KR20050001125A - system, method and medium for providing VoIP service in Firewall/NAT - Google Patents

Abstract

The present invention relates to a method and system for providing VoIP service even in a firewall / NAT scheme.

The system according to the configuration of the present invention includes a media relay server that manages a terminal inside a firewall / NAT, relays a request for a terminal, relays messages and media, and assigns a public IP / port to the agent. do. The agent receives a public IP / port according to a registration request and a call request of the terminal, performs a call connection, and directly sends outbound media to the gateway. The media relay server relays inbound media from the gatekeeper to the agent using the inbound RTP and RTCP channels.

According to the configuration of the present invention, a two-way VoIP service can be provided even in a firewall / NAT environment with a simple configuration without changing the configuration of the firewall / NAT.

Description

System, method and medium for providing VoIP service in Firewall / NAT}

The present invention relates to a method, a system, and a recording medium having the same, which can use an internet-based video / audio terminal even under a firewall and a NAT (Network Address Translation) environment. More specifically, the present invention relates to a method, a system for supporting voice / video communication using the Internet without changing the environment of a firewall and NAT, and software of a user terminal, and a recording medium having the same.

Voice over IP (VoIP) is a term that refers to IP telephony technology for a set of facilities that deliver voice information using the Internet Protocol (IP). In general, this means that voice information is sent in digital form in discrete packets, rather than traditional protocols based on circuits such as PSTN, a public switched telephone network. The main advantage of VoIP and Internet telephony technology is that it integrates telephone service by utilizing existing IP network so that telephone users can receive long distance and international phone service in internet and intranet environment with only local call charge.

VoIP encourages the use of ITU-T H.323, a standard for transporting voice and video over IP over the public Internet or on an intranet within an enterprise. Through VoIP forums, Cisco, Vocaltech, 3Com, and NetSpeak It was done by the equipment manufacturers.

However, the firewall or NAT (Network Address Translation) adopted by most companies makes it difficult to use VoIP applications that use protocols including H.323. Firewalls block IP voice and video traffic by placing a barrier on all incoming incoming unsolicited communication packets. Since NAT has a private IP, IP voice / video terminals within its control cannot be routed to other domains or the public Internet, thereby blocking IP traffic.

Accordingly, there have been various attempts to provide VoIP services even under firewalls and NAT environments applied to many enterprises due to these problems.

One such prior art has a scheme of supporting an application level gateway (ALG) directly in a firewall or NAT. However, because of the complexity of the VoIP protocol itself and various application scenarios, it is not easy to support such a solution, and it can be a bottleneck due to excessive overload in firewalls and NATs. In addition, the application of such a solution may be an additional burden for a company that wants to receive additional VoIP service while using an existing firewall and NAT, and thus it is not adopted as a preferred approach from the enterprise side. The problem is that products do not provide complete protocols and solutions.

Next, the conventional technology to be considered is a method under development of IETF's MIDCOM, which is a method of using a protocol for controlling a firewall and NAT from the outside. However, this method also presupposes a change in the firewall or NAT, similar to the method described above, and separates the ALG function from the firewall and NAT only to solve the problem of the first method. Protocol to control firewall and NAT to open and close required ports or create and destroy address bindings. This method can use various existing VoIP platforms and terminals without modification, but it is expected to take considerable time before they can be practically applied due to the upgrade problem and standardization of firewall and NAT.

Another prior art is the firewall traversal method under discussion in the IETF. This is a way to securely pass through the firewall through changes in the VoIP terminal and the VoIP platform rather than the firewall or NAT itself. Typical applications of protocols and solutions such as STUN (Simple Traversal of UDP Through NAT) and TURN (Traversal Using Relay NAT) are typical. It can be said. In practice, this method can be provided with VoIP service without changing existing firewall and NAT, but it is limited to apply uniformly to all companies adopting various firewall / NAT environments and security policies. This has a problem that arises. In addition, the above-described technology of STUN has a problem of not supporting symmetric NAT and a problem of not supporting RTCP, and TURN has a problem that requires a heavy load on the media relay server.

The present invention provides a method for supporting a VoIP service under a firewall / NAT environment to reduce the load of the media relay server while supporting a symmetric NAT environment, to solve the above problems. In addition, the present invention provides a server-agent implementation method for effectively providing two-way VoIP service to a large number of users in a private network through a single TCP connection without software change of the user terminal.

1 is a schematic diagram illustrating a system for providing two-way VoIP in a firewall / NAT environment, in accordance with an embodiment of the invention.

2 is a flowchart illustrating a method for providing VoIP service in a firewall / NAT environment according to an embodiment of the present invention.

3 is a signal flow diagram illustrating a signal flow of an initial configuration of a VoIP service according to an embodiment of the present invention.

4 is a signal flow diagram illustrating a signal flow of an outbound VoIP service according to an embodiment of the present invention.

5 is a signal flow diagram illustrating a signal flow of an inbound VoIP service according to an embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention.

In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention. Like parts are designated by like reference numerals throughout the specification.

Now, a VoIP service providing method according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a schematic diagram illustrating a system for providing two-way VoIP in a firewall / NAT environment, in accordance with an embodiment of the invention.

As shown in FIG. 1, the system according to an embodiment of the present invention includes a terminal 100 for performing VoIP communication, an agent 200, a firewall / NAT 300, a media relay server 400, and a VoIP. The gatekeeper 500 and the VoIP gateway 600.

The plurality of terminals 100 have a private IP address and are equipped with a standard VoIP protocol and may be an IP phone or a PC-based soft phone on the user side. The agent 200 manages a plurality of terminals attempting to register using the VoIP protocol in the firewall / NAT and routes signals and media performed by the VoIP protocol to terminals managed by the agent 200. In addition, the device interprets the message of the terminal attempting the call and replaces the private IP address and port existing in the message with the public address and port assigned by the request to the media relay server 400 upon registration of the terminal to the VoIP gatekeeper. It serves to convey. The firewall / NAT 200 is a device installed inside an enterprise and may be configured in various forms according to a security policy and a network situation of an enterprise.

The media relay server 400 is a device located in the VoIP service provider's network and operates in the manner of an agent and a client server located inside the enterprise, and must have at least one TCP connection for communication. In addition, this device allocates the public IP address and port requested by the agent, and relays to the agent by receiving incoming signals and media from its own gateways and terminals as its assigned IP address and port. do.

The VoIP gatekeeper 500 and the VoIP gateway 600 manage the subscribers in addition to the functions of interpreting and processing VoIP protocols and interworking with the PSTN as core devices established by operators to provide VoIP services. It plays various roles, such as the ability to create a call detail record (CDR) for billing.

2 is a flowchart illustrating a method for providing VoIP service in a firewall / NAT environment according to an embodiment of the present invention.

In order to receive the VoIP service from the terminal in the firewall / NAT environment, an initial setting is performed between the agent 200 and the media relay server 400. One TCP channel is connected for initial configuration between the agent 200 and the media relay server 400, and a remote access control server (RAS) and a public IP for signaling are allocated to the agent 200.

When the setting between the agent and the media relay server is completed, the terminal 100 is registered with the gatekeeper 600 (S20). The terminal that wants to register transmits a registration request message to the agent 200, and the agent registers the terminal to the VoIP gatekeeper 600 on behalf of the registration request.

When the initial setting and the terminal registration is completed, in step S30, the terminal 100 can make a call or receive an incoming request from the terminal from the outside. When the terminal 100 attempts a call or receives a setup message for an incoming call (S31, S32). To make a call, you need a public IP for RTP and RTCP.

Therefore, the agent 200 is assigned to request the public IP for RTP, RTCP to the media relay server 400 (S40).

When the public IP for RTP and RTCP is allocated, the agent 200 attempts to connect to the call via the media relay server 400 and receives a connection message to make a call (S50).

When the call is connected, outbound media from the terminal 100 is transmitted directly to the counterpart without passing through the media relay server, and establishes an RTP and RTCP channel for processing inbound media from the counterpart (S60). ). The media relay server 400 is relayed to the agent 200 is the inbound media (S70).

As described above, the VoIP service method according to the embodiment of the present invention does not require overall modification of the terminal or the firewall / NAT environment, and can be easily implemented by adding an agent of a relatively simple device or program. In addition, since the outbound message does not go through the media relay server, media traffic of the media relay server can be reduced.

3 is a signal flow diagram illustrating a signal flow of initial setting and terminal registration of a VoIP service according to an embodiment of the present invention.

Step S101 is a process for the agent 200 to connect the TCP with the media relay server 400. In step S102, the agent 200 requests the media relay server 400 to request a public IP / Port for RAS and signaling. In addition, step S103 is a step in which the media relay server 400 allocates a public IP / Port for RAS and signaling to be received and relayed by the media relay server 400. All of the above processes must be performed during the initial setting of the agent 200.

Step S104 is a step in which the terminal 100 requests registration, in this case, the agent 200 analyzes a registration request (RRQ) message from the terminal and receives a signaling IP assigned a private IP / Port in the message. The registration request is performed to the VoIP gatekeeper 500 by changing to / Port (S105). In this case, the transport layer uses UDP as in normal VoIP. Step S106 is a process in which the VoIP gatekeeper 600 performs a response to the agent's registration request via the RAS port assigned to the media relay server 500. The agent performs the IP / IP inside the message as in step S105. Transmit the response to the registered terminal by changing the port to private.

The terminal registration process should be performed during the initial setup process of the terminal, and the case where the terminal intends to attempt a call will be described in detail below.

4 is a flowchart illustrating a signal flow in an outbound VoIP service according to an embodiment of the present invention.

When the above-described initial setting process is completed, the terminal 100 is in a state capable of performing an outgoing call and attempts to make a call to the agent 200 (S110). When the terminal 100 attempts to make a call, the agent 200 requests a public IP / Port for receiving the RTP and the RTCP from the media relay server 204 (S111).

Thereafter, the media relay server allocates a public IP / Port for RTP and RTCP to receive and transmit itself (S112). Agent 200 attempts to call by changing the RTP, IP / Port for RTCP in the configuration message to the authorized IP / Port assigned (S113). In this case, it is preferable that the VoIP protocol supports fast connet and tunneling.

Step S114 is a process in which the VoIP gateway 600 delivers a Connect message. The message includes a public IP / Port for RTP and RTCP.

Agent 200 transmits outbound media to VoIP gateway 206 as a destination (S115). In this case, since the delivered media does not go through the media relay server 500, the media load of the media relay server can be reduced by half.

Next, the agent performs a UDP connection for establishing an inbound RTP and RTCP channel with the media relay server 400 (S116). Through this, the media for inbound is delivered to the agent through the UDP connection established through the public IP / Port for RTP and RTCP of the media relay server, and the agent communicates by relaying the media to the terminal managed by the agent ( S117).

5 is a signal flow diagram illustrating a signal flow of an inbound VoIP service according to an embodiment of the present invention.

When the initial setting and terminal registration shown in Figure 3 is completed, the terminal is in a state capable of receiving a call from the outside.

In step S120, a Setup message is received from the VoIP gateway 600 and the VoIP gatekeeper 500 through the pre-assigned signaling IP / Port. The configuration message is transmitted to the terminal 100 via the agent 200. Steps S121 and S122 indicate a procedure of requesting and assigning an authorized IP / Port to the media relay server 400 to receive RTP and RTCP.

Step S123 represents a connection message processing procedure for the configuration message received by step 120. In this case, the agent is a public IP / Port to which a private IP / Port for RTP and RTCP in the message is allocated. It converts to and delivers.

In step S124, the agent may transmit an outbound from the terminal 100. In step S125, the agent establishes an inbound RTP and RTCP channel to perform a UDP connection. Thereafter, the inbound media is transmitted to the agent 200 through the relay of the media relay server 400.

As described above, an embodiment of the present invention provides an inbound and outbound VoIP service for a plurality of terminals through a single TCP connection by installing an agent inside the firewall / NAT and having a media relay server in the VoIP provider network. Can provide.

In addition, according to an embodiment of the present invention, the media relay server greatly reduces the load of traffic flowing into the media relay server by simplifying only the function of allocating an IP / Port requested by an agent and relaying only to inbound media. It becomes possible.

In addition, the agent manages the terminals inside the firewall / NAT, and can simplify the application by simplifying only the functions for routing incoming media and routing media.

Although the preferred embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

According to the configuration of the present invention described above, in order to provide a two-way VoIP service in the firewall / NAT environment, it is not necessary to consider the firewall / NAT environment, the problem that needs to open a plurality of TCP ports and the problem that needs to modify the terminal, etc. Can be solved at the same time.

In addition, it has the effect of providing two-way VoIP service to enterprises in a firewall / NAT environment while minimizing the function and load of an agent installed in an enterprise and a media relay server installed in an operator network.

Therefore, the user side can use the two-way VoIP service with a low cost and simple procedure while attaining the purpose of the security policy to the maximum, and the operator can overcome the limitations of the service and expect the effect of the service activation and profit generation.

Claims (8)

In the method of providing VoIP service in firewall / NAT environment: Registering, by an agent installed in the firewall / NAT, a public IP / port for signaling from a media relay server in the service provider network by a registration request of a terminal, and registering with the VoIP gatekeeper; Receiving, by the agent, a public IP / port for RTP or RTCP from the media relay server at the request of an Internet telephone terminal and transmitting the same to the VoIP gatekeeper; The agent sending outbound media from a terminal directly to a VoIP gateway; Establishing, by the agent, a channel for RTP or RTCP with the media relay server to receive inbound media; And The media relay server relaying inbound media from the VoIP gateway to the agent using the RTP or RTCP channel. The VoIP service method according to claim 1, further comprising an agent performing a TCP connection with a media relay server in order to be allocated the public IP / port for signaling. The method of claim 2, The agent further comprises the step of attempting to connect to the VoIP gateway via the media relay server using the public IP / port for the RTP and RTCP. The method of claim 2, And the agent receiving a message from a VoIP gate keeper using the public IP / port for signaling. In a system that provides VoIP services in a firewall / NAT environment: A VoIP gatekeeper for interpreting and processing the VoIP protocol; A VoIP gateway for interworking a VoIP service network with an external network; An agent that manages a plurality of terminals in the firewall / NAT and performs communication with the media relay server; A media relay server for relaying messages or media in the VoIP service network and assigning a public IP to the agent; The agent receives a public IP / port for the private IP / port of the terminal from the media relay server and provides a VoIP service for directly transmitting outbound media from the terminal to the VoIP gateway using the public IP / port. system. The method of claim 5, wherein The public IP / port is a VoIP service providing system including a public IP / port for signaling and a public IP / port for RTP or RTCP. The method of claim 6, The media relay server is a VoIP providing system for relaying inbound media to the agent using the public IP / port for the public RTP or RTCP. In a recording medium capable of a computer in which a program providing a VoIP service in a firewall / NAT environment is recorded: An agent installed in the firewall / NAT is configured to register with the VoIP gatekeeper by receiving a public IP / port for signaling from a media relay server in the service provider network by a registration request of a terminal; A function of the agent receiving a public IP / port for RTP or RTCP from the media relay server at the request of an Internet telephone terminal and transmitting it to a VoIP gatekeeper; The agent directly sends outbound media from the terminal to the VoIP gateway; The agent establishes a channel for RTP or RTCP with the media relay server to receive inbound media; And And a function of the media relay server relaying inbound media from the VoIP gateway to the agent using the RTP or RTCP channel.