Matrix Technical Support Mailer - 69 Security on VoIP

Transcription

1 Matrix Technical Support Mailer - 69 Security on VoIP Dear Friends, This mailer provides information about security features available in ETERNITY to restrict access of VOIP port or VOIP Card. VOIP is basically exchange of Voice over Internet Network. Various highly advanced and intelligent IP devices are used to accomplish this task. Generally IP PBX and VOIP adaptors are used to exchange voice over IP. All these IP devices used in internet cloud always have an identity called public IP, static or dynamic, through which they can be accessed. So it s very important to secure these devices from illegal access. What is Hacking??? Hacking a VOIP device is to reconfigure or reprogram the device to function in a way not facilitated by owner or administrator. It s a kind of modification to program to give user access to features that were otherwise unavailable. If a VOIP device is not enough secured, a hacker can change configuration of device, use international calling facilities or other resources of device. They can steal or destroy important data, can inject viruses. They can perform as admin of device and can even crash whole device. Now the question arises is how we can secure a VOIP device. Securing an IP device means restricting/limiting the access of device, restricting the use of resources available in IP device. These device should be enough intelligent to authenticate users. Authentication can be user id, password, and contact details depending upon the intelligence of IP device.

2 Security features available in ETERNITY: White List IP Address Table Logical partition Digest Authentication White List IP Address Table: It is a list of IP Addresses & their respective Subnet masks from where call traffic is to be allowed on a particular VoIP Ethernet Port. The Enable IP Address based Call traffic Restriction flag must be enabled for the particular VoIP Ethernet Port on which IP based call traffic restriction is to be enabled. When the flag is enabled & the IP Address table is configured, traffic coming from all IP Addresses, other than those programmed in the White List, will be blocked. Call restriction will be applicable on all the SIP trunks those are assigned to the particular VoIP Ethernet Port i.e. those configured for peer to peer as well as Proxy. If the flag Enable IP Address based Call traffic Restriction is enabled, but the White List IP Address table is blank, all the Incoming call traffic will be rejected.

3 Logical partition: Logical partition is about limiting routing between different types of trunk/interfaces like routing from VoIP to GSM or VoIP to PRI etc. A fixed category is defined for each type of interface. If logical partition is allowed between these categories call routing will be allowed. In case of restricted logical partition, routing will not be allowed.

4 Digest Authentication: This security feature is applied to a particular SIP trunk and not the whole VOIP port. MD5 Authentication Algorithm is used for Encryption and Decryption of the Authentication ID and Password. Incoming call on SIP trunk can be limited to specific users based on credentials, i.e. Authentication Id and Password. The Caller has to first prove his authentication before successfully calling to ETERNITY. Digest Authentication Table is configured for defining user ID and passwords of authenticated users. This feature is only for peer to peer trunk. It is not applied to sip trunk registered to a proxy server. Both White List and Digest Authentication can be applied simultaneously.

5 Note: We always recommend System Engineer (System Installer at customer s place) to use VoIP security features like white list IP address and Digest

6 authentication every time in case you are installing the system for peer to peer calling. Note: Allow logical partition only for Gateway application. No need to allow a logical partition for peer to peer calling. For more information, contact: Matrix Technical Training Team Training@MatrixComSec.com Disclaimer: The information contained in this and/or attachment may contain confidential or privileged information. Unauthorized use, disclosure or copying is strictly prohibited and may constitute unlawful act and can possibly attract legal action, civil and/or criminal. The contents of this message need not necessarily reflect or endorse the views of Matrix Comsec Pvt. Ltd on any subject matter. Any action taken or omitted on this message is not entirely at your risk and the originator of this message nor does Matrix Comsec Pvt. Ltd take any responsibility or liability towards the same. If you are not the intended recipient, please notify us immediately and permanently delete the message.