New Network Systems security router enables exchange of confidential information over private and public networks, including Internet.

MINNEAPOLIS--(BUSINESS WIRE)--Nov. 14, 1994--Network Systems Corp. Monday introduced the first network security product that enables organizations to exchange information in total confidentiality across all types of private and public access data networks, including the Internet.

With data protection assured, network managers are free to take advantage of the most cost-effective networks available for transferring sensitive information.

The bullet-proof security and unprecedented flexibility provided by Network Systems' new Security Router are made possible by the company's latest security software -- its Data Privacy Facility (DPF). DPF employs two significant innovations in approach:

-- First, security is tightly integrated in the network router; and

-- Second, data is encrypted on a packet-by-packet basis.

"Network Systems' Security Router with DPF clearly offers the deepest set of security features for internetworking technology today," said Nick Lippis, president, Strategic Networks Consulting.

"Security is too often the most overlooked element of a robust mission-critical network," said Glenn Gabriel Ben-Yosef, senior consultant at the Yankee Group. "Network Systems, in its Security Router with DPF, provides a completely different level of security for LANs reminiscent of the bullet-proof security model found on mainframes. Yet, Network Systems' security model is transparent to the end user, providing protection while maintaining ease of use," he said.

Previous security techniques have relied on encryption hardware installed at each end of a point-to-point link or on software encryption programs, both of which limit security's reach. Neither method, for example, has been capable of security data on multi-access networks such as Frame Relay, ATM, X.25 or SMDS. Encrypting routers, on the other hand, can exchange protected data with other routers anywhere -- on any type of network.

Also, the Security Router with DPF permits users to select specific data for encryption or compression -- based on address, application type or transmitting interface -- and gain additional efficiencies. The entire selected packet is encrypted and transmitted using a standard IP header containing the network addresses of the DPF routers.

In addition, with security built into the routers, data protection becomes automatic and transparent to users. And, Network Systems' Security Router with DPF virtually eliminates the need for human intervention:

-- No modification of existing computers and routers is required;

-- Key management is handled automatically by the routers; and

-- In the event of an equipment failure, the routers automatically select backup devices and continue the communications session.

Since the Security Router combines the functions of a router with the functions of an encryption device, customers gain total data protection at reduced cost. The Security Router's data compression capabilities also improve network efficiency.

By encrypting complete packets, and transmitting them inside IP packets, the customer takes full advantage of the strengths of standard network media. Although DPF scrambles information in the packet, it does nothing to alter its ability to be sent over any standard IP network -- local area, metropolitan area and point-to-point or fast-packet wide area networks, including the Internet.

Relying on IP packets to carry encrypted data offers a number of advantages. Foremost is the flexibility to create a "virtual private link" over any type of network -- point-to-point, Ethernet, Frame Relay, ATM or the Internet. Also, DPF capitalizes on the robust, self-healing, characteristics of IP networks to ensure high reliability. And, with IP likely to be favored in emerging technologies, customers of Network Systems' DPF can look to it as a long-term solution.

DPF provides the means to defeat traffic analysis. Since the entire original packet is encrypted, the addresses of the communicating computers are also encrypted. The encrypted packets are transmitted in IP packets which are addressed between DPF routers. Outside observers would only see two routers communicating; they would not know that this was actually the two end computers communicating.

"Data security is fast becoming a hot-button as companies come to rely on networks to handle business transactions," said Ted Doty, program manager, Network Systems' security products. "DPF answers the growing need for ironclad data privacy. Plus, it opens up a whole new world of networking possibilities. Organizations can now provide improved service and gain significant cost savings without compromising the security of their most proprietary information."

"For nearly two decades, Network Systems has been the premier supplier of secure, high performance networking equipment," said William R. Franta, Network Systems' vice president, routers/switch business unit, and chief technical officer. "DPF is a further example of our pioneering efforts to address the critical need for data security."

Test units of the Security Router with DPF will ship Dec. 1. In addition to supporting Ethernet, FDDI and T1/E1 WANS, the Security Router provides bridging and IP, IPX, DECnet and AppleTalk routing. The security Router directly supports Frame Relay, SMDS and X.25 and, through a cellifier, it also supports ATM.

The new product offers benefits across a variety of networks including:

-- Point-to-point links. DPF offers bulletproof security -- and eliminates the need for costly encryption devices at each end of the link.

-- Multipoint links, such as Frame Relay, or multi-access networks, including public internets. DPF provides the first commercially available security solution for these networks, enabling customers to create "virtual private networks" over which data may flow with complete confidentiality. Organizations gain privacy without the cost of leased lines.

-- Shared links. DPF allows two or more companies to share high-capacity communications connections while keeping the information of each strictly confidential. This allows them to take advantage of higher capacity links than they could justify alone -- without sacrificing data security.

DPF encrypts data using any of three strong encryption standards: the International Data Encryption Algorithm (IDEA), recognized as the world's strongest commercial encryption method; the Data Encryption Standard (DES), a proven U.S.-standard; and NSC1, a high speed, proprietary algorithm suitable for encryption at Ethernet speeds.

Engineered for high performance -- with IDEA encryption, for example, DPF can protect a full duplex T1 link -- and for total security through redundant configurations, DPF makes available a number of important features in addition to data privacy, including:

-- Authentication to automatically verify that data is coming from the correct source and going to the right destination;

-- Digital signatures to prevent data modification in transit;

-- Replay prevention to block the presentation of old transactions again at a later date; and

-- Key authentication to ensure that future transmission won't be compromised if an encryption key is disclosed.

Data compression is another high-value feature of the Security Router with DPF. Its ability to squeeze more data onto existing bandwidth -- text throughput is almost doubled -- improves network efficiency and delays the need for costly upgrades.

Minneapolis-based Network Systems Corp., provides comprehensive solutions for successfully implementing high performance enterprise networks.

CONTACT: Network Systems Corp.

              Paul Payack, 612/424-1555
              Ted Doty, 301/596-2271