AudioCodes 400HD Series - Remote Configuration Management; Audiocodes Device Manager Validation; Sandboxing; Device File System

CHAPTER1 Overview
C448HD C450HD | Users & Administrator's Manual
Remote Configuration Management
AudioCodesdevicesdonothaveanembeddedWebserver.Configurationandmanagementare
performedusingoneofthefollowingremoteinterfaces:
■ MicrosoftTeamsAdminCenter(forNativeTeamsdevices)overHTTPSprotocols,enabled
afterasuccessfulsign-inauthenticationprocess.
■ AudioCodesDeviceManager(partofAudioCodes'OVOCsuite)overHTTPS.
■ DebugginginterfaceoverSSH.NotethatSSHmustbedisabledbydefaultandenabledonly
perspecificcasefordebuggingpurposesonly.
AudioCodes Device Manager Validation
TheAudioCodesNativeTeamsdevicesvalidatetheAudioCodesDeviceManageridentityusinga
knownRootCA:
■ ThedeviceisshippedwithknownRootCAsinstalled.SeeAudioCodesRootCACertificate
onpage10.
■ Fortheinitialconnection,theAudioCodesDeviceManageraccessesdevicesusingaknown
CA.
■ Onceasuccessfulsecuredconnectionhasbeenestablishedbetweenthedeviceandthe
DeviceManager,theusercanreplacetheRootCAontheDeviceManagerandonthe
phone,andre-establishtheconnectionleveraginganyPrivateRootCA.
Sandboxing
AudioCodesdevicesuseAndroidApplicationSandboxsothateachapplicationcanaccessits
owndataandisisolatedfromotherapplications.Thispreventsamaliciousappfromaccessing
thecodeorthedataofotherapplicationsinthesystem.
Device File System
TheAudioCodes device'sfile  systemis encryptedonC450HD- DBWdevices.Customers  may
enforceapolicyofdeviceencryptionviaMicrosoft'scloud-basedIntuneservice.
Keystore
WithAudioCodesdevices,thecertificatekeysareencryptedonthedevicefilesystem.
Device Certificate
AudioCodesdevicesareshippedwithauniquecertificatewhichissignedbyAudioCodesRoot
CA.Networkadministratorscaninstallathird-partycertificateonthephoneinthecustomer’s
trusted  environment.  Network administrators  should  follow  the  following  guidelines  when 
replacingtheexistingtrustedCAs:
■ ThedevicecertificateURLwillonlybevalidifnoSCEPserverURLispresent
- 8 -