R&S®SITLine

Data is encrypted using the Advanced Encryption Standard (AES) with a 256-bit key in Galois / Counter Mode (GCM). This not only ensures complete confidentiality but also provides cryptographically strong integrity protection that immediately detects and discards manipulated packets (configurable with up to 16 bytes of overhead).

Device authentication is based on Elliptic Curve Cryptography (ECC). 384-bit ECC keys (ECGDSA) are used for connections to peer devices, while highly secure 512-bit Brainpool curves are used for management connections (TLS 1.2). These methods provide a very high level of security while requiring relatively little computational effort.

Fully autonomous key negotiation using authenticated Diffie-Hellman ECKAS-DH (Elliptic Curve Key Agreement Scheme) provides Perfect Forward Secrecy. The hardware-integrated True Random Number Generator (PTG.3) generates high-entropy key material. By default, the master key is rotated every 10 hours (36,000 s) and the session key every 3 minutes (180 s) – completely transparently and without any interruption to the connection (hitless rekeying).

Standard routers and software VPNs use the store-and-forward principle, in which each packet is first received in full and buffered. SITLine ETH NG processes data streams using dedicated Field Programmable Gate Arrays (FPGAs) in a cut-through architecture. Encryption begins while the frame is still being received. This reduces latency on the ETH-XL to an impressive < 3 microseconds at 100 Gbit/s – consistently, regardless of network utilization.

When data is exchanged between geographically separate locations, sensitive information leaves the protected local infrastructure and must be transmitted over external or shared networks. Typical examples include secure point-to-point connections between two government sites, a corporate site and its data center, or two production facilities. For example, two development sites of an automotive supplier located in different cities can securely exchange design data, CAD files, and other confidential development information on a daily basis. R&S®SITLine ETH encrypts the Ethernet connection between the sites, ensuring that the data remains protected throughout the entire transmission path.

Organizations with many locations often require more than individual point-to-point connections. R&S®SITLine ETH enables encrypted communications in multipoint and meshed network structures, making it suitable for scalable infrastructures with numerous communication relationships. One example is federally organized government agencies with central and regional offices, where different locations need to exchange sensitive information directly and securely. Instead of treating each communication relationship in isolation, a scalable encrypted network structure is established, allowing sensitive administrative data to be securely transmitted between authorized locations.

Security-critical communications are not limited to central data centers; they increasingly originate at geographically distributed and decentralized locations. At these locations in particular, a compact form factor, low power consumption, and protection of the integrity of transmitted information can be crucial. R&S®SITLine ETH enables these decentralized Ethernet connections to be cryptographically secured as well. Possible scenarios include small government branch offices or decentralized technical components of critical infrastructure (e.g., those of an energy provider) whose control, status, or operational data must be securely transmitted to a central location. Unauthorized parties must not be able to intercept these communications undetected or manipulate transmitted information. Network encryption therefore protects the connection directly at the decentralized location and secures communications all the way to the central infrastructure.

Organizations cannot always control the entire infrastructure over which their sensitive data is transported. Carrier, service provider, or other shared networks therefore represent a potential trust boundary. R&S®SITLine ETH encrypts data at the boundaries of the organization’s own infrastructure, ensuring that the confidentiality and integrity of transmitted information can be protected regardless of the underlying transport network. A specific example: A German federal agency connects its headquarters in Berlin to a data center in another city via leased carrier infrastructure. The agency controls its own networks, but not every component of the transport path in between. SITLine devices encrypt the data before it enters the third-party transport network and decrypt it only after it reaches the controlled destination.