Methods and means of protecting telephone sets and telephone lines.

Methods and means of protecting telephone sets and telephone lines.

Khorev Anatoly Anatolyevich
Methods and means of protecting telephone sets and telephone lines

Source: magazine «Special Equipment»

When protecting telephone sets and telephone lines, several aspects must be taken into account:

• telephones (even when the receiver is hung up) can be used to intercept acoustic speech information from the premises in which they are installed, that is, to eavesdrop on conversations in these premises;
• telephone lines passing through premises can be used as power sources for acoustic bugs installed in these premises, as well as for transmitting intercepted information;
• and, of course, it is possible to intercept (eavesdrop) on telephone conversations by means of a galvanic or inductive sensor connection to the telephone line of bugs (telephone repeaters), dictaphones and other means of unauthorized information retrieval.

The telephone set has several elements that have the ability to convert acoustic vibrations into electrical ones, i.e., have a «microphone effect». These include: the bell circuit, the telephone and, of course, the microphone capsules. Due to electroacoustic transformations in these elements, information (dangerous) signals arise.

When the receiver is hung up, the telephone and microphone capsules are galvanically disconnected from the telephone line, and when special highly sensitive low-frequency amplifiers are connected to it, it is possible to intercept dangerous signals arising in the elements of only the bell circuit. The amplitude of these dangerous signals, as a rule, does not exceed fractions of a mV.

When using the «high-frequency interference» method to retrieve information, despite the galvanic disconnection of the microphone from the telephone line, the interference signal, due to its high frequency, passes into the microphone circuit and is amplitude-modulated by the information signal.

Therefore, both the ringing circuit and the microphone circuit must be protected in the telephone set.

To protect a telephone from leakage of acoustic (speech) information via an electroacoustic channel, both passive and active methods and means are used.

The most widely used passive methods of protection include [12]:

• limitation of dangerous signals;
• filtration of dangerous signals;
• disabling sources (converters) of dangerous signals.

Possibility of limitation of dangerous signalsis based on the nonlinear properties of semiconductor elements, mainly diodes [12]. The circuit of the small-amplitude limiter uses two back-to-back diodes with a volt-ampere characteristic (the dependence of the value of the electric current flowing through the diode on the voltage applied to it) shown in Fig. 1, a [12]. Such diodes have high resistance (hundreds of kOhm) for low-amplitude currents and units of Ohm or less — for high-amplitude currents (useful signals), which eliminates the passage of dangerous low-amplitude signals into the telephone line and has virtually no effect on the passage of useful signals through the diodes [12].

Diode limiters are connected in series to the call line (see Fig. 1 b) or directly to each of the telephone lines (see Fig. 2) [2, 3, 5, 12].

Filtering of dangerous signals is used mainly to protect telephone sets from «high-frequency interference».

The simplest filter is a capacitor installed in the ringing circuit of telephone sets with an electromechanical bell and in the microphone circuit of all sets (see Fig. 1, b and c) [2, 3, 5, 12]. The capacitor capacity is selected to shunt the high-frequency probing signals and not to have a significant effect on the useful signals. Usually, capacitors with a capacity of 1 μF are used for installation in the ringing circuit, and 0.01 μF for installation in the microphone circuit [3]. A more complex filtering device is a multi-link low-pass filter on LC elements.

To protect telephone sets, devices that combine a filter and a limiter are usually used. These include: devices of the type «Ekran», «Granit-8», «Korund», «Gran-300». etc. (see Fig. 2) [3].

Disconnecting telephones from the line when conducting confidential conversations indoors is the most effective method of protecting information.

The simplest way to implement this protection method is to install a special switch in the telephone case or telephone line, which is turned on and off manually. More convenient to use is to install a special protection device in the telephone line, which automatically (without operator intervention) disconnects the telephone from the line when the handset is hung up.

A typical device implementing this protection method is the «Barrier-M1» product. It includes [13]:

• an electronic switchboard;

• a circuit for analyzing the state of the telephone set, the presence of ringing signals and controlling the switchboard;

• circuit for protecting a telephone set from exposure to high-voltage impulses.

The device has the following operating modes: standby mode, call signal transmission mode, and operating mode.

In standby mode (with the telephone receiver on) the telephone set is disconnected from the line, and the device is in the mode of analyzing the lifting of the telephone receiver and the presence of call signals. In this case, the isolation resistance between the telephone set and the PBX line is at least 20 MOhm [13]. The voltage at the device output in standby reception is 5 — 7 V [13].

When receiving call signals, the device switches to the call signal transmission mode, in which the telephone set is connected to the line via an electronic switch. The connection is made only for the duration of the call signals.

When the telephone handset is lifted, the device switches to the operating mode and the telephone is connected to the line. The device switches from standby to operating mode when the current in the telephone line is at least 5 mA [13].

The product is installed in a break in the telephone line, as a rule, when it exits the designated (protected) room or in a distribution board (cross) located within the controlled zone.

The device is powered from a telephone line with a standby current consumption of no more than 0.3 mA [13].

The «Barrier» M1 device provides protection for the telephone not only from information leakage via the electro-acoustic channel, but also from the effects of high-voltage pulses (up to 1000 V and up to 100 μs in duration) [13].

Active methods of protection against information leakage via an electroacoustic channel involve linear noise suppression of telephone lines. The noise signal is fed into the line when the telephone is not in use (the receiver is hung up). When the telephone receiver is picked up, the noise signal is stopped from being fed into the line.

Certified linear noise suppression devices include MP-1A (protection of analog telephone sets) and MP-1Ts P-1A (protection of digital telephone sets), etc. [9].

In order to protect acoustic (voice) information in designated areas, along with protecting telephone sets, it is necessary to take measures to protect telephone lines directly, since they can be used as power sources for acoustic bugs installed in areas, as well as for transmitting information received by these bugs.

In this case, both passive and active methods and means of protection are used. Passive methods of protection are based on blocking acoustic bugs powered by the telephone line in the on-hook mode, and active methods are based on linear noise pollution of lines and destruction (electrical «burning») of bugs or their power supplies by feeding high-voltage pulses into the line.

Protection of information transmitted via communication channels can be implemented at the semantic and energy levels. At the semantic level, information protection is achieved by using cryptographic methods and means of protection and is aimed at preventing its receipt (isolation), even if the enemy (intruder) intercepts information signals. Information protection methods at the energy level are aimed at preventing (hindering) the enemy (intruder) from receiving information signals directly. That is, these methods are aimed at reducing the signal/noise ratio to values ​​that ensure the impossibility of isolating the information signal by reconnaissance means (unauthorized information retrieval means).

In this article we will consider only methods of protecting information at the energy level. Telephone conversations are protected by both active and passive methods.

The main active methods include [1 … 14]:

• feeding a low-frequency (voice range) in-phase masking signal into the telephone line during a conversation (the low-frequency in-phase masking interference method);
• feeding a high-frequency audio range masking signal into the telephone line during a conversation (the high-frequency masking interference method);
• feeding a masking high-frequency ultrasonic signal into a telephone line during a conversation (ultrasonic masking interference method);
• raising the voltage in a telephone line during a conversation (voltage boost method);
• feeding a voltage into the line during a conversation that compensates for the constant component of the telephone signal (zeroing method);
• feeding a masking low-frequency (voice range) signal into the line when the telephone receiver is hung up (low-frequency masking interference method);
• feeding a masking low-frequency (voice range) signal with a known spectrum into the line when receiving messages (compensation method);
• feeding high-voltage pulses into the telephone line (the «burning» method).

The essence of the in-phase masking low-frequency (LF) signal methodconsists of feeding into each wire of the telephone line using a single grounding system of the telephone exchange equipment and the neutral wire of the 220 V power grid (the neutral wire of the power grid is grounded) masking signals of the speech frequency range, coordinated in amplitude and phase (as a rule, the main interference power is concentrated in the frequency range of the standard telephone channel: 300 — 3400 Hz) [14]. In the telephone set, these interference signals compensate each other and do not interfere with the useful signal (telephone conversation). If the information is removed from one wire of the telephone line, the interference signal is not compensated. And since its level significantly exceeds the useful signal, interception of information (isolation of the useful signal) becomes impossible.

Discrete signals (pseudo-random pulse sequences) of the speech frequency range are usually used as a masking interference signal [14].

The method of common-mode masking low-frequency signal is used to suppress telephone radio bugs (both with parametric and quartz frequency stabilization) with serial (in the break of one of the wires) inclusion, as well as telephone radio bugs and dictaphones with connection to the line (to one of the wires) using inductive sensors of various types.

Method of high-frequency masking interferenceconsists of feeding a broadband masking signal into the telephone line during a conversation in the range of higher frequencies of the audio range (that is, in the range above the frequencies of the standard telephone channel) [4, 6, 8].

This method is used to suppress almost all types of eavesdropping devices, both contact (parallel and serial) connection to the line, and connection using inductive sensors. However, the efficiency of suppression of means of information removal with connection to the line using inductive sensors (especially those without preamplifiers) is significantly lower than that of means with galvanic connection to the line.

Broadband analog signals of the «white noise» type or discrete signals of the pseudo-random pulse sequence type [4, 8, 12, 14] are used as a masking signal.

The frequencies of the masking signals are selected in such a way that after passing through the selective circuits of the bug modulator or the microphone amplifier of the dictaphone, their level is sufficient to suppress the useful signal (the speech signal in the telephone line during the subscribers' conversations), but at the same time these signals do not degrade the quality of telephone conversations. The lower the frequency of the interference signal, the higher its efficiency and the greater the interfering effect it has on the useful signal. Frequencies in the range from 6 — 8 kHz to 16 — 20 kHz are usually used. For example, in the Sel SP-17/T device, interference is created in the range of 8 — 10 kHz [11].

Such masking interference causes a significant decrease in the signal-to-noise ratio and distortion of useful signals (deterioration in speech intelligibility) when intercepted by all types of eavesdropping devices (see Fig. 3 and 4) [8, 11]. In addition, radio bugs with parametric frequency stabilization (a «soft» channel) of both serial and parallel connection exhibit a «drifting» of the carrier frequency, which can lead to loss of the receiving channel [8].

To eliminate the impact of a masking interference signal on a telephone conversation, a special low-pass filter with a cutoff frequency of 3.4 kHz is installed in the protection device, suppressing (shunting) interference signals and not having a significant effect on the passage of useful signals. A similar role is played by bandpass filters installed on city telephone exchanges, passing signals whose frequencies correspond to a standard telephone channel (300 Hz — 3.4 kHz), and suppressing the interference signal.

Method ultrasonic masking interference is basically similar to the one discussed above. The difference is that interference signals of the ultrasonic range with frequencies from 20 — 25 kHz to 50 — 100 kHz are used [14].

The voltage increase method consists of increase in voltage in the telephone line during a conversation and is used to degrade the performance of telephone radio bugs [8]. Increasing the voltage in the line to 18-24 V causes a «drifting» of the carrier frequency and a deterioration in speech intelligibility due to the blurring of the signal spectrum in radio bugs with a serial connection and parametric frequency stabilization [8]. In radio bugs with a serial connection and quartz frequency stabilization, a decrease in the signal-to-noise ratio of 3-10 dB is observed. Telephone radio bugs with a parallel connection simply turn off at such voltages in some cases.

The «zeroing» methodprovides for the supply of a constant voltage to the line during a conversation, corresponding to the voltage in the line when the telephone handset is lifted, but with reverse polarity [14].

This method is used to disrupt the operation of eavesdropping devices with a contact parallel connection to the line and using it as a power source. Such devices include: parallel telephone sets, wired microphone systems with electret microphones using the telephone line to transmit information, acoustic and telephone bugs powered by the telephone line, etc.

Low-frequency masking interference methodconsists of feeding a masking signal (most often, like «white noise») of the speech frequency range (as a rule, the main power of the interference is concentrated in the frequency range of a standard telephone channel: 300 — 3400 Hz) into the line when the telephone receiver is put down and is used to suppress wired microphone systems that use the telephone line to transmit information at a low frequency, as well as to activate (switch on for recording) dictaphones connected to the telephone line using adapters or inductive sensors, which leads to the rewinding of the film in the noise recording mode (that is, in the absence of a useful signal) [8].

Compensation method is used for one-way masking (hiding) of voice messages transmitted to the subscriber via a telephone line, and is highly effective in suppressing all known means of unauthorized information retrieval [1].

The essence of the method is as follows [1]: when transmitting a hidden message, a masking noise (a digital or analog masking signal of the speech range with a known spectrum) is fed to the telephone line at the receiving end using a special generator. At the same time, the same masking signal («clean» noise) is fed to one of the inputs of a two-channel adaptive filter, the other input of which receives an additive mixture of the received useful signal of the speech signal (the transmitted message) and the same interference signal. The additive filter compensates (suppresses) the noise component and isolates the useful signal, which is fed to the telephone or sound recording device.

The disadvantage of this method is that the masking of voice messages is one-sided and does not allow two-way telephone conversations.

The «burning» method is implemented by feeding high-voltage (over 1500 V) pulses into the line, leading to electrical «burning» of the input stages of electronic information interception devices and their power supplies, galvanically connected to the telephone line [10, 11].

When using this method, the telephone set is disconnected from the line. Pulses are sent to the line twice. The first (for «burning» parallel-connected devices) is when the telephone line is open, the second (for «burning» series-connected devices) is when the telephone line is short-circuited (usually in the central distribution board of the building).

To protect telephone lines, both simple devices implementing one protection method and complex devices providing comprehensive protection of lines using various methods, including protection against information leakage via an electroacoustic channel, are used.

There is a wide variety of protective equipment on the domestic market. Among them, the following can be distinguished: «SP 17/T», «SI-2001», «KTL-3», «KTL-400», «Kom-3», «Kzot-06», «Cicada-M», «Procrustes» (PTZ-003), «Procrustes-2000», «Consul», «Grom-ZI-6», «Proton». and others. The main characteristics of some of them are given in Table 1, efficiency — in Table 2, and appearance — in Fig. 5 [4, 6, 8, 10, 11, 14].

In active telephone line protection devices, the most frequently implemented method is high-frequency masking interference (SP 17/T, KTL-3, KTL-400, Kom-3, Procrustes (PTZ-003), Procrustes-2000, Grom-ZI-6, Proton, etc.) and ultrasonic masking interference (Procrustes (PTZ-003), Grom-ZI-6).

The method of common-mode low-frequency masking interference is used in the «Cicada-M» device, and the method of low-frequency masking interference is used in the «Procrustes», «Proton», «Kzot-06» devices, etc.

The «zeroing» method is used, for example, in the «Cicada-M» device, and the method of increasing the voltage in the line is used in the «Procrustes» device.

The compensating method of masking voice messages transmitted to the subscriber via a telephone line is implemented in the product «Tuman».

Most protection devices automatically measure the voltage in the line and display its value on a digital indicator. In the device «Grom-ZI-6» the level of voltage reduction in the line is displayed on the digital indicator.

Telephone line protection devices are relatively small in size and weight (for example, the Procrustes product weighs 1 kg [8] with dimensions of 62• 155• 195 mm). They are usually powered by a 220 V AC network. However, some devices (for example, Kzot-06) are powered by autonomous power sources.

To disable (burn out) input stages) unauthorized data retrieval devices with galvanic connection to a telephone line, devices of the PTL-1500, KS-1300, KS-1303, Cobra (see Fig. 6) type are used. Their main characteristics are given in Table 3 [10, 11].

The devices use high-voltage pulses with a voltage of at least 1500 — 1600 V. The power of the «burn out» pulses is 15 — 50 VA. Since the bookmark circuits use miniature low-voltage components, high-voltage pulses break them down and the bookmark circuit is put out of order.

«Telephone bug burners» can operate in both manual and automatic modes. The continuous operation time in automatic mode is from 20 seconds to 24 hours.

The «KS-1300» device is equipped with a special timer, which allows, when operating in automatic mode, to set the time interval for sending pulses to the line within the range from 10 minutes to 2 days [11].

Along with active protection tools, various devices are widely used in practice to monitor certain parameters of telephone lines and establish the fact of unauthorized connection to them.

Methods of monitoring telephone linesare mainly based on the fact that any connection to them causes a change in the electrical parameters of the lines: the amplitudes of voltage and current in the line, as well as the values ​​of capacitance, inductance, active and reactive resistance of the line [4, 5, 9, 10, 12]. Depending on the method of connecting the embedded device to the telephone line (serial, in a break in one of the wires of the telephone cable, or parallel), the degree of its influence on the change in the parameters of the line will be different.

With the exception of particularly important facilities, communication lines are built according to a standard model. The line is introduced into the building by a trunk multi-pair (multi-core) telephone cable to the internal distribution board. Then, from the board to each subscriber, wiring is carried out using a two-wire telephone cable of the TRP or TRV brand. This scheme is typical for residential and small administrative buildings of sizes. For large administrative buildings, internal wiring is done with a set of trunk cables to special distribution blocks, from which, for short distances (up to 20 — 30 m), wiring is also carried out using a TRP or TRV cable [7].

In static mode, any two-wire line is characterized by a wave impedance, which is determined by the linear capacitance (pF/m) and inductance (H/m) of the line. The wave impedance of the main cable is within 130 — 160 Ohm for each pair, and for TRP and TRV brand wires it has a spread of 220 — 320 Ohm [7].

Connecting data collection devices to the trunk cable (both external and internal) is unlikely. The most vulnerable connection points are: the input distribution board, internal distribution blocks and open sections of the TRP wire, as well as telephone sockets and devices. The presence of modern internal mini-PBX does not affect this situation.

The main parameters of radio bugs connected to a telephone line are as follows. For bugs with parallel connection, the important parameters are the input capacitance, the range of which can vary from 20 to 1000 pF or more, and the input resistance, the value of which is hundreds of kOhm [7]. For bugs with series connection, the main parameter is the input resistance, which can be from hundreds of Ohms to several Mohms.

Telephone adapters with an external power source, galvanically connected to the line, have a high input resistance of up to several Mohms (in some cases, more than 100 Mohms) and a fairly small input capacitance [7].

Of great importance are the energy characteristics of the means of information collection, namely the current consumption and the voltage drop in the line.

The most informative and easily measurable parameter of a telephone line is the voltage in it with the telephone receiver in place and lifted. This is due to the fact that when the telephone receiver is hung up, a constant voltage of 60-64 V (for domestic PBXs) or 25-36 V (for imported mini-PBXs, depending on the model) is supplied to the line. When the handset is lifted, a signal is sent to the line from the PBX, which is converted into a long beep in the telephone receiver, and the voltage in the line decreases to 10-12 V [7, 8].

If a bug is connected to the line, these parameters will change (the voltage will differ from the typical voltage for this telephone set).

Table 4 shows experimentally obtained values ​​of the voltage drop on the line for some telephone bugs [8].

However, the voltage drop in the line (with the receiver on and off) does not give a clear answer — whether a bug is installed in the line or not, since voltage fluctuations in the telephone line can occur due to its poor quality (as a result of changes in the state of the atmosphere, time of year, or precipitation, etc.). Therefore, to determine the fact of connection of a bug to the line, it is necessary to constantly monitor its parameters.

When a bug is connected to a telephone line, the amount of current consumed also changes.(when the telephone receiver is lifted). The amount of power taken from the line depends on the transmitter power of the bug and its efficiency.

When connecting a radio bug in parallel, the consumed current (when the telephone receiver is lifted) usually does not exceed 2.5 — 3.0 mA [7].

When connecting to the line of a telephone adapter with an external power source and high input resistance, the current consumed from the line is insignificant (20 — 40 μA) [7].

Combined radio bugs with autonomous power sources and parallel connection to the line have low input resistance (several kOhm) and practically do not consume energy from the telephone line, but significantly increase its capacity.

By measuring the current in the line when the telephone handset is removed and comparing it with the standard, it is possible to detect the fact of connecting embedded devices with a current consumption of more than 500 — 800 μA [7].

The detection of embedded devices with low current consumption from the line by technical means of control is limited by the inherent noise of the line, caused by the instability of both static and dynamic parameters of the line. The instability of dynamic parameters primarily includes fluctuations in the leakage current in the line, the value of which reaches 150 μA [7].

The simplest device for monitoring telephone lines is a voltage meter. When setting up, the operator records the voltage value corresponding to the normal state of the line (when no extraneous devices are connected to the line) and the alarm threshold. When the voltage in the line decreases more than the set threshold, the device emits a light or sound alarm signal.

Devices that signal a disconnection of a telephone line, which occurs when a bug is connected in series, are also built on the principles of measuring line voltage.

As a rule, such devices also contain filters to protect against eavesdropping due to the «microphone effect» in the elements of the telephone set and high-frequency «imposition».

Telephone line monitoring devices built on the principle discussed above react to voltage changes caused not only by connecting data collection devices to the line, but also by voltage fluctuations at the telephone exchange (which is quite common for domestic lines), which leads to frequent false alarms of signaling devices. In addition, these devices do not allow detecting parallel connection of high-resistance (with a resistance of several megohms) eavesdropping devices to the line. Therefore, such devices are not widely used in practice.

The operating principle of more complex devices is based on periodic measurement and analysis of several line parameters (most often: voltage, current, and complex (active and reactive) resistance of the line). Such devices allow determining not only the fact of connection of information retrieval devices to the line, but also the connection method (serial or parallel). For example, telephone line controllers «KTL-2», «KTL-3» (see Fig. 7) and «KTL-400» allow detecting bugs powered by the telephone line in 4 minutes, regardless of the method, place and time of their connection, as well as the line parameters and voltage of the automatic telephone exchange [9]. The devices also emit a light alarm signal in the event of a short-term (at least 2 seconds) disconnection of the line.

Modern telephone line controllers, as a rule, along with the means of detecting the connection of unauthorized devices to the line, are also equipped with means of suppressing them. For suppression, the method of high-frequency masking interference is mainly used. The suppression mode is switched on automatically or by the operator upon detection of an unauthorized connection to the line [9].

To block the operation (dialing) of unauthorizedly connected parallel telephone sets, special electronic blockers are used.

The operating principle of such devices will be explained using the Rubin product as an example. In standby mode, the device analyzes the telephone line condition by comparing the voltage in the line and on the reference (base) load connected to the telephone circuit. When the handset of an unauthorized parallel telephone is lifted, the voltage in the line decreases, which is recorded by the protection device. If this fact is recorded during a telephone conversation (the handset on the protected telephone is lifted), an audible and visual alarm is triggered (the LED for unauthorized connection to the line lights up). And if the fact of an unauthorized connection to the line is recorded in the absence of a telephone conversation (the handset on the protected telephone is not lifted), the alarm is triggered and the protection device switches to the mode of blocking dialing from the parallel telephone. In this mode, the protection device shunts the telephone line with a resistance of 600 Ohm (simulating the removal of the handset on the protected telephone set), which completely eliminates the possibility of dialing a number from a parallel telephone set.

In addition to unauthorized connection to the line of a parallel telephone set, the Rubin protection device also signals the facts of breakage (opening) and short circuit of the telephone line.