Secure Call Implementation; Enabling Secure Calls; Secure Call Details - Linksys SPA1001 Administrator User Manual

Secure Call Implementation

Secure Call Implementation
This section describes secure call implementation with a Linksys ATA. It includes the following topics:
•
•
•
•

Enabling Secure Calls

A secure call is established in two stages. The first stage is no different from normal call setup. The
second stage starts after the call is established in the normal way with both sides ready to stream RTP
packets. I
In the second stage, the two parties exchange information to determine if the current call can switch over
to the secure mode. The information is transported by base64 encoding embedded in the message body
of SIP INFO requests, and responses using a proprietary format. If the second stage is successful, the
Linksys ATA plays a special Secure Call Indication Tone for a short time to indicate to both parties that
the call is secured and that RTP traffic in both directions is being encrypted.
If the user has a phone that supports call waiting caller ID (CIDCW) and that service is enabled, the CID
will be updated with the information extracted from the Mini-Certificate received from the remote party.
The Name field of the CID will be prepended with a '$' symbol. Both parties can verify the name and
number to ensure the identity of the remote party.
The signing agent is implicit and must be the same for all Linksys ATAs that communicate securely with
each other. The public key of the signing agent is pre-configured into the Linksys ATA by the
administrator and is used by the Linksys ATA to verify the Mini-Certificate of its peer. The
Mini-Certificate is valid if it has not expired, and it has a valid signature.
The Linksys ATA can be configured so that, by default, all outbound calls are either secure or not secure.
If secure by default, the user has the option to disable security when making a call by dialing *19 before
dialing the target number. If not secure by default, the user can make a secure outbound call by dialing
*18 before dialing the target number. However, the user cannot force inbound calls to be secure or not
secure; that depends on whether the caller has security enabled or not.
The Linksys ATA will not switch to secure mode if the CID of the called party from its Mini-Certificate
does not agree with the user-id used in making the outbound call. The Linksys ATA performs this check
after receiving the Mini-Certificate of the called party

Secure Call Details

Looking at the second stage of setting up a secure call in greater detail, this stage can be further divided
into two steps.
1.
Linksys ATA Administrator Guide
3-10
Enabling Secure Calls, page 3-10
Secure Call Details, page 3-10
Using a Mini-Certificate, page 3-11
Generating a Mini-Certificate, page 3-11
The caller sends a "Caller Hello" message (base64 encoded and embedded in the message body of
a SIP INFO request) to the called party with the following information:
Message ID (4B)
•
Version and flags (4B)
•
SSRC of the encrypted stream (4B)
•
Chapter 3 Configuring Linksys ATAs
Document Version 3.1