(19) TZZ _Z_T (11) EP 2 106 578 B1 (12) EUROPEAN PATENT SPECIFICATION (45) Date of publication and mention (51) Int Cl.: of the grant of the patent: G06F 21/55 (2013.01) G06F 21/70 (2013.01) 14.09.2016 Bulletin 2016/37 G06F 21/82 (2013.01) (21) Application number: 07736264.8 (86) International application number: PCT/IL2007/000524 (22) Date of filing: 29.04.2007 (87) International publication number: WO 2008/090537 (31.07.2008 Gazette 2008/31) (54) SECURITY SWITCH SICHERHEITSSCHALTER COMMUTATEUR DE SÉCURITÉ (84) Designated Contracting States: (72) Inventors: AT BE BG CH CY CZ DE DK EE ES FI FR GB GR •Yoffe,Simon HU IE IS IT LI LT LU LV MC MT NL PL PT RO SE 54056 Givat Shmuel (IL) SI SK TR • Yoffe, David 54056 Givat Shmuel (IL) (30) Priority: 22.01.2007 US 881510 P (74) Representative: Modiano, Micaela Nadia et al (43) Date of publication of application: Modiano Josif Pisanty & Staub Ltd 07.10.2009 Bulletin 2009/41 Thierschstrasse 11 80538 München (DE) (73) Proprietors: •Yoffe,Simon (56) References cited: 54056 Givat Shmuel (IL) EP-A2- 1 698 990 US-A- 3 703 987 • Yoffe, David US-A- 4 945 443 US-A- 4 945 443 54056 Givat Shmuel (IL) US-A- 5 555 156 US-A1- 2003 051 162 US-A1- 2005 271 190 Note: Within nine months of the publication of the mention of the grant of the European patent in the European Patent Bulletin, any person may give notice to the European Patent Office of opposition to that patent, in accordance with the Implementing Regulations. Notice of opposition shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention). EP 2 106 578 B1 Printed by Jouve, 75001 PARIS (FR) 1 EP 2 106 578 B1 2 Description phone-lines, cables, a wireless LAN, Bluetooth, etc, which only increases the security risk. TERMS [0004] These communication means can be used to retrieve private information, audio/video information, us- [0001] 5 er location information (track where user is located when personal device is using out communication) or transmit- Authorized user - owner or permitted operator of a ted information. Devices with permanently installed or personal device. accessory sensor components such as a microphone, Unauthorized user - any user or software that does earphone(s), speakers, camera, etc, are able to capture not have an explicit permission to operate the per- 10 the information at a user location. Devices with perma- sonal device. nently installed or accessory communication compo- Unauthorized access - any attempt of an unauthor- nents like: modem, LAN adapter, Wireless LAN adapter, ized user to access or operate a personal device Bluetooth, GSM, etc, are able to transmit information and False indication/notification - an indication show- might reveal the user location. When signals are trans- ingone state, while the real stateis different. Hooked 15 mitted from the user location, the transmission can be component- a component connected in parallel with used for tracking the user location. Components of a de- other device(s) to the same input element, in such vice/appliance that are controlled by software and elec- way that both devices can operate together, but the tronic switching devices may be controlled by an unau- hooked component is isolated from the other de- thorized user even if they were disabled earlier by the vice(s). 20 authorized user. The components can be controlled with- "Man in the middle" - a component logically placed out the user noticing the change in mode of operation. between two other components and which can con- For example, a mobile phone may look "switched off" but trol the information passed between the two other still be functioning or even transmitting. components [0005] Local authorized or unauthorized users can Secure Input - an input readable only to a permitted 25 easily modify the software operating the personal device, component, meaning that the input of the permitted thereby causing a security breach, e.g. by downloading component cannot be revealed by others compo- a virus affected software update. This scenario of soft- nents. ware modification is very common: on one hand it is much Internal - enclosed within an envelope or surface of easier than hardware modification, and on the other hand the personal device or positioned at least partially 30 it is much harder to verify such modification or notice onthe surface of theenvelope of thepersonal device. unwanted change. Isolated Switch - a switch that cannot be operated [0006] At present, the problem of unauthorized access or affected by any entity or factor except an author- is handled by different types of security software such as ized user. firewalls, anti-virus programs, anti-spyware programs Independent operation - operation that cannot be 35 and security systems. However, each new software se- affected by any entity or factor except an authorized curity system is eventually overcome by new hacking user. methods, viruses, worms, Trojans and other threats. This creates an endless competition between security provid- FIELD OF THE INVENTION ers and unauthorized users. In essence, software secu- 40 rity is hard to implement and/or prove. Even if the theo- [0002] The presented invention is related to security retical model of the security is proven, there may still be of personal communication or computing devices with a mistake or bug in the implementation that allows a break external communications and sensors (e.g. microphone, in the security. Consequently, software security solutions camera) features and using software for operation. cannot be trusted. 45 [0007] Hardware security solutions are known and in- BACKGROUND OF THE INVENTION clude: devices used to isolate telephone lines in order to prevent unauthorized capture of audio information from [0003] Personal software operated devices or appli- phone user (see US Pat. No.5,402,465 and US Pat. Ap- ances (hereinafter "personal devices") such as mobile plication No. 20050271190); data line switches for com- phones, IP-phones, pocket PCs, PDAs, laptop comput- 50 puters that disconnect a computer line physically from ers, desktop computers and network switches, use a va- the Internet, working in manual and/or automatic mode riety of hardwired or wireless communication means for (US Pat. Application No. 20030062252); a power off communication with other devices. A remote unauthor- method for a wireless peripheral device, which termi- izeduser can adversely use these communication means nates power to all parts of the wireless device except the to try and break the personal device security and obtain 55 control chip by a certain operation on a connect button personal and other information on the personal device (US Pat. Application No. 20050009496); a switch that user or owner. A single personal device may have a powers-on a PDA in response to the stylus being re- number of different communication means such as moved from the PDA’s stylus holder, and, selectably, 2 3 EP 2 106 578 B1 4 powers-off the PDA in response to the stylus being re- means, referred to as "security switch" or "isolated placed into the PDA (US Pat. No. 6,233,464); a mobile switch" is internal to the personal device and is isolated, phone with two input modes, whereby a switch of input both "internal" and "isolated being defined above. modes is attained by changing an electrical connection The "isolation" also means that the control elements of between the main printed circuit board (PCB) in the5 the switch do not have any external communication ca- phone and the front and back PCBs (US Pat. No. pability and are protected from remote operation/manip- 7,031,758); the NetSafe Computer Security Switch, ulation. which uses a simple physical switching technology in a [0011] In some embodiments a security switch of the way that allows a computer or group of computers to present invention is a component having: a) control ele- quickly and easily block a communications signal from 10 ments that are not connected electrically to an environ- entering the computer(s) and restart the signal without ment from which they should be isolated and shielded, any softwareand without the need to power down,reboot, or that are decoupled in such a way that both electrical or run software on the computer(s) (US Pat. Application and magnetic fields cannot influence their operation; and No. 20040243825); a wireless button for a laptops, of- b) switching elements that cannot be connected, discon- fered by the Hewlet Packard Corporation in its line of15 nected or bypassed by elements other than the control Pavilion laptops (hereinafter the "HP wireless button"), elements in (a). which enables or disables all integrated wireless compo- [0012] The security switch may be mechanical (elec- nents in the laptop (e.g. WiFi and Bluetooth), and a wire- trical contacts switched mechanically) or electronic/elec- less light that indicates simultaneous the computer’s trical. When mechanical, its control is already isolated overall wireless state (enabled or disabled); the portable 20 because it can be operated only by manual physical op- electronic device that disconnects a receiving antenna erationof the user, not by the deviceitself. A mechanically from the duplexer of a mobile phone (US Pat. Application operated switch should not have an electrically operated No. 2004/0203536A1). bypass. When electronic/electrical, the security switch is [0008] All existing protection solutions suffer from one isolated electrically, i.e. completely separated electrically of two disadvantages: either the switch is "external" and 25 from other elements or components of the personal de- can therefore be tampered with by an external factor, or vice. the switch is internal but not fully isolated from the device [0013] The principle of operation of the security switch itself (and therefore can be manipulated by the software disclosed herein relies solely on manual disconnection of the device).