	US 7,574,736 B2
	System and method for efficiently transferring media across firewalls
Rao Salapaka, Redmond, Wash. (US); Srikanth Shoroff, Sammamish, Wash. (US); and Gur Kimchi, Bellevue, Wash. (US)
Assigned to Microsoft Corporation, Redmond, Wash. (US)
Filed on Mar. 03, 2004, as Appl. No. 10/792,349.
Prior Publication US 2005/0198499 A1, Sep. 08, 2005
Int. Cl. G06F 17/00 (2006.01)

U.S. Cl. 726—13 [726/14; 726/15]

12 Claims

1. A computer-implemented process for receiving from a plurality of sending clients media packets across a firewall sent to a single destination address and a single destination port of a firewall, each media packet not including an unencrypted Synchronization Source Identifier (SSRC) but including an encrypted Synchronization Source Identifier, comprising the process actions of:

establishing a plurality of security associations (SAs) for dialogs between sending clients and receiving clients, each SA including source information of a sending client and an indication of a receiving client;

receiving from a sending client an encrypted media packet sent using Real-time Transport Protocol (RTP) message format at a media-relay server, the encrypted media packet being sent to the destination address and the destination port;

determining whether the sending client's Security Association (SA) exists using the sender's source information received with the media packet the sender's source information being unencrypted and including a source address;

if no SA exists, dropping the media packet at the media-relay server; and

if a SA does exist, decrypting the media packet including decrypting a media packet Synchronization Source Identifier included in the media packet;

obtaining obtained Synchronization Source Identifier from the SA;

comparing the media packet Synchronization Source Identifier included in the decrypted media packet with the obtained Synchronization Source Identifier obtained from the SA;

if the media packet Synchronization Source Identifier included in the decrypted packet does not match the obtained Synchronization Source Identifier obtained from the SA, dropping the media packet;

and

if the media packet Synchronization Source Identifier in the decrypted packet matches to the obtained Synchronization Source Identifier obtained from the SA, forwarding the packet to a receiving client indicated in the SA based on the sender's source information

wherein a plurality of sending clients send media packets with different encrypted Synchronization Source Identifiers to the destination address and the destination port.