MPLS encryption security use case

Today’s digital world is rife with security challenges, particularly in mission-critical networks where public safety is paramount. These networks require top-tier security mechanisms that ensure critical services perform seamlessly and without disruption. Traditional encryption solutions, such as IPSec and MacSec, were conceived in a different technological era and can pose challenges when implemented in modern environments.

Transport-layer independent encryption offers a novel solution to these challenges. It provides a scalable, efficient encryption framework that guarantees seamless, end-to-end security for all traffic types, across any network topology, ushering in a new era of network encryption.

 

Real-world application of MPLS WAN security

A leading provider of critical transport infrastructure recently faced the prospect of developing a secure, reliable communications network to replace an outdated system. This new network was to deliver vital services ensuring safe transport operations nationwide, catering to private, military, and commercial operators at various physical locations.

Building the network on a private MPLS WAN was a strategic decision, but it posed a challenge. MPLS, though reliable, doesn’t offer inherent encryption; a non-negotiable requirement given the sensitive nature of the traffic carried. The implementation of encryption across the MPLS network had to achieve three primary objectives:

1. Provide encryption security whilst maintaining network performance.
2. Avoid alterations to the current network architecture.
3. Align with government certifications for protecting critical services.

 

Evaluating the alternatives

When it came to exploring their options, the company considered several alternatives, including IPSec VPNs in firewalls and routers. After rigorous lab testing, the chose to go with the CypherNET range of FIPS and Common Criteria certified High-Speed Encryptors (HSE).

Transport-Layer Independent Encryption was a key component of the decision as it offered a solution that could secure any network topology. It also provided robust encryption without performance or bandwidth compromises typically associated with IPSec encryption solutions. HSE’s versatility enables the encryption of network data at any layer and over any underlying service, providing an encrypted overlay that matches the security and flexibility of MPLS and IP technologies.

 

Key Benefits

1. Versatility Across Network Topologies: Unlike traditional encryption protocols, transport-layer independent encryption functions across a wide range of network topologies. It provides encryption at Layers 2, 3, or 4, making it suitable for various network configurations.
2. Robust Security Measures: Employing a NIST-approved Key Derivation Function (KDF) creates robust encryption keys, impervious to brute-force attacks. It eliminates the need for key exchanges between devices, significantly reducing the risk of eavesdropping and providing perfect forward and backward secrecy, plus it is quantum safe, ensuring long-term protection.
3. Scalability for Expanding Networks: Transport-Layer Independent Encryption is built with scalability in mind. Compared to traditional protocols, it reduces the key exchange frequency, making the generation of encryption keys more practical and efficient for large-scale networks.
4. Precision Control over Network Traffic: Flexible management allows precise control over network traffic, enabling specific security policy enforcement. This prevents malicious traffic from infiltrating the network and safeguards sensitive data.
5. Simplified Key Management: Eliminating the need for public key certificates simplifies the key management process by using a Key Derivation Key (KDK) that can be securely generated and installed into all devices within the network. This simplification is not only less prone to errors but also time-efficient.

 

Better technology, better outcomes

Having successfully deployed the CypherNET solution, the organisation was able to meet all of its stated objectives. An obsolete system was replaced with an advanced, secure communications network that could effectively deliver essential services across the nation. Dedicated hardware provided a highly secure encryption overlay for the MPLS WAN infrastructure. This allowed the business to maintain the highest security standard for their mission-critical transport services, without compromising network performance, paving the way for a future-proofed operation against evolving security threats.

 

Request a POC

More and more customers are turning to CypherNet encryptors to protect everything from core infrastructure to edge computing. If you would like to explore the opportunities offered by transport-layer independent encryption, /. today and start your journey towards a more secure infrastructure.