BusinessPhone Communication Platform 7.0

## System Security

## Scope

The scope of this document is to describe how the Ericsson PBX BusinessPhone handles security threats. This document is valid for BusinessPhone 7.0 or higher.

This document covers BusinessPhone with its ports, security aspects on BusinessPhone applications hosted on external servers are not considered.

## Abbreviations

PBX |  | Private Branch Exchange |
TDM |  | Time Division Multiplex |
PCB |  | Printed Circuit Board |
LAN |  | Local Area Network |
IAS |  | Integrated Application Server |
IP |  | Internet Protocol |
IPU |  | Internet Protocol Unit board |
H.323 |  | International Telecommunication Union Standard for VoIP |

## Back Door security

By separation of user plane (TDM and IP media streams like voice, video) and control plane (signalling connections of all purposes), no intrusion can be performed by any communication connection to the system.

Signalling connections towards the system for any purposes (Administration and maintenance, Application interfaces) have a full controlled access to only system internal functions/information. All general function that the used operating system would provide over the standard interfaces (V.24 and Ethernet) are disabled by a hard-coded lock.

Due to the fact that all communication is fully terminated within the system, no unauthorized transit access to other interfaces or even rerouting on the same system interface is possible.

It is not possible to upload software to the system that could be used as a Trojan horse.

## Denial of Service (DoS)

Any attack through one of the system interfaces may only cause a temporary lock out of the attacked interface and possibly the other interfaces of the affected board. The system itself will continue operation, with possibly reduced performance for the period of the DoS attack. The interfaces automatically recover after a certain recovery time depending on the interface type.

## Peripheral boards with LAN (Ethernet) connectivity

### IP-Unit (IPU)

The IPU hosts the gateway and gatekeeper function for H.323 based VoIP extension and trunk traffic. In addition it provides all system's signalling connections for administration and maintenance and application interfaces via the Ethernet interface.

The IPU operates on an embedded real-time operating system, where no back door access from any other system interface towards the LAN is possible.

Due to the fact that no other program can be loaded and only the ports for the upper mentioned applications are opened, no firewall is necessary on the board itself. The same applies to the need for virus protection, as no commercial business application is available on the IPU that may become infected.

### Integrated Application Server (IAS)

The IAS acts towards the customers LAN as a server for the hosted applications (services) and interworks with the system control software via an internal serial connection that can be compared with the logical communication as the applications are hosted on an external PC. Therefore the rules for the systems integrity applies as described above, and only the IAS itself has to be assessed more in detail.

As the IAS is operating on a Windows Server 2003 operating system, all issues regarding security applies as for a standard network server.

#### Firewall

As the IAS is intended to reside in a secure Intranet Domain, it is assumed that the necessary firewall control is performed by the company's security policy. To enable connections from outside the customers firewall to any application on BusinessPhone IPU or IAS, the relevant applications and ports need to be opened, respectively a protocol aware firewall (e.g. for H.323) installed.

If no central firewall is available to secure the LAN, the IT administrator may activate the Windows 2003 integrated firewall or install a firewall of his choice on the IAS, taking care that all necessary network connections to the IAS are routed through the firewall.

#### Virus protection

Due to the fact that the IAS is operating on a Windows operating system, any possible attacks to the operating system may affect also the IAS operation. To prevent the IAS and subsequent the whole LAN from such attacks, the IT administrator should consider to install an antivirus application and keep the system up to date, according to the on-line information provided by Microsoft. See:

http://windowsupdate.microsoft.com

Revision: A © Ericsson Enterprise 2005