Securing VoIP networks

The Network

Experts agree that one important step in the quest for VoIP security is to separate the VoIP network from the ordinary LAN traffic. The complex and relative insecure nature of computer networks adds many opportunities for eavesdropping and other forms of attack, and seasoned admins are well aware that physical access is more or less identical to a hacked system.

To isolate the VoIP network, use physical separation or even a virtual LAN (VLAN) configuration. Of course, separating VoIP traffic will not protect you against physical access by an attacker who connects to a free port of the voice network. (If a port is accessible, the attacker can simply hitch up a laptop and spoof a phone's MAC address.) The best way to combat this kind of local intrusion is to use additional 802.1x [15] [16] authentication against the switch.

To ensure secure VoIP communications with the enterprise system for road warriors, it makes sense to route the connection via a VPN tunnel. This setup should support low-bandwidth codecs, such as GSM (Global System for Mobile communications) [17]. As an alternative, you might prefer to use SRTP and SIPS--S/MIME, if clients and servers support this option, because of the lower protocol overhead.

Figure 5 shows a combination of the techniques discussed in this article in which the VoIP infrastructure is isolated from the remaining system. The link between the sub-branch and head office uses one or multiple VPN tunnels. (When forecasting the bandwidth, it is important to take the VPN protocol overhead into consideration.) The PSTN (Public Switched Telephone Network) connection can be handled separately at each branch or routed via the head office. A failover link for each branch is a good idea. This keeps your branch offices reachable, even if the IP connection fails or is overloaded.

Conclusion

If you are thinking about adding a voice component to your network presence, it makes sense to plan your approach to VoIP security before you begin. The hardware and software tools of the VoIP environment provide a number of interesting security options. First determine which protocols and components you need for your VoIP network, then shop for tools that provide the necessary support. Table 1 shows the results of our research into the compatibility of phones and VoIP appliances by various manufacturers.

If you already have a VoIP network, simple techniques such as VLAN isolation and strategic use of available encryption alternatives will help you build a better and more secure environment for VoIP communications.

The Author

Michael Hirschbichler is a Research Associate at the Vienna University of Technology Institute of Broadband Communications (IBK; http://www.ibk.tuwien.ac.at). His scientific work focuses on performance evaluation, VoIP security, and, more specifically, IP multimedia subsystem security.

Christoph Egger is also an assistant at the IBK. His research focus includes various VoIP security topics, as well as the simulation and emulation of mobile networks and the IP multimedia subsystem.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Linphone

    When you want to call your friends in distant countries, don’t pick up the phone; just put on your headset and fire up Linphone.

  • IP Telephony Intro

    Using a headset and a webcam to make phone calls is easy, interactive, and even free, thanks to VoIP. In this month's cover story, we'll help you choose a VoIP softphone, and we'll show you how to configure your own Asterisk exchange server.

  • Wengophone

    Video telephony, calls to landlines, short messaging, and conferencing: the free Wengophone outpaces competitors in the VoIP field.

  • Socks 5

    Socks is a universal proxy protocol for TCP and UDP that allows internal hosts to securely pass the firewall and authenticates users. This article describes the latest version of the Socks proxy protocol and shows how to implement it.

  • Security Strategies

    Is your data safe? Are your borders protected? This month we examine some expert techniques for building more secure networks.

comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News