Security Best Practices

Security and compliance are essential for real-time engagements through technology. In order to provide safe and reliable cloud services, Agora adheres to the compliance requirements of different countries, regions, and industries, in addition to being certified to ISO/IEC 27001. For more information, see ISO Certificates.

Agora products and services are designed and built with multiple protection measures against attacks commonly seen in the real-time engagement industry. This article describes some of the security best practices that Agora has adopted, as well as security tools it provides for developers, as follows:

Level 1 - Channels separation

The channels architect is the first built-in layer of protection. Agora creates an independent and isolated channel for each audio, video, or messaging data transmission. All channels are logically separated and only authenticated users from the same App ID can join the same channel.

Level 2 - Token authentication

The second layer of protection is on the authentication layer. This is done via using the dynamic token authentication. The token is a short-lived access key, which is generated by the app backend and allows users to access the Agora platform after the user is properly validated by the app.

A token is generated with important information such as App ID, user ID (uid), channel name, and expiration date.

The app developer can enable token authentication (App Certificate) on Console. When enabled, all user’s request to join a channel must be done with a valid token.

Please note for best security practices, you need to set the token expiration time (24 hours by default). A token has three expiration timestamps:

• Token expiration: How long a token is valid for, that is, how long a user can stay in a channel.
• Privilege expiration:
  • Join a channel: How long a token can be used to join a channel.
  • Streaming privilege: Whether a user can send audio, video or messaging to the channel, or join as an audience member. This privilege is not enabled by default. For details, refer to FAQ: How do I use co-host authentication.

Level 3 - Encryption

The next layer of security in the Agora platform is encrytion. Agora supports transmission encryption and data encryption.

To guarantee data confidentiality during transmission, Agora uses the AUT (Agora Universal Transport) encryption protocol, Agora's proprietary secured transport layer.

Data encryption encrypts all the audio and video streams with a symmetric key and encryption controlled by the app developer. In this level the app provides a symmetric encryption key to the local SDK libraries.

The SDK encrypts all the captured media using the key and the configured encryptions using AES 128/256 (based on configuration). The data is sent encrypted to Agora SD-RTN^TM and from there to the other endpoints in the channel. The receiving endpoint will use the key provided by the app layer to decrypt the media streams and send to the renders. With this method, only the application knows the keys. In the Native SDK (iOS, Android, Mac, Windows) the keys are not sent to Agora servers.

When using Other Agora services like Web SDK, Cloud Recording, Content Moderation, Transcoding etc, encryption is done a bit differently and it is not end-to-end. In this case media is still encrypted but the Agora service needs to be aware of the key to be able to connect to the channel and provide service. For example, in Web SDK the User/Browser protection is done via the web-server protection (HTTPS) as well as the WebRTC standard, security practice (encryption, key management etc). More information on WebRTC security can be found here https://webrtc-security.github.io/.

The media encryption on Web SDK is done via WebRTC standard but the interoperability to Agora is done using Agora’s encryption engine and the encryption key is passed securely to the Web SDK servers via the APIs. The key is required as the Agora edge server will convert from WebRTC protocols to Agora’s protocol and allow interoperability with Native SDK. Similar situation happens with Cloud Recording, Content Moderation etc., where the Restful APIs are used to securely pass the key for the channel.

Level 4 - Network geofencing

To meet the laws and regulations of different countries or regions, the Agora RTC SDK supports geofencing. After enabling geofencing, the SDK only connects to Agora servers within the specified region, regardless of where your app users are located.

For example, if you specify North America as the region for connection, when two users attempt to connect to Agora servers from different locations, the result is as follows:

Security best practice checklist

Use this list to quickly check what measures you have or have not taken to best protect the security of you app and users:

1. Enable token authentication on Agora Console.
2. Disable No certificate in your project management page. Once it is done your app authenticates users with tokens only.
   
3. Deploy a token server in your backend services.
4. Protect the token server and only allow the app backend server to connect to the token server.
5. Set the token expiration date to a reasonable time. See the description of the privilegeExpiredTs parameter in API Reference.
6. If needed, contact support@agora.io to enable token privilege and set token per role.
7. For additional security if needed work with the Agora SA team to customize the token server and modify the token join privilege to a low time, like 5 min. This is more advance and recommended after app development is completed.
8. Channel encryption key management – generate a random key (secret) per channel at the time of creating the channel, do not reuse encryption keys.
9. Pass the channel encryption key (secret) securely outside of Agora engine to authenticated endpoints that are allowed to join the channel.
10. For additional security, you can also do the following:
    • Set the “Agora channel name” to a one-time random string managed by your app.
    • Set the Agora uid to a one-time numeric id that is mapped to the user on the app level. Do not use the users' real ID on your app as the Agora uid.