Switching to VoIP

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

228

|

Chapter 10: Security and Monitoring

Media Encryption

Encrypting the key piece of authentication info—the endpoint’s access password—is

one way to prevent unauthorized access to make and receive calls using an IP phone.

But this measure alone doesn’t protect calls in progress from being observed and

possibly recorded.

Once an intruder has access to the softPBX or a critical piece of routing infrastruc-

ture, like a firewall, she may be able to store VoIP media streams packet by packet,

and piece them together to listen to later. It isn’t very hard to figure out which codec

the call used and play the call back using a program that supports lots of codecs, like

QuickTime or a decent sound file editor. This is a potentially devastating risk—a

true cornucopia for the daring intruder. So, to remove the risk, the media streams to

and from IP phones and the softPBX can be encrypted.

Encryption of media channels is something the bulk of VoIP vendors don’t support,

but the need is clear. The prevailing method of sending media streams in an

encrypted fashion is via SRTP (Secure Real Time Transport Protocol), a mechanism

that must be activated during capabilities negotiation (SDP or H.245). As with any

other capability, all endpoints involved in the call must support the same standard of

encryption. ...