============================================================================================
				EM Installer Package 
============================================================================================
############################################################################################
1. The reason for this Installer Package
############################################################################################
This is an easy-to-use solution for the stand-alone client computer use case which can be distributed and easily installed on each client computer that will be used for 
accessing the nodes through the Element management tools.
It also solves the issue for older Element Management Launcher versions that EM launching terminates for expired EM software signing certificates.
This can be used as an alternative if the solution is not included in the EM installers from the SW package on the node. 

############################################################################################
2. What's the content?
############################################################################################
The package consists of several installation wizards for Windows/Linux/Solaris,and README files.
1.EMCLI
emcli_install.exe
README.txt

2.LTE EM
lte_em_install.exe
lte_em_install_lin.bin
lte_em_install_sol.bin
README.txt

3.M-MGW EM
nm_install.exe
nm_install_lin.bin
nm_install_sol.bin
README.txt

4.WCDMA EM
em_install.exe
em_install_lin.bin
em_install_sol.bin
README.txt

5.RNC EM
em_install.exe
em_install_lin.bin
em_install_sol.bin
README.txt

Note: Executable file with suffix name exe such as em_install.exe is installation wizard for Windows system
      Executable file em_install_lin.bin is installation wizard for Linux system.
      Executable file em_install_sol.bin is installation wizard for Solaris system.

############################################################################################
3. How to use it?
############################################################################################
1.Uncompress zip file to local directory.
2.Choose the installation package according to the node type.
3.Choose executable file according to the client computer operating system and run it.
4.Follow wizard to install EM Launcher.
5.Each installation package has its own README file to refer to.

############################################################################################
4. Antivirus Warning Concern
############################################################################################
If there is antivirus warning like "Suspicious File Blocked" during executing installation, make sure your EM installer package is downloaded from SW GW directly. 
Then the software is legitimate. To avoid the warning, you can manually add this software and its folder into exception list in your antivirus software's setting windows. 

############################################################################################
5. Security Considerations
############################################################################################
The integrity of the Element Manager software (EM SW) is protected by a cryptographically signed Signature Module (SM), which makes sure that only Ericsson SW is loaded onto the target node, as part of the software Upgrade Package (UP). 
While the EM SW is loaded onto the client from the target node or Ericsson SW GW, the SM is validated by using Ericsson Root Certificate for SW signing. 

HTTPS should be used as transfer protocol for downloading the EM SW to ensure a secure connection for downloading EM SW from the target node onto the client file system.

As the first step of validating the EM SW, the signing certificate embedded in the EM SW package is validated using the following controls:
1.The chain of trust, up to the root certificate,
2.Certificate Revocation List (CRL),
3.Expiry date.
A negative result of #1 and #2 will stop the loading of the EM SW, while #3 only generates a log entry.
Normally there are two reasons that might result in the signing certificate being expired:
- the target node has not been upgraded frequently or 
- the HW (or SW) product is no longer supported by Ericsson.

However, none of the mentioned reasons really disqualifies the signing certificate, because the certificate is still a valid certificate issued by Ericsson, if it passes the controls #1 and #2. 
By just providing information to the user in about the expired signing certificate, the user gets the opportunity to continue using the EM Tool and can later take the required action to update the tool.

The validity check of the EM SW is performed by the Element Management Launcher (EM Launcher), which is available on the target node and also part of the EM Installer Package on Ericsson SW GW.

Older target node systems contain EM Launcher versions that terminates the EM launching upon expired certificates.
Trouble with old and no longer maintained/supported software can be avoided if customers upgrade regularly, but in case old SW is still in use, a new version of the EM Launcher will ensure that the Element Managers are still operational, even after certificate expiry. 

The certificate validation logic will continue validating the certificate expiry, but only terminates the launch of the EM Tool in case the controls #1 or #2 fails, and not if the validity period is passed. In that case the expiry is logged as a hint to the customer to upgrade the target node.

The security is still provided by the target nodes and not by the tool itself. The tool user still needs to use valid credentials for logging in to the node.
Accepting an expired certificate in this case doesn't change the value of the certificate, as long as it passes other controls.

Bottomline: The security of the Element Management tools is not degraded by the changed EM Launcher behavior to continue EM launching despite the expired certificate.

============================================================================================
