Yealink Teams Series, Руководство администратора

Страница: 83 / 112

| Security Features | 83
These tools also encrypt the plaintext 16-character symmetric keys using a fixed key, which is the same as the one
built in the phone, and generate new files named as <xx_Security>.enc (xx is the name of the configuration file, for
example, y000000000058_Security.enc for y000000000058.cfg file, account_Security.enc for account.cfg). These
tools generate another new file named as Aeskey.txt to store the plaintext 16-character symmetric keys for each
configuration file.
Configuration Files Encryption and Decryption
Encrypted configuration files can be downloaded from the provisioning server to protect against unauthorized access
and tampering of sensitive information (for example, login passwords, registration information).
For security reasons, you should upload encrypted configuration files, <xx_Security>.enc files to the root directory
of the provisioning server. During auto provisioning, the phone requests to download the boot file first and then
download the referenced configuration files. For example, the phone downloads an encrypted account.cfg file. The
phone will request to download <account_Security>.enc file (if enabled) and decrypt it into the plaintext key (for
example, key2) using the built-in key (for example, key1). Then the phone decrypts account.cfg file using key2. After
decryption, the phone resolves configuration files and updates configuration settings onto the phone system.
Encryption and Decryption Configuration
The following table lists the parameters you can use to configure the encryption and decryption.
Parameter static.auto_provision.update_file_mode <y0000000000xx>.cfg
Description It enables or disables the phone only to download the encrypted files.
Permitted Values
0 -Disabled, the phone will download the configuration files (for example,
sip.cfg, account.cfg, <MAC>-local.cfg) and <MAC>-contact.xml file from the
server during auto provisioning no matter whether the files are encrypted or
not. And then the phone resolves these files and updates the settings onto the
IP phone system.
1 -Enabled, the phone will only download the encrypted configuration files
(for example, sip.cfg, account.cfg, <MAC>-local.cfg) or <MAC>-contact.xml
file from the server during auto provisioning, and then resolve these files and
update settings onto the phone system.
Default 0
Parameter static.auto_provision.aes_key_in_file <y0000000000xx>.cfg
Description It enables or disables the phone to decrypt configuration files using the
encrypted AES keys.
Permitted Values
0 -Disabled, the phone will decrypt the encrypted configuration files using
plaintext AES keys configured on the phone.
1 -Enabled, the phone will download <xx_Security>.enc files (for example,
<sip_Security>.enc, <account_Security>.enc) during auto provisioning, and
then decrypts these files into the plaintext keys (for example, key2, key3)
respectively using the phone built-in key (for example, key1). The phone
then decrypts the encrypted configuration files using corresponding key (for
example, key2, key3).
Default 0
Parameter static.auto_provision.aes_key_in_file <y0000000000xx>.cfg
Description It enables or disables the phone to decrypt configuration files using the
encrypted AES keys.