Encrypt called numbers for outbound calls
This document describes two solutions for encrypting called numbers to avoid transmitting them in plaintext.
Background
Some customers have strict security requirements for called numbers and prohibit transmitting them in plaintext when using an outbound calling system.
Solution 1: Customer-owned call center
This solution applies to customers who operate their own call center integrated with the outbound calling system via SIP trunking.
The recommended process is as follows:
Use your own encryption logic to encrypt the called number.
Call the outbound calling system API to upload the encrypted called number.
The outbound calling system calls your call center and passes the encrypted number.
Your call center decrypts the number and places the outbound call.
This solution gives you full control over the encryption and decryption logic, as numbers are decrypted only within your environment. Note: The maximum length for a called number is 64 characters.
Solution 2: Using a third-party call center
This solution is for customers who do not have their own call center and rely on a third-party call center to place calls. In this scenario, you can use the number encryption logic provided by the outbound calling system to ensure data security.
The system decrypts the number in memory only when a call is placed.
Encryption and decryption logic
1. The client calls the outbound calling system API to create an asymmetric encryption key. You can create one asymmetric key per Alibaba Cloud main account. (See: Create Asymmetric Key Pair)
2. The outbound calling system uses Alibaba Cloud Key Management Service (KMS) to create the asymmetric key. The private key is managed by KMS, ensuring it is never exposed.
3. The client calls the outbound calling system API to get the public key of the asymmetric key pair. You use this public key for data encryption. (See: Get Asymmetric Public Key)
4. The outbound calling system retrieves the public key from KMS and returns it to the client.
5. Client-side data encryption logic
Generate a random AES key.
Use the AES key to encrypt the called number.
Use the RSA public key to encrypt the AES key.
Pass the encrypted called number and the encrypted AES key to the outbound calling system using the AssignJobs API.
NoteIn the AssignJobs API call, pass the encrypted called number to the phoneNumber field of the contacts object. Pass the encrypted AES key to the encryptedAesKey field of the contact object.
For a detailed example, see the demo below.
6. Call the outbound calling system API to start an outbound task. (See: Create Batch Outbound Tasks)
7. The outbound calling system calls the KMS decryption API. It uses the RSA private key in KMS to decrypt the encrypted AES key.
8. The outbound calling system uses the AES key to decrypt the called number and then places the call.
9. Note: All called numbers are stored as ciphertext in the outbound calling system. If you need to search for a conversation record by the called number, you must use the encrypted number.
Demo
For a reference implementation of the client-side encryption method, see the following demo: