Consensus is growing among some system implementors that Verizon's patents for calling to PSTN and VoIP endpoints is tightly coupled to "direct media". This article discusses the three claims on which Vonage was found infringing and how it relates to other hosted VoIP carriers, like those using MetaSwitch, Sylantro, or BroadSoft.
US Patent 6,104,711, Claim 20 talks about making calls directly to VoIP endpoints. One requirement of this system is that the service provider system returns the actual IP address of the called VoIP endpoint. But in many VoIP systems, this isn't the case; a call agent (like that in a MetaSwitch VP3510) or a Session Border Controller (SBC, like the Acme Packet SD or Ditech C100) actually gets the media first. However, in many systems even with SBCs, the media flows directly between endpoints when it can; e.g., when the calling and called party are on the same local network (or, strictly speaking, behind the same NAT router). So in those cases, the media is direct, and the Verizon patent may cover that case.
US Patent 6,282,574, Claim 27 discusses calls to PSTN endpoints. And, just like the '711 patent, the IP address of the PSTN gateway has to be returned. But in many systems, the IP address of the PSTN gateway is never returned; instead, an SBC in the middle mediates the media. However, if you're using a local, enterprise gateway, then the IP address of that gateway may well be returned to the calling party.
Would a jury see it this way? I don't know. They may adopt some abstraction that says that the SBC becomes part of the media gateway as a larger system, or the SBC represents the PSTN endpoint. Under that reasoning, even calling via an SBC could be infringing. But that seems clearly outside the scope of the patent claims.
US Patent 6,539,880, Claims 1, 6, 7, and 8 talks about calls to a wireless handset, and it doesn't have the same IP-address-of-the-called-endpoint restriction. This patent covers the VoIP call no matter how it's signaled. The classic case for this is a SIP soft client (such as CounterPath X-Ten) calling to a SIP-registered WiFi phone via a registrar. (Replace "SIP" in hat sentence with "H.323" and it applies just as much. However, the patent requires "registration", so MGCP probably wouldn't apply -- unless we consider an RSIP message to be a sort of registration.) But it's unclear to me whether this patent could cover a cordless phone connected to an ATA (such as the Linksys/Sipura SPA-2100), or calls from an SIP phone or an ATA, or from a PSTN gateway.
Then there's the prior-art question -- H.323 was already standardized by the time the Verizon patents were filed. And SIP was well along the path. H.323 and SIP were designed specifically to support networks like the one Verizon patented. Does that pre-existence of an enabling technology make this un-patentable?