CollabWorx: actual title set by JS

Home : Technology : Security

Overview of the security mechanisms

General design concept

CollabWorx SRTC software has been designed around the concept of end-to-end security. SRTC software, run by an authenticated and authorized user, encrypts all messages and data streams on the client side, passes them via servers or reflectors that do not decrypt (and hence do not ‘understand’) the payload data, and delivers them to other users, where the data is decrypted and acted upon as dictated by the nature of the application.

This is a non-orthodox approach. Although the notion of end-to-end security is not new, it is rarely used in the current industrial practice. Typically, the servers encrypt/decrypt the messages. A good example is the XMPP instant messaging protocol, which is protected by the TLS mechanism. The end-to-end approach implemented by CollabWorx has several advantages, including:

The computationally expensive encryption/decryption mechanism is performed on clients and hence distributed over multiple, private computational resources.
Since the messaging servers/meeting engines and reflectors used to distribute media streams (CollabWorx SRTC supports multicast, but it is rarely used in actual deployments due to security constraints. The end-to-end nature of SRTC security is however not affected when multicast is used) do not need to decrypt/encrypt the data, they are more scalable and deliver better performance. This is relevant for the SAAS deployment model, as the service provider does not need to provide corresponding resources.
The most prevalent threat to security includes human factor in data centers. The end-to-end security eliminates this factor completely, as the servers/service providers do not have access to the data being transmitted without taking special measures.

Authentication and Authorization

When the SRTC software runs in the stand-alone (non-embedded) mode, user authentication and authorization is handled by CollabWorx SafePerimeter (SP) server component. SP is a J2EE application, accessed over HTTPS as configured by the (deployment-dependent) web application container. SP provides authentication as well as other mechanisms used to enforce user access policy to various collaborative resources. SafePerimeter service is typically accessed by SRTC SIM (Secure Instant Messenger) and can be accessed by SRTC Secure Meetings (SM).

SIM client also implements a single-sign-on mechanism, which enables users to access secure meeting and other collaboration resources (e.g., portals) based on SIM authentication.

Authentication for Enterprise-class systems

Certain enterprise-class systems require single-sign-on originating in a higher-level resource. A good example is the AKO (Army Knowledge Online) portal, currently being extended to the DKO (D standing for ‘Defense’). In principle, all applications running on DoD networks should implement a SSO based on the user DKO credentials. For collaboration systems with their own authentication mechanisms this is more complex than for standard web applications. CollabWorx SP is designed to work in such environment and can be registered as an authorized application with SSO agents such as Netegrity. In such deployments SP accepts user credentials from both its internal database and from the upstream authentication authority. Communication with SIM client is performed with Netegrity application registration elements incorporated into the authentication exchange stream.

Authentication when running in embedded mode

CollabWorx Secure Meetings can be embedded in virtually any web application or portal. Examples of currently supported integrated portals include MS SharePoint, CA CleverPath, and open-source Liferay. In the embedded mode, the embedding software (e.g. a portal) provides user authentication and authorization. Additionally, CollabWorx designed a general methodology allowing embedding software to distribute the session keys used by the meeting components.

Data encryption

Data encryption mechanisms are different for CollabWorx SIM and for the Secure Meetings, as per description below.

Data encryption in CollabWorx SIM

SIM uses Public Key Cryptography with a zero-maintenance PKI.

A 2048-bit exchange key pair is generated once per deployment and stored in OS key store (just like regular certificates). Public key of the pair is distributed among other users. When a new user joins, his/her public key is automatically distributed as well.

SIM messages are encrypted with this rotating session key.The overall design is driven by a trade-off between security and message size, as text messaging is sometimes used on the networks with very limited bandwidth.

Use of embedded public key generation and distribution mechanism eliminates all tasks that IT personnel would have to perform to ensure secure information exchange. There is no need to set up a repository of encryption keys, or expired certificates. With all options installed, SIM provides a complete, self-contained, enterprise class, maintenance-free secure instant messaging infrastructure.

Please, note that SIM servers have no access to message content. Message archiving is supported on client side, if so desired.

Interoperability with other IM systems

CollabWorx provides a gateway to the XMPP-based systems (aka Jabber). Due to the security architecture of the XMPP the gateway has to decrypt messages before injecting them into XMPP cloud. The security level for such connection depends on the level offered by XMPP (if an XMPP server offers TLS then messages never travel in the Internet in the open text), but interoperability with use of such applications as Jabber or Google Talk expands the reach of collaboration. At present, gateways from XMPP to other systems exist (e.g., SIP/SIMPLE), so CollabWorx SIM can interoperate globally.

The XMPP gateway can also be used to serve as the IM monitoring and archiving agent if a centralized message archiving is required by legal environment (e.g. SEC or SO demands on public companies).

Data encryption for Secure Meetings

Secure Meetings use a symmetric session key. When started from SIM using SIM SSO (stand-alone mode), Secure Meetings generate and distribute session keys for various portlets. Different components can use different encryption strengths. Preconfigured options include RC2, DES and 3DES, with AES as an option, with corresponding key strengths ranging from 40 bit to 256 bit. Secure Meetings encrypt all data streams, including streaming audio and video.

In the embedded mode, the embedding software (e.g. a portal) provides user authentication and authorization. CollabWorx provided extensions are responsible for key generation and distribution. There is no difference in the security mechanisms for the stand-alone and embedded meetings beyond this point.

Security of collaboration systems is a complex topic, and the description above just scratches the surface. For a more extensive review, please, consult this white paper. Many of the solutions described therein are supported in our products.

Read more about the system architecture, and the event-sharing system design paradigm .

[Home] [About Us] [Products] [Downloads] [Search]