VoIP / Telecom Security

Secure SIP and WebRTC edge for a CPaaS and contact center platform

Israeli CPaaS and Contact Center Platform

A hardened SIP and WebRTC edge in front of a cloud communications platform: four client transports in, TLS to the platform out, layered abuse and fraud controls, and a full handover pack.

Build My Team Now → Verified on Upwork

At a glance

Category
VoIP / Telecom Security
Region
Israel
Client
CPaaS / Contact Center
Services
Cybersecurity Engineering, Managed IT Operations
Duration
Jul 2026 to Sep 2026
Engagement model
Fixed-scope project (Phase 1)
01

The challenge

The platform needed a hardened edge between its customers' endpoints and its own systems. Browsers over WebRTC, softphones and desk phones over SIP TLS, and native and legacy clients over UDP all had to connect, and everything had to reach the platform over TLS.

The edge also had to stand up to the abuse every public SIP service sees, without becoming a second user database: the platform keeps the users and answers authentication.

02

What we did

  • Built the edge on Kamailio for signalling and rtpengine for media, with a TURN and STUN relay for NAT traversal.
  • Terminated four client transports (WebRTC over WSS, SIP over TLS, SIP over UDP and TCP, legacy UDP) and forwarded all traffic to the platform over TLS 1.2 or later.
  • Layered the security controls cheapest first: default-deny network firewall, reputation blocklist, host-level bans, flood rate limiting, a registration throttle, per-account credential lockout and rejection of domains the edge does not serve.
  • Added a per-account call-rate fraud guard that emits events for alerting, and built and proved the alerting with real events.
  • Handed over an architecture and handover guide, a deployment guide, a hardening guide, a media server upgrade runbook and infrastructure diagrams, with the repository delivered privately.
03

Outcome

  • Phase 1 delivered as scoped, with the client confirming the handover was clear and well documented.
  • The rebuild guide was validated by building a fresh host from it alone: the production configuration loaded on that host unmodified apart from address substitution.
  • Rated 5.0 on Upwork.
Stack

What we worked with

Signalling and media
  • Kamailio
  • rtpengine
  • TURN / STUN
Transports
  • WebRTC (WSS)
  • SIP over TLS
  • SIP over UDP and TCP
Protection
  • Default-deny firewall
  • Reputation blocklist
  • fail2ban
  • Rate limiting
  • Fraud guard
Client feedback

Client feedback

5.0 Upwork rating

“The team delivered the Phase 1 SBC edge as scoped, and the handover was clear and well documented. They have deep and solid telecom knowledge and communicated responsively throughout.”

Upwork job: “Senior SIP / Kamailio / Asterisk / WebRTC Telecom Architect & Prototype Consultant”

Verified on Upwork
Related service

Ready to Start Building?

Get a free engineering consultation. No commitment. No pressure. Just answers.

Start Building Today → View Us on Upwork