Author: admin

Posted on

Directory Products Update – 19.0 Capabilities

The below is a list of the new capabilities brought to our Directory products for the 19.0 release. 19.0 adds a lot of extra functionality across the board for our messaging products, along with a complete rewrite of the codebase so that future releases and bug fixes can be developed more quickly. For the full release notes please check the individual product updates, available from the customer portal and evaluation sections of our website.

Dependencies

Use of several new 19.0 features depend on Cobalt 1.3 or later.

M-Vault

Product Activation 

M-Vault uses the new product activation.  Product activation is managed with the Messaging Activation Server (MAS) which provides a Web interface to facilitate managing activation of messaging and other Isode products. MAS is provided as a tool, but installed as an independent component.   

Headless Setup

M-Vault, in conjunction with Cobalt, provides a mechanism to set up a server remotely with a Web interface only. This complements setup on the server using the M-Vault Console GUI.

Password Storage

Password storage format defaults to SCRAM-SHA-1 (hashed). This hash format is preferred as it enables use of SASL SCRAM-SHA-1 authentication which avoids sending plain passwords. Storage of passwords in the plain (previous default) is still allowed but discouraged.

LDAP/AD Passthrough

An LDAP Passthrough mechanism is added so that M-Vault users can be authenticated over LDAP against an entry in another directory. The key target for this mechanism is where there is a need to manage information in M-Vault, but to authenticate users with password against users provisioned in Microsoft Active Directory.  This is particularly important for Isode applications such as M-Switch, M-Link, and Harrier which utilize directory information not generally held in Active Directory.

Cobalt provides capabilities to manage accounts utilizing LDAP Passthrough.

OAuth Enhancements

A number of enhancements to OAuth, which was introduced in R18.1

  • OAUTH service has been integrated  into the core M-Vault server, which simplifies configuration and improves security,
  • Operation without Client Secret, validating OAUTH Client using TLS Client Authentication.  This improves security and resilience.
  • Allow client authentication using Windows SSO, so that Windows SSO can work for OAUTH Clients.  This enables SSO to be used for Isode’s applications using OAuth.

Sodium Sync

  • Some enhancements to Sodium Sync to improve operation on Windows Server.
  • Option that will improve performance for any remote server with a large round-trip-time. 
Posted on

Red/Black 2.0 – New Capabilities

This major release adds significant new functionality and improvements to Red/Black, a management tool that allows you to monitor and control devices and servers across a network, with a particular focus on HF Radio Systems.  A general summary is given in the white paper Red/Black Overview

Switch Device

Support added for Switch type devices, that can connect multiple devices and allow an operator (red or black side) to change switch connections.   Physical switch connectivity is configured by an administrator.  The switch column can be hidden, so that logical connectivity through the switch is shown.

SNMP Support

A device driver for SNMP devices is provided, including SNMPv3 authorization.   Abstract devices specifications are included in Red/Black for:

  • SNMP System MIB
  • SNMP Host MIB
  • SNMP UPS MIB
  • Leonardo HF 2000 radio
  • IES Antenna Switch
  • eLogic Radio Gateway

Abstract devices specifications can be configured for other devices with suitable SNMP MIBs.

Further details provided in the Isode WP “Managing SNMP Devices in Red/Black“.

Alert Handling

The UI shows all devices that have Alerts which have not been handled by operator.   The UI enables an operator to see all un-handled alerts for a device and gives the ability to mark some or all alerts as handled.

Device Parameter Display and Management

A number of improvements have been made to the way device parameters are handled:

  • Improved general parameter display
  • Display in multiple columns, with selectable number of columns and choice of style, to better support devices with large numbers of parameters
  • Parameter grouping
  • Labelled integer support, so that semantics can be added to values
  • Configurable Colours
  • Display of parameter Units
  • Configurable parameter icons
  • Optimized UI for Device refresh; enable/disable; power off; and reset
  • Integer parameters can specify “interval”
  • Parameters with limited integer values can be selected as drop down

Top Screen Display

The top screen display is improved.

  • Modes of “Device” (monitoring)  and “Connectivity” with UIs optimized for these functions
  • Reduced clutter when no device is being examined
  • Allow columns to be hidden/restored so that the display can be tuned to operator needs
  • Show selected device parameters on top screen so that operator can see critical device parameters without needing to inspect the device details
  • UI clearly shows which links user can modify, according to operator or administrator rights
Posted on

M-Guard 1.4 New Capabilities

M-Guard 1.4 is a platform support update release for M-Guard Console and M-Guard Appliance. M-Guard Appliance has been updated to use UEFI instead of BIOS for key system services.

Platform Support

The M-Guard Appliance now supports running on Netgate 6100 and 6100 MAX appliance systems.

M-Guard Appliance on Hyper-V now uses Generation 2 virtual machines.

M-Guard Appliance on VirtualBox now uses EFI.

Use of BIOS for booting is deprecated in favor of UEFI.

Base Operation System Upgraded 

The M-Guard Appliance operating system is now powered by FreeBSD 13.1.

Notice

Upgrading earlier installations requires special steps.  Contact Isode support for assistance.

Posted on

Cobalt 1.3 Release Features

Cobalt 1.3 depends on M-Vault 19.0 or subsequent versions

M-Vault Management Support

  • M-Vault Bootstrap.   Enables operation in conjunction with M-Vault 19.0 to support headless bootstrap.
  • Managing users in M-Vault groups, such as Directory Server Administrators  and Messaging Configuration Read/Write.  This enables Cobalt to control user and operator rights to access M-Vault.
  • AD/LDAP passthrough support
    • Allow users (per domain) to support mandatory or partial passthrough
    • Set and validate passthrough entry for user
    • Identify users in passthrough server that might be added to domain

Messaging Management

  • Profile Editor for supporting and managing M-Switch Profiler.
    • SIC Coverage UI. Provide full list of SICS, showing which addresses each one goes to.   This enables operator to ensure that all SICs are sensibly handled.
  • File Transfer By Email capability is now managed by Cobalt, replacing capability previously in MConsole.
  • For Organizations and Military DLs enable control manage capability functions:
    • Max Message Size
    • Max Line Length (for ACP 127 destinations)
    • Charset Restrictions (for ACP 127 destinations)
    • Allows/block attachments
  • Option to show for a user which DLs the user is in, and give easy addition to other DLs.  This facilitates managing DL membership.

New Views

  • Non-Human Users (Special Users).  Need to support accounts with passwords that are not humans.   For XMPP, Email or both.  
  • View for end users, rather than administrators.  User can:
    • Change password. 
    • See all of own entry and modify  attributes.   The list of modifiable attributes can be configured.
    • See references to entry and email list membership.
  • User Groups, to enable management of directory groups (Distinguished Names).

Cobalt Access Control

  • New Cobalt roles, that can enable selective control of which users can access directory admin controls, and which users can set OAUTH rights and can add OAUTH Clients.  
  • Restrict Password set/change rights, so that only selected Cobalt administrators can do this.

Security Enhancements

  • When deleting a user, remove the password.   This will make it safe for applications searching whole DIT as you can’t authenticate with a deleted user’s account. 
  • Security Clearance can be selected for any role or user, based on a configured catalogue.  This supports key M-Switch and Harrier feature to check clearances. 

Miscellaneous

  • When assigning a new email, search entire DIT for conflicts, not just Cobalt area.   This  helps SASL resilience
  • Can add Photos to Routed UAs and Organizations.  
  • Check References on Delete. Cobalt has a “References” button on user/role form that displays all references of a user/role.  On deleting, references are deleted as well.
  • Tool to check references to users in AD, so that when users in AD are deleted, dangling references can be picked up.
  • Remove default domain concept
  • On deletion of domain in Cobalt, give option to delete all the domain data
  • Option to end all  cobalt logged in sessions of an operator, to allow an operator to logout from all browsers with a single action
  • There is also an option for an operator with appropriate rights  to end sessions of another Cobalt operator.
Posted on

Icon-5066 3.0 – New Capabilities

We are thrilled to announce the latest update to our STANAG 5066 server, Icon-5066. With this new release, we’ve incorporated a host of exciting features and enhancements, designed to not only add new functionality to your deployment but also increase the performance of your HF Radio Network.

The below is a list of the changes, and updates that can be found within Icon-5066 v3.0.

ALE Management

This major new feature enables management of ALE configuration independent of ALE implementation and allows easy sharing of configuration between nodes.  This capability is supported for modems where Isode provides ALE support.  Key features:

  • Web configuration of HF Network for each Icon-5066 node.
  • Configuration of Node ALE addressing, with support for 2G, 3G and 4G.
  • Support for fixed frequency (not using ALE for a network)
  • Configuration of HF Frequency list with options for narrowband and wideband
  • Configuration of schedules for used with ALE or fixed frequency.   This enables the frequencies used to be changed at configured times so that appropriate frequencies are used for an ALE network throughout the 24 hour cycle.
  • Import/Export of configuration, to enable easy sharing of configuration between nodes.   Model is that you configure ALE setup on one node and the transfer to other nodes.

Security

Two important security enhancements are included:

  1. Use of OAuth to control which operators can access Icon-5066.
  2. Support of TLS which includes:
    1. HTTPS Web Access
    2. TLS Support for GCXP to support Modem Proxy (crypto bypass) across a Red/Black boundary
    3. Web configuration of PKI setup of TLS

STANAG 5066 Ed4 Compliance

Icon-5066 is compliant to STANAG 5066 Ed4.   An overview of Ed4 is here.   Detailed Icon-5066 compliance is specified here. 

Most of these capabilities were in the previous release, but described as STANAG 5066 proposed extensions.   Interoperability has been tested with another Ed4 implementation.

SNR Monitor

A new option is provided to configure Icon-5066 as a modem monitor with a simple TCP monitoring protocol.  This is a general purpose capability, but is specifically targeted to support the ACP 127 FAB (Frequency Assignment Broadcast) capability in M-Switch to enable the FAB broadcast to report on measured link quality using a modem at a remote location. 

New Modem/ALE Support

The following ALE capabilities are added:

  • 3G ALE support for RapidM RM8 and RM10.
  • 4G ALE support for RapidM RM10

A new “Raw TCP” data option, which sends and receives data over simple TCP connection.   This generic capability can be used to exchange data with RapidM RM10 modem.

Management

Support for independent control of multiple STANAG 5066 nodes, so that on a system with multiple nodes nodes can be independently enabled and disabled by the Icon-5066 operator.

Red/Black Driver

A driver is provided for Isode’s Red/Black product to monitor Icon-5066.   Like the Red/Black driver for Isode supported Modems, this driver is distributed with Icon-5066, but will be picked up by a collocated Red/Black server.   It enables a Red/Black operator to enable/disable an Icon-5066 node and to monitor key parameters.

Product Activation

Icon-5066 servers are now controlled by Isode Product Activation.  This control includes:

  • Optional enabling of TLS.  This is helpful for export.
  • Control of the number of nodes available

Posted on

Successfully Managing HF Radio Networks

With the potential for new technologies to cause interference to traditional communications networks and even space itself at the risk of becoming weaponised, it is important to make sure that you always have a backup plan for your communications ready and waiting.

Should the worst happen and your primary network, typically SatCom, go down you need to ensure that you can still communicate with your forces wherever they are, and that communication needs to be fast,  simple and reliable. It also needs to be suitable for operation within degraded and denied environments.

That’s where HF Radio has a distinct advantage, utilising the ionosphere itself to relay communications and long-range radio signals. If you’re interested you can read more about the benefits of communications over HF Radio and how Isode is developing HF technology here.

When implementing new technologies, one of the challenges you can always expect to face is how you manage them and control how the important systems connect with one another. For HF Radio, that has always been a factor limiting its deployment, how do you ensure that mobile units remain connected to your HF network as they move from one location to the next?

This can now be done by our latest HF Radio enhancement product, Icon Topo. 

Icon Topo is a state of the art, web-based management system for HF Radio networks. The management system allows an operator to monitor and control the location of Mobile Units such as ships or aircraft, ensuring that as they move from one HF Access Point to another they can remain connected to your communications network.

The Icon Topo system allows you to manage your Mobile Units across multiple HF Networks, and plan a connection route for them as they do so, all from an easy forms-based interface. Removing any interruptions to service or downtime from applications as the MU moves across its intended path.

You can read more on Icon Topo here.

Alongside our HF management system, we have also recently developed our Red/Black solution to manage encrypted data over HF networks.

Red/Black is a Web-based server that can provide control and monitoring of different devices and servers. This is intended to complement, not replace, primary device management tools. Red/Black servers can operate in a pair, to monitor and control devices across a secure boundary.

Our Red/Black servers are designed to support HF radio systems through the display and management of communication chains, as seen below. They allow separation of, and passage for encrypted information across restricted networks from a ‘high’ side to a ‘low’ side. 

You can read more about our Red/Black solution here

The above two products give you full oversight over your HF networks so that you can be confident you will retain complete control over what gets to connect to your HF network and how exactly they do it.

If you’d like more information on our HF products, or are interested in a product demo then get in touch with us on sales@isode.com, alternatively you can fill out a contact form on our website and one of our team will get back to you.

Posted on

Draft, Review & Release

This week we are excited to announce the release of Harrier 3.1 and Cobalt 1.1.

These releases are an important step for our Draft, Review & Release Solution, a capability of particular interest within Military Deployments.

Draft and Release is a process of handling formal military communication, it is vital for scenarios where formal responsibility must be taken for messages sent. For example, Military commands sent as messages needing to be approved/released by an appropriate senior officer. More information on this can be found in our recently updated whitepaper.

This latest release of Harrier provides a new, simple and intuitive UI for drafters, reviewers, and releasers, making each task straightforward. Also included is a visual workflow, allowing easy tracking of messages.

There will be situations where it makes sense to send directly and to avoid any workflow. Cobalt allows simple control of users who can send directly for selected messages based on SIC and Priority.

Cobalt provides a range of capabilities to support Formal Military Message Handling Systems (MMHS), with capabilities oriented towards the support of systems using Isode’s Harrier, M-Box, and M-Switch products.

Downloads and accompanying release notes can be found in the evaluator and customer sections of the website.

Posted on

HF for more than just messaging

Over the last two years, Isode has been working alongside other HF experts to update STANAG 5066 from edition 3 to 4, motivated by the need to keep this vital standard current with the latest messaging developments.

One particular area of interest for Isode is enabling TCP applications to perform efficiently over HF links and our CEO, Steve Kille, gave a presentation in this area at the most recent HFIA meeting back in March. You can find a PDF of the presentation, ‘Web Browsing over HF’, here.

In an ideal world all mission-critical applications would take advantage of specific optimized protocols for HF but, as it’s impractical to do this for every service, having mechanisms to support generic services that run over IP in high-speed networks is necessary.

To provide IP services over HF in a reasonably efficient manner, a central challenge is to provide a mechanism to support TCP-based applications efficiently. This can be done with a TCP PEP (Performance Enhancing Proxy), such as our recently announced Icon-PEP product.  Icon-PEP product enables deployment of IP Applications over an HF network using STANAG 5066 link layer as the interface to that network. More information can be found on the Icon-PEP product page.

Posted on

Isode Military Capabilities at DSEI 2021

DSEI is the premier showcase for military technology of all types. Held every other year, DSEI attracts one the largest international audiences, with over 75,000 visitors from 114 countries at DSEI 2019.

Isode will be displaying a number of unique capabilities at DSEI 2021, which you can see on our stand on the UK Pavilion, including:

Military Email

Isode’s end-to-end solution fronted by Harrier, our web based military messaging client, and including message servers and gateways covering all of the major military messaging standards.

Harrier military mail client compose Screen
Isode Harrier Web-based Email Client for Military Messaging supports the draft and release process to support formal release and approval of messages by an appropriate officer.

Military Instant Messaging

Instant messaging, using the XMPP standard, is an increasingly important component of military communications systems. Isode clients, servers and gateways allow XMPP traffic over standard and constrained (SatCom/HF) links a s well as between XMPP and legacy instant messaging systems such as IRC, all of which can be controlled using Isode’s extensive security labelling infrastructure.

At DSEI 2021 we will be giving the first public demonstration of the web version of our Swift XMPP Client.

You can find more information on Isode’s products set for Military Messaging and Military Instant Messaging by following the links.

Isode Military Messaging and Military Instant Messaging products have been successfully deployed with the land, air and naval forces of over 30 countries.

Posted on

The Isode pre-sales team has expanded

We’re pleased to announce a new addition to the Isode family, Chris Marshall, who joined our pre-sales team earlier this year.

Photo of Chris Marshall

Chris has a BSc in Computer Science from the University of Wolverhampton and over 30 years of experience in the IT sector. He is a keen traveler, recently exploring the USA with his family for a month. During his free time enjoys racing his laser dinghy at the local sailing club.

Chris joins us from an Isode partner, where he spent 20 years supporting customers in large, highly secure organisations around the world with their messaging projects. He is familiar with Isode software and has wasted no time getting stuck in providing support to our customers.

Welcome to the team Chris.