(Part Number – CEP-007-DDS-01) BlackTube CEP DS0 – DS0 Serial Circuit Extension Over Ethernet – Secure DDS to Ethernet – Engage

Overview

Flexible Serial Data Extensions over IP Packet or MPLS Networks

The Black•Tube CEP CEP DDS converts DDS serial data connections into AES encrypted IP packets, extending the serial data over very cost effective Ethernet or MPLS based LAN/WAN/MAN wired and wireless networks. Synchronous, Asynchronous, Isochronous or HDLC serial data is encrypted then encapsulated into IP packets. This facilitates the interconnection of Serial Data over IP between Serial Bulk Encryptors (KIV7/OMNI), Data Terminals, Data Acquisition Systems, WAN Routers and Bridges and SCADA RTUs

Layer 1 with Isochronous Support

In Layer 1 operating mode every bit is encapsulated into an IP packet. The size and frequency of the IP packets can be set with data bit rates from 2.4 to 64 kilobits per second. Isochronous serial protocols, such as Conitel, are transported synchronously to maintain message alignment. A configured number of incoming packets are buffered in order to compensate for the packet delivery jitter introduced by the network. The size of the Tube bit buffer is configurable to accommodate the peak amount of jitter.

Asynchronous Over IP

Asynchronous characters from the DDS interface with 5 to 8 data bits, baud rates from 1.2 to 38.4 kilobits, 1 or 2 stop bits that are with or without parity are efficiently encapsulated into IP packets. The encapsulation supports block mode transfers to minimize the bandwidth required. Additionally the latency is controlled by setting the Tube Bytes per packet.

SDLC Over IP

In Layer 2 operating mode SDLC Data frames, such as those used by IBM 317x Controllers, Wide Area Networking protocols PPP and Frame Relay or proprietary Data Links, are transported within IP packets as SDLC over IP. The Serial to Packet conversion only occurs when SDLC frames are active.

SCADA Protocol Transparency

The Black•Tube CEP transports Bit or Byte orientated SCADA protocols transparently because of its unique TDM circuit emulation capability. RTU transmit data is encapsulated into IP packets at configurable samples per second and deencapsulated at the far end at the same rate, ensuring properly timed RTU SCADA data delivery.

+

Dual LAN Interfaces

All IP•Tube SER DS0 models ship with dual 10/100 BaseT Ethernet LAN ports. The dual Ethernet interfaces provide for:

• Management interface on LAN port 2 when LAN port 1 is connected to a VPN tunnel
  
• Protector Option for Redundant Packet Path connections with Constant or Switch Over Criteria

Assured Delivery Protocol

In order to assure high quality communications over links with intermittent or noisy performance, such as Wireless. :

• Packet out of sequence detection and re-sequencing
• Duplicate skipping
• Lost packet retransmissions with configured delay

CEP Management

Black•Tube CEPs isolate management and data plane functionality with the use of two separate processor modules. Management processor access is limited to SSH or SNMPv3 encrypted sessions that employ AES256 bit keys and sophisticated NIST passwords. These sessions may be established after authentication via TACACS+ or Radius.
The independent Linux based management plane of the Black•Tube CEP ensures Critical Infrastructure Data is isolated from management network access. The Management Module uses internal serial ports to connect to the Data Plane processor.

Administration and User Logs are available with Syslog.

CEP management security features include:

• Administrative policies for adding, removing, disabling and renaming authorized users; limiting user access to assigned commands; and enabling only desired port numbers.

• User authentication directly or in conjunction with TACACS+ or RADIUS servers including RSA SecureID support for two factor trusted compliance.

• An SSH command interface encrypting management traffic with powerful 256 bit symmetric keys and NIST based passwords.

• Support of the SNMPv3 protocol for secure connectivity to SNMP element managers.

• In addition, administrative accounting data can be reported to syslog servers with accurate timestamps provided by an NTP source.

Protector Option

The protector option utilizes the second LAN interface as a redundant path for the interconnection of the IP encapsulated DDS data. The extension of the DDS has a fault tolerant link that is configured to always on, or with switch over criteria.

Related Products

The IP•Tube DLT1-MUX maps DSOs from a central site to as many as 24 remote locations via an IP/Ethernet connection. Get maximum use of expensive DS1 interfaces on PBX, Channel equipment and datacom gear. Also provides Virtual DACS Over IP capability. Mesh DS0s one-to-many or many-to-many.