Digi integrates FIPS 140-2 security

  • October 17, 2023
  • Steve Rogerson
  • Digi

Minnesota-based Digi has integrated FIPS 140-2 federally-validated cryptography across its entire line of cellular routers and other devices based on its DAL accelerated Linux operating system.

This enhancement positions Digi as a provider for the government sector, including government agencies and contractors, and police forces, as well as financial institutions, medical facilities and other industries that handle sensitive information and require high levels of security.

FIPS 140-2 (Federal Information Processing Standard Publication 140-2) is a US federal and Canadian national standard established by Nist for validated cryptography. Its implementation ensures sensitive data remain secure and confidential.

Government agencies, including the Department of Defense (DoD), the Department of Homeland Security (DHS), Customs & Border Patrol (CBP), Federal Bureau of Investigation (FBI) and Drug Enforcement Administration (DEA), as well as US government contractors, police forces and other federal entities, are required to adhere to FIPS 140-2 guidelines to protect their sensitive information and comply with the Federal Information Security Management Act (FISMA). Additionally, financial institutions, such as the IRS, and organisations required to be Hipaa-compliant have to use FIPS-validated devices.

“We recognise the paramount importance of FIPS 140-2 compliance for federal agencies and law enforcement personnel, as well as financial and medical institutions, as it ensures validated data protection, encryption and authentication,” said Gregory Hill, director of product management at Digi. “Therefore, we are thrilled to unveil the seamless integration of FIPS 140-2 across our entire cellular router line, reaffirming our dedication to empowering our valued customers with advanced levels of security in their IoT deployments.”

Digi has completed formal validation testing and been granted Nist certificate #4489. The implementation follows the guidelines of the Nist CMVP cryptographic module validation programme.

Digi’s FIPS implementation is built on the OpenSSL 3.0 release, providing up-to-date cryptographic algorithms, including ciphers, hash functions and key lengths. The integration of FIPS 140-2 ensures a high level of encryption and authentication, meeting the stringent security requirements of government agencies and healthcare organisations.

Digi’s entire line of enterprise (EX), industrial (IX) and transportation (TX) routers, console servers, and USB-connected devices will be equipped with FIPS through a software update via Digi Remote Manager, making it a candidate for new deployments and upgrades of existing systems.

Enabling FIPS is said to be straightforward, requiring a simple configuration setting without any additional software keys to download, or additional variant product SKUs.

Beyond government, finance and healthcare, other sectors in which data security is a priority, such as transportation, public safety, utilities, and lottery and gaming, can also benefit from FIPS compliance.

As the FIPS standard continues to evolve, Digi intends to transition to FIPS 140-3 as part of a firmware release before the expected expiration of FIPS 140-2 in September 2026.

Founded in 1985, Digi (www.digi.com) has helped its customers connect over 100 million things.