Within Messaging, communications are secured from end-to-end using standard encryption and authentication algorithms. Keys are dynamically generated and are stored in RAM where they are overwritten whenever the links are disabled or recreated. Additionally, all links support the use of the AES algorithm for encryption using 128-bit keys. When authentication is used, the HMAC-SHA1-96 authentication algorithm is implemented.
Customers can have confidence in Avaya VoIP solutions because of the implementation of standard encryption and authentication algorithms, use of dynamic key negotiation, and incorporation of this capability as a fundamental part of the standard product offering of Avaya media servers, gateways, and endpoints.
The table lists the protocols in Messaging to ensure secure transmissions through data encryption. Keys are dynamically generated and stored in RAM where they are overwritten whenever the link is disabled or recreated.
| Link | Description | Transport protocol | Encryption / authentication algorithm | Key exchange |
|---|---|---|---|---|
| RTP | Bearer traffic (voice calls) | SRTP | AES
HMAC-SHA1 |
Keys are dynamically created on a per-connection basis. Separate keys are produced for the transmit and receive streams of each call. Keys are not escrowed but are stored in RAM where they are not accessible by administrators or users.
In conference calls a unique key pair (one for transmit, one for receive) is assigned for encrypting the payload of each endpoint participating in the conference. |
| Administrative access | Web interface for server to computer/laptop | HTTPS
SSL/TLS |
AES
3DES |
Keys negotiated each time link is established and are discarded at the end of the session (not retained in flash memory). |
| IPSI | Control and signaling information between Internet Protocol Server Interface (IPSI) in a central gateway to the server | AES-128-CBC | Pre-administered key stored in IPSI flash memory and Messaging software but not accessible by users or administrators exchanged with 128-bit Diffie-Hellman.
Since the IPSI link is only between a specific interface card and the media server, the key that is used to secure that link only needs to be known by those two entities. |
|
| Account information | Required local account stored on media server; all others on supported external AAA server. | |||
| Backup | Server to data destination: files in the pam_config backup set are included in the security set.
For manual movement to another server running the same Messaging release. |
SCP | AES-128 | 15-256 character pass phrase |