NCP's "Secure VPN GovNet Box" has just obtained German Federal Office for Information Security (BSI) approval for governmental use. This hardware solution, developed by NCP in collaboration with Fraunhofer SIT, encrypts Internet connections between two sites. Fraunhofer SIT was involved in the product's design and implementation, and also supported NCP in the BSI certification process. The underlying idea behind the project was to provide business enterprises and public authorities with a trusted communication channel that offers effective protection against eavesdropping. "The GovNetBox uses advanced IT security techniques, for instance hardware-based protection based on trusted computing concepts. These techniques guarantee high security and ease of use," says Dr. Carsten Rudolph, Head of Fraunhofer SIT's Trust and Compliance department. "The NCP Secure VPN GovNet Box is based on NCP's Next Generation Network Access Technology. It was developed entirely in-house – with absolutely no back doors for spyware of the kind utilized by national or international intelligence services," adds Peter Söll, Managing Director of NCP engineering GmbH. The project partners presented the box at the it-sa exhibition in Nuremberg from October 8 to 10.

The "NCP Secure VPN GovNet Box" has been approved by the BSI for the German security classification VS-NfD (restricted). Fraunhofer SIT developed the architecture, supported the implementation with a prototype, and advised NCP later on during the project as well as regarding the certification. To prevent hidden back doors and programming errors as far as possible, all key elements of the VPN box – such as random-number generators, algorithms, and software libraries – were extensively tested in the course of the development and approval procedures.

Using the box is straightforward: it is simply attached to a USB port on the computer and connected to the Internet via Ethernet, WLAN, or UMTS. Users authenticate themselves by inserting a smart card into the box and typing their PIN on the integrated PIN pad. If the number is entered correctly, the box sets up an encrypted connection to the remote device attached to the enterprise server. As long as the Internet connection is only established via the box, all communications are reliably protected against eavesdropping. The risk that access data or PINs could be misused or stolen by viruses or Trojans lurking on the user's PC is reduced to a minimum. A TPM (trusted platform module) – a chip that is used in trusted computing concepts – is an integral part of the implementation. It employs cryptographic techniques to check hardware and software states. Access to secret keys is only granted if the software on the VPN box has not been manipulated. If this is not the case, access to data encrypted using these keys is denied. The TPM's role in the box is to protect configuration data; it is a passive element that does not influence the box's behavior in any other way. All TPM interfaces and standards are defined by the Trusted Computing Group, comprised of various industry representatives.