Linksys ATA Administration Guide
57
Secure Call Implementation
Secure Call Implementation
This section describes secure call implementation with the ATA device . It includes the following
topics:
•
”Enabling Secure Calls” section on page 57
•
”Secure Call Details” section on page 58
•
”Using a Mini-Certificate” section on page 58
•
”Generating a Mini Certificate” section on page 59
NOTE:
This is an advanced topic meant for experience installers. See also the
LVS Provisioning
Guide
.
Enabling Secure Calls
A secure call is established in two stages. The first stage is no different from normal call setup.
The second stage starts after the call is established in the normal way with both sides ready to
stream RTP packets.
In the second stage, the two parties exchange information to determine if the current call can
switch over to the secure mode. The information is transported by base64 encoding embedded
in the message body of SIP INFO requests, and responses using a proprietary format. If the
second stage is successful, the ATA device plays a special Secure Call Indication Tone for a short
time to indicate to both parties that the call is secured and that RTP traffic in both directions is
being encrypted.
If the user has a phone that supports call waiting caller ID (CIDCW) and that service is enabled,
the CID will be updated with the information extracted from the Mini-Certificate received from
the remote party. The Name field of the CID will be prepended with a ‘$’ symbol. Both parties
can verify the name and number to ensure the identity of the remote party.
The signing agent is implicit and must be the same for all ATAs that communicate securely with
each other. The public key of the signing agent is pre-configured into the ATA device by the
administrator and is used by the ATA device to verify the Mini-Certificate of its peer. The Mini-
Certificate is valid if it has not expired, and it has a valid signature.
The ATA device can be configured so that, by default, all outbound calls are either secure or not
secure. If secure by default, the user has the option to disable security when making a call by
dialing *19 before dialing the target number. If not secure by default, the user can make a
secure outbound call by dialing *18 before dialing the target number. However, the user cannot
force inbound calls to be secure or not secure; that depends on whether the caller has security
enabled or not.
The ATA device will not switch to secure mode if the CID of the called party from its Mini-
Certificate does not agree with the user-id used in making the outbound call. The ATA device
performs this check after receiving the Mini-Certificate of the called party