Scribd Logo
Upload

Welcome to Scribd!

  • 33 views

    Snom Secure Voip: Call Establishment and Media Protection

    Uploaded by

    ricardo
    This document discusses requirements and methods for securing VoIP communications. It covers securing SIP signaling with TLS, protecting media with SRTP, and how this is implemented on snom phones to guarantee a secure VoIP environment.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Snom Secure Voip: Call Establishment and Media Protection

    Uploaded by

    ricardo
    33 views14 pages
    This document discusses requirements and methods for securing VoIP communications. It covers securing SIP signaling with TLS, protecting media with SRTP, and how this is implemented on snom phones to guarantee a secure VoIP environment.

    Original Description:

    snom tutorial

    Original Title

    snomSecVoIP

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses requirements and methods for securing VoIP communications. It covers securing SIP signaling with TLS, protecting media with SRTP, and how this is implemented on snom phones to guarantee a secure VoIP environment.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    33 views14 pages

    Snom Secure Voip: Call Establishment and Media Protection

    Uploaded by

    ricardo
    This document discusses requirements and methods for securing VoIP communications. It covers securing SIP signaling with TLS, protecting media with SRTP, and how this is implemented on snom phones to guarantee a secure VoIP environment.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 14

    snom Secure VoIP: 

    Call establishment and media 
    protection
    2

     Requirements for secure VoIP

    • Protection of SIP­signaling via Secure SIP (SIPS)
    – Encryption and integrity protection
    – Hop­by­hop

    • Protection of  the media
    – Encryption and integrity protection
    – End­to­end
    – At network (IPSec ESP) or application layer (SRTP)
     

    Secure SIP is similar to HTTPS

    • SIPS extends SIP in a similar way as Secure HTTP (HTTPS)

    • Secure SIP works like HTTP over TLS (RFC 2818)

    • Transport Layer Security (TLS) usage within SIP

    • using TLS for UAs is recommended

    • TLS cannot be applied to UDP­based SIP signaling
     

    SIP without TLS 

    • Third­parties are able to trace and intercept your SIP call flows 
     

    Using Secure SIP in snom phones

    • Add these parameters into the  Outbound 

    Proxy­Field: 
    intern.snom.de:5061;transport=tls

    • Port 5061 is the standard Secure SIP port 

    and works with TCP

    • If the provider sets a SIPS DNS SRV 

    record, the Outbound Proxy­Field is not 
    needed.
     

    Tracing protected SIP messages

    • There is no opportunity  for  third­parties to intercept your SIP messages

    • The TLS communication between your snom phone and the registrar is now  safe
    7

     Certificate management Service for SIP 

    • certificates by SIP servers are very similar to those used by web servers

    • a given domain, example.com, will get one certificate for each server to route 
    interdomain SIP requests

    • UAs registering or being challenged can also view this certificate to ensure that 
    they are connected to a valid server (not a server spoofing the domain)

    • certificates  can be identical to the standard e­commerce certificates supported 
    today by web browsers

    • possible that UA could have e­commerce cert, that is not a scalable approach for 
    millions of UAs
    8

     Secure RTP (SRTP)

    • ciphered RTP payload

    • ciphering in snom phones via Advanced Encryption Standard (AES)

    • using AES 128 bit also known as Rijndael

    • AES was adopted by National Institute of Standards and Technology (NIST) as 
    US FIPS PUB 197 in November 2001

    • sdescriptions describes a way of establishing security parameters for SRTP with 
    SDP attribute a=crypto

    • attribute is not a key management protocol like Multimedia Internet KEYing 
    (MIKEY)

    • the transmission of the key makes only sense in combination with TLS
    9

     Unsecure RTP

    • It is the same like in unsecure SIP, third­parties can intercept your media streams
    10

     Activating secure RTP in snom phones

    • Enable in the Configuration Line under the RTP menu “RTP Encryption”
    11

     What will happen

    • A crypto key will be delivered by SDP. If you are using unsecure SIP the key will be delivered in 

    clear text. 
    12

     Ciphered RTP

    • If your crypto key is transported via TLS, third­parties have no chance to decrypt the 

    ciphered RTPs
     

    Conclusion

    • snom phones implement
    – ciphered RTP payload 
    – Secure SIP  
    – snom phones guarantee Secure VoIP environment
    14

    © 2005 snom technology AG

    Written by:
    Hirosh Dabui
    hd@snom.com
    Version: 1.0b

    The  author  has  made  his  best  effort  to  prepare  this  document.  The  content  is  based  upon  latest 
    information whenever possible. The author makes no representation or warranties of any kind with 
    regard  to  the  completeness  or  accuracy  of  the  contents  herein  and  accept  no  liability  of  any  kind 
    including but not limited to performance, merchantability, fitness for any particular purpose, or  any 
    losses  or  damages  of  any  kind  caused  or  alleged  to  be  caused  directly  or  indirectly  from  this 
    document.

    For more information, mail info@snom.com, Gradestr. 46, 12347 Berlin, Germany.

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy