UIC 917-5: The HERMES System Architecture & International Data Exchange

UIC 917-5 Chapter 9 outlines the technical architecture of the HERMES System (Handling of Electronic Railway Message Exchange System). Before the public internet became ubiquitous, HERMES was established as the dedicated, secure Virtual Private Network (VPN) connecting the IT centers of national Railway Undertakings (RUs) across Europe and beyond.

This document serves as the “Network Manual” for international interoperability, defining how reservation data (passenger) and consignment data (freight) travel securely between different national systems (e.g., DB’s Kurs 90, SNCF’s Resarail).

1. The HERMES Network Topology

The HERMES network is not a centralized cloud but a meshed network of interconnected nodes. Chapter 9 describes the hierarchy and connection protocols:

• H-Nodes (HERMES Nodes): The primary gateways located at the computer centers of member railways. They act as the “routers” for international traffic.
• Interconnectivity: Each node creates a secure tunnel to other nodes, allowing for real-time transaction processing (e.g., booking a seat in a foreign train).
• HZB (HERMES Central Bureau): The administrative body (based in Utrecht) responsible for network management, security keys, and routing tables.

2. Applications Running on HERMES

HERMES is the carrier; the value lies in the applications it transports. The system supports critical business functions defined by other UIC leaflets.

3. Protocol Evolution: From X.25 to IP

While historically built on the X.25 packet-switching standard, UIC 917-5 Chapter 9 addresses the migration to modern TCP/IP (Internet Protocol) based networks via MPLS (Multiprotocol Label Switching). This modernization ensures higher bandwidth and lower latency while maintaining the strict security isolation required for critical infrastructure.

Security Layer: Since the network carries financial booking data, traffic is encrypted, and access is strictly controlled via closed user groups (CUG), preventing unauthorized access from the public internet.