IT Shielding Strategies: The Zone Model
van Eck Phreaking | TEMPEST | BSI Zone Model by the German Federal Office for Information Security (BSI)
All electronic devices, especially video display terminals (VDTs), emit electromagnetic radiation. These so-called compromising emanations can be captured with suitable equipment, even across large distances (over 100 m), in order to eavesdrop on data transmissions. Most notably, an attacker could reconstruct the video signal and display it on a second screen. The video signal is very well suited for being displayed quickly, but other components and signals can also be emitted, thereby unintentionally broadcasting processed information. In addition to the radiant emanation, there is also compromising conducted electromagnetic interference such as power fluctuations. The German Federal Office for Information Security (BSI) recommends in its IT-Protection Catalogues to use protected computers (zone 1 according to the Zone Model) for sensitive areas.
Security Safeguard Options
Cryptography is useless as a security safeguard because in this case it is not an encrypted data stream of a network that is tapped into but the electromagnetic radiation emanating from a video display terminal, which by definition displays the relevant information in an unencrypted form for the user to see. Cryptography is not used in this application.
An effective, but at the same time highly expensive safeguard option is the complete shielding of a given workspace (based on the principle of Faraday’s cage), which would effectively shield against electromagnetic radiation. On the windows of such a workspace, transparent metal coating could be applied. As far as hardware is concerned, shielding strategies focus on shielding the components known to emit radiation such as graphic cards, cables, and monitors. For this reason, a central processing unit (CPU) is lined with a leakproof RF shield and cables are wrapped with foil shields and braided shields.
Low-emission or EMC/EMI-shielded devices may make van Eck phreaking more difficult. The emission level, however, should not be assessed based on such guidelines as the Swedish low-emission standard for VDTs (MPR II or TCO). The emission limits required for the TCO certification are set to avoid adverse health effects caused by EMF emissions from VDTs. This certification does not include any safeguards against compromising emanations.
For the military-related sector, the German Federal Office for Information Security (BSI)—based on the NATO TEMPEST standards on compromising emanations—has developed a German version (called the Zone Model) that features three main zones (the standards were renamed at the end of 2006; the designation of the former NATO standards is given in parentheses):
Zone 0 – NATO SDIP 27 Class A (AMSG 720B) Environment without special requirements
Zone 1 – NATO SDIP 27 Class B (AMSG 788) Environment with medium level of protection (equivalent to 20 m free-space loss)
Zone 2 – NATO SDIP 27 Class C (AMSG 784) Environment with high level of protection (equivalent to 100 m free-space loss)
With the exception of zone 0, the difference between zone 1 and 2 has to do mainly with the permissible limits for the specific power levels and specific bandwidths of the emanations. The exact limit values are classified information. Zone 0 equipment is also tested for information-carrying peak signals that are eliminated based on correlation.
In order to comply with these standards, one can request from the BSI the contact details for an accredited testing laboratory, which would run the required tests on the relevant hardware and, if desired, would also execute modifications accordingly. Testing according to the NATO standards is also available for the civil and commercial sector. At the present time, the BSI notes active testing in this market.
Low-pass filters can be equally effective for safeguarding analogue controls, even though to some extent they cause a considerable loss in quality as far as the recognition of details is concerned. Especially the display of text on a screen, which mostly consists of RF frequency components, can be made much more difficult to retrieve for eavesdroppers through the use of low-pass filters. The disadvantage for the user of the VDT, however, is that the low-pass filter causes especially the display of texts to appear blurry and thus is hard on the eyes. This strategy, therefore, is not suitable for permanent use at a workstation. Furthermore, it would only protect the video signal from transmitting compromising emanations. For analogue display terminals, the use of TEMPEST-proof fonts is a simple-toimplement safeguard. The characters of these special fonts are surrounded by contours with specifically adjusted colour gradients. The displayed result is similar to a two-dimensional low-pass filtering, and in some cases also lets the display of texts appear blurry. This safeguard, of course, is obsolete in digital displays because the digitised pixel data can again generate the signal. DVI-D displays operate with a different type of signal transmission (bit coding); it generates a bit pattern for each colour hue, including black and white. The latter fonts may even worsen the problem when the colour gradients of the displayed colours use a bit pattern that differs significantly from the bit pattern of the background colour across the spectrum under detection. The level of brightness and colour hue do not allow any identification of the bit code.
Power line filters and harmonic filters protect against compromising conducted electromagnetic interference. Another option is jammers. Jammers are designed in such a way that they transmit at a frequency (or frequency band) that coincides with that of the display terminal, but with a much higher amplitude. Because the Telecommunications Act specifies restrictions regarding maximum permissible power output levels, jammers may have to be operated at lower intensities and this, in turn, would provide eavesdroppers with a potential avenue that could allow them to filter or calculate out the desired signal. In this case, it is desirable to tie the jammer and the frequencies emitted by the display terminal together by using the RGB signals of the display terminal to modulate the jammer. Alternatively, the jammer could also be modulated with white noise so that a broadspectrum interference signal is generated.