Encrypting the Media:
For encrypting the media, 256-bit Advanced Encryption Standard (AES-256) is used.
AES-256 specifies a cryptographic algorithm using a symmetrical block cipher that can
process data blocks of 128 bits with 256bit chipper key (crypto key) which is agreed by
Diffie-Hellman procedure. Audio samples are collected from the codec, they are
encrypted, and inserted into the RTP payloads.
When the receiving side gets RTP payloads, the decrypting occurs.
A secure contact would be by generating and exchanging shared Diffie-Hellman half-
keys. Diffie-Hellman master key for the AES-256 encryption is generated from the
combination of the two shared half keys exchanged by two Telesis systems involved in
a call.
Diffie-Hellman key exchange:
Telesis systems exchange Diffie-Hellman half keys using authentication based on
H.235 Baseline Security Profile with or without integrity check. This prevents Man-in-
the-Middle (MIM) attacks and communicating systems can be sure with whom they
share the Diffie-Hellman half keys. Hash algorithm for H.235 Baseline Security Profile
or H.235 Baseline Security Profile with integrity check is HMAC-SHA1-96. Exchange
of HMAC-SHA1-96 hashed Diffie-Hellman halfs keys provides additional security.
Key exchange occurs during H323 call signaling (H.225) messaging between two
systems for end-to-end communication. First call signaling message in both direction
are used in key exchange. Setup message is used in forward direction. Setup
Acknowledge, Call proceeding, Alerting or Connect message can be used in reverse
direction. Since, the authentication keyed by the password, which is a secret in two
systems, it may be open to MIM attacks if simple passwords are chosen. Telesis
systems allow Diffie-Hellman half key exchange provided that a sufficiently long
password is selected. In the following cases, the call fails before connect.
•
Authentication failure
•
Authentication but missing half key in Setup message
•
Authentication but missing half key in one of Setup Acknowledge, Call
proceeding, Alerting or Connect messages
Summary:
Security of VoIP communication between two Telesis systems is ensured with:
•
A sufficiently long password
•
Baseline Security Profile for RAS messaging for H.323 endpoint-to-gatekeeper
registration
•
Baseline Security Profile for Call Signaling for secure Diffie-Hellman key
exchange.
•
Exchange of HMAC-SHA1-96 hashed Diffie-Hellman half keys
•
Cipher AES-256
H.323 AND SIP INTEGRATION
Description:
Telesis PX24U/PX24M Hybrid IP PBX systems support for SIP and H.323 protocols.
Both protocols coexist on the same Telesis PX24U/PX24M Hybrid IP PBX system. SIP
and H.323 calls may originate and terminate in the same system. Furthermore, Telesis
PX24U/PX24M Hybrid IP PBX systems allow calls from SIP based devices to be
routed to H.323 based devices and vice versa. With this interoperability, enterprises
may have the ability to use both protocols in the same network.
General Capabilities:
Telesis PX24U/PX24M Hybrid IP PBX systems can register to both SIP registrar and
H.323 gatekeeper at the same time. This allows address resolution of a Telesis PX24U/
PX24M Hybrid IP PBX system from either side and results in flexibility for multi-path
VoIP access applications. Furthermore, Telesis PX24U/PX24M Hybrid IP PBX systems
may have both integrated H.323 gatekeeper and external gatekeeper registration
capability at the same time. Similarly, they may have both integrated SIP registrar and
external registrar registration capability at the same time. Coexistence of all these
capabilities allows:
•
SIP users to call SIP users in private address space
•
SIP users to call H.323 users in private address space
•
SIP users to call SIP entities in public network
•
SIP users to call H.323 entities in public network
25
Summary of Contents for PX24M
Page 1: ...PX24U PX24M HYBRID IP PBXs...
