## 3 Results and Discussion
### Development of a Real Network Encryption Method Based on the TLS Protocol  
Transport Layer Security (TLS): This is a security protocol that can be used to encrypt and authenticate SIP traffic. TLS can be used to secure the signaling channel between the client and the server. Generation of certificates and keys: As mentioned above, Asterisk uses UDP port 5060 (by default) for the SIP signaling protocol, and also transmits this information in the clear, so by intercepting traffic, we can get all the information regarding numbers and, in fact, the conversation itself. SIP over TLS will be able to help us with this problem, which in turn will encrypt signaling data using port 5061 (by default) TCP. Therefore, even by intercepting traffic, an attacker will receive information in encrypted form, but this only applies to the SIP protocol; the voice needs to be encrypted separately. SRTP will help us here. It is worth noting that using only TLS without SRTP does not make sense, since media traffic remains unencrypted. It is worth noting that using TLS is not a panacea, and will not protect us from MITM (man-in-the-middle) attacks, if certificate authentication is not used. First we need to generate keys for encryption. The necessary script is already in the Asterisk archive we downloaded. We go to the unpacked folder with the asterisk, and then to/contrib/scripts. We are interested in ast_tls_cert. The certificate is generated for a year; therefore, before generating certificates, we can go into the script and correct all 365 to 3650 or any other number so that the issue period is 10 years or any necessary period. We also need to use the hostname in the system (in other words, the computer name). If the current hostname does not suit us, then we use edit/etc/hosts and write the desired name at the end of the first line, for example, asterisk_server (Figure 16). Key C is the hostname (dns name) or IP address. O is the name of our organization. D is the certificate generation directory. We will be prompted to enter a passphrase for ca.key. This will create a ca.crt file. Next, we will be prompted to enter the passphrase again, after which the asterisk.key file will be created. The asterisk.crt file will be created automatically. We will be prompted to enter the passphrase a third time, after which the asterisk.pem file will be created, which is a combination of the asterisk.key and asterisk.crt files. The next step is to generate client certificates and keys (Figure 17). The \"-m client\" option tells the script that we need a client certificate, not a server certificate. The \"-c ca.crt\" option specifies which CA we are using. The \"-k ca.key\" switch provides the key for the above CA. The \"-C\" option, since we are defining a client this time, is used to determine the hostname or IP address of our SIP phone. The \"-O\" parameter specifies the name of our organization. The \"-d\" option is the output key directory. The \"-o\" parameter is the name of the key that we output. Figure 16: Generating the certificate and keys of the Asterisk server. to config file search, creating /the-step  
on an use this config file to create additional care without  
extending its information for the fields in the certificate  
creating certificate /100.8x  
creating state request /100.8x  
creating certificate /100.8x  
sufficient request self-signature of  
disjected = \(\pm\)0.0.0.1 = \(\pm\)0.000  
after pass phase for \(\pm\)0.0x  
conting key and enter into /100.8x  
Next, go to the \(\mathrm{sip.conf}\) settings and add these lines to the general field:  
tisenable = yes  
tisbindaddrr = 0.0.0.0:5061  
tiscertifile = /etc/asterisk/keys/asterisk.pem  
tiscafile = /etc/asterisk/keys/ca.crt  
tiscipher = ALL  
tisclientmethod = \(\mathrm{tlsv1}\)  
tisdonverifyserver = no  
Here we activate TLS, specify which interfaces and which port to listen on, specify the Asterisk certificate, and also the CA certificate (if we use self-signed certificates for peers), and enable all types of encryption.