Mitel MiVOICE BUSINESS, Engineering Manualline

Page: 356 / 381

Engineering Guidelines
342
When the data is encrypted, it is simply replaced with a scrambled version. This is a 1 for 1
transformation, so there are no additional bytes. As a result, the bandwidth is the same for
encrypted or non-encrypted information. This is NOT true for Secure RTP (SRTP) which
appends either 4 or 10 bytes to the voice payload depending on the cipher mode used. See
“Voice streaming security (SRTP)” on page 343.
For the signalling information, there are some additional messages related to setting up the
secure connections. However, these are minimal when compared to the remainder of the
signalling bandwidth, which is already quite low. For voice information the bandwidth remains
the same for both encrypted and unencrypted payloads.
As an analogy, the encryption can be considered as simply another voice CODEC or an
additional process in the voice-streaming path. For voice streaming, G.711 and G.729 CODECs
are often used. The encryption merely makes these secure, so the result is a secure-G.711 and
a secure-G.729 CODEC. The bit rate remains the same, as does the network bandwidth
requirements.
Figure 59: Unsecured vs Secured Connection
SIGNALLING AND MEDIA PATHS
Media and signalling path encryption is supported for all of Mitel's IP phones on the 3300 ICP.
Media path encryption is accomplished with Secure RTP using 128-bit Advanced Encryption
Standard (AES). Encryption is backwards compatible to support both currently shipping
desktops and previously deployed Mitel IP desktops. Mitel provides encryption of the media
path between multiple 3300 ICPs using the Secure Sockets Layer (SSL) protocol. This allows
scalability of applications by configuring 3300 ICPs into clusters or deploying them as part of
a centrally managed but distributed architecture.
The signalling path is generally between the controller and the IP Phone or other end-device.
This path is established as a secure connection. Signalling information is interpreted within the
controller. Where a message needs to be sent to another controller, such as with IP-Networking,
or to another end device, an independent secure connection is used. Thus a call between two
phones on two controllers will require the establishment of three secure signalling channels,
that is, a secure connection at each controller and one between the controllers.