A variety of computer networking applications involve establishing connections between two or more computing devices. Such networking applications can include multimedia streaming, Voice over IP (VoIP) communications, file sharing, online multiplayer video games, etc. The performance of these networking applications can be negatively impacted by various network security policies and devices, which often limit the ability of two computing devices to exchange data over a network.
A variety of different protocols and encoding techniques can be used to transmit data from one computer to another. Such protocols are often characterized via four conceptual layers that collectively form the Internet protocol suite, including the application layer, transport layer, Internet layer, and link layer. For example, when accessing a website, a computer may retrieve a Hypertext Markup Language (HTML) file from a remote server having a unique Internet Protocol (IP) address, which is a part of the Internet layer. The HTML document may be retrieved using the Hypertext Transfer Protocol (HTTP) of the application layer, with network packet transmission being managed by the Transmission Control Protocol (TCP) of the transport layer. In a multimedia streaming environment, a computer may connect to a server and retrieve multimedia content using the Real-Time Transport Protocol (RTP) of the application layer, with transmission of individual data packets (or datagrams) being handled by the User Datagram Protocol (UDP) of the transport layer. In general, different protocols and technologies may be differently-suited to different network applications and environments.
In an ideal scenario, a computing device would in most or all cases be able to send and receive data over a network using the best-suited network protocols. For example, TCP may be used in settings where transmission reliability and fidelity is preferred, at the expense of latency. Similarly, UDP may be used in settings where low latency is more important than reliable transmission. However, in some cases various network restrictions imposed by firewalls, security policies, Network Address Translation (NAT) devices, etc., may present a technical problem in that they limit the types of network traffic that a particular computing device can send and/or receive. Existing solutions to this technical problem, such as Interactive Connectivity Establishment (ICE), can help two computing devices identify a mutually viable communication path. However, such solutions can be ineffective in some network environments, such as when a network security policy only allows transmission of packets sent via a request and response protocol like HTTP. This can interfere with network applications that rely on bidirectional data flow, such as bidirectional media streaming, file sharing, VoIP and other types of computer-facilitated communication, online multiplayer gaming, etc. The functionality of such applications can therefore be significantly impaired, if not completely interrupted, unless network security is relaxed or special exceptions are added to the security policy. Both of these approaches have drawbacks, and may be impossible when a user attempting to establish a connection does not have control over their network configuration.
Accordingly, the present disclosure is directed to technical solutions to the problem of network security and/or infrastructure interfering with bidirectional data transmission. These solutions include techniques for bidirectional data exchange using a request and response protocol. As a technical result of the solutions described herein, multiple request and response data streams can be used to emulate a single, bidirectional data stream. This can enable two computing devices to establish a connection and exchange data as part of a bidirectional data stream, even when network policies only allow request and response traffic via, for example, HTTP. It will be understood that, while the bidirectional data exchange techniques described herein are especially beneficial in network environments that restrict some types of network traffic, the techniques described herein may be used in any network environment where a connection is established between two computing devices over a network, and need not be limited to any particular network environment, application, or protocol.
As indicated above, a variety of different protocols and connection types can be used to facilitate data transfer, though some network environments will be better suited to bidirectional data exchange than others.
In the example of
However, in real-world implementations, the specifics of a particular network environment can interfere with the ability of two computing devices to successfully establish a connection.
Accordingly, use of VoIP applications in network environments featuring NAT, as well as other network applications that require bidirectional data exchange between two computing devices, can require the use of one or more NAT traversal techniques. Two common solutions for NAT traversal are Session Traversal Utilities for NAT (STUN) and Traversal Using Relays around NAT (TURN). Accordingly, in
STUN generally involves a computing device behind NAT querying a STUN server for the network address (e.g., IP address) that the computing device presents to the public network. Once this network address is provided, the computing device can establish a connection with the second computing device, and specify the public network address to which the second computing device should send incoming data. Notably, once the STUN server provides the public network address, data can flow directly between the first and second computing devices, without requiring additional involvement of the STUN server.
TURN is generally used in situations where STUN alone is not sufficient. When TURN is used, the first computing device will connect to a TURN server and request that the server allocate a relay that can be used to exchange data with the second computing device. The two computing devices can then each connect to the TURN server, which has a well-known address on the public network (e.g., the Internet), and the TURN server will pass data sent by one computing device on to the other computing device. In this manner, each computing device can communicate with the other, without needing to know the network address of the other computing device.
In some examples, DPI may be used to block network traffic that does not use specific network protocols. For example, because a large percentage of typical Internet traffic is sent as HTTP traffic over TCP, a DPI device may be configured to block traffic sent using different protocols, with the assumption that such traffic is not permitted by a network security policy. However, when a DPI device only allows traffic sent via a request and response protocol like HTTP, the ability of a computing device to send and receive a bidirectional data stream as described above can be compromised, in some cases rendering certain network applications completely unusable.
As an example, when traffic is sent using HTTP, a computing device is generally unable to send a request for data while receiving a response from a remote computing device, and vice versa. In a specific example, a computing device may send an HTTP request to a remote computing device, the request including some amount of data (e.g., digitized audio). After receiving the request, the remote computing device may respond with additional data (e.g., digitized audio from another party). Upon receiving the response, the computing device may send another request including additional data. Notably, after sending the first request, the computing device will be unable to send additional data until after it receives the response from the remote computing device. Similarly, after sending the response, the remote server will be unable to send more data until after it receives another request from the computing device. Accordingly, relying on a traditional request and response protocol for bidirectional communication may require each computing device to wait its “turn” before it can send data. This can make it impossible to conduct a VoIP call as shown in
Accordingly,
At 502, method 500 includes sending a first request to a remote computing device via a request and response protocol, the first request including an outgoing portion of a data stream. This is schematically illustrated in
As used with regard to
In the specific example of
When the remote computing device is a TURN server, sending of the first request by the computing device may be preceded by one or more allocate requests intended to establish a relay candidate with the TURN server. In TURN, a relay candidate typically refers to a session maintained by the TURN server that relays data received from one computing device to another computing device over a network. For example, the computing device may send a first allocate request, and receive an allocate error response. Based on data included in the allocate error response, the computing device may send two concurrent allocate requests, one for incoming data and one for outgoing data. In some cases, each of these two concurrent allocate requests may specify a same session ID (provided, for example, in the allocate error response), thereby indicating to the TURN server that the two allocate requests are related. Upon receiving the two allocate requests, the TURN server may create a single relay candidate for the incoming and outgoing request and response streams. In some cases, the allocate requests sent by the computing device may be included within request and response packets. As an example, an allocate request may be included within the body of an otherwise normal HTTP packet. Upon successfully establishing a relay candidate with the TURN server, the computing device may send the first request including the outgoing portion of the data stream, as will be described in more detail below.
In
Returning briefly to
Returning briefly to
In some cases, the first and second requests may be sent by the computing device to the remote computing device at substantially the same time. Once both requests are sent, the remote computing device can send the response to the second request at the same time as the computing device is sending a new request, the new request including a new outgoing portion of the data stream. In this manner, the computing device can send outgoing data at the same time as it receives incoming data, thus emulating a single, bidirectional data stream with two different request and response streams. In some cases, the first and second requests may not be “fulfilled” until after data transmission between the computing device and remote computing device has ceased. In other words, the amount of data transmitted as part of the first request and solicited by the second request can be arbitrarily large, and sent as a plurality of individual data packets over a period of time.
Though method 500 and the above description of
At 702, method 700 includes receiving a first request from a first computing device via a request and response protocol, the first request including a first-device-provided portion of a data stream. This is shown in
At 704, method 700 includes sending the first-device-provided portion of the data stream to the second computing device. This is shown in
Returning to
Returning to
Returning to
In some embodiments, the methods and processes described herein may be tied to a computing system of one or more computing devices. In particular, such methods and processes may be implemented as a computer-application program or service, an application-programming interface (API), a library, and/or other computer-program product.
Computing system 800 includes a logic machine 802 and a storage machine 804. Computing system 800 may optionally include a display subsystem 806, input subsystem 808, communication subsystem 810, and/or other components not shown in
Logic machine 802 includes one or more physical devices configured to execute instructions. For example, the logic machine may be configured to execute instructions that are part of one or more applications, services, programs, routines, libraries, objects, components, data structures, or other logical constructs. Such instructions may be implemented to perform a task, implement a data type, transform the state of one or more components, achieve a technical effect, or otherwise arrive at a desired result.
The logic machine may include one or more processors configured to execute software instructions. Additionally or alternatively, the logic machine may include one or more hardware or firmware logic machines configured to execute hardware or firmware instructions. Processors of the logic machine may be single-core or multi-core, and the instructions executed thereon may be configured for sequential, parallel, and/or distributed processing. Individual components of the logic machine optionally may be distributed among two or more separate devices, which may be remotely located and/or configured for coordinated processing. Aspects of the logic machine may be virtualized and executed by remotely accessible, networked computing devices configured in a cloud-computing configuration.
Storage machine 804 includes one or more physical devices configured to hold instructions executable by the logic machine to implement the methods and processes described herein. When such methods and processes are implemented, the state of storage machine 804 may be transformed—e.g., to hold different data.
Storage machine 804 may include removable and/or built-in devices. Storage machine 804 may include optical memory (e.g., CD, DVD, HD-DVD, Blu-Ray Disc, etc.), semiconductor memory (e.g., RAM, EPROM, EEPROM, etc.), and/or magnetic memory (e.g., hard-disk drive, floppy-disk drive, tape drive, MRAM, etc.), among others. Storage machine 804 may include volatile, nonvolatile, dynamic, static, read/write, read-only, random-access, sequential-access, location-addressable, file-addressable, and/or content-addressable devices.
It will be appreciated that storage machine 804 includes one or more physical devices. However, aspects of the instructions described herein alternatively may be propagated by a communication medium (e.g., an electromagnetic signal, an optical signal, etc.) that is not held by a physical device for a finite duration.
Aspects of logic machine 802 and storage machine 804 may be integrated together into one or more hardware-logic components. Such hardware-logic components may include field-programmable gate arrays (FPGAs), program- and application-specific integrated circuits (PASIC/ASICs), program- and application-specific standard products (PSSP/ASSPs), system-on-a-chip (SOC), and complex programmable logic devices (CPLDs), for example.
The terms “module,” “program,” and “engine” may be used to describe an aspect of computing system 800 implemented to perform a particular function. In some cases, a module, program, or engine may be instantiated via logic machine 802 executing instructions held by storage machine 804. It will be understood that different modules, programs, and/or engines may be instantiated from the same application, service, code block, object, library, routine, API, function, etc. Likewise, the same module, program, and/or engine may be instantiated by different applications, services, code blocks, objects, routines, APIs, functions, etc. The terms “module,” “program,” and “engine” may encompass individual or groups of executable files, data files, libraries, drivers, scripts, database records, etc.
It will be appreciated that a “service”, as used herein, is an application program executable across multiple user sessions. A service may be available to one or more system components, programs, and/or other services. In some implementations, a service may run on one or more server-computing devices.
When included, display subsystem 806 may be used to present a visual representation of data held by storage machine 804. This visual representation may take the form of a graphical user interface (GUI). As the herein described methods and processes change the data held by the storage machine, and thus transform the state of the storage machine, the state of display subsystem 806 may likewise be transformed to visually represent changes in the underlying data. Display subsystem 806 may include one or more display devices utilizing virtually any type of technology. Such display devices may be combined with logic machine 802 and/or storage machine 804 in a shared enclosure, or such display devices may be peripheral display devices.
When included, input subsystem 808 may comprise or interface with one or more user-input devices such as a keyboard, mouse, touch screen, or game controller. In some embodiments, the input subsystem may comprise or interface with selected natural user input (NUI) componentry. Such componentry may be integrated or peripheral, and the transduction and/or processing of input actions may be handled on- or off-board. Example NUI componentry may include a microphone for speech and/or voice recognition; an infrared, color, stereoscopic, and/or depth camera for machine vision and/or gesture recognition; a head tracker, eye tracker, accelerometer, and/or gyroscope for motion detection and/or intent recognition; as well as electric-field sensing componentry for assessing brain activity.
When included, communication subsystem 810 may be configured to communicatively couple computing system 800 with one or more other computing devices. Communication subsystem 810 may include wired and/or wireless communication devices compatible with one or more different communication protocols. As non-limiting examples, the communication subsystem may be configured for communication via a wireless telephone network, or a wired or wireless local- or wide-area network. In some embodiments, the communication subsystem may allow computing system 800 to send and/or receive messages to and/or from other devices via a network such as the Internet.
In an example, a method for bidirectional data exchange comprises: on a computing device, sending a first request to a remote computing device via a request and response protocol, the first request including an outgoing portion of a data stream; sending a second, separate request to the remote computing device via the request and response protocol, the second request soliciting an incoming portion of the data stream; and receiving, from the remote computing device and via the request and response protocol, a response to the second request, the response including the incoming portion of the data stream. In this example or any other example, the request and response protocol is the Hypertext Transfer Protocol (HTTP). In this example or any other example, the first request is an HTTP POST request. In this example or any other example, the second request is an HTTP GET request. In this example or any other example, data sent from the computing device is inspected by a proxy server performing Deep Packet Inspection (DPI). In this example or any other example, the data stream is a Voice over IP (VoIP) communication between the computing device and a second computing device including digitized audio from at least one call participant. In this example or any other example, one or more network devices between the computing device and the remote computing device performs network address translation (NAT). In this example or any other example, the remote computing device is a Traversal Using Relays around NAT (TURN) server.
In an example, a computing device comprises: a communications subsystem; a logic machine; and a storage machine holding instructions executable by the logic machine to: via the communications subsystem, send a first request to a remote computing device via a request and response protocol, the first request including an outgoing portion of a data stream; send a second, separate request to the remote computing device via the request and response protocol, the second request soliciting an incoming portion of the data stream; and receive, from the remote computing device and via the request and response protocol, a response to the second request, the response including the incoming portion of the data stream. In this example or any other example, the request and response protocol is the Hypertext Transfer Protocol (HTTP). In this example or any other example, data sent from the computing device is inspected by a proxy server performing Deep Packet Inspection (DPI). In this example or any other example, the data stream is a Voice over IP (VoIP) communication between the computing device and a second computing device including digitized audio from at least one call participant. In this example or any other example, one or more network devices between the computing device and the remote computing device performs network address translation (NAT). In this example or any other example, the remote computing device is a Traversal Using Relays around NAT (TURN) server.
In an example, a computing device for bidirectional data exchange comprises: means for sending a first request to a remote computing device via a request and response protocol, the first request including an outgoing portion of a data stream; means for sending a second, separate request to the remote computing device via the request and response protocol, the second request soliciting an incoming portion of the data stream; and means for receiving, from the remote computing device and via the request and response protocol, a response to the second request, the response including the incoming portion of the data stream. In this example or any other example, the request and response protocol is the Hypertext Transfer Protocol (HTTP). In this example or any other example, data sent from the computing device is inspected by a proxy server performing Deep Packet Inspection (DPI). In this example or any other example, the data stream is a Voice over IP (VoIP) communication between the computing device and a second computing device including digitized audio from at least one call participant. In this example or any other example, one or more network devices between the computing device and the remote computing device performs network address translation (NAT). In this example or any other example, the remote computing device is a Traversal Using Relays around NAT (TURN) server.
It will be understood that the configurations and/or approaches described herein are exemplary in nature, and that these specific embodiments or examples are not to be considered in a limiting sense, because numerous variations are possible. The specific routines or methods described herein may represent one or more of any number of processing strategies. As such, various acts illustrated and/or described may be performed in the sequence illustrated and/or described, in other sequences, in parallel, or omitted. Likewise, the order of the above-described processes may be changed.
The subject matter of the present disclosure includes all novel and non-obvious combinations and sub-combinations of the various processes, systems and configurations, and other features, functions, acts, and/or properties disclosed herein, as well as any and all equivalents thereof.