Cisco 2901

Media authentication and encryption features on the Cisco Systems ® portfolio of integrated services routers help ensure that voice conversations are protected from eavesdropping information theft media tampering toll fraud denial of service and other attacks.

The Cisco ® Unified Communications system of voice video and IP communications products and applications enables organizations to communicate more effectively-enabling them to streamline business processes reach the right resource the first time and impact the top and bottom line. The Cisco Unified Communications portfolio is an integral part of the Cisco Business Communications Solution-an integrated solution for organizations of all sizes which also includes network infrastructure security and network management products wireless connectivity and a lifecycle services approach along with flexible deployment and outsourced management options end-user and partner financing packages and third party communications applications.

Product Overview
Businesses are moving to IP communications to reduce operational expenses increase productivity and simplify network administration. The Cisco integrated services router portfolio i.e. Cisco 1861 Cisco 2800 Series Cisco 2900 Series Cisco 3800 Series Cisco 3900 Series and VG-2xx Series platforms deliver powerful and scalable Unified Communications solutions for the most demanding enterprise environments.

A wide range of Unified Communications security features are available on Cisco integrated services routers to deliver high levels of security protection for businesses deploying IP communications solutions. The Cisco multilayer offering based on the self-defending network model starts with the network itself and extends to the endpoints and applications. The SAFE Blueprint from Cisco presents a detailed framework of best practices and tools to help secure business networks.
Media encryption using Secure Real-Time Transport Protocol (SRTP) delivers protection by encrypting the voice conversation rendering it unintelligible to internal or external eavesdroppers who have gained access to the voice domain. Designed for voice packets SRTP supports the AES encryption algorithm and is an IETF RFC 3711 standard.

Media encryption on Cisco routers works together with Cisco Unified Communications Manager (CUCM) software and the media encryption feature on Cisco Unified IP phones to secure both gateway-to-gateway calls and IP phone-to-gateway calls. This enables secure analog phone calls secure fax calls or secure calls among IP Phones and/or between an IP phone and the gateway depending on the gateway interface type the media is terminated on. Voice encryption keys derived by Cisco Unified Communications Manager are securely sent by encrypted signaling path to Cisco Unified IP phones and Cisco Unified Border Element (CUBE) through the use of Transport Layer Security (TLS) and to gateways over IP Security (IPSec) protected links.

Media encryption features on Cisco routers are available beginning with Cisco IOS ® Software release 12.3(11)T2 on 1861 & 2800/3800 series platforms with an upgrade to the Advanced Enterprise Services or Advanced IP Services IOS Software Feature Sets and Universal Image release 15.0(1)M on 2900/3900 series platforms with UC and Security License PAK. The features are enabled on digital signal processing modules (DSPs) available on the PVDM2 PVDM3 and some NMs.

Applications
Media authentication and encryption on Cisco integrated services routers together with media encryption on Cisco Unified IP phones and Cisco Unified Communications Manager provides a highly secure environment for IP communications across a WAN or LAN. As illustrated in Figure 1 SRTP is used to encrypt voice calls placed on voice gateway network modules in branch office A. This provides secure calls from analog phone to analog phone or fax machine to fax machine within the office. Similarly secure calls are enabled from time-division multiplexing (TDM) endpoints or analog phones at branch office A to Cisco Unified IP phones at the headquarters. The signaling between the gateway at branch office A and Cisco Unified Communications Manager is secured using IPSec and the signaling between the IP phones at headquarters and Cisco Unified Communications Manager is secured using TLS.

Key Features and Benefits

Media Authentication and Encryption
Media encryption currently delivers end-to-end encryption for voice calls between Cisco Unified IP phones. The introduction of media encryption on Cisco routers adds the ability to place secure IP phone-to-gateway and gateway-to-gateway calls. Callers can now place encrypted calls to the PSTN gateway using IETF RFC3711 standards-based SRTP. SRTP encrypts only the payload of a voice packet without adding additional encryption headers. Because of this an SRTP-encrypted voice packet is almost indistinguishable from an RTP voice packet allowing features like quality of service (QoS) and compressed RTP to be supported without any additional development or packet manipulation. In addition SRTP uses the largest practical key size supported by the AES encryption standard for increased security. Voice encryption keys are generated for each call ensuring a higher level of security protection. Media authentication also validates the identity of the devices encrypting the calls.
Media encryption using SRTP is suitable for voice privacy and confidentiality on the LAN to protect against internal threats. In addition media encryption can also be delivered across an IP WAN or the Internet using the same VPN infrastructure deployed for data.

Signaling Authentication and Encryption
Signaling authentication and encryption between the gateways/CUBE and Cisco Unified Communications Manager is protected using IPSec. This ensures that signaling information such as dual tone multifrequency (DTMF) digits passwords PINs and voice encryption keys are secure. Both software-based IPSec available in Cisco IOS Software and hardware-based IPSec using the AIM-VPN modules are supported.

Scalability of Encrypted Calls
SRTP media encryption is performed on DSP modules and not on the router CPU. This enables efficient scalability as increasing the number of voice gateway interfaces with DSPs or increasing the number of DSPs integrated on the platforms (such as on the integrated services routers) increases the number of DSPs available for secure calls.

Efficient Delay Optimization and Channel Capacity Impact
No additional call setup delays are introduced with encrypted calls as the key exchange is completed as part of the normal call setup and no extra messages are introduced. Voice media delay is also not introduced because SRTP media encryption is performed in the DSP and not by the router CPU or a separate encryption engine that processes the completed voice packet.

Management Features
Media authentication and encryption is easily configured on Cisco routers using the command-line interface (CLI). In addition features such as a lock icon indicator on Cisco IP Phones provide visual confirmation of encryption in calls to supported gateways. If a device within the call flow does not support media encryption or the security is compromised the lock icon disappears. CLI commands are also available to confirm and provide details about an encrypted call and to debug calls.

Security in Cisco Unified Survivable Remote Site Telephony Mode
Cisco Unified Survivable Remote Site Telephony provides call processing redundancy when connectivity to Cisco Unified Communications Manager is lost. Media authentication and encryption is supported in Cisco Unified Survivable Remote Site Telephony mode beginning with Cisco IOS Software release 12.3(14)T for ISR and 15.0(1)M for ISR-G2 providing the ability to place secure calls within a remote branch office when the WAN link or Cisco Unified Communications Manager goes down. When the WAN link or Cisco Unified Communications Manager is restored Cisco Unified Communications Manager resumes secure call handling capabilities. The signaling from the Cisco Unified Survivable Remote Site Telephony router to the IP phones is encrypted using TLS.

SRTP AND IPSEC VPNS
SRTP and IPSec are complementary VPN technologies. One of the key differences is that SRTP can deliver encryption from end to end that is from IP phone to IP phone whereas IPSec VPN is a router-to-router tunnel-based encryption. In addition SRTP encrypts only voice packets whereas IPSec VPN tunnels can transport data voice and video (and thus are called V3PN).

This means that SRTP can add additional protection for voice traffic using an IPSec VPN.
For enterprises and small and medium-sized businesses that have a trusted WAN network SRTP can be used to encrypt voice end to end across this network. However most of these businesses conduct business across the Internet or across a WAN that is managed by a service provider. Therefore the WAN may be insecure and a VPN tunnel is used to transport data securely between branch offices. SRTP can be used to secure voice in the WAN across the same IPSec VPN network that is used for data