Remote Endpoint Control; Communication Encryption - Cisco SPA921 - - IP Phone Provisioning Manual

Provisioning Cisco Small Business VoIP Devices
Residential Deployment Provisioning Requirements
Cisco Small Business IP Telephony Devices Provisioning Guide
Device configuration varies according to the individual customer and with the
same customer over a period of time. The IP Telephony Device must be
configured to match the account service parameters for the individual customer.
Also, the configuration may need to be modified because of new service provider
features, modifications in the service provider network, or firmware upgrades in
the endpoint.
This customized, ongoing configuration is supported by the following features:
• Reliable remote control of the endpoint
• Encryption of the communication controlling the endpoint
• Streamlined endpoint account binding

Remote Endpoint Control

The service provider must be able to modify the configuration parameters in the IP
Telephony Device after the unit has been deployed to the customer premises. The
service provider must also be able to upgrade the firmware remotely, and both of
these operations must be reliable.
In a residential deployment, the end IP Telephony Device is typically connected to
a local network. The device accesses the Internet through a router using network
address translation (NAT). For enhanced security, the router may attempt to block
unauthorized incoming packets by implementing symmetric NAT, a packet filtering
strategy which severely restricts the packets that are allowed to enter the
protected network from the Internet.

Communication Encryption

The configuration parameters communicated to the IP Telephony Device may
contain authorization codes or other information that need to be protected from
unauthorized access. It is in the service provider's interest to prevent unauthorized
activity by the customer, and in the customer's interest to prevent from
unauthorized use of the account by other persons. For this reason, the service
provider may wish to encrypt the configuration profile communication between
the provisioning server and the IP Telephony Device, in addition to restricting
access to the administration web server for the device.
1
11