Communications Technology
Preserving information security at data centres
John Parsons of MPE Ltd talks about the dangers of leaking confidential data from data centres and how MPE’s TEMPEST filters can help prevent it
John Parsons T
he TEMPEST threat to information security was first recognised by the US National Security Agency (NSA) and GCHQ in the 1960s. Governments, armed forces, municipal authorities and companies now share this concern that electrical and electronic equipment such as computers and peripherals give off unintended electromagnetic emanations which can then be reconstructed beyond the building boundary as intelligible data. Countermeasures are aimed at
preventing eavesdropping on data radiated as signals via conducting lines such as power, telephone or control line cables. The evidence is that TEMPEST countermeasures are becoming as important for information security in the civilian world as in the military arena. Examples of sites at risk would be Western embassies in hostile parts of the world, and data centres handling sensitive personal and financial information, where power line cables are vulnerable to electronic eavesdropping. Confidential data – or devices containing or processing such data – are usually referred to as “red”. This implies merely that you don’t want the data to escape. Conversely, non-confidential data and equipment are termed “black”. Sensitive or classified data that has been suitably encrypted is also regarded as black. A device processing red data, yet incorporating adequate protection to contain emissions, can be black too. Meanwhile a cable carrying black data that passes close to red equipment, and thus has the potential to pick up red data, can be considered red. Where a cable has to pass through a
red/black boundary, a filter can be inserted as an intended countermeasure to filter out all frequencies except the desired signal. It is normally a low-pass filter that blocks everything above a given frequency, on the basis that any parasitic red signal is likely to be of high frequency. This solution has obvious limitations, since any parasitic signals within the passband will still get through, and a low- pass filter cannot be used if the desired signal is itself of high frequency. A proper TEMPEST-grade filter must also prevent bypass coupling, where a radiated red signal bypasses the filter and couples onto the black side.
Paul Currie, the sales and marketing director of MPE, explains: “High-speed
250V AC, 50/60Hz, 16A MPE TEMPEST power line filter for information security at data centres
28 December 2016/January 2017
information-bearing signals are the ones
Components in Electronics Typical 5A to 100A MPE TEMPEST power line filters for data centres
most likely to couple onto the low impedance, copper power cables trailing through a data centre, and then be most vulnerable to interception beyond the building boundary. Accordingly, to be effective, the electrical filters designed for TEMPEST anti-eavesdropping applications have to perform across the full frequency spectrum to Super High Frequency (SHF) (3GHz to 30GHz), and above. “MPE filters with incorporated
feedthrough suppression capacitors do just that. Commercial grade equipment filters, employing two-terminal capacitors and designed for suppression of EMI up to typically 30MHz, will fall into resonance well before the SHF band, and are therefore unsuitable for TEMPEST uses.” MPE offers a comprehensive range of TEMPEST power line filters of alternative performance specifications. These extend from 6A to 16A filters, which might be used to treat individual power inlets, up to 2400A filters for the hardening of a main building power supply. When specifying filters, data centre managers must also take into account the electrical loading that TEMPEST filters will impose on their power supplies. TEMPEST hardening comes at a cost – filters cause leakage currents and power dissipation, and take up space. On the plus side, the installation of TEMPEST filters supports the protection of equipment within the protected area from incoming mains-borne EMI and transients, which could otherwise pass unimpeded and cause damage and disruption to susceptible pieces of equipment. The TEMPEST filters will also contribute to the attenuation of secondary lightning effects not suppressed by primary building lightning protection devices.
When electrical filters can combine the multiple benefits of TEMPEST hardening, EMI suppression and transient attenuation, this is known as “integrated hardening”. Now a critical consideration of any data
centre manager is that installed TEMPEST filters will be reliable over time. The
undiminished long-term performance of installed filters becomes highly significant when most cannot be accessed easily to survey or replace – having been installed deep within building infrastructure. So, having been originally designed to support mission-critical military applications, MPE’s EMI, EMP and TEMPEST filters apply the most liberal design margins to ensure maximum in-service reliability. MPE has also long supplied TEMPEST products which adhere to the onerous specifications of CESG (the Communications Electronics Security Group at GCHQ) and of the US NSA and more recently NATO SDIP-27 Standards. Filters contain reactive and resistive elements which are all at risk of in-service failure. Although the electrical supply may be expected to be fused to cope with the possibility of a filter failing from a short circuit, it is the prospective loss of service that is of most concern to the data centre manager. The filter component at greatest risk of in-service failure is the capacitor. However, filters such as MPE’s incorporating capacitors manufactured from self-healing, high-reliability, metallised plastic film would generally be expected to be fully reliable for the intended lifetime of an installation. MPE manufactures power line filters which support the highest level of TEMPEST hardening, providing low insertion loss performance (dB against frequency in Hz) across the whole spectrum from Very Low Frequency (VLF) to above SHF. Hence the performance of MPE filters comfortably exceeds the industry benchmarks for mains supply applications, which can b as high as 100dB in a frequency range across 10kHz to 10GHz. Housed in electroplated steel cases, TEMPEST filters from MPE are of compact size for easy, flexible, bulkhead or chassis mounting into the rack systems of data centres, and include product options where low earth leakage is critical.
www.mpe.co.uk www.cieonline.co.uk
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56 |
Page 57 |
Page 58 |
Page 59 |
Page 60
