BLACKPIQ / POST-QUANTUM IPsec

Post-quantum IPsec.
Locked to the port.

Protect industrial Ethernet with a post-quantum IPsec tunnel using optional hybrid ML-KEM key establishment, plus physical locking at the controller.
Hybrid ML-KEM / Encrypted IPsec / Port locking
*Optional hybrid ML-KEM-768/1024 in Standard Mode. Both endpoints must support and enable the selected profile.
The supplied BlackPiQ product photo shows the device physically secured to the controller. A highlighted post-quantum IPsec tunnel connects a compatible control-center gateway to BlackPiQ, with optional hybrid ML-KEM and classical key establishment.
The supplied BlackPiQ product photo shows the device physically secured to the controller. A highlighted post-quantum IPsec tunnel connects a compatible control-center gateway to BlackPiQ, with optional hybrid ML-KEM and classical key establishment.
BLACKEDGE / SECURE REMOTE CONSOLE ACCESS

Remote access.
Physical control.

Connect authorized operators to critical RS232 consoles with SSH or HTTPS, strong authentication and physical port security.
SSH & HTTPS / MFA & AAA / Tamper alerts
Simplified BlackEdge diagram: remote operator connects by SSH or HTTPS over Ethernet to BlackEdge, physically locked to a router or switch RS232 console. Optional TACACS+ or RADIUS AAA is a separate side connection.
Simplified BlackEdge diagram: remote operator connects by SSH or HTTPS over Ethernet to BlackEdge, physically locked to a router or switch RS232 console. Optional TACACS+ or RADIUS AAA is a separate side connection.
BLACKVAULT HSMs / HARDWARE KEY PROTECTION

Protect the keys.
Keep control.

Generate, safeguard and manage cryptographic keys in protected hardware for enterprise applications and critical infrastructure.
Key generation / Tamper response / Access control
BlackVault HSM touchscreen model with inserted smart card, shown as the example for the BlackVault HSM family.
BLACKVAULT TOUCHSCREEN
HSM / HSM.TAC / HSM.RAS
BLACKSER AES / SERIAL DATA ENCRYPTION

Encrypt serial data.
Protect operations.

Add AES-256 protection to existing RS232 communications serving RTUs, PLCs, meters and protective relays.
RS232 / Modbus · DNP · IEC101 / Inline encryption
BlackSER AES inline RS232 serial data encryptor, front view.
AES-256
SERIAL DATA PROTECTION
RS232
EXISTING SERIAL ASSETS
INDUSTRIAL CONTROL SYSTEM PROTECTION

Critical control.
Post-quantum IPsec.

Protect PLCs, RTUs and IEDs with an optional hybrid post-quantum IPsec tunnel, physically locked to the industrial controller by BlackPiQ.
Hybrid ML-KEM / PLCs · RTUs · IEDs / Port locking
*Optional hybrid ML-KEM-768/1024 in Standard Mode. Both endpoints must support and enable the selected profile.
The supplied BlackPiQ and controller photo with a highlighted post-quantum IPsec tunnel terminating at BlackPiQ and physical protection at the controller Ethernet port. Hybrid ML-KEM key establishment is optional and requires a compatible configuration at both endpoints.
previous arrowprevious arrow
next arrownext arrow
PlayPause
Slider

Public Safety Communications Network Dramatically Increases Network Availability

A major networking company owns and operates a public safety trunked radio system serving statewide public safety agencies. The P25 radio system utilizes T1 trunks for connection between approximately 180 tower sites and three regional centers. State Police, Highway Authority, county and municipal agencies all rely on the public safety radio system for critical public safety communications.

To ensure a high availability of service, the networking company’s engineers focused on minimizing service interruptions caused by T1 outages. In the event of a T1 failure, they wanted the circuit to automatically switch to an alternate path on a different access network. Cellular, with its increasing capacity and reliability, was determined to be a viable solution for this backup path. However, next generation 3G/4G cellular networks are packet based and don’t support native T1 circuit transport. The engineers needed equipment that would convert a T1 signal to IP, and automatically switch to the cellular path when the primary T1 failed.

The Engage Communication IP•Tube circuit emulation product line was just the solution the engineers were looking for. They had successfully used the IP•Tube for automatic protection switching of T1 over satellite links, and decided a similar solution would be effective for cellular backup of the critical P25 network. Engage Communication IP•Tube T1-over-IP solutions encapsulate TDM data into IP packets for transmission over IP & Ethernet connections. The IP•Tube uses circuit emulation to transparently transport T1 voice and data, enabling interconnection of T1-based PBX/Voice, public safety radio (LMR) and WAN router equipment over packetbased IP links.

The Link Protector option expands IP•Tube T1-over-IP functionality, adding auto protection switching and eliminating manual intervention in the case of a T1 outage.

Under normal operation, IP•Tube with Link Protector functions in a PassThru (transparent) mode, continuously monitoring the quality of the primary leased T1 connection. In the event of a T1 outage, the IP•Tube immediately detects the failed connection, switches from PassThru mode to T1- over-IP mode, and routes customer T1 traffic over an IP link.

In the public safety radio application, IP•Tube equipment is installed at the radio tower sites and at the regional centers. The primary T1 trunks, linking tower sites back to the regional centers, are monitored for quality on an ongoing basis. If a T1 link drops below customer configured performance levels, the IP•Tube automatically switches tower traffic over the cellular network, restoring T1 connectivity between the tower and the regional center. See Figure 1.

PubSAfetyComm1

 

Fig 1 – Engage IP-Tube provides Auto Backup of T1s over Cellular Network

 

  •  Under normal conditions, IP•Tube provides PassThru of Primary T1, monitoring the primary T1 path
  •  Upon T1 outage, IP•Tube routes T1 traffic over Cellular network, immediately restoring T1 connection
  •  

    The IP•Tube automatically switches back to the primary T1 trunk when service is restored. With the IP•Tube again in PassThru mode, the public safety radio traffic is returned to the primary T1 trunk. The primary T1 is monitored for future outages, and the cellular connection can be terminated.

    IP•Tube T1 units are available in standalone configurations for deployment at remote tower sites, and in chassis versions for aggregation at regional centers.IP•Tube circuit emulation solutions from Engage Communication offer a number of specialized features which help to ensure a high quality T1 connection over the cellular network:

    • Lossless Data Compression reduces Ethernet bandwidth by eliminating idle and redundant data, minimizing cellular bandwidth required;
    • Far-End Echo Cancellation suppresses echo in PBX and other Voice applications;
    • Assured Delivery Protocol greatly improves on UDP best-effort transport used in TDM-over-Ethernet products by enabling retransmission of dropped packets as well as packet out-of-sequence correction
    • Transparent TDM over IP mode ensures all customer traffic types can be carried over the emulated T1 circuit;
    • Alternatively, the HDLC-over-IP protocol makes efficient use of cellular bandwidth for WAN router traffic.

    The availability of higher capacity/higher reliability cellular networks and IP•Tube T1 Circuit Emulation makes it possible to significantly improve availability for critical public safety communications networks.


    Engage logo 990000 rev 2.000
    9565 Soquel Drive Dr,
    Aptos, CA 95003
     
    Telephone: +1-831-688-1021
    Toll Free : +1-877-ENGAGE4
    ​Designed, Fabricated, and Assembled
    in America icon
    Supported Worldwide

    © 1989-2025 Engage Communication, Inc. All Rights Reserved.