OmniJoin Security (July 2015)

WHIITE PAPER OmniJoin Security (July 2015) Introduction The OmniJoin solution has been included in the Government purchasing framework for Cloud based services G-Cloud 6 has met with the requirements for the framework and has is now an official supplier for the Crown Commercial Services Supplier for Software as a Service (SaaS). Already used extensively within healthcare, Oil & Gas and Pharmaceutical and research industries. One cloud-based service. Two deployment models. OmniJoin Cloud (Public full cloud based solution) OmniJoin Private Cloud (video/audio and content localised on premise servers) NO special hardware. OmniJoin web conferencing, delivers high-quality, highly-secure voice, visual collaboration via online meetings, in our public cloud or your own private cloud. Hardware agnostic supporting VMware and Microsoft Hyper-V virtual server environments OmniJoin Security Public cloud A multi-layered level of security and configuration restrictions are available to ensure that the strictest lockdown for a variety of secure market sector use. These are: Service Provider Level restrictions for limiting feature sets at the Top of the Tree these are then forced down to the administrator and below on an inherited basis. Administrator this is the user level restrictions enforced from the service provider and inherited by the NHS administrator. Account User These are the normal service users - their access and features available can be further be restricted from the administrator level. Participant This is the level that any invited participant will join meeting via a URL link sent via email restrictions on features can be set by the Account User. 1

OmniJoin uses the following multi-layer security model: The OmniJoin Cloud o Physical security o Network access security Communications security Endpoint security Account authentication Session security (meeting security) Attendee privacy Firewall / Proxy Traversal Privacy OmniJoin is also finalising its ISO 27001 certification which is expected in summer 2015 (Certificate of engagement from externally contracted ISO consultant is available upon request) Physical / Network Security Public Cloud The OmniJoin Network Operations Centre and backend are secure data centre facilities which conform to SSAE 16 Type II standards for physical and remote access security. OmniJoin uses virtualised servers with redundancy across physically distant datacentre s. The OmniJoin Cloud distributed architecture provides virtual conferencing servers closer to you (thereby reducing video latency time) and Intelligent Video work together to ensure that you get the best video conferencing experience possible for everyone in your conference regardless of each individual s connection type (wired, wireless or satellite) and prevailing bandwidth availability. The OmniJoin Cloud is distributed across the following geographical regions allowing connections to the best conference server region automatically. 1. United Kingdom 2. Europe - Scandinavia, Germany 3. United States of America, - Eastern Region, Western Region, Central Region 4. Asia Pacific - Australia, Japan 2

OmniJoin Features Public v Private Cloud editions Encryption OmniJoin is compliant with the following NIST & IETF requirements: NIST 800-52 Transport Layer Security Guidelines IETF RFC 2246 TLS/SSL Protocol, Version 1.0 IETF RFC 3268 AES Cipher suites for TLS IETF RFC 2104 HMAC-SHA-1 Communications Security All OmniJoin conferencing, live contact list / OmniJoin IM, and portal page sessions are encrypted via industry standard, secure sockets layer/transport layer connections (SSL 3.0/TLS 1.x). If a secure connection cannot be established, the connection will fail. OmniJoin uses public key infrastructure (PKI) and a third-party certificate/certificate authority (CA). OmniJoin does not internally manage key pairs or otherwise use proprietary encryption methods. Encryption is secured up to RSA 256bit AES encryption for all control protocols and media payload. Endpoint Security All OmniJoin executable clients use signed code. OmniJoin signed code is in compliance with Microsoft Windows, Apple OS X, Apple ios, Google Store, and Mozilla developer guidelines as applicable. OmniJoin code is signed Brother Industries Ltd., Japan. OmniJoin browser loaders use extended validation certificates that are signed by the issuing authority (Microsoft, Apple, Google, Mozilla, as applicable) 3

Account Authentication All OmniJoin registered host accounts access requires an account user name and password to authenticate the user. The account user name requires a properly formatted email address. The account password specification is a minimum of eight characters, and at least one number or special character, one uppercase character, and one lowercase character. Session Security / Virtual Meeting Room Security OmniJoin uses industry standard techniques for establishing and managing secure browser-based sessions. A secure SSL/TLS connection is established as described in the Communications Security section above. A unique session identifier is associated with each user regardless of role for each session. OmniJoin session cookies expire after 15 minutes of inactivity (automatic logoff). Conferencing Client Session Security The OmniJoin conferencing client uses industry standard techniques for establishing and managing secure application sessions. The conferencing client uses secure SSL/TLS connections for all communications for the duration of each meeting session. A meeting instance is de-virtualized 15 minutes after the last attendee departs (via close or leave meeting button), but may also occur when no meeting data activity is detected for 15 minutes (automatic logoff). As an added measure of protection, customers may lock their meetings rooms, which require the meeting room owner to be in attendance. Further restrictions can be enforced to limit and control most meeting room properties, including audio and video settings, default layouts, features, and participant privileges. Remote control, file transfer, the recording feature, and participants ability to print shared materials. Firewall and Proxy Traversal OmniJoin software and online services were designed to support multi-office networks. OmniJoin uses web service SSL/TLS connections on ports 80, 443, 22, 23, 1270, and 37000 (a legacy port). OmniJoin uses TCP and does not employ UDP or other broadcast-oriented transports. All connections are established from the client out the firewall, there are no inbound connection requests. OmniJoin supports proxy authentication standards including WPAD, NTLM, proxy autoconfiguration, Socks5, and manual proxy configuration settings. OmniJoin software includes vendor-specific proxy optimizations for Squid Web Proxy, Microsoft Threat Management Gateway/ISA Server, and others. OmniJoin also provides fall-back mechanisms for proxy servers with no installed proxy client. The OmniJoin connection sequence tries multiple ports and connection types, generally favouring higher throughput and direct TCP connections over port 443 where possible. 4

Application Programming Interface (API) Using the OmniJoin API enables for the support of customer-specific application and programming requirements using client-to-server architecture. OmniJoin can be integrated into custom web portals or custom applications. Allowing pre-call and post-call functions (meeting management) that let you manage OmniJoin outside of the standard Brother interfaces. Dynamically create or delete meeting rooms in response, to website inputs or custom application calls (available upon request) OmniJoin Interoperability OmniJoin is interoperable with the following hardware software as detailed in the table below: System Requirements Supported OS s Supported browsers CPU Hard disk space Presence client (optional) Recommended Devices Mobile Client - ios Windows 8.1, 8, 7, Vista / Apple Mac OS x 10.6 or higher (Intel CPU only) PC Microsoft IE 8 or higher, PC/Apple Mac Google Chrome v33 or later, Mozilla Firefox v27 or later, Apple Mac Safari v6.1 or later Core2 Quad, Intel i3, i5 or i7 equivalent CPU Memory (RAM); 4 GB or higher 100Mb Windows 8.1, 8, 7, Vista / Apple Mac OS x 10.6 or higher (Intel Only - Core2 Duo or Quad, Intel i3, i5 or i7) Web cameras any integrated or external USB based camera external webcams that support 720p or higher recommended Audio any integrated microphone and speakers external USB headsets or speaker phones recommended Client availability Apple App Store Supported ios model versions ios 6.0 or later ipod Touch 5th generation or later iphone 4/4S or later ipad2 or later 5

Android Client Android Client is scheduled for release this year and will become available as a Free of Charge Telephone Integration Telephony integration is available at local rate based on a pre-paid bundle of minutes Legacy Videoconference Technology Support for H.323 / SIP based videoconference systems is planned for the OmniJoin late 2015. OmniJoin Audio fidelity OmniJoin supports high quality wide band audio, offering full duplex audio with echo cancellation and adaptive noise suppression. Audio streams are optimised to be synced and kept in time with video. OmniJoin Video Quality OmniJoin distinguishes between physical capture, encoding, and display resolution; knows the bandwidth status and display layouts at each endpoint; and then leverages its real-time controls to deliver the highest quality video conference possible within these constraints. Technical note: competing technologies do not know, at the capture or encoding steps, the display resolution at the recipient. In this respect, OmniJoin Intelligent Video is a major technological leap forward. Intelligent continuously monitors the capabilities of participants in a conference including their display size and real-time available bandwidth Dynamic OmniJoin adjusts video encoding quality, in response to challenging bandwidth conditions and attendees video layouts decisions Scalable OmniJoin scales video quality from low resolutions up to HD 1080p Video streams can be floated and displayed over multiple screens Intelligent Rate - provides flexibility in low-bandwidth environments by providing an additional lowquality stream (reduced bit rate, frame rate, or resolution). This can be sent to participants experiencing low-bandwidth conditions without sacrificing quality for other participants Intelligent Video Summary: Meters all endpoints in a conference including display size, bandwidth, and session properties Operates at low bandwidths 82kbps > and will not time out with high latency connections 6

Dynamic OmniJoin controls each step, video capture, encoding and display, in response to changing bandwidth conditions and attendees video layouts Scalable OmniJoin can scale video quality from low web resolutions to HD 1080p Granular controls over video quality and the conferencing experience The OmniJoin cloud, with nearby resources closer to you than many competing services and fixed-site hardware-mcu-based video conferencing implementations, adds to the above advantages by reducing round-trip latency. OmniJoin Bandwidth Summary Video bandwidth is subjective to the use and to configuration that is enforced, either at the service provider level or by customer s administration of OmniJoin. Bandwidth is also variable based on how Intelligent Rate will meter and throttle the connection link. Below the following table should be used as a general guide to the expected consumption of bandwidth at various resolutions and frame rates. Only video and audio were tested (excluded data sharing) (Reference for a meeting with 2 video attendees. Unit: kbps) OmniJoin conference call (not using intelligent rate) frame rate Unit: fps 10 15 20 30 Resolution Kpbs Kpbs Kbps Kbps 160x120 82 85 88 90 "Preferred Resolution" setting 320x240 102 105 110 120 640x480 150 160 180 210 1280x720 360 510 580 660 1920x1080 810 960 1060 - Presence Client Offers complete secure messaging solution that is optional to the web interface method of using OmniJoin. 7

It provides a desktop app for PC and Apple Mac that allows escalation from Instant Messaging to an OmniJoin conference. Secure mail messaging, conference control and scheduling and meeting management. The presence client also operates outside of the conference license so can be deployed to the entire desktop estate and used for presence and IM. Supporting the ability to create groups of users (organisations) and control access via IM and presence to who can see who. Licence OmniJoin benefits from a concurrent enterprise license that allows OmniJoin to be installed on any number of PC s with unlimited number of defined users, benefiting from the Free of Charge presence and IM client. The license only enforces the number of concurrent conference sessions. OmniJoin screen sharing OmniJoin offers the full capability to allow multiple methods of control and sharing abilities. This include: Share desktop (supports multiple displays) Application (share any currently loaded application) Whiteboard Media file (optimises it for the conference) Regions (Share and enlarge screen region) Full annotation / save and print These are defined for meetings and participants and depend on the features enabled at a Service provider level and or administrative level: Hosts Own and control of the meeting room environment, and can share any file, application or share desktop or play optimised media files, uploaded PowerPoints and other documents can also be annotated when this feature is enabled. When enabled remote control can allow the shared content to be work on remotely. Presenters have the ability to share documents as defines for the meeting Participants can join and see what Hosts and Presenters are showing but have no control and can only see what they give by hosts/presenters OmniJoin Conference Scheduling Using a simple to use web interface or optional desktop app or using the OmniJoin API, meetings can be easily scheduled to allow Hosts and Participants to communicate in a secure manner. All virtual meeting rooms can be configured with passwords and also locked so participants will be held in an isolated waiting room until the Host joins at this point they are transferred into the meeting room. 8

OmniJoin supports various methods of meeting configurations these are defined as below: Registration based conference Scheduled conference Ad-hoc conference (on-demand) Registration based conference this is scheduled at a pre-defined time and requires the invited participant to respond to and emailed invitation and click on a web form when this has been filled and completed (details can be defined when this is scheduled for information required, including for example any legal consent wording that is required by the organisation) a second email will be sent with details of the URL link to join the conference and also meeting password. Users can not join until a defined time before the meeting e.g. 15mins meeting room can also be locked and users will be held in a waiting room until the meeting owner joins. Example: 9

Scheduled conference this is the most common type of virtual meeting used - a scheduled for a pre-defined time and only becomes active at a defined time before the meeting e.g. 15mins Ad-hoc is a conference room created on the fly and the invitation can be emailed and user can immediately join straight away. Conference passwords, and restrictions defined during the creation apply as do the meeting lock feature that will hold participants in a waiting room pending the owner joining. OmniJoin ease of use OmniJoin is designed to be completely user friendly and does not require technical expertise to be utilised. Once a meeting has been scheduled the attendee accepts by clicking on the invitation, following the security procedures set by the host (password or pin) and then entering the meeting. A media configurator window is prompted when they enter the meeting and simply requires the attendee to select what audio and visual devices they are using from a drop down selection and to set the volume via a simple slide bar. OmniJoin will only list what devices they actually have connected and this can still be adjusted by the host if necessary. Once this has been completed they guest attendee will be visually and audio enabled. 10