地址和端口。 在多媒体通信时， 只有多媒体流通道是从内向外建立时， NAT设备才可以建立对应的端口映射关系， 传送到网关的外网 IP地址 上的多媒体流才可正确地传送到局域网的终端。 如果多媒体流通道是从 外向内建立的，则 NAT设备无法建立映射关系，多媒体流的传送会失败。 再有， 如果这些通道采用的是超时的机制维持， 如果在超时时间内该通 道没有数据传送， 这个映射关系就会被取消掉， 在多媒体通信时， 如果 需要有很长时间停止通道上多媒体数据传送时， 需要采取一定的措施来 维持通道的建立。
上面详细分析了音频、 视频业务无法通过 NAT/FW的原因。 然而， NGN网络最大的好处之一就是能为用户提供丰富的业务，特别是为企业 用户提供语音、 数据、 视频融合的业务， 因此上面所提到问题的解决就 更加的迫切， 成为目前 NGN网络业务开展最大的障碍。 另一方面， 宽 带接入网絡由于大多不属于运营商网络， 运营商无法对其进行统一规 划， 使得接入网絡的 IP地址问题、 业务质量保证（Quality of Service , 筒称 "QoS" )和安全保证问题、 实时会话业务和数椐业务的区分等问题 难以得到解决， 这些问题成为困扰运营商的重要方面。
目前业界现有的解决方法有应用层网关方式 （Application Layer Gateway, 简称 "ALG" )、 中间盒通讯方式（ Middlebox Communication, 筒称 "MIDCOM" )、 用户数据报协议（User Datagram Protocol, UDP ) 对 NAT 的简单穿越方式（Simple Traversal of UDP Through Network Address Translators , 筒称 "STUN"；)、 通过中继^"式穿越 NAT 方式 ( TURN )o
下面简单说明上述各种现有技术的内容。
第一种： ALG方式。 普通 NAT是通过修改 UDP )或传输控制协议 ( Transfer Control Protocol , TCP )报文头部地址信 、实现地址的转换， 但部分承载于 TCP UDP的应用， 如多媒体会话、文件共享、 游戏等 "端 到端" 的应用， 在 TCP/UDP 负载中也需带地址信息。 一般情况下， 应 用程序在 TCP UDP负载中填写自身地址， 此地址信息在通过 NAT时被 修改为 NAT上对外的地址， 即我们常说的 ALG方式。
ALG功能目前主要驻留在一些 NAT/Firewall设备中， 要求这些设 备本身具备应用程序识别的智能。 同时每增加一种新的应用程序都需要 对 NAT/Firewall进行升级。
对 NGN业务应用， ALG 需要支持 IP语音和诸如 H323、 SIP、 MGCP/H.248等视频协议的识别和对 NAT/Firewall 的控制， 以使 NGN 业务顺利穿越。
ALG的关键点为： 企业网 /驻地网内部终端能穿透 NAT/ALG注册 到公网 SoftX上， 通过 SoftX进行协议解析和呼叫处理。 公网 SoftX和 企业网终端通过 SIP/H.323/MGCP/H.248 协议互通， NAT/ALG需要识别 SIP/ H.323/MGCP/H.248协议信令并建立媒体流通道， 以支持媒体流顺 利穿越 NAT/FW。
ALG是支持 NGN应用一种最筒单的方式， 但由于网络实际情况是 已部署了大量不支持 NGN业务应用的 NAT/FW 备。
第二种情况： MIDCOM方式。 MIDCOM与 ALG不同， MIDCOM 的框架结构是采用可信的第三方 MIDCOM代理 （Agent ) 对中间盒 ( Middlebo ) 进行控制的机制， 应用业务识别的智能也由 Middlebox 转移到外部的 MIDCOM Agent上， 因此应用协 i义对 Middlebox是透明 的 。
由于应用业务识别的智能从 Middlebox移到夕卜部的 MIDCOM Agent 上， 根据 MIDCOM 的架构， 在不需要更改 Middlebox基本特性的基础 上，通过对 MIDCOM Agent的升级就可以支持更多的新业务，这是相对 ALG方式的一个很大的优势。
在 NGN 业务实际应用中， Middlebox 功能可驻留在 NAT/FW, MIDCOM Agent功能可驻留在 SoftX。 通过软交换设备中的 MIDCOM Agent对 IP语音和诸如 H.323、 SIP、 MGCP/H.248等视频协议的识别和 对 NAT/ FW的控制， 它可以作为 NGN业务穿越: NAT/FW的一个解决 方案。
MIDCOM方式的关键点为：公网 SoftX通过 MIDCOM协议对私网 边缘的 NAT/FW 设备进行控制， SoftX 别主、 被叫侧的 SIP/H323/MGCP/H248协议， 如主、 被叫侧均为局内的私网用户， SoftX 需要通过 MIDCOM协议控制主、 被叫两侧的 NAT/FW, 在 NAT/FW上 创建了媒体流通道后， 媒体流可顺利穿越 NAT/FW。
由于软交换设备 SoftX上已实现了对 SIP/H323/MGCP/H248协议的 识别， 只需在 NAT/FW设备上增加 MIDCOM协汉即可， 而且以后新的 应用业务识别随着软交换的支持而支持， 因此这仲方案是一种比较有前 途的解决方案， 但现有的 NAT/FW设备需升级支持 MIDCOM协议。 第三种： STUN方式。 解决 NGN NAT问题的另一思路是， 局域网 内的用户终端通过某种机制预先得到其地址对应在出口 NAT上的对外 地址，然后在报文负载中所描述的地址信息就直接填写出口 NAT上的对 外地址， 而不是该用户终端的在局域网内的 IP地址，这样报文负载中的 内容在经过 NAT时就无需被修改了， 只需按普通 NAT流程转换报文头 的 IP地址即可， 负载中的 IP地址信息和报文头的 IP地址信息又是一致 的。 STUN协议就是基于此思路来解决应用层地址的转换问题。
用户的应用程序，作为 STUN客户端（CLIENT )向 NAT外的 STUN 服务器 （SERVER )通过 UDP发送请求 STUN 消息， STUN SERVER 收到请求消息， 产生响应消息， 响应消息中携带请求消息的源端口， 即 STUN CLIENT在 NAT上对应的外部端口。 然后， 响应消息通过 AT 发送给 STUN CLIENT, STUN CLIENT通过响应消息体中的内容得知其 在 NAT上对应的外部地址，并且将其填入以后呼叫协议的 UDP负载中， 告知对端 , 本端的实时传输协议 ( RealTime Transfer Protocol , RTP )接 收地址和端口号为 NAT外的地址和端口号。 由于通过 STUN协议已在 NAT上预先建立媒体流的 NAT映射表项， 故媒体流可顺利穿越 NAT。
STUN协议最大的优点是无需现有 NAT/FW设备做任何改动。 由于 实际的网络环境中， 已存在大量的 NAT/FW, 并且这些 NAT/FW并不支 持分组语音（ Voice over IP, VoIP )的应用，如果用 MIDCOM或 NAT/ALG 方式来解决此问题， 需要替换现有的 NAT/FW, 这是不太容易的。 而采 用 STUN方式无需改动 NAT/FW, 这是其最大优势， 同时 STUN方式可 在多个 NAT串联的网络环境中使用，但 MIDCOM方式则无法实现对多 级 NAT的有效控制。
根据 STUN原理， STUN SERVER必须放在公网中， 可以内嵌在公 网 SoftX中， 由于通过 STUN协议已在 NAT上预先建立媒体流的 NAT 映射表项， 故媒体流可顺利穿越 NAT。
STUN的局限性在于需要应用程序支持 STUN CLIENT的功能， 即 NGN的网络终端需具备 STUN CLIENT功能。同时 STUN并不适合支持 TCP连接的穿越， 因此不支持 H.323 应用协议。另外 STUN方式还不支 持 NGN业务对防火墙的穿越， 同时 STUN方式不支持对称 NAT类型的 穿越。
第四种： TURN方式。 TURN方式与 STUN相似， 其解决 NAT问 题的思路也是基于私网接入用户通过某种机制预先得到其私有地址对 应在公网的地址， 然后在报文负载中所描述的地址信 ·就直接填写该公 网地址。 不同的是， STUN方式预先得到的地址为出口 NAT上的地址， TURN方式预先得到的地址为 TURN服务器 （SERVER )上的地址。
TURN应用模型如图 1所示，实现 TURN方式的系、统包括分组用户 终端 10、 11 , NAT FW 20, 21 , SoftX 40、 41以及 TURN SERVER50。 它通过分配 TURN Server 的地址和端口作为 TURN 客户端 （TURN CLIENT )对外的接受地址和端口， 即局域网内用户终端发出的报文都 要经过 TURN SERVER进行中继转发。值得指出，这 是 STUN方式与 TURN方式区别最大的地方。 这种方式除了具有 STUNT方式的优点外， 还能解决 STUN方式中应用无法穿透对称 NAT ( Symmetric NAT ) 以及 防火墙设备的缺陷， 即无论企业网 /驻地网出口为哪种类型的 NAT/FW, 都可以实现 NAT的穿透， 同时 TURN支持基于 TCP的应用， 如 H.323 协议。 此外 TURN SERVER控制分配地址和端口， 能分配实时传输协议 ( RealTime Transfer Protocol ， 简称 "RTP" ) /实时传输控制协议 ( RealTime Transfer Control Protocol , 筒称 "RTCP" ) 地址对作为本端 客户的接受地址， 其中 RTCP端口号为 RTP端口号力口 1 , 从而避免了 STUN应用模型下出口 NAT对 RTP/RTCP地址端口号的任意分配，使得 客户端无法收到对端发过来的 RTCP报文。
TURN的局限性在于需要终端支持 TURN CLIENT,这一点同 STUN 一样对网络终端有要求。 此外， 所有报文都必须经过 TURN SERVER转 发， 增大了包的延迟和丢包的可能性。
综上所述， 上述四种方案分别存在以下问题：
对于 ALG方式， 不但需要对现有的大量 NAT/FW进行改造以支持 ALG, 而且 NAT/FW此时难以支持业务的变化， 还有因为 ALG 不能识 别加密后的报文内容， 所以必须保证报文采用明文传送， 这使得报文在 公网中传送时有艮大的安全隐患。
对于 MIDCOM方式， 需要对现有大量的 NAT/FW进行升级以支持 MIDCOM。 而且， 运营商难以对属于企业的 NAT/FW进行升级和管理。
对于 TURN方式， 需要 NGN的网络终端具备 TURN Client功能， 此外如果多媒体终端的信令收端口和发端口不一致， RTP/RTCP 的收端 口和发端口不一致则可能造成无法穿越 NAT的问题。
对于 STUN方式， 除了具有与 TUR —样的问题， 即需要网络终 端支持和会因端口配置不一致而无法穿越 NAT夕卜， 还不支持 TCP连接 穿越和对称 NAT的穿越。
造成上述些缺点的主要原因在于，一方面， ALG、MIDCOM、 STUN、 TURN方式的实现需要 NAT/FW或用户终端的支持； 另一方面， 由于各 种方式本身的缺陷， 使得它们在面对一些应用无能为力。 发明内容
有鉴于此， 本发明的主要目的在于提供一种实现网絡地址转换穿越 的方法及其系统， 使得在任何组网形式下实现穿越时均不需要对现有的 NAT/FW和用户终端进行改造。
为实现上述目的 ,本发明提供了一种实现网络地址转换穿越的方法， 包含以下步驟：
A 当网络地址转换服务器或防火墙以外的代理服务器收到来自第 一网絡内分组用户终端的信令报文时， 对该信令 艮文负载信息进行解 析， 记录该报文负载中的呼叫信令地址和端口， 以及媒体流实时传输协 议和实时传输控制协议地址和端口， 并且将该报文负载信息中的呼叫信 令地址和端口修改为所述代理服务器为该呼叫分酉 &的在第二网络中的 呼叫信令地址和端口， 将该报文负载信息中的媒体流实时传输协议和实 时传输控制协议地址和端口修改为所述代理服务器为该媒体流分配的 在第二网络中的地址和端口；
B 所述代理服务器将修改后的所述信令报文发送到分组语音信令 处理设备或业务处理设备；
C 当所述代理服务器收到发向所述第一网络内分组用户终端的回 应信令报文时， 对该回应信令报文负载信息进行觯析， 将该报文负载信 息中回应信令地址和端口修改为步骤 A 中所记录的呼叫信令地址和端 口， 将该报文负载信息所携带的媒体流实时传输协、议和实时传输控制协 议地址和端口，修改为步骤 A中所记录的媒体流实时传输协议和实时传 输控制协议地址和端口；
D 所述代理服务器将修改后的所述回应信令 艮文发向所述第一网 络内分组用户终端。
在步骤 A之前， 该方法可以进一步包括：
第一网絡内的分组用户终端向所述代理服务器发送信令报文， 该信 令报文先被发送到网络地址转换服务器或防火墙， 网络地址转换服务器 或防火墙为该信令报文分配公网地址 /端口， 并将该信令报文 IP头的源 地址从第一网络的地址 /端口修改为为其分配的公网地址 /端口， 并在信 令地址映射关系中记录所述第一网络地址 /端口与网络地址转换服务器 或防火墙分配的公网地址 /端口之间的对应关系 ,然后把该信令报文转发 到所述代理服务器。
在执行步骤 A后， 可以包括：
所述代理服务器定期向所述第一网络内分组用户终端发起报文， 刷 新所述网络地址转换服务器或防火墙上的信令地址映射关系。
步骤 A还可以进一步包括：
当所述代理服务器收到来自所述笫一网络内分组用户终端的呼叫信 令时，记录该呼叫信令的报文 IP头地址和端口， 并将其修改为所述代理 服务器为该呼叫分配的在第二网絡中的呼叫信令地址和端口；
则步骤 C进一步包括：
当所述代理服务器收到发向所述第一网络内分组用户终端的呼叫信 令时，将该呼叫信令的寺艮文 IP头地址和端口 4 改为所述被记录的呼叫信 令的报文 IP头地址和端口。
其中， 所述分组语音信令处理设备或业务处理设备是软交换设备或 IP语音网守设备。
本发明提供的一种实现网络地址转换穿越的系统包含：
位于第一网络内分组用户终端, 用于发起和接收业务;
位于第二网絡内的代理服务器， 用于接收来自第一网絡的所述分組 用户终端的信令报文， 对该信令报文的报文负载信息进行解析， 记录该 报文负载中的呼叫信令地址和端口， 以及媒体流地址和端口， 并且将该 报文负载中的呼叫信令地址修改为所述代理服务器为该呼叫分配的在 第二网络中的呼叫信令地址和端口， 将该报文负载中的媒体流地址和端 口修改为所述代理服务器为该媒体流分 ®£的在第二网絡中的地址和端 口， 然后将修改后的所述信令拫文发送到所述软交换设备， 和， 当所述 代理服务器收到发向所述第一网络内分组用户终端的回应信令时， 对该 回应信令的报文负载信息进行解析， 将该报文负载中回应信令地址和端 口修改为所述被记录的呼叫信令地址和端口， 将该报文负载所携带的媒 体流地址和端口， 修改为所述被记录的媒体流地址和端口， 然后将 "ί 改 后的所述回应信令发向所述第一网络内分組用户终端；
软交换设备， 用于提供综合业务和呼叫控制， 在收到发送给所述分 组用户终端的回应信令报文时转发给所述代理服务器。
该系统可以进一步包括：
网络地址转换服务器或防火墙， 用于为所述分组用户终端提供接入 第二网络的服务， 为所述分组用户终端和所述代理服务器相互转发报 文。
所述分组用户终端可以是使用 Η.323协议、 或会话初始化协议、 或 媒体网关控制协议、 或 Η.248协议进行音频和视频通信的用户终端。
所述代理服务器还可以用于按照流量计费。
所述代理服务器还可以用于用户的接入控制、 带宽管理， 对媒体流 的服务质量标记、 虚拟专用网标记和信息进行加密。
所述代理服务器还用于多个第一网络和第二网络地址对的设置， 同 时实现对多个网络地址转换服务器或防火墙的穿越。
对于媒体流的交互， 所述代理月艮务器还可以采用首包刷新方式来更 新媒体流的会话表项或地址转换关系表项。
通过比较可以发现， 本发明的技术方案与现有技术的区别在于， 本 发明通过代理服务器对 NAT/FW进行穿越， 代理服务器不但对报文 IP 头的地址 /端口进行转换， 而且对 艮文中携带的信令地址 /端口以及 RTP/RTCP地址 /端口也进行转换。 这种技术方案上的区别， 带来了较为明 的有益效果， 即该方案不 需要 NAT/FW设备进行任何改造； 对业务终端没有需求， 不需要终端修 改； 可以实现多层 NAT和对称 NAT的穿越;. 能同时实现对多个企业网 / 驻地网出口 FW/NAT的穿越； 提供用户的接入控制功能， 提供对媒体流 的 QoS标记和信息加密， 解决接入网络中实时会话业务的 QoS保证和 安全问题； 而且还具有刷新 NAT映射表和流量计費的功能。 附图简要说明 图 1是 TURN方式下的系统结构图； 图 2是根据本发明的一个实施例的 FULL PROXY方式的系统结构 图；
图 3 是根据本发明的一个实施例的 FULL PROXY 方式的实现 NAT/FW穿越的方法流程。 实施本发明的方式 为使本发明的目的、 技术方案和优点更力口清楚， 下面将结合附图对 本发明作进一步地详细描述。
本发明釆用全代理 ( FULL PROXY )方式， 通过对私网内用户终端 的呼叫信令和媒体流同时做中继来实现出口 NAT/FW的穿越。
图 2所示为实现本发明 FULL PROXY 式的系统的一个具体实施 例的结构示意图。 为突出本发明， 图 2中只标出与本发明有密切关系的 部分。
如图 2所示，本实施例的系统包括分组用户终端 10和 11、 NAT/FW 20和 21、 代理服务器（PROXY SERVER ) 30、 软交换设备（SoftX ) 40 和 41。 其中， 分组用户终端 10、 11 分别属于不同的网絡， 分别通过 NAT FW 20、 21与 PROXY SERVER30相连； PROXY SERVER30与 SoftX 40、 41相连。 图中实线为媒体流， 虛线为信令流。
分组用户终端 10、11是指使用诸如 H.323、会话初始化协议（ Session Initation Protocol, SIP ), 媒体网关控制十办议 ( Media Gateway Control Protocol, MGCP )、 H.248等音频 /视频协议通信的用户终端。 分组用户 终端是多媒体业务的发起者和接 4欠者， 在私网中， 分别通过 NAT/FW20 和 21 接入公网。 需要指出的是， 本发明中提到的私网和公网只是一个 具体的特例， 实质上只要是两个网络都可以， 可以是不同的局域网， 也 可以一个是局域网， 一个为外部公共网络， 只要一个网络在 NAT/FW之 内， 即认为该网络为私网， 另一个网络在 NAT/FW之外， 即认为该网络 为公网。
NAT/FW 20、 21是指实现 NAT功能和防火墙功能的设备， 通常配 置在私网接入公网的位置。 它一方面用于防止数据包无限制的进入私网 内， 保护私网内主机不受外界攻击； 另一方面通过网络地址端口转换， 隐藏私网 IP地址， 使私网内的多个用户终端能够共享较少数量的公网 IP地址。
PROXY SERVER 30类似于现有技术中的 TURN SERVER, 置于城 域网汇聚层 , 用于实现 FULL PROXY的功能， 即信令代理以及媒体中 继功能。 具体功能如下： PROXY SERVER30在收到来自分组用户终端 10的信令报文时， 对信令报文负载进行解析与处理， 得到该信令报文的 IP 头地址 /端口、 该信令报文负载中的呼叫信令地址 /端口以及该用户终 端接收媒体流地址 /端口，这些地址 /端口为私网地址 /端口。并且， PROXY SERVER30在公网中分别为该信令报文、 该信令艮文的负载中的呼叫信 令以及该用户终端接收媒体流分配呼叫信令地址 /端口。并记录上述私网 地址 /端口与公网地址 /端口的对应关系。
然后， 将信令报文的 IP头地址 /端口修改为 PROXY SERVER30为 该呼叫分配的在公网中的信令报文地址 /端口，将该信 ^艮文负载中的呼 叫信令地址修改为 PROXY SERVER30 为该呼叫分配的在公网中地址 / 端口， 将该信令报文负载中的媒体流地址 /端口修改为 PROXY SERVER30为该媒体流分配的在公网中的地址 /端口。然后将经过地址修 改的信令报文发送到 SoftX 40、 41。当 PROXY SERVER30收到来自 SoftX 40、 41发向分组用户终端 10的信令报文时， 根从自身记录的对应关系 中获取该信令报文的 IP头地址 /端口对应的私网内的 IP头地址 /端口，该 信令报文负载中呼叫信令地址 /端口所对应的私网内的呼叫信令地址 /端 口，以及该信令报文负载中媒体流的地址 /端口所对应的私网内的媒体流 的地址 /端口， 将该信令报文的 IP头地址 /端口修改为私网中信令报文 IP 头地址 /端口； 将该信令报文负载中呼叫信令地址 /端口修改私网中的呼 叫信令地址 /端口； 将该信令报文所携带的媒体流地址 /端口修改为私网 中的媒体流地址 /端口； 最后， 按照修 后的信令报文 IP头地址对该报 文进行转发。这样，呼叫信令以及媒体流就可以通过 PROXY SERVER30 在主被叫之间进行中转。
熟悉本发明领域的技术人员会理觯， PROXY SERVER30可以配置 多个 IP地址对。 如果 PROXY SERVER30上配置有多个私网的 IP地址 或多个公网 IP地址, 则可以用一台设备同时实现对多个企业网 /驻地网 出口 FW/NAT 的穿越或同时代理多个软交换。 通过这种方式确保了 PROXY SERVER30无论在哪种组网模式， 无论 NAT是否对称 NAT, 媒 体流都能得到正确转发。
此外， 通过对信令的处理和分析， PROXY SERVER30不仅得到本 次会话的地址变换情况， 还可以获得带宽需求等服务质量（Quality of Service, 简称 " QoS" )信息。 由此， 它能通过会话状态信息来控制媒体 流的通过与关闭， 起到保护网络、 防范带宽盗用等。 PROXY SERVER30 可以提供对用户的接入控制功能、 带宽管理功能， 提供对媒体流的 QoS 标记、 虚拟局域网 （ Virtual Local Area Network, 简称 "VLAN" )标记 和信息加密。
为了防止 NAT映射表老化问题， 本发明还可以引入 NAT地址绑定 关系的定时刷新机制， 即 PROXY SERVER30在信令解析获得地址后就 定期向分组用户终端 10发起报文， 来刷新企业出口 NAT/FW20上的信 令地址映射关系， 即私网 IP地址 /端口与 NAT/F W20分配的公网上的 IP 地址 /端口的对应关系。 在解决信令地址对企业出口 NAT的穿越后， 对 于媒体流的交互， PROXY SERVER30采用首包刷新方式来更新媒体流 的会话表项或地址转换关系表项， 即在终端发出媒体流后， 经过企业出 口的 NAT/FW20进行转换到达 PROXY SERVER30, 通过首包学习得到 出口 NAT/FW20上动态分配的地址 /端口信息， 从而更新媒体流会话表 项， 建立一个完整的媒体流会话表项， 完成位于公网接入多个企业时的 媒体转发功能。 '
在系统中引入 PROXY SERVER30后， 由于主叫方和被叫方的媒体 流都经过 PROXY SERVER30, 所以 PROXY SERVER30可以准确地获 得媒体流量， 从而实现基于报文流量的计费， 而不仅仅是传统的基于时 长的计费。
SoftX40、 41是软交换设备， 作为 NGN的网络控制层的关键构件， 用于提供综合业务和呼叫控制。 在收到公网发送给私网中的分组用户终 端的信令报文时， 将收到的该 ^艮文转发给 PROXY SERVER30。
下面再具体说明本发明中的基于 FULL PROXY 方式的穿越 NAT/FW的方法流程。 作为本发明的一个较佳实施例， 假设由分组用户终端 10发起相关 业务到分组用户终端 11 , 过程如图 3所示：
步驟 200:私网内的分组用户终端 10向 PROXY SERVER30发送信 令报文，该信令报文中包含注册和呼叫信息， 并且该信令报文的 IP头的 源地址为私网地址。分组用户终端 10将 PROXY SERVER30看作软交换 设备。具体地说，源自分组用户终端 10的信令报文先被发送到 NAT/FW 20, NAT/FW 20为该信令艮文分配一个公网地址 /端口， 并将其才艮文 IP 头的源地址从私网地址 /端口修改为为其所分配的公网地址 /端口， 但是 对报文内部信息不作任何改动， 记录上述私网地址 /端口与 NAT/FW 20 分配的公网地址 /端口之间的对应关系， 然后把该信令报文转发到 PROXY SERVER30.
步骤 210: 当 PROXY SERVER30收到该信令报文后, 对该信令报 文负载中携带的信息进行解析与处理，得到信令报文的 IP头地址 /端口、 报文负载中的呼叫信令地址 /端口以及用户终端所请求的媒体流地址 /端 口， 并且， PROXY SERVER30为该信令报文、 该信令才艮文负载中的呼 叫信令以及该用户终端所请求的媒体流分别分配在公网中的地址 /端口。 然后， PROXY SERVER30 寻信令报文 IP 头地址 /端口修改为 PROXY SERVER30为该呼叫分配的在公网中的地址 /端口，将该报文负载中的呼 叫信令地址修改为 PROXY SERVER30为该呼叫分配的在公网中的呼叫 信令地址 /端口， 将该报文负载中的媒体流地址 /端口修改为 PROXY SERVER30为该媒体流分配的在公网中的地址 /端口，并记录私网内的信 令报文的 IP头地址 /端口、 报文负载中的呼叫信令地址 /端口以及用户终 端所请求的媒体流地址 /端口与 PROXY SERVER30分配的公网内的地址 /端口之间的对应关系。
步驟 220: 将步骤 210 中修改后的信令报文转发给软交换设备 SoftX40o
步驟 230: 当 SoftX40收到需要发向分组用户终端 10的回应信令报 文时， 将该回应信令报文转发给 PROXY SERVER30。
步骤 240: PROXY SERVER30收到发向私网内分组用户终端 10的 回应信令报文时， 对该回应信令报文负载信息进行解析， 得到回应信令 报文的 IP头地址 /端口、 回应信令报文负载中回应信令的地址 /端口、 媒 体流地址 /端口， 然后根据回应 言令报文的 IP头地址 /端口、 回应信令报 文负载中回应信令的地址 /端口、 媒体流地址 /端口从自身记录的对应关 系中获取对应的私网中 IP地址、呼叫信令地址 /端口、媒体流地址 /端口， 然后将该回应信令 4艮文的 IP头地址 /端口 改为私网中对应的 IP头地址 /端口， 将该回应信令报文负载中回应信令地址 /端口修改为私网中对应 的呼叫信令地址 /端口， 将该回应信令所携带的媒体流地址 /端口， 修改 为私网中对应的媒体流地址 /端口。 这里， 媒体流地址 /端口可以为 RTP/RTCP地址 /端口。
通过在步骤 210和步驟 240中对报文负载中信令和媒体流地址 /端口 的记录和修改， 实现了对 NAT FW的穿越， 并且在任何组网形式下实现 穿越时均不需要对现有的 NAT/FW和用户终端进行改造。
步骤 250: PROXY SERVER30将修改后的回应信令报文发向私网 内分组用户终端 10。
具体地说， PROXY SERYER30首先将修改后的回应信令报文发送 给 NAT/FW20， 该报文的目的地址是 NAT/FW20为分组用户终端 10的 呼叫分配的公网地址 /端口 , NAT/FW20从自身记录的私网地址 /端口和 公网地址 /端口的对应关系表中查询出该报文的公网目的地址 /端口所对 应的私网地址 /端口 , 然后用查询到的私网地址 /端口替换该报文的公网 目的地址 /端口， 然后将经过地址 /端口转换的回应信令报文转发给分组 用户终端 10。
从上述过程可以看出， 本发明的 FULL PROXY方式与 TUR 方式 的中继相比， 有如下区别：
TURN方式是在 TURN SERVER与用户终端通过 TURN协议交互 时分配地址 /端口， 报文内部的地址信息由终端生成， TURN SERVER对 后续的报文才艮据分配的地址 /端口信息进行地址变换后中继转发。 而 FULL PROXY 方式是通过对报文进行中继的设备对呼叫协议解析与处 理， 改写报文其中携带的媒体流地址信息后转发信令拫文， 同时根据改 写的媒体流地址信息对媒体报文做地址变换后中继转发。
虽然通过参照本发明的某些优选实施例， 已经对本发明进行了图示 和描述， 但本领域的普通技术人员应该明白， 可以在形式上和细节上对 其作各种各样的改变， 而不偏离所附权利要求书所限定的本发明的精神 和范围。

Claims

权利要求书
1、一种实现网络地址转换穿越的方法， 其特征在于， 该方法包含以 下步骤：
A 当网络地址转换服务器或防火墙以外的代理服务器收到来自第 一网络内分组用户终端的信令报文时， 对该信令报文负载信息进行解 析， 记录该报文负载中的呼叫信令地址和端口， 以及媒体流实时传输协 议和实时传输控制协议地址和端口， 并且将该报文负载信息中的呼叫信 令地址和端口修改为所述代理服务器为该呼叫分配的在第二网络中的 呼叫信令地址和端口， 将该报文负载信息中的媒体流实时传输协议和实 时传输控制协议地址和端口修改为所述代理服务器为该媒体流分配的 在第二网络中的地址和端口；
B 所述代理服务器将修改后的所述信令报文发送到分组语音信令 处理设备或业务处理设备；
C 当所迷代理服务器收到发向所述第一网絡内分组用户终端的回 应信令报文时， 对该回应信令报文负载信息进行解析， 将该报文负载信 息中回应信令地址和端口修改为步骤 A 中所记录的呼叫信令地址和端 口， 将该报文负载信息所携带的媒体流实时传输协议和实时传输控制协 议地址和端口 , 修改为步骤 A中所记录的媒体流实时传输协议和实时传 输控制协议地址和端口；
D 所述代理服务器将修改后的所述回应信令报文发向所述第一网 絡内分组用户终端。
2、 根据权利要求 1所述的方法， 其特征在于， 在步骤 A之前进一 步包括：
第一网络内的分组用户终端向所述代理服务器发送信令报文， 该信 令才艮文先被发送到网络地址转换月 务器或防火墙， 网络地址转换服务器 或防火墙为该信令报文分配公网地址 /端口， 并将该信令报文 IP头的源 地址从第一网络的地址 /端口修改为为其分配的公网地址 /端口， 并在信 令地址映射关系中记录所述第一网络地址 /端口与网络地址转换服务器 或防火墙分配的公网地址 /端口之间的对应关系，然后把该信令报文转发 到所述代理服务器。
3、 根据权利要求 1所述的方法， 其特征在于， 在执行步骤 A后， 包括：
所述代理服务器定期向所述第一网络内分組用户终端发起报文， 刷 新所述网络地址转换服务器或防火墙上的信令地址映射关系。
4、根据权利要求 1所述的方法， 其特征在于， 所述分组语音信令处 理设备或业务处理设备是软交换设备或 IP语音网守设备。
5、 根据权利要求 1所述的方法， 其特征在于， 步骤 A还进一步包 括：
当所述代理服务器收到来自所述第一网络内分组用户终端的呼叫信 令时，记录该呼叫信令的报文 IP头地址和端口， 并将其修改为所述代理 月艮务器为该呼叫分配的在第二网络中的呼叫信令地址和端口；
则步骤 C进一步包括：
当所述代理服务器收到发向所述第一网络内分组用户终端的呼叫信 令时，将该呼叫信令的报文 IP头地址和端口修改为所述被记录的呼叫信 令的 艮文 IP头地址和端口。
6、 一种实现网络地址转换穿越的系统 , 其特征在于， 该系统包含： 位于第一网络内分组用户终端， 用于发起和接收业务；
位于第二网络内的代理服务器， 用于接收来自第一网络的所述分组 用户终端的信令报文， 对该信令报文的报文负载信息进行解析， 记录该 报文负载中的呼叫信令地址和端口， 以及媒体流地址和端口， 并且将该 报文负载中的呼叫信令地址修改为所述代理服务器为该呼叫分配的在 第二网络中的呼叫信令地址和端口， 将该报文负载中的媒体流地址和端 口修改为所述代理服务器为该媒体流分配的在第二网络中的地址和端 口， 然后将修改后的所述信令报文发送到所述软交换设备， 和， 当所述 代理服务器收到发向所述第一网络内分组用户终端的回应信令时， 对该 回应信令的报文负载信息进行解析， 将该报文负载中回应信令地址和端 口修改为所述被记录的呼叫信令地址和端口， 将该报文负载所携带的媒 体流地址和端口， 修改为所述被记录的媒体流地址和端口， 然后将修改 后的所述回应信令发向所述第一网络内分组用户终端；
软交换设备， 用于提供综合业务和呼叫控制， 在收到发送给所述分 组用户终端的回应信令 ^艮文时转发给所述代理服务器。
7、 根据权利要求 6所述的系统， 其特征在于， 该系统进一步包括： 网络地址转换服务器或防火墙， 用于为所述分组用户终端提供接入 第二网络的服务， 为所述分组用户终端和所述代理服务器相互转发报 文。
8、根据权利要求 6所述的系统， 其特征在于， 所述分組用户终端是 使用 H.323协议、 或会话初始化协议、 或媒体网关控制协议、 或 H.248 协议进行音频和视频通信的用户终端。
9、根据权利要求 6所述的系统， 其特征在于， 所述代理服务器还用 于按照流量计费。
10、 根据权利要求 6所述的系统， 其特征在于， 所述代理服务器还 用于用户的接入控制、 带宽管理， 对媒体流的服务质量标记、 虚拟专用 网标记和信息进行加密。
11、 根据权利要求 6所述的系统， 其特征在于， 所述代理服务器还 用于多个第一网络和第二网络地址对的设置 , 同时实现对多个网絡地址 转换服务器或防火墙的穿越。
12、 根据权利要求 6所述的系统， 其特征在于， 所述代理服务器采 用首包刷新方式来更新媒体流的会话表项或地址转换关系表项。
PCT/CN2004/001516 2003-12-24 2004-12-24 Procede de conversion et de traversee d'une adresse reseau et son systeme WO2005062546A1 (fr)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP04802529A EP1693998B1 (en) 2003-12-24 2004-12-24 Method and system for a proxy-based network translation
DE602004019807T DE602004019807D1 (de) 2003-12-24 2004-12-24 Verfahren und system zu einer proxy-basierten netzwerkadressübersetzung
US10/584,212 US7787459B2 (en) 2003-12-24 2004-12-24 Method and system for implementing traversal through network address translation

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200310121080.8 2003-12-24
CNB2003101210808A CN100399768C (zh) 2003-12-24 2003-12-24 实现网络地址转换穿越的方法、系统

Publications (1)

Publication Number Publication Date
WO2005062546A1 true WO2005062546A1 (fr) 2005-07-07

Family

ID=34706058

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2004/001516 WO2005062546A1 (fr) 2003-12-24 2004-12-24 Procede de conversion et de traversee d'une adresse reseau et son systeme

Country Status (6)

Country Link
US (1) US7787459B2 (zh)
EP (1) EP1693998B1 (zh)
CN (1) CN100399768C (zh)
AT (1) ATE424675T1 (zh)
DE (1) DE602004019807D1 (zh)
WO (1) WO2005062546A1 (zh)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1748597A1 (en) 2005-07-27 2007-01-31 Sharp Kabushiki Kaisha Method for managing hidden stations in a centrally controlled network
WO2008003644A1 (de) * 2006-07-03 2008-01-10 Siemens Aktiengesellschaft Verfahren zur verwaltung von kommunikationsverbindungen über netzwerk-adressumsetzende nat netzknoten
US7848306B2 (en) 2005-07-27 2010-12-07 Sharp Laboratories Of America, Inc. Coexistence of access provider and in-home networks
US7856008B2 (en) 2005-07-27 2010-12-21 Sharp Laboratories Of America, Inc. Synchronizing channel sharing with neighboring networks
US8027345B2 (en) 2005-07-27 2011-09-27 Sharp Laboratories Of America, Inc. Method for automatically providing quality of service
US8175190B2 (en) 2005-07-27 2012-05-08 Qualcomm Atheros, Inc. Managing spectra of modulated signals in a communication network
US8509442B2 (en) 2005-07-27 2013-08-13 Sharp Laboratories Of America, Inc. Association, authentication, and security in a network
US8654635B2 (en) 2003-11-24 2014-02-18 Qualcomm Incorporated Medium access control layer that encapsulates data from a plurality of received data units into a plurality of independently transmittable blocks
CN112437168A (zh) * 2020-11-13 2021-03-02 广州朗国电子科技有限公司 一种内网穿透系统

Families Citing this family (62)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1317873C (zh) * 2003-08-19 2007-05-23 中兴通讯股份有限公司 基于媒体网关控制协议的信令代理实现方法
US7912046B2 (en) * 2005-02-11 2011-03-22 Microsoft Corporation Automated NAT traversal for peer-to-peer networks
JP4487810B2 (ja) * 2005-03-14 2010-06-23 株式会社日立製作所 セッション中継装置
IES20050439A2 (en) * 2005-06-30 2006-08-09 Asavie R & D Ltd A method of network communication
US20070022289A1 (en) * 2005-07-20 2007-01-25 Mci, Inc. Method and system for providing secure credential storage to support interdomain traversal
CN100413376C (zh) * 2005-08-15 2008-08-20 华为技术有限公司 一种提高下一代网络终端通信安全性的方法及终端
US7920548B2 (en) * 2005-08-18 2011-04-05 Hong Kong Applied Science And Technology Research Institute Co. Ltd. Intelligent switching for secure and reliable voice-over-IP PBX service
CN101064712B (zh) * 2006-04-24 2013-04-24 上海信息安全基础设施研究中心 一种基于Linux内核实现双通道穿越多级NAT和防火墙的系统及方法
WO2007123359A2 (en) * 2006-04-24 2007-11-01 Ktfreetel Co., Ltd. Interworking system between ip networks using different ip addressing scheme, application layer gateway (alg), stun server, network address translator, interworking method thereof, and sip message routing method thereof
CN100454905C (zh) * 2006-06-09 2009-01-21 华为技术有限公司 穿越网络地址转换的方法
CN100596125C (zh) * 2006-06-30 2010-03-24 华为技术有限公司 一种媒体流穿越网络地址转换的方法及系统
CN101119299A (zh) 2006-08-02 2008-02-06 华为技术有限公司 导通媒体流的方法、导通检测方法及其系统
CN102325086A (zh) * 2006-08-02 2012-01-18 华为技术有限公司 导通媒体流的方法、导通检测方法及其系统
US9413590B2 (en) * 2006-08-22 2016-08-09 Orange Method for management of a secured transfer session through an address translation device, corresponding server and computer program
CN101132353A (zh) * 2006-08-23 2008-02-27 华为技术有限公司 一种信令转发的方法及装置
CN101179480B (zh) * 2006-11-07 2010-05-12 中兴通讯股份有限公司 一种转发流媒体的方法
EP2103091B1 (en) * 2006-12-12 2015-11-18 Telefonaktiebolaget L M Ericsson (publ) Ip address distribution in middleboxes
EP2116007A4 (en) 2006-12-29 2017-04-05 Broadview Networks, Inc. Method and system for network address translation (nat) traversal of real time protocol (rtp) media
CN101309203B (zh) * 2007-05-17 2011-03-16 中兴通讯股份有限公司 一种网络媒体服务方法
CN101325600A (zh) * 2007-06-15 2008-12-17 华为技术有限公司 一种操作指示方法、设备及系统
US8631155B2 (en) * 2007-06-29 2014-01-14 Microsoft Corporation Network address translation traversals for peer-to-peer networks
CN101094159B (zh) * 2007-07-18 2010-06-09 中兴通讯股份有限公司 一种媒体流私网穿透的方法
US7933273B2 (en) * 2007-07-27 2011-04-26 Sony Computer Entertainment Inc. Cooperative NAT behavior discovery
CN101796805B (zh) * 2007-09-04 2014-12-17 富士通株式会社 接入网关及其应用方法
US8233488B2 (en) 2007-09-14 2012-07-31 At&T Intellectual Property I, Lp Methods and systems for network address translation management
JP2009089183A (ja) * 2007-10-01 2009-04-23 Brother Ind Ltd 情報処理装置及び情報処理プログラム
CN101562898B (zh) * 2008-04-16 2011-04-06 北京信威通信技术股份有限公司 一种高效的无线接入系统rtp代理技术
CN101262447B (zh) * 2008-04-21 2011-02-16 中国科学院计算技术研究所 一种系统终端设备建立nat穿越通道的方法
US20090319674A1 (en) * 2008-06-24 2009-12-24 Microsoft Corporation Techniques to manage communications between relay servers
US8374188B2 (en) * 2008-06-24 2013-02-12 Microsoft Corporation Techniques to manage a relay server and a network address translator
CN101621506A (zh) * 2008-07-01 2010-01-06 鸿富锦精密工业（深圳）有限公司 透过nat实现实时多媒体双向通信的方法
CN101742008B (zh) * 2008-11-11 2012-08-08 华为技术有限公司 一种媒体流代理方法、语音交换机及通信系统
KR101606142B1 (ko) * 2008-11-28 2016-03-25 삼성전자주식회사 음성패킷망에서 네트워크 주소 번역 통과를 지원하기 위한 장치 및 방법
US8166179B2 (en) * 2009-01-30 2012-04-24 Cisco Technology, Inc. Media streaming through a network address translation (NAT) device
US8171148B2 (en) 2009-04-17 2012-05-01 Sling Media, Inc. Systems and methods for establishing connections between devices communicating over a network
US9167043B2 (en) * 2009-05-22 2015-10-20 Nederlandse Organisatie Voor Toegepast-Natuurwetenschappelijk Onderzoek Tno Servers for device identification services
WO2011000405A1 (en) * 2009-06-29 2011-01-06 Telefonaktiebolaget Lm Ericsson (Publ) Method and apparatus for relaying packets
TWI420387B (zh) * 2009-07-30 2013-12-21 Woei Jia Hwang 網頁即時語音錄製方法及其應用
US8621099B2 (en) 2009-09-21 2013-12-31 Sling Media, Inc. Systems and methods for formatting media content for distribution
CN102035950B (zh) * 2009-09-30 2014-08-13 华为技术有限公司 坐席业务处理方法及ip坐席终端
JP2011077804A (ja) * 2009-09-30 2011-04-14 Oki Networks Co Ltd 通信装置およびその通信方法
US9015225B2 (en) 2009-11-16 2015-04-21 Echostar Technologies L.L.C. Systems and methods for delivering messages over a network
US9178923B2 (en) 2009-12-23 2015-11-03 Echostar Technologies L.L.C. Systems and methods for remotely controlling a media server via a network
JP4818428B2 (ja) * 2009-12-25 2011-11-16 株式会社東芝 通信システム及び電話交換装置及び制御方法
US9275054B2 (en) 2009-12-28 2016-03-01 Sling Media, Inc. Systems and methods for searching media content
TW201125330A (en) * 2009-12-29 2011-07-16 Gemtek Technolog Co Ltd Network address transforming method, network address transformer and communication system for multimedia streaming.
US9113185B2 (en) 2010-06-23 2015-08-18 Sling Media Inc. Systems and methods for authorizing access to network services using information obtained from subscriber equipment
CN103780779B (zh) * 2012-10-19 2016-10-05 华为技术有限公司 媒体流的交互方法和网络设备
KR102015806B1 (ko) * 2012-10-22 2019-08-29 삼성전자 주식회사 전자장치, 네트워크 시스템 및 프라이비트 네트워크를 구축하는 방법
CN104601418B (zh) * 2014-12-02 2017-11-21 重庆尊贤科技有限公司 多个一户一vlan捆绑认证机制出口下多网融合传输系统
CN104994028B (zh) * 2015-07-15 2019-04-26 上海地面通信息网络股份有限公司 基于nat地址转换器的带宽节约控制装置
US10560407B2 (en) * 2016-10-06 2020-02-11 Sap Se Payload description for computer messaging
CN107104966B (zh) * 2017-04-25 2020-07-17 刘正达 基于网络结构动态调整的家用无线网络安全的实现方法
US10785192B2 (en) 2018-02-28 2020-09-22 Sling Media Pvt. Ltd. Methods and systems for secure DNS routing
US10742696B2 (en) * 2018-02-28 2020-08-11 Sling Media Pvt. Ltd. Relaying media content via a relay server system without decryption
CN109361561A (zh) * 2018-08-23 2019-02-19 中国联合网络通信集团有限公司 心跳机制保持方法、装置及存储介质
US11153350B2 (en) * 2019-09-16 2021-10-19 Fortinet, Inc. Determining on-net/off-net status of a client device
CN112969046A (zh) * 2021-02-05 2021-06-15 招联消费金融有限公司 一种基于内网代理的视频面签系统和方法
CN113163024B (zh) * 2021-03-12 2023-04-07 网宿科技股份有限公司 报文处理方法、服务器及存储介质
CN113489717A (zh) * 2021-07-02 2021-10-08 北京飞讯数码科技有限公司 基于sip协议的内外网互通方法、装置、设备及存储介质
CN115086183B (zh) * 2022-07-05 2024-02-06 武汉思普崚技术有限公司 一种应用层网关的报文关联方法及装置
CN115550591A (zh) * 2022-09-02 2022-12-30 深圳市华运通科技股份有限公司 视讯通话系统、视讯通话方法及存储介质

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030048780A1 (en) * 2001-09-10 2003-03-13 Phomsopha Bounthavivone K. Supporting real-time multimedia applications via a network address translator
CN1411220A (zh) * 2001-10-04 2003-04-16 华为技术有限公司 私有网络的ip语音业务实现方法及系统

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH11122301A (ja) * 1997-10-20 1999-04-30 Fujitsu Ltd アドレス変換接続装置
JP3770831B2 (ja) * 1999-08-18 2006-04-26 富士通株式会社 ネットワークの負荷分散を行うコンピュータ、監視装置、その方法およびそのためのプログラムを記録した記録媒体
US7146410B1 (en) * 2000-06-07 2006-12-05 Nortel Networks Limited System and method for executing control protocols among nodes in separate IP networks
US6879820B2 (en) * 2000-07-12 2005-04-12 Telefonaktiebolaget Lm Ericsson (Publ) Charging in communication networks having split control planes and user planes
GB2369746A (en) 2000-11-30 2002-06-05 Ridgeway Systems & Software Lt Communications system with network address translation
JP3760767B2 (ja) * 2000-12-21 2006-03-29 株式会社日立製作所 ネットワーク管理装置及びネットワーク管理方法
US7050422B2 (en) * 2001-02-20 2006-05-23 Innomedia Pte, Ltd. System and method for providing real time connectionless communication of media data through a firewall
US6687245B2 (en) * 2001-04-03 2004-02-03 Voxpath Networks, Inc. System and method for performing IP telephony
US7068646B2 (en) * 2001-04-03 2006-06-27 Voxpath Networks, Inc. System and method for performing IP telephony including internal and external call sessions
US20040198679A1 (en) 2001-07-05 2004-10-07 Sophie Vasseur Use of inhibitors of expression or activity of p8/com1 for treating tumors
US20030033418A1 (en) * 2001-07-19 2003-02-13 Young Bruce Fitzgerald Method of implementing and configuring an MGCP application layer gateway
US7219161B1 (en) * 2001-08-29 2007-05-15 Cisco Technology, Inc. Techniques for network address and port translation for network protocols that do not use translated ports when requesting network resources
US7072332B2 (en) * 2001-09-27 2006-07-04 Samsung Electronics Co., Ltd. Soft switch using distributed firewalls for load sharing voice-over-IP traffic in an IP network
US7274684B2 (en) * 2001-10-10 2007-09-25 Bruce Fitzgerald Young Method and system for implementing and managing a multimedia access network device
US7200139B1 (en) * 2001-11-08 2007-04-03 At&T Corp. Method for providing VoIP services for wireless terminals
US20030106067A1 (en) * 2001-11-30 2003-06-05 Hoskins Steve J. Integrated internet protocol (IP) gateway services in an RF cable network
US20040095913A1 (en) * 2002-11-20 2004-05-20 Nokia, Inc. Routing optimization proxy in IP networks
US7454510B2 (en) * 2003-05-29 2008-11-18 Microsoft Corporation Controlled relay of media streams across network perimeters

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030048780A1 (en) * 2001-09-10 2003-03-13 Phomsopha Bounthavivone K. Supporting real-time multimedia applications via a network address translator
CN1411220A (zh) * 2001-10-04 2003-04-16 华为技术有限公司 私有网络的ip语音业务实现方法及系统

Cited By (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8654635B2 (en) 2003-11-24 2014-02-18 Qualcomm Incorporated Medium access control layer that encapsulates data from a plurality of received data units into a plurality of independently transmittable blocks
US9013989B2 (en) 2003-11-24 2015-04-21 Qualcomm Incorporated Medium access control layer that encapsulates data from a plurality of received data units into a plurality of independently transmittable blocks
US8027345B2 (en) 2005-07-27 2011-09-27 Sharp Laboratories Of America, Inc. Method for automatically providing quality of service
US7848306B2 (en) 2005-07-27 2010-12-07 Sharp Laboratories Of America, Inc. Coexistence of access provider and in-home networks
US7856008B2 (en) 2005-07-27 2010-12-21 Sharp Laboratories Of America, Inc. Synchronizing channel sharing with neighboring networks
US7865184B2 (en) 2005-07-27 2011-01-04 Sharp Laboratories Of America, Inc. Method for managing hidden stations in a centrally controlled network
EP1748597A1 (en) 2005-07-27 2007-01-31 Sharp Kabushiki Kaisha Method for managing hidden stations in a centrally controlled network
US8175190B2 (en) 2005-07-27 2012-05-08 Qualcomm Atheros, Inc. Managing spectra of modulated signals in a communication network
US8416887B2 (en) 2005-07-27 2013-04-09 Qualcomm Atheros, Inc Managing spectra of modulated signals in a communication network
US8509442B2 (en) 2005-07-27 2013-08-13 Sharp Laboratories Of America, Inc. Association, authentication, and security in a network
US7720471B2 (en) 2005-07-27 2010-05-18 Sharp Laboratories Of America Method for managing hidden stations in a centrally controlled network
US8045579B2 (en) 2006-07-03 2011-10-25 Siemens Enterprise Communications Gmbh & Co. Kg Method for managing communication connections by network address translating (NAT) network nodes
WO2008003644A1 (de) * 2006-07-03 2008-01-10 Siemens Aktiengesellschaft Verfahren zur verwaltung von kommunikationsverbindungen über netzwerk-adressumsetzende nat netzknoten
CN112437168A (zh) * 2020-11-13 2021-03-02 广州朗国电子科技有限公司 一种内网穿透系统
CN112437168B (zh) * 2020-11-13 2023-09-01 广州朗国电子科技股份有限公司 一种内网穿透系统

Also Published As

Publication number Publication date
CN1633102A (zh) 2005-06-29
US20070217407A1 (en) 2007-09-20
CN100399768C (zh) 2008-07-02
EP1693998A1 (en) 2006-08-23
ATE424675T1 (de) 2009-03-15
DE602004019807D1 (de) 2009-04-16
US7787459B2 (en) 2010-08-31
EP1693998A4 (en) 2007-01-03
EP1693998B1 (en) 2009-03-04

Similar Documents

Publication Publication Date Title
WO2005062546A1 (fr) Procede de conversion et de traversee d'une adresse reseau et son systeme
EP2034666B1 (en) Method and system for realizing media stream interaction and media gateway controller and media gateway
KR101280281B1 (ko) 일련의 경계 게이트웨이들을 통하는 ｉｐ 멀티미디어 베어러 경로 최적화를 위한 개선된 방법 및 시스템
EP1650916B1 (en) The system and method for realize multimedia call crossover the private network
US8484359B2 (en) Providing telephony services to terminals behind a firewall and/or a network address translator
EP1692844B1 (en) Methods and devices for traversing firewalls and network address translation (nat) installations
US8468259B2 (en) Middlebox control
KR100804291B1 (ko) Ｉｐ 어드레스 바인딩들에 기초한 멀티미디어 트래픽의필터링 방법 및 시스템
US20050286538A1 (en) Method and call server for establishing a bi-directional peer-to-peer communication link
JP2004515164A (ja) 通信システム
EP2850813A1 (en) Nat traversal for voip
JP4705167B2 (ja) ネットワークアドレス変換またはファイアウォール設備を越える方法及びシステム
WO2007036160A1 (fr) Appareil, systeme et procede assurant la communication entre un client et un serveur
WO2003030463A1 (fr) Procede et systeme pour la prestation d'un service vocal ip sur un reseau prive
US20100031339A1 (en) Streaming Media Service For Mobile Telephones
US8374178B2 (en) Apparatus and method for supporting NAT traversal in voice over internet protocol system
WO2008003214A1 (fr) Procédé, dispositif et système de passage de flux multimédia à travers la traduction d'adresse de réseau
EP1804429B1 (en) A communication system and method for achieving ip cross-domain intercommunication via an edge media gateway
KR100606895B1 (ko) ＮＡＰＴ 환경에서 ＶｏＩＰ 시스템의 음성 통신방법
KR20050001125A (ko) 방화벽 환경에서 보이스오버아이피 서비스를 제공하는시스템, 방법 및 기록 매체
JP2006340260A (ja) インターネット電話機の通話制御方法

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): GM KE LS MW MZ NA SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LT LU MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 2004802529

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

WWW Wipo information: withdrawn in national office

Ref document number: DE

WWP Wipo information: published in national office

Ref document number: 2004802529

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2007217407

Country of ref document: US

Ref document number: 10584212

Country of ref document: US

WWP Wipo information: published in national office

Ref document number: 10584212

Country of ref document: US