WO2006000141A1 - Systeme de securite du reseau multimedia et procede correspondant - Google Patents

Systeme de securite du reseau multimedia et procede correspondant Download PDF

Info

Publication number
WO2006000141A1
WO2006000141A1 PCT/CN2005/000725 CN2005000725W WO2006000141A1 WO 2006000141 A1 WO2006000141 A1 WO 2006000141A1 CN 2005000725 W CN2005000725 W CN 2005000725W WO 2006000141 A1 WO2006000141 A1 WO 2006000141A1
Authority
WO
WIPO (PCT)
Prior art keywords
port
media stream
convergence
node
address
Prior art date
Application number
PCT/CN2005/000725
Other languages
English (en)
French (fr)
Inventor
Xianyi Cheng
Honghong Su
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Publication of WO2006000141A1 publication Critical patent/WO2006000141A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/1066—Session management
    • H04L65/1101—Session protocols
    • H04L65/1106—Call signalling protocols; H.323 and related
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/60—Network streaming of media packets
    • H04L65/65—Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]

Definitions

  • the present invention relates to network security technologies in the field of communications or computers, and more particularly to a multimedia network security system and method.
  • the general firewall does not allow any connection initiated by the public network node to enter the firewall, such as "the node 21 of the public network initiates a TCP connection to the port 5000 of the node 11 of the private network"; meanwhile, the firewall It also restricts the internal nodes of the private network from initiating a connection to the external network, "the node 11 of the private network initiates a TCP connection to the port 5000 of the node 21 of the public network.” If the firewall allows the internal node of the private network to initiate a connection to the external node, it needs to open a port inside the firewall. For example, the firewall in Figure 1 opens the internal 80 port, so that the node 11 of the private network can initiate to the node 21 of the public network. The TCP connection, and then the node 21 can respond to the request of the node 11 along the original path, thereby completing the information interaction between the two nodes.
  • the basic components include:
  • H.323 terminal multipoint control unit (MCU), gatekeeper (GK) and gateway, each component can be used as a node in the multimedia system, and call interaction can be performed between nodes.
  • MCU multipoint control unit
  • GK gatekeeper
  • gateway each component can be used as a node in the multimedia system, and call interaction can be performed between nodes.
  • the H.323 protocol contains two main protocols: H.225.0 and H.245; wherein the H.225.0 protocol also contains two parts: the RAS, Registration, Admisstion and Status protocol part and the Q.931 protocol. section.
  • the H.224 protocol in order to realize the control function of the remote camera, the H.224 protocol is cited, and the commands controlled by the remote camera are packaged by the H.224 protocol, and then placed in the real-time transmission protocol/real-time transmission control protocol ( Transmission is performed in RTP/RTCP, Realtime Transport Protocol/ Realtime Transport Control Protocol).
  • the RTP/RTCP protocol is mainly used to transmit audio media streams, video media streams, and remote camera control commands.
  • the complete call process between node A and node B mainly includes four processes: RAS signaling process, Q.931 signaling process, H.245 process and media.
  • Stream interaction process the complete call process between node A and node B mainly includes four processes: RAS signaling process, Q.931 signaling process, H.245 process and media.
  • a typical H.323 call will include audio media streaming and video media streaming.
  • each node A or B needs to open 4 receiving ports, including: RTP receiving port of the video media stream, RTP receiving port of the audio media stream, RTCP receiving port of the video media stream, and The RTCP receive port of the audio media stream.
  • a firewall between nodes A and B uses port convergence technology to reduce the number of ports opened on the firewall.
  • a separate client device for port convergence is set inside the firewall (ie between the firewall and the private network node A); outside the firewall (ie between the firewall and the public network node B) Independent server device for port convergence to achieve port convergence.
  • the prior art generally uses two ports of audio and video.
  • the problem to be solved by the present invention is to provide a multimedia network security system and method, so that the nodes in the interaction between the two sides of the firewall can open as few ports as possible, avoiding incomplete port convergence, and improving the effectiveness of firewall multi-network security protection.
  • the multimedia network security system of the present invention includes a firewall having a firewall port, an internal node having an internal node port located inside the firewall, and an external node having an external node port located outside the firewall, and the internal node and the external node traverse
  • the firewall establishes a call
  • the external node is provided with a convergence port in a direction connected with the firewall, and is configured to receive media streams of all internal node ports, and distinguish the media streams and send media of all external node ports to each corresponding Internal node port.
  • the internal node is provided with a convergence port in a direction connected to the firewall, configured to receive the media stream of the convergence port of the evening node from one firewall port and distinguish the media stream, and pass the media of all the internal node ports through the one
  • the firewall port is sent to the convergence port of the external node.
  • the media streams of the internal node port and the external node port both have unique identifiers for distinguishing media streams.
  • the unique identifier of the media stream includes the source IP address of the packet in the IP packet header sent by the internal node to the external node, the source port number of the packet in the packet header of the user datagram, and the content of the corresponding redirect packet.
  • Media stream type The unique identifier of the media stream includes the source IP address of the packet in the IP packet header sent by the internal node to the external node, the source port number of the packet in the packet header of the user datagram, and the content of the corresponding redirect packet.
  • the unique identifier of the media stream refers to a payload type field and a synchronization source identifier field in a packet header field in a real-time transport protocol when the media stream is transmitted by using a real-time transport protocol.
  • the multimedia network security method of the present invention is used to implement communication between an internal node and an external node respectively located inside and outside the firewall with a firewall port, and includes the following steps: setting steps, at least setting a convergence port on the external node; determining an address Step, determine the communication peer The convergence port address; the identification interaction step, according to the convergence port address, sending a notification message to the convergence port, the notification message carrying a unique identifier corresponding to the media stream type; the media stream transmission step, according to the convergence port address, via the convergence port Transmitting a media stream carrying a unique identifier to a communication peer or receiving a unique identifier media stream of the communication peer from a firewall port; the media stream distribution step, according to the unique identifier of the media stream, the convergence port distinguishes the media stream.
  • the method also includes the steps of: declaring a step of declaring itself to the communication peer with port convergence capabilities.
  • the declaring step is based on the H.323 protocol, and the specific process is as follows: A connection request message is sent to the communication peer, the statement itself supports port convergence, and the connection request message implements a statement supporting port convergence through the non-standard information domain.
  • the declaring step further includes the steps of: the communication peer feedbacks the call processing message, the statement itself supports port convergence, and the call processing message implements a statement supporting port convergence by extending the non-standard information domain.
  • the step of determining the address is achieved by prior agreement.
  • the step of determining the address is implemented by using the H.245 protocol exchange negotiation, and specifically includes the following steps: sending a redirect address request message implemented by extending the non-standard field in the command message in the H.245 protocol to the communication peer having the convergence port
  • the communication peer end feedbacks a redirected address response message that is implemented by extending the non-standard field in the command message in the H.245 protocol and carrying the convergence port address.
  • the step of determining the address is implemented by opening the logical channel based on the H.245 protocol.
  • the specific process is as follows: The external node or the internal node having the convergence port fills in the local port address into the convergence port address in the open logical channel response message.
  • the notification packet is implemented based on the redirection packet, where the redirection packet includes an IP network packet header, an IP packet header containing the source IP address of the packet, and a user datagram protocol including the source port number of the 4 ⁇ text.
  • a packet header and a redirection packet content including a media stream type; the unique identifier includes the source IP address, a source port number, and a corresponding media stream type.
  • the notification message is implemented based on the real-time transport protocol message, and the unique identifier of the media stream is implemented by using the payload type field and the synchronization source identifier field in the packet header field, and the specific steps are: sending a synchronization source to the convergence port.
  • An identifier notification message indicating that the synchronization source identifier value and its corresponding media stream type are used; the convergence port feedback synchronization source identifier response message, in the same
  • the step source identifier response message contains a synchronization source identifier value conflict or a notification success message.
  • the synchronization source identifier notification message and the synchronization source identifier response message are implemented by extending non-standard fields in the command message in the H.245 protocol.
  • the present invention has the following advantages:
  • the convergence port and the media stream are uniquely identified, the number of ports opened on the firewall is as small as possible (for example, only one firewall port) without affecting the normal communication of the internal nodes, thereby improving the effectiveness of the firewall for network security protection.
  • Sex but also convenient for users to configure and maintain firewall devices;
  • FIG. 1 is a block diagram of an embodiment of a network security system in the prior art.
  • FIG. 2 is a block diagram of a prior art H.323 multimedia system.
  • FIG. 3 is a flow chart of a H.323 multimedia call in the prior art.
  • Figure 4 is a detailed flow chart of Figure 3.
  • FIG. 5 is a block diagram of another embodiment of a network security system in the prior art.
  • FIG. 6 is a block diagram of an embodiment of a multimedia network security system in the prior art.
  • FIG. 7 is a block diagram of another embodiment of a multimedia network security system in the prior art.
  • FIG. 8 is a block diagram of an embodiment of a multimedia network security system of the present invention.
  • FIG. 9 is a block diagram of another embodiment of a multimedia network security system of the present invention.
  • FIG. 10 is a block diagram of still another embodiment of the multimedia network security system of the present invention.
  • FIG. 11 is a general flow chart of the multimedia network security method of the present invention.
  • FIG. 12 is a flow chart of an embodiment of a multimedia network security method according to the present invention.
  • FIG. 13 is a flow chart of another embodiment of a multimedia network security method of the present invention.
  • Figures 14 and 15 are schematic diagrams showing the extension of the connection request message and the call processing message in Figures 12 and 13.
  • 16 and 17 are schematic diagrams showing the extension of the redirect address request message in FIG. 18 and 19 are schematic diagrams showing the extension of the redirected address response message in FIG.
  • Figure 20 is a schematic diagram showing the extension of the redirect message in Figures 12 and 13.
  • 21 is a flow chart of still another embodiment of the multimedia network security method of the present invention.
  • 22 and 23 are schematic diagrams showing the extension of the synchronization source identifier notification message in FIG.
  • a private network and a public network are distributed on both inner and outer sides of a firewall.
  • a node in a private network located inside a firewall is referred to as an internal node, and is located in a public network or other network outside the firewall.
  • the nodes are called external nodes.
  • multimedia communication is not required, for example, the private network is an enterprise network, and only needs to communicate with a public network (such as the Internet), a port can be opened on the firewall.
  • the transceiver port of the media stream includes: RTP, Real t ime Transport Protocol ) Port, Real Time Transport Control Protocol (RTCP) port, Real Time Transport Protocol (RTP) port and Real Time Transport Control Protocol (RTCP) ) Ports, these ports need to be open on the firewall. Since each internal node has a media stream for transmitting and receiving in both directions to the video RTP port, the video RTCP port, the audio RTP port, and the audio RTCP port, as shown in FIG. 7, if each port is inconsistent, the call is made. You need to open 8 ports on the firewall.
  • the purpose of the invention is to make the port convergence more thorough, so that it can be on the firewall in multimedia communication. Open as few ports as possible. Generally, with the solution of the present invention, only one port needs to be opened in the firewall and does not affect the normal multimedia communication between the internal node and the external node.
  • the multimedia network security system of the present invention includes a firewall with a firewall port, an internal node 2 with an internal node port located inside the firewall, and an external node 3 with an external port located outside the firewall.
  • the node 2 and the external node 3 traverse the firewall 1 to establish a call.
  • the external node 3 is provided with a convergence port 31 in the connection direction with the firewall 1, and the convergence port 31 is configured to receive media streams of all internal node ports of the internal node 2, and distinguish The media stream and the media of all external node ports of the external node 3 are sent to the respective internal node ports of the internal node 2, and the media stream from the internal node port has a unique identifier, and the convergence port 31 uses the identifier to distinguish the media stream.
  • the ports of the internal node send all the media streams to one port of the firewall first, and then the firewall forwards all the received packets to the receiving port of the external node through the port. If you look at the internal node from the firewall, there are multiple ports sending packets to it, that is, when the firewall receives the packets sent by the internal nodes, you can see the ports of each internal node. If the firewall is viewed from the receiving port, the packet is received from a firewall port, but the internal node is seen from the convergence port, but there are multiple ports sending packets to it.
  • the internal node 2 is provided with a convergence port 22 in a connection direction with the firewall, and the convergence port 22 of the internal node 2 is configured to receive the media stream of the convergence port 31 from a firewall port and the area ⁇ A body stream is processed accordingly and the media of all internal node ports of the internal node 2 is sent through it to a convergence port 31 through a firewall port.
  • FIG. 10 when the transceiver ports of the internal node 2 and the external node 3 are inconsistent, the convergence port setting schemes in FIGS. 8 and 9 are still applicable. It is distinguished by the direction of the arrow in FIG. 10: a single arrow indicates that the internal node 2 transmits a media stream to the external node 3, and a double arrow indicates that the external node 3 transmits a media stream to the internal node 2. The reason why the external node 3 transmits direction to the internal node 2 is indicated by a double arrow.
  • the internal node 2 In the actual transmission process, in addition to the external node 3 transmitting the media stream to the internal node 2, the internal node 2 also sends a corresponding message to the external node 3. .
  • the packet filtering principle of the firewall 1 under normal circumstances, the external node 3 cannot directly send the media stream to the internal node 2 unless the internal node 2 first sends a notification message to the external node 3, and then externally Node 3 is fed back to internal node 2 along the original path.
  • the packet filtering principle of the firewall is also applicable to the specific embodiments in Figures 8 and 9, and will continue to be described in the multimedia network security method of the present invention.
  • the present invention relates to the public-private network traversing content, please refer to the patent application: application number 03159214. 7, the name is "the implementation of the multimedia protocol traversing network address translation device".
  • the unique identifier is used by an external node or an internal node to distinguish media streams from different ports of the communication peer at the convergence port for corresponding processing, for example, an external node or an internal node that sets a convergence port can be unified through the unique identifier in the media stream.
  • the media stream received from the convergence port is divided into "video RTP,”, video "RTCP”, “audio RTP”, and “audio RTCP” messages, and further processing is performed.
  • the differentiation process is referred to the multimedia network security method of the present invention.
  • the unique identifier of the media stream is implemented by the internal node sending the notification message to the external node according to the packet filtering principle, and the packet notifies the source IP address of the packet in the IP packet header in the packet, and the packet in the packet header of the user datagram protocol. Source port number and the type of media stream in the corresponding redirected packet content.
  • the unique identifier is implemented by using a real-time transport protocol in the media stream, directly in the real-time transport protocol packet, using a payload type field (PT) and a synchronization source identifier field (SSRC) in the packet header field, and then Detailed text.
  • PT payload type field
  • SSRC synchronization source identifier field
  • Open the port on the firewall generally refers to the internal interface of the firewall 1, that is, open the internal node 2 of the firewall 1 can access a public network or a port of other networks, such as: Open the port 80 of the firewall 1, it means that the node inside the firewall 2 It is possible to access the external node 3 in the external network with port 80 as the receiving port.
  • the convergence port 31 is set at least in the external node 3 (according to the packet filtering principle of the firewall, only the convergence port is set in the internal node, and the firewall 1 needs to open multiple ports corresponding to each port of the external node) Equivalent to the number of ports of the external node 3, the media stream is sent and received at one convergence port 31. Therefore, when the firewall 1 is traversed, only one port needs to be opened to establish communication with the convergence port 31, and the internal node 2 of the firewall 1 only needs to The convergence port 31 sends the media stream to complete the normal communication, thereby reducing the number of ports opened by the firewall.
  • the internal node 2 also sets the convergence port 22, then the private network and the public network or other external nodes 3 are set with the convergence port, so the internal node 2 of the firewall 1 is only The media stream needs to be sent by the convergence port 22 to complete the normal communication, that is, only the port of the convergence port 22 of the internal node 1 to the convergence port 31 of the external node 3 needs to be opened, thereby reducing the number of ports opened by the firewall 1.
  • the multimedia network security method of the present invention is used for communication between internal nodes and external nodes respectively located on the inner and outer sides of the firewall, and is characterized in that it comprises the following steps: Step s1, setting steps, at least setting on an external node Convergence port
  • Step s 2 determining an address step, determining a convergence port address of the communication peer
  • Step S3 Identify an interaction step, and send a unique identifier corresponding to each media stream type to the convergence port according to the convergence port address. Because at least the convergence node is set on the external node, at least the notification packet is sent to the convergence port of the external node. Firewall packet filtering principle), carrying a unique identifier corresponding to the media stream type;
  • Step s4 the media stream transmission step, according to the convergence port address, sends a media stream carrying the unique identifier to the communication peer end through a firewall port or receives a media stream carrying the unique identifier from the communication peer end through a firewall port;
  • Step s5 the media stream distribution step, according to the unique identifier of the media stream, the convergence port distinguishes each media stream.
  • the multimedia network security method further includes the following steps: Declaring a step, indicating that the communication peer itself has port convergence capability.
  • the declaring step further includes the following steps: transmitting a connection request message Setup to the communication peer, the statement itself supporting port convergence, and the connection request message Setup implements a statement supporting port convergence by extending the non-standard information domain;
  • the declaration effect can also be achieved by using only the connection request message instead of the corresponding call processing message.
  • the step of determining the address is implemented by a prior agreement or the step of determining the address is implemented by an interactive negotiation based on the H.245 protocol or by opening a logical channel based on the H.245 protocol.
  • the determining the address step, based on the H.245 protocol exchange negotiation specifically includes the following steps: sending a redirect address request message to the communication peer having the convergence port, where the redirect address request is cancelled
  • the information is implemented by extending the non-standard field in the command message in the H.245 protocol; the communication peer feedback redirects the address response message, the redirected address response message carries the convergence port address, and the redirect response message is extended by the H.245 protocol.
  • Non-standard field implementation in the command message is implemented by a prior agreement or the step of determining the address is implemented by an interactive negotiation based on the H.245 protocol or by opening a logical channel based on the H.245 protocol.
  • the determining the address step, based on the H.245 protocol exchange negotiation specifically includes the following steps
  • the determining the address step is implemented according to the H.245 protocol by opening the channel, and specifically includes the following steps: The external node or the internal node having the convergence port fills each port address into a convergence port address in the open logical channel response message. .
  • the notification packet is implemented based on the redirection packet, where the redirection packet includes an IP network packet header, an IP packet header containing the source IP address of the packet, and a user data packet containing the source port number of the ⁇ document.
  • the protocol packet header and the content of the redirect packet containing the media stream type, the specific step is to send a redirect message to the convergence port, and the unique identifier includes the source IP address, the source port number, and the corresponding media stream type.
  • the notification packet may also be implemented based on the real-time transport protocol packet, and the payload identifier domain and the synchronization source identifier domain in the packet header domain are used to implement the unique identifier of the media stream, including the following steps: Sending a synchronization source identifier notification message, declaring a synchronization source identifier value and its corresponding media stream type; a convergence port feedback synchronization source identifier response message, and the synchronization source identifier response message includes a synchronization source identifier value conflict Or notify the success message.
  • the synchronization source identifier notification message and the synchronization source identifier response message are implemented by extending a non-standard field in the command message in the H.245 protocol.
  • a specific embodiment of the multimedia network security method of the present invention (the internal node, the external node transceiver port is consistent, and the convergence node is set on the external node) includes the following steps:
  • the internal node When the internal node sends a Setup message to the external node, it needs to extend the Setup message, and declares that the internal node has the port convergence capability (that is, supports port convergence) in the Setup message. This is compatible with the port convergence function.
  • the node may also declare the calling or called in the Set up message. In this embodiment, the internal node is called as the calling party;
  • the external node After receiving the Setup message sent by the internal node, the external node needs to extend the CallProceeding message when feeding back the CallProceeding message to the internal node, and also declares that the external node has port convergence capability in the CallProceeding message (this step can be omitted);
  • the internal node After completing all the H.323 protocol procedures, the internal node sends a redirect address request message to the external node through the extended message of H.245, requesting the convergence port address of the external node;
  • the external node After receiving the redirect address request message, the external node returns a redirected address request response message to the internal node, and brings a convergence port address in the response message; thus, if the internal node does not know the convergence port of the external node in advance
  • the address is followed by steps (4), (5).
  • steps (4) and (5) may be omitted;
  • the internal node can then send the media stream to the external node, if the internal node directly reaches the convergence port of the external node at this time. If the media stream is sent, the external node cannot distinguish the content of the media stream of each port. Therefore, the internal node needs to send the notification packet to the convergence port before sending the media stream to the external node. In this embodiment, the redirect packet is used. Enabling the external node to distinguish various media stream information subsequently sent by the internal node according to the content of the redirected message;
  • the internal node can send the media stream carrying the unique identifier to the external node, and the external node can also send the uniquely identified media stream to the internal node.
  • the received media stream is differentiated at the convergence port for corresponding processing.
  • a specific embodiment of the multimedia network security method of the present invention (the internal node, the external node transceiver port is consistent, and the convergence node is set on the external node) includes the following steps: (1) When the internal node sends a Setup message to the external node, it needs to extend the Setup message to declare that the internal node has port convergence capability (that is, support port convergence) in the Setup message, so that it can be compatible with port convergence. The node may also declare the calling or called in the Setup message. In this embodiment, the internal node is called as the calling party;
  • the external node After receiving the Setup message sent by the internal node, the external node needs to extend the CallProceeding message to the internal node, and also declares that the external node has port convergence capability in the CallProceeding message.
  • this embodiment directly informs the internal node of the convergence port address of the external node in the process of opening the logical channel, and does not need to extend the H.245 message for notification.
  • the external node When informing, the external node only needs to fill in the logical channel response message, fill its own video RTP receiving address, video RTCP receiving address, audio RTP receiving address, and audio RTCP receiving address as the address of "converged port".
  • the process of opening the logical channel here is a standard H.245 protocol process, so it will not be described in detail;
  • the internal node can then send the media stream to the external node, if the internal node directly converges to the external node at this time.
  • the port "sends the media stream, and the external node still cannot distinguish the content of the media stream. Therefore, before sending the media stream to the external node, the internal node needs to send the redirection packet to the convergence port, so that the external node can distinguish the various media stream information that the internal node subsequently sends according to the content of the redirection packet;
  • the internal node can send the media stream carrying the unique identifier to the external node normally, and the external node can also send the unique identified media stream to the internal node normally;
  • the H.323 protocol in multimedia communication contains two main protocols: H.225.0 and H.245; where the H.225.0 protocol is also the main To include two parts: the RAS protocol part and the Q. 931 protocol part.
  • the H.224 protocol in order to implement the remote camera control function, the H.224 protocol is referenced, which uses the H.224 protocol for packet control by the remote camera and then transmits it in the RTP/RTCP protocol.
  • the RTP/RTCP protocol (which is a "real-time transport protocol/real-time transport control protocol"), in the H.323 protocol, 1 mainly uses this protocol to transmit audio streams, video streams, and remote camera control commands.
  • the data field of the non-standard parameter of the Setup/Cal lProceeding message (ie, the data field of NonStandardParameter) is extended to indicate the ability of the internal node or external node to converge and whether the internal node of the call is called or called.
  • the extension protocol is filled in by: Fill in the non-standard data (nonStandardData) field in the H323-UU-PDU.
  • nonStandardData the structure used is
  • NonStandardParameter contains two parts: nonStandardldent if ier and data field.
  • the nonStandardldent if ier part is filled in according to the content specified in the standard protocol, and the Data part is filled in as shown in Figure 14 and 15.
  • H323-UU-PDU SEQUENCE h323-mes sage-body CHOICE
  • the data field further includes (see Figure 13) type, length and parameters. As shown in Figure 14, the Setup message is used as an example. If the value is 1, the value of the parameter is 1, indicating that the port is converged.
  • MPR Redirect Address Request
  • MPR-ACK Redirect Address Response Messages
  • the MPR and MPR-ACK messages are extended messages of H.245.
  • the MPR and MPR-ACK are used to request and respond to the redirect message, and return the address of the requesting internal node or the external node to send a new media redirection message, that is, the convergence port address of the communication peer.
  • NonStandardMessage non-standard field
  • nonStandardData fields non-standard data fields
  • nonStandardData structures with NonStandardParameter, non-standard parameters
  • nonStandardldentifier non-standard identifier
  • Data data field
  • the nonStandardldentifier section is filled in according to the content specified in the standard protocol. For the Data section, please refer to Figures 16, 17, 18 and 19.
  • Nonstandard NonStandardMessage -- use this field maintenanceLoopOff Command Ma intenanceLoopOff Command
  • SendTerminalCapabi 1 i tySet SendTerminalCapabi 1 i tySet, encrypt ionCommand Encry t i onCommand,
  • the data field in the non-standard data field in the MPR message includes the following fields and values (each field adopts network byte order):
  • length message length, in bytes, now fixed to 8 bytes
  • Type Fixed fill 0 (identified as MPR);
  • the data field in the non-standard data field in the MPR-ACK message includes the following fields (the fields are in network byte order):
  • Port number The destination port number used by the internal node or external node to send redirection packets, that is, the convergence port port number.
  • IP address The destination IP address used by internal or external nodes to send redirected packets, that is, the IP address of the receiving port.
  • the MPR_ACK message carries the converged port address recorded in the fields: port number and IP address.
  • MRI Media Redirect Indicat ion
  • the data field in the non-standard data field in the MRI message includes the following fields and values (the fields are in network byte order) as follows:
  • Length The number of bytes of the redirected packet, excluding the identifier and length fields.
  • Type 1 - Initialization, 2 - Maintenance;
  • Private network address The source IP address used by the internal node to send redirected packets.
  • Private network port The source port used by the internal node to send redirected packets.
  • RTCP H. 224 0x06 Direction: 0 - receiving direction, 1 - sending direction;
  • the redirected packet is determined by the value of the direction: 0 - the receiving direction or the 1 - the sending direction.
  • the media stream of the internal node and the external node is determined.
  • the redirect packet is sent from the internal node to the external node. Send, the external node returns according to the path of the redirected message for interaction.
  • IP network header + IP header including the source IP address of the packet, IP1 + UDP header (including the source port number of the packet, portl) + Redirect packet content (including redirection)
  • IP network header + IP header including the source IP address of the packet, IP1 + UDP header (including the source port number of the packet, portl) + Redirect packet content (including redirection)
  • the source port number port2 and the source IP address IP2 in the content of the redirected message, what type of media stream is corresponding to the media stream type, determining the media stream type, and because of the IP packet header.
  • the source IP address IP1 and the port number port1 of the UDP packet header are uniquely determined, and the media stream type corresponding to the IP packet IP address IP1 and the port number port1 of the UDP packet header uniquely can be correspondingly obtained by redirecting the packet structure.
  • RTP/RTCP Real-Time Protocol
  • the MRI message can be used as the notification packet according to the packet filtering principle, and the identifier of the media stream of the external fp node is notified: the source IP address of the packet in the IP header and the source port number of the packet in the packet header of the user datagram + corresponding Redirects the type of media stream in the message content.
  • the internal node and the external node have the same transceiver port and the convergence node is set on the external node and the internal node, which includes the following steps. :
  • the internal node needs to send a Setup message when sending a Setup message to an external node. Extending to declare that the internal node has port convergence capability in the Se tup message, and the specific extension manner is the same as the foregoing embodiment;
  • the external node After receiving the Se tup message sent by the internal node, the external node needs to extend the Ca l Proceeding message when feeding back the Ca l Proceeding message to the internal node, and also declare that the external node has port convergence capability in the message, and the extension mode Same as the foregoing embodiment;
  • the external node informs the internal node of the address of its convergence port during the process of opening the logical channel; when notifying, the external node only needs to receive the address and video of its own video RTP in the open logical channel response message.
  • the RTCP receiving address, the audio RTP receiving address, and the audio RTCP receiving address are all filled in as the address of the convergence port.
  • the process of opening the logical channel here is the standard H.245 protocol process, so it will not be described in detail; (Note: The process of determining the convergence port address can also be used to redirect the address request (MPR) and redirect the address response message (MPR). - ACK) instead of);
  • MPR address request
  • MPR redirect the address response message
  • - ACK address response message
  • the internal node sends a synchronization source identifier notification message ("SSRC notification" message) to the external node through the extended message of H.245 to the external node, and describes to the external node.
  • SSRC notification a synchronization source identifier notification message
  • the SSRC value to be used in the media stream to be sent with the SSRC value as the unique identifier of the media stream;
  • the convergence port feeds back the synchronization source identifier response message, and the synchronization source identifier ⁇ response message contains a synchronization source identifier value conflict or a notification success message.
  • the external node After receiving the "SSRC Notification" message, the external node first checks whether there is a SSRC value conflict. If there is a SSRC value conflict, it returns a failure to the internal node, and explains the reason, so that the internal node regenerates the SSCR value and then notifies the external node. Therefore, in the actual processing, the subsequent entire communication process may repeatedly repeat steps (5) and (6) due to the conflict of SSCR values; if there is no SSCR value conflict, return a success message to the internal node;
  • the media stream that the internal node can normally send to the external node Since the RTP/RTCP protocol packet itself already contains the SSRC, the external node can then receive the packet according to the media stream.
  • the SSRC value and the PT field are used to distinguish the specific content of the media stream; similarly, the external node can also normally send the media stream to the internal node.
  • the synchronization source identifier notification message/synchronization source identifier response message may also be implemented based on the ⁇ .245 ⁇ .245 protocol command message extension.
  • the data field in the non-standard data field of the synchronization source identifier notification message includes the following fields and values (each field adopts network byte order):
  • Length the length of the message, in bytes, fixed to 8.
  • Type Currently fixed fill 0 (identified as MPR);
  • SSRC value 4 bytes, SSRC value in the RTP message to be transmitted.
  • the data field in the non-standard data field of the synchronization source identifier response message includes the following fields and values (each field adopts network byte order:):
  • Length The length of the message, in bytes, fixed to 12;
  • the synchronization source is the source stream of the RTP packet, which is a random number.
  • multimedia network security system and method of the present invention can provide the following benefits when applying multimedia services:
  • the convergence port and the media stream are uniquely identified, the number of ports opened on the firewall is as small as possible (for example, only one firewall port) without affecting the normal communication of the internal nodes, thereby improving the effectiveness of the firewall for network security protection. Sex, but also convenient for users to fire Configuration and maintenance of wall equipment;

Landscapes

  • Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

多媒体网络安全系统及方法
技术领域 本发明涉及通信或计算机领域的网络安全技术， 尤指一种多媒体网络 安全系统及方法。
背景技术 随着网络的发展， 网络安全也越来越突出， 虽然各个企事业单位都有 自己的私有网络， 但在实际的应用过程中， 又不得不与公网及其它网络进 行通信， 所以， 大多数企事业单位为保证自己私有网络的安全， 均采用防 火墙来加以保障。 防火墙之所以能够保障网络安全性， 是因为防火墙能对 经过的各种报文进行过滤。
请参照图 1所示， 一般防火墙均不会让任何有公共网络节点主动发起 的连接进入防火墙内部， 如 "公共网络的节点 21向私有网络的节点 11的 端口 5000发起 TCP连接" ； 同时， 防火墙也限制私有网络内部节点随便向 外部网络发起连接， "私有网络的节点 11向公共网络的节点 21的端口 5000 发起 TCP连接"。如果防火墙允许私有网络内部节点向外部节点发起连接， 则需要打开防火墙内部的某个端口， 如 1图中的防火墙打开了内部 80端口， 这样私有网络的节点 11便可以向公共网络的节点 21发起 TCP连接， 然后， 节点 21也就可以沿着原路响应节点 11的请求， 从而完成两个节点间的信息 交互。
请参照图 2所示， 以 H.323多媒体系统为例， 其基本组件包括： 若干
H.323终端、 多点控制单元（MCU )、 网守（GK )及网关， 每一个组件在 该多媒体系统中可作为一个节点， 节点间可进行呼叫交互。
所述 H.323协议包含两个主要协议： H.225.0和 H.245; 其中 H.225.0协 议也主要包含两部分的内容： 认证 ( RAS, Registration, Admisstion and Status )协议部分和 Q.931协议部分。 在 H.323协议中， 为实现远端摄像机 的控制功能， 引用了 H.224协议， 将远端摄像机控制的命令采用 H.224协议 进行打包，然后放在实时传输协议 /实时传输控制协议 (RTP/RTCP , Realtime Transport Protocol/ Realtime Transport Control Protocol)中进行传送。 在 H.323协议中， 主要用 RTP/RTCP协议来传送音频媒体流、视频媒体流以及 远端摄像机控制命令。
请参照图 3所示，根据 H.323协议的规定，节点 A和节点 B之间完整的呼 叫过程主要包括四个过程： RAS信令过程、 Q.931信令过程、 H.245过程和 媒体流交互过程。
请参照图 4所示， 在媒体流的交互过程中， 一个典型的 H.323呼叫将包 括音频媒体流和视频媒体流传输。在视 /音频媒体流的传输过程中，每个节 点 A或 B需要打开 4个接收端口， 包括： 视频媒体流的 RTP接收端口、 音频 媒体流的 RTP接收端口、 视频媒体流的 RTCP接收端口和音频媒体流的 RTCP接收端口。
这样， 根据 H.323多媒体通信的特点， 一旦呼叫的双方处于防火墙的 两边， 即节点 A和节点 B处于防火墙的两边， 则必须在防火墙上打开 H.323 多媒体通信过程中媒体流需要用到的多个端口， 因此减低了防火墙对网络 安全的预防能力。
现有技术中， 节点 A、 B之间有防火墙采用端口收敛技术， 减少在防 火墙上打开的端口数量。 请参照图 5所示， 在防火墙内部 （即在防火墙和 私有网络节点 A之间）设置独立的用于端口收敛的客户端设备； 在防火墙 外部 （即在防火墙和公共网絡节点 B之间）设置独立的用于端口收敛的服 务端设备， 从而达到端口收敛的目的。 在进行端口收敛时， 现有技术一般 采用音频和视频两个端口。
这样， 现有技术虽然采用端口收敛技术， 减少了在防火墙上打开端口 的数量， 但还存在以下问题：
( 1 ) 必须在防火墙内部放置独立的端口收敛设备， 增加用户使用成 本， 也将导致实际应用及维护的复杂度；
( 2 ) 由于还存在两个端口， 所以端口收敛并不是很彻底；
( 3 ) 由于每个呼叫均要经过客户端 /服务端进行端口收敛处理， 所以 其效率较低， 而且会因此引入延迟， 影响通信质量； ( 4 ) 由于该方式将客户端作为内部网络的代理来使用， 这就要求节 点 A必须将网守的地址配置成客户端的地址。这样，在公共运营的环境下， 非常不利于运营商统一部署业务， 公布统一的网守地址， 所以该方式有明 显的使用局限性。
发明内容
本发明解决的问题是提供一种多媒体网络安全系统及方法， 使位于防 火墙两边的节点交互过程中， 防火墙打开尽可能少的端口， 避免端口收敛 不彻底， 提高防火墙多网络安全防护的有效性。
为解决上述问题， 本发明多媒体网絡安全系统包括具有防火墙端口的 防火墙、位于防火墙内侧的具有内部节点端口的内部节点及位于防火墙外 侧的具有外部节点端口的外部节点， 所述内部节点和外部节点穿越防火墙 建立呼叫， 所述外部节点在与防火墙连接的方向上设置有收敛端口， 用于 接收所有内部节点端口的媒体流， 并区分媒体流以及将所有外部节点端口 的媒体流经其发送至各个相应内部节点端口。
所述内部节点在与防火墙连接的方向上设置有收敛端口， 用于从一个 防火墙端口接收夕卜部节点的收敛端口的媒体流并区分媒体流， 以及将所有 内部节点端口的媒体流经其穿越一个防火墙端口发送至外部节点的收敛 端口。
所述内部节点端口和外部节点端口的媒体流都具有用于区分媒体流 的唯一标识。
所述媒体流的唯一标识包括内部节点向外部节点发送的告知推文中 的 IP包头中报文的源 IP地址、 用户数据报协议包头中报文的源端口号及 对应重定向报文内容中的媒体流类型。
所述媒体流的唯一标识指在媒体流采用实时传输协议传输时的实时 传输协议^ =艮文中的信息包标题域中的有效载荷类型域和同步源标识符域。
相应地， 本发明多媒体网络安全方法， 用于实现分别位于具有防火墙 端口的防火墙内外两侧的内部节点和外部节点间的通信， 包括以下步骤： 设置步骤， 至少在外部节点设置收敛端口； 确定地址步骤， 确定通信对端 的收敛端口地址； 标识交互步骤， 根据收敛端口地址， 向收敛端口发送告 知报文， 该告知报文携带媒体流类型对应的唯一标识； 媒体流传输步骤， 才艮据收敛端口地址， 经由收敛端口， 穿越一个防火墙端口向通信对端发送 携带唯一标识的媒体流或从一个防火墙端口接收通信对端的携带唯一标 识媒体流；媒体流分发步骤，根据媒体流唯一标识， 收敛端口区分媒体流。
所述方法还包括以下步骤： 声明步驟， 向通信对端声明本身具有端口 收敛能力。
所述声明步骤基于 H.323协议， 其具体过程如下： 向通信对端发送连 接请求消息， 声明本身支持端口收敛， 所述连接请求消息通过 展非标准 信息域实现支持端口收敛的声明。 所述声明步骤还包括以下步骤： 通信对 端反馈呼叫处理消息， 声明本身支持端口收敛， 所述呼叫处理消息通过扩 展非标准信息域实现支持端口收敛的声明。
所述确定地址步骤通过事先约定来实现。
所述确定地址步骤通过基于 H.245协议交互协商实现， 具体包括以下 步骤： 向具有收敛端口的通信对端发送通过扩展 H.245协议中命令消息中 的非标字段实现的重定向地址请求消息； 通信对端反馈通过扩展 H.245协 议中命令消息中的非标字段实现的且携带收敛端口地址的重定向地址响 应消息。
所述确定地址步骤基于 H.245协议通过打开逻辑通道实现， 具体过程 为： 具有收敛端口的外部节点或内部节点在打开逻辑通道响应消息中将本 身各个端口地址皆填写成收敛端口地址。
标识交互步骤中告知报文基于重定向报文实现， 所述重定向报文包括 IP网络包头、 包含 ^艮文的源 IP地址的 IP包头、 包含 4艮文的源端口号的用 户数据报协议包头及包含媒体流类型的重定向报文内容； 所述唯一标识包 括所述的源 IP地址、 源端口号及对应的媒体流类型。
所述标识交互步骤中告知报文基于实时传输协议报文实现， 采用信息 包标题域中有效载荷类型域和同步源标识符域实现媒体流的唯一标识， 具 体步骤为： 向收敛端口发送同步源标识符通知报文， 声明采用同步源标识 符值及其对应的媒体流类型； 收敛端口反馈同步源标识符响应报文， 在同 步源标识符响应报文包含同步源标识符值冲突或通知成功消息。
所述同步源标识符通知报文和同步源标识符响应报文通过扩展 H.245 协议中命令消息中的非标字段实现。
与现有技术相比， 本发明具有以下优点：
由于采用收敛端口及媒体流唯一标识， 使得在不影响内部节点的正常 通信的情况下， 在防火墙上打开的端口尽可能的少 （例如仅一个防火墙端 口）， 从而提高防火墙对网络安全防护的有效性， 同时也方便用户对防火 墙设备的配置及维护；
不需要在防火墙内部增加额外设备 /组件， 方便用户使用，减少用户使 用成本； 同时也不会因此而影响通信效果；
由于媒体流的唯一标识、 收敛端口地址确定实现方式有多种， 方便用 户在多种场合下使用， 没有使用局限性。
附图说明 图 1是现有技术中网络安全系统一实施例框图。
图 2是现有技来中 H.323多媒体系统框图。
图 3是现有技术中 H.323多媒体呼叫流程图。
图 4是图 3细化流程图。
图 5是现有技术中网络安全系统另一实施例框图。
图 6是现有技术中多媒体网络安全系统一实施例框图。
图 7是现有技术中多媒体网络安全系统另一实施例框图。
图 8是本发明多媒体网络安全系统一实施例框图。
图 9是本发明多媒体网络安全系统另一实施例框图。
图 10是本发明多媒体网络安全系统又一实施例框图。
图 11是本发明多媒体网络安全方法整体流程图。
图 12是本发明多媒体网絡安全方法一实施例流程图。
图 13是本发明多媒体网络安全方法另一实施例流程图。
图 14、 15是图 12、 13中连接请求消息和呼叫处理消息扩展示意图。 图 16、 17是图 12中重定向地址请求消息扩展示意图。 图 18、 19是图 12中重定向地址响应消息扩展示意图。
图 20是图 12、 13中重定向报文扩展示意图。
图 21是本发明多媒体网络安全方法又一实施例流程图。
图 22、 23是图 21中同步源标识符通知报文扩展示意图。
图 24、 25是图 21中同步源标识符响应报文扩展示意图。 具体实施方式 请参阅背景技术， 防火墙内外两侧分布私有网络和公共网络， 在本发 明中将位于防火墙内侧的私有网絡中的节点称之为内部节点， 而位于防火 墙外侧的公共网络或其他网络中的节点称之为外部节点。 在不需要多媒体 通讯时， 例如， 私有网络为企业网， 仅需要与公共网络（如 Internet )进 行通讯， 则在防火墙上开设一个端口即可。
然而在多媒体通讯时， 请参照图 6、 7所示， 多媒体通讯中按照 H. 323 协议， 一个普通的视音频呼叫， 其媒体流的收发端口包括： 视频实时传输 协议（RTP, Real t ime Transport Protocol ) 端口、 视频实时传输控制 协议（RTCP, Real t ime Transport Control Protocol )端口、 音频实时 传输协议 ( RTP, Real t ime Transport Protocol )端口和音频实时传输 控制协议（RTCP, Real t ime Transport Control Protocol )端口， 这些 端口都需要在防火墙上打开。 由于每个内部节点对视频 RTP 端口、 视频 RTCP端口、 音频 RTP端口及音频 RTCP端口均有发送和接收两个方向的媒 体流， 请参见图 7所示， 如果每个端口都不一致， 则该呼叫在防火墙上需 要打开 8个端口。 请参照图 6所示， 如果内部节点和外部节点的收发端口 一致， 则也需要在防火墙上打开 4个端口。 防火墙打开端口越多越影响网 络安全， 多到一定程度防火墙形同虚设。 现有技术采用端口收敛技术以减 少在防火墙上开设端口的数量， 但是以多媒体通讯中内部节点和外部节点 的收发端口一致情况为例， 采用现有技术解决方案， 仍至少需要在防火墙 上打开两个端口。
本发明的目的是使端口收敛更彻底， 以便在多媒体通讯中在防火墙上 开设尽量少的端口， 一般情况， 采用本发明解决方案， 仅需要在防火墙打 开一个端口且不影响内部节点和外部节点正常的多媒体通讯。
请参照图 8所示， 本发明多媒体网络安全系统， 包括具有防火墙端口 的防火墙 1、 位于防火墙内侧的具有内部节点端口的内部节点 2及位于防 火墙外侧的具有外部端口的外部节点 3, 所述内部节点 2和外部节点 3穿 越防火墙 1建立呼叫， 所述外部节点 3在与防火墙 1的连接方向上设置有 收敛端口 31 , 收敛端口 31用于接收内部节点 2所有内部节点端口的媒体 流， 并区分媒体流以及将外部节点 3所有外部节点端口的媒体流经其发送 至内部节点 2的各个相应内部节点端口， 来自内部节点端口的媒体流具有 唯一标识， 收敛端口 31利用该标识区分媒体流。
按照图 8, 内部节点的端口先将所有的媒体流发送到防火墙的一个端 口上， 然后防火墙再将所有接收到的报文通过该端口转发给外部节点的收 敛端口。 如果从防火墙看内部节点， 有多个端口在向它发送报文， 即防火 墙接收内部节点发送的报文时， 能够看到各个内部节点的端口。 如果从收 敛端口看防火墙， 是从一个防火墙端口上接收报文， 但是从收敛端口看内 部节点， 却是有多个端口在向它发送报文。
请参照图 9所示， 所述内部节点 2在与防火墙的连接方向上设置有收 敛端口 22 , 该内部节点 2的收敛端口 22用于从一个防火墙端口处接收收 敛端口 31的媒体流并区 ^ 某体流作相应处理以及将内部节点 2所有内部 节点端口的媒体流经其穿越一个防火墙端口发送至收敛端口 31。
图 8、 9中的实施例是基于内部节点 2和外部节点 3收发端口一致的 情况。 请参照图 10所示， 当内部节点 2和外部节点 3收发端口不一致时， 仍然适用图 8、 9中收敛端口设置方案。 通过图 10中的箭头方向分辨出： 单箭头表示内部节点 2向外部节点 3发送媒体流， 而双箭头表示外部节点 3向内部节点 2发送媒体流。 之所以用双箭头表示外部节点 3向内部节点 2传输方向， 在实际的传输过程中， 除了外部节点 3向内部节点 2发送媒 体流外， 内部节点 2也要向外部节点 3发送相应的报文。 根椐防火墙 1的 包过滤原则， 在正常的情况下， 外部节点 3是不能直接向内部节点 2发送 媒体流的， 除非内部节点 2先向外部节点 3发送告知报文告知， 然后外部 节点 3采用沿着原路反馈到内部节点 2。 当然防火墙的包过滤原则同样适 用于图 8、 9 中的具体实施例， 且在本发明多媒体网络安全方法会继续描 述。 另外， 本发明涉及到公私网穿越的内容请参照专利申请： 申请号 03159214. 7 , 其名称为 《多媒体协议穿越网络地址转换设备的实现方式》 中的说明。
所述唯一标识是用于外部节点或内部节点在收敛端口处区分来自通 信对端不同端口媒体流， 以作相应处理， 例如设置收敛端口的外部节点或 内部节点通过媒体流中唯一标识能够将统一从收敛端口接收到的媒体流 区分为 "视频 RTP，，、 视频 "RTCP'，、 "音频 RTP" 及 "音频 RTCP"报文， 再 作进一步的处理， 区分过程参见本发明多媒体网络安全方法。 所述媒体流 的唯一标识通过内部节点根据包过滤原则向外部节点发送的告知报文实 现的， 包 告知报文中的 IP包头中报文的源 IP地址、 用户数据报协议包 头中报文的源端口号及对应重定向报文内容中的媒体流类型。
或者所述唯一标识通过在媒体流采用实时传输协议传输时， 直接在实 时传输协议报文中， 采用信息包标题域中有效载荷类型域 (PT)和同步源标 识符域（SSRC)实现， 后文详述。
在防火墙打开端口， 一般是指在防火墙 1的内部接口上， 即打开防火 墙 1内部节点 2可以访问公共网络或其他网络的某个端口， 如： 打开防火 墙 1的 80端口， 则表示防火墙内部节点 2可以访问外部网絡中以 80端口 作为接收端口的外部节点 3。
本发明多媒体网络安全系统中， 因为至少在外部节点 3设置收敛端口 31 (根据防火墙的包过滤原则， 仅在内部节点设置收敛端口， 防火墙 1对 应外部节点的各个端口还需开设多个端口）， 相当于无论外部节点 3有多 少个端口， 其媒体流的收发都集中在一个收敛端口 31 处， 所以穿越防火 墙 1时只需打开一端口与收敛端口 31建立通讯， 防火墙 1内部节点 2仅 需要向收敛端口 31发送媒体流便能完成正常的通信， 从而减少防火墙打 开端口的数目。
若内部节点 2也设置收敛端口 22 ,则此时私有网络和公共网络或其他 中的外部节点 3都设置了收敛端口， 所以， 同样防火墙 1的内部节点 2仅 需要由收敛端口 22发送媒体流便能完成正常的通信， 即只需要打开内部 节点 1收敛端口 22到外部节点 3的收敛端口 31这一端口， 从而减少防火 墙 1打开端口的数目。
请参照图 11 所示， 本发明多媒体网络安全方法， 用于分别位于防火 墙内外两侧的内部节点和外部节点间通信， 其特征在于， 包括以下步骤： 步骤 s l， 设置步驟， 至少在外部节点设置收敛端口；
步骤 s 2 , 确定地址步骤， 确定通信对端的收敛端口地址；
步骤 S 3 , 标识交互步骤， 根据收敛端口地址， 向收敛端口发送各个媒 体流类型对应的唯一标识， 因为至少在外部节点设置收敛端口， 所以需要 至少向外部节点的收敛端口发送告知报文（符合防火墙包过滤原则）， 携 带媒体流类型对应的唯一标识；
步骤 s4 , 媒体流传输步骤， 根据收敛端口地址， 经由收敛端口， 穿越 一个防火墙端口向通信对端发送携带唯一标识的媒体流或从一个防火墙 端口接收通信对端携带唯一标识的媒体流；
步骤 s5 , 媒体流分发步骤， 根据媒体流唯一标识， 收敛端口区分各个 媒体流。
所述多媒体网络安全方法还包括以下步驟： 声明步骤， 向通信对端声 明本身具有端口收敛能力。 所述声明步骤基于 H. 323协议进一步包括以下 步骤： 向通信对端发送连接请求消息 Setup, 声明本身支持端口收敛， 所 述连接请求消息 Setup通过扩展非标准信息域实现支持端口收敛的声明； 通信对端反馈呼叫处理消息 Ca l lProceeding, 声明本身支持端口收敛， 所 述呼.叫处理消息 Cal lProceeding通过扩展非标准信息域实现支持端口收 敛的声明。 需要说明的是仅使用连接请求消息而不要相应的呼叫处理消息 也可达成声明效果。
所述确定地址步驟通过事先约定实现或者所述确定地址步骤通过基 于 H. 245协议交互协商实现或者基于 H. 245协议通过打开逻辑通道实现。 所述确定地址步骤， 基于 H. 245协议交互协商， 具体包括以下步骤： 向具 有收敛端口的通信对端发送重定向地址请求消息， 所述重定向地址请求消 息通过扩展 H. 245协议中命令消息中的非标字段实现； 通信对端反馈重定 向地址响应消息， 所述重定向地址响应消息携带收敛端口地址， 且重定向 响应消息通过扩展 H. 245协议中命令消息中的非标字段实现。
所述确定地址步據基于 H. 245协议通过打开£辑通道实现， 具体包括 以下步骤： 具有收敛端口的外部节点或内部节点在打开逻辑通道响应消息 中将本身各个端口地址皆填写成收敛端口地址。
标识交互步骤中告知报文基于重定向报文实现， 所述重定向报文包括 IP网络包头、 包含 ^艮文的源 IP地址的 IP包头、 包含^ ^艮文的源端口号的用 户数据报协议包头及包含媒体流类型的重定向报文内容， 具体步骤为向收 敛端口发送重定向 4艮文， 而所述唯一标识包括所述的源 IP地址、 源端口 号及对应的媒体流类型。
所述标识交互步骤中告知报文也可以基于实时传输协议报文实现， 采 用信息包标题域中有效载荷类型域和同步源标识符域实现媒体流的唯一 标识， 具体包括以下步骤： 向收敛端口发送同步源标识符通知报文， 声明 采用同步源标识符值及其对应的媒体流类型； 收敛端口反馈同步源标识符 响应报文， 在同步源标识符响应报文包含同步源标识符值冲突或通知成功 消息。 所述同步源标识符通知报文和同步源标识符响应报文通过扩展 H. 245协议中命令消息中的非标字段实现。
如上所述， 确定地址步骤和标识交互步骤具体实现方案有多种， 可以 排列组合多种不同的多媒网络安全方法具体实施例。 在本申请文件为说明 本发明多媒体网络安全方法原理， 列举出 3个实施例加以说明。
请参照图 12 所示， 本发明多媒体网络安全方法一具体实施例 （该实 施例在内部节点、 外部节点收发端口一致且在外部节点设置收敛端口）， 具体包括以下步骤：
( 1 ) 内部节点在向外部节点发送 Setup消息时， 需要对 Setup消息 进行扩展， 便在 Setup消息中声明内部节点具有端口收敛能力 （即支持 端口收敛）， 这样做可以兼容不支持端口收敛功能的节点， 另外也可以在 S e t up消息声明主叫还是被叫， 在本实施例中设内部节点为主叫； (2)外部节点接收到内部节点发送的 Setup消息后， 向内部节点反 馈 CallProceeding消息时， 需要对 CallProceeding消息进行扩展， 同时 也在 CallProceeding 消息中声明外部节点具有端口收敛能力 （该步骤可 以省略）；
(3)继续完成正常的 H.323协议交互过程， 这些过程与本专利 请 无关， 故省略；
( 4 ) 当完成所有的 H.323协议过程后， 内部节点通过 H.245的扩展 消息向外部节点发送重定向地址请求消息， 请求外部节点的收敛端口地 址；
(5) 外部节点接收到重定向地址请求消息后， 向内部节点返回重定 向地址请求响应消息， 并在该响应消息中带上收敛端口地址； 这样如果事 先内部节点并不知道外部节点的收敛端口地址则之行步骤（4)、 （5)， 在 具体的实现过程中， 如果内部节点和外部节点双方已经约定了收敛端口地 址， 则可以省略步骤（4)和（5);
(6)在完成步驟（1) ~ (5)后， 虽然按照 H.323协议的过程， 这 时内部节点便可以向外部节点发送媒体流， 当如果此时内部节点直接向外 部节点的收敛端口发送媒体流， 则外部节点还是不能区分各个端口媒体流 的内容； 所以， 内部节点在向外部节点发送媒体流之前， 需要先向收敛端 口发送告知报文， 本实施例釆用重定向报文， 使得外部节点能够根据重定 向报文的内容来区分内部节点随后发送的各种媒体流信息；
(7)在外部节点收到重定向报文后， 内部节点便可以向外部节点正 常发送的携带唯一标识的媒体流， 而外部节点也可以正常向内部节点发送 唯一标识的媒体流了；
( 8 )根据媒体流唯一标识， 将收敛端口处区分接收的媒体流进行相 应处理。
请参照图 13所示， 本发明多媒体网络安全方法一具体实施例 （该实 施例在内部节点、 外部节点收发端口一致且在外部节点设置收敛端口）， 具体包括以下步骤： ( 1 ) 内部节点在向外部节点发送 Setup消息时， 需要对 Setup消息 进行扩展， 以便在 Setup消息中声明内部节点具有端口收敛能力 （即支持 端口收敛）， 这样^可以兼容不支持端口收敛功能的节点， 另外也可以在 Setup消息声明主叫还是被叫， 在本实施例中设内部节点为主叫；
(2)外部节点接收到内部节点发送的 Setup消息后， 向内部节点反 馈 CallProceeding消息时， 需要对 CallProceeding消息进行扩展， 同时 也在 CallProceeding消息中声明外部节点具有端口收敛能力；
(3)继续完成正常的 H.323协议交互过程， 这些过程与本专利无关， 故省略；
(4) 与上述实施例不同的是， 本实施例直接在打开逻辑通道的过程 中向内部节点告知外部节点的收敛端口地址， 而不需要再通过扩展 H.245 消息来进行通知。在告知时，外部节点只需要在打开逻辑通道响应消息中， 将自己的视频 RTP接收地址、 视频 RTCP接收地址、 音频 RTP接收 址、 音频 RTCP接收地址均填为 "收敛端口" 的地址便可以了。 这里的打开逻 辑通道过程为标准的 H.245协议过程， 所以不再作详细描述；
(5)在完成过程 (1) ~ (4)后， 虽然按照 H.323协议的过程， 这 时内部节点便可以向外部节点发送媒体流， 当如果此时内部节点直接向外 部节点的 "收敛端口" 发送媒体流， 则外部节点还是不能区分媒体流的内 容。 所以， 内部节点在向外部节点发送媒体流之前， 需要先向收敛端口发 送重定向报文， 使得外部节点能够根据重定向报文的内容来区分内部节点 随后发送的各种媒体流信息；
(6)在外部节点收到重定向报文后， 内部节点便可以向外部节点正 常发送的携带唯一标识的媒体流， 而外部节点也可以正常向内部节点发送 唯一标识的媒体流了；
(7)根据媒体流唯一标识， 将收敛端口处的媒体流分发给目标节点 的相应各个端口。
下面对上述两个实施例中涉及具体协议进行说明。 多媒体通信中 H.323协议包含两个主要协议： H.225.0和 H.245; 其中 H.225.0协议也主 要包含两部分的内容： RAS协议部分和 Q. 931协议部分。在 H. 323协议中， 为实现远端摄像机的控制功能， 引用了 H. 224协议， 它将远端摄像机控制 的命令采用 H. 224协议进行打包， 然后放在 RTP/RTCP协议中进行传送。 RTP/RTCP 协议（它是 "实时传输协议 /实时传输控制协议" 的筒称）， 在 H. 323协议中，1主要用该协议来传送音频码流、 视频码流以及远端摄像机 控制命令。
请参照图 14、 15所示， Setup/Cal lProceeding消息扩展。
对 Setup/Cal lProceeding 消 息的非标参数的数据域 ( 即 NonStandardParameter的 data域）进行扩展， 用于表明该内部节点或外 部节点端口收敛的能力以及本次呼叫内部节点做被叫还是主叫。
扩展协议的填写方式是： 在 H323-UU- PDU 中的非标数据 ( nonStandardData ) 字段中填写。 nonStandardData (采用的结构为
NonStandardParameter ) 包 含 两 部 分 内 容 ： 非 标 标 识 ( nonStandardldent if ier ) 和 数 据 域 ( data ) 其 中 nonStandardldent if ier部分根据标准协议规定的内容进行填写， 而 Data 部分的填写见图 14、 15。 下面 H. 323相关字段描述：
H323-UU-PDU SEQUENCE h323-mes sage-body CHOICE
{
setup Setup-UUIE,
cal 1 Proceeding Cal lProceeding-UUIE,
connect Connect-UUIE, ·
alert ing Alert ing-UUIE,
informat ion Inf ormat ion-UUIE,
releaseComplete ReleaseComplete-UUIE,
f aci 1 i ty Faci l i ty-UUIE, progres s Progress - UUIE, em ty NULL, —一 used when a Facility message is sent
status Status- UUIE，
statuslnquiry Statuslnquiry-UUIE,
setupAcknowledge SetupAcknowledge-UUIE,
not if y Notify- UUIE nonStandardData NonStandardParameter OPTIONAL, (采用 该字段）
NonStandardParameter ：： =SEQUENCE
{
nonStandardldent if ier NonStandardldent if ier
data OCTET STRING
}
NonStandardldent if ier ：： =CH0ICE object OBJECT IDENTIFIER,
h221NonStandard SEQUENCE
{
t35CountryCode INTEGER (0..255), ― country, per
T.35,
t35Extension INTEGER (0..255)， 一- assigned nationally, manuf acturerCode INTEGER (0..65535) -- assigned nationally,
数据域进一步包括（见图 13 )类型、 长度及参数。 请参照图 14所示， 以 Setup消息为例， 当类型取值为 1， 参数取值为 1， 则表示支持端口收 敛。
请参照图 16、 17、 18及 19所示， 重定向地址请求（MPR)和重定向 地址响应消息（MPR- ACK)的扩展。 重定向地址请求消息， 以下筒称： MPR (Media Port Req ); 重定向地址响应消息， 以下简称： MPR- ACK。
MPR和 MPR-ACK消息是 H.245的扩展消息。 MPR和 MPR-ACK用于对重 定向消息请求和响应， 返回请求内部节点或外部节点新的发送媒体重定向 艮文的地址， 即通信对端的收敛端口地址。
不管是 MPR还是 MPR- ACK消息，其均利用 H.245协议命令消息（ command 消息， 对应的结构是： CommandMessage) 中的 nonstandard (非标字段， 对应的结构是： NonStandardMessage)字段进行才广展。在 nonstandard中， 使用非标数据字段 (nonStandardData字段）， nonStandardData (采用的 结构为 NonStandardParameter, 非标参数） 包含两部分内蓉： 非标标识 ( nonStandardldentifier ) 和 数 据 域 ( Data ) 。 其 中 nonStandardldentifier部分根据标准协议规定的内容进行填写， 而 Data 部分的填写请参照图 16、 17、 18及 19。
H.245中相关字段描述如下：
Mul timediaSystemControlMessage ：： =CH0ICE
{
request RequestMessage,
response ResponseMessage,
command CommandMessage, ―采用该消息
indication IndicationMessage, }
CoramandMessage：： -CHOICE
{
nonstandard NonStandardMessage, --采用该字段 maintenanceLoopOff Command Ma intenanceLoopOff Command,
SendTerminalCapabi 1 i tySet SendTerminalCapabi 1 i tySet, encrypt ionCommand Encry t i onCommand,
f 1 owCon tro 1 Command F 1 owCont rol Command,
endSess ionCommand EndSess ionCommand,
miscel laneousCommand Miscel laneousCommand, communicat ionModeCoramand Communicat ionModeCoramand, conf erenceCommand Conf erenceCommand,
h223Mul tip 1 exReconf igurati on
H223Mul ti i exReconf igurati on,
newATMVCCommand NewATMVCCommand,
mob i 1 eMu ltili nkReconf igurati onCommand
MobileMultilinkReconf igurationComniand
NonStandardMessage ：： =SEQUENCE
{
nonStandardData NonStandardParameter,
}
NonStandardParameter ：： -SEQUENCE
{
nonStandardldentif ier NonStandardldentif ier data OCTET STRING
NonStandardldent if ier ：： =CH0ICE —Not el
{
object OBJECT IDENTIFIER,
h221NonStandard SEQUENCE
{
t 35CountryCode INTEGER (0. . 255) , ― country, per
T. 35 ,
t 35Extens ion INTEGER (0. . 255) , ― ass igned na t i ona 1 ly,
manuf acturerCode INTEGER (0. . 65535) ― ass igned nat ional ly
请参照图 16、 17所示， MPR消息中的非标数据字段中数据域包括以下 字段及取值（各字段均采用网络字节序）：
标识： 固定填 0x45434543;
, 长度： 消息长度， 以字节为单位， 现在固定为 8个字节；
类型： 固定填 0 (标识为 MPR );
子类型： 取值及对应的端口， 参见图 17;
保留： 4字节保留字段， 填 0。
请参照图 18、 19所示， MPR-ACK消息中的非标数据字段中数据域包括 以下字段 取值（各字段均采用网络字节序）：
标识： 固定填 0x45434543;
类型： 目前固定为 1 (标识为 MPR— ACK ); , 长度： 消息长度， 以字节为单位， 现在固定为 12个字节；
地址属性： 固定为 2;
子类型， 取值及对应的端口， 参见图 19;
端口号： 用于内部节点或外部节点发送重定向报文的目的端口号， 即 收敛端口端口号；
IP地址： 用于内部或外部节点发送重定向报文的目的 IP地址， 即收 敛端口的 IP地址；
保留： 4字节保留字段， 固定填 0。
这样， 在 MPR— ACK 消息携带收敛端口地址记录在字段： 端口号和 IP 地址内。
请参照图 20 所示， 重定向才艮文， 以下简称： MRI ( Media Redirect Indicat ion )。 MRI报文用于建立防火墙内部到防火墙外部的媒体流通道。
MRI报文中的非标数据字段中数据域， 即报文内容包括以下字段及取 值（各字段均采用网络字节序）如下：
标识： 固定填 0x45434543
长度： 重定向报文的字节数， 不包括标识和长度字段；
类型： 1 -初始化， 2 -维持；
私网地址 内部节点发送重定向报文使用的源 IP地址;
私网端口 内部节点发送重定向报文使用的源端口；
媒体种类
RTP图象 = 0x01
RTCP图象 = 0x02
RTP声音 = 0x03
RTCP声音 = 0x04
RTP H. 224 = 0x05
RTCP H. 224 = 0x06 方向： 0 -接收方向， 1 -发送方向；
保留： 62字节保留字段， 必须全部填 0;
号码长度： 内部节点号码长度；
号码： 内部节点的节点号码。
当收发端口一致 /不一致， 重定向报文以 "方向的取值： 0 -接收方向 或 1 -发送方向" 区分确定内部节点和外部节点的媒体流， 该重定向报文 由内部节点向外部节点发送， 外部节点遵照重定向报文的路径返回进行交 互。
一个重定向报文的格式如下： IP 网络包头 + IP 包头 （包含报文的 源 IP地址， IP1 ) + UDP包头（包含报文的源端口号， portl ) + 重定 向报文内容（包含重定向报文中的节点号码、 源端口号 port2、 源 IP地址 IP2及对应的媒体流类型， 如图 20所示）; 而 "RTP/RTCP" 报文的格式如 下： IP网络包头 + IP包头 （包含^ =艮文的源 IP地址） + UDP包头 （包 含报文的源端口号） + RTP/RTPC报文内容。 在上述的实现过程中， 首先 根据重定向报文内容中的节点号码、 源端口号 port2和源 IP地址 IP2来 确定其对应的是什么类型的媒体流， 确定媒体流类型后， 又因为 IP 包头 的源 IP地址 IP1和 UDP包头的端口号 portl唯一确定， 则通过重定向艮 文结构可对应得出 IP包头源 IP地址 IP1和 UDP包头的端口号 portl唯一 对应的媒体流类型。 这样虽然在随后接收到的 "RTP/RTCP" 报文时没有媒 体流类型说明， 但可以才艮据 IP1和 portl来区分不同类型的媒体流。 所述 UDP ( User Datagram Protocol )指用户数据艮协议。
这样， 根据包过滤原则 MRI报文可作为告知报文， 并通知外 fp节点媒 体流采用的标识： IP包头中报文的源 IP地址 +用户数据报协议包头中报 文的源端口号 +对应重定向报文内容中的媒体流类型。
请结合参照图 9、 21所示，为本发明多媒体网络安全方法又一实施例， 该实施例在内部节点、 外部节点收发端口一致且在外部节点、 内部节点都 设置收敛端口， 具体包括以下步骤：
( 1 ) 内部节点在向外部节点发送 Setup消息时， 需要对 Setup消息 进行扩展， 以便在 Se tup消息中声明内部节点具有端口收敛能力， 具体扩 展方式同前述实施例；
( 2 )外部节点接收到内部节点发送的 Se tup 消息后， 向内部节点反 馈 Ca l lProceeding消息时， 需要对 Ca l lProceeding消息进行扩展， 同时 也在消息中声明外部节点具有端口收敛能力， 扩展方式同前述实施例；
( 3 )继续完成正常的 H. 323协议交互过程， 这些过程与本专利无关， 故省略；
( 4 ) 同样的， 外部节点在打开逻辑通道的过程中告知内部节点其收 敛端口的地址；在告知时，外部节点也只需要在打开逻辑通道响应消息中， 将自己的视频 RTP接收地址、 视频 RTCP接收地址、 音频 RTP接收地址、 音频 RTCP接收地址均填为收敛端口的地址便可以了。 这里的打开逻辑通 道过程为标准的 H. 245协议过程， 所以不再作详细描述； （注意： 收敛端 口地址的确定过程也可以用来重定向地址请求 （MPR )和重定向地址响应 消息（MPR- ACK )方式替代）； 另外， 由于内部节点和外部节点都设有收敛 端口， 所以都需要知道通信对端的收敛端口地址， 其实现方式同上；
( 5 ) 当完成所有的 H. 323协议过程后， 内部节点通过 H. 245的扩展 消息向外部节点发送向收敛端口发送同步源标识符通知报文（ "SSRC通知" 消息）， 向外部节点说明其即将发送的媒体流中将要使用的 SSRC值， 以 SSRC值作为媒体流唯一标识；
( 6 ) 收敛端口反馈同步源标识符响应报文， 在同步源标识符^应报 文包含同步源标识符值冲突或通知成功消息。例如，外部节点接收到 "SSRC 通知" 消息后， 首先检查是否存在 SSRC值冲突， 如果存在 SSRC值冲突， 则向内部节点返回失败， 并说明原因， 以便内部节点重新生成 SSCR值再 通知外部节点， 所以在实际的处理过程中， 随后的整个通信过程都有可能 由于 SSCR值的冲突导致不断重复步骤（5 )和步驟（6 ); 如果不存在 SSCR 值冲突， 则向内部节点返回成功消息；
( 7 ) 内部节点便可以向外部节点正常发送的媒体流， 由于 RTP/RTCP 协议报文中， 本身就已经包含 SSRC,这样外部节点便可以根据媒体流报文 中 SSRC值及 PT域来区分媒体流的具体内容； 同样， 这时外部节点也可以 正常向内部节点发送媒体流。
所述同步源标识符通知报文 /同步源标识符响应报文也可以基于 Η. 245Η. 245协议命令消息扩展实现。
请参照图 22、 23所示， 所述同步源标识符通知报文非标数据字段中 数据域包括以下字段及取值（各字段均采用网络字节序）：
标识： 固定填 0x00000001 ;
长度： 消息长度， 以字节为单位， 固定为 8;
类型： 目前固定填 0 (标识为 MPR );
子类型： 取值及对应的端口， 请参照图 23;
SSRC值: 4字节， 即将传送的 RTP报文中 SSRC值。
请参照图 24、 25所示， 所述同步源标识符响应报文非标数据字段中 数据域包括以下字段及取值 (各字段均采用网络字节序：)：
标识:' 固定填 0x00000001;
长度： 消息长度， 以字节为单位， 固定为 12;
类型： 目前固定为 1 ; (标识为 MPR— ACK );
子类型： 取值及对应的端口， 请参照图 25;
结果： 标识对 SSRC声明的结果。 0 ~成功， 1 ~ SSRC冲突， 其它 ~保 留；
保留： 4字节保留字段， 固定填 0;
SSRC ( Synchronizat ion source ), 同步源即 RTP 包的信源流， 是个 随机数。
综上所述， 本发明多媒体网络安全系统及方法， 用户在应用多媒体业 务时， 可以带来如下益处：
由于采用收敛端口及媒体流唯一标识， 使得在不影响内部节点的正常 通信的情况下， 在防火墙上打开的端口尽可能的少（例如仅一个防火墙端 口）， 从而提高防火墙对网络安全防护的有效性， 同时也方便用户对防火 墙设备的配置及维护；
不需要在防火墙内部增加额外设备 /組件， 方便用户使用， 减少用户 使用成本； 同时也不会因此而影响通信效果；
由于媒体流的唯一标识、 收敛端口地址确定实现方式有多种， 方便用 户在多种场合下使用， 没有使用局限性。

Claims

权 利 要 求
1.一种多媒体网络安全系统， 包括具有防火墙端口的防火墙、 位于防 火墙内侧的具有内部节点端口的内部节点及位于防火墙外 «的具有外部 节点端口的外部节点， 所述内部节点和外部节点穿越防火墙建立呼叫， 其 特征在于， 所述外部节点在与防火墙连接的方向上设置有收敛端口， 用于 接收所有内部节点端口的媒体流， 并区分媒体流以及将所有外部节点端口 的媒体流经其发送至各个相应内部节点端口。
2.如权利要求 1所述的多媒体网络安全系统， 其特征在于， 所述内部 节点在与防火墙连接的方向上设置有收敛端口， 用于从一个防火墙端口接 收外部节点的收敛端口的媒体流， 并区分媒体流以及将所有内部节点端口 的媒体流经其穿越一个防火墙端口发送至外部节点的收敛端口。
3.如权利要求 1或 2所述的多媒体网络安全系统， 其特征在于， 所述 内部节点端口和外部节点端口的媒体流都具有用于区分媒体流的唯一标 识。
4.如权利要求 3所述的多媒体网络安全系统， 其特征在于， 所述媒体 流的唯一标识包括内部节点向外部节点发送的告知报文中的 IP 包头中报 文的源 IP地址、 用户数据报协议包头中报文的源端口号及对应重定向报 文内容中的媒体流类型。
5.如权利要求 3所述的多媒体网络安全系统， 其特征在于， 所述媒体 流的唯一标识指在媒体流采用实时传输协议传输时的实时传输协议报文 中的信息包标题域中的有效载荷类型域和同步源标识符域。
6.—种多媒体网络安全方法， 用于实现分别位于具有防火墙端口的防 火墙内外两侧的内部节点和外部节点间的通信， 其特征在于， 括以下步 骤：
设置步驟， 至少在外部节点设置收敛端口；
确定地址步骤， 确定通信对端的收敛端口地址；
标识交互步骤， 根据收敛端口地址， 向收敛端口发送告知报文， 该告 知报文携带媒体流类型对应的唯一标识；
媒体流传输步骤， 根椐收敛端口地址， 经由收敛端口， 穿越一个防火 墙端口向通信对端发送携带唯一标识的媒体流或从一个防火墙端口接收 通信对端的携带唯一标识媒体流；
媒体流分发步骤， 根据媒体流唯一标识， 收敛端口区分媒体流。
7.如权利要求 6所述的多媒体网络安全方法， 其特征在于， 所述方法 还包括以下步骤：
声明步骤， 向通信对端声明本身具有端口收敛能力。
8.如权利要求 7所述的多媒体网络安全方法， 其特征在于， 所述声明 步骤基于 H. 323协议， 其具体过程如下：
向通信对端发送连接请求消息， 声明本身支持端口收敛， 所述连接请 求消息通过扩展非标准信息域实现支持端口收敛的声明。
9.如权利要求 8所述的多媒体网络安全方法， 其特征在于， 所述声明 步骤还包括以下步骤：
通信对端反馈呼叫处理消息， 声明本身支持端口收敛， 所述呼叫处理 消息通过扩展非标准信息域实现支持端口收敛的声明。
10.如权利要求 6 所述的多媒体网络安全方法， 其特征在于， 所述确 定地址步骤通过事先约定来实现。
11.如权利要求 6 所述的多媒体网络安全方法， 其特征在于， 所迷确 定地址步驟通过基于 H. 245协议交互协商实现， 具体包括以下步骤： 向具有收敛端口的通信对端发送通过扩展 H. 245协议中命令消息中的 非标字段实现的重定向地址请求消息；
通信对端反馈通过扩展 H. 245协议中命令消息中的非标字段实现的且 携带收敛端口地址的重定向地址响应消息。
12.如权利要求 6所述的多媒体网络安全方法， 其特征在于， 所述确 定地址步骤基于 H. 245协议通过打开逻辑通道实现， 具体过程为： 具有收 敛端口的外部节点或内部节点在打开逻辑通道响应消息中将本身各个端 口地址皆填写成收敛端口地址。
13. 如权利要求 6所述的多媒体网络安全方法， 其特征在于， 标识交 互步骤中告知报文基于重定向报文实现， 所述重定向报文包括 IP 网络包 头、 包含报文的源 IP地址的 IP包头、 包含报文的源端口号的用户数据报 协议包头及包含媒体流类型的重定向^ ^艮文内容； 所述唯一标识包括所述的 源 IP地址、 源端口号及对应的媒体流类型。
14.如权利要求 6所述的多媒体网络安全方法， 其特征在于， 所述标 识交互步骤中告知报文基于实时传输协议报文实现， 采用信息包标题域中 有效载荷类型域和同步源标识符域实现媒体流的唯一标识， 具体步骤为： 向收敛端口发送同步源标识符通知报文， 声明采用同步源标识符值及其对 应的媒体流类型； 收敛端口反馈同步源标识符响应报文， 在同步源标识符 响应报文包含同步源标识符值冲突或通知成功消息。
15.如权利要求 14所述的多媒体网络安全方法， 其特征在于， 所述同 步源标识符通知 4艮文和同步源标识符响应报文通过扩展 H. 245协议中命令 消息中的非标字段实现。
PCT/CN2005/000725 2004-06-23 2005-05-25 Systeme de securite du reseau multimedia et procede correspondant WO2006000141A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200410049678.5A CN100484016C (zh) 2004-06-23 2004-06-23 多媒体网络安全系统及方法
CN200410049678.5 2004-06-23

Publications (1)

Publication Number Publication Date
WO2006000141A1 true WO2006000141A1 (fr) 2006-01-05

Family

ID=35719037

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2005/000725 WO2006000141A1 (fr) 2004-06-23 2005-05-25 Systeme de securite du reseau multimedia et procede correspondant

Country Status (2)

Country Link
CN (1) CN100484016C (zh)
WO (1) WO2006000141A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102844268A (zh) * 2010-04-28 2012-12-26 普莱克斯技术有限公司 氧气供应方法及设备

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100514940C (zh) 2006-10-23 2009-07-15 华为技术有限公司 对网络通信端口重定向的方法和网络通信系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20010096779A (ko) * 2000-04-14 2001-11-08 이태권 인터넷 진학 포탈 서비스 시스템 및 그 운용 방법
EP1354460A1 (en) * 2001-01-05 2003-10-22 Telefonaktiebolaget Lm Ericsson Multi-user applications in multimedia networks
CN1610340A (zh) * 2003-10-21 2005-04-27 西安西邮双维通信技术有限公司 一种多媒体通信安全代理网关及安全代理方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20010096779A (ko) * 2000-04-14 2001-11-08 이태권 인터넷 진학 포탈 서비스 시스템 및 그 운용 방법
EP1354460A1 (en) * 2001-01-05 2003-10-22 Telefonaktiebolaget Lm Ericsson Multi-user applications in multimedia networks
CN1610340A (zh) * 2003-10-21 2005-04-27 西安西邮双维通信技术有限公司 一种多媒体通信安全代理网关及安全代理方法

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102844268A (zh) * 2010-04-28 2012-12-26 普莱克斯技术有限公司 氧气供应方法及设备

Also Published As

Publication number Publication date
CN1713590A (zh) 2005-12-28
CN100484016C (zh) 2009-04-29

Similar Documents

Publication Publication Date Title
US9590821B2 (en) Communication system for transmitting data under a tunnel protocol between at least two data computers via a wide area network and a method for running such a communication system
US7996543B2 (en) Client-to-client direct RTP exchange in a managed client-server network
US8599747B1 (en) Lawful interception of real time packet data
US8767590B2 (en) Multimedia conference system and method which enables communication between private network and internet
WO2007036160A1 (fr) Appareil, systeme et procede assurant la communication entre un client et un serveur
WO2008017265A1 (fr) Procédé et système pour conduire le flux de média, et procédé et système de détection de conduite
US20060187912A1 (en) Method and apparatus for server-side NAT detection
WO2009129718A1 (zh) 一种音视频会议中实现文件共享的方法、装置及系统
WO2007093127A1 (fr) Système, procédé et dispositif de configuration d'une session média interactive d'après un sous-système ip multimédia
JP2008517556A (ja) ファイアウォール越えのための装置および方法
US7948890B2 (en) System and method for providing a communication channel
TW201002018A (en) Method for predicting port number of NAT apparatus based on two STUN server inquiry results
US8788682B2 (en) Communication device, and method, in an internet protocol network, of controlling a communication device
JPWO2006051594A1 (ja) 通信ネットワークにおけるｉｐパケット中継方法およびゲートウエイ装置
US20100040057A1 (en) Communication method
US20160112372A1 (en) Dynamic tunnel for real time data communication
WO2012174927A1 (zh) 一种视频监控系统及媒体穿越网络地址转换设备的方法
WO2010025676A1 (zh) 实现流媒体通信的方法、装置及系统
WO2015180570A1 (zh) 数据通道建立方法和通信设备
WO2015096302A1 (zh) 基于sip媒体能力重协商的nat穿越方法、代理服务器和系统
WO2018050116A9 (zh) 一种视频会议系统中端口复用方法和服务器和计算机存储介质
WO2012000364A1 (zh) 实现会议电视系统跨网段信令互通的方法及系统
WO2009082908A1 (fr) Procédé, dispositif et système de traitement d'un protocole de flux en temps réel
US8428074B2 (en) Back-to back H.323 proxy gatekeeper
WO2006000141A1 (fr) Systeme de securite du reseau multimedia et procede correspondant

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KM KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NG NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SM SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): BW GH GM KE LS MW MZ NA SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LT LU MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
NENP Non-entry into the national phase

Ref country code: DE

WWW Wipo information: withdrawn in national office

Country of ref document: DE

122 Ep: pct application non-entry in european phase