Cisco Systems 8941 Security Profiles section on page 1-13for more information, Access section on

Chapter

Understanding Security Features for Cisco Unified IP Phones

Table 1-4	Overview of Security Features (continued)
Feature		Description
Device authentication		Occurs between the Cisco Unified CM server and the phone when each entity
		accepts the certificate of the other entity. Determines whether a secure
		connection between the phone and a Cisco Unified CM should occur; and, if
		necessary, creates a secure signaling path between the entities by using TLS
		protocol. Cisco Unified CM will not register phones unless they can be
		authenticated by the Cisco Unified CM.
File authentication		Validates digitally signed files that the phone downloads. The phone validates
		the signature to make sure that file tampering did not occur after the file creation.
		Files that fail authentication are not written to Flash memory on the phone. The
		phone rejects such files without further processing.
Signaling Authentication		Uses the TLS protocol to validate that no tampering has occurred to signaling
		packets during transmission.
Manufacturing installed certificate		Each Cisco Unified IP Phone contains a unique manufacturing installed
		certificate (MIC), which is used for device authentication. The MIC is a
		permanent unique proof of identity for the phone, and allows Cisco Unified CM
		to authenticate the phone.
Secure SRST reference		After you configure a SRST reference for security and then reset the dependent
		devices in Cisco Unified CM Administration, the TFTP server adds the SRST
		certificate to the phone cnf.xml file and sends the file to the phone. A secure
		phone then uses a TLS connection to interact with the SRST-enabled router.
Media encryption		Uses SRTP to ensure that the media streams between supported devices proves
		secure and that only the intended device receives and reads the data. Includes
		creating a media master key pair for the devices, delivering the keys to the
		devices, and securing the delivery of the keys while the keys are in transport.
Signaling encryption		Ensures that all SCCP signaling messages that are sent between the device and
		the Cisco Unified CM server are encrypted.
CAPF (Certificate Authority Proxy		Implements parts of the certificate generation procedure that are too
Function)		processing-intensive for the phone, and interacts with the phone for key
		generation and certificate installation. The CAPF can be configured to request
		certificates from customer-specified certificate authorities on behalf of the
		phone, or it can be configured to generate certificates locally.
Security profiles		Defines whether the phone is nonsecure or encrypted. See the “Understanding
		Security Profiles” section on page 1-13for more information.
Encrypted configuration files		Lets you ensure the privacy of phone configuration files.
Optional disabling of the web server		You can prevent access to a phone’s web page, which displays a variety of
functionality for a phone		operational statistics for the phone. See the “Disabling and Enabling Web Page
		Access” section on page 8-3.

	Cisco Unified IP Phone 8941 and 8945 Administration Guide for Cisco Unified Communications Manager 8.5 (SCCP and SIP)
1-12	OL-20851-01