Middleboxes: Controllable media firewalls

Internet technology is promised for the broadband multi-service future. However, it is unclear how this technology can bring service providers the needed revenue, since today this technology cannot provide basic quality guarantees for the services rendered. Generally, over-provisioning of the bandwidth is used to get the services to an acceptable level, but this is costly and cannot work in areas where high aggregation rates are necessary (such as the local loop). Today IP (router) technology lacks mechanisms for high-granularity access control, per-user accounting, and quality of service (QoS) policing. We believe that, for a service provider to deploy billable services, these issues need to be resolved. Only if access to the service is controlled and only when the network provides information about the usage of the network elements can next-generation services in the telecommunication industry, like voice over IP (VoIP) and multimedia conferencing, be rolled out profitably. In this paper, we present a technology that can address these needs. We employ controllable firewalls that have the ability to prevent unwanted IP traffic from entering a network. Creating pinholes that allow individual calls (voice or real-time multimedia streams) in controllable firewalls can be done very fast and efficiently. Traditional firewalls have no such provisioning. Multiple application servers should be able to request pinholes to one or more controllable firewalls. This approach, while familiar from the public switched telephone network (PSTN), is a new paradigm for IP networks.