Federal Office for Information Security

The development of the Secure Inter-Network Architecture SINA

The German Federal Government's move from Bonn to Berlin and the growing requirements in terms of modern and secure office communication marked the birth of SINA. In 1999, the BSI started a project to secure IP-based networks by means of cryptographic security mechanisms.

Classified documents, which were previously kept in safes and transported by courier only under strictest secrecy, were now to be transmitted via the Internet and stored on desktops and notebooks. The particular challenge was to secure potentially insecure PC systems and networks in such a way that

• the highest security was ensured,
• the conversion and migration costs remained low
• and users could readily work with the system.

Following initial, promising prototypes, the BSI was looking for an industry partner for the (further) development and production, and the corresponding tender was issued. secunet won the bid. Since that time, secunet and the BSI have worked in close collaboration on the concept design, development and evaluation of new SINA components. Our partners innotek, Rohde & Schwarz SIT, Siemens and S.I.E. have also contributed to the success of SINA products.

Evaluation of the German Virtual Post Office

The signature application components of the virtual post office of the German Federation was successfully tested according to Common Criteria (ISO/IEC 15408), level EAL 3+, and compliance with the requirements of the German Signature Act (SigG) and the German Digital Signature Ordinance (SigV) was confirmed. For the BSI, secunet took on the project management for the evaluation, certification and confirmation and developed solutions for individual aspects of compliance with the German Signature Act and the German Digital Signature Ordinance.

Certification processes for standard solutions according to Common Criteria

For the BSI, secunet developed and field-tested a supplementary certification process on the basis of Common Criteria. The process focuses on market requirements with regard to saving costs and time and addresses existing standard IT security solutions for the mass market such as VPN solutions or e-business solutions. The results indicated considerable optimisation potential for the certification of standard IT security solutions.