BACKGROUND OF THE INVENTION

[0002] The Internet may be used for many forms of communication, including voice conversations, video conferencing, development collaboration, and the like. In order for a manufacturers' programs, applications, equipment, and systems to be interoperable with each other, many protocols have been developed to standardize the communication between such systems. These protocols have grown increasingly complex to handle all the types of traffic generated to facilitate communication for video conferencing, voice over Internet Protocol (VoIP), and data over Internet Protocol applications. Two such protocols are H.323 from the International Telecommunication Union - Telecommunication Standardization Sector (ITU-T) and the Session Initiation Protocol (SIP) from the Internet Engineering Task Force (IETF). Both H.323 and SIP, as well as Skype, Inter- Asterisk eXchange (IAX), and many other similar protocols, typically allow for multimedia communication including voice, video, and data communications in real-time.

[0003] H.323, SIP, VoIP, and the like are defined as application layer protocols of the Open Systems Interconnection (OSI) seven layer model. The layers of the OSI model include, from bottom to top, the physical, data link, network, transport, session, presentation, and application layers. Application layer protocols facilitate communication between software applications of devices providing a high level of abstraction from the details of sending information across a network, which are present at the lower layers of the OSI model. Examples of some commonly-used Application layer protocols include HyperText Transfer Protocol (HTTP), HTTP Secure (HTTPS), Simple Mail Transfer Protocol (SMTP), File Transfer Protocol (FTP), TELNET, Post Office Protocol version 3 (POP3), and Internet Message Access Protocol (IMAP).

[0004] In Internet Protocol (IP) communication networks, devices or endpoints on the network are usually identified by their respective IP address. Applications and programs on the different devices further identify each other using port numbers. A port number is a sixteen bit integer, the value of which falls into one of three ranges: the well-known ports, ranging from 0 through 1023; the registered ports, ranging from 1024 through 49151; and the dynamic and/or private ports, ranging from 49152 through 65535. The well-known ports are reserved for assignment by the Internet

Corporation for Assigned Names and Numbers (ICANN) for use by applications that communicate using the Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) and generally can only be used by a system/root process or by a program run by a privileged user. The registered ports may be registered for use by companies or other individuals for use by applications that communicate using TCP or UDP. The dynamic or private ports, by definition, cannot be officially registered nor are they assigned. Both the H.323 and SIP standards, as well as many other such communication protocols, use multiple, well-known, registered, and/or dynamic ports in order to facilitate such communication.

[0005] H.323 and SIP each rely on multiple other protocols, some of which may in turn rely on UDP for sending and receiving multimedia traffic. UDP features minimal overhead compared to other transport protocols (most notably TCP) at the expense of having less reliability. UDP does not provide for guaranteed packet delivery nor data integrity. However, UDP does offer the highest possible throughput, thus, making it ideally suited for multimedia real-time communications.

[0006] Multimedia communications traffic will most likely encounter a firewall at some point during transmission, especially over the Internet, without regard to which protocol the traffic conforms. Firewalls are used in modern networks to screen out unwanted or malicious traffic. One of many techniques a firewall may use is packet filtering, wherein the firewall determines whether or not to allow individual packets by analyzing information in the packet header (such as the IP address and port of the source and destination). Thus, various ports or IP addresses may be blocked to minimize the risk of allowing malicious traffic into an important computer network or system. Another more advanced technique is called stateful inspection, wherein in addition to analyzing header information, a firewall keeps track of the status of any connection opened by network devices behind the firewall. Deciding whether or not a packet is dropped in a stateful inspection is based on the tracked status of the connection and information from within the packet header, hi practice, firewalls (especially those used by large corporations) generally only allow traffic from the well-known ports, though such firewalls may be specially configured to allow traffic on any port. For multimedia communication systems that use multiple registered and dynamic ports, firewalls (unless

specially configured) will generally block the data traffic on these ports between multimedia systems, thus, preventing communication.

[0007] Video conferencing endpoints generally use multiple dynamic ports for the transmission of communication data packets and, as such, each port used necessitates opening that port on a firewall. Additionally, different endpoints participating in different conversations use different sets of ports, further increasing the number of ports to be opened on a firewall. Reconfiguring ports on a firewall is a time consuming task that introduces the risk of human error, which may defeat the purpose of the firewall by leaving a network vulnerable to malicious attacks. Furthermore, even though these dynamic ports should be closed after the communication ends, in practice, once a firewall port is open, it remains open because the firewall technicians typically do not expend the additional time resources to close the ports.

[0008] Li addition to firewalls, most large networks also typically deploy proxy servers that are used for many reasons, including reducing the number IP addresses that a computer network exposes to external networks and/or the Internet and monitoring the traffic sent between internal and external networks, hi order to connect to an external resource or the Internet, an internal computer of a network often times connects to a proxy server, the proxy server then connects to the external resource, and data sent between the internal computer and external resource is sent through the proxy. As such, the external resource is aware of only the proxy server's IP address and not the internal computer's IP address. Thus, by having the internal computer connect to the proxy server in lieu of directly connecting to the external resource, proxy servers may also be used to monitor and in some cases prevent the flow of traffic between internal computers and external resources. As an example, a computer attempting to connect to an unauthorized external resource (e.g., an illicit website, an external computer that is not secure, or the like) may be refused a connection by the proxy server or a connection may be terminated if the traffic between the internal computer and external resource contains unauthorized data or does not conform to an authorized protocol.

[0009] The proxy server may also be used to authenticate the communication from the endpoints with the internal network. If an unknown endpoint attempts to obtain access to the external network through the proxy server, the proxy

server will prevent that access if the endpoint fails the authentication. Many different authentication protocols are typically used by various proxy servers. Examples of such authentication protocols are base64 encoding, Microsoft Corporation's NT LAN MANAGER™ (NTLM™), INTEGRATED WINDOWS AUTHENTICATION™ (IWA™), and the like.

[0010] Each Application layer protocol has its own specification for the proper exchange of messages that allow access to resources between network devices or endpoints. Network devices and endpoints conform to this specification to both properly interoperate with each other and to successfully traverse a proxy server. Protocol violations by network devices or endpoints may be treated by a proxy server as a security threat and thus, run the risk of a proxy server terminating a connection, thwarting communication between network devices. As an example, a proxy server may be monitoring a connection wherein a malicious website sends malformed HTTP traffic in an attempt to exploit a weakness of an internal computer. Upon finding such malformed HTTP traffic, the proxy server may terminate the connection to stop the attack on the internal computer.

[0011] Many proxy servers are HTTP proxy servers that provide Internet connections for computers within a network. Typically, proxy servers operate in a standard mode that may only allow traffic conforming to commonly-used protocols (e.g., HTTP, FTP, and the like). Multimedia protocols, such as H.323, SIP, VoIP, and the like, which are themselves not commonly-used protocols and also rely on other protocols that are not commonly-used may be blocked or simply ignored as incompatible data streams. As an example, in the case where an H.323 endpoint is behind an HTTP proxy server, the H.323 connection requests may be denied or ignored while another device's HTTP connection requests are allowed.

[0012] Existing video conferencing systems such as TANDBERG' s BORDER CONTROLLER™, a component of TANDBERG's EXPRESSWAY™ firewall traversal solution, requires the use of TANDBERG Gatekeepers or TANDBERG traversal enabled endpoints. While allowing firewall traversal, the EXPRESSWAY™ solution still requires either proprietary proxy servers or standard proxy servers to be reconfigured to trust, allow, or even understand the protocols used. The V2IU™ series

of products from Polycom, Inc., are Application Level Gateways (ALG) that act as protocol-aware firewalls that automate the selection and trusting of ports, but as such, require either standard proxy servers to be reconfigured to trust, allow, or understand the protocols used when sending traffic between endpoints or to bypass altogether the standard proxy servers of a network. Further, such an ALG does not provide for secure communication. The PATHFINDER™ series of products from RadVision, Ltd., provides for firewall traversal via multiplexing to a single port, but still requires standard proxy servers to be either bypassed or reconfigured to trust and allow the traffic sent between endpoints.

[0013] Similar systems have been implemented for voice, VoIP, and data over IP communication systems. Each either relies on a proprietary system or equipment or relies on standard proxy servers being reconfigured to trust, allow, or understand the traffic sent between endpoints, which could leave the underlying network vulnerable to malicious electronic attacks.

BRIEF SUMMARY OF THE INVENTION

[0014] The various representative embodiments of the present invention are directed to systems and methods for transporting multimedia protocol traffic using a commonly-used protocol that is known to be typically compatible with standard proxy servers. Multimedia protocol traffic from a first endpoint is received and then transmitted using a commonly-used protocol. The received commonly-used protocol traffic is then transmitted using the original multimedia protocol to a targeted second endpoint. hi using the commonly-used protocol, the traffic may operate with a proxy server, such that little or no reconfiguration of the proxy server is required, hi so doing, the risk of human error leaving a network vulnerable to malicious attacks is reduced. Moreover, instead of creating an unrecognizable data stream, which may still be rejected by more-advanced proxy servers, the various embodiments of the present invention actually creates a data stream that conforms to a known, commonly-used communication protocol.

[0015] The foregoing has outlined rather broadly the features and technical advantages of the present invention in order that the detailed description of the invention that follows may be better understood. Additional features and advantages of the invention will be described hereinafter which form the subject of the claims of the invention. It should be appreciated by those skilled in the art that the conception and specific embodiment disclosed may be readily utilized as a basis for modifying or designing other structures for carrying out the same purposes of the present invention. It should also be realized by those skilled in the art that such equivalent constructions do not depart from the spirit and scope of the invention as set forth in the appended claims. The novel features which are believed to be characteristic of the invention, both as to its organization and method of operation, together with further objects and advantages will be better understood from the following description when considered in connection with the accompanying figures. It is to be expressly understood, however, that each of the figures is provided for the purpose of illustration and description only and is not intended as a definition of the limits of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS

[0016] For a more complete understanding of the present invention, reference is now made to the following descriptions taken in conjunction with the accompanying drawing, in which:

[0017] FIGURE 1 is a diagram illustrating example protocols used between devices on a network according to one embodiment of the present invention; and

[0018] FIGURE 2 is a flowchart illustrating example steps that may be employed by conversion devices to communicate with a proxy server in a communication system configured according to one embodiment of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

[0019] A variety of protocols may be used to transmit multimedia traffic between endpoints of a network. Whether the traffic is data between applications, voice communications, or video conferencing, whenever multimedia traffic is used there is a possibility that the traffic or connection between devices will be refused by a proxy server between the devices. As an example, video conferencing systems, whether they are based on H.323, SIP, Skype, IAX, or other similar multimedia communication protocols, use multiple protocols and sub-protocols in order to enable two-way audio and video communication. The communication protocols specify different types of traffic that may be sent between endpoints which include media traffic (voice, video, and the like) along with the control traffic (camera, connection control, and the like). The media traffic comprises data for the images and sound being transmitted between endpoints with the control traffic comprising data used to control the connection between endpoints and the features of the endpoint (e.g., camera direction, zoom, and the like). When two video conferencing systems attempt to establish a connection, a proxy server may refuse to allow the connection as the devices may use unrecognized or unauthorized protocols.

[0020] FIGURE 1 is a diagram illustrating example protocols used between devices on a network according to one embodiment of the present invention. Endpoints 100/101/102 each establish a separate connection with device 103, with each endpoint using its own respective multimedia protocol (100 using H.323, 101 using SIP, and 102 using VoIP). It is noted that while the endpoints of FIGURE 1 are depicted as video conferencing systems (100/101/107/108) using either H.323 or SIP, and VoIP phones (102/109) using VoIP, any network equipment that communicates using a multimedia protocol, such as H.323, SIP, VoIP, Skype, IAX, or the like, may be used. Further examples of such equipment include H.323 gateways, SIP proxies, and the like.

[0021] Upon the creation of the connections with endpoints 100/101/102, device 103 establishes a connection with device 106 by first connecting to proxy server 104 using a commonly-used protocol, such as HTTP. It is noted that alternative embodiments may use other commonly-used protocols that are typically recognized and authorized by proxy servers including, but not limited to: HTTP, HTTPS, FTP, POP3, SMTP, MAP, and the like. Further, while FIGURE 1 illustrates device 103 using a

single connection to proxy 104, alternative embodiments may use any number of connections between device 103 and proxy server 104. As an example, for each endpoint that connects to device 103, a separate connection maybe established with proxy server 104, such that the traffic of each endpoint is transmitted using separate connections.

[0022] Proxy server 104 recognizes the protocol used by device 103 as a valid and authorized protocol and authenticates the communication from device 103 if necessary. Proxy server 104 may use any type of authentication protocol, such as NTLM™, IW A™, base65 encoding, or the like. Once proxy server 104 authenticates the communication, it establishes a connection with device 106 through Internet 105. In the case where HTTP is the protocol used, the connection between devices 103 and 106 may appear to proxy server 104 as a typical web browser attempting to connect to a website. Thus, proxy server 104, operating in a standard mode will facilitate and allow the connection to be made.

[0023] In alternative or additional embodiments of the invention the proxy server may require authentication from the device attempting to establish the connection. The information for this authentication may be from device 103 or be based on identification information from an endpoint connected to device 103. Such identification information may also incorporated into the data sent from the endpoints of a system.

[0024] Device 106 then establishes connections with endpoints 107/108/109 using the appropriate multimedia protocols (107 using H.323, 108 using SIP, and 109 using VoIP) completing the connections between endpoints 100/101/102 and 107/108/109, respectively. In alternative embodiments, device 106 may require device 103 to verify the connection attempt as an authorized request before establishing the connections with endpoints 107/108/109.

[0025] After all of the connections have been established, endpoints 100/101/102 may begin sending packets of multimedia data to device 103 using their respective protocols. Endpoints 100/101/102/107/108/109 are not aware of devices 103/106 nor proxy server 104 or how the connection was made, and may operate as if the connections were made directly.

[0026] Device 103 converts the protocol of the packets received from endpoints 100/101/102 to the protocol used to connect to proxy server 104 and then forwards the converted packets to proxy server 104. One method of converting is described in co-pending, commonly assigned, U.S. Patent Application No. 11/403,549, titled "SYSTEM AND METHOD FOR TRAVERSING A FIREWALL WITH MULTIMEDIA COMMUNICATION," the disclosure of which is incorporated by reference herein. Devices 103 and 106 follow the specification of the commonly-used protocol, and, as such, they generate messages and resource requests, such that the multimedia protocol data (including the messages and resource requests required by the multimedia protocol) will conform to the commonly-used protocol when passing through proxy server 104. Further, these messages and resource requests may be used to identify multimedia data being sent between devices 103/106 or to cause one of devices 103/106 to initiate further messages or resource requests. As an example when using HTTP, devices 103 and 106 may use specially formed resource requests that may identify any of the following: the type of multimedia protocol being used; the target endpoint; that a new endpoint is requesting a new connection; or the like.

[0027] Proxy server 104 recognizes the packets as valid, authorized, and properly requested packets conforming to a commonly-used protocol and forwards the packets to device 106. Proxy server 104 may maintain the status of all open connections and verify that the transfer of resources using those connections accords with the protocols used by the connections. As an example when HTTP is used, data may not be transferred unless requested, as such, devices 103 and 106 may continuously generate resource requests so that the multimedia data may be continuously transmitted across Internet 105.

[0028] Device 106 decapsulates the received packets, restoring the original multimedia protocol of the packets. In so doing, the packets may then be forwarded on to their target endpoint. Thus, each of endpoints 100, 101, and 102 has an established connection and may communicate with endpoints 107, 108, and 109 respectively through proxy 104 via network devices 103 and 106.

[0029] In alternative or additional embodiments, devices 103 and 106 may also qualify their incoming traffic in order to securely pass traffic associated with the

connection between endpoints 100/101/102 and 107/108/109. One method of qualifying is described in co-pending, commonly assigned, U.S. Patent Application No. 11/403,549, titled "SYSTEM AND METHOD FOR TRAVERSING A FIREWALL WITH MULTIMEDIA COMMUNICATION."

[0030] FIGURE 2 is a flowchart illustrating example steps 20 that may be employed by conversion devices, such as devices 103 and 106, to communicate with a proxy server in a communication system configured according to one embodiment of the present invention. An endpoint, when connected to a network, first registers with a conversion device by the endpoint identifying itself as a compliant endpoint (e.g., it is an endpoint that conforms to H.323, SIP, VoIP, or the like), as shown by step 201.

[0031] On a given network, multiple devices may be connected and as such, the conversion device receives traffic from many devices within that network. Thus, the conversion device qualifies the traffic it receives to ensure that the traffic sent to the destination conversion device is appropriate traffic. This is shown in step 202 and may be accomplished by comparing a given packet's source IP and port addresses to those of endpoints that have registered with the local conversion device. In step 203, the local conversion device encrypts the previously qualified traffic securing the communication between two endpoints using any suitable encryption method including, but not limited to: AES 128-bit, TDES, Skipjack, or the like, hi step 204, the encrypted traffic is then encapsulated to conform to a commonly-used protocol, such as HTTPS, by placing the previously encrypted packet into a new packet conforming to HTTPS. As shown by step 205, the encapsulated traffic is then forwarded to the destination conversion device.

[0032] In step 206, the proxy server receives the forwarded traffic from the local conversion device. In step 207, the proxy server recognizes that the traffic conforms to a commonly-used protocol and authenticates the traffic for transmission to the destination conversion device. Step 208 has the proxy server forwarding the authorized traffic to the destination conversion device.

[0033] In step 209, the destination conversion device receives the commonly-used protocol traffic from the proxy server, which is decapsulated by step 210

restoring the original multimedia protocol of the packets. In step 211, this decapsulated traffic is then decrypted, thus, recovering the original multimedia and control communication information within the packets. With the packets being fully restored, they are then forwarded to the destination endpoint by the destination conversion device, as shown by step 212.

[0034] It is noted that while the disclosure has used the communication between video conference and VoIP phone endpoints as an example, it is understood that the systems and methods described may be used by other programs, applications, communications systems, and the like, that use multimedia protocols for communication. As such, embodiments of the invention may be used for audio systems VoIP systems, or any other system that uses a multimedia protocol to transfer data between devices. The same holds true for other types of programs, equipment, or applications using a multimedia protocol to transfer data across a network.

[0035] While each of the conversion devices, such as devices 103 and 106 (FIG. 1), is depicted connected to two video conferencing systems and a VoIP phone, they may be connected to a single or multiple and various video conference or phone systems, audio conference or phone systems, data collaboration systems, or the like. When multiple video, audio, or data collaboration systems are connected to a device, such as device 103, any connections or calls that do not require traversing a proxy server may, accordingly, not be transmitted across a network using a commonly-used communication protocol. As an example, if two video conference endpoints are on the same network behind a proxy server and are engaging in communications, this traffic may not pass through a proxy server (the traffic is only transmitted on the internal network). Thus, the conversion device may recognize this situation and, accordingly, not encapsulate nor encrypt the traffic between two such endpoints.

[0036] Additionally, a conversion device need not be a stand-alone device as its functionality may be integrated into any other network device including, but not limited to: video conference or phone systems, audio conference or phone systems, data collaboration systems, or the like. Alternative embodiments may also send traffic between endpoints 10 and 15 that conform to any number of standards or protocols for multimedia communication including, but not limited to the H.323, SIP, or VoIP

protocols by converting the multimedia communication protocols into a commonly-used protocol that is typically allowed by most proxy servers.

[0037] Although the present invention and its advantages have been described in detail, it should be understood that various changes, substitutions and alterations can be made herein without departing from the spirit and scope of the invention as defined by the appended claims. Moreover, the scope of the present application is not intended to be limited to the particular embodiments of the process, machine, manufacture, composition of matter, means, methods and steps described in the specification. As one of ordinary skill in the art will readily appreciate from the disclosure of the present invention, processes, machines, manufacture, compositions of matter, means, methods, or steps, presently existing or later to be developed that perform substantially the same function or achieve substantially the same result as the corresponding embodiments described herein may be utilized according to the present invention. Accordingly, the appended claims are intended to include within their scope such processes, machines, manufacture, compositions of matter, means, methods, or steps.