BLACKPIQ / POST-QUANTUM IPsec

Post-quantum IPsec.
Locked to the port.

Protect industrial Ethernet with a post-quantum IPsec tunnel using optional hybrid ML-KEM key establishment, plus physical locking at the controller.
Hybrid ML-KEM / Encrypted IPsec / Port locking
*Optional hybrid ML-KEM-768/1024 in Standard Mode. Both endpoints must support and enable the selected profile.
The supplied BlackPiQ product photo shows the device physically secured to the controller. A highlighted post-quantum IPsec tunnel connects a compatible control-center gateway to BlackPiQ, with optional hybrid ML-KEM and classical key establishment.
The supplied BlackPiQ product photo shows the device physically secured to the controller. A highlighted post-quantum IPsec tunnel connects a compatible control-center gateway to BlackPiQ, with optional hybrid ML-KEM and classical key establishment.
BLACKEDGE / SECURE REMOTE CONSOLE ACCESS

Remote access.
Physical control.

Connect authorized operators to critical RS232 consoles with SSH or HTTPS, strong authentication and physical port security.
SSH & HTTPS / MFA & AAA / Tamper alerts
Simplified BlackEdge diagram: remote operator connects by SSH or HTTPS over Ethernet to BlackEdge, physically locked to a router or switch RS232 console. Optional TACACS+ or RADIUS AAA is a separate side connection.
Simplified BlackEdge diagram: remote operator connects by SSH or HTTPS over Ethernet to BlackEdge, physically locked to a router or switch RS232 console. Optional TACACS+ or RADIUS AAA is a separate side connection.
BLACKVAULT HSMs / HARDWARE KEY PROTECTION

Protect the keys.
Keep control.

Generate, safeguard and manage cryptographic keys in protected hardware for enterprise applications and critical infrastructure.
Key generation / Tamper response / Access control
BlackVault HSM touchscreen model with inserted smart card, shown as the example for the BlackVault HSM family.
BLACKVAULT TOUCHSCREEN
HSM / HSM.TAC / HSM.RAS
BLACKSER AES / SERIAL DATA ENCRYPTION

Encrypt serial data.
Protect operations.

Add AES-256 protection to existing RS232 communications serving RTUs, PLCs, meters and protective relays.
RS232 / Modbus · DNP · IEC101 / Inline encryption
BlackSER AES inline RS232 serial data encryptor, front view.
AES-256
SERIAL DATA PROTECTION
RS232
EXISTING SERIAL ASSETS
INDUSTRIAL CONTROL SYSTEM PROTECTION

Critical control.
Post-quantum IPsec.

Protect PLCs, RTUs and IEDs with an optional hybrid post-quantum IPsec tunnel, physically locked to the industrial controller by BlackPiQ.
Hybrid ML-KEM / PLCs · RTUs · IEDs / Port locking
*Optional hybrid ML-KEM-768/1024 in Standard Mode. Both endpoints must support and enable the selected profile.
The supplied BlackPiQ and controller photo with a highlighted post-quantum IPsec tunnel terminating at BlackPiQ and physical protection at the controller Ethernet port. Hybrid ML-KEM key establishment is optional and requires a compatible configuration at both endpoints.
previous arrowprevious arrow
next arrownext arrow
PlayPause
Slider

Global Carrier Relies on Engage to Backhaul T3/E3 Traffic over Packet Network

End User: Global Cellular Carrier
Type: Telecommunications Service Provider
Profile: Multi-national cellular service provider operating in numerous markets across the globe.

Summary
A major global carrier aggregates cellular traffic on a combination of T3 and E3 circuits for backhaul across their core network. Increasingly, the core network elements are migrating from circuit to packet technology as capacity requirements grow, and the “quality of service” of packet networks improve. While the core network is migrating to IP (packets), much of the access network is still circuit based. As the Carrier ultimately decided to maintain their circuit based network, they deployed Engage Communication IP•Tube technology to convert the access T3 and E3 circuits for transport over the core packet network.

Network Design
Network designers for this Carrier were given the task of connecting cellular access traffic to the core IP network. Several alternatives were considered, including migrating the access network to IP. Although a long term goal, this was eventually deemed too costly in terms of both capital and operational expenditures.
In looking for alternatives, the designers begin to explore keeping their access network and converting the T3 and E3 uplinks from circuit to a packet format. This was determined to be a viable approach if the conversion process and packet network could ensure reliable delivery, low latency, and high performance.

Solution
The network designers contacted Engage Communication for assistance determining if “Circuit to Packet” (Circuit Emulation) conversion would be an effective solution. After a detailed review Engage proposed the IP•Tube T3 and IP•Tube E3 circuit to packet converters. A combination of extremely low latency, fast packet processing, and ease of use demonstrated that the Engage solution could be effective for the carrier.
After review with the Carrier’s operations group, a field trial was scheduled using the Engage CHUB chassis at a central location and individual units at a number of remote locations. The chassis supports both T3 and E3 circuits and both chassis and remotes were configured for redundant -48V power supplies.

Deployment
At the conclusion of a successful field trial, the circuit to packet conversion solution using Engage Communication IP•Tube technology was released to production. T3 and E3 circuits continue to be converted to packets on the deployment schedule.
According to the Project Engineer:
“Engage pre-sales and post-sales support was exemplary. Product is always delivered on time, and they jumped through hoops when we had to rush equipment to meet an expedited build out. ”



Large University Gets Rid of Leased T1 Circuits While Maintaining Existing PBX and LAN Infrastructure

Summary
State university and college budgets continue to be in flux as funds originally earmarked for education are reallocated to other purposes. Faced with the need to reduce telecom expenditures while maintaining service levels, this large university zeroed in on replacing T1 leased circuits with internal fiber and radio packet networks. Thus eliminating WAN circuit charges.

Solution
After investigating replacement of the current PBX voice equipment with Voice over IP (VoIP), and adding additional interfaces to existing router equipment, new equipment costs quickly pushed the ROI to an unacceptable level. That was without even factoring in the training and support costs associated with this new equipment.
Going back to the drawing board, the team found that circuit to packet conversion might allow them to connect their existing equipment to the campus packet networks. In addition, circuit to packet converters provided for the quick ROI the team was looking for.
However, there were concerns about the effect the packet network would have on their PBX T1 voice circuits, especially on the radio links. The university turned to Engage Communication to help design the network.

Engage Technology
Engage proposed the robust and proven IP•Tube GT1 product family to meet the varying needs of the university. With both remote and central site configurations, the IP•Tube GT1 was perfect for the wide variety of multi-campus sites.
With both single and multi-T1 port echo cancellation, the IP•Tube GT1 ensured crisp and clear voice communications across the radio network. Data compression reduced network bandwidth, and quality of service (QoS) support ensured delay sensitive traffic was given a higher priority in the network. Engage’s unique Assured Delivery Protocol (ADP) detects when packets are dropped and retransmits those packets to minimize data loss over the wireless connections.
The IP•Tube GT1 was also effective transporting data traffic over the university network. Including the ability to efficiently send different fractions of a T1 to different locations over the packet network.

Implementation
The IP•Tube GT1 solution was deployed in two stages. The initial deployment moved a limited number of T1 circuits on the main campus on to both the Fiber and Radio networks. Once proven successful, the remaining T1 circuits were retired and all traffic carried over the Engage IP•Tube GT1 circuit to packet converters. ROI objectives were met, and the university achieved their cost savings projections.


IP•Tube Key Component in Backup Communications Network Used By
One of Australia’s Largest Public Safety Agencies
 

Summary
Australian systems integrator Emtec installed Engage IP•Tubes in a backup emergency communications network it designed for one of Australia’s largest fire and rescue agencies. The network provides the agency with failover E1-over-IP connectivity so fire fighters in the field won’t lose contact with their regional offices, and headquarters.

Meeting the Voice and Data Needs of Private Industry and Public Agencies in Australia
Australian systems integrator Emtec has provided voice and data communications systems, solutions, and technology for more than 30 years. In addition to selling to a wide variety of private industries, Emtec has a long and successful track record of equipping federal and state governments and public safety agencies with the latest in communications solutions. Since 2005, Emtec has been integrating Engage Communications’ technology into many of those solutions.

According to Emtec Business Manager Ross
Monaco, Engage’s product engineering and manufacturing quality stand out.

“Engage as a partner, and the IP•Tube as a product, have been great from start to finish. The product is ideal for mission critical installations, and is very easy to set up.”

One of the most recent implementations was for one of Australia’s largest public safety agencies. Operating more than 250 fire stations, this state agency provides fire and rescue services to manage fire emergencies in the state’s major cities and towns. The agency distributed an RFP requesting proposals for an emergency network backup using existing radio tower infrastructure.

One of the most recent implementations was for one of Australia’s largest public safety agencies. Operating more than 250 fire stations, this state agency provides fire and rescue services to manage fire emergencies in the state’s major cities and towns. The agency distributed an RFP requesting proposals for an emergency network backup using existing radio tower infrastructure.

Implementation
Backup voice communication was provided via E1 circuits transported over IP microwave radio. Data compression and echo cancellation functionality were IP•Tube product features that made it the right choice for emergency scenarios when voice quality, and lots of network capacity are of paramount importance.IP•Tubes were installed at both ends of the wireless communications connections. Fire Brigades on the ground can now communicate to their local control rooms via 2-way radio. The IP•Tube then interconnects the regional control rooms to the Head Control room.

According to Monaco, the system has worked flawlessly: 

“The system works exactly as designed, and the IP•Tube is an important piece of the infrastructure. It helps ensure the safety of the people who would come to my house if I had to call the fire department.”


Hospital Network Secures Voice and Data Traffic with Engage Encryption Solutions

Summary
Concern about data breaches is on the rise as healthcare organizations are increasingly targets of both internal and external data snooping, hacking, and theft. The negative consequences can include fines, investigation and legal fees, computer and voice network downtime, and ultimately can impact an organizations reputation.
The IT organization of a major regional healthcare system, taking these threats seriously, put in place a plan to encrypt data in motion between their different facilities. This included both packet data and T1 voice circuits.
After researching network encryption equipment providers, the hospital IT team determined the Engage Communication BlackDoor packet and BlackBond link encryptors were an ideal fit.

Solution
Engage “Black” products utilize highly secure 256 bit Advanced Encryption Standard (AES) symmetrical key encryption. The BlackDoor encryptor provides packet encryption at layer 2 or layer 3 for 10/100 and 1 Gig Ethernet connections, and offers copper or fiber based interfaces. The BlackBond encryptor provides link encryption for T1 or E1 circuits.
In this case a combination of 10/100 and Gigabit Ethernet BlackDoor encryptors were used. One server unit was deployed for key management and the other units were BlackDoor client devices. The BlackBond was installed on all T1 voice circuits interconnecting PBXs and Key

Systems at the various healthcare locations. The BlackBond encrypts both full and fractional T1 traffic, is an extremely low latency device, and is transparent to the T1 payload. Consequently the “plug and play” insertion of the BlackBond onto existing T1 circuits was seamless.
Both the BlackDoor and BlackBond are available in stand-alone and slot-card configurations. The Engage CHUB chassis was installed at the main data center location with BlackDoor Gig, BlackDoor 10/100, and BlackBond T1 slot cards all inserted in the same chassis. The chassis was configured with redundant power supplies. Satellite facilities were outfitted with stand-alone BlackDoor and BlackBond units.
To further protect the data traffic, the Hospital elected to encrypt the entire IP packet payload and header so that snooping on the links would not reveal source and destination IP address information. IP tunnels were created between BlackDoors at the various locations to accomplish this.

Implementation
Engage provided detailed training to the Hospital network operations staff and the BlackDoor and BlackBond equipment were delivered on time. Equipment installation was also completed per schedule and configuring and turning up the solution went smoothly with some assistance from Engage technical support.
With data and voice encryption in place, the Hospital has added another level of protection in the continuous battle to secure sensitive patient records, corporate data, and voice communications.


Government Department Secures Critical Data with Engage Layer 2 / Layer 3 BlackDoor Encryptors

Summary
The increasing sophistication and frequency of cyber-attacks led this government organization to take proactive steps to protect their data in motion. Working with information technology and cybersecurity experts, as well as government security auditors, a solution was developed. The government department decided to encrypt / decrypt data from gigabit Ethernet switch ports at all network nodes. In addition, they decided to deploy independent encryption equipment to avoid reduced performance on the switches and the high cost of integrated encryption cards for switch chassis. Separating and simplifying management of encryption elements was also a consideration.
After a thorough analysis of solutions on the market, Engage Communication BlackDoor Gig packet encryptors were selected.

Solution
The BlackDoor Gig is an advanced Gigabit Ethernet encryptor utilizing highly secure AES 256 bit symmetrical keys. It operates in point-to-point, point-to-multipoint, and multipoint-to-multipoint networking modes. Packets are encrypted at either layer 2 or layer 3, and a BlackDoor Gig Server provides key management.
While working with Engage on the system design of their encryption network, the government department determined Gigabit fiber interfaces were preferred over copper, and that these interfaces should provide for transport over diverse networks, as well as the ability to switch between networks if a failure were to occur. They also wanted to deploy multiple BlackDoor Gig encryptors in a chassis at larger data center locations.

Engage proposed the BlackDoor fiber based SFP interface to meet the requirement for fiber connectivity, and the BlackDoor slot-card for the CHUB multi-slot chassis to meet the higher density central site requirements. In addition, Engage worked with the government’s technical team to specify and implement the redundant network and failover functionality.

On Time Delivery
Delivery timing was critical to the government because of security audit stipulations, network availability, and end of year budget considerations. Engage engineers implemented the redundant network functionality and integrated it into the product on time, and Engage manufacturing ensured product was ready to ship to meet the customer deadline.
The BlackDoor Gig solution has proven its effectiveness in securing the government network while also increasing network reliability and availability.


Engage logo 990000 rev 2.000
9565 Soquel Drive Dr,
Aptos, CA 95003
 
Telephone: +1-831-688-1021
Toll Free : +1-877-ENGAGE4
​Designed, Fabricated, and Assembled
in America icon
Supported Worldwide

© 1989-2025 Engage Communication, Inc. All Rights Reserved.