Securing an IMS-based VoIP network with multiple VPNs

#The present disclosure applies to networks used for communication. Networks that are used for voice over Internet protocol (VoIP) can be implemented using technologies and methodologies that provide voice communications between users in one or more connected networks. However, vulnerabilities in VoIP networks can cause security concerns. Breaches in security can cause, for example, distributed denial of service (DDoS) attacks, eavesdropping, and privacy issues.

#The present disclosure describes techniques that can be used for securing an Internet protocol (IP) Multimedia Subsystem (IMS)-based voice over IP (VoIP) network with multiple virtual private networks (VPNs). In some implementations, a computer-implemented system includes one or more processors and a non-transitory computer-readable storage medium coupled to the one or more processors. The non-transitory computer-readable storage medium stores programming instructions for execution by the one or more processors, the programming instructions instructing the one or more processors to perform operations. The operations include the following. Using separate Internet protocol (IP) routing and forwarding domains, security is provided for an IP multimedia subsystem (IMS)-based voice over IP (VoIP) network. Providing security includes: encrypting messages between user endpoints (UEs) and a session border controller (SBC); routing signaling for a call between a first UE and a second UE through the SBC; and routing media flows for the call between the first UE and the second UE through the SBC for further messaging.

#In some implementations, a computer-implemented method includes the following. A call sent by a first user endpoint (UE) to a second UE is received by a SBC. The SBC provides security for an IMS-based VoIP network and controls traffic between a first VPN connecting IMS core servers, a second VPN connecting IP phones, and a third VPN connecting non-IP-phone devices (including analog phones, for example). The call originates from either of the second VPN connecting the IP phones or from the third VPN connecting the non-IP-phone devices. A signaling for the call is encrypted and routed by the SBC to the second UE. A media flow for the call is encrypted and routed by the SBC through the third VPN before routing the call to the second UE.

#FIG. 1 is a block diagram showing an example of an architecture for message traffic in an IP network, according to some implementations of the present disclosure.

#FIG. 2 is a block diagram showing an example of an architecture for message traffic in an IP network using a firewall, according to some implementations of the present disclosure.

#FIG. 3 is a block diagram showing an example of an architecture for message traffic using closed virtual private networks (VPNs), according to some implementations of the present disclosure.

#Like reference numbers and designations in the various drawings indicate like elements.

#The following detailed description describes techniques for securing an Internet protocol (IP) multimedia subsystem (IMS)-based voice over IP (VoIP) network with multiple virtual private networks (VPNs). Various modifications, alterations, and permutations of the disclosed implementations can be made and will be readily apparent to those of ordinary skill in the art, and the general principles defined may be applied to other implementations and applications, without departing from scope of the disclosure. In some instances, details unnecessary to obtain an understanding of the described subject matter may be omitted so as to not obscure one or more described implementations with unnecessary detail and inasmuch as such details are within the skill of one of ordinary skill in the art. The present disclosure is not intended to be limited to the described or illustrated implementations, but to be accorded the widest scope consistent with the described principles and features.

#Techniques of the present disclosure include the use of multiprotocol label switching (MPLS) Layer 3 VPN techniques for securing a 3rd-generation partnership project (3GPP) IMS-based VoIP network. The network can provide geographically redundant core call processing sites in an enterprise network. The techniques can take advantage of Layer-3 level segregation provided by the MPLS technologies. The segregation can exist while keeping existing security measures (encryption and network firewalls) in place. The core (main) IMS call processing sites can be isolated in a dedicated MPLS Layer-3 VPN architecture. Users can be contained in separate VPNs, depending on the level of security controls established in their local environments. Furthermore, the techniques can require that last-mile signaling and media traffic be encrypted. The media traffic can include traffic between the user endpoints (UEs), such as traffic between IP phones and a perimeter security device (for example, a session border controller (SBC)).