Oxe Purple Native Encryption Solution Sheet en
Oxe Purple Native Encryption Solution Sheet en
Native Encryption
Software encryption of communications and hardened platform against cyberattacks
Digitalisation has been underway for some time. Today, In this document we describe how ALE protects your
employees can collaborate wherever they wish with the ability communications from cyberattacks, with a secure-by-design
to communicate in real-time. But not all communication tools communication platform, open to the cloud with a hybrid
provide the necessary framework to address continuous architecture, with native best-of-breed encryption mechanisms,
availability, security, confidentiality and compliance. providing full control to your IT team and compliance with your
security policies and best practices.
Alcatel-Lucent Enterprise (ALE) has been working with
organisations and customers worldwide to understand the
new challenges they face and to provide secure unified
communications solutions that enable people to work
from anywhere, with any device.
Solution sheet
Alcatel-Lucent OmniPCX Enterprise Purple Native Encryption
Today’s cybersecurity landscape
The switch to a digital environment has led to a rapid increase One important aspect is the fact that moving to the cloud increases
in phishing and ransomware attacks. This is a serious concern the “attack surface”, meaning hackers could exploit non-secure
for the increasing numbers of remote workers in the space, openness to cloud-based services or Software as a Service
and all organisations (public and private). With cyber threats (SaaS). Stringent requirements from the IT team are necessary
on the rise, companies need to work harder than ever to for provider and vendors’ Service Level Agreements (SLAs).
protect their employees and their customers.
Solution sheet
Alcatel-Lucent OmniPCX Enterprise Purple Native Encryption
ALE security-by-design approach
Taking a comprehensive look at the current landscape allows Privacy and reliability of cloud services are sometimes
companies to determine the protection strategies they need questioned. ALE cloud services offer a strict data privacy policy
for their IT assets. For instance, ALE offers companies solutions with data centres in different locations for a worldwide service
they need to be compliant with local and global certifications, coverage. ALE has points of presence in privacy conscious
such as General Data Protection Regulation (GDPR) compliance, countries such as France, Germany, USA, Canada, Singapore
HDS or HIPAA (for healthcare market), ISO 27001 for cloud and Australia. Under the terms of the contract, personal user
services or ISO 15408 Common Criteria certifications. data is not used for any commercial or marketing purposes,
and ALE ensures compliancy with local data privacy regulations
ALE also offers secure connectivity in the cloud, with mutual
such as GDPR in European countries. ALE cloud services are
authentication and encryption elements, better communications
also certified ISO 27001 for information security management.
confidentiality in meetings, as well as data privacy and control
within the cloud. An end-to-end solution to cover the evolving ALE cloud services can also leverage the customer’s
business security environment ensures that teams can safely communication servers. Customers can keep critical business
thrive in any new environment. communication systems on premises and connect to the cloud
for innovative collaboration applications and services.
Solution sheet
Alcatel-Lucent OmniPCX Enterprise Purple Native Encryption
Unified communications hybrid architecture
The collaboration and unified communications platform is an whatever their device, through a variety of standard technologies
important foundational tool for the company. However, the return such as PSTN, TDM, IP, SIP, VoWiFi and DECT and provides
on investment only becomes evident with the enrollment of each metrics for IT to monitor the Quality of Service (QoS)
working group. To make this happen, the stakeholders must • High availability reaching 5x9s with spatially redundant
be consulted, and their concerns considered and addressed, architectures, deployed on customer’s premises or hosted
including the IT team in charge of the security policies. in a private cloud, 100% software-based and fully virtualised,
Too often, security measures hamper the regular use of with protection against denial of service (DoS) attacks, built-
innovative new services. When it comes to collaborative work, in security with hardened devices and operating systems
the user experience must remain intuitive. On the administration • Data privacy and protection with role-based access control
side, it is important to verify platform compatibility based on and encryption of stored data. This ensures all the crucial
environments approved by the IT department, including for data gathered in the evolving business environment is fully
example, the allowance of mobile apps for Android and IOS protected from end-to-end and under your control.
smartphones and tablets. In addition, the collaborative solution • Communications confidentiality with strong encryption
and the communication server must dialogue through open mechanisms based on industry standards natively
APIs to facilitate the management and control of telephone implemented into the solution, without any impact on
services and exchanges in real-time. This evolution is leading voice quality and performance, delivering the experience
IT teams to more upstream control. customers and employees expect
Alcatel-Lucent Enterprise provides comprehensive Communications are susceptible to being intercepted and
on premises and cloud-based communication and listened to by anybody, over the corporate network (LAN or
collaboration solutions to address digital transformation. WLAN) and even more so over the public Internet. Multiple
ALE communication solutions enable call continuity from counter measures at the network infrastructure level minimise
anywhere, in any situation and from any device. the risk of interception (switched LAN environment, VLAN
ALE key features to protect communications: segmentation, management of ACLs between VLANS, protection
against ARP spoofing or flooding), but the only way to ensure
• Secure connectivity between on premises ALE complete protection is to have the conversation fully encrypted
communication system (IP-PBX and phones) and the cloud on transit: Even if intercepted by a malicious person the voice
infrastructure operated by ALE, with mutual authentication, conversation will remain inaudible because de-ciphering is
encryption and Session Border Controller (SBC) to secure not possible.
the public network access
Alcatel-Lucent OmniPCX® Enterprise Purple (OXE Purple) provides
• Seamless connection inside and outside the organisation.
built-in Native Encryption to ensure complete encryption for any
The underlying communication infrastructure connects
communications over the network (private and public Internet).
hybrid workers to back-office and front-line employees,
Solution sheet
Alcatel-Lucent OmniPCX Enterprise Purple Native Encryption
OXE Purple Native Encryption principles
OXE Purple offers business communications designed for the This technology can be securely deployed in any environment:
digital age. It connects the entire Enterprise and provides On premises or hosted in private cloud. It is 100% software-
organisations the freedom, agility and security to grow their based, supports virtualisation, and delivers 5x9s high
business with trust. availability with hot redundancy of the core components.
Solution sheet
Alcatel-Lucent OmniPCX Enterprise Purple Native Encryption
OXE Purple Native Encryption components
OXE Purple Native Encryption offers: • Encryption of conversations using the Rainbow client
application (on desktop, web, android and iOS smartphone)
• Signalling flow encryption using the Datagram Transport
through the Rainbow WebRTC gateway for internal
Layer Security (DTLS) protocol. This applies to signalling
communications (to a device or other application managed
flows exchanged between the OXE Purple Communication
by the OXE Purple Communication Server) or to the public
Server and DTLS compatible IP devices and applications.
network
• Voice flow encryption using the SRTP protocol. This applies
• Encryption of the communications in a network of OXE
to voice flows exchanged between DTLS compatible IP
Purple Communication Servers
devices and applications.
• Support of the geo-redundancy of the OXE Purple
• DTLS connections (for signalling encryption) established
Communication Server and of the Passive Communication
with server authentication or mutual authentication
Server (PCS) for secure branch office in survivability mode
(server and client)
• Embedded Certificate Authority (CA) and Trust Store
• Secured IP Media Gateways (based on pure software
for certificate-based authentication with a possibility for the
or proprietary hardware) for encrypted media processing
customer to customise the certificate with an external
including non-IP phones connected to hardware boards
Public Key Infrastructure (PKI) for a complete privacy
(digital and analogue)
• Encryption of the communications to the public network
through the Public SIP Trunk up to the Service Provider
border element using SIP TLS
Public SIP
trunking
encryption
SIP
Built-in OXE-MS
Secured Media
software Gateways hardware
security OXE and software
OXE
Native
Encryption
OXE Purple
Secured devices
network
and applications
encryption
ABC-F
Applicative PCS
PCS for branch
eco-system offices security
Solution sheet
Alcatel-Lucent OmniPCX Enterprise Purple Native Encryption
OXE Purple Native Encryption supports most
of the IP devices and applications connected
to the Communication Server (including
desk phones, mobile DECT handsets and Public
network
softphones). It also supports complete
encryption in transit for a user equipped with
SIP Trunk
non-IP equipment (for example an analogue
or digital phone) connected to a hardware
SBC
media gateway managed by the OXE Purple
Communication Server. In addition, the
feature supports the cloud-based Rainbow™
by Alcatel-Lucent Enterprise collaborative
application.
OXE PURPLE
The connection between the OXE Purple Communication As illustrated in the diagram below, Voice media is encrypted in
Server and the Rainbow cloud services is ensured by the transit between User A on a desk phone and User B equipped
Rainbow WebRTC Gateway software component. with the Rainbow client application, on PC/Mac/Web or
smartphone. The Rainbow WebRTC Gateway performs the
The Rainbow WebRTC Gateway generates an asymmetric
real-time relay of the SRTP flow between User A and User B.
key pair and exports a certificate signing request (CSR) to
be signed by a certificate authority (CA) that can be the OXE The Rainbow WebRTC Gateway is a full software component
Purple Communication Server embedded certificate authority that is virtualised, supports duplication and load balancing
(CA) or an external public key infrastructure (PKI). The Rainbow for more scalability.
WebRTC Gateway identity is controlled by the OXE Purple
Communication Server during the TLS handshake using the
certificate trust list (CTL) in its Trust Store.
Rainbow
HTTPS HTTPS
WebRTC
Gateway
User A User B
SRTP WebRTC
SIP TLS
OXE PURPLE
DTLS
Solution sheet
Alcatel-Lucent OmniPCX Enterprise Purple Native Encryption
Visual padlock icon on ALE phones and softphone applications
When a communication is encrypted, a padlock icon appears on the phone screen or in the softphone application.
This mechanism provides end-users with confidence in the confidentiality of the conversation.
ALE DeskPhones
Padlock icon appears when the call is ciphered.
IP Desktop Softphone
Solution sheet
Alcatel-Lucent OmniPCX Enterprise Purple Native Encryption
Features and benefits
Features Benefits
Client/device confidentiality (signalling protocol and media) Prevent from malicious attacks, IP phone spoofing and
communications eavesdropping
Mutual authentication and integrity of call control signalling Protect business communications from denial of service
(ensuring that messages have not been modified) attacks
Support of DTLS 1.2 with AES 256 and SRTP with AES 128: State-of-the-art ciphering mechanisms to ensure the highest
• 100% software-based level of protection and confidentiality for all conversations
• SHA2 certificate authentication whatever the hardware device or software application used
• ALE Enterprise and Essential DeskPhones (IP), by the employee
IP Desktop Softphone, compatible with
ALE Premium DeskPhones S-series
• GD4/GD3/INTIP3/OMS and PCS
• DTLS scalability with External Encryption Gateway
• IP-XBS DECT encryption
• Rainbow WebRTC Gateway encryption
Support TLS 1.2 with AES 256 and SRTP with AES 128: Protect conversations inside and outside the corporate
• SIP trunks network, including public network access using SIP Trunks
Visual padlock icon on the phone and in the softphone End-user confidence in the confidentiality of the
application to indicate the call is encrypted and secure conversation
Call encryption in transit with the Rainbow application Ensure confidentiality of conversation for employees using
through the Rainbow WebRTC Gateway the Rainbow client application on PC/Mac, Web, Android
smartphone and iPhone
Built-in software-based encryption feature for Implement high-grade security processes without impacting
OmniPCX Enterprise Purple solution the manageability of the communication system
Zero impact on Quality of Service (QoS) settings Simple deployment and configuration without the need
and network configuration for changes at the network infrastructure level
Geographic redundancy and local branch office Business continuity in all situations without compromise
survivability support on confidentiality in case of network, server or data
centre failures
Solution sheet
Alcatel-Lucent OmniPCX Enterprise Purple Native Encryption
ALE recommendations and best practices
All organisations (public and private) are significant targets Make your communication system redundant and
for cyberattacks. Implementing the most secure equipment add a security component:
available is essential. Integrated management tools must • Risk can never be equal to zero. If a gateway or the main
allow security supervision across all elements. communication system is down, a back-up system can
Additionally, mobile devices are transforming the take over seamlessly when there is spatial redundancy
communications landscape and heightening the need for • Add the necessary components to protect your communication
security as cyber attackers exploit the increasing volumes system, such as a Session Border Controller (SBC) or a
of code contained at every point of access. Defense-grade Reverse Proxy (RP), while notification servers are used
encryption, data privacy and protected communications to alert the necessary people
environments require a secure and highly available
Educate:
infrastructure that is efficient and easy to manage.
• Educate users and administrators; apply best practices within
ALE recommends you: your teams including, reminders for updating passwords,
Update and monitor your communication system: train users on how to fight cybercrime and how to recognise
an encrypted call with the padlock icon on the phone
• System updates are critically important in terms of
cybersecurity. This keeps your communication system
up to date with protection against software vulnerability.
For more information, check out
• Enable monitoring of your communication system to our additional resources:
track suspicious activities by configuring use thresholds
and alarms in the network management system OmniPCX Enterprise Purple Brochure
www.al-enterprise.com The Alcatel-Lucent name and logo are trademarks of Nokia used under license by ALE. To view
other trademarks used by affiliated companies of ALE Holding, visit: www.al-enterprise.com/en/legal/trademarks-copyright.
All other trademarks are the property of their respective owners. The information presented is subject to change without
notice. Neither ALE Holding nor any of its affiliates assumes any responsibility for inaccuracies contained herein.
© Copyright 2022 ALE International, ALE USA Inc. All rights reserved in all countries. DID22051201EN (May 2022)