The IP•Tube CEP RS232 converts RS232 serial data connections into IP packets, extending the serial data over very cost effective Ethernet or MPLS based LAN/WAN/MAN wired and wireless networks. Synchronous, Asynchronous, Isochronous or HDLC serial data is encapsulated into IP packets. This facilitates the interconnection of Serial Data over IP between Serial Bulk Encryptors (KIV7/OMNI), Data Terminals, Data Acquisition Systems, WAN Routers and Bridges and SCADA RTUs.

Layer 1 with Isochronous Support
In Layer 1 operating mode every bit is encapsulated into an IP packet. The size and frequency of the IP packets can be set with data bit rates from 75 bits to 256 kilobits per second. Isochronous serial protocols, such as Conitel, are transported synchronously to maintain message alignment. A configured number of incoming packets are buffered in order to compensate for the packet delivery jitter introduced by the network. The size of the Tube bit buffer is configurable to accommodate the peak amount of jitter.

Asynchronous Over IP
Asynchronous characters from the RS232 interface with 5 to 8 data bits, baud rates from 1.2 to 38.4 kilobits, 1 or 2 stop bits that are with or without parity are efficiently encapsulated into IP packets. The encapsulation supports block mode transfers to minimize the bandwidth required. Additionally the latency is controlled by setting the Tube Bytes per packet.

HDLC Over IP
In Layer 2 operating mode HDLC Data frames, such as those used by Wide Area Networking protocols PPP and Frame Relay or proprietary Data Links, are transported within IP packets as HDLC over IP. The Serial to Packet conversion only occurs when HDLC frames are active.

SCADA Protocol Transparency
The IP•Tube CEP RS232 transports Bit or Byte orientated SCADA protocols transparently because of its unique TDM circuit emulation capability. RTU transmit data is encapsulated into IP packets at 64,000 samples per second and de-encapsulated at the far end at the same rate, ensuring properly timed RTU SCADA message delivery. 

IP•Tube CEP isolates management and data plane functionality with the use of two separate processors modules. Management processor access is limited to encrypted sessions via SSH or SNMPv3, that employ AES 256 bit keys and sophisticated NIST passwords. These sessions may be established after authentication via TACACS+, RADIUS and two factor authenticated with RSA SecurID.

The independent Linux based management plane of the IP•Tube CEP ensures Critical Infrastructure Data is isolated from management network access. The Management Module uses internal serial ports to connect to the Data Plane processor.

Administration and User Logs are available with Syslog.

Three LAN Interfaces
All IP•Tube CEP RS232 models ship with three 10/100BaseT
Ethernet LAN ports. The Ethernet interfaces provide for:
• Management interface
• Two Data Plane LAN interfaces for redundant connections
• Protector Option for Redundant Packet Path connections
with Constant or Switch Over Criteria

Assured Delivery Protocol
In order to assure high quality communications over links
with intermittent or noisy performance, such as Wireless,
the IP•Tube CEP RS232 employs Engage’s robust Assured
Delivery Protocol with the following benefits:
• Packet out of sequence detection and re-sequencing
• Duplicate skipping
• Lost packet retransmissions with configured delay

The IP•Tube CEP RS232's Management module 10/100BaseT Ethernet interface provides a management port when interconnecting the IP•Tube CEP RS232 through a Virtual Private Network. Each LAN interface of the IP•Tube CEP RS232 features independent IP network configurations.  

The volume application for the IP•Tube CEP RS232 is the conversion of legacy serial communication interfaces of Utility SCADA systems from leased telco circuits to IP and MPLS packet services.

Legacy Utility SCADA installations utilize technology that was designed decades ago.  Many substations have proprietary or bit orientated SCADA communication protocols that require the constant delay of circuits.

Engage adapted our Serial Circuit Emulation technology to facilitate the transparent transport of Serial SCADA over packet networks and to comply with the unique Utility industry specifications required by NERC.  NERC is the Electric Reliability Corporation for North America, subject to oversight by the Federal Energy Regulatory Commission and governmental authorities in Canada.  NERC’s jurisdiction includes users, owners, and operators of the bulk power system.

A NERC reliability standard mandates that SCADA systems have Data Center Front End redundancy.  The IP•Tube CEP RS232 at the Substations support from 1 to 4 Data Center redundant and diversely routed connections.  

NERC -CIP mandates control center redundancy. RTUs must be accessible from, and be able to connect to, multiple control centers.IP•Tube CEP continuously monitors connectivity to the active control center and automatically switches to the active backup control center (1 to 4 supported).

• • • • • Meets NERC mandates for control center redundancy
        • Preserves investment in RTU and Central site SCADA
        • Facilitates control center redundancy with IP flexibility
        • Supports up to four redundant control centers
        • Redundant and diverse connectivity

NERC is committed to protecting the bulk power system against cybersecurity compromises that could lead to misoperation or instability.  Engage incorporated a sophisticated locked-down embedded Linux based management module into the IP•Tube CEP that exceeds the NERC -CIP cybersecurity standards and is upgradeable to support future standards.

Management module isolates management and data plane functionality with the use of two separate processors modules. Management processor access is limited to encrypted sessions via SSH, or SNMPv3, that employ AES 256 bit keys and sophisticated NIST passwords. These sessions may be established after authentication via TACACS+.

The independent Linux based management plane of the IP•Tube CEP ensures Critical Infrastructure Data is isolated from management network access. The Management Module uses internal serial ports to connect to the Data Plane processor.  Administration and User Logs are available with Syslog.

The IP•Tube CEP installations achieve NERC CIP compliance with a combination of internal and external functions.

Internally the Management Module software has the sophistication to implement comprehensive policies and privileges for administrator and user accounts. Administrator policy includes removal, disabling or renaming.

Interoperability with external functions such as Syslog, Network Timing Protocol and TACACS+ with its support for RSA SecureID delivers trusted compliance.

Electronic Security Perimeter
The IP•Tube CEP in combination with industry standard services meets the Electronic Security Perimeter's NERC CIP-005 specifications.  In addition Control Plane isolation from the Data plane provides a higher level of security for the Cyber Assets.

System Security Management

Access control is Authenticated, Authorized and Accounted for with TACACS+.

Security Patches managed proactively.

In order to minimize the number of analog telephone circuits required to connect Data Center Front End SCADA controllers to Substation Remote Terminal Units Multi-Drop communication protocol was implemented. 

The CEP Multi-Drop feature allows a single RS-232 SCADA host connection to communicate with up to 8 remote terminals over a packet based network

The IP•Tube CEP transparently supports Multi-Drop by simultaneously transmitting IP packetized Front End SCADA messages to up to eight remote IP•Tube CEPs. 

The IP•Tube CEP connected to the addressed RTU detects a control signal and sends the SCADA response back to the Serial interface connected to the Front End polling port.