Bundeswehr Restructures Information Technology And Communications

The Bundeswehr’s NuKomBw messaging system will provide the German military with secure e-mail capabilities and will replace aging legacy equipment. NuKomBw features advanced security applications and remote management and diagnostic capabilities.

New network replaces legacy equipment, provides enhanced security.

The German military is deploying an electronic communications system that allows users to exchange classified information across nonsecure fiber optic networks. Featuring advanced encryption technologies, the system will operate on existing infrastructure without the need to make major modifications or the danger of compromised security. When complete, the new system will replace legacy equipment and will connect all of Germany’s major military installations.

Originating from feasibility studies in the early 1990s, the Nutzerorientierte Kommunikation der Bundeswehr, or armed forces user-oriented communications system (NuKomBw), is being designed to emulate the U.S. military’s Defense Message System, explains Christian Willenberg, director, business intelligence, defense and communications systems division, European Aeronautic Defence and Space Company (EADS), Friedrichshafen, Germany. Another goal of the project is to replace the legacy teletype systems still in use by some parts of the German military. “The program is simply to provide all organizational units in the Bundeswehr—all the armed forces, not only the army—with a modern e-mail-based communications system,” he says.

The German government awarded the 20 million euro ($24 million) contract to EADS in 2004. It is organized in two phases, with the first part scheduled for completion in March 2006. At the end of this initial phase, all of the system’s 30 servers located throughout Germany and in some overseas locations, including the United States, will be in place. This initial installation also involves approximately 1,000 client workstations located in 260 major Bundeswehr facilities. First phase work includes all system engineering, design, addressing and configuration.

Phase two will increase the number of clients to 50,000 workstations. “Not every individual soldier will have a terminal, personal computer or laptop, but every organizational site or department will have one,” he says. NuKomBw systems also will be installed in mobile headquarters and facilities.

NuKomBw operates on existing Bundeswehr fiber optic networks. Willenberg notes that the military has been replacing and upgrading its networks to optical and asynchronous transfer mode systems over the past year. He adds that the Internet protocol (IP)-based network interoperates with advanced security applications more effectively.

Willenberg explains that the Bundeswehr’s information technology and communications systems are scheduled to be restructured through a major program called Hercules, which has not yet been launched. NuKomBw is one of the central services envisioned under this effort. These services include military messaging, standard e-mail services, Internet    services and public key infrastructure (PKI).  E-mail and Internet services already have been implemented. 

The number of services NuKomBw provides will increase in time as new applications become available. Consisting of Internet-based tools, this software will form a network of loosely connected services. Once the program is completely deployed, Willenberg predicts that it will remain relatively stable and will not require additional expansion besides system and hardware upgrades. “It’s not really the core of a huge system, but it is already quite a large system by itself,” he says.

The final rollout of NuKomBw’s second phase is tied financially to the Hercules program, but Willenberg believes that final rollout will be completed despite any funding issues. This last phase is scheduled to be complete in 2007. “All the functionality is there; all the management software is there; all the services are there; and the network is there. It’s only [about] the rollout of additional clients,” he says.

NuKomBw consists of four subsystems: messaging, directory, security and management. The directory service provides an automatically replicating system to create and manage address lists for user groups and to store PKI certificates.

Three types of security measures are built into the system. The first is based on virtual private network (VPN) hardware in the form of IP encryption boxes provided by the German federal office for information security, or BSI. The government also provides PKI certification for approved user groups.

The BSI has developed and implemented a family of security products called Security Infrastructure Network Architecture (SINA), which the program is using. “This is a hardware-based VPN. It is certified, Tempest-hardened equipment. It has a reduced Linux kernel operating system and a hardware encryption processor specially designed and secured by the BSI,” he says.

The program has shipped more than 300 VPN encryption boxes to all of the server nodes. This equipment secures all access to the standard Bundeswehr network and adds a layer of security to it, Willenberg explains.

PKI encryption provides a second layer of security at the application level. This method relies on smart card access—every client system keyboard is equipped with a smart card reader. PKI also allows users to encrypt and to digitally sign their messages. Willenberg adds that the Bundeswehr’s central PKI authority provided certificates and smart cards.

A central control center will monitor and manage message traffic across the NuKomBw network. The center will serve as a help desk and will conduct data recovery and restart functions for the system’s servers.

Gateways are the third and final part of the security architecture. Willenberg notes that passing data between secure and nonsecure domains in military networks is an old dilemma engineers face. He explains that EADS developed a product called Secom Secure Connect that permits and protects the transmission of messages between different security domains. The product is certified by the German military and is used in the program, he says. 

NuKomBw is fully interoperable with NATO networking communications systems at the unsecured level. At this level, it adheres to all NATO protocols and has been tested at NATO’s information technology laboratories in The Hague. Willenberg observes that this level of interoperability was not possible five years ago.

For secure communications interoperability, NATO has recently defined a common gateway called ACP 145. The gateway allows information to be transferred from a local national system to a NATO network via a gateway that performs security functions. A secure message sent through the gateway is decrypted and then re-encrypted with a NATO key. “Otherwise it [the messaging] will not work because you will not allow your national certificates to be published for use [and] because then you would be open to all the world. No national organization would do that,” he says.

The ACP 145 gateway has been defined and tested, but it is not used operationally because there are no partners in the program. Willenberg notes that the only available partner is the United States with its Defense Message System. NATO does not currently have an applicable system. “I think the mechanisms are there, and they will be based on ACP 145,” he says.

EADS engineers faced several challenges in designing the system to interoperate with legacy equipment. Willenberg believes that much of NuKomBw’s complexity comes from combining many new technologies such as directories, multiple-security-level PKI certificates and addressing. Addressing schemes had to be developed for all the units, and routing plans were designed for the data. Emergency management and routing plans had to be developed to counter individual- and multiple-node failures.

“There were two major challenges. One was the complexity of setting up a large system as such with up to 50,000 users. The second one was combining a number of new technologies that had never been used in such a large environment,” he says. For example, the SINA VPN architecture has never been implemented in networks with more than 350 nodes. The number of nodes presents a management challenge because all of the various connections must be laid down in the communication and security planning.

Although the program does not actually manage the government-furnished network, Willenberg notes that functionality and operational status must be supervised. Message tracking is conducted from a system control center that monitors system performance and network availability and that serves as a help desk. The center issues alerts when  threats to the system are detected, and it can monitor all the servers across the network and perform functions such as memory backup and recovery. “From this center, you can see if one of the eight fans in a given server is still operational or not. And if not, it will send an alarm and it will immediately invoke a ticketing system,” he says.

NuKomBw features two systems in its management suite: a user reference system and an industry reference system. Any new software versions or releases are tested on a separate set of designated servers before being transferred to the operational system. Software updates are centrally distributed through the control center to individual servers or clients.

Willenberg notes that NuKomBw does not currently have a document management system; however, all e-mail is archived in a central server for research purposes and all communications relationships are documented. Messages are routed to a local server, where the intended recipient is alerted. The system also features a reporting and acknowledgment system. For example, senders are notified when an addressee has not opened a message in a certain period of time, depending on the message’s urgency.

“I think it’s a good solution to keep services lean and simple because you can easily overload them with all kinds of functionality. We are trying to stay with commercial products that are industry standard and trying as much as possible to avoid specialty products,” he says.

 

Web Resources
German Federal Ministry of Defense: www.bmvg.de
EADS: www.eads.net