Assured: The Isode Blog

Isode R14.4: M-Switch MIXER enhancements to support S/MIME & Security Labels

This one of a series of a messages describing new features in Isode R14.4, scheduled to ship in April 2009. You can see all of the messages on this blog relating to R14.4 by clicking on this link

R14.4 extends M-Switch MIXER to support S/MIME and Security Labels. 

M-Switch MIXER provides conversion between X.400 and Internet Messaging. MIXER as specified in RFC 2156 does not include any security mappings, as in general mapping of protocol dependent security features does not make sense. Security Labels can be carried with X.400 messages, as "X.411 labels" in the message envelope. 

Security labels can be carried with Internet messages, as "ESS labels" with an S/MIME message as defined in RFC 2634 "Enhanced Security Services for S/MIME". ESS labels and X.411 labels are similar ASN.1 encoded labels. 

R14.4 extends M-Switch MIXER to map X.411 and ESS Security Labels. Coming from Internet Mail this is done by extracting the ESS Label and the MIME message from the S/MIME encoding, mapping the label encoding and then sending it as an X.411 label. S/MIME signature verification is also done. Coming from X.400, the reverse happens, mapping an X.411 label to an ESS label wrapped in S/MIME, with the S/MIME signed by the MIXER gateway. 

This functionality also provides generic mapping between S/MIME and X.400 when security labels are not used. It also provides content integrity and authentication between the S/MIME end user and the MIXER gateway.

Isode R14.4: PKI Display and Checking

This one of a series of a messages describing new features in Isode R14.4, scheduled to ship in April 2009. You can see all of the messages on this blog relating to R14.4 by clicking on this link

There is a close relationship between X.509 PKI (Public Key Infrastructure) and X.500/LDAP directory. It is common practice to store certificates, CRLs (Certificate Revocation Lists) and other PKI information in a directory. For a complex PKI with multiple Certification Authorities (CAs) there will be many entities publishing related information into the directory.  This can be complex. Isode provides tools to manage PKI information in the directory with two types of target user:

1. Those deploying Isode products, which make use of PKI to support digital signatures for a number of peer authentication and other security features. This is part of the management tool set in support of an Isode deployment.
2. Those operating a PKI for other purposes, and simply using Isode servers to hold the data. 

R14.4 adds a number of capabilities to make these tasks easier. Sodium has significantly enhanced display of PKI objects and in particular Certificates and CRLs in order to make more useful information available to the manager.

As a part of Certificate display, Sodium provides an option to verify the certificate.  This will be done using trust anchors and other verification settings from the bind profile, so multiple profiles can be defined to give different checking environments.  The checks use the same verification libraries as the Isode client and server products, so this is helpful to diagnose authentication configuration problems with Isode servers, as well as general purpose checking of PKI correctness.

The following screenshots show display of information in a CRL, and certificate verification in Sodium.

Certificate Revocation List

Certificate Verification in Sodium

 

Certificate Verification Result

Military Messaging Interoperability Testing

As a software company (and a server software at that) it's rare that we get to set up test labs with the actual equipment used in the field by some of our end-user customers. It was a nice change therefore to be recently visited by Gary Waddington of Boldon James and Mikko Huttunen and Pekka Puhakainen of SkySweep to do some interoperability testing involving Isode's M-Switch X.400 message switch, Skysweep's STANAG 5066 server and the Safemail.mil email client from Boldon James using radios from Park Air Systems.

David Wilson & Steve Kille (Isode), Mikko Huttunen (SkySweep), 

Gary Waddington (Boldon James), Pekka Puhakainen (SkySweep)

Over the course of two days we demonstrated:

1. STANAG 4406 Annex E messaging over radio using ACP 142 with the Microsoft Outlook based, safemail.mil X.400 mail client from Boldon James and our own M-Switch X.400 product.
2. Data application operation over radio using STANAG 5066 (using the Park Air VHF/UHF Radios and STANAG 5066 servers from SkySweep).

Two existing Isode whitepapaers can be consulted for background information; "Military Messaging over HF Radio and Satellite using STANAG 4406 Annex E" and "STANAG 5066: The Standard for Data Applications over HF Radio".

We showed non-ARQ operation using STANAG 5066 UDOP and ACP  142, and ARQ operation using STANAG 5066 RCOP and Connection Oriented ACP 142. An  overview of the messaging protocols and standards and why they are important in providing an efficient messaging service is given in the Isode whitepaper "Messaging Protocols for HF Radio".

Isode R14.4: X.400 Mailbox Management Preview

This one of a series of a messages describing new features in Isode R14.4, scheduled to ship in April 2009. You can see all of the messages on this blog relating to R14.4 by clicking on this link

We plan to provide an X.400 Mailbox management capability in MConsole which will give integrated functionality to replace functionality currently provided by XMSConsole and by User View in EMMA. 

This project has started, and we are shipping the work done so far in R14.4 as a preview. This provides the monitoring capabilities of XMSConsole with a UI similar to that of XMSConsole. A screenshot is provided below.

We intend to develop this UI around the mailbox view, so there is an integrated point of configuring, monitoring, and controlling each mailbox. 

Feedback on the work done so far and input on requirements for capabilities in this area would be very helpful to us.

Isode R14.4: M-Store X.400 Performance Improvements

This one of a series of a messages describing new features in Isode R14.4, scheduled to ship in April 2009. You can see all of the messages on this blog relating to R14.4 by clicking on this link

R14.4 makes some performance and scalability improvements for M-Store X.400 that will be important for deployments holding millions of messages and mailboxes with tens of thousands of messages. This note describes the changes made, which will be interesting for M-Store X.400 users, and for applications using M-Vault as an index.

X.400 P7 provides a searching capability that is very similar to that provided by X.500. Rather than develop a special local index, M-Store X.400 uses M-Vault for mailbox indexing, with one directory entry per mailbox, holding information that may be searched on. This enables M-Store X.400 to use M-Vault's high performance searching.

Testing with large configurations identified a number of situations where overall performance was constrained by M-Vault. Changes have been made to deal with this:

• The most important client operation to optimize for is "list new messages". Further index optimizations were made, in particular to deal with the situation where there are large numbers of both submitted messages and delivered messages for a user.
• Directory paged results are used, which improves directory resource utilization for searches returning large numbers of results.
• When M-Store X.400 starts up in a large deployment, most of the clients will connect very quickly and issue a "list new messages" command. Each of these leads to a directory search. Having large numbers of directory searches outstanding is inefficient, so M-Store X.400 limits this number. This ensures a steady rate of new client connection, and at the same time enables connected clients to operate well.

These changes will give good M-Store X.400 performance for very large deployments, including those currently anticipated in 2009.

Apple's iPhone & making mobile email work well using IMAP

Apple's iPhone has an excellent email client that is an important part of the platform. The iPhone's sophisticated use of IMAP (in contrast to other widely available IMAP clients) is one reason that the email client works so well. 

A new whitepaper on the Isode site looks at how iPhone uses IMAP to meet mobile messaging requirements, and looks at other IMAP capabilities that could be used to support mobile messaging.

Isode R14.4: X.500 (2008) Conformance

This one of a series of a messages describing new features in Isode R14.4, scheduled to ship in April 2009. You can see all of the messages on this blog relating to R14.4 by clicking on this link

X.500 (2008) is the latest version of X.500. This is the 6th edition of X.500, and was approved by the ITU-T in November 2008.   Approval by ISO as ISO/IEC 9594 is expected this year. There are no major changes relative to the 5th edition (X.500(2005)) and the protocols are fully interoperable. More information can be found on http://www.x500standard.com/.   

X.500 specifies many capabilities, and a product supporting X.500 should provide a conformance status in the manner defined in  Section 13 of X.519. The conformance statement for M-Vault can be found at http://www.isode.com/support/x500-conformance.html. This will be updated to X.500(2008) when R14.4 ships. 

Technical work to support this has been a detailed standards review. We have made a number of product changes, primarily to ensure protocol support (not necessarily service support) for various protocol features and error codes. 

We believe that we support all of the X.500 features that will be useful to our customers. If you have a requirement for additional capabilities (you can determine features we do not support from the M-Vault conformance statement) please let us know.

Isode R14.4: CCCP - Supporting External Content Checking and Converion of Internet Mail in M-Switch

This is the twelfth in a series of messages describing new features in Isode R14.4, scheduled to ship in April 2009. You can see all of the messages on this blog relating to R14.4 by clicking on this link

R14.4 M-Switch adds the capability to use customer or partner provided capabilities to check and convert Internet messages.  Although M-Switch provides a comprehensive range of checking and conversion capabilities, there will sometimes be customer requirements that go beyond this.  R14.4 enables this by use of a new protocol called CCCP (Content Checking and Conversion Protocol). The CCCP specification is available here.

M-Switch uses CCCP to provide information to a customer developed CCCP server, that performs checking and conversion of messages. CCCP is a simple text encoded protocol with an encoding approach aligned with the IMAP protocol. CCCP enables the following functionality to be provided:

• Recipient changing (can be regarded as re-writing or redirect).
• Sender re-write.
• Recipient expansion (so the CCCP server can implement simple lists).
• Content conversion. The CCCP server may provide back modified messages, and different copies can be assigned to different recipients.
• For each recipient, message can be non-delivered, discarded, or quarantined (the CCCP requests M-Switch to perform the action).

These features allow a CCCP server to perform a wide range of address and content checking and conversion functions. The client/server architecture gives a number of advantages:

• CCCP processing is applied to stored messages, so this is completely transparent to external message transfer.
• Parallel processing means that slow CCCP processing of one message (e.g., taking human intervention) will not delay other message processing.
• Conversion and Checking is cleanly decoupled from M-Switch.
• For large deployments,  M-Switch and CCCP servers can be independently horizontally scaled.

M-Switch provides flexible use of CCCP, so that multiple CCCP channels can be configured to provide different conversions for different message flows. CCCP enables a wide range of conversion capabilities for different markets, and Isode is happy to work with any partner or customer to develop new CCCP servers.

Isode R14.4: Security Policy Enhancements

This is the eleventh in a series of messages describing new features in Isode R14.4, scheduled to ship in April 2009. You can see all of the messages on this blog relating to R14.4 by clicking on this link

Isode provides a Security Policy Infrastructure to support applications controlling access using Security Labels.  This is described in the Isode whitepaper "Isode Security Policy, Security Label and Security Clearance Infrastructure". This document will be updated when R14.4 ships.

R14.4 makes a number of updates to this infrastructure:

1. Support of NATO Security Categories.  Security Categories are used within Security Labels to provide finer grained control than Security Classification. R14.3 supported only US MISSI Security Categories, as defined in SDN.801c. NATO ACP 322 defines Security Categories with similar semantics to MISSI, but different syntax. R14.4 adds support for these categories, and control within the SPIF as to which syntax is used. This change means there is support for the two major definitions of Security Category, and that ACP 322 and UK JSP 457 can be fully supported.
2. The Isode Security Policy has been extended to support Equivalent Policies in line with SDN.801c definitions. This enables a Security Policy to define labels from other policies that are equivalent to the local ones. These labels will then be verified according to this equivalence.
3. Support of ESS Security Label formats in addition to X.501/X.411. This includes conversion between the formats.
4. Security Clearances can now be included in certificates. Where there is a Security Clearance in a directory entry, Sodium can now include this in a PKCS#10 CSR (Certificate Signing Request) which will result in the Security Clearance being included with the X.509 Certificate as part of the Subject Directory Attributes Extension.
5. Formal XML schema specifications of the Isode XML Security Label and Clearance formats are now provided.  Basic XML style sheets are also provided. This will facilitate external use and management of data in these formats.

Isode R14.4: Ongoing work on M-Switch GUI Configuration Management

This is the tenth in a series of messages describing new features in Isode R14.4, scheduled to ship in April 2009. You can see all of the messages on this blog relating to R14.4 by clicking on this link

We are rewriting the M-Switch configuration GUI, adding new functionality to MConsoleand gradually replacing EMMA. R14.4 moves us further towards this goal, with some of the new features in MConsole now fully functional and others available for preview.

MTA and Channel configuration was integrated with the operational display (switch view) in a previous release. R14.4 has added in configuration of bilateral agreements and schedules, completing this part of the GUI.

The M-Switch system view in MConsole is provided "read only" in R14.4 as this view is not yet complete. The UI to make modifications is also included for preview. Although broadly similar to EMMA's system view, we've made many detailed changes to improve ease of use. R14.4 completes Routing Tree and MIXER configuration capabilities in system view.

Three main areas remain to be completed, which we plan to do in 2009:

1. Wizards for creating MTAs, X.400 Message Stores, and Channels will be completely rewritten. We will be designing the new wizards from ground up, aiming for an easy to use style along the lines of Quickconfig.
2. Tables (partially displayed in R14.4). These are a directory representation of table based configuration. Some of these tables are rarely used, and will be moved to an advanced configuration option. A new UI will be provided for the authorization and policy tables to enable a higher level and easier to use abstraction.
3. Log files. There will be an advanced UI, with functionality similar to the current one, and a simple top level UI that will use a slider to increase/decrease logging level.

We've included preview screenshots below (click for larger images). Feedback on both the new R14.4 features and the plans for the complete UI are welcome.