Army Secures 'Last Mile' In Its Supply Chain

By Tom Smith

The military's equivalent of a corporate supply chain is a critical link in getting soldiers the materials they need to wage war.

That's why it's especially noteworthy that the U.S. Army plans a major rollout of highly secure wireless LAN equipment that will be used by soldiers charged with maintenance, replenishment, and repair of equipment and other materials used in combat.

If a tank or truck breaks down on the battlefield, the wireless LAN gear would be used in ordering the necessary parts through wireless connectivity with Army systems.

Wireless connections could also be used to check and update maintenance records on ground vehicles and aircraft, for example.

"There's basically a warehouse on the battlefield, and that's where certain supplies are stored," said Pete Johnson, CIO in the Army's Program Executive Office for Enterprise Information Systems (PEO EIS), Fort Belvoir, Va. "If a unit orders supplies that aren't locally stored, they're shipped to the local warehouse."

At A Glance Company: United States Army, Program Executive Office for Enterprise Information Systems Industry: Government/Military E-Business Goal: Supply mobile, transportable networked systems to soliders supporting troops on the battlefield, in compliance with strict government security standards. Solution: Decided to use wireless LAN equipment at existing security levels, since data is sensitive but unclassified, but then needed to go back and add supplemental security following disclosure of significant security problems. Wireless LAN gives soldiers flexibility and mobility without requiring lots of configuration changes. --T.S.

The relevant IT systems that wireless LANs will communicate with -- developed internally by the Army -- control warehouses and inventory, such as helicopter and airplane parts for aviation units. Those systems, of course, have connectivity back to central Army systems, which in turn have connections to Army suppliers, such as those that make or distribute spare parts.

The Army's internally developed supply chain systems apply the Army's business rules related to maintenance, such as keeping up-to-date information on the combat readiness of a vehicle. "If you pull a tank from an engine, it's no longer battle-ready, so readiness data is compiled and sent back up to the national level so the Army as a whole can see the status of assets," Johnson said.

All this means that the wireless LANs the Army will begin implementing in the next 60 days will ultimately serve as the last-mile connection in the its supply-chain network.

The types of data being transmitted in such applications are called "secure but unclassified," which means the Army didn't need "super-duper encryption" when it first considered deploying wireless LANs.

As part of the Army's Combat Service Support Automated Information System Interface Project (CAISI), Johnson had already planned to roll out wireless LANs when a major security hole was discovered in wired equivalent privacy (WEP) last year.

"If you had a wireless LAN card, a [hacker] could sniff into your network, read your data and become a member of that network," Johnson said.

That prompted the Army to issue a wireless LAN policy stating it was not permitted to use 802.11 natively, or without additional encryption safeguards, and that whatever supplemental encryption was used must satisfy Federal Information Processing Standards (FIPS) requirements.

That requirement, in turn, prompted PEO EIS to begin investigating products that would supply additional encryption.

Its choice: wireless LAN security products from Fortress Technologies. Fortress is currently working on FIPS certification for its AirFortress product, but it has other products that have already achieved FIPS certification, Johnson said, which gave him confidence the company's products would meet the federal government security standards.

Fortress' products were also selected because they had an advantage over those that use virtual private network (VPN) technology. Such products build secure tunnels inside the network over which they operate, and require network nodes to alert other nodes of their IP address and other relevant information. The shortcoming with that approach, Johnson explained, is that it doesn't work very well in a highly mobile environment. "You set the VPN up, and tell each VPN device on your network where all the other ones are, and that works until things change. In an environment with soldiers on the battlefield, that becomes very cumbersome."

With AirFortress, each gateway and client share an Access ID that creates a closed architecture in which gateways and clients only pass encrypted traffic between AirFortress devices, giving more flexibility for roaming than the VPN approach.

The Army's introduction of new WLAN security requirements delayed the rollout of some WLAN equipment. Johnson said PEO EIS had planned to double its WLAN systems to 4,000 this year, but has had to delay 2,000 new purchases in order to buy the AirFortress security system. He declined to cite the Army's overall investment in the wireless and security technology. AirFortress gateways start at $1,995.

Once it's operational -- and the plan is to begin CAISI wireless deployment in the next 60 days at the Fort Bragg, N.C., Army base -- Johnson said he expects PEO EIS will use triple DES encryption on the AirFortress product, with 168-bit keys. AirFortress offers multiple encryption options. That encryption will supplement the encryption that's available in the wireless LAN radios.

The total CAISI deployment, which will involve 11,000 wireless clients, will take about four years and involve Cisco Systems and other off-the-shelf wireless equipment, Johnson said.

Meantime, Johnson thinks the Army has put in place a secure method of providing last-mile connectivity in its supply chain.