Hasler Hayes from Nortel's Security Governance & Compliance team joins us with a post which approaches Voice Security from a different perspective:

In this blog post we will discuss Voice Security from the viewpoint of its role in life line healthcare. This post was inspired by my 83 year old mother's adventures with VoIP.

Retired people are often very concerned in reducing the cost of their daily expenses, especially since they typically have a very limited pension income to live on. They seek every opportunity to reduce the cost of their basic necessities so they are able to support themselves better. This led my mother to replace her traditional voice service with a newer, cheaper, voice service (VoIP but she never knew that).

As her son, one unexpected benefit that I saw was the self image boost she got by being in tune with the technology world, besides saving money.

The new voice service went well for several months until her doctors told her that she needed a 24 hour heath care surveillance unit while in her apartment by herself. In the case that she needed help in the apartment, she was to press a button on the wireless remote she was to carry all the time while at home. The main unit would then dial a manned health care service provider, and by using the built-in speaker phone they would start to render assistance - ultimately they would/could call for an ambulance.

As my mother started the process of getting this service installed in her apartment, a serious flaw in her new phone service was exposed - the lack of support for this particular emergency service. If my mother had stayed with a plain old telephone service (POTS) there would have been no problem. In the end my mother had to abandon her VoIP service and return to the old fashioned voice phone service. With a POTS line re-installed, my mother simply plugged in her new health care box and it worked.

So what was the problem?

When the original voice phone service was designed some 100 years ago, it worked by closing a mechanical relay in the phone that closed a loop, causing a current to flow through a relay coil located in the central office. The battery across the circuit was a nominal 48 volt battery. In addition old fashioned voice phone services are often required by government regulations to offer life line service. This means that the equipment in the central office must employ up to 8 hours of battery backup to keep the life line services running. Since it was originally designed prior to the transistor, a mechanical relay coil needed to be energized in the central office to indicate the off hook state. Such coils need more than 10 ma of loop current from the central office to close the loop to signal that they are off hook.

What this means, is that old fashioned phone service can provide up to a continuous ½ watt of potential power within the end-user's residence to power services with the reliability of battery back up. A benefit to the old fashioned phone system was that features of this unit were built on core voice service features that are to be found in every county with classic phone service.

The above technical features are not intrinsic to newer alternatives such as VoIP services. As VoIP becomes more and more mainstream, more careful due consideration in the selection of solution features will need to be given to address such issues as:

• How could a VoIP product morph to support health care needs?

• How to support a life line healthcare service?

• How can life line battery backup be provided?

• Which ubiquitous physical interface can other types of service providers use?

• Which ubiquitous electrical and protocol interfaces can other types of service providers use?

• Which ubiquitous programming language to create a standard API would other types of service providers use?

• With the limited vision and dexterity of some seniors, KISS installation is a must.

With today's VoIP solutions some existing solutions may already address some of the above points better than other competing offers. This blog post has presented a bit of an alternative view of things to consider when selecting a VoIP solution.

Security is not always about cryptographic features, but sometimes about offering a reliable and available service that offers peace of mind.

Hasler Hayes

Senior Security Architect

Nortel