Live Show Report IP Telephony Security

I'm presently sitting in a session at the Next Generation Networks Conference in Boston entitled "IP Telephony Security: Threat and Countermeasures." Moderated by Scott Bradner, university security officer for Harvard University (pictured at left, Scott is a proud Macintosh user, interestingly enough), this panel session hopes to answer the following questions:

The panelists are:

What follows are my notes from this session. I hope you find them helpful.

--

For Ashley Johnston, director of marketing for VoIP at Texas Instruments, there are four security goals for VoIP:

The basic system in place now needs to secure both signaling and voice media. And all equipment may be wired or wireless. It's structured like so:

Telephony interface (circuits) --> DSP (voice/media sec) --> Micro (signal security) --> IP network --> Micro --> DSP --> land or mobile phone.

Thinking about key exchanges, when you type in a password, you'd like it to be easy. But if you do that for every system, you expose yourself quite a bit. On the other end of the scale, you use a very difficult password from IT, which you write somewhere so you won't forget it. In either case, you're in trouble. So we need a key exchange that makes sense for the application we're using. There are a few options available here:

And for encryption, there are three types available:

For wireless LAN security for VoIP, the industry has evolved from WEP to WPA and now to 802.11i (the holy grail) and 802.1x.

Interesting note: Regardless of how you secure VoIP, performance is the biggest factor. Algorithms like AES takes 50 ms, Key generation takes 500 ms. An IPSec exchange takes one to five seconds on each end.

--

Dr. Ramesh Lakshmi-Ratan, president of VocalTec, did not want to talk about technologies and how-tos. Instead, he shared with us his "musings and personal insights of a well-worn engineer who's been trying to do this for a long time."

VoIP started at the core of what we call class-4 networks. It was just a means of transport between trusted endpoints (between telephony gateways). As VoIP migrates to the edge, you can now do amazing things like eight-way conferencing. But you can also do dangerous things from a business point of view because of a number of challenges:

Here's how security maps out for him:

On VoIP moving to the edge: It's currently based upon the Internet model where we'll have very capable, smart pieces of equipment at the edge and dumb equipment in the middle (utility), providing core services (connectivity, discovery, etc.) just like the Internet. The benefits are many, but there are problems with this architecture:

Instead, we should look to service providers, which can create what we call a walled garden approach, similar to the old CompuServe/AOL networks, where you look to your direct provider for protections. ATT just announced, for example, a managed network that makes the Internet a security appliance for you. The same could be applied to VoIP services.

The bottom line is that the world is not just a network. It never will be again and never was, really. Now the difference is that it's not just a net of physical networks; rather, it's a set of relationships (maybe some of them are embodied in packets and servers that register clients) where business models are shifting from physical networks to virtual collections and relationships, from hardware to software.

--

Bruce Robertson, senior manager, Network Design, CTO's Office at Nortel Networks, discussed things much more from a solution level for an enterprise-level network. Hey that's us!

Nortel has developed four levels of security, which it can tailor to a specific target market.

At this point, Bruce introduced something extremely unreadable and possibly untranslatable.

The Secure Voice Zone (SVZ) technology employs a stateful firewall and uses application level gateways for H.323 and SIP traffic. Nortel will employ this SVZ at two locations, between two end points (at the service provider level).