Public and private sector

Research laboratory

Results have to leave the zone continuously, which makes the outflow the design problem rather than the workstation.

Area
TEMPEST/RÖS
Architecture patterns
1
Products used
8

The problem

What makes it hard

The adversary has time and patience and is often interested in one narrow technical area rather than in everything. Visiting researchers and doctoral students rotate through. The publishing culture pulls towards openness. And the laboratory contains measurement equipment that radiates strongly itself and that nobody is going to replace with an approved equivalent, because no such equivalent exists.

Appropriate level: TEMPEST Level B / RÖS U2 normally, TEMPEST Level A / RÖS U1 for positions against the façade.

The laboratory equipment breaks the chain. An oscilloscope bench in the same room as a Level A client removes the protection in practice. Either the room is divided into two zones, or a lower level is accepted deliberately.

How it is built

Flow out of the zone: a diode in and out

Two diodes in opposite directions are not a bidirectional link, as long as they stay physically separate.

See the full pattern
One diode carries backup and logs out, another carries updates in under its own approval. Neither carries anything the other way.Level A zoneOutside the zoneDiode outWorkstationsDiode inBackup and logsUpdatesfiles and logsout of the zoneno way backinto the zoneafter review
One diode carries backup and logs out, another carries updates in under its own approval. Neither carries anything the other way.Level A zoneOutside the zoneDiode outWorkstationsDiode inBackup and logsUpdatesfiles and logsout of thezoneno way backinto thezoneafter review
  • Approval document per article numberThe two diodes are requested separately — a supplier statement says nothing about the unit.
  • The direction sits in the opticsNo rule, no configuration, no setting that can be changed afterwards.
  • One-way path
  • Data path
  • Path that does not exist
One diode carries backup and logs out, another carries updates in under its own approval. Neither carries anything the other way.

In the catalogue

Equipment from the catalogue

Built from: Tower Workstation 32" 60-00-8703, Microtower 60-00-8205, Data Diode Secure 1 Gbit MM TEMPEST 60-00-7303 and 5 more below.

TEMPEST Level A · RÖS U1

Tower Workstation 32"

CPU
Intel CPU i7-9700E
Hard drive
Removable 512 GB SSD
Optimal (recommended) resolution
3840 x 2160 (4K UHD)

Product no 60-00-8703

TEMPEST Level A · RÖS U1

Microtower

Secure expansion unit for Fibersystem’s Workstation and Tower Workstation systems. It provides connections…

Product no 60-00-8205

TEMPEST Level A · RÖS U1

Data Diode Secure 1 Gbit MM TEMPEST

Data rate
1 Gbps
Wavelength
Multimode 850 nm
Input, LC
1000 BaseSX

Product no 60-00-7303

Standard

Data Diode Middleware (DDMW)

Software solution for transferring data over data diodes in such a controlled manner. It consists of a sender…

Product no 60-00-7367

TEMPEST Level A · RÖS U1

Secure Data Tap 1 Gbit

Duplication of network signals, including any existing physical errors, to transmit-only ports and is…

Product no 60-00-7450

Standard

Fiber Optical Switch 1x2 MM

Switching time
3.5 ms
Insertion loss, typical
<0.3 dB
Optical channels in/out
2 LC duplex

Product no 60-00-8274

Standard

Secure USB Disconnect Desktop

Dimensions
38 x 100 x 100 (HxWxD) mm
Weight
300 Gram

Product no 60-00-0234

Reading and references

Explained in

Named customer references are not published. What we can show is the solution area this environment belongs to, and the reasoning behind the design.

Sector

Environments

Environments with the same problem

The technology is the same; the buying process usually is not.

Hands soldering a circuit board under a work lamp

Next step

Describe your environment

If yours is close to this one but not the same, that difference is usually where the design decisions are. Tell us what it looks like.

Verified credentials

All certifications