TRANSEC

Advanced Overview

2008 VT iDirect, Inc.

TRANSEC Operation

iDirect ACC and DCC Encryption Channels

Operational Encryption
Public Key Infrastructure
Acquisition & Authentication
Acquisition Obfuscation
Key Rolls
Handling Security Compromises

Encryption Channels
Acquisition Ciphertext Channel (ACC)
Only used during Acquisition and Authentication
Based on ACC key using AES 256 CBC symmetric encryption
Key is initially distributed to the remote manually then updated
over the air in operation
Key is rolled every 28 days by default. Key is stored if the power
is turned off. Remote must manually rekey if it is out of network
for two keyrolls.

Data Ciphertext Channel (DCC)

The DCC channel encrypts all user data traffic with the DCC key
using AES 256 CBC symmetric encryption
Masks activity with random blocks of data when remotes have no
data to send Wall of Data
Key is updated over the air every 8 hours by default. Not stored if
power is cycled.

Operational Encryption

Wall of Data

Hub System
XLM

XXLMXXLLMLX LLVLMXX

VMXXMM
XXXMVLL

KR

IV
VMXXMM
XXXMVLL

KR

IV

TOS

00110101101001 SADA

LLVLMXX

XLM

XXLMXXLLMLX

ACCkey

ACCkey

IPencryptor

DCCkey

DCCkey

IPencryptor

Evolution e8000
Series Remotes
$%^#$#%@^&&#

SADA

TOS

SADA

TOS

$%^#$#%@^&&#

Demand
Header DID

WAN

DCCkey

ProtocolProcessor

TRANSEC Hub

Evolution e8000
Series Remotes

IPencryptor

Public Key Infrastructure (PKI)

Host private keys/public keys

Asymmetric cryptography
Each host has a set of self generated private and public
keys used for certificate exchange and verification
2048 bit long private / public keys (RSA)
These keys protect all network key exchanges

Each network element has a X.509 certificate

A certificate is a document that connects a public key to
an identity
Used to authenticate remotes and build a chain of trust
Certificates are issued by iDirect CA

Public Key Infrastructure (PKI)

Wall of Data
Hub System
XLM

XXLMXXLLMLX LLVLMXX

VMXXMM
XXXMVLL

KR

IV
VMXXMM
XXXMVLL

KR

IV

TOS

00110101101001 SADA

LLVLMXX

XLM

XXLMXXLLMLX

X.509Certificate

IPencryptor

DID #456789
Public Key

DCCkey

Signature

$%^#$#%@^&&#

SADA

TOS

SADA

TOS

$%^#$#%@^&&#

ACCkey

Demand
Header DID

WAN

ProtocolProcessor

TRANSEC Hub

Strong
Authentication

ACCkey
DCCkey

IPencryptor

Evolution e8000
Series Remotes

TRANSEC Network Acquisition

When and only when a remote is out of network, the
hub periodically invites it to acquire on ACC channel.
An out-of-network remote immediately responds to this
invitation on the ACC with an "ACQ Burst" from which
the hub calculates the timing, power and frequency
offsets the remote must apply to successfully join the
network.
The hub and remote authenticate across the ACC
using X.509 Certificate Exchange
Current ACC and DCC keys are encrypted using the
remotes public key (PKI) and distributed to each
remote

Acquisition and Authentication

VMXXMM
XXXMVLL

X.509Certificate
ACCkey

DID #456789
Public Key

DCCkey

Signature

ACCkey
DCCkey

Evolution e8000
Series Remotes
ACCkey

DCCkey
ACCkey

X.509 Certificate
DID #123456
Public Key

ACCkey
DCCkey

Signature
DCCkey

ProtocolProcessor

TRANSEC Hub

Evolution e8000
Series Remotes

ACQ Obfuscation

To mask the actual acquisition activity, the hub will

Issue dummy invitations to remotes already in network, so that it appears there is always
some acquisition activity. Remotes in network will always burst in response to dummy
invitations.
Deliberately not issue invitations for some slots, so the ACQ channel never appears full.
Issue normal invitations, in which some remotes will burst and others will not.

Frequency, timing and power of dummy bursts will vary to hide

usage patterns

Key Rolls
Changing encryption keys
Peer 1
periodically helps prevent
attackers from deriving keys
from captured data
(cryptanalysis)
iDirect TRANSEC makes
rolling period configurable
ACC key must be manually
distributed the first time or if
a remote is out of network
for 2 ACC keyrolls

Key Distribution Protocol

Peer 2

Mutual Trust Established

Key Distribution Complete

Global Key Distributor

Global Key Distributor (GKD)

GKD distributes ACC key among one or more
networks
Allows roaming remotes to acquire into all networks

Multiple GKDs can be configured for redundancy

Within an individual hub
Between multiple hubs

Handling Security Compromises

Zeroization is a process for removing all Critical
Security Parameters (CSPs) from a network element.
Network configuration
DCC and ACC keys
Public/private key pair

Certificate revocation adds a certificate to the CRL,

breaking trust between an entity and the rest of the
network.
Network acquisition fails
Key distribution ceases to work

Operator-triggered key rolls, in combination with

certificate revocation prevents network elements from
decoding data.

THANK YOU