TD 92579EN
15 February 2012 / Ver. H
Installation and Operation Manual
IP-DECT Base Station & IP-DECT Gateway (software version 5.0.x)
22
4
IP Security
4.1
IP Security Terminology
4.1.1
SSL/TLS
Note:
Secure Socket Layer (SSL) has been renamed Transport Layer Security (TLS). TLS 1.0
is based on SSL 3.0/3.1. This document hereafter uses the term TLS.
TLS is a security mechanism based on cryptography (see
4.1.3 Cryptography
) and is used
for encrypting communications between users and TLS-based Websites. The encryption
prevents eavesdropping and tampering with any transmitted data.
TLS operates on the OSI Model Level 5 and uses PKI (see
4.1.2 Public Key Infrastructure
).
4.1.2
Public Key Infrastructure
Public Key Infrastructure (PKI) is a component of Public Key Cryptography (PKC) that uses:
• Public Key Certificates, see
Public Key Certificates (Digital Certificates)
• Certificate Authorities, see
Certificate Authorities
Public Key Certificates (Digital Certificates)
Public Key Certificates are used for key exchange and authentication. They are simply
electronic documents (files) that incorporate a digital
signature
to bind together a
public
key
with an
identity
(information such as the name or a person or organization, their
address, and so forth).
The signature may be signed by a trusted entity called a Certificate Authority (CA), see
Certificate Authorities
.
The most common use of public key certificates is for TLS certificates (https websites).
Certificate Authorities
A
Certificate Authority
or Certification Authority (CA) is a trusted entity which issues
public key certificates. The certificates contain a public key and the identity of the owner.
The CA asserts that the public key belongs to the owner, so that users and relying parties
can trust the information in the certificate.
Certificate Signing Request (CSR)
or
Certification Request
is a message that is
generated and sent to a CA in order to apply for a TLS certificate. Before the CSR is
created a key pair is generated, the private key kept secret. The CSR will contain the
corresponding public key and information identifying the applicant (such as distinguished
name). The private key is not part of the CSR but is used to digitally sign the entire
request. Other credentials may accompany the CSR.
If the request is successful, the CA will send back an identity certificate that has been
digitally signed with the CA’s private key.
A CSR is valid for the server where the certificate will be installed.
4.1.3
Cryptography
Cryptography is the encoding of messages to render them unreadable by anyone other
than their intended recipient(s). Modern cryptography uses complex algorithms
implemented on modern computer systems.
