ADDERView Secure Analogue Enhanced Manual

							



10


Installation
Locations
Please consider the following important points when planning the locatio\
n of 
the AdderView Secure unit:
•	 Situate	the	unit	close	to	the	host	computers	to	which	it	will	be	connected	
and also the user console peripherals. 
•	 The	unit	requires	a	power	supply	input,	so	a	nearby	spare	mains	power	
outlet will be required. 
•	 As	keyboard	and	mouse	switching	codes	are	not	possible	for	security	reasons,	
the only way to change channels is via the front panel buttons. Therefore, the 
unit should be easily accessible from the user’s normal position.     
•	 Please	consult	the	precautions	listed	within	the	Safety information section.
Cabling recommendations
The special cables available for connections to each system are carefully 
constructed with braid and foil to provide excellent screening against s\
ignal 
emissions that could otherwise be eavesdropped. A similarly constructed \
cable is 
also	available	for	the	monitor	connection	(VSCD9).	
The special cables already have ferrite cores fitted to assist with si\
gnal 
suppression.	For	USB	peripheral	connections,	we	strongly	recommend	that	(if	
not	already	fitted)	you	attach	ferrite	cores	to	those	cables	to	further	assist	with	
emission suppression. 
Tamper-evident seals
The primary casing access screws are pre-fitted with tamper-evident se\
als. It 
may be a policy of your organisation to fit proprietary tamper-evident\
 labels 
across certain chassis screws. Additionally, seals could be added betwee\
n each 
connection and the unit to highlight any connections that have been alte\
red.
IMPORTANT:	Do	not	use	the	unit	if	the	tamper-evident	seals	are	
damaged.	Do	not	use	if	there	are	any	signs	of	damage	to	the	unit	or	its	
power supply. 
SECT 3
Links overview
The rear panel of the unit is well marked, however, the diagram below of\
fers 
additional clarity on how best to arrange your connections.
You may have noticed that the indicators on the front panel use differen\
t 
colors to represent the various channels. This is done to provide quick \
and 
effective visual feedback to the operator. Channel 1 has a green indicat\
or 
and is traditionally used for the lowest security connection. The fina\
l channel, 
numbered	2	on	the	two	port	version	and	4	of	the	four	port	version,	uses	a	red	
indicator and is usually connected to the highest security connection. T\
hese are 
configuration conventions only and are offered as a suggestion - there\
 are no 
technical differences in the operational specifications of the four ch\
annels.  
CONSOLE
INDOOR USEO NLY
5V 2.5A2413
Channel	1	 (green indicator)Usually used for connection to the lowest security computer/network.
Channel	4	or	channel 2 on two channel models   (red indicator)Usually used for connection to the highest security computer/network.
Console	connectionsConnect directly to the operator’s keyboard, mouse, video display and card	reader	(if	used).
Channel	3	 (amber  indicator)
Channel	2	 (blue  indicator) 
WARNING:	Do	not	open	the	case	of	the	switch	or	remove	any	screws	
(other	than	the	rack	mounting	screws,	if	fitted)	-	the	switch	will	become	
unusable if the case is opened.   
						

							



11


Mounting
The AdderView Secure unit offers two main mounting methods:
•	Supplied	four	self-adhesive	rubber	feet
•	Optional	rack	brackets
CONS
INDOOR USE O NLY
3   
						

							



12


Making connections
Connections to the AdderView Secure unit do not need to follow the preci\
se 
order given in this user guide, although if one or more systems must be \
hot-
plugged, connect these after all other connections have been made.
IMPORTANT: To achieve the high levels of signal isolation and low emissi\
ons 
profile that the switch is capable of delivering, it is necessary to u\
se the only the 
cables listed in the Additional items section. These have been very carefully 
designed and tested to maximize the performance levels of the switch.
Note: For additional security, use tamper-evident tape to bridge the com\
puter 
cable connections to the switch’s case once installed. 
Connections to computer systems
All connections to computer systems are achieved using combined shielded\
 link 
cables of which there are several different types to suit the various po\
rts used - 
see the Additional items section for details.
See also Devices used with the AdderView Secure for advice about linking 
devices to the AdderView Secure unit.     
To	connect	a	system	link	
1  Wherever possible, ensure that power is disconnected from the unit and t\
he 
host	computer(s)	to	be	connected.
2	 At	the	rear	panel	of	the	unit,	connect	the	appropriate	link	cable	to	the	26-
way connector of the appropriate channel.  
Connections to user console peripherals
To	connect	a	keyboard	and	mouse
IMPORTANT: To reduce the risk of radiated snooping, do not use wireless \
keyboard or mouse devices.
See also Devices used with the AdderView Secure for advice about linking 
devices to the AdderView Secure unit.
1  Wherever possible, ensure that power is disconnected from the unit and t\
he 
host	computer(s)	to	be	connected.
2 In the middle of the rear panel, connect the cables from the keyboard an\
d 
mouse to the USB sockets marked  and  respectively.
 Note: If using a combined keyboard and smartcard reader then connect the\
 
keyboard/reader to the socket labeled . Any keyboard connected to the 
keyboard socket should then be removed as it will become non-functional)\
.
3 Attach the connectors at the other end of the link cable to the appropri\
ate 
ports	of	the	computer,	i.e.	VGA	video,	USB	(or	PS/2	keyboard	and	mouse)	
and the smart card reader, if used - see below. 
  IMPORTANT: If only certain computers require the use of the smart card 
reader, for those systems use a link cable that has only one USB connect\
or - 
do not leave a spare USB link unconnected.  
CONSOLE
3 If using a smart card reader, connect the cable from the reader to the U\
SB 
socket labeled .
 Note: The smartcard port is not active on standard models (AVSV1002-XX \
and AVSV1004-XX) which do not contain smartcard circuitry.          
						

							



13


To	connect	a	display	monitor
1  Wherever possible, ensure that power is disconnected from the unit and t\
he 
host	computer(s)	to	be	connected.
2  Connect a suitable VGA video display to the port labeled  within the 
Console section on the rear panel. Ensure that the securing screws are u\
sed 
to maintain reliable links.
 Note: We strongly recommend that you use a video cable that has been 
correctly screened against signal emissions (such as the VSCD9 cable). 
CONSOLE
Note: The use of EDID information (automatically provided by the video \
display) 
could cause issues in certain high security installations - please see t\
he Video 
display (EDID) information section for further details).   
						

							



14


Video display (EDID) information
The	Display	Data	Channel	(or	DDC)	communication	scheme	was	introduced	to	
allow	video	displays	to	provide	details	(using	the	information	format	of	EDID	
-	Extended	Display	Identification	Data)	about	themselves	and	their	capabilities	
to the computer’s graphic adapter circuitry. In most applications thi\
s is a useful 
and positive feature. However, in a highly secure environment this prese\
nts two 
potential problems:
•	 Most	video	displays	provide	manufacturer,	model	and	serial	number	
information as part of their EDID transfer. This unique information coul\
d 
possibly be used as a marker by anyone attempting to compromise security\
 
within one or more of the connected computers/networks.
•	 The	operation	of	the	DDC	scheme	could	theoretically	provide	a	means	to	
transfer a small packet of EDID information to the computers at each pow\
er 
on cycle of the AdderView Secure. 
If your organisation wishes to protect against such scenarios then it is\
 
recommended that the DDC lines are disconnected in the cable between the\
 
AdderView Secure and the monitor. Alternatively, Adder would be happy 
to discuss configuring the AdderView Secure with a DDC policy to suit \
your 
organisation.
AdderView	Secure	EDID	policy
The AdderView Secure maintains individual EDID memories for each connect\
ed 
computer port. During manufacture, these memories are each loaded with a\
 
default EDID packet. 
When the AdderView Secure is powered on, its response will be determined\
 by 
the condition of the DDC signalling pins of the video monitor connector:\
•	If	the	DDC	pins	are	connected	as	standard: The AdderView Secure reads 
the EDID information from the attached video monitor and loads a copy 
into each port memory, which can then be made available to the connected\
 
computers.
•	If	no	video	monitor	is	connected	or	the	monitor’s	DDC	signalling	pins	
are disconnected: The AdderView Secure will maintain the existing data 
held in the EDID memories and make them available to the computers. 
•	If	the	video	monitor’s	DDC	signalling	pins	have	been	connected	to	
ground: The AdderView Secure will load a set of default data to the EDID 
memories and no data will be made available to the computers. This provi\
des 
a means of clearing information about previously attached monitors.
Note: Most analog video cards will output a video signal without EDID 
information. In such installations it may be acceptable to disconnect th\
e DDC 
connections from the AdderView Secure so that no EDID information is mad\
e 
available to the computers. However, some graphics cards will not output\
 a 
video signal unless they can read the EDID information.
To	determine	how	EDID	information	is	used
Note: The information given here is provided purely as an overview. It i\
s beyond 
the scope of this document to provide detailed instructions on how to mo\
dify 
video display cables, which should only be attempted by a qualified en\
gineer.
If the transfer of EDID information is unsuitable for your installation,\
 you can 
take steps to bypass or disable its use. EDID information is sent from t\
he video 
display on the following pins of the connector:
•	 VGA	(15-pin	D-type)	connector:		 pins	12	and	15
As mentioned earlier, the AdderView Secure unit responds in the differen\
t ways, 
depending upon how the DDC data lines within the video display cable hav\
e 
been wired:
DDC pin conditions AdderView Secure unit response
Connected EDID information is harvested from the connected 
video display during unit power on and written to all 
computer port memories.  
Not connected Unit retains the EDID information that is already held 
in the port memories and continues to present them to 
the attached computers. No new EDID information can 
be sought from the currently connected video display.
Grounded Unit overwrites all EDID information held in memory 
with default information but does not present anything 
to the attached computers.
In situations where no EDID information is being supplied, it may be nec\
essary to 
use a special driver on the connected computers to inform their graphic adapters 
on the appropriate signals to send. 
Alternatively, a ‘surrogate’ video display of the appropriate type\
 could be 
temporarily connected to the AdderView Secure unit in order to harvest t\
he 
necessary EDID information. The surrogate video display could then be re\
placed 
by	the	real	one,	which	has	its	DDC	pins	disconnected	(not	grounded).	   
						

							



15


Connection to power supply
Important: Please read and adhere to the electrical safety information g\
iven 
within the Safety information section of this guide. In particular, do not use an 
unearthed power socket or extension cable.
To	connect the power supply
1 Attach the output connector of the power supply (country	specific	power	
supplies	are	available)	to the socket located in the centre of the rear panel.
2 When all other connections have been made, connect the main body of the \
power supply to a nearby earthed mains socket.
NSOLE
5V 2.5 A   
						

							



16


SECT	4
Operation
In operation, the AdderView Secure unit allows you to quickly and secure\
ly 
switch between up to four systems. Strictly only one system may be acces\
sed at 
a	time,	whereupon	the	common	keyboard	and	mouse	(and	smart	card	reader,	if	
used)	are	linked	to	that	system.	
Important security features
Tamper-evident seals
Given the high security nature of most installations that incorporate th\
is unit, 
tamper-evident seals are fitted as standard across certain chassis scr\
ews. As part 
of a best practice policy, you are recommended to check any applied seal\
s on a 
regular basis to ensure that the unit has not been opened without author\
ization.
IMPORTANT:	Do	not	use	the	unit	if	the	tamper-evident	seals	are	
damaged.	Do	not	use	if	there	are	any	signs	of	damage	to	the	unit	or	its	
power supply.
The security indicators
The front panel includes five indicators that are dedicated to the Add\
erView 
Secure’s internal security system.    
Note: Although anti-subversion monitoring continues to take place while \
the 
unit is powered down, indications are only given once power is reapplied\
.
If any subversions are suspected by the unit then it will immediately en\
ter a lock 
down state where the following will take place:
•	 The	computer	channels	become	isolated	and	will	not	respond	to	the	front	
panel buttons,
•	 The	green	authentication	channel	indicator	will	illuminate,
•	 The	four	red	security	will	continually	show	the	following	flashing	alert	
sequence:
Anti-subversion monitoring (enhanced models only)
The	enhanced	models	(AVSC1102-XX	and	AVSC1104-XX)	continually	monitor	
their	various	defences	for	potential	subversions	(even	when	power	is	removed),	
such as: 
•	 Dismantling	of	the	case,
•	 Tampering	with	the	circuitry,
•	 Loss	or	corruption	of	authentication	security	information.
To confirm that such checks are taking place, every five seconds the\
 red security 
indicators will display a brief scanning sequence where one light appear\
s to 
track right and then left along the row:  
www.adder .comSECURE
ADDER VIEW
Green authentication channel indicatorIlluminates whenever the authentication channel is selected. The indicator will be on immediately after power up, until a computer channel is selected. 
Four	red	anti-subversion	 (and authentication) indicatorsOn	enhanced	models,	these	indicate	the	current state of the anti-subversion function (discussed	in	the	next	section)	and	also	provide responses whenever you use the authentication process. 
Once	the	alert	state	occurs,	it	is	irreversible.	The	unit	can	no	longer	be	used	and	
must be replaced.   
						

							



17


Authentication checking (enhanced models only)
In addition to the anti-subversion scans that occur continuously, enhanc\
ed 
versions	(AVSC1102-XX	and	AVSC1104-XX)	of	the	AdderView	Secure	also	
provide a trusted mechanism whereby you can confirm their authenticity\
.
At manufacture, qualifying AdderView Secure units have a unique identity\
 code 
configured	within	their	circuitry.	On	request,	Adder	can	provide	you	with	an	
Authentication Certificate when you provide the following information:\
•	 The	8-digit	Unit	ID, and
•	 The	16-digit	Request	Code. 
Both of these codes are listed on the AdderView Secure unit. 
Once	the	validity	of	your	request	has	been	
confirmed, you will be sent an Authentication 
Certificate containing the following:
•	 Confirmation	of	the	8-digit	Unit	ID,
•	 A	unique	16-digit	Query	Code, and
•	 A	Key	Map which shows a series of 
indications that the AdderView Secure 
unit must give in response to particular 
key presses that you can enter.
Authentication Certificate
Unit ID:7654-3210
Query code: a1b2-c3d4-e5f6-a7b8
Key Display
0
1
2
3
4
5
6
7
8
9
To	use	your	Authentication	Certificate
1  Apply power to the AdderView Secure unit. 
 Note: If the unit is already on, remove power, wait five 
seconds and then re-apply power.
 The green  indicator will be on to show that the 
keyboard is switched to the internal authentication 
channel	(also	the	red	indicators	should	be	performing	
their	intermittent	scan	procedure): ................................. 
2 Using the attached keyboard, enter the characters:  
a u t h e n t i c a t e  and press Enter. Note: The video 
display is not used during this process - take care to enter 
characters correctly. 
 The first of the four red indicators will begin to flash: ....
3	 Enter	the	8-digit	Unit	ID code and press Enter. 
 If the code is correct, the first red indicator will illuminate 
and the second will begin to flash:.................................
4	 Enter	the	16-digit	Query	Code code from the 
Authentication	Certificate	(do	not	enter	the	dashes)	 
and press Enter. Take care, you have ten attempts to 
enter the correct code - see the section ‘If you make a 
mistake when entering’.
 If the code is correct, the red indicators will extinguish, 
leaving only the green illuminated: ................................
5	 Using	the	attached	keyboard,	press	a	numeric	key	(using	
the number keys above the main keyboard, not the 
numeric	keypad)	and	observe	how	the	four	red	indicators	
illuminate in response. Check the pattern against the one 
listed on the certificate for the pressed numeric key. You 
can check as many of the listed codes as appropriate. 
However, if any response does not match the pattern 
shown on the certificate, do not use the AdderView 
Secure unit and seek immediate advice from Adder 
technical support.
If you make a mistake when entering
•	 If	you	press	an	incorrect	key,	press	the	Esc key to start the same code again.
•	 While	entering	a	code,	if	you	do	not	press	a	key	for	30	seconds,	the	unit	will	
timeout and you will need to begin whole process again.
•	 IMPORTANT:	You	have	ten	attempts	to	enter	the	Query	Code	correctly	(this	
is counted each time the Enter key is pressed - using Esc to start the c\
ode 
again	or	going	beyond	the	30	second	timeout	do	not	count	as	one	of	the	
ten	attempts).	After	the	tenth	consecutive	incorrect	attempt,	the	AdderView	
Secure will enter its alert state and will lock out irreversibly.    
						

							



18


Selecting computers
In order to guard against the possibility of malicious software and also\
 to 
minimize the chance of accidental switching, the AdderView Secure unit o\
ffers 
only one method to change between channels. All switching is done using \
the 
front panel switches.
•	 The	buttons	are	clearly	labeled	to	eliminate	any	ambiguity.
•	 Press	the	appropriate	button	to	select	the	labeled	channel.
•	 When	the	chosen	channel	has	been	connected,	the	adjacent	indicator	
will	illuminate	(continuously)	to	confirm.	If	the	indicator	flashes,	then	the	
selected computer is either switched off or disconnected.
•	 Each	channel	uses	a	differently	colored	indicator	to	provide	additional	visual	
feedback about the chosen channel. Channel 1 has a green indicator and 
is generally configured to link with the lowest security computer/netw\
ork, 
whereas	channel	4	(or	channel	2	on	two-port	versions)	has	a	red	indicator	
and is generally configured to link with the highest security computer\
/network.   
Note: If a keyboard key is held down during a channel change then the ke\
y will 
be sent to the selected computer upon release of the channel change butt\
on. 
Do not hold down keys during a channel change.    
Smart card reader
Your AdderView Secure unit can be attached to an optional smart card rea\
der 
that allows you to insert your security card for authorization. The inst\
ructions 
given here are general advice and may differ for the model of card reade\
r fitted 
or be superseded by procedures stipulated within your organisation.
Note: The channel can be changed before or after inserting the smart car\
d. 
To	use	the	smart	card	reader
1 Align your smart card correctly with the reader slot.
2	 Press	the	required	channel	select	button	(if	the	required	channel	is	not	
already	selected).
3 Follow the on screen instructions issued by the selected computer.   
						

							



19


Further information
Troubleshooting
If you experience problems when installing or using the AdderView Secure\
 unit, 
please check through this section for a possible solution. If your probl\
em is not 
listed here and you cannot resolve the issue, then please refer to the ‘\
Getting 
assistance’ section.
No	video	from	computer
•	 This	is	most	likely	to	be	associated	with	a	mismatch	between	the	host	
computer’s video output and the DDC data held within the AdderView 
Secure. Computers often need read the correct DDC data before they will \
output a video signal.  
	 Depending	on	your	DDC	connection	policy	(see	Video display (EDID) 
information	for	details),	remember	that	the	AdderView	Secure	will	only	
attempt to read the DDC data from your monitor when the AdderView 
Secure is first powered on. To ensure that your monitor’s DDC data \
is read 
and stored correctly, ensure that it is attached and powered on when you\
 
switch on the AdderView Secure.
SECT 5
Summary of threats and solutions
This section provides a list of potential security threats that the Adde\
rView 
Secure might face during operation and the special steps that have been \
taken 
to counteract them. 
ThreatSolution
Microprocessor 
malfunction or 
unanticipated software 
bugs causing data to flow 
between ports.
Unidirectional data flow is enforced by 
hardware “data diodes” so data isolation 
doesn’t rely on software integrity.
Subversive snooping 
by means of detecting 
electromagnetic radiation 
emitted from the 
equipment.
Carefully shielded metal case with dual 
shielding in critical areas.
Detection of signals 
on one computer by 
monitoring for crosstalk 
(leakage)	signals	on	
another computer.
No connection to sensitive analogue inputs 
(such	as	computer	microphone	ports)	are	
provided. A very high level of crosstalk 
separation is provided between signals 
from different computers.
Malicious modification of 
microprocessor software 
causing data to leak 
between ports.
Data isolation is assured by hardware and so 
is not compromised by any changes to the 
microprocessor software. Microprocessors 
use one time programmable memory so 
flash upgrades are not possible. Case uses 
counter-sunk screws which can be protected 
by tamper-evident seals.
Buffered data within a 
keyboard or mouse is sent 
to the wrong computer 
after switchover. 
Keyboard and mouse are powered down 
and reset between each switchover to 
ensure that all buffers are cleared out.
Data leakage by means 
of monitoring conducted 
emissions on mains power.
The power circuitry provides strong 
protection against signal leakage via the 
power cable.