RedMax EXtreme EX-LRT Guía para resolver problemas descargar pdf (Pagina 33)

Oracle SBC Security Guide

The protocol specifies the data exchanged between an OCSP client (such as the Net-Net SBC) and an

OCSP responder, the Certification Authority (CA), or its delegate, that issued the target certificate. An

OCSP client issues a request to an OCSP responder and suspends acceptance of the certificate in question

until the responder replies with a certificate status.

Certificate status is reported as

 good

 revoked

 unknown

OCSP can be especially useful in environments where individual certificates have been issued to a single

user or user device. Certificates for devices that are stolen or misplaced can be revoked, so even if valid

credentials are known the device will not be able to connect.

Configuration is detailed in Section 15 “Security” of the ACLI Configuration Guide.

SRTP

Many customers require the ability to encrypt and authenticate the content and signaling of their real time

communications sessions. The SBC supports the Secure Real-Time Transport Protocol (SRTP).

Authentication provides assurance that packets are from the purported source, and that the packets have

not been tampered with during transmission. Encryption provides assurance that the call content and

associated signaling has remained private during transmission.

SRTP requires an IPsec NIU and a Signaling Security Module (SSM/SSM2/SSM3).

RTP and RTCP traffic are encrypted as described in RFC 3711, The Secure Real-time Transport Protocol

(SRTP). The negotiation and establishment of keys and other cryptographic materials that support SRTP

is described in RFC 4568, Session Description Protocol (SDP) Security Description for Media Streams.

Cryptographic parameters are established with only a single message or in single round-trip exchange

using the offer/answer model defined in RFC 3264, An Offer/Answer Model with the Session Description

Protocol (SDP).

The SBC also supports signaling of SRTP keys with MIKEY through an implementation of a subset of

RFC 3830. This implementation of MIKEY offers encryption of both RTP media and RTCP statistical

information. This implementation requires signaling plane encryption using SIP-TLS.

For further information and configuration settings, refer to Appendix L: and to Section 15 “Security” of

the ACLI Configuration Guide.

IPsec for SIP

IPsec provides another mechanism for encrypting and securing SIP signaling services through the use of

2-port GigE optical IPsec PHY card.

Security Associations and Security Policies allow for flexibility in defining local and remote IP address,

ports and subnet masks. These should be defined to only allow IPsec communications between authorized

gateways or hosts and the SBC.

In software release S-C6.2.0, the SBC supports IPsec IKEv1 to create IPsec tunnels dynamically. This is

based on the Internet Key Exchange (IKE) Protocol as defined in RFC 2409, Internet Key Exchange, and

for the Dead Peer Detection (DPD) protocol as defined in RFC 3706, A Traffic-Based Method of

Detecting Dead Internet Key Exchange (IKE) Peers.

1 2 ... 28 29 30 31 32 33 34 35 36 37 38 ... 141 142

Sin comentarios

RedMax EXtreme EX-LRT Guía para resolver problemas Pagina 33