Patent ID: 8363836

Claim:
A system, comprising: a network device configured to: receive a message used to authorize a media flow which traverses the network device towards a destination endpoint, wherein the message includes a cryptographic authorization token (CAT), flow data describing a source endpoint and the destination endpoint for the media flow, a pseudo-time indicating when the CAT was generated, a keep-alive frequency period, and a CAT lifetime period specified relative to the pseudo-time; evaluate, by a processor, the CAT to determine whether the CAT was generated by an authorized call controller, wherein the evaluation is based, at least in part, on a shared secret known to both the network device and the authorized call controller; and upon determining that the CAT was generated by the authorized call controller, open a pinhole which allows network traffic from the source endpoint to pass through the network device towards the destination endpoint, wherein the pseudo-time included in the CAT is greater than a different pseudo-time previously observed by the network device, the different pseudo-time being associated with a different CAT previously used to authorize opening a respective pinhole for a different media flow.