Routing voip calls through multiple security zones

Abstract

Call setup signaling is performed across at least a first security zone, a second security zone, and a third security zone to set up a call. At least one gate is then established between the first security zone and the third security zone to enable traffic flow for the call between the first security zone and the third security zone.

1 - 23 . (canceled) 
     
     
         24 . A non-transitory computer-readable medium storing instructions, the instructions comprising:
 one or more instructions which, when executed by one or more processors of a first network device, cause the one or more processors to:
 receive a call invitation message for establishing a call from a first user device included in a first security zone, 
 establish, based on the call invitation message and between the first security zone and a second security zone, a first discrete pinhole for signaling packets associated with the call and a second discrete pinhole for media packets associated with the call, 
 forward, based on establishing the first discrete pinhole and the second discrete pinhole, the call invitation message to a second network device in the second security zone, 
 receive, from the second network device, a processed call invitation message, 
 associate the processed call invitation message with the call invitation message, 
 close, based on associating the processed call invitation message with the call invitation message, the second discrete pinhole, 
 establish, based on closing the second discrete pinhole and between the first security zone and a third security zone, a third discrete pinhole and a fourth discrete pinhole, 
 the third discrete pinhole permitting media messages associated with the call to be transmitted, via the first network device, directly between the first security zone and the third security zone, and the fourth discrete pinhole pointing to the second network device to direct signaling messages associated with the call to the second network device, and 
 establish, based on creating the third discrete pinhole and the fourth discrete pinhole, the call between the first user device and a second user device included in the third security zone. 
   
     
     
         25 . The non-transitory computer-readable medium of  claim 24 , further comprising:
 one or more instructions to:
 identify, based on information included in a header of the processed call invitation message, an identifier associated with the processed call invitation message, and 
 determine whether to associate the processed call invitation message with the call invitation message based on the identifier associated with the processed call invitation message. 
   
     
     
         26 . The non-transitory computer-readable medium of  claim 25 , further comprising:
 one or more instructions to determine whether the identifier associated with the processed call invitation message matches an identifier included in a header of the call invitation message.   
     
     
         27 . The non-transitory computer-readable medium of  claim 24 , where the one or more instructions to establish the call include:
 one or more instructions to:
 generate, based on address information included in the processed call invitation message, a modified message, 
 forward the modified message to the second user device, 
 receive, via the fourth discrete pinhole and based on forwarding the modified message, a response message from the second user device, and 
 direct, based on receiving the response via the fourth discrete pinhole, the response to the second network device via the first discrete pinhole. 
   
     
     
         28 . The non-transitory computer-readable medium of  claim 24 , where the one or more instructions to receive the processed call invitation include:
 one or more instructions to receive the processed call invitation via the first discrete pinhole.   
     
     
         29 . The non-transitory computer-readable medium of  claim 24 , where the first security zone is associated with a trusted network and the second security zone is associated with an untrusted network. 
     
     
         30 . The non-transitory computer-readable medium of  claim 24 , where the call comprises a Voice over Internet Protocol session. 
     
     
         31 . A network device comprising:
 a processor to:
 receive, from a first device included in a first security zone, a first message for establishing a voice over Internet Protocol (VoIP) session between the first device and a second device included in a second security zone, 
 open, based on the first message:
 a first gate for transmitting a first type of data associated with the call between the first device and a third device included in a third security zone, and 
 a second gate for transmitting a second type of data associated with the call between the first device and the third device, 
 
 receive a second message from the third device, 
 determine that the second message is associated with the first message, 
 close, based on determining that the second message is associated with the first message, the second gate, 
 open, based on closing the second gate:
 a third gate for transmitting the second type of data associated with the call between the first device and the second device, and 
 a fourth gate for transmitting the first type of data associated with the call between the second device and the third device, and 
 establish, based on opening the third gate and the fourth gate, the VoIP session between the first device and the second device. 
 
   
     
     
         32 . The device of  claim 31 , where the processor is further to:
 identify a first address based on information included in a header of the first message, and   identify a second address based on information included in a non-header portion of the first message, where the first gate is opened based on identifying the first address and the second gate is opened based on identifying the second address.   
     
     
         33 . The device of  claim 31 , where the first type of data comprises data associated with signaling messages associated with the VoIP session and the second type of data comprises data associated with media transmitted between the first device and the second device during the VoIP session. 
     
     
         34 . The device of  claim 31 , where the processor is further to:
 determine whether a particular value, included in a header of the second message, matches a corresponding particular value included in a header of the first message,   determine that the second message is associated with the first message when the particular value included in the header of the second message matches the corresponding particular value included in the header of the first message, and   drop the second message when the particular value included in the header of the second message does not match the corresponding particular value included in the header of the first message.   
     
     
         35 . The device of  claim 34 , where the particular value comprises a value included in a particular field of the second message. 
     
     
         36 . The device of  claim 31 , where the processor is further to:
 modify, based on address information included in the second message, the second message,   forward the modified second message to the second device,   receive, via the fourth gate, a response from the second device, and   direct, based on receiving the response via the fourth gate, the response to the third device via the first gate.   
     
     
         37 . The device of  claim 31 , where the processor is further to:
 identify first address information included in a header of the first message,   identify second address information included in a non-header portion of the first message,   modify the first address information and the second address information, and   forward the first message, including the modified first address information and the modified second address information, to the third device via the first gate.   
     
     
         38 . A method comprising:
 receiving, by a first device, a first message for establishing a call between a second device included in a first security zone and a third device included in a second security zone;   identifying, by the first device and based on information included in the first message, a first address associated with a first port of the first device and a second address associated with a second port of the first device;   opening, by the first device based on identifying the first address and the second address:
 a first gate for transmitting a first type of data associated with the call between the second device and a fourth device included in a third security zone, and 
 a second gate for transmitting a second type of data associated with the call between the second device and the fourth device; 
   generating, by the first device, a second message based on the first address and the second address;   forwarding, by the first device, the second message to the fourth device;   receiving, by the first device, a third message from the fourth device based on forwarding the second message;   determining, by the first device, that the third message is associated with the first message;   closing, by the first device and based on determining that the third message is associated with the first message, the second gate;   opening, by the first device and based on closing the second gate:
 a third gate for transmitting, via the first device, the second type of data associated with the call between the second device and the third device, and 
 a fourth gate for transmitting, via the first device, the first type of data associated with the call between the third device and the fourth device; and 
   establishing, based on opening the third gate and the fourth gate, the call between the second device and the third device.   
     
     
         39 . The method of  claim 38 , where the first type of data comprises data associated with signaling messages associated with a VoIP session associated with the call and the second type of data includes media transmitted during the VoIP session. 
     
     
         40 . The method of  claim 38 , further comprising:
 comparing a first value, included in a header of the third message, with a corresponding first value, included in a header of the first message; and   determining that the third message is associated with the first message based on comparing the first value included in the header of the third message with the corresponding first value included in the header of the first message.   
     
     
         41 . The method of  claim 40 , further comprising:
 determining, based on the comparing, whether the first value, included in the header of the third message, matches the corresponding first value included in the header of the first message; and   dropping the third message when the first value, included in the header of the third message, does not match the corresponding first value, included in the header of the first message.   
     
     
         42 . The method of  claim 38 , where generating the second message includes:
 translating the first address to obtain a third address, and   translating the second address to obtain a fourth address.   
     
     
         43 . The method of  claim 38 , where the first security zone is associated with a private network and the second security zone is associated with a public network.