1CLICK.io

Do Business Face to Face

How secure is your 1Click Live Video Chat?

FacebookTwitterLinkedInGoogle+Pinterest

privacy-issues-statistics

According to a Forrester report, the general features of any good live video chat software are customization, routing, efficiency, chat interface, systems integration and reporting and analytics. However, no live video chat is completely perfect if not for advanced security features.

The security aspect of any chat software is of utmost importance. However, the security of a video chat software is of even higher importance. Why? Well, for starters, a video chat involves face-to-face communication between two individuals. In the case of video calling in business, the agent is a complete stranger to the customer. Hence, there is a lot of trust and credibility at risk to the agent. And for this very reason, security is of highest priority for any video chat software.

1Click’s live video chat enables not just face-to-face real time communication. It also allows for document sharing and confidential information sharing during virtual conference meetings. The chat software, however, makes sure all the information shared is secure and protected appropriately.

THE TLS PROTOCOL

Like I mentioned earlier, video chat in businesses imply a face-to-face communication over video. Hence, it is of utmost importance that the two applicants, in conversation, feel secured. This is where the Transport Layer Security (TLS) protocol comes into action. The primary aim of the TLS protocol is to provide communications security between the two applicants over the Internet. 1Click uses the latest version in security standards of TLS 1.2. The TLS makes sure the connection is private and reliable. This is done when both the agent and customer authenticate each other. This is then followed by negotiating an encryption algorithm and cryptographic keys before the application protocol transmits or receives any data.

CRYPTOGRAPHY KEYS

What is a cryptographic key and why is it important for a secured live video chat? A cryptographic key is a series of bits used by cryptographic algorithm. This is used to convert plain text into cipher text or the other way round. This key is private and, hence, ensures secured communication between the agent and the customer. How are these keys derived? 1Click derives these cryptographic keys using:

1. Datagram Transport Layer Security – Secure Real-time Transport Protocol (DTLS-SRTP)

The DTLS-SRTP allows for the exchange of the cryptographic parameters, which in turn, helps in obtaining the key material. This key exchange follows the media path and not the signalling path, and are multiplexed on the same ports as the media itself. This process transfers a fingerprint attribute in the Session Description Protocol (SDP), which is carried over secured websockets. This fingerprint attribute will be presented during the DTLS handshake. The integrity of the fingerprint attribute will be protected using the Session Initiation Protocol Identity mechanism. The SIP also prevents the fingerprint from being modified by intermediate proxies.

2. SDP Security Description – Session Description Protocol (SDES-SDP)

The SDES-SDP along with its crypto parameters are similar to that as DTLS-SRTP. These parameters are to exchanged over secure websocket connections. These crypto parameters describe the cryptographic suite, key parameters and session parameters for the earlier unicast media line.

CRYPTO-SUITE

A crypto-suite, or an identifier, helps in describing the encryption and authentication algorithms that is utilized in the SRTP media stream. The Secure Real-time Transport Protocol (SRTP) uses a cryptographically secures pseudo-random function (PRF) which generates encryption and authentication session keys from the master key. Both the master key and master salt will be derived by applying HMAC, keyed with the material received during the key exchange protocol. The possible values of the suite parameter will be defined within the text of the transport. This means that every transport defines a separate space for the set of crypto-suites.

POWERFUL ADVANCED ENCRYPTION STANDARD

The advanced encryption standard or AES is a description for the encryption of electronic data. The AES was established by the US National Institute of Standards and Technology (NIST) in 2001. 1Click’s default AES is AES_CM_128_HMAC_SHA1_80. This AES provides agents with a 128 bit master key and a 80 bit authentication tag. The default lifetime of this crypto-suite is 2^48 Secure Real-time Transport Protocol (SRTP) Packets or 2^31 SRTCP Packets. 1Click has another AES, i.e, AES_CM_128_HMAC_SHA1_32, which is quite similar to that of the crypto-suite. However, unlike the 80-but authentication tag provided by the default AES, this AES provides a 32 bit authentication tag.

ACCESS RESTRICTIONS

1Click allows agents to have complete control on who is a part of the conversation and who shouldn’t. Using the live video chat, agents can ban certain customers based on their IP addresses. During virtual conference meetings too, the agent can choose those s/he wants as a part of the meeting. Hence, every information discussed in the meeting is not open to all.

Hence, the security aspect of any live video chat software is the highest priority and every video chat software should comply with every possible security aspect to provide customers with a secured communication service.