| Classification and characteristics of technical channels for leakage of information processed by TSPI and transmitted via communication channels
Anatoly Anatolyevich Khorev, Candidate of Military Sciences Classification and characteristics of technical channels for leakage of information processed by TSPI and transmitted via communication channels The article is reprinted from the journal «Special Equipment» No. 2, 1998. Under technical means of receiving, processing, storing and transmitting information (TSPI)understand technical means that directly process confidential information. Such means include: electronic computing equipment, secure automatic telephone exchanges, operational command and loudspeaker communication systems, sound amplification systems, sound accompaniment and sound recording systems, etc. When identifying technical channels of information leakage, TSPI must be considered as a system that includes the main (stationary) equipment, terminal devices, connecting lines (a set of wires and cables laid between individual TSPI and their elements), distribution and switching devices, power supply systems, grounding systems. Individual technical means or a group of technical means intended for processing confidential information, together with the premises in which they are located, constitute a technical means object. Technical means objects also include designated premises intended for holding closed events. Along with the TSPI, technical means and systems are installed in the premises that are not directly involved in the processing of confidential information, but are used together with the TSPI and are located in the zone of the electromagnetic field created by them. Such technical means and systems are called auxiliary technical means and systems (ATMS). These include: technical means of open telephone, loudspeaker communication, fire and security alarm systems, electrification, radio, clock, household appliances, etc. As a channel for information leakage, ATMS that go beyond the controlled zone (CZ) are of greatest interest., i.e. zones in which the appearance of persons and vehicles without permanent or temporary passes is excluded In addition to the connecting lines of the TSPI and VTSS, wires and cables that are not related to them, but pass through rooms where technical equipment is installed, as well as metal pipes of heating systems, water supply systems and other conductive metal structures, may go beyond the controlled zone. Such wires, cables and conductive elements are called extraneous conductors. Depending on the physical nature of the origin of information signals, as well as the environment of their propagation and methods of interception, technical information leakage channels can be divided into electromagnetic, electrical and parametric. Electromagnetic information leakage channels Electromagnetic information leakage channels are those that arise due to various types of side electromagnetic radiation (EMR) of the TSPI:
Electromagnetic radiation of TSPI elements.In the TSPI, the information carrier is an electric current, the parameters of which (current strength, voltage, frequency and phase) change according to the law of the information signal. When an electric current passes through the current-carrying elements of the TSPI, an electric and magnetic field arises around them (in the surrounding space). Due to this, the elements of the TSPI can be considered as emitters of an electromagnetic field modulated according to the law of change in the information signal. Electromagnetic radiation at the operating frequencies of the HF generators of the TSPI and VTSS. The TSPI and VTSS may include various types of high-frequency generators. Such devices include: master oscillators, clock frequency generators, erasure and magnetization generators of tape recorders, heterodynes of radio and television receivers, generators of measuring instruments, etc. As a result of external influences of the information signal (for example, electromagnetic oscillations), electrical signals are induced on the elements of the high-frequency generators. The receiver of the magnetic field can be the inductance coils of the oscillatory circuits, chokes in the power supply circuits, etc. The receiver of the electric field are the wires of the high-frequency circuits and other elements. The induced electrical signals can cause unintentional modulation of the generators' own high-frequency oscillations. These modulated high-frequency oscillations are emitted into the surrounding space. Electromagnetic radiation at the frequencies of self-excitation of the ULF TSPI. Self-excitation of the low-frequency amplifiers of the TSPI (for example, amplifiers of sound reinforcement and sound accompaniment systems, tape recorders, public address systems, etc.) is possible due to random transformations of negative feedback (inductive or capacitive) into parasitic positive feedback, which leads to the amplifier switching from the amplification mode to the signal self-generation mode. The self-excitation frequency lies within the operating frequencies of the nonlinear elements of the low-frequency amplifier (for example, semiconductor devices, vacuum tubes, etc.). The signal at the self-excitation frequencies, as a rule, turns out to be a modulated information signal. Self-excitation is observed mainly when the low-frequency amplifier is switched to a nonlinear operating mode, i.e. to an overload mode. The interception of secondary electromagnetic emissions of the TSPI is carried out by means of radio and radio-technical reconnaissance located outside the controlled zone. The zone in which it is possible to intercept (with the help of a reconnaissance receiver) secondary electromagnetic emissions and subsequent decoding of the information contained in them (i.e. the zone within which the ratio «information signal/interference» exceeds the permissible standard value) is called (dangerous) zone 2. Electric channels of information leakage The causes of electrical information leakage channels may be:
Interference of electromagnetic radiation from the TSPIarise when elements of the TSPI (including their connecting lines) emit information signals, as well as in the presence of galvanic coupling of the TSPI connecting lines and extraneous conductors or VTSS lines. The level of induced signals depends to a large extent on the power of the emitted signals, the distance to the conductors, and the length of the joint run of the TSPI connecting lines and extraneous conductors. The space around the TSPI, within which the information signal above the permissible (standardized) level is induced on random antennas, is called (dangerous) zone 1. A random antenna is a VTSS circuit or extraneous conductors capable of receiving side electromagnetic radiation. Random antennas can be concentrated and distributed. A concentrated random antenna is a compact technical device, such as a telephone, a loudspeaker of a radio broadcasting network, etc. To distributed random antennasinclude random antennas with distributed parameters: cables, wires, metal pipes and other conductive communications. Leakage of information signals into power supply circuitspossible in the presence of a magnetic coupling between the output transformer of the amplifier (for example, the low-frequency power amplifier) and the transformer of the rectifier. In addition, the currents of the amplified information signals are closed through the power supply, creating a voltage drop on its internal resistance, which, if there is insufficient attenuation in the filter of the rectifier, can be detected in the power supply line. The information signal can also penetrate into the power supply circuits as a result of the fact that the average value of the consumed current in the final stages of the amplifiers depends to a greater or lesser extent on the amplitude of the information signal, which creates an uneven load on the rectifier and leads to a change in the consumed current according to the law of change in the information signal. Leakage of information signals into ground circuits.In addition to the grounding conductors used to directly connect the TSPI to the grounding circuit, various conductors extending beyond the controlled area may have a galvanic connection to the ground. These include the neutral wire of the power supply network, screens (metal sheaths) of connecting cables, metal pipes of heating and water supply systems, metal reinforcement of reinforced concrete structures, etc. All these conductors, together with the grounding device, form a branched grounding system to which information signals can be induced. In addition, an electromagnetic field arises in the soil around the grounding device, which is also a source of information. Interception of information signals via electrical leakage channels is possible by direct connection to the VTSS connecting lines and external conductors passing through the premises where the TSPI are installed, as well as to their power supply and grounding systems. For these purposes, special means of radio and radio-technical reconnaissance, as well as special measuring equipment, are used. Removal of information using hardware bugs. In recent years, there have been more frequent cases of removal of information processed in the TSPI by installing electronic devices for intercepting information in them — bugs. Electronic devices for intercepting information installed in TSPI are sometimes called hardware bugs. They are mini-transmitters whose radiation is modulated by an information signal. Most often, bugs are installed in TSPI of foreign manufacture, but they can also be installed in domestic facilities. The information intercepted with the help of bugs is either directly transmitted via a radio channel, or first recorded on a special storage device, and then, upon command, transmitted to the object that requested it. Parametric channel of information leakage Interception of information processed in technical means is also possible by their “high-frequency irradiation”. When the irradiating electromagnetic field interacts with the elements of the TSPI, the electromagnetic field is re-radiated. In some cases, this secondary radiation is modulated by the information signal. When reading information, to eliminate the mutual influence of the irradiating and re-radiated signals, their time or frequency decoupling can be used. For example, pulsed signals can be used to irradiate the TSPI. When re-radiated, the signal parameters change. Therefore, this information leakage channel is often called parametric. To intercept information via this channel, special high-frequency generators with antennas that have narrow directional patterns and special radio receiving devices are required. Information after processing in the TSPI can be transmitted via communication channels, where it can also be intercepted. Currently, HF, VHF, radio relay, tropospheric and space communication channels, as well as cable and fiber-optic communication lines are mainly used to transmit information. Depending on the type of communication channels, technical channels for intercepting information can be divided into electromagnetic, electrical and inductive. High-frequency electromagnetic radiation from communication transmitters, modulated by an information signal, can be intercepted by portable radio reconnaissance equipment and, if necessary, transmitted to the processing center for decoding. This channel for intercepting information is most widely used for listening to telephone conversations conducted via radio telephones, cellular telephones, or via radio relay and satellite communication lines. The electrical channel for intercepting information transmitted via cable communication lines involves contact connection of reconnaissance equipment to cable communication lines. The simplest method is a direct parallel connection to the communication line. But this fact is easily detected, since it leads to a change in the characteristics of the communication line due to a drop in voltage. Therefore, reconnaissance equipment is connected to the communication line either through a matching device, which somewhat reduces the voltage drop, or through special devices for compensating for the voltage drop. In the latter case, the reconnaissance equipment and the device for compensating for the voltage drop are connected to the communication line in series, which significantly complicates the detection of an unauthorized connection to it. The contact method is used mainly to remove information from coaxial and low-frequency communication cables. For cables in which increased air pressure is maintained, devices are used that prevent its decrease, as a result of which the special alarm is prevented. The electric channel is most often used to intercept telephone conversations. In this case, the intercepted information can be directly recorded on a dictaphone or transmitted via a radio channel to a receiving point for its recording and analysis. Devices connected to telephone communication lines and integrated with devices for transmitting information via a radio channel are often called telephone bugs. In case of using signal devices for monitoring the integrity of the communication line, its active and reactive resistance, the fact of contact connection of reconnaissance equipment to it will be detected. Therefore, special services most often use an inductive channel for intercepting information, which does not require contact connection to communication channels. This channel uses the effect of the occurrence of an electromagnetic field around the communication cable when information electrical signals pass through it, which are intercepted by special inductive sensors. Inductive sensors are used mainly for reading information from symmetrical high-frequency cables. Signals from sensors are amplified, frequency division of channels is carried out, and information transmitted through separate channels is recorded on a tape recorder or a high-frequency signal is recorded on a special tape recorder. Modern inductive sensors are capable of reading information from cables protected not only by insulation, but also by double armor made of steel tape and steel wire tightly wrapped around the cable. For contactless retrieval of information from unprotected telephone lines, special low-frequency amplifiers equipped with magnetic antennas can be used. Some means of contactless retrieval of information transmitted via communication channels can be combined with radio transmitters for retransmission to the processing center. |