Secure telephone communications with Voice over IP from Crypto AG

Transcription

1 Secure telephone communications with Voice over IP from IT Security Solutions

2 Voice over IP more than simply telephoning The introduction of Voice over IP (VoIP) is a common item on today s agenda for modernising telephone infrastructure. Governments in particular are making use of this new form of communication. What makes VoIP such an interesting technology? Are economic advantages the primary motivation? Far from it! VoIP offers a number of additional features that conventional telephony does not: Best possible use of existing data networks ( IP everywhere ) for voice, data, images and video today and in future. Minimised operating costs, as the infrastructure shared by telephony and data communications is maintained and serviced by a single IT team. Simple administration, as new connections can be added, changed and removed within minutes world-wide. Static services of an existing central office can be optimised with ease using proactive services (e.g. electronic phone directory). Virtually unlimited mobility for users. Integration in your work processes. You derive major advantages from a VoIP phone that uses your computer network to transmit voice. IP-capable terminals enable your IP data network to be employed for voice communication instead of just data transmission, as before. Consequently, a separate infrastructure for voice connections becomes obsolete. Telephony service and support can thus be grouped together and simplified by making them part of the regular tasks handled by your IT department. It is obvious that a uniform IP network defined on the basis of standards is more cost-effective than a conventional telephone network. A VoIP telephone can be integrated with minimal cost in your work processes to perform a diversity of tasks. You select the number you want with a mouse click. The phone displays the contact data from your computer and informs you of your calendar entries during the call. With the function keys on your IP telephone, you can open doors or manage alarms of all kinds through an application server. You can also install what is a called a soft phone (phone software) version of a VoIP telephone directly on your PC. 2

3 IP telephony is not the same as Internet telephony IP telephony can utilise two different communication channels. One is routed over a private IP network, the other over the public Internet. Voice transmission over your private network (LAN, WAN leased line network) poses tough requirements for the infrastructure. Your IP phone converts your voice into data packets and uses the IP protocol as a means of transporting these packets in the data network. In VoIP, the recipient must receive the voice data packets quickly and in the correct order so they can be reconverted into voice communication. For this reason, your network must be equipped with VoIP-capable network components. If you have leased line networks, your telecom provider is the one who guarantees you quality of service. Your data network has to have sufficient transmission capacity for your VoIP service to be competitive with traditional lineconducted telephony and to meet all quality expectations. With encryption solutions from, your private network can be encrypted at a high security level as a plug-and-play application. If a call is routed over the Internet, you have no influence on the quality of service. The maximum quality achievable today for a VoIP call over the Internet is still inadequate for professional applications. Due to data congestion, choppy calls are the norm. Despite the rapid spread of VoIP services in the Internet by Skype and other providers, these offerings are suitable only for users satisfied with low standards of quality. On the question of security, the operation of a maximum-security VoIP network for the authorities would require an encryption unit to be physically placed at the premises of the telecom provider, because that is where your call is switched. Anyone aware of security needs can easily see that this approach is infeasible for security reasons. 3

4 Gentle migration Choosing VoIP does not necessarily mean you have to replace your existing phone infrastructure all at once and make large investments in a new one. VoIP can be converted step by step. You can equip new workstations, subentities within your organisation and field offices with new VoIP phones and use a gateway to connect them easily with the existing central office at your headquarters. But you can also continue using the existing telephone infrastructure in the process. That offers a number of advantages to you: Users require no special training and so any qualms they might otherwise have had about using new VoIP systems are eliminated from the outset. Moreover, data networks have much shorter depreciation periods than telephone infrastructures. If you are planning an installation in a new building, a strictly IP solution offers the greatest potential for savings. It allows you to dispense with separate voice communication cabling for the building. Your data network transports your voice communications (VoIP), your data, your fax transmissions (Fax over IP) and your multimedia applications (Video over IP). A gateway serves as your interface with the world of public switched telephone networks (PSTN). The use of VoIP blurs the line between telephony and informatics. 4

5 What are the inherent risks of Voice over IP? Telephones are still the main link with the world for most public authorities and governments. With telephony developing at such a fast pace, it is important to be aware at all times of the threats that VoIP can pose. Anyone who combines telephony with IT also combines its security gaps and multiplies the risks involved! VoIP communication is based on the use of open IT standards. This very fact invites hackers to their damaging and unwanted mischief. Hackers record calls as audio files to listen to them later. They reroute calls or conduct them under false identities, generate false engaged tones or switch manipulated waiting queues. Damaging programs for these purposes can easily be found on the Internet and downloaded by anyone for free. It is therefore essential that anyone who has planned or is planning to use VoIP has to devise a security plan. IP HC

6 Configuration examples for secure Voice over IP Encryption in a virtual user scenario VIP Office Headquarters VIP Office SAT Dish Router (ISP) IP-Telephony Gateway Firewall PBX IP-PBX Telephone Telephone Security Management Centre Secure LAN Trusted LAN PSTN

7 Satellite Router (ISP) VIP Office SAT Dish Untrusted Network Secure LAN IP NETWORK Branch Office Router (ISP) Secure LAN Small Branch Office

8 Real security in a virtual world The confidentiality, integrity and authenticity of your data and information have to be guaranteed at all times. That is especially true if you send calls (VoIP), faxes (FoIP) or data over networks. has just the solution for you: IP. What may at first sound highly technical is in fact very easy to use: IP uses public or private networks as means of transport, but all the while the data and voice communication (VoIP) are being transmitted, this function keeps them absolutely unreadable, inaccessible and free of attack for anyone trying to read along or eavesdrop. You merely switch the IP unit between your IP telephone and the LAN connection of your network, and Security Architecture from IP units from implement encryption in a separate security module, thus protecting your information against any risk of being accessed from the outside. This kind of security solution featuring the same tamper-proof hardware found throughout the IP VPN portfolio of also protects your information from internal dangers within your own network. This means the encryption process itself is likewise protected from unauthorised access and manipulation. Hardwarebased encryption as offered by is therefore your best guarantee of maximum security. You will be amazed how simple the installation, security management and operation of a maximum-security network can be! incomparable end-to-end security is yours. Each Ethernet-capable IP telephone, IP fax or PC is guaranteed to function flawlessly. Public authorities and the military have been making use of these kinds of encryption solutions from for years. Rack equipment supplement encryption for the entire IP data communications at nodes in the network or in computing centres at headquarters. For IT infrastructure, this means that network performance is not impaired at all by the integration of an IP VPN Encryption solution from. They can encrypt all connections in cryptological groups with separate keys. 8

9 Security management: centralised, efficient and convenient A convenient and customisable management of security functions is a decisive factor for end-to-end security and substantially increases the system efficiency of your network. With the computer-based Security Management Centre (SMC) from, you can carry out all management tasks quickly and conveniently right from your screen. That allows you, among other things, to distribute keys online and offline in an encrypted process, to set up cryptological groups, to manage authorised relationships among network participants and groups of participants and to include or exclude units in or from your security arrangements. Keys are changed automatically at a date and time you can set (using the Message Scheduler function). The uninterrupted operation of your network is guaranteed throughout the key changes. Your data is afforded comprehensive protection on the SMC thanks to the encrypted saving of information (local security), the encrypted exchange of keys and the Message Scheduler. With the Security Management Centre from, you manage your network security at the same security level as IP from protects your voice communications. Security Management Centre SMC-1100 IP VPN 9

10 To Remain Sovereign is your expert partner for the efficient and secure handling of information. As a legally and economically independent Swiss company, we are not subject to any export restrictions. We have been concentrating on developing, manufacturing and implementing custom security solutions for over 50 years. Our range comprises the latest technology and comprehensive services. After-sales service and product training that guarantee autonomous operation and high availability are assured over the system s entire lifetime, whatever the user environment. You too can rely on the expertise and capability of. Customers from over 130 countries are already doing just that., Headquarters P.O. Box 460 CH-6301 Zug Switzerland Tel Fax crypto@crypto.ch Branch Offices Abidjan 01 B.P Abidjan 01 Ivory Coast Tel Fax Abu Dhabi Regional Office Middle East P.O. Box Abu Dhabi United Arab Emirates Tel Fax Buenos Aires Maipu 1256 PB A 1006 Buenos Aires Argentina Tel Fax Kuala Lumpur Regional Office Pacific Asia No. 2 Jalan SS7/11 Kelana Jaya Petaling Jaya Malaysia Tel Fax Muscat Regional Office Seeb PC 111 Sultanate of Oman Tel Fax CP-VoIP E/0645