20
Threat
Solution
Data being sent to ports
by means of faulty or
subverted keyboards or
mice causing the channel
to switch and sending
data in turn to each port.
Channel switching is controlled by the front
panel buttons only with all keyboard hotkey
or mouse switching capabilities removed
from the design.
Data transfer by means of
common storage.
USB ports support keyboard and mouse
(and optional card reader) connections
only. The product does not enable a USB
memory stick or disk drive to be shared
between computers. Unidirectional
keyboard and mouse data signalling
protects against data transfer across the
switch.
Timing analysis attacks.
If a connection exists between a computer
and a shared microprocessor system, it
is potentially possible to determine what
may be happening on the micro by timing
the responses to repeated requests that
the micro must service. For example, if
a high data bit takes longer to transmit
through the system than a low bit it may
be possible to detect the pattern of data
flowing between other ports by attempting
to time the responses to otherwise normal
requests. In the AdderView Secure, each
port has a dedicated processor that only
has input signals from the rest of the
system. These input signals are only active
when the port is selected. Consequently a
timing analysis attack from one computer
would yield no information about data
flowing to another computer.
The user selects the wrong
port.
Only one simple method of selecting
computers is provided. The selected port
is clearly and unambiguously indicated on
the front panel by means of colored lights
adjacent to each key switch. For high levels
of security, the screens of high and low
security computers should be arranged to
look visibly different in general appearance.
Threat
Solution
Forced malfunctions due
to overloaded signalling.
It is potentially possible to create forced
malfunctions by constantly and quickly
sending a stream of valid requests (such as
the request to update the keyboard lights).
A well known example of an undesirable
KVM malfunction is a “crazy mouse”
which was quite common with early KVM
switches and was caused by data loss on
PS/2 systems with the result that the mouse
darted around the screen randomly clicking
and opening windows. The unidirectional
design of the AdderView Secure ensures
that the influence of signalling on one port
cannot flow past the data diodes. This
means that overload signalling on one port
will not affect the operation of another
port. USB signalling is not susceptible to the
failure mechanism that caused the crazy
mouse on PS/2 systems.
Signalling by means of
shorting the power supply
or loading the power
supply.
Each port is independently powered by its
USB port. Shorting the power supply on
one port will not cause the power on other
ports to be switched off.
Tampering with the
switch.
The switch is fitted with tamper protection
measures.
Data transfer by means of
a shared smartcard.
The switch provides a layer of isolation
between the physical smartcard reader and
the computer. This will counter threats
associated with sharing the same physical
card reader. The result is to deliver the
same security level as would be present
if multiple card readers were used and
the card was swapped between them.
A further level of security is provided by
making the smartcard function absent
from certain computers (by means of using
cables that lack the yellow smartcard USB
connector).
Non-authentic facsimile
switches.
The enhanced models enable the
authenticity of the switch to be checked by
means of security certificates.
