myViewBoard Security Development Overview
This document is being provided in response to the inquiry made to ViewSonicfor requesting security development and deployment architecture for the myViewBoard project. Security and privacy are components of myViewBoard TM in the design, development, and delivery of this service.
In this document we will describe how we integrate Github, Docker, and Circle CI,deploy secure, scalable architecture on Amazon’s Web Service Cloud platform, WebRTC’s protocol for securing our streaming service, and how PGP (Pretty GoodPrivacy) is integrated in our secure file sharing and transmit use case. This approach is designed to balance customers’ needs for security and confidentiality with public information in regard to technologies and third-party solutions that myViewBoard integrates.
- 1 Secure Development Lifecycle
- 2 Product Architecture Overview
- 3 Storing and Managing Encryption Keys in the Cloud
- 4 Protecting Data in Transit to Amazon S3
- 5 Protecting Data in Transit to Amazon RDS
- 6 Protecting Data in Transit to Amazon DynamoDB
- 7 Secure Streaming Service
- 8 WebRTC Built-in Security Features
- 9 Signalling Server
- 10 WebRTC Default Case - P2P
- 11 WebRTC Default Case - TURN
- 12 WebRTC Default Case - Encryption
- 13 Addendum
Secure Development Lifecycle
Security Development Lifecycle is a set of activities and milestones which can drive high-quality security outcomes in product and services development. It can be subdivided into 4 distinct sections: Architecture and Design, Implementation, Validation and Release. A review is conducted after each stage has been completed. Below are the activities that should be taken care of at each stage of the Secure Development Lifecycle process:
Continuous Integration and testing with cloud service
Product Architecture Overview
Storing and Managing Encryption Keys in the Cloud
Security measures that rely on encryption require encryption keys. In the cloud, as in an on-premises system, it is essential that access keys are secure. Combining server-side encryption with AWS key management and storage capabilities, Amazon Web Services is able to provide an HSM service in the cloud known as AWS CloudHSM.
AWS employs a private network with ssh support for secure access between tiers and is configurable to limit access between tiers.
Reference: Amazon Web Services
Protecting Data in Transit to Amazon S3
Like AWS service management, Amazon S3 is accessed over HTTPS. This includes all Amazon S3 service management requests, as well as user payload, such as the contents of objects being stored/retrieved from Amazon S3 and associated metadata. When the AWS service console is used to manage Amazon S3, an SSL/TLS secure connection is established between the client's browser and the service console endpoint. All subsequent traffic is protected within this connection. When Amazon S3 APIs are used directly or indirectly, an SSL/TLS connection is established between the client and the Amazon S3 endpoint. All subsequent HTTP, and user payload traffic is encapsulated within the protected session.
Reference: Amazon Web Services
Protecting Data in Transit to Amazon RDS
Connecting to Amazon RDS from Amazon EC2 in the same region relies on the security of the AWS network. Connection from the internet uses SSL/TLS for additional protection. SSL/TLS provides peer authentication via server X.509 certificates, data integrity authentication, and data encryption for the client-server connection. SSL/TLS is currently supported for connections to Amazon RDS MySQL and Microsoft SQL instances. For both products, Amazon Web Services provides a single self-signed certificate associated with the MySQL or Microsoft SQL listener. Amazon RDS for Oracle Native Network Encryption encrypts the data as it moves into and out of the database. Oracle Native Network Encryption encrypts network traffic travelling over Oracle Net Services using industry standard encryption algorithms such as AES and Triple DES.
Amazon RDS VPC
Protecting Data in Transit to Amazon DynamoDB
Connecting to DynamoDB from other services from AWS in the same region relies on the security of the AWS network. Connecting to DynamoDB across the internet uses HTTP over SSL/TLS (HTTPS) to connect to DynamoDB service endpoints. Avoid any HTTP for access to DynamoDB and for all connections across the internet.
Secure Streaming Service
Browser-based communications eliminates cost and complexity
By breaking vendor and platform dependencies, WebRTC transforms enterprise communications. Until now, businesses have been limited to expensive desk phones and proprietary software clients. While vendors support open standards such as SIP (Session Initiation Protocol), many maximize product margins by providing support only for proprietary endpoints and separately licensed software clients. With more workers using smartphones as their primary handset, expensive desk phones are becoming increasingly difficult to justify. What businesses need is a way to make smartphones and tablets viable alternatives to traditional phones. However, traditional solutions for extending enterprise communication services to mobile devices are costly and inefficient.
Most UC (Unified Communications) vendors offer operating-system-specific soft clients that take time and money to qualify, deploy, and support. WebRTC overcomes these limitations by bringing real-time communications directly to the browser. This eliminates special purpose, OS-specific clients. With WebRTC, IT organizations can accelerate time-to-market and contain costs by extending enterprise communications services to any browser-enabled device (smartphone, tablet, or PC).
Users can access the WebRTC-enabled service over any network – public or private; WiFi, mobile broadband, or wired LAN. WebRTC reduces upfront IT expenses by containing client licensing fees, qualification efforts, and deployment costs. There are no proprietary clients to purchase, roll out, update, or support. The client application runs on an off-the-shelf "free"browser. Qualification, deployment, and maintenance costs are contained to the Web site. New features and fixes are implemented right on the Web page.
WebRTC Built-in Security Features
In essence, downloading any software from the internet carries an inherent risk that your PC may become infected by a virus, malware, spyware or various other 'bugs'that threaten the security of your data. As such, the principal solution to combat viruses is to install firewalls and anti-malware software that work to defend your computer against any potential threats.
With WebRTC however, there's no need to worry about any of that because since WebRTC works from browser to browser, you don't need to download any software or plugins in order to set up a video conference or VOIP call. All the security that you need is already contained within your browser and the WebRTC platform. Some of the in-built security features contained within the WebRTC platform include:
- End-to-end encryption between peers
- Datagram Transport Layer Security (DTLS)
- Secure Real-Time Protocol (SRTP)
Encryption is built in to WebRTC as a permanent feature and addresses all security concerns effectively. Regardless of what server or compatible browser you're using, private peer-to-peer communication is safe thanks to WebRTC's advanced end-to-end encryption features.
Data Transport Layer Security (DTLS)
Any data that is transferred through a WebRTC system is encrypted using the Datagram Transport Layer Security method. This encryption is already built into compatible web browsers (Firefox, Chrome, Opera), so that eavesdropping or data manipulation can't happen.
Secure Real-Time Protocol (SRTP)
In addition to offering DTLS encryption, WebRTC also encrypts data through Secure Real-Time Protocol, which safeguards IP communications from hackers, so that your video and audio data is kept private.
WebRTC Default Case - P2P
This is a true End-To-End encryption (E2E)
WebRTC Default Case - TURN
A TURN Sever DOES NOT terminate the encryption. In this case, it's a true End-To- End encryption (E2E)
WebRTC Default Case - Encryption
Changes to the system environment:
This document relates exclusively to the details of the product or project specified above. This section is designed to provide requested details on how the product in question interacts with the system environment in question.
This product has software components that are installed in standard user directories. Any exceptions to this are listed below:
- Crossmatch Fingerprint SDK
This software component also adds or makes modifications to the following system attributes and configurations (such as registry entries, firewall settings, digital certificates, kernel mode drivers, and browser plugins):
- Registry Keys:
Services: The following are uses of cryptography:
- Hashing Algorithms: SHA25
- Public-Key Algorithms: RSA-204
- SSL Schemes: TLS 1.2
The following is a list of all known third party components used in this product:
- - MQTT 3.1 and 3.1.1 compliant
- - QoS 0 and QoS 1