
CHAPTER1 Overview C470HD | Users & Administrator's Manual
App Signing
Android requires all apps to be digitally- signed with a developer key before installation;
currently,theAudioCodesdevicesverifythatappsaresignedbyMicrosoft.
Appsigningpreventsmalicioususer/usersfromreplacingaMicrosoft-signedappwithanapp
that"pretends"tobeMicrosoftbutwhichlackstheprivatekeythatisknownonlytoMicrosoft.
Web Browser
TheAudioCodesdevicedoesnotincludeaWebbrowser.Userscannotbrowsetothepublic
internetorinternalintranet.AllWebservicesarecustomizedtoconnecttoOffice365services
andAudioCodes'managedservicessuchastheOneVoiceOperationsCenter(OVOC).
WithoutaWebbrowser,malicioususer/userswillnotbeabletoaccessthedeviceandbrowse
fromitasatrusteddeviceintothecustomernetwork.
Remote Configuration Management
AudioCodesdevicesdonothaveanembeddedWebserver.Configurationandmanagementare
performedusingoneofthefollowingremoteinterfaces:
■MicrosoftTeamsAdminCenter(forNativeTeamsdevices)overHTTPSprotocols,enabled
afterasuccessfulsign-inauthenticationprocess.
■AudioCodesDeviceManager(partofAudioCodes'OVOCsuite)overHTTPS.
■DebugginginterfaceoverSSH.NotethatSSHmustbedisabledbydefaultandenabledonly
perspecificcasefordebuggingpurposesonly.
AudioCodes Device Manager Validation
TheAudioCodesNativeTeamsdevicesvalidatetheAudioCodesDeviceManageridentityusinga
knowntrustedcertificate:
■Thedeviceisshippedwithknowntrustedcertificateinstalled.SeeAudioCodesRootCA
Certificateonpage9.
■Fortheinitialconnection,theAudioCodesDeviceManageraccessesdevicesusingaknown
trustedcertificate.
■Onceasuccessfulsecuredconnectionhasbeenestablishedbetweenthedeviceandthe
DeviceManager,theusercanreplacethetrustedcertificateontheDeviceManagerandon
thephone,andre-establishtheconnectionleveraginganyPrivateTrustedCertificate.
Sandboxing
AudioCodesdevicesuseAndroidApplicationSandboxsothateachapplicationcanaccessits
owndataandisisolatedfromotherapplications.Thispreventsamaliciousappfromaccessing
thecodeorthedataofotherapplicationsinthesystem.
-7-