Enhance Network Security: Q-Play Player and Editor Protocols Explained

Security and Protocols for Nordicscreen Systems

Player Configuration

1. Network Connection:

  1. Connect Players directly to the company's internal network without the need to open firewalls, either incoming or outgoing.

2. SSL Security:

  1. Ensure an encrypted connection by only allowing Players to connect to Q-Play's cloud servers via SSL (port 443).

Recommendations for Larger Companies

Isolated Network:

  1. For complex network structures, consider placing Players on a dedicated VLAN to ensure isolation from the company's primary network units.


Firewall Configuration

Essential Ports and Addresses:

  1. For finely tuned firewall settings, ensure openings for:
    1. DNS lookup: Port 53 (UDP/TCP)
    2. HTTPS connections: Port 443 (TCP)

Communication with Nordicscreen Servers

Q-Play V1 Server IP Addresses:

  1. 1.playerapi.q-play.net - IP: 116.203.16.33
  2. 2.playerapi.q-play.net - IP: 78.47.204.28
  3. 3.playerapi.q-play.net - IP: 78.47.50.80
  4. 4.playerapi.q-play.net - IP: 116.203.120.93
  5. app.tdplay.dk - IP: 195.201.28.125
  6. storage3.q-play.net - IP: 195.201.31.193
  7. wc.q-play.net - IP: 159.69.0.117 and 8.99.85.147

Q-Play V2 Server IP Addresses:

  1. app.q-play.io - IP: 163.172.188.220
  2. api.q-play.io - IP: 163.172.188.220
  3. https://94.playerapi.q-play.net - IP: 163.172.188.220
  4. https://97.playerapi.q-play.net - IP: 163.172.188.220
  5. https://98.playerapi.q-play.net - IP: 163.172.188.220

Q-Play V2 Integration Server IP Addresses:

  1. 167.235.239.183

Access to External Sources:

  1. Ensure access to external resources such as news feeds, YouTube, and other content sources.

Q-Cal: Network and Security Requirements

For Q-Cal, the following IP whitelist and port security requirements apply in the current setup:

Web Services

  • app.q-cal.net
    IP: 116.203.85.242
    Port: 443 (SSL)
  • controller.q-cal.net
    IP: 116.203.23.160
    Port: 11812 (SSL)

AD/O365 Synchronization

If access needs to be restricted, ensure the following IPs can communicate:

  • sync.q-cal.net → 142.132.160.124
  • app.q-cal.net → 116.203.85.242

Notes


Editor Security

Secured Connection:

  1. All communication between users and the Q-Play Editor occurs over an encrypted HTTPS/SSL connection (port 443).

Open Ports for Content:

  1. Opening HTTP port 80 may be necessary to access RSS feeds and news from foreign websites.

Q-Play system architecture diagram showing Player connections via SSL to NordicScreen cloud serversQ-Play system architecture

Account Separation Method 

Q-Play V2 is build on the Laravel framwork, tenant scoping is implemented with global scopes, which is recommended for implementing multi-tenancy on a one database setup.

Q-Play stores all integration login credentials encrypted with AES-256. NordicScreen employees do not have access to this information. The data is stored exclusively on the specific integration server managing the customer's integrations and is not saved anywhere else.

Hosting and Security Overview 

Our servers are hosted in Germany with Hetzner: https://www.hetzner.com/legal/legal-notice/.

Private Network
NordicScreen operates its own private network with a static IP address. This network is the gateway to critical systems, ensuring a controlled and secure environment.

Internet Security
There is no direct internet access to the server. Access is highly restricted and limited to select trusted employees with management responsibilities. Support and commercial personnel do not have access to these systems.

Access Protection

Multi-Factor Authentication (MFA) is effectively implemented through the combined use of these methods, ensuring robust protection against unauthorized access. Access to critical systems is secured with the highest standards, incorporating Multi-Factor Authentication (MFA), IP whitelisting, and SSH certificates for unparalleled protection.

This layered security approach ensures the highest levels of protection for all hosted systems and data.