Telephony security system

• US 20040161086A1
• Filed: 02/13/2004
• Published: 08/19/2004
• Est. Priority Date: 12/11/1998
• Status: Active Grant

• Current Assignee: SecureLogix Corporation
• Original Assignee: SecureLogix Corporation
• Inventors: Pickens, Keith S., Buntin, David L.
• Granted Patent: US 7,133,511 B2
• Time in Patent Office: Days
• US Class Current: 379/189
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/5058 Service discovery by the service manager
• CPC Class Codes: H04L 41/5087 wherein the managed service relates to voice services management of VoIP services H04M7/0081
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/1079 of unsolicited session attempts, e.g. SPIT
• CPC Class Codes: H04M 2203/609 Secret communication
• CPC Class Codes: H04M 2207/203 composed of PSTN and data network, e.g. the Internet
• CPC Class Codes: H04M 2207/35 virtual private networks
• CPC Class Codes: H04M 2242/22 Automatic class or number identification arrangements
• CPC Class Codes: H04M 3/2218 Call detail recording
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 3/38 : Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections queuing arrangements H04Q3/64
• CPC Class Codes: H04M 3/42059 : Making use of the calling party identifier
• CPC Class Codes: H04M 3/42102 : Making use of the called party identifier
• CPC Class Codes: H04M 7/009 : in systems involving PBX or KTS networks
• CPC Class Codes: H04M 7/0093 : signalling arrangements in networks

Abstract

A system and method of telephony resource management and security for monitoring and/or controlling incoming and outgoing calls between an enterprise'"'"'s end-user stations and a public circuit-switched network and/or a public packet-switched network. A security policy is made up of one or more rules designating at least one action to be performed based on at least one attribute of the incoming or outgoing call. Calls are detected and sensed on the line, trunk and/or cabling, and analyzed to determine attributes associated with each call. Actions are performed based upon the determined attributes, in accordance with the security policy rules.

Claims

1. A telephony security system located within one or more locations of an enterprise for monitoring and/or controlling incoming and outgoing calls between a public circuit-switched network for provision of circuit-switched circuits to the public, wherein a physical circuit is temporarily established on demand and kept reserved for the user until the network receives a disconnect signal and one or more end-user stations located within an enterprise'"'"'s one or more locations, said telephony security system comprising:

one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations designating at least one action to be performed based on at least one attribute of an incoming and outgoing call between the public circuit-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said at least one attribute of the incoming and outgoing call between the public circuit-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations is from a group including;

the call direction,

the call source,

the call destination,

the call type,

the keyword detected in the call content,

the call connect time,

the call start date,

the call start time,

the call end date,

the call end time,

the call duration,

the identifier for the extension or direct connect line carrying the call,

the PBX trunk through which the call is processed,

the channel through which the call is processed,

the digits dialed prior to the base phone number, and

the digits dialed after the base phone number;

means for determining said at least one attribute of the incoming and outgoing call between the public circuit-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations; and

means for performing said at least one action in accordance with said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations.

2. The telephony security system as defined in claim 1 wherein said call type attribute is from a group including:

voice,

fax,

data transfer (modem),

STU-III-voice,

STU-III-data,

STU-III-unspecified,

wideband,

wideband video,

busy,

unanswered, and

undetermined.

3. The telephony security system as defined in claim 1 wherein said at least one action is from a group including:

allowing the call,

denying the call,

redirecting the call,

recording the call content,

encrypting the call,

sending a tone,

sending a message,

logging the call,

generating a report, and

providing an alert,

adjusting the security policy, and

performing one or more designated assessments,

said one or more designated assessments including either or both of;

authenticating an inbound call for remote access, and

monitoring the call content for keywords.

4. The telephony security system as defined in claim 3 wherein one or more of said at least one action is performed using a remote management server and/or other peripheral device,

said remote management server and/or other peripheral device performing said one or more of said at least one action from a group including:

logging the call,

recording the call content,

monitoring the call content for keywords,

generating a report,

providing an alert, and

adjusting the security policy.

5. The telephony security system as defined in claim 3 wherein one or more of said at least one action may be preempted and/or complemented by a system administrator manually selecting one or more preemptive/complementary actions from a group including:

allowing the call,

denying the call,

redirecting the call,

logging the call,

recording the call content,

encrypting the call,

generating a report,

providing an alert,

adjusting the security policy, and

performing one or more assessments.

6. The telephony security system as defined in claim 3 wherein said action of generating a report includes generating at least one report from a group including:

a post-event report,

a schedule-generated report,

an ad hoc report,

a batch analysis report,

a trend report, and

a difference/comparison report.

7. The telephony security system as defined in claim 3 wherein said action of generating an alert notification includes generating at least one alert notification from a group including:

an electronic mail notification,

a pager alerting notification,

a console messaging notification, and

a Simple Network Management Protocol (SNMP) trap.

8. A telephony security system located within a public circuit-switched network for monitoring and/or controlling incoming and outgoing calls between a public circuit-switched network for provision of circuit-switched circuits to the public, wherein a physical circuit is temporarily established on demand and kept reserved for the user until the network receives a disconnect signal, and one or more end-user stations located within an enterprise'"'"'s one or more locations, said telephony security system comprising:

one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations designating at least one action to be performed based on at least one attribute of an incoming and outgoing call between the public circuit-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said at least one attribute of the incoming and outgoing call between the public circuit-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations is from a group including;

the call direction,

the call source,

the call destination,

the call type,

the keyword detected in the call content,

the call connect time,

the call start date,

the call start time,

the call end date,

the call end time,

the call duration,

the identifier for the extension or direct connect line carrying the call,

the PBX trunk through which the call is processed,

the channel through which the call is processed,

the digits dialed prior to the base phone number, and

the digits dialed after the base phone number;

means for determining said at least one attribute of the incoming and outgoing call between the public circuit-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations; and

means for performing said at least one action in accordance with said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations.

9. The telephony security system as defined in claim 8 wherein said call type attribute is from a group including:

voice,

fax,

data transfer (modem),

STU-III-voice,

STU-III-data,

STU-III-unspecified,

wideband,

wideband video,

busy,

unanswered, and

undetermined.

10. The telephony security system as defined in claim 8 wherein said at least one action is from a group including:

allowing the call,

denying the call,

redirecting the call,

recording the call content,

encrypting the call,

sending a tone,

sending a message,

logging the call,

generating a report, and

providing an alert,

adjusting the security policy, and

performing one or more designated assessments,

said one or more assessments include either or both of;

authenticating an inbound call for remote access, and

monitoring the call content for keywords.

11. The telephony security system as defined in claim 10 wherein one or more of said at least one action is performed using a remote management server and/or other peripheral device,

said remote management server and/or other peripheral device performing said one or more of said at least one action from a group including:

logging the call,

recording the call content,

monitoring the call content for keywords,

generating a report,

providing an alert, and

adjusting the security policy.

12. The telephony security system as defined in claim 10 wherein one or more of said at least one action may be preempted and/or complemented by a system administrator manually selecting one or more preemptive/complementary actions from a group including:

allowing the call,

denying the call,

redirecting the call,

logging the call,

recording the call content,

encrypting the call,

generating a report,

providing an alert,

adjusting the security policy, and

performing one or more assessments.

13. The telephony security system as defined in claim 10 wherein said action of generating a report includes generating at least one report from a group including:

a post-event report,

a schedule-generated report,

an ad hoc report,

a batch analysis report,

a trend report, and

a difference/comparison report.

14. The telephony security system as defined in claim 10 wherein said action of generating an alert notification includes generating at least one alert notification from a group including:

an electronic mail notification,

a pager alerting notification,

a console messaging notification, and

a Simple Network Management Protocol (SNMP) trap.

15. A method for monitoring and/or controlling incoming and outgoing calls between a public circuit-switched network for provision of circuit-switched circuits to the public, wherein a physical circuit is temporarily established on demand and kept reserved for the user until the network receives a disconnect signal, and one or more end-user stations located within an enterprise'"'"'s one or more locations, said method comprising the following steps to be performed within the public circuit-switched network:

establishing one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations designating at least one action to be performed based on at least one attribute of an incoming and outgoing call between the public circuit-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said at least one attribute of the incoming and outgoing call between the public circuit-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations is from a group including;

the call direction,

the call source,

the call destination,

the call type,

the keyword detected in the call content,

the call connect time,

the call start date,

the call start time,

the call end date,

the call end time,

the call duration,

the identifier for the extension or direct connect line carrying the call,

the PBX trunk through which the call is processed,

the channel through which the call is processed,

the digits dialed prior to the base phone number, and

the digits dialed after the base phone number;

determining said at least one attribute of the incoming and outgoing call between the public circuit-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations; and

performing said at least one action in accordance with said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations.

17. The telephony security system as defined in claim 15 wherein said call type attribute is from a group including:

IP voice,

busy,

unanswered, and

undetermined.

18. The telephony security system as defined in claim 15 wherein said at least one action is from a group including:

allowing the call,

denying the call,

redirecting the call,

recording the call content,

encrypting the call,

sending a tone,

sending a message,

logging the call,

generating a report, and

providing an alert,

adjusting the security policy, and

performing one or more designated assessments,

said one or more assessments include either or both of;

authenticating an inbound call for remote access, and

monitoring the call content for keywords.

19. The telephony security system as defined in claim 18 wherein one or more of said at least one action is performed using a remote management server and/or other peripheral device,

said remote management server and/or other peripheral device performing said one or more of said at least one action from a group including:

logging the call,

recording the call content,

monitoring the call content for keywords,

generating a report,

providing an alert, and

adjusting the security policy.

20. The telephony security system as defined in claim 18 wherein one or more of said at least one action may be preempted and/or complemented by a system administrator manually selecting one or more preemptive/complementary actions from a group including:

allowing the call,

denying the call,

redirecting the call,

logging the call,

recording the call content,

encrypting the call,

generating a report,

providing an alert,

adjusting the security policy, and

performing one or more assessments.

21. The telephony security system as defined in claim 18 wherein said action of generating a report includes generating at least one report from a group including:

a post-event report,

a schedule-generated report,

an ad hoc report,

a batch analysis report,

a trend report, and

a difference/comparison report.

22. The telephony security system as defined in claim 18 wherein said action of generating an alert notification includes generating at least one alert notification from a group including:

an electronic mail notification,

a pager alerting notification,

a console messaging notification, and

a Simple Network Management Protocol (SNMP) trap.

16. A telephony security system located within one or more locations of an enterprise for monitoring and/or controlling incoming and outgoing calls between a public packet-switched network for provision of packet-switched circuits to the public, wherein data is carried in the form of packets and one or more end-user stations located within an enterprise'"'"'s one or more locations, said telephony security system comprising:

one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations designating at least one action to be performed based on at least one attribute of an incoming and outgoing call packet between the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said at least one attribute of the incoming and outgoing call packet between the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations is from a group including;

the call direction,

the call source,

the call destination,

the call type,

the keyword detected in the call content,

call connect time,

the call start date,

the call start time,

the call end date,

the call end time,

the call duration,

the codec used,

the number of bytes from the call source,

the number of bytes from the call destination,

the number of packets from the call source,

the number of packets from the call destination,

source transmission rate,

destination transmissions rate,

source latency,

destination latency,

source jitter,

destination jitter,

source packet loss,

destination packet loss, and

total bandwidth used;

means for determining said at least one attribute of the incoming and outgoing call packet between the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations; and

means for performing said at least one action in accordance with said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations.

23. A method for monitoring and/or controlling incoming and outgoing calls between a public packet-switched network for provision of packet-switched circuits to the public, wherein data is carried in the form of packets and one or more end-user stations located within an enterprise'"'"'s one or more locations, said method comprising the following steps to be performed within one or more locations of an enterprise:

establishing one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations designating at least one action to be performed based on at least one attribute of an incoming and outgoing call packet between the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said at least one attribute of the incoming and outgoing call packet between the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations is from a group including;

the call direction,

the call source,

the call destination,

the call type,

the keyword detected in the call content,

call connect time,

the call start date,

the call start time,

the call end date,

the call end time,

the call duration,

the codec used,

the number of bytes from the call source,

the number of bytes from the call destination,

the number of packets from the call source,

the number of packets from the call destination,

source transmission rate,

destination transmissions rate,

source latency,

destination latency,

source jitter,

destination jitter,

source packet loss,

destination packet loss, and

total bandwidth used;

determining said at least one attribute of the incoming and outgoing call packet between the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations; and

performing said at least one action in accordance with said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations.

24. A telephony security system located within a public-switched network for monitoring and/or controlling incoming and outgoing calls between a public packet-switched network for provision of packet-switched circuits to the public, wherein data is carried in the form of packets and one or more end-user stations located within an enterprise'"'"'s one or more locations, said telephony security system comprising:

one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations designating at least one action to be performed based on at least one attribute of an incoming and outgoing call packet between the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said at least one attribute of the incoming and outgoing call packet between the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations is from a group including;

the call direction,

the call source,

the call destination,

the call type,

the keyword detected in the call content,

the call connect time,

the call start date,

the call start time,

the call end date,

the call end time,

the call duration,

the codec used,

the number of bytes from the call source,

the number of bytes from the call destination,

the number of packets from the call source,

the number of packets from the call destination,

source transmission rate,

destination transmission rate,

source latency,

destination latency,

source jitter,

destination jitter,

source packet loss,

destination packet loss, and

total bandwidth used;

means for determining said at least one attribute of the incoming and outgoing call packet between the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations; and

means for performing said at least one action in accordance with said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations.

25. The telephony security system as defined in claim 24 wherein said call type attribute is from a group including:

IP voice,

busy,

unanswered, and

undetermined.

26. The telephony system as defined in claim 24 wherein said at least one action is from a group including:

allowing the call,

denying the call,

redirecting the call,

recording the call content,

encrypting the call,

sending a tone,

sending a message,

logging the call,

generating a report, and

providing an alert,

adjusting the security policy, and

performing one or more designated assessments,

said one or more designated assessments including either or both of;

authenticating an inbound call for remote access, and

monitoring the call content for keywords.

27. The telephony security system as defined in claim 26 wherein one or more of said at least one action is performed using a remote management server and/or other peripheral device,

said remote management server and/or other peripheral device performing said one or more of said at least one action from a group including:

logging the call,

recording the call content,

monitoring the call content for keywords,

generating a report,

providing an alert, and

adjusting the security policy.

28. The telephony security system as defined in claim 26 wherein one or more of said at least one action may be preempted and/or complemented by a system administrator manually selecting one or more preemptive/complementary actions from a group including:

allowing the call,

denying the call,

redirecting the call,

logging the call,

recording the call content,

encrypting the call,

generating a report,

providing an alert,

adjusting the security policy, and

performing one or more assessments.

29. The telephony security system as defined in claim 26 wherein said action of generating a report includes generating at least one report from a group including:

a post-event report,

a schedule-generated report,

an ad hoc report,

a batch analysis report,

a trend report, and

a difference/comparison report.

30. The telephony security system as defined in claim 26 wherein said action of generating an alert notification includes generating at least one alert notification from a group including:

an electronic mail notification,

a pager alerting notification,

a console messaging notification, and

a Simple Network Management Protocol (SNMP) trap.

31. A telephony security system located within one or more locations of an enterprise for monitoring and/or controlling incoming and outgoing calls between a public circuit-switched network for provision of circuit-switched circuits to the public, wherein a physical circuit is temporarily established on demand and kept reserved for the user until the network receives a disconnect signal and/or a public packet-switched network for provision of packet-switched circuits to the public, wherein data is carried in the form of packets and one or more end-user stations located within an enterprise'"'"'s one or more locations, said telephony security system comprising:

one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations designating at least one action to be performed based on at least one attribute of an incoming and outgoing call and/or call packet between the public circuit-switched network and/or the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said at least one attribute of the incoming and outgoing call and/or call packet between the public circuit-switched network and/or the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations is from a group including;

the call direction,

the call source,

the call destination,

the call type,

the keyword detected in the call content,

the call connect time,

the call start date,

the call start time,

the call end date,

the call end time,

the call duration,

the identifier for the extension or direct connect line carrying the call,

the PBX trunk through which the call is processed,

the channel through which the call is processed,

the digits dialed prior to the base phone number,

the digits dialed after the base phone number,

the codec used,

the number of bytes from the call source,

the number of bytes from the call destination,

the number of packets from the call source,

the number of packets from the call destination,

source transmission rate,

destination transmission rate,

source latency,

destination latency,

source jitter,

destination jitter,

source packet loss,

destination packet loss, and

total bandwidth used;

means for determining said at least one attribute of the incoming and outgoing call and/or call packet between the public circuit-switched network and/or the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations; and

means for performing said at least one action in accordance with said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations.

32. The telephony security system as defined in claim 31 wherein said call type attribute is from a group including:

voice,

fax,

data transfer (modem),

STU-III-voice,

STU-III-data,

STU-III-unspecified,

wideband,

wideband video

IP voice,

busy,

unanswered, and

undetermined.

33. The telephony security system as defined in claim 31 wherein said at least one action is from a group including:

allowing the call,

denying the call,

redirecting the call,

recording the call content,

encrypting the call,

sending a tone,

sending a message,

logging the call,

generating a report, and

providing an alert,

adjusting the security policy, and

performing one or more designated assessments,

said one or more designated assessments including either or both of;

authenticating an inbound call for remote access, or

monitoring the call content for keywords.

34. The telephony security system as defined in claim 33 wherein one or more of said at least one action is performed using a remote management server and/or other peripheral device,

said remote management server and/or other peripheral device performing said one or more of said at least one action from a group including:

logging the call,

recording the call content,

monitoring the call content for keywords,

generating a report,

providing an alert, and

adjusting the security policy.

35. The telephony security system as defined in claim 33 wherein one or more of said at least one action may be preempted and/or complemented by a system administrator manually selecting one or more preemptive/complementary actions from a group including:

allowing the call,

denying the call,

redirecting the call,

logging the call,

recording the call content,

encrypting the call,

generating a report,

providing an alert,

adjusting the security policy, and

performing one or more assessments.

36. The telephony security system as defined in claim 33 wherein said action of generating a report includes generating at least one report from a group including:

a post-event report,

a schedule-generated report,

an ad hoc report,

a batch analysis report,

a trend report, and

a difference/comparison report.

37. The system as defined in claim 33 wherein said action of generating an alert notification includes generating at least one alert notification from a group including:

an electronic mail notification,

a pager alerting notification,

a console messaging notification, and

a Simple Network Management Protocol (SNMP) trap.

38. A method for monitoring and/or controlling incoming and outgoing calls between a public circuit-switched network for provision of circuit-switched circuits to the public, wherein a physical circuit is temporarily established on demand and kept reserved for the user until the network receives a disconnect signal and/or a public packet-switched network for provision of packet-switched circuits to the public, wherein data is carried in the form of packets and one or more end-user stations located within an enterprise'"'"'s one or more locations, said method comprising the following steps to be performed within one or more locations of an enterprise:

establishing one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations designating at least one action to be performed based on at least one attribute of an incoming and outgoing call and/or call packet between the public circuit-switched network and/or the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said at least one attribute of the incoming and outgoing call and/or call packet between the public circuit-switched network and/or the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations is from a group including;

the call direction,

the call source,

the call destination,

the call type,

the keyword detected in the call content,

the call connect time,

the call start date,

the call start time,

the call end date,

the call end time,

the call duration,

the identifier for the extension or direct connect line carrying the call,

the PBX trunk through which the call is processed,

the channel through which the call is processed,

the digits dialed prior to the base phone number,

the digits dialed after the base phone number,

the codec used,

the number of bytes from the call source,

the number of bytes from the call destination,

the number of packets from the call source,

the number of packets from the call destination,

source transmission rate,

destination transmission rate,

source latency,

destination latency,

source jitter,

destination jitter,

source packet loss,

destination packet loss, and

total bandwidth used;

determining said at least one attribute of the incoming and outgoing call and/or call packet between the public circuit-switched network and/or the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations; and

performing said at least one action in accordance with said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations.

45. The telephony security system as defined in claim 38 wherein said action of generating an alert notification includes generating at least one alert notification from a group including:

an electronic mail notification,

a pager alerting notification,

a console messaging notification, and

a Simple Network Management Protocol (SNMP) trap.

39. A telephony security system located within either a public circuit-switched network and/or a public packet-switched network for monitoring and/or controlling incoming and outgoing calls between the public circuit-switched network and/or the public packet-switched network and one or more end-user stations located within an enterprise'"'"'s one or more locations, said telephony security system comprising:

one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations designating at least one action to be performed based on at least one attribute of an incoming and outgoing call and/or call packet between the public circuit-switched network and/or the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said at least one attribute of the incoming and outgoing call and/or call packet between the public circuit-switched network and/or the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations is from a group including;

the call direction,

the call source,

the call destination,

the call type,

the keyword detected in the call content,

the call connect time,

the call start date,

the call start time,

the call end date,

the call end time,

the call duration,

the identifier for the extension or direct connect line carrying the call,

the PBX trunk through which the call is processed,

the channel through which the call is processed,

the digits dialed prior to the base phone number,

the digits dialed after the base phone number,

the codec used,

the number of bytes from the call source,

the number of bytes from the call destination,

the number of packets from the call source,

the number of packets from the call destination,

source transmission rate,

destination transmission rate,

source latency,

destination latency,

source jitter,

destination jitter,

source packet loss,

destination packet loss, and

total bandwidth used;

means for determining said at least one attribute of the incoming and outgoing call and/or call packet between the public circuit-switched network and/or the public packet-switched network and the one or more end-user stations located within the enterprise'"'"'s one or more locations; and

means for performing said at least one action in accordance with said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations.

40. The telephony security system as defined in claim 39 wherein said call type attribute is from a group including:

voice,

fax,

data transfer (modem),

STU-III-voice,

STU-III-data,

STU-III-unspecified,

wideband,

wideband video

IP voice,

busy,

unanswered, and

undetermined.

41. The telephony system as defined in claim 39 wherein said at least one action is from a group including:

allowing the call,

denying the call,

redirecting the call,

recording the call content,

encrypting the call,

sending a tone,

sending a message,

logging the call,

generating a report, and

providing an alert,

adjusting the security policy, and

performing one or more designated assessments,

whereby options for said one or more assessments include either or both of;

authenticating an inbound call for remote access, and

monitoring the call content for keywords.

42. The telephony security system as defined in claim 41 wherein one or more of said at least one action is performed using a remote management server and/or other peripheral device,

said remote management server and/or other peripheral device performing said one or more of said at least one action from a group including:

logging the call,

recording the call content,

monitoring the call content for keywords,

generating a report,

providing an alert, and

adjusting the security policy.

43. The telephony security system as defined in claim 41 wherein one or more of said at least one action may be preempted and/or complemented by a system administrator manually selecting one or more preemptive/complementary actions from a group including:

allowing the call,

denying the call,

redirecting the call,

logging the call,

recording the call content,

encrypting the call,

generating a report,

providing an alert,

adjusting the security policy, and

performing one or more assessments.

44. The telephony security system as defined in claim 41 wherein said action of generating a report includes generating at least one report from a group including:

a post-event report,

a schedule-generated report,

an ad hoc report,

a batch analysis report,

a trend report, and

a difference/comparison report.

46. A telephony security system located within one or more locations of an enterprise for centralized monitoring and/or control of incoming and outgoing calls between a first disparate circuit-switched communications network and a second disparate packet-switched communications network and one or more end-user stations located within an enterprise'"'"'s one or more locations, said telephony security system comprising:

one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations designating at least one action to be performed based on at least one attribute of an incoming and outgoing call between the first of the one or more disparate communications networks and/or the second of the one or more disparate communications networks and the one or more end-user stations located within the enterprise'"'"'s one or more locations,

said at least one attribute of the incoming and outgoing call between the first of the one or more disparate communications networks and/or the second of the one or more disparate communications networks and the one or more end-user stations located within the enterprise'"'"'s one or more locations is from a group including;

the call direction,

the call source,

the call destination,

the call type,

the keyword detected in the call content,

the call connect time,

the call start date,

the call start time,

the call end date,

the call end time,

the call duration,

the identifier for the extension or direct connect line carrying the call,

the PBX trunk through which the call is processed,

the channel through which the call is processed,

the digits dialed prior to the base phone number,

the digits dialed after the base phone number,

the codec used,

the number of bytes from the call source,

the number of bytes from the call destination,

the number of packets from the call source,

the number of packets from the call destination,

source transmission rate,

destination transmission rate,

source latency,

destination latency,

source jitter,

destination jitter,

source packet loss,

destination packet loss, and

total bandwidth used;

means for determining said at least one attribute of the incoming and outgoing call between the first of the one or more disparate communications networks and/or the second of the one or more disparate communications networks and the one or more end-user stations located within the enterprise'"'"'s one or more locations; and

means for performing said at least one action in accordance with said one or more rules associated with the one or more end-user stations located within the enterprise'"'"'s one or more locations.

47. The telephony security system as defined in claim 46 wherein said call type attribute is from a group including:

voice,

fax,

data transfer (modem),

STU-III-voice,

STU-III-data,

STU-III-unspecified,

wideband,

wideband video

IP voice,

busy,

unanswered, and

undetermined.

48. The telephony security system as defined in claim 46 wherein said at least one action is from a group including:

allowing the call,

denying the call,

redirecting the call,

recording the call content,

encrypting the call,

sending a tone,

sending a message,

logging the call,

generating a report, and

providing an alert,

adjusting the security policy, and

performing one or more designated assessments,

said one or more designated assessments including either or both of;

authenticating an inbound call for remote access, and

monitoring the call content for keywords.

49. The telephony security system as defined in claim 48 wherein one or more of said at least one action is performed using a remote management server and/or other peripheral device,

said remote management server and/or other peripheral device performing said one or more of said at least one action from a group including:

logging the call,

recording the call content,

monitoring the call content for keywords,

generating a report,

providing an alert, and

adjusting the security policy.

50. The telephony security system as defined in claim 48 wherein one or more of said at least one action may be preempted and/or complemented by a system administrator manually selecting one or more preemptive/complementary actions from a group including:

allowing the call,

denying the call,

redirecting the call,

logging the call,

recording the call content,

encrypting the call,

generating a report,

providing an alert,

adjusting the security policy, and

performing one or more assessments.

51. The telephony security system as defined in claim 48 wherein said action of generating a report includes generating at least one report from a group including:

a post-event report,

a schedule-generated report,

an ad hoc report,

a batch analysis report,

a trend report, and

a difference/comparison report.

52. The telephony security system as defined in claim 48 wherein said action of generating an alert notification includes generating at least one alert notification from a group including:

an electronic mail notification,

a pager alerting notification,

a console messaging notification, and

a Simple Network Management Protocol (SNMP) trap.