Cisco Unified Contact Center Enterprise Solution Reference ...

Chapter 7 Securing Unified CCE
OL-8669-05
Cisco Unified Contact Center Enterprise 7.x SRND
Endpoint Security
Figure 7-5 shows the Certificate Authority enrollment procedure to generate certificates used by the
agent and the servers. The agent desktop certificate enrollment process is manual, requiring the creation
of certificate signing requests (CSRs) at each endpoint, which are then transferred to the certificate
authority responsible for signing and generating the certificates.
Figure 7-5 Certificate Authority Enrollment Procedure
Generate key's
Private Public
User key's
End Host
Certificate
request
Unified IP Phone Device Authentication
When designing a Unified CCE solution based on Cisco Unified CallManager Release 4.x or 5.0,
customers may choose to implement device authentication for the Cisco Unified IP Phones 7940, 7960,
or 7970. Unified CCE 7.0 was tested with Cisco Unified CallManager's Authenticated Device Security
Mode, which ensures the following:
Device Identity — Mutual authentication using RSA signatures
Signaling Integrity — SCCP messages authenticated using HMAC-SHA-1
Signaling Privacy — SCCP message contents encrypted using AES-128-CBC
Unified IP Phone Media Encryption
Step 1 Step 2
Step 3
Step 4
Step 5
CA's keys
Private Public
Certificate Authority
Media encryption is not supported in a Unified CCE environment. Silent monitoring or call recording
functionality is not available on Unified IP phones where the media is encrypted using Secure Real-Time
Transport Protocol (SRTP).
Sign
End host
certificate
143958
7-21