Phone Lock Module Description

Imagicle Phone Lock module, included in Imagicle Call Analytics Enterprise for Cisco UC, is the most effective solution to avoid phone abuses. Thanks to Phone Lock, company employees can easily lock their phone line, preventing unauthorized people to use it and avoiding any surprise on the company's phone bill.

Phone Lock allows the users to lock or unlock own phone line, on all phone devices associated to it, by hitting IP Phone's Services button, select Phone Lock XML service and entering a PIN code. When the phone is locked, incoming calls may still be answered (or dropped), while outgoing calls are dropped or re-routed to any number (i.e. a voicemail service). Calls to emergency numbers or other specific numbers/ranges might be still available, depending on applied Global Settings.

The users can verify own locking status from a padlock icon or a text message appearing on phone display.

If a user forgets his/her PIN, the UCX Suite administrator can reset it through the web interface.

Locking the phone can optionally clear call registry, including the list of missed, received and placed calls.

Phone Lock is a server based application which can control the telephony traffic using either:

• TAPI (Telephony Application Programming Interface)

• CURRI (Cisco External Call Control Profile)

Note: Starting from Imagicle 2020.Spring.1 release, Phone Lock TAPI engine can selectively lock overlapping extensions, if associated to different partitions and different phone devices.

Product architecture

When Phone Lock detects a call being initiated, it retrieves the user associated to relevant phone line in the UCX Suite users' list. Some of the user's properties control the status of the IP phone.

The phone line can be locked by the user for privacy reasons or fraud prevention, either from the phone services interface, from Jabber/Webex client's "Phone Lock" gadget or through the UCX Suite web interface. The phone line can also be locked by the administrator.

The phone status is stored in Phone Lock users' list and it can be easily checked and changed through the web interface. When the user accesses the XML service on the IP phone, lock icon is toggled in the list accordingly.

Note: If you are leveraging FAC (Forced Authorization Codes) or CMC (Client Matter Codes) to initiate an outbound call, please do not enable Phone Lock feature. Phone Lock operates at phone device or line level, so other phone devices/lines can still initiate outbound calls using FAC/CMC code of a blocked user.

Available Blocking Methods 

Imagicle Phone Lock allows phone line locking by means of below three methods:

User's Lock

Each user can autonomously lock own phone line/device from the following interfaces:

• User's web portal

• Administrator's web portal

• Jabber/Webex Phone Lock gadget

• XML Phone service

• Imagicle One Desktop PC tool (manual or automatic)

Administrator's Lock

Phone Lock administrator can access to a specific Phone Lock web page called "Users". From this page, administrator can lock any phone line/device. Two option available:

• Standard phone block, by clicking on padlock icon to toggle lock status. This locking method can be reverted by relevant user.

• Administrative phone block, by checking user's "ADMIN LOCK" flag. This locking method does NOT allow user to revert own lock status. User should contact administrator to unlock own line.

In both cases, phone lock behaviour is the same as user's lock.

Budget's Lock

Third locking method implies having Budget Control module enabled, included in Imagicle call Analytics Enterprise license. If a user, or a group of users associated to same department/cost center, reach the assigned budget, the phone line(s) are locked in administrative mode, so if user wants to keep on calling, he/she needs to contact the administrator or wait for the beginning of next budget period.

Phone Behaviors

By default, Imagicle Phone Lock only acts on outgoing calls, but you can also enable incoming calls block by checking "Block Incoming calls when phone is locked" flag, available in Phone Lock's Global Settings.

Let's consider the following configuration:

Dotted lines represent device - user association, as detected by Imagicle Phone Lock + AXL services.

Some examples

• User U1 is locked:

  • TAPI

    • On D1 and D3 phone sets appear “Phone is locked” message

    • All outbound calls from D1 and D3 devices are dropped

    • Outbound calls from other devices are allowed

  • CURRI

    • On D1 and D3 phone sets appear “Phone is locked” message

    • Outbound calls from line L1 (on both D1 and D3) are dropped

    • Outbound calls from other lines are allowed

• User U2 is locked:

  • TAPI

    • On D2 phone set appears “Phone is locked” message

    • All outbound calls from D2 device are dropped

    • Outbound calls from other devices are allowed (even those performed from line L2 on D1 phone set)

  • CURRI

    • On D2 phone set appears “Phone is locked” message

    • Outbound calls from line L2 (on both D1 and D2) are dropped

    • Outbound calls from other lines are allowed

• User U1 is locked, L2 is included in the whitelist, conference call

  • TAPI

    • On D1 and D3 phone sets appear “Phone is locked” message

    • Outbound/inbound calls on line L2 are allowed

    • If L2 starts a conference call by including U1, conference is allowed

    • If U1 starts a conference call by including anybody but L2, conference is dropped

    • If anybody but L2 starts a conference by including U1, conference is dropped

Lock status on Cisco IP Phone

Depending on IP Phone model/series, different notification methods are available to show a graphical "lock" icon or a text message on phone display.

Status icon + text popup

If IP phone supports XML popup message/graphic push, then the following notification appears:

Text-only popup

If IP phone supports XML popup message push, then the following notification appears:

TAPI-based text notification

If IP phone is monitored via CTI/TAPI, then the following notification might appear:

Lock notification included into Phone line text

This new method, available starting from 2020.Winter.1 release, adds phone line's lock status beside existing phone line label. This is the most compatible method, available to any IP Phone with an embedded display. See below screenshot sample:

Budget Lock Notification

If a user has been locked due to own Budget overrun, all phone devices associated to user's line show “Line DN is locked” message, where DN is the primary extension number.

TAPI-based locking engine

With this configuration you need to install Cisco TSP on the UCX Suite Server. Through it, Phone Lock is notified about events related to the monitored IP Phones.

Main advantages of this architecture is an easy configuration on the CuCM. You only have to associate all the phones to an Application User. This method also allows to selectively lock phone devices associated to overlapping extension numbers.

ECC-based (CURRI) locking engine

Cisco Unified Communication Manager (Unified CM) 8.0(1) and later support the External Call Control (ECC) feature. This feature enables an external route server to take some call routing decisions in place of the CallManager.

Whenever a call is performed, if the called number matches an external call control enabled pattern, Cisco unified CallManager issues a routing request towards the external route server. The call routing request contains the calling party and called party information.

Imagicle UCX Suite receives the request, applies business logic, and returns a call routing response that informs CUCM about call allowance.

This allows Phone Lock to route or block a call based on the lock status of the device.

Blocking Technology Comparison

The following table summarizes the differences between the blocking technologies available since Imagicle UCX Suite Winter 2014:

• ECC-Curri is more scalable than TAPI, it has been successfully tested with more than 100 requests per second

• ECC-Curri might need Numbering Plan configuration changes

• ECC-Curri blocks call before routing, there is no ringback neither missed call notifications for the called

• ECC-Curri doesn't need any additional module to install on UCX Suite

• ECC-Curri supports Load Balancing out of the box

• TAPI blocks the call after call has been already routed. The caller could hear a short ringback and the called party could get a missed call

• TAPI needs a CTI-enabled Users that monitors all the involved phones

• TAPI doesn't support Load Balancing

• TAPI needs Cisco CallManager CTI manager service running

• TAPI supports shared lines and overlapping numbering plans

Locking logics Summary table

Extension mobility support

Phone Lock supports extension mobility. In this case, it blocks the line entered in the First Extension Number field of the user associated to the CUCM End User.

Compatible devices

While using ECC-based locking engine, ANY phone device can be locked, including analog sets. If TAPI-based engine is chosen, it works with CTI-monitorable phone devices only. Visual notification of locking status is obviously available to IP Phones with a display only.