NanoSec
 
Device Security
Framework
NanoBoot
NanoCert
NanoDefender
NanoDTLS
NanoEAP
NanoRADIUS
NanoSec
NanoSSH
NanoSSL
NanoUpdate
NanoWPA2
 

Home > Products

Features
Benefits
Architecture


IPsec/IKE is a standard for securing IP communications by encrypting and or authenticating packets at the network layer. It's useful for providing authentication (to ensure peers are communicating with the intended trusted parties), data confidentiality (to ensure data cannot be read in transit) and message integrity (to ensure traffic has not been altered in transit). IPsec is terrific for applications like VOIP, to reduce the threat of packet sniffers or man-in-the-middle attacks.

Unfortunately, most IPsec packages are designed for PC's, not embedded devices. That means that they can be somewhat unwieldy in memory-constrained device environments... and the performance of typical commercial or open-source IPsec offerings can be pretty disappointing, as well.


NanoSEC™ is the answer.

NanoSec is Mocana's ultra-optimized, micro-footprint IPsec/IKE solution specifically designed to speed product development while providing best-in-class device security services for resource-constrained environments. And it's surprisingly affordable: your NanoSec total cost of ownership will usually be substantially less expensive than open source. (Try our "build vs. buy" calculator, here.)

NanoSEC™ Features
Mocana's NanoSec is an standards-based full featured and RFC-compliant IPsec toolkit. NanoSec is easy to use, uniquely architected with an asynchronous core to fully leverage hardware acceleration, is extremely portable and has an incredibly small memory footprint. It is ideally suited to securing voice, video and data communications.

Mocana NanoSec supports IKEv2, Mobile IKE (MOBIKE), Dual-Mode Operation (IKE + IKEv2) and integrates tightly with Mocana's NanoEAP package (Extensible Authentication Protocol). All are integral parts of Mocana's Device Security Framework.


Very High Performance
NanoSec, like all of Mocana's device security solutions, is designed with an asynchronous core to fully leverage hardware acceleration. NanoSec throughput typically outperforms open source IPsec packages by a factor of 4x or better, depending on the platform.

Ultra-Small Size
Optimized for size and memory usage, the NanoSec client has been specifically designed and written to operate on resource-constrained devices, requiring as little as 65KB ROM. This is less than one-fifth the size of the typical IPsec client.

Full (not partial) RFC Compliance:
  • RFC-2401, Security Architecture for the Internet Protocol
  • RFC-2402, IP Authentication Header
  • RFC-2403, The Use of HMAC-MD5-96 within ESP and AH
  • RFC-2404, The Use of HMAC-SHA-1-96 within ESP and AH
  • RFC-2405, The ESP DES-CBC Cipher Algorithm With Explicit IV
  • RFC-2406, IP Encapsulating Security Payload (ESP)
  • RFC-2407, The Internet IP Security Domain of Interpretation for ISAKMP
  • RFC-2408, Internet Security Association and Key Management Protocol (ISAKMP)
  • RFC-2409, The Internet Key Exchange (IKE)
  • RFC-2410, The NULL Encryption Algorithm and Its Use With IPsec
  • RFC-2451, The ESP CBC-Mode Cipher Algorithms
  • RFC-3280, Internet X.509 Public Key Infrastructure Certificate and Certificate
         Revocation List (CRL) Profile
  • RFC-3566, The AES-XCBC-MAC-96 Algorithm and Its Uses With IPsec
  • RFC-3602, The AES-CBC Cipher Algorithm and Its Use with IPsec
  • RFC-3706, A Traffic-Based Method of Detecting Dead Internet Key
         Exchange (IKE) Peers
  • RFC-3715, IPsec-Network Address Translation (NAT) Compatibility
         Requirements
  • RFC-3748, Extensible Authentication Protocol (EAP)
  • RFC-3947, Negotiation of NAT-Traversal in IKE
  • RFC-3948, UDP Encapsulation of IPsec ESP Packets
  • RFC-4306, Internet Key Exchange (IKEv2) Protocol
  • RFC-4434, The AES-XCBC-PRF-128 Algorithm for the Internet Key
         Exchange Protocol (IKE)
  • RFC-4555, IKEv2 Mobility and Multihoming
  • RFC-4718, IKEv2 Clarifications and Implementation Guidelines


  • Very Granular IPsec Feature Controls:
    Complete control of AH and ESP protocols configuration
  • Multiple concurrent instances for multi-homing, VLAN, per-interface, etc.
  • Complete control of transport and tunnel modes
  • Simple and complete control of shared secrets (IKE authentication)
  • Complete control of IKE exchange
  • Complete control of non-compliant security policy packets

  • Rich Cryptography Algorithm Support
  • 3DES-168-CBC
  • Diffie-Hellman Groups 1, 2, 5, 14 SYMMETRIC CRYPTOGRAPHY
         OTHER CRYPTOGRAPHY
  • BLOWFISH—CBC
  • Automatic key negotiation
  • AES-128-CBC SUPPORT
  • AES-192-CBC
  • AES-256-CBC Crypto libraries
  • DES-56-CBC
  • Digital Signatures
  • HMAC-SHA1-96 certificates (X.509) authentication
  • HMAC-MD5-128 ASyMMETRIC CRyPTOGRAPHY
  • IKE support for digital
  • Leverages Mocana Common
  • PKCS #1, version 1.5
  • PKCS #5
  • PKCS #7
  • PKCS #8
  • PKCS #10
  • PKCS #12
  • Support for manual keying
  • MD2 MESSAGE INTEGRITY
  • MD4
  • HMAC-SHA1-160
  • DHE affords Perfect Forward
  • MD5
  • HMAC-MD5-96 Secrecy (PFS)
  • RSA
  • SHA1
  • SHA-224
  • SHA-256 AUTHENTICATION
  • SHA-384
  • SHA-512

  • NanoSEC Benefits
    Works Where Others Won't
    NanoSec fits into the smallest memory crannies where other IPsec implementation simply can't... and open-source implementations can't hold a candle to NanoSec's throughput performance.

    Platform Independent
    NanoSec, like all of Mocana's device security toolkits, is CPU-architecture and platform independent. NanoSec is immediately available for over 100 processor/OS combinations, and ports to new platforms can typically be completed in 2 hours. Platforms supported out-of-the-box include Linux, Monta Vista Linux, VxWorks, OSE, Nucleus, Solaris, ThreadX, Windows, MacOS X, (ARC) MQX, pSOS, and Cygwin. NanoSec is endian-neutral, and can be used without an RTOS if required.


    No Crypto Expertise Required

    NanoSec features an extremely powerful, but simple and easy-to-use API. That's because we built it for ease-of-use and ease of installation from the ground up. You don't need to be a crypto expert, because NanoSec hides all of the complexity of the cryptography. You can focus on your development project, and let NanoSec worry about the security. Plus Mocana's developer support team is always available to answer your questions about crypto, our toolkits, or embedded development in general.


    Dramatically Speeds Your Development Cycle

    NanoSec is a ready-made, pre-optimized and exhaustively tested IPsec solution that frees your in-house development resources to focus on what's really important: the functionality of your project. NanoSec's advanced, well-documented APIs speed development & integration efforts and significantly ease customization. NanoSec allows you to develop proprietary systems while giving you the freedom to substitute in the commercially-available components you choose. As always, Mocana's developer support team is available 24/7/365 to help you anytime.


    Less Expensive than Open Source

    While open source IPsec implementations are "free", they usually end up costing a lot more than Mocana NanoSec. Click here for our free "build vs. buy" calculator. Or here for a free source code evaluation of NanoSec and a quote.



    NanoSEC Architecture



    Other Mocana Solutions

    In addition to our NanoSec security solution, Mocana also develops an embedded SSL / TLS client and server (NanoSSL), a RADIUS client (NanoRADIUS), an embedded SSH (NanoSSH) and an EAP/802.1X wireless solution including wireless supplicants (NanoEAP). All Mocana's solutions are among the very smallest and fastest protocol implementations on the market. Mocana solutions have an asynchronous core to fully leverage hardware acceleration and are developed with ease of use and performance in mind. All come with Mocana's comprehensive support and maintenance and are available either individually or as a bundle as part of the Mocana Device Security Framework.

    Download Data Sheet PDF
    Contact Mocana


    NanoSSH
    Features & Benefits
    Open-standards, RFC compliant, full featured
    Easy to install and use
    Speeds development cycle
    Full Source Code
    Code reuse for smaller memory footprint
    Advanced well documented APIs
    Advanced cryptography support
    FIPS validated cryptography support
    High performance zero-threaded, asynchronous architecture
    RTOS neutral and transport agnostic
    World-class development & technical support
    NanoSec Free Evaluation
    Please fill out the form below. All fields are required.
    First Name
    Last Name
    Company
    Job Title
    Phone
    Address
    City
    State
    Zip Code
    Email

    Your Privacy

    Country
    Embedded security source code packages can only be delivered to valid business email addresses.
    When is your project starting?


    I'd like to receive email updates and news from Mocana*

    I have read the Mocana Terms and Conditions
     

    Sales | Support | Library Info | Contact | Privacy Policy | FAQs | Site Map

    Copyright © 2008 Mocana Corporation