The most urgent problem with securing enterprise VoIP is the lack of interoperable security standards, especially for encryption and authentication. This problem could be easily solved by using a SIP Authenticator, Protocol, and Encryption Transcoder equipped with an encryption accelerator, DSP media processor, and cryptographic storage.

The SIP Transcoder would sit in series with the SIP streams and translate from one vendor’s SIP protocol to another’s. Each SIP channel input and output could be configured to be compatible with any vendor that supports the SIP Transcoder. The SIP Transcoder would be an open platform and any vendor could write their own transcoding configuration or routine. The transcoder could be configured with T1/E1 channels and multiple GigE ports and could then translate between IP

and T1/E1 or T1/E1 in-and-out or IP in-and-out.

Most forecasts predict that VoIP sales will not exceed those of TDM until 2010. There is still much market resistance to adopting VoIP. The leading factors inhibiting the adoption of VoIP are the low availability of reliable and cost effective high speed broadband, the growing concerns of security vulnerabilities, and the lack of interoperable standards.

VoIP voice quality requires broadband with guaranteed network availability, low packet loss, and low latency. Broadband cost, quality, and availability continues to improve and will have less and less of a negative impact on the VoIP market.

VoIP security has not caused much resistance thus far for VoIP, but it is a growing concern. As the VoIP market grows, so will attacks on the VoIP infrastructure similar to the way malware has increasingly infiltrated the web and email. As attacks on VoIP continue to increase so will the recognition of VoIP security as a serious problem. Authentication and encryption remedies for VoIP security are currently available and they can greatly decrease security risks in a properly deployed VoIP installation. Proper deployment will remain problematic, however, until VoIP achieves greater interoperability across all segments of the VoIP infrastructure.

There are fewer purchasing decisions for a TDM phone system than for a VoIP installation. Because TDM is a very mature industry and standards have been in place for a long time, interoperability usually does not enter the decision making process. A major source of uncertainty for a VoIP installation is the question of interoperability between all the necessary components.

SIP is the predominate protocol for the transport of voice and video over an IP network. SIP is an adaptable universal protocol that is very versatile and supports the transport of many types of communications and media. Ironically, it is SIP’s flexibility that is at the root of VoIP’s current interoperability issues. Most VoIP vendors have chosen SIP as their transport protocol even though SIP is not an industry standard. The IETF SIP Working Group is working on a specification RFC (Request For Comments) 3261 which is on their “Standards Track”. SIP is not yet a standard – at best, it’s a reference specification. The problem with RFC 3261 is its ambiguous nature, the words may, should and recommend appear 766 times in the 269-age document. There are more than 80 additional SIP-elated RFCs that attempt to clarify or fix RFC 3261.

SIP RFC 3261, being ambiguous,. Allows for many different protocols for media and signal transmission. Although TLS (Transmission Layer Security) is emerging as the preferred encryption protocol for SIP signaling transmission. TLS can use over a dozen different ciphering schemes. SIP requests can be sent using TCP

, UDP (News - Alert), or SCTP. Media transmission can be sent using RTP

, SRTP, or Ipsec among others. Then add the multitude of authentication schemes, passwords, various Public Key Exchange methods, and Certificate Authorities. There are literally thousands of possible SIP implementations. For this reason most SIP signaling and media are sent in the clear with no encryption and weak authentication.

There is still some probability that SIP will not become a standard. A likely scenario is that the SIP specification will evolve into an industry-wide de facto standard. Current SIP implementations have so much variation in their interpretation and implementation of the SIP specification, they are incompatible with one another. When a SIP standard does evolve, the majority of existing installations will not be compliant and most have been implemented on a platform that will not have the flexibility or processing ability to adapt to the future standards. The SIP transcoder could be used to salvage these existing installations.

If the VoIP industry is going to gain the predicted market share over TDM, it must address the “fear uncertainty and doubt” associated with the adoption of VoIP. While VoIP may be the best choice when purchasing a phone system, TDM is currently the easier and safest choice. The VoIP industry must turn this around. VoIP’s lack of interoperable standards will make this a formidable task. A SIP transcoder can convert any SIP deployment so as to be compatible with any other SIP implementation. It can also provide strong authentication, encryption, and media processing services that will provide major improvements over TDM.

SIP RFC 3261 is very weak when addressing authentication, suggesting that a SIP proxy server or UA may (or may not) challenge the source identity of a SIP request. RFC 3261 does not recommend an authentication scheme. VoIP needs mechanisms superior to TDM to challenge its market domination. Authentication is an excellent area where VoIP could easily prove to be superior over TDM. A SIP implementation can and should use a strong authentication scheme with private encryption keys and authentication certificates stored in a cryptographic storage module. TDM does not have the capability for using strong authentication.

Authentication is an area where SIP can prove to be better than TDM. TDM has Caller ID to authenticate the caller which can easily be spoofed. If SIP were deployed with strong authentication performed with the use of Identity Certificates, all end points of a conversation could be positively identified.

A VoIP implementation of SIP requires two data paths, one for connection information, referred to as signaling, and one for the voice, referred to as the media stream. SIP signaling is similar to HTTP text based protocols and uses established TCP/IP protocols for transport of both signaling and media. SIP signaling, being a clear text protocol, will require encryption when traversing a public network. Without encryption the signaling is vulnerable to many security risks. Within the enterprise, eavesdropping of SIP conversation is too easy. An employee with limited technical knowledge can learn and deploy eavesdropping within minutes thanks to the availability of free software on the Internet. Within the enterprise network the media should also be encrypted to prevent eavesdropping.

There are many authentication and encryption schemes and it is too much to ask SIP vendors to support such a wide variety of ciphering schemes. It would add prohibitive development, production, and provisioning costs. Some markets will require exceptionally strong authentication and encryption where other markets are well served by a simpler scheme. The transcoder will maintain compatibility regardless of the protocols used.

A SIP transcoder would ease the deployment of low bit rate and wideband codecs. The predominant codec used with SIP is G.711, which is nearly equivalent to TDM in bandwidth and voice quality. VoIP must move beyond the G.711 codec. Use of the G.729 low bit rate codec will reduce bandwidth costs by up to a factor of eight, and the G.722 wideband codec will improve voice quality to better than twice the frequency response. Both codecs offer a competitive advantage over TDM.

One common difference in SIP implementations is whether the DTMF and Caller ID are transported in the signaling or the media stream. From a SIP design perspective it is much easier to implement the transmission of DTMF and Caller ID in the signaling, as text is very easy to encode and decode. When these signals are transported in the media it becomes a very compute-intensive task to encode and decode. The eventual SIP standard will most likely require DTMF and Caller ID to be transported within the media. This would eliminate many security vulnerabilities and require less effort transcoding SIP signaling to media in a SIP-to-PSTN

gateway. It would be a very difficult if not impossible task for a manufacturer to retrofit a change to move the DTMF and Caller ID from the signaling to the media stream. These computationally intensive tasks can be offloaded to a SIP transcoder equipped with a DSP media processor.

A SIP transcoder would very useful to a SIP trunking Telephony Service Provider (TSP) where the IP-PBX

is located on the customer premise. SIP TSPs currently have a rigorous site survey procedure to ensure interoperability with the customer premise equipment (CPE). This is a labor-intensive task and excludes many potential customers due to incompatibility of CPE with the TSP’s SIP service.

The SIP transcoder can also maintain compatibility between phones and an IP-PBX (News - Alert). SIP phones can be the majority cost in a VoIP installation. If the IP-PBX is upgraded or replaced, there is the possibility of introducing new SIP phone incompatibilities. The SIP transcoder can sit between the phones and IP-PBX and restore compatibility.

A SIP transcoder can ease the deployment of VoIP security measures by solving the SIP interoperability issues. It can simplify development and deployment of SIP by implementing the complex algorithms and computationally intensive tasks in a single appliance. In addition it can accelerate the SIP advantage over TDM and remove most impediments related to VoIP deployment.

Patrick Young (News - Alert) is CEO of Arlinx, Inc., a manufacturer of open telephony platforms. For more information, visit the company online at www.arlinx.com.

The World's Largest Communications And Technology Community

Technology Marketing Corporation,
800 Connecticut Ave, 1st Floor East, Norwalk, CT 06854 USA
Ph: 800-243-6002, 203-852-6800; Fx: 203-866-3326
General comments: tmc@tmcnet.com. Comments about this site: webmaster@tmcnet.com.

» About » Contact » Advertise