R&S FT5066 Trusted Filter Radio control information filter red/black separation

Transcription

1 Secure Communications Data Sheet R&S FT5066 Trusted Filter Radio control information filter red/black separation to STANAG

2 R&S FT5066 Trusted Filter At a glance The R&S FT5066 trusted filter is developed for a scenario consisting of a STANAG 5066 message handling application involving a radio and/or modem interface and a remote control protocol. The device provides firewall functionality for the radio s control information. Inserted in the control path of a system, the filter provides a strict red/black separation. This ensures that only explicitly permitted control commands are transmitted and prevents (un)intentional data leakage over the control interface. One aspect often neglected in a communications system is the threat caused by the transmission of control information. The path for control information is necessarily nearly always plain. As a result, it can be deliberately or unwittingly abused, e.g. through a programming error, to circumvent the encryption mode and transmit sensitive information openly. The R&S FT5066 protects the control path and prevents the accidental diversion of red data to the black side of the system. A potential security leak results because the message handling system to be protected processes red data (payload data) as well as the data required to control the modem and radio equipment on the black side of the system. An error condition occurring inside the message handling system can lead to an unintentional transfer of payload information to the black side, bypassing the cryptographic engine. The R&S FT5066 detects, blocks, signals and logs these compromising error conditions. Separate, independent and autonomous built-in tests ensure the ongoing integrity of the R&S FT5066 s firewall functionality. A read-only logging function has been implemented to deny any possible access to the device over the external interfaces, which further enhances the integrity of the device. Key facts Rigid enforcement of classification boundary between red and black data Prevents data leakage over the control interface Operates in systems classified up to SECRET Built-in tests and access control Audiovisual status indicators and detailed logging function Supports R&S M3SR radios, Harris and RM6 as well as GA-123 modems 2

3 R&S FT5066 Trusted Filter Benefits and key features Red/black separation provides system integrity Managed communications relationships and flows avoid security leaks Two independent processors cross-check the integrity of red/black separation Mathematical checksums prevent control data bypass within the device page 4 Verifiable and security-conforming mapping of overall system White list function with zero tolerance for secure operation Exhaustive testing of the system ensures overall integrity page 6 Detailed and direct system status and logging Clear signals provide precise information on current system status Detailed logging for maintenance and adjustment page 7 Design concept protects against manipulation and secures device integrity Physical and logical measures prevent undetected manipulation Comprehensive self-testing ensures the permanent reliability of the system page 8 Rohde & Schwarz R&S FT5066 Trusted Filter 3

4 Red/black separation provides system integrity Managed communications relationships and flows avoid security leaks The R&S FT5066 has two processors that control the flow of communications within the device, as well as to the message handling system (MHS) and the radio/modem. One processor is responsible for communications with the MHS on the red side, while the second processor handles communications with the radio/modem on the black side. Control commands flow over two separate paths. A unidirectional driver allows information from the black side (radio/modem) to enter the red area (MHS) but, critically, prevents data from the red side from using this path. Data from the red side can only flow to the black side through the path using the two independent processors. Log information can only be output over the read-only interface, which is on the red side. No information can enter the device via the log interface, i.e. leave the red side, nor can the R&S FT5066 be accessed and compromised over the log interface. Red/black separation for the control path Red side Black side STANAG 5066 PC Control path Data path R&S FT5066 Crypto device Control path Data path Radio or modem 4

5 Two independent processors cross-check the integrity of red/black separation The R&S FT5066 has been designed with two independent processors: one for the red and one for the black side. Each processor has been independently initialized with its own program (filter policy) in the manufacturing process and has its own physical flash memory and RAM in which the respective boot loader and firmware of each processor has been stored. Both processors initialize independently and check that the firmware is operating on the correct processor side. The red processor then confirms that the black processor firmware version is correct. The device will only operate after all tests have been completed successfully. Mathematical checksums prevent control data bypass within the device During operation, the red processor receives a control data package from the message handling system, examines it and, if deemed valid, encapsulates it with a start byte, header byte and end byte. The header byte includes a checksum (CRC) and the data length. The black processor receives and processes the data and checks the results. The black processor will forward the information to the radio/modem and send an acknowledge to the red processor only if all mathematical parameters coincide. Data from the MHS is forwarded to the radio or modem only when both processors operate correctly on their own and in tandem. Data flow within the FT5066 Log interface Red interface Red processor system Unidirectional driver Black processor system Black interface Rohde & Schwarz R&S FT5066 Trusted Filter 5

6 Verifiable and security-conforming mapping of overall system White list function with zero tolerance for secure operation The R&S FT5066 operates on the basis of positive vetting (white lists) and does not tolerate even the smallest deviation. The device is always configured to operate in a known and clearly specified environment. The environment includes specifically the control path, the message handling system and the radio or modem. Exhaustive testing of the system ensures overall integrity Extensive consultation and testing is required with all parties before a device can be released for the specific application and put into operation. Any deviations must be evaluated from the security risk perspective. Any non-conforming communications protocols are either rejected, or the offending protocol implementation must be modified. Typical operating environment Customer PC client Customer PC TCP/IP application LAN Remote control R&S STANAG 5066 server (R&S PSL1) Serial data R&S FT5066 trusted filter R&S ED4-2 crypto device R&S XK4115 HF transceiver 6

7 Detailed and direct system status and logging Clear signals provide precise information on current system status Audiovisual signals provide immediate and easily recognizable information on the status of the system. Clearly visible LEDs on the front panel of the device indicate the proper functioning of the system or the device warning level. Separate LEDs for the red and black side help to pinpoint the source of non-permitted behavior. A clearly audible tone is activated as soon as the device is in blocking mode, which is the state the device enters after it has received the maximum number of warnings or a critical error has occurred. Detailed logging for maintenance and adjustment The logging function provides further information on the operational status of the system. Faulty control commands are listed with the relevant error code to pinpoint the origin of the errors. The details help to differentiate between red and black processors, other components and implementations and enable a quicker resolution of the problem. Three different error levels indicate the potential risk of compromising the system due to a faulty transmission. Log data Time stamp Radio/modem Error number/description Incorrect transmission, information blocked Rohde & Schwarz R&S FT5066 Trusted Filter 7

8 Design concept protects against manipulation and secures device integrity Physical and logical measures prevent undetected manipulation Various physical and logical procedures and processes protect the R&S FT5066 against malfunction and manipulation. Separate filter lists for each processor are loaded into the device in a secure environment during production. The R&S FT5066 is sealed afterwards to prevent access to its internal interfaces. CRC processes are used within the device for communications between the processors (file names, control commands, etc.), and the external interfaces (logging functionality) can only be used to read out data. Comprehensive self-testing ensures the permanent reliability of the system The R&S FT5066 performs a built-in test (BIT) after power on or after the RESET button has been activated. The red to black transmission channel is blocked while the BIT is being performed. Both green LEDs light up after the successful, error-free completion of the BIT. A continuous audio tone is emitted and at least one red LED flashes if the BIT fails. In this case, the device must be returned to Rohde & Schwarz for reinitialization. Seals provide tamper detection Seals Rohde & Schwarz R&S FT5066 Trusted Filter 8

9 Specifications Specifications Interfaces Logging Black control Red control CE conformity EMI Safety V.28, 9-pin D-Sub, female, Bd V.28, 9-pin D-Sub, female, Bd fix (model.02: 9600 Bd fix) V.28, 9-pin D-Sub, female, Bd fix (model.02: 9600 Bd fix) in line with EN class B (emissions), in line with EN (immunity) in line with EN (requirements for ensuring safety of IT equipment) Environmental conditions Max. operating temperature +70 C Max. storage temperature +85 C Min. operating temperature 30 C Min. storage temperature 40 C Rel. humidity at +40 C max. 95 % Vibration in line with Rohde & Schwarz HVO 149 class A Shock test in line with Rohde & Schwarz HVO 149 class B Power supply Operating voltage range 20 V to 28 V (24 V nominal) Max. power consumption 4 W Connector KYCON KPJX-3S female General data Dimensions W H D 130 mm 45 mm 165 mm (5.1 in 1.8 in 6.5 in) Weight approx. 700 g (1.5 lb) Ordering information Designation Type Order No. Trusted Filter, for R&S XK2100, RM6, GA-123 R&S FT Trusted Filter, for R&S XK4115 R&S FT Trusted Filter, for Harris 5710A R&S FT Rohde & Schwarz R&S FT5066 Trusted Filter 9

10 Service you can rely on J Worldwide J Local and personalized J Customized and flexible J Uncompromising quality J Long-term dependability About Rohde & Schwarz Rohde & Schwarz is an independent group of companies specializing in electronics. It is a leading supplier of solutions in the fields of test and measurement, broadcasting, radiomonitoring and radiolocation, as well as secure communications. Established more than 75 years ago, Rohde & Schwarz has a global presence and a dedicated service network in over 70 countries. Company headquarters are in Munich, Germany. Environmental commitment Energy-efficient products Continuous improvement in environmental sustainability ISO certified environmental management system Certified Quality System ISO 9001 Rohde & Schwarz SIT GmbH Am Studio 3 D Berlin Fax info.sit@rohde-schwarz.com Regional contact Europe, Africa, Middle East customersupport@rohde-schwarz.com North America TEST RSA ( ) customer.support@rsa.rohde-schwarz.com Latin America customersupport.la@rohde-schwarz.com Asia/Pacific customersupport.asia@rohde-schwarz.com R&S is a registered trademark of Rohde & Schwarz GmbH & Co. KG Trade names are trademarks of the owners Printed in Germany (ft) PD Version July 2010 R&S FT5066 Data without tolerance limits is not binding Subject to change Rohde & Schwarz GmbH & Co. KG München, Germany