Schneier on Security

Clive Robinson • August 23, 2011 8:39 AM

Oh I forgot to mention, if your attacker is aware that you have such a device there are ways they can use it to get past the security.

I won’t go into implementation details because it might give people ideas how to attack alsorts of other systems.

However to put it in crypto speak, it can be used in just the same way bitflipping can be used to attack a stream cipher that does not have appropriate plaintext level MACs etc.

Clive Robinson • August 24, 2011 8:14 AM

For those that want to go into the subject of security at the physical layer a good course on EmSec, TEMPEST, EMC would be a good place to start. Or ask Nick P for a list of our back posts on the subject on this blog 8)

As Robert T notes it is the RF power that is the problem, or more correctly the energy and the rise time (power = energy / time).

In effect there are two types of energy “wanted” and “unwanted” energy the trick is to accept the wanted energy and reject the unwanted energy without causing unwanted disturbance to the delicate electronics.

What most people don’t realise is that even the best of pasive filters have defficiency in terms of parasitic components of resistance, capacitance and inductance not least of which are those due to physical layout. Further few consider what happens to energy that does not pass through the filter, that is where it goes and where it ends up.

In the case of some fast rising high energy signals (EMP etc) the circuit can end up looking like a potential divder or ladder network thus unwanted energy makes it through the filter to the sensitive electronics, other paths often occure due to poor circuit layout and “grounding” issues. Sadly the use of detectors and de-Qing circuits take time thus have dificulties with very fast rise times. Thus reliance on balanced design and high speed diode devices in proffessional systems where EMP type interferance is to be expected in the environment.

Outside of clasified documentation for the likes of EmSec and TEMPEST the next best source on the basics is EMC and RF Design documentation.

However the best documentation that covers the basics of the problem and some of the soloutions to the issues was a document called “The care and feeding of double balanced mixers” however it does not appear to be up on the web currently.

However you can start by reading,

http://www.odyseus.nildram.co.uk/Systems_And_Devices_Files/Mixer_Basics.pdf

You can also hunt around for information using

[diplexer “double balanced mixer”]

Diplexers are circuits that can work from “Dc-Daylight” and maintain a constant impedence and broad band return loss both of which are desirable properties when dealing with unwanted energy. Put simply they are two or more filters that get terminated in the correct load. In the case of unwanted energy this is a resistor.

Good Return loss is important because it represents energy bouncing backwards and forwards between the source (antenna wire) and the diplexer resistive load. This energy can create “standing waves” causing voltage peaks well above the signal level (see VSWR or Voltage Standing Wave Ratio) or worse if there are any nonlinear circuit elements (limiting diodes etc) convert the energy from one frequency to another.

Unfortunatly few electronic designers these days have a good proffesional understanding of RF and analog circuit design, nor do those laying out their designs on Printed Circuit Boards (PCBs).

And if you want an idea of what’s involved with an “amateur” level interest in RF design have a look at,

http://www.qrp.pops.net/miscellaneous-RF-topics-2011.asp

As I said a lot of people designing electronics in general don’t get to even this Amateur level of skill in RF which along with EMC design is usually seen as a “Black Art” like much like most analog electronics design. The result is they tend to copy from other designs hoping that it all works at the end of the day to get them past EMC testing…

Clive Robinson • August 24, 2011 6:50 PM

@ RobertT,

“Floating systems like a heartpace maker are a little different to normal RF because trying to limit the”out of band” energy with LC filters does no really work.”

Not with the antenna, however it should with the device electronics if properly sheilded etc.

And thereby hangs the problem with pacemakers and the newer IED type devices that US medical insurance companies are pushing. At one end of the antenna is the device electronics, at the other the patients heart.

Now this is where I tred very carefully because my experiance with the design of medical electronics was not with pacemakers or other implantable devices (I’m actually squeamish about such things and always have been)

As far as I’m aware the human heart is very insensitive to LF and above frequency energy (other than the heating effect) where as it is extreamly sensitive to DC and upto low audio range frequencies and waveforms.

If this is true then to a certain extent RF energy on the heart end of the wire can be ignored upto a much greater level than could any DC or low frequency signal.

However as we both know many modulation systems effectivly “envelope modulate” the RF carrier even if it is just sending packets of data every so often by turning an FM/PM modulated carrier on and off.

As we also know envolope modulation is very easy to recover it just requires a diode to rectify the RF.

So we end up having a piece of wire acting as an antenna that in of it’s self does not appear to represent much of a threat even if it is connected at one end to the heart because it is effectivly only an effective antenna at VHF and above and the heart is (I’m assuming) insensitive to this at low energy levels.

However at the other end of this wire we have a bunch of electronics that is going to be sensitive to VHF and above frequencies and worse due to the use of square law and other nonlinear devices will convert part of that energy into DC or low frequency if it can.

To do this the electronics must be able to see the RF energy at a level that is sufficient to cause the rectification of the RF.

Now two solutions would normaly present themselves to this problem a Farady Shield and making the antenna very inefficient.

So the first aproximation is the one often used in audio electronics, which is to put the electronics in a shielded box, and put the wires that would act as an antenna into a shield as well which is only terminated at the electronics box end not the heart end.

This is fine from the electronics perspective but is it also fine from the hearts end ie to the heart does it represent no more of a threat than a piece of wire of equivalent size…

Well sadly no because the case and outer screen of the wire will still act as an antenna even though the electronics is inside, the wire attached to the heart spoils the model because it breaches the shield and the heart it’s self will end up acting as an antinodal refrence to the shield which is not good if the wire alows the transfer of the energy.

Thus the second aproximation is to replace the low impeadence wire to the heart with a high impedance which limits the amount of energy that can be transfered between the heart and the electronics.

However this has a disadvantage, although it can still be used for sensing the heart waveform it is not of much use when it comes to providing either the pacing pulse or defib pulse.

Is there a solution to this problem well yes there is and it’s called galvanic issolation. And oddly you turn the problem back on it’s self.

Two tuned circuits where the inductors are effectivly a transformer provide galvanic issolation between one side and the other. The fact they are made tuned circuits means that there is a narrow frequency band in which energy can cross from one tuned circuit to another.

If the electronics side is an oscillator which is envelope modulated and the other side is a fullwave rectifier then only energy in the passband of the tuned circuits should cross.

So we then need to review the model again…

I’m guessing with care the issue can be brought to within managable proportion.