Why a Reverse Proxy with My Instant Communicator for mobiles??

Why a Reverse Proxy with My Instant Communicator for mobiles?? INTEGRATED COMMUNICATION SYSTEMS 8AL020043359DRARA, February 2010

What is OmniTouch 8600 My Instant Communicator? Is an aggregator of all user communication tools Integrated (in depth) in devices respective ergonomics Is Coherent and has a very small footprint across devices (mobiles / desktop) Is unique on the market

Unified Communications Client access across devices OmniTouch 8600 My Instant Communicator Same consistent services and user experience whatever the device What kind of applications can I have on these mobiles?

What are the end-user services provided by My Instant Communicator? Automatic Reverse call / Call by name Enterprise directory look up with telephony presence Caller name display Unified Call log Visual Voice Mail Notification / Eventing Buddy list with riched presence, instant messaging & conferencing services Unified Communication services are provided by Web Services

The web services flows through a network architecture OXE Server WAN / Internet Firewall/VPN gateway LAN switch Web services MIC client for Multiple devices WEB SERVICES Telephony control for accessing RE services Phonebook & Enterprise directory Call log Visual Voicemail Telephony presence Instant Conferencing / Messaging Event notification Our Mobility solutions are focused on Unified Communications everywhere What s about the architecture & security for these web services? Application Servers

Just a reminder... SSL & TLS Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols that provide security for communications over networks such as the Internet. HTTPS HyperText Transfer Protocol over SSL (HTTPS) is a TCP/IP protocol used by Web servers to transfer and display Web content securely. The data transferred is authenticated and encrypted against eavesdropping and man-inthe middle attacks These standard protocols are used by our Web services What is the architecture recommended for our My Instant communicator?

Architecture recommended based on a Reverse Proxy Https MIC client for Multiple devices WAN / Internet External Firewall Demilitarized zone DMZ Reverse Proxy (Apache, Squid, Blue coat..) Internal Firewall LAN Http or Https Application Servers OXE Server switch Our web services secured by HTTPS can go through a Reverse Proxy What are the benefits to use a Reverse Proxy?

BENEFITS of a Reverse Proxy BENEFITS One secure access to internal servers from remote clients through authentication at the corporate network border Single point of control over who can access and to which HTTP servers you allow access to (Monitoring & Logging) Easy replacement of applications servers or host name changes. With a Reverse Proxy these types of changes will not affect the outside clients. Unique Access www.alcatel-lucent.com DMZ Local Area Network Users Internet Reverse proxy Servers Farm with n IP adr.

Blue Coat a partner recommended by ALU Why Blue coat? Set and forget appliance, quick to deploy and easy to manage Complete loggin and reporting Great flexibility for authentication methods allowing compliance with IT policies Solution validated & supported by ALCATEL-LUCENT & BLUE COAT And not Apache or Squid They are widely spread in the world and free of charges BUT Compatibility with My Instant Communicator requires the last version to benefit patches and finetuning (Linux geek needed) Restrictions regarding authentications possibilities NO official support by the BP s & ALU

Alternative Architecture with a Firewall/VPN Gateway OXE Server IPSEC/Https Firewall VPN IPSEC/SSL LAN switch MIC client for Multiple devices WAN / Internet Http or Https Application Servers The web services secured by IPSEC or HTTPS can go through a Firewall/VPN

Alternative Architecture with a Firewall/VPN Gateway PROS Technology already deployed in the customer infrastructure, there is no additional cost BUT an IPSEC client must be supported on the mobile devices. VPN IPSEC and SSL(TLS) are very well known by the administrators CONS No available IPSec clients for all the mobiles used except Nokia and IPHONE. On the Nokia web site there is a list of Firewall/VPN gateways supported. My IC applications has been tested with a Nokia mobile and the Brick solution. The Cisco IPSEC client is being tested with our Brick VPN gateway. Specific security configuration for each mobile. Today a Firewall is not able to detect web-based attacks (SQL Injections). It s a security issue for the Application servers.