Nortel SMC 2450, Implementation Manual

Page: 43 / 262

Description Page 43 of 260
Secure Multimedia Controller Implementation Guide
Dynamic Host Configuration Protocol
The IP phones can use a static IP address or use full or partial Dynamic Host
Configuration Protocol (DHCP) to acquire its own IP address and the IP
address of the Terminal Proxy Server (TPS) in CS 1000 setups. The TPS
represents the server side of the UNIStim protocol. DHCP can also provide
the UNIStim IP phone with a security-enabled Action Byte, which forces the
IP phone to initiate the UNIStim connection using the secure handshake.
Note: Phase 2 IP phones can have more than one fingerprint stored at a
time.
Automatic client fingerprint update
If a client runs firmware that supports secure UNIStim but does not have a
primary key fingerprint, the SMC can automatically update the fingerprint to
the client.
Master key The master key is generated by the UNIStim IP
phone, encrypted with the server's public key,
and returned to the server. The master key is
stored on both the UNIStim IP phone and server.
It is used to create two unique session keys: one
for encryption, and one for authentication.
Session keys All secure UNIStim packets are encrypted with
one session key and authenticated with a
second. Each session key is derived
independently on the UNIStim IP phone and
server using the master key along with
parameters passed during connection initiation.
Because session keys are used for every packet
sent, Nortel recommends you regenerate the
session keys periodically.
Table 1
RSA key types
Key Description