NIST Reports on VoIP Security
by M. E. Kabay, PhD, CISSP
Associate Professor, Information Assurance
Norwich University, Northfield VT
Voice over IP (VoIP) technology digitizes sound and sends the data stream in packets through
the Internet. One would think at first that normal network security technologies would suffice to
protect the packet stream against interference. Unfortunately, voice transmission imposes timing
constraints on the data stream; if packets are not received quickly enough to ensure
reconstitution in the right order in real-time, people will perceive the sound as distorted.
International standards have set an upper bound of 150 ms on the delay (latency) in packet
delivery; this requirement imposes severe demands on the throughput of security equipment and
software – demands that exceed the norms common to data processing applications for networks.
D. Richard Kuhn and Thomas J. Walsh of the National Institute of Standards and Technology
and Steffen Fries of Siemens AG publish the final version of NIST Special Publication 800-58
in January 2005. I usually like the NIST SPs, but this one is particularly thorough and wellwritten.
After a brief introduction of the project scope (Chapter 1), the authors turn to an overview of
VoIP technology (Chapter 2) and then discuss the fundamentals of quality of service (QoS)
including latency, jitter (irregular delivery of bursts of packets followed by gaps in the
transmission), packet loss, effective bandwidth (much reduced in practice from the theoretical
bandwidth) and resilience (power failure backups, secondary systems) and susceptibility to
denial-of-service (DoS) attacks.
Chapter 4 reviews the International Telecommunication Union (ITU) standard H.323 that
specifies details of audio and video communications across packet networks. The authors
provide definitions, diagrams and summaries of the protocols involved in different types of calls.
They review security profiles and end with encryption issues (performance is a constant
problem to consider).
Chapter 5 deals with Session Initiation Protocol (SIP), the Internet Engineering Task Force
(IETF) standard used for VoIP. As in Chapter 4, the authors present the fundamental
architecture and terminology of SIP. They then review several aspects of security features
already integrated into SIP.
Chapters 6, 7, and 8 summarize the technological infrastructure of VoIP including specialized
gateways, firewalls, network address translation (NAT), call initiation, encryption and IPsec.
Chapter 9, “Solutions to the VOIPsec Issues,” discusses the following approaches:
 Encryption at the End Points
 Secure Real Time Protocol (SRTP)
 Key Management for SRTP – MIKEY
 Better Scheduling Schemes


Compression of Packet Size
Resolving NAT/IPsec Incompatibilities.
The final chapter is entitled “Planning for VOIP Deployment.” One of the most interesting
sections is a brief warning about the privacy implications of VoIP technology. The caller’s voice
is being carried over data networks and so there is some confusion over precisely which legal
privacy protections apply to these transmissions.
The authors end on a cautionary note:
“The construction of a VOIP network is an intricate procedure that should be studied in great
detail before being attempted. New risks can be introduced, and vulnerabilities of data packet
networks appear in new guises for VOIP . . . . The integration of a VOIP system into an already
congested or overburdened network could be catastrophic for an organization’s technology
infrastructure. There is no easy “one size fits all” solution to the issues discussed in these
chapters. . . . VOIP can be done securely, but the path is not smooth. It will likely be several
years before standards issues are settled and VOIP systems become a mainstream commodity.
Until then, organizations must proceed cautiously, and not assume that VOIP components are
just more peripherals for the local network. Above all, it is important to keep in mind the unique
requirements of VOIP, acquiring the right hardware and software to meet the challenges of VOIP
security.”
***
For further reading
Kuhn, D. R., T. J. Walsh & S. Fries (2005). Security Considerations for Voice Over IP Systems.
NIST SP 800-58.
< http://csrc.nist.gov/publications/nistpubs/800-58/SP800-58-final.pdf >
***
A Master’s degree in the management of information assurance in 18 months of online study
from Norwich University – see
< http://www.msia.norwich.edu/ > for details.
M. E. Kabay, PhD, CISSP is Associate Professor in the Division of Business and Management at
Norwich University in Northfield, VT. Mich can be reached by e-mail at <
mailto:mkabay@norwich.edu >; Web site at < http://www.mekabay.com/index.htm >.
Copyright  2005 M. E. Kabay. All rights reserved.
Permission is hereby granted to Network World to distribute this article at will, to post it without
limit on any Web site, and to republish it in any way they see fit.