Security configuration

Last Updated : Oct 24, 2019 |
Prolog information
Metadata
Keywords:
Device Adapter enables secure communications between endpoints and the Device Adapter cluster using Datagram Transport Layer Security (DTLS). DTLS usage requires both server-side and endpoint actions to be taken.
The DTLS policy service attribute controls the mode of DTLS operation. There are three possible values for this service attribute:
  • Off
    DTLS is not used. Communications are not secure.
  • Best-effort
    DTLS is used where possible and supported to secure communications.
  • Always
    DTLS is always used to secure communications.
Overall solutions can have three levels of security that depend on the solution architecture and the endpoint devices in use:
  • Basic
    Basic level security uses the Best-effort setting of the DTLS policy service attribute. Endpoints are configured with an action byte of 1 and port 4100. There is a brief period of insecure signaling at the beginning of endpoint registration.
  • Advanced
    Advanced level security uses the Best-effort setting of the DTLS policy service attribute. DTLS-capable endpoints are configured with an action byte of 7 and port 4101. All other endpoints are configured with an action byte of 1.
  • Complete
    Complete level security uses the Always setting of the DTLS policy service attribute. All endpoints in use must be DTLS-capable. They are configured with an action byte of 7 and port 4101. Insecure registrations are not permitted.
Additionally, the CA root certificate must be installed on each endpoint. See Distributing the root certificate for information on distributing the certificate to endpoints in the solution.
Note:
If you set the Enable client authentication attribute to Yes, then the Client Identity Certificate must be installed on the phone.
Mutual DTLS authentication is supported only on the 11xx and 12xx UNIStim endpoints. If the Device Adapter cluster contains any other endpoint; for example, 200x IP UNIStim endpoint, then do not enable client authentication.
The 11xx and 12xx series IP phones are FIPS 140-2 compliant. Ensure that the Client Identity Certificates that are installed on these phones have a key length of at least 2048 bit. This is required for the FIPS compliance process.
You can install the Client Identity Certificate on the 11xx and 12xx UNIStim endpoints by doing any of the following:
  • Use SCEP.
  • Download the PKCS#12 file that is specified in the [DEV_CERT] configuration section of the UNIStim Software Release 4.3 for IP Deskphones Release notes.
For more information about installing the Client Identity Certificate on the 11xx and 12xx UNIStim endpoints, see the UNIStim Software Release 4.3 for IP Deskphones Release notes.