Encapsulation, compression, and encryption of PCM data

• US 20040218742A1
• Filed: 03/01/2004
• Published: 11/04/2004
• Est. Priority Date: 07/23/2001
• Status: Active Grant

• Current Assignee: Craig Heilmann, Greg Schmid, Keith S. Pickens, Kirk Smith
• Original Assignee: Craig Heilmann, Greg Schmid, Keith S. Pickens, Kirk Smith
• Inventors: Smith, Kirk, Pickens, Keith S., Heilmann, Craig, Schmid, Greg
• Granted Patent: US 7,231,027 B2
• Time in Patent Office: Days
• US Class Current: 379/189
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/5087 wherein the managed service relates to voice services management of VoIP services H04M7/0081
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04M 2203/609 Secret communication
• CPC Class Codes: H04M 2207/35 virtual private networks
• CPC Class Codes: H04M 7/009 in systems involving PBX or KTS networks
• CPC Class Codes: H04M 7/0093 signalling arrangements in networks
• CPC Class Codes: H04M 7/129 Details of providing call progress tones or announcements
• CPC Class Codes: H04M 7/1295 : Details of dual tone multiple frequency signalling

Abstract

A system and method to provide secure access across the untrusted public switched telephone network is described. The system and method can be initiated by a security policy defining actions to be taken based upon at least one attribute of the call.

Claims

1. A virtual private telephone network for providing encrypted transport of a call across a public switched telephone network (PSTN) from a first enterprise location to a second enterprise location, said virtual private telephone network being located between one or more end-user stations at the first enterprise location and one or more end-user stations at the second enterprise location, said virtual private telephone network comprising:

at least one rule associated with the first enterprise location;

said at least one rule associated with the first enterprise location specifying at least one action associated with the first enterprise location to be performed based on at least one attribute of the incoming or outgoing call to/from the first enterprise location;

at least one rule associated with the second enterprise location;

said at least one rule associated with the second enterprise location specifying at least one action associated with the second enterprise location to be performed based on at least one attribute of the incoming or outgoing call to/from the second enterprise location;

at least one first telephony appliance associated with the first enterprise location;

said at least one first telephony appliance associated with the first enterprise location including means for determining said at least one attribute of the incoming or outgoing call to/from the first enterprise location;

said at least one attribute being from a group including;

the call direction,

the call source number,

the call destination number,

the call type,

said call type attribute being defined as one of voice, fax, or data transfer (modem),

the call date,

the call time,

the call duration,

the identifier for the extension or direct connect line carrying the call,

the channel through which the call is processed,

the start date of the call,

the start time of the call,

the end date of the call, and

the end time of the call;

said at least one first telephony appliance associated with the first enterprise location further including means for performing said at least one action associated with the first enterprise location specified in said at least one rule associated with the first enterprise location;

said at least one action being from a group including;

allowing the call,

denying the call,

conducting the call in encrypted mode,

sending a tone,

sending a message,

logging the call,

generating a report, and

providing an alert; and

at least one second telephony appliance associated with the second enterprise location;

said at least one second telephony appliance associated with the second enterprise location including means for determining said at least one attribute of the incoming or outgoing call to/from the second enterprise location;

said at least one attribute being from said group including;

the call direction,

the call source number,

the call destination number,

the call type,

said call type attribute being defined as one of voice, fax, or data transfer (modem),

the call date,

the call time,

the call duration,

the identifier for the extension or direct connect line carrying the call,

the channel through which the call is processed,

the start date of the call,

the start time of the call,

the end date of the call, and

the end time of the call;

said at least one second telephony appliance associated with the second enterprise location further including means for performing said at least one action associated with the second enterprise location specified in said at least one rule associated with the second enterprise location;

said at least one action being from said group including;

allowing the call,

denying the call,

conducting the call in encrypted mode,

sending a tone,

sending a message,

logging the call,

generating a report, and

providing an alert.

2. The virtual private telephone network as defined in claim 1 wherein said group of attributes of the incoming or outgoing call to/from the first enterprise location further includes:

the trunk group through which the call is processed,

the digits dialed prior to the base phone number,

the digits dialed after the base phone number,

the caller ID identifier,

the call connect time,

the keywords detected in the call content, and

the digits dialed after call connect.

3. The virtual private telephone network as defined in claim 1 wherein said group of attributes of the incoming or outgoing call to/from the second enterprise location further includes:

the trunk group through which the call is processed,

the digits dialed prior to the base phone number,

the digits dialed after the base phone number,

the caller ID identifier,

the call connect time,

the keywords detected in the call content, and

the digits dialed after call connect.

4. The virtual private telephone network as defined in claim 1 wherein one of said at least one rule associated with the first enterprise effects the encryption of all calls.

5. The virtual private telephone network as defined in claim 1 wherein one of said at least one rule associated with the second enterprise effects the encryption of all calls.

6. The virtual private telephone network as defined in claim 1 further including means for performing at least one additional action associated with the first enterprise location responsive to the success or failure of said action of conducting the call in encrypted mode, said at least one additional action being from a group including:

allowing the call,

denying the call,

sending a tone,

sending a message,

adjusting the security policy,

logging the call,

generating a report, and

providing an alert.

7. The virtual private telephone network as defined in claim 1 further including means for performing at least one additional action associated with the second enterprise location responsive to the success or failure of said action of conducting the call in encrypted mode, said at least one additional action being from a group including:

allowing the call,

denying the call,

sending a tone,

sending a message,

adjusting the security policy,

logging the call,

generating a report, and

providing an alert.

8. The virtual private telephone network as defined in claim 6 wherein said action of adjusting the security policy, to be performed in association with the first enterprise location, includes changing, in accordance with said at least one rule associated with the first enterprise location, one or more actions and/or one or more additional actions associated with the first enterprise location to be performed on future incoming or outgoing calls to the one or more end-user stations at the first enterprise location.

9. The virtual private telephone network as defined in claim 7 wherein said action of adjusting the security policy, to be performed in association with the second enterprise location, includes changing, in accordance with said at least one rule associated with the second enterprise location, one or more actions and/or one or more additional actions associated with the second enterprise location to be performed on future incoming or outgoing calls to the one or more end-user stations at the second enterprise location.

10. The virtual private telephone network as defined in claim 1 wherein said action of conducting the call in encrypted mode, to be performed in association with the first enterprise location, includes creation of a VoIP-compatible packet for transport over the PSTN.

11. The virtual private telephone network as defined in claim 1 wherein said action of conducting the call in encrypted mode, to be performed in association with the second enterprise location, includes creation of a VoIP-compatible packet for transport over the PSTN.

12. The virtual private telephone network as defined in claim 1 further including:

a public branch exchange (PBX) located at the first enterprise location, and

means for said PBX to determine and provide one or more attributes of said at least one attribute of the incoming or outgoing call to/from the first enterprise location.

13. The virtual private telephone network as defined in claim 1 further including:

a public branch exchange (PBX) located at the second enterprise location, and

means for said PBX to determine and provide one or more attributes of said at least one attribute of the incoming or outgoing call to/from the second enterprise location.

14. The virtual private telephone network as defined in claim 1 further including:

a public branch exchange (PBX) located at the first enterprise location, and

means for said PBX to be used to perform one or more actions of said at least one action specified in said at least one rule associated with the first enterprise location.

15. The virtual private telephone network as defined in claim 1 further including:

a public branch exchange (PBX) located at the second enterprise location, and

means for said PBX to be used to perform one or more actions of said at least one action specified in said at least one rule associated with the second enterprise location.

16. The virtual private telephone network as defined in claim 1 wherein said action of conducting the call in encrypted mode to be performed in association with the first enterprise location is performed without encrypting actions being taken by either the party using the one or more end-user stations at the first enterprise location or the party using the one or more end-user stations at the second enterprise location.

17. The virtual private telephone network as defined in claim 1 wherein said action of conducting the call in encrypted mode, to be performed in association with the second enterprise location, is performed without encrypting actions being taken by the party using the one or more end-user stations at the second enterprise location or the party using the one or more end-user stations at the first enterprise location.

18. A method for providing encrypted transport of a call across a public switched telephone network (PSTN) from a first enterprise location to a second enterprise location, said method being implemented between one or more end-user stations located at the first enterprise location and one or more end-user stations located at the second enterprise location, said method comprising the steps of:

defining at least one rule associated with the one or more end-user stations located at the first enterprise location;

said at least one rule associated with the one or more end-user stations located at the first enterprise location specifying at least one action associated with the first enterprise location to be performed based on at least one attribute of the incoming or outgoing call to/from the first enterprise location;

defining at least one rule associated with the one or more end-user stations located at the second enterprise location;

said at least one rule associated with the one or more end-user stations located at the second enterprise location specifying at least one action associated with the second enterprise location to be performed based on at least one attribute of the incoming or outgoing call to/from the second enterprise location;

determining said at least one attribute of the incoming or outgoing call to/from the first enterprise location;

said at least one attribute being from a group including;

the call direction,

the call source number,

the call destination number,

the call type,

said call type attribute being defined as one of voice, fax, or data transfer (modem),

the call date,

the call time,

the call duration,

the identifier for the extension or direct connect line carrying the call,

the channel through which the call is processed,

the start date of the call,

the start time of the call,

the end date of the call, and

the end time of the call;

determining said at least one attribute of the incoming or outgoing call to/from the second enterprise location;

said at least one attribute being from a group including;

the call direction,

the call source number,

the call destination number,

the call type,

said call type attribute being defined as one of voice, fax, or data transfer (modem),

the call date,

the call time,

the call duration,

the identifier for the extension or direct connect line carrying the call,

the channel through which the call is processed,

the start date of the call,

the start time of the call,

the end date of the call, and

the end time of the call;

performing said at least one action associated with the first enterprise location and specified in said at least one rule associated with the one or more end-user stations located at the first enterprise location;

said at least one action being from a group including;

allowing the call,

denying the call,

conducting the call in encrypted mode,

sending a tone,

sending a message,

logging the call,

generating a report, and

providing an alert; and

performing said at least one action associated with the second enterprise location and specified in said at least one rule associated with the one or more end-user stations located at the second enterprise location;

said at least one action being from a group including;

allowing the call,

denying the call,

conducting the call in encrypted mode,

sending a tone,

sending a message,

logging the call,

generating a report, and

providing an alert.

19. The method as defined in claim 18 wherein said group of attributes in said step of determining said at least one attribute of the incoming or outgoing call to/from the first enterprise location further includes:

the trunk group through which the call is processed,

the digits dialed prior to the base phone number,

the digits dialed after the base phone number,

the caller ID identifier,

the call connect time,

the keywords detected in the call content, and

the digits dialed after call connect.

20. The method as defined in claim 18 wherein said group of attributes in said step of determining said at least one attribute of the incoming or outgoing call to/from the second enterprise location further includes:

the trunk group through which the call is processed,

the digits dialed prior to the base phone number,

the digits dialed after the base phone number,

the caller ID identifier,

the call connect time,

the keywords detected in the call content, and

the digits dialed after call connect.

21. The method as defined in claim 18 wherein said step of defining at least one rule associated with the one or more end-user stations located at the first enterprise location effects the encryption of all calls.

22. The method as defined in claim 18 wherein said step of defining at least one rule associated with the one or more end-user stations located at the second enterprise location effects the encryption of all calls.

23. The method as defined in claim 18 further including the step of performing at least one additional action associated with the first enterprise location responsive to the success or failure of conducting the call in encrypted mode;

said at least one additional action being from a group including;

allowing the call,

denying the call,

sending a tone,

sending a message,

adjusting the security policy,

logging the call,

generating a report, and

providing an alert.

24. The method as defined in claim 18 further including the step of performing at least one additional action associated with the second enterprise location responsive to the success or failure of conducting the call in encrypted mode;

said at least one additional action being from a group including;

allowing the call,

denying the call,

sending a tone,

sending a message,

adjusting the security policy,

logging the call,

generating a report, and

providing an alert.

25. The method as defined in claim 18 wherein said action of adjusting the security policy in said step of performing said at least one action associated with the first enterprise location includes changing, in accordance with said at least one rule associated with the one or more end-user stations located at the first enterprise location, one or more actions and/or one or more additional actions to be performed on all future incoming or outgoing calls to/from the one or more end-user stations at the first enterprise location.

26. The method as defined in claim 18 wherein said action of adjusting the security policy in said step of performing said at least one action associated with the second enterprise location includes changing, in accordance with said at least one rule associated with the one or more end-user stations located at the second enterprise location, one or more actions and/or one or more additional actions to be performed on all future incoming or outgoing calls to/from the one or more end-user stations at the second enterprise location.

27. The method as defined in claim 18 wherein said action of conducting the call in encrypted mode in said step of performing said at least one action associated with the first enterprise location includes creating a VoIP-compatible packet for transport over the PSTN.

28. The method as defined in claim 18 wherein said action of conducting the call in encrypted mode in said step of performing said at least one action associated with the second enterprise location includes creating a VoIP-compatible packet for transport over the PSTN.

29. The method as defined in claim 18 wherein said step of determining said at least one attribute of the incoming or outgoing call to/from the first enterprise location includes:

using a public branch exchange (PBX) located at the first enterprise location for determining and providing one or more attributes of said at least one attribute of the incoming or outgoing call to/from the first enterprise location.

30. The method as defined in claim 18 wherein said step of determining said at least one attribute of the incoming or outgoing call to/from the second enterprise location includes:

using a public branch exchange (PBX) located at the second enterprise location for determining and providing one or more attributes of said at least one attribute of the incoming or outgoing call to/from the second enterprise location.

31. The method as defined in claim 18 wherein said step of performing said at least one action associated with the first enterprise location includes:

using a PBX located at the first enterprise location to perform one or more actions of said at least one action associated with the first enterprise location.

32. The method as defined in claim 18 wherein said step of performing said at least one action associated with the second enterprise location includes:

using a PBX located at the second enterprise location to perform one or more actions of said at least one action associated with the second enterprise location.

33. The method as defined in claim 18 wherein said action of conducting the call in encrypted mode in said step of performing said at least one action associated with the first enterprise location is performed without encrypting actions being taken by either the party using the one or more end-user stations located at the first enterprise location or the party using the one or more end-user stations located at the second enterprise location.

34. The method as defined in claim 18 wherein said action of conducting the call in encrypted mode in said step of performing said at least one action associated with the second enterprise location is performed without encrypting actions being taken by either the party using the one or more end-user stations located at the second enterprise location or the party using the one or more end-user stations located at the first enterprise location.

35. A method of providing encrypted transport of a call from a first geographically separate location, across a public switched telephone network (PSTN), to a second geographically separate location, said method comprising the steps of:

defining one or more rules associated with the incoming or outgoing call to/from one or more end-user stations located at the first geographically separate location;

said at least one rule associated with the incoming or outgoing call to/from one or more end-user stations located at the first geographically separate location specifying one or more actions associated with the first geographically separate location to be performed based upon one or more attributes of the incoming or outgoing call to/from the first geographically separate location;

said one or more attributes being from a group including;

the call direction,

the call source number,

the call destination number,

the call type,

said call type attribute being defined as one of voice, fax, or data transfer (modem),

the call date,

the call time,

the call duration,

the identifier for the extension or direct connect line carrying the call,

the channel through which the call is processed,

the start date of the call,

the start time of the call,

the end date of the call, and

the end time of the call; and

said one or more actions being from a group including;

allowing the call,

denying the call,

conducting the call in encrypted mode,

sending a tone,

sending a message,

logging the call,

generating a report, and

providing an alert;

defining one or more rules associated with the incoming or outgoing call to/from one or more end-user stations located at the second geographically separate location;

said at least one rule associated with the incoming or outgoing call to/from one or more end-user stations located at the second geographically separate location specifying one or more actions associated with the second geographically separate location to be performed based upon one or more attributes of the incoming or outgoing call to/from the second geographically separate location;

said one or more attributes being from a group including;

the call direction,

the call source number,

the call destination number,

the call type,

said call type attribute being defined as one of voice, fax, or data transfer (modem),

the call date,

the call time,

the call duration,

the identifier for the extension or direct connect line carrying the call,

the channel through which the call is processed,

the start date of the call,

the start time of the call,

the end date of the call, and

the end time of the call; and

said one or more actions being from a group including;

allowing the call,

denying the call,

conducting the call in encrypted mode,

sending a tone,

sending a message,

logging the call,

generating a report, and

providing an alert;

determining said one or more attributes of the incoming or outgoing call to/from the first geographically separate location;

determining said one or more attributes of the incoming or outgoing call to/from the second geographically separate location;

performing said one or more actions associated with the first geographically separate location in accordance with said one or more rules associated with the incoming or outgoing call to/from one or more end-user stations located at the first geographically separate location; and

performing said one or more actions associated with the second geographically separate location in accordance with said one or more rules associated with the incoming or outgoing call to/from one or more end-user stations located at the second geographically separate location.

36. The method as defined in claim 35 wherein said group of attributes in said step of determining said one or more attributes of the incoming or outgoing call to/from the first geographically separate location further includes:

the trunk group through which the call is processed,

the digits dialed prior to the base phone number,

the digits dialed after the base phone number,

the caller ID identifier,

the call connect time,

the keywords detected in the call content, and

the digits dialed after call connect.

37. The method as defined in claim 35 wherein said group of attributes in said step of determining said one or more attributes of the incoming or outgoing call to/from the second geographically separate location further includes:

the trunk group through which the call is processed,

the digits dialed prior to the base phone number,

the digits dialed after the base phone number,

the caller ID identifier,

the call connect time,

the keywords detected in the call content, and

the digits dialed after call connect.

38. The method as defined in claim 35 wherein said step of defining said one or more rules associated with the incoming or outgoing call to/from one or more end-user stations located at the first geographically separate location effects the encryption of all calls.

39. The method as defined in claim 35 wherein said step of defining said one or more rules associated with the incoming or outgoing call to/from one or more end-user stations located at the second geographically separate location effects the encryption of all calls.

40. The method as defined in claim 35 further including the step of performing one or more additional actions associated with the first geographically separate location responsive to the success or failure of conducting the call in encrypted mode;

said one or more additional actions being from a group including;

allowing the call,

denying the call,

sending a tone,

sending a message,

adjusting the security policy,

logging the call,

generating a report, and

providing an alert.

41. The method as defined in claim 35 further including the step of performing one or more additional actions associated with the second geographically separate location responsive to the success or failure of conducting the call in encrypted mode;

said one or more additional actions being from a group including;

allowing the call,

denying the call,

sending a tone,

sending a message,

adjusting the security policy,

logging the call,

generating a report, and

providing an alert.

42. The method as defined in claim 35 wherein said action of adjusting the security policy in said step of performing said one or more actions associated with the first geographically separate location includes changing, in accordance with said one or more rules associated with the incoming or outgoing call to/from one or more end-user stations located at the first geographically separate location, one or more actions and/or one or more additional actions to be performed on all future incoming or outgoing calls to/from the one or more end-user stations located at the first geographically separate location.

43. The method as defined in claim 35 wherein said action of adjusting the security policy in said step of performing said one or more actions associated with the second geographically separate location includes changing, in accordance with said one or more rules associated with the incoming or outgoing call to/from one or more end-user stations located at the second geographically separate location, one or more actions and/or one or more additional actions to be performed on all future incoming or outgoing calls to/from the one or more end-user stations located at the second geographically separate location.

44. The method as defined in claim 35 wherein said action of conducting the call in encrypted mode in said step of performing said one or more actions associated with the first geographically separate location includes creating a VoIP-compatible packet for transport over the PSTN.

45. The method as defined in claim 35 wherein said action of conducting the call in encrypted mode in said step of performing said one or more actions associated with the second geographically separate location includes creating a VoIP-compatible packet for transport over the PSTN.

46. The method as defined in claim 35 wherein said step of determining said one or more attributes of the incoming or outgoing call to/from the first geographically separate location includes:

using a public branch exchange (PBX) located at the first geographically separate location for determining and providing at least one attribute of said one or more attributes of the incoming or outgoing call to/from the first geographically separate location.

47. The method as defined in claim 35 wherein said step of determining said one or more attributes of the incoming or outgoing call to/from the second geographically separate location includes:

using a public branch exchange (PBX) located at the second geographically separate location for determining and providing at least one attribute of said one or more attributes of the incoming or outgoing call to/from the second geographically separate location.

48. The method as defined in claim 35 wherein said step of performing said one or more actions associated with the first geographically separate location includes:

using a PBX located at the first geographically separate location to perform at least one action of said one or more actions associated with the first geographically separate location.

49. The method as defined in claim 35 wherein said step of performing said one or more actions associated with the second geographically separate location includes:

using a PBX located at the first geographically separate location to perform at least one action of said one or more actions associated with the second geographically separate location.

50. The method as defined in claim 35 wherein said action of conducting the call in encrypted mode in said step of performing said one or more actions associated with the first geographically separate location is performed without encrypting actions being taken by either the party using the one or more end-user stations located at the first geographically separate location or the party using the one or more end-user stations located at the second geographically separate location.

51. The method as defined in claim 35 wherein said action of conducting the call in encrypted mode in said step of performing said one or more actions associated with the second geographically separate location is performed without encrypting actions being taken by either the party using the one or more end-user stations located at the second geographically separate location or the party using the one or more end-user stations located at the first geographically separate location.