Security Features
119
Topics
Configuration Files Encryption Tools
Configuration Files Encryption and Decryption
Encryption and Decryption Configuration
Example: Encrypting Configuration Files
Configuration Files Encryption Tools
Yealink provides three configuration files encryption tools:
l
Config_Encrypt_Tool.exe (via graphical tool for Windows platform)
l
Config_Encrypt.exe (via DOS command line for Windows platform)
l
yealinkencrypt (for Linux platform)
The encryption tools encrypt plaintext configuration files (for example, account.cfg, <y0000000000xx>.cfg,
<MAC>.cfg) (one by one or in batch) using 16-character symmetric keys (the same or different keys for configuration
files) and generate encrypted configuration files with the same file name as before.
These tools also encrypt the plaintext 16-character symmetric keys using a fixed key, which is the same as the one
built in the IP phone, and generate new files named as <xx_Security>.enc (xx is the name of the configuration file,
for example, y000000000103_Security.enc for y000000000103.cfg file, account_Security.enc for account.cfg).
These tools generate another new file named as Aeskey.txt to store the plaintext 16-character symmetric keys for
each configuration file.
Configuration Files Encryption and Decryption
Encrypted configuration files can be downloaded from the provisioning server to protect against unauthorized
access and tampering of sensitive information (for example, login passwords, registration information).
You can encrypt the configuration files using encryption tools. You can also configure the <MAC>-local.cfg files to
be automatically encrypted using 16-character symmetric keys when uploading to the server (by setting “stat-
ic.auto_provision.encryption.config” to 1).
For security reasons, you should upload encrypted configuration files, <xx_Security>.enc files to the root directory of
the provisioning server. During auto provisioning, the phone requests to download the boot file first and then down-
load the referenced configuration files. For example, the phone downloads an encrypted account.cfg file. The
phone will request to download <account_Security>.enc file (if enabled) and decrypt it into the plaintext key (for
example, key2) using the built-in key (for example, key1). Then the IP phone decrypts account.cfg file using key2.
After decryption, the phone resolves configuration files and updates configuration settings onto the IP phone sys-
tem.
Encryption and Decryption Configuration
The following table lists the parameters you can use to configure the encryption and decryption.
Parameter
static.auto_provision.update_file_mode
<y0000000000xx>.cfg
Description
It enables or disables the phone only to download the encrypted files.
Permitted
Values
0
-Disabled, the phone will download the configuration files (for example, sip.cfg, account.cfg, <MAC>-
local.cfg) from the server during auto provisioning no matter whether the files are encrypted or not.
And then resolve these files and update settings onto the phone system.
1
-Enabled, the phone will only download the encrypted configuration files (for example, sip.cfg,
account.cfg, <MAC>-local.cfg) from the server during auto provisioning, and then resolve these files
and update settings onto the phone system.
Default
0
Parameter
static.auto_provision.aes_key_in_file
<y0000000000xx>.cfg
Description
It enables or disables the phone to decrypt configuration files using the encrypted AES keys.
