Development of an IP cryptographic function for the HF radio environment

Abstract

Provisioning Internet Protocol (IP) services over military High Frequency (HF) radio networks has been of interest from at least as early as 1999. Historically, this has only been achieved with limited success for User Datagram Protocol (UDP) based IP services due to the high latency and low bandwidth of HF channels. However, emerging Wideband High Frequency (WBHF) technology holds promise as a key enabler for this application domain, creating a renewed drive to develop a workable IP over HF system. An aspect to consider in this system design is that of network security. While Annex E of the North Atlantic Treaty Organization (NATO) Standardization Agreement (STANAG) 5070 mandates the provisioning of security at the IP layer, little else is disclosed in the public domain. This presents a unique opportunity to develop an IP cryptographic function for the HF radio environment. This is approached by firstly investigating related subject matter on topics such as the HF transmission medium in general, traditional data transmission over an HF channel, the history of IP data communication over HF, traditional security mechanisms in the HF military environment, and security in traditional IP networks. A design and implementation of an IP cryptographic function, or IP crypto for short, is presented in the context of an envisioned IP over HF system. The design draws on information obtained in the literature study and from existing HF industry standards, and when necessary, compliance with HF industry standards is given preference when making design decisions. The implementation is done using the Linux Transform (XFRM) framework. It is suitable for the evaluation purposes of this research study and is not intended to be a fully developed IP crypto product ready for commercial use in the HF military environment. This IP crypto is evaluated using an IP over WBHF capable test bench consisting of Commercial Off-The-Shelf (COTS) equipment, including WBHF modems and an HF channel simulator. This process consists of developing throughput- and latency tests by modifying the open source IPERF3 network performance evaluation tool, using these tests to establish a performance baseline of the test bench, viz. without the IP crypto included in the system, repeating the tests with the IP crypto included in the system, and lastly, comparing the IP crypto results to the baseline test results. This comparative analysis quantifies the extent of the IP crypto's impact on the IP over WBHF test bench system's performance, and finds that this is more pronounced for the throughput rate than for the latency characteristics of the system. Additionally, while the presence of the IP crypto may influence the viability of some IP services over HF, it in no way renders the system completely unusable for IP services.