Overview

The TR-069 Device Manager has a reliable and scalable security architecture. It achieves all the security goals, defined by the TR-069 Protocol specification, and delivers even more advanced security mechanisms.

The backend security policy encapsulates the following mechanisms:

Each of the described properties can be configured via backend bundle configurations OR through inheritable node properties in the RM device management tree. For further information refer to the TR-069 Device Management Configuration document.


  • SSL/TLS transport between the RM backend and the connected device. Running the TR-069 implementation in HTTPS mode will provide transaction confidentiality and data integrity.

    To turn on the TR-069 HTTPS Mode, set the mprm.tr069.httpsOnly node inheritable property to true for the group holding the target devices. In the Management Console, this property is shown as HTTPS mode and is placed within the Security Properties node property category. (Refer to the "Inheritable TR-069 Device Properties" section in the TR-069 Device Management Configuration document.)

  • Require basic or digest authentication from a device.

    The main properties to activate and configure authentication are:

    • To turn on authentication for HTTP, set the mprm.tr069.http.wwwAuth inheritable node property to Basic or Digest. To turn on authentication for HTTPS, use similarly the mprm.tr069.https.wwwAuth inheritable property.

    • If needed, change the realm of the ACS with the mprm.tr069.wwwAuthRealm inheritable node property, valid for both authentication types, or with the mprm.tr069.wwwDigestAuthDomain one for digest authentication only. Additionally, you can configure the parameters of digest authentication with the mprm.tr069.wwwDigestAuthDomain, mprm.tr069.wwwDigestAuthAlgorithm and mprm.tr069.wwwDigestAuthQOP properties.

      More information about authentication properties is available in the "Inheritable TR-069 Device Properties" section in the TR-069 Device Management Configuration document.

  • Banned IP addresses of devices that failed to connect a number of times are banned for some period of time. To configure the support of banned IP addresses, use the properties mprm.tr069.maxBadRequests, mprm.tr069.bannedIPCleanPeriod, mprm.tr069.banPeriod and mprm.tr069.banTableCapacity from the RM TR069 Configuration. For more information please see the the TR-069 Device Management Configuration document.

  • IP address filtering of connection requests coming from devices. The RM uses two lists for IP filtering, both configured by means of inheritable node properties:

  • Log specific security events in the RM Log Service as set up with the mprm.tr069.securityLogLevel property from the RM TR-069 Configuration. For more information please see the the TR-069 Device Management Configuration document.

  • Secure download mode, which the user can turn on by using the mprm.tr069.secureDownload property from the TR069 Download Manager Configuration. For more information please see the the TR-069 Device Management Configuration document.