Download PDF - Black Box (UK)

KVM
Secure Switching
ServSwitch Secure KVM Switches with USB
Combat security threats with these EAL4+ tested
The ServSwitch Secure KVM Switches with
USB are EAL4+ certified and TEMPEST approved
(except SW2008A-USB-EAL and SW4008-USB-
EAL). They surpass the security profiles of most
other KVM switches. These new switches have
been evaluated for Common Criteria Evaluation
Assurance to Level 4+ (EAL4+). Common Criteria
is an international standardised process for
information technology security evaluation,
validation, and certification. The Common Criteria
scheme is supported by the National Security
Agency through the National Information
Assurance Program (NIAP).
The ServSwitch Secure KVM Switches with
USB provide control and separation of up to
four PCs connected to secure and unsecure
networks through just one keyboard, monitor,
and mouse. Users can safely switch among as
many as four computers operating at different
classification levels without worry.
Features include:
• High port-to-port electrical isolation, which
facilitates data separation (RED/BLACK).
• The low radiated emissions profile meets
the appropriate national requirements.
• Switches are permanently hard wired,
preventing access from one CPU or
network to the others.
• External tamper-evident seals.
• Channel-to-channel 60-dB crosstalk isolation
protects against signal snooping.
• Supports DVI-I video, which is DC balanced
and may be encoded for security.
• Provides robust isolation between networks,
so they’re ideal for government applications
that access classified networks in addition
to public networks such as the Internet.
• WARRANTY — 2 Years.
Why ServSwitch Secure KVM
Switches with USB?
1. Prevent data leaking between
ports and to the outside world.
2. Prevent sensitive data from being
stored in the device.
3. Prevent electronic snooping.
C
Threats/Solutions
1. Prevent data leaking between
ports and to the outside world.
Threat: Microprocessor malfunction or
unanticipated software bugs cause
data to flow between ports.
Solution: Unidirectional keyboard and mouse
data flow is enforced by hardware “data
diodes” so data isolation doesn’t rely on
software integrity. This makes it impossible
for the computer to send data along the
keyboard and mouse signaling channel. This
advanced design also ensures data isolation
through hardware and prevents the keyboard
and mouse interfaces from becoming covert
computer-to-computer signaling channels
because of software holes or unanticipated
bugs.
In addition, keyboard and mouse devices
can only be enumerated at the keyboard and
mouse ports. Any other USB peripherals, such
as a USB thumb drive, will be inhibited from
operating, preventing any uploading or
downloading of data.
Threat: Physical proximity between ports
enables data leakage.
Solution: Isolation is improved by placing
the red and black ports at the opposite
edges of the switch.
Threat: Accidental port switching.
Solution: Locked-down operation disables
all keyboard hotkey and mouse switching
functions in both software and hardware
so that data corruption can’t inadvertently
cause an unanticipated channel change.
The only way to change the channel is
with the front-panel keys. There is only one
button per channel, so channel selection is
clear. Colour-coded visual feedback confirms
the channel selection.
Threat: Signaling by shorting the power supply
or loading the power.
Solution: Each port is independently powered
by its USB port. Shorting the power supply
on one port will not cause the power on the
other ports to be switched off. The shared
keyboard, mouse, and monitor circuitry are
powered by the power supply. The lack of a
common power supply minimises electronic
signaling.
Threat: Detection of signals on one computer by
monitoring for crosstalk (leakage) signals on
another computer.
Solution: Minimum crosstalk separation of
60 dB provided between signals from one
computer and input or I/O signals to another.
There are no connections to sensitive
analogue inputs, such as computer
microphone ports. Microphone circuitry
enables sensitive recording of small analogue
signals. Even very low crosstalk levels could be
recorded and act as a means by which a
non-selected computer could read data being
sent to another computer.
Threat: Timing analysis attacks (looking at
what happens on one port to determine
data flow patterns on another).
Solution: Only one computer is connected
at a time to any shared circuitry. Links are
unidirectional, preventing timing analysis.
Threat: Electromagnetic emissions.
Solution: Special low emissions cables are used
to minimise radiated electromagnetic signal
leakage. Filtered power connections minimise
emissions down the power lines.
2
Tech Support: 0118 965 6000 | Sales: 0118 965 6150