Security design and evaluation in a VoIP secure infrastracture: a policy based approach

This paper aims at defining security levels of a voice over IP infrastructure during its design phase. The proposed technique uses security policies to express the security statements that could be adopted, and the policy evaluation is based on security metrics to compare policies. The technique first step consists of policy structure definition; the proposed approach is applied on the target VoIP infrastructure. In the second step of the technique, the policy is used to define reference levels against which a security designer can evaluate his design choice or compare the adopted security solution with existing ones.