Patent Grant
7323986
The present invention relates to a tamper respondent enclosure which may be opened and closed as many times as necessary.
The applicant has previously proposed a variety of forms of tamper resistant enclosures, such as those described in U.S. Pat. No. 5,858,500, and UK Patent Applications 2 220 513 A, 2 258 075 A, 2 256 956 A, 2 256 957 A, 2 256 958 A and 2 270 785 A, the disclosures of which are incorporated herein by reference. These enclosures are in the form of envelopes and shallow boxes, the walls of which are formed by folding flexible sheets incorporating tamper detection features. Included in such sheets are layers of flexible material including a matrix of semi-conductive lines printed on thin insulating film. The matrix of lines forms a continuous conductor which is broken if attempts are made to penetrate the film. The circuit is monitored by opening the conductor at one point and measuring the resistance between the two ends of the circuit. The sheets are folded and overlapped to create an enclosure of wedge-shaped, cuboid or cube form, such as disclosed in GB 2 258 075 A in which a laminate is folded about a plurality of fold lines to form an enclosure. In U.S. Pat. No. 5,858,500 the envelope or box formed of the flexible sheet is potted in a settable material. The enclosures are intended to surround an item to be protected, such as an electronic device, which may be an encryption module, chip or other circuit for processing, containing or carrying potentially valuable information. As noted above, any attempt to penetrate the enclosure results in damage to one or more of the lines, and this damage is detectable as a change in an electrical characteristic of the conductor. On detection of such a change the valuable information contained within the item is typically erased or destroyed and an alarm may be activated.
It is, however, a limitation of such an enclosure system that should access to any components within the enclosure be required e.g. for maintenance or replacement of components, the whole has to be reassembled and wrapped. The discussed tamper respondent enclosures also suffer from the limitation in that the enclosures may only be used once. This means that once the cover has been removed, the tamper respondent sensor has to be completely replaced. This adds to the cost of using such enclosures.
It is an object of at least one embodiment of the present invention to obviate or mitigate at least one or more of the aforementioned limitations.
It is a further object of at least one embodiment of the present invention to provide a tamper respondent enclosure which may be used more than once.
According to a first aspect of the present invention there is provided a re-usable tamper respondent enclosure comprising a first sensing means and a second sensing means wherein the first sensing means detects any attempt to breach the enclosure or to circumvent the second sensing means.
According to a second aspect of the present invention there is provided a tamper respondent enclosure comprising:
a casing adapted to be opened and closed;
a first sensing means comprising at least one detecting element, wherein damage to said at least one detecting element results in a detectable variation to a characteristic of the detecting element; and
a second sensing means comprising at least one means for detecting opening of the casing;
wherein said casing is adapted to contain and protect at least one item disposed therein.
The enclosure has the advantageous property in that it may be opened for access, servicing and modification of an item enclosed within the casing. Preferably, the enclosure may be opened without causing damage to the first sensing means.
Typically, the tamper respondent enclosure may have two main forms of security, as indicated by the first and second sensing means. The first and second sensing means prevent unwanted access to an item contained within the casing.
Typically, the tamper respondent enclosure comprises:
(a) a casing having a top portion and an intermateable bottom portion;
(b) said first sensing means comprising a detecting element having a first portion wrapped at least partially around or within said top portion of said casing, and a second portion wrapped at least partially around or within said bottom portion of said casing, wherein damage to said detecting element results in a detectable variation to a characteristic of the detecting element; and
(c) said second sensing means comprising at least one sensor and forming an electrical or electronic circuit including said sensor wherein the sensor is capable of detecting opening of the casing;
(d) wherein said casing is adapted to contain and protect at least one item disposed therein.
Typically, the tamper respondent enclosure comprises:
(a) a casing having an opening and adapted to be attached to a surface such that an item disposed on the surface is enclosed by the casing;
(b) a first sensing means comprising a detecting element wrapped at least partially around or within said casing, wherein damage to said detecting element results in a detectable variation to a characteristic of the detecting element; and
(c) a second sensing means comprising at least one sensor and forming an electrical or electronic circuit including said sensor wherein the sensor is capable of detecting removal of the casing from said surface.
The first sensing means may detect any attempt to breach the casing. Conveniently, an attempt to breach the casing may damage the detecting element resulting in detectable change in a characteristic of the detecting element. Attempts to breach the casing may comprise any combination of puncturing, cutting, drilling, peeling, delaminating or chemical erosion.
The first detecting means may further detect any attempt to by-pass or otherwise circumvent the second sensing means, such as by mechanical intrusion to prevent the activation of the second sensing means.
The second sensing means may detect any attempt to open the casing. Typically, the opening of the casing may result in a sensing circuit being broken.
The second sensing means may comprise an intermateable connector.
The second sensing means may comprise a switch.
The second sensing means may comprise a proximity sensor.
The second sensing means may comprise a capacitance sensor.
The second sensing means may comprise a photosensitive device.
The second sensing means may comprise an acoustically responsive device.
The second sensing means may comprise a magnetically responsive device.
The second sensing means may comprise conductive contact pads on a surface.
The tamper respondent enclosure may be opened in a predetermined way without physical damage. The valuable information contained within the item may be erased upon opening by actuation of the second sensing means. The tamper respondent enclosure may be re-closed as required with full security functionality restored. If the said valuable information was erased upon opening the enclosure, said information would then need to be reloaded by the manufacturer or authorized technician after re-closing.
The casing may be of any suitable shape such as, but not exclusively, cubic, cuboidal, polyhedral, spherical, or hemispherical and may comprise a plurality of separate component parts.
In one embodiment of the invention the casing may comprise an open box-like section adapted to be attached to a planar surface such as a printed circuit board or the like on which the item to be protected is disposed. The casing would enclose such an item and any attempt to remove the casing from the planar surface would actuate the second sensing means.
The casing may comprise a plurality of separate component parts adapted to fit together.
In a further embodiment the casing may be formed from a first and second part which may be adapted to fit together. Typically, the first part may be an open-topped box-like section and the second part may be a lid section. The first and second parts may be fitted together to form a box-like casing. Alternatively, the casing may comprise a member, such as a door or doors, which may be moved between an open and closed position. In a further alternative, the casing may comprise a slidable member which may be slid between an open and closed position.
The casing material may be electrically conductive or nonconductive. Typically, the casing may be made from any material such as a metal, alloy or a polymeric material.
Conveniently, the casing may comprise additional protection means between separable parts of the casing to prevent unwanted access. For example, at least one of the component parts may comprise a multiple wall between separable parts of the casing. Preferably, the multiple wall section may be a double wall section. Such an arrangement may help to prevent unwanted probing within the casing, thereby gaining access to a stored item.
In one embodiment the items to be protected within the casing will be connected to other items internal to the casing, for example on a printed circuit board. Typically the connection will be through circuit traces within, or on, the printed circuit board. In another embodiment the items protected within the casing may be connected to devices or equipment external to the casing. Typically this connection will be through cables such as electrical conductor or optical fibre cables. In the routing of such cables from internal to external of the casing it is important to avoid any direct breaching of the casing or the tamper respondent covering thereby compromising the tamper protection provided by the casing. An example of such a routing, later herein described in detail, comprises the passage of a cable of suitable profile between the walls of the casing to exit in the gap between the internal and external walls of the casing. Such an arrangement causes the cable to take at least one 180° bend which prohibits a direct probing attack alongside the cable into the secure interior of the enclosure.
It may also be advantageous to incorporate a venting system in the casing to compensate for pressure changes due to temperature changes within the casing; or to compensate for pressure differential between the internal volume of the casing and the environment external to the casing such as would be experienced, for example, in aircraft or aerospace applications. A convenient way to provide such venting without breaching the casing would be to choose enclosure dimensions so as to provide a ventilation path of serpentine geometry (at least one 180° bend). Optionally, a tube such as a “lay-flat” tube may extend from inside of the casing to the outside. Such a tube may be routed in similar fashion to the aforesaid Interconnecting cable or ventilation path thereby avoiding breaching of the casing and the covering member. Having such a configuration on at least two sides of the enclosure would allow for an inlet and an outlet ventilation port and could incorporate forced airflow through the protected enclosure without loss of security.
In a further embodiment of the invention a heat pipe or any other suitable heat dissipation device may be incorporated to remove heat from a device within the enclosure and dissipate to the environment external of the enclosure. The heat pipe may be routed in a serpentine manner as for the aforesaid cables and ventilation tubes.
A ventilation path may also exist between internal and external sections of the casing.
The enclosure may also comprise an interconnecting cable.
Typically, at least part of the casing may comprise an outer covering member. The outer covering member may encompass substantially all of the outer surfaces of the casing. Alternatively, or additionally, the inner surfaces of the casing may be encompassed by the covering member.
The first sensing means may comprise a covering member covering at least part of the casing.
Preferably, the covering member may be bonded to an outer surface of the casing, an inner surface of the casing or both inner and outer surfaces. The bonding may be achieved by any appropriate means. For example, thermoplastic or thermosetting adhesives comprising tapes or sheets, or thermosetting dispensable liquid adhesive, or combinations of both, may be used. Pressure sensitive adhesives may also be used to bond the covering to a surface of the casing. Conveniently, the first sensing means comprises one or more detecting elements which may be incorporated or attached to the covering member. Where a plurality of elements is provided, each element may take a similar form or may take a different form. One or more elements may take the form of elongate electrical conductors formed of any appropriate material such as conductive or semi-conductive ink or a metal. One or more elements may take the form of conductive or reactive sheets forming layers or parts of layers of a laminated covering member. Preferably, the one or more detecting elements extend over substantially the whole area of the casing.
The covering member may be bonded to the surface of the casing using material which is utilised in the composition of the at least one detecting element.
The one or more detecting elements may be incorporated or attached to the covering member.
The at least one detecting element may have a cohesive strength and a bond between said detecting element and said covering member and a bond between said detecting element and said enclosure surface each having an adhesive strength, and said cohesive strength may be less than at least one of said adhesive strengths.
Typically, the one or more detecting elements may extend over substantially the whole area of the casing.
The characteristic of the detecting element may be electrical such as one or more of resistance, capacitance, impedance, inductance, reactance or the like. In use, the element preferably forms part of a monitored sensing electrical circuit across or through which a voltage or electrical signal may be applied or transmitted. Any attempt to penetrate the casing that alters said characteristic may thus be detected as, for example, a change in the measured voltage across the detecting element or a variation in a signal passed through the detecting element.
The one or more detecting elements may comprise a plurality of conductive tracks. The conductive tracks may be rectilinear or serpentine.
A protective coating or covering may be applied over the conductive tracks.
The detecting elements may be obscured by overprinting.
The one or more detecting elements may be provided on the face of the covering to be mounted to the surface of the casing. When the covering is adhered to a surface of the casing, any attempt to separate the covering from the surface will therefore disrupt or otherwise damage the elements. In other embodiments the one or more elements may be incorporated within the covering, and the covering adapted to delaminate or otherwise separate on an attempt to separate the covering member from the surface, such delamination disrupting or otherwise damaging the elements. Typically, the covering member may bend or flex to allow edges or parts of the member to be folded around the edges of the casing.
The covering member may initially be provided in a planar form and may then be folded around the casing to the appropriate form.
The covering member is preferably optically opaque. Typically, the covering member covers substantially all of the outside surface of the casing. Preferably the covering member and the sensing element disposed thereon comprise materials which are non-differentiable by X-ray radiography.
The covering member may be used with a metallised or otherwise treated cover to provide EMI shielding or ESD protection.
Preferably, the second sensing means may be within the casing where there may be provided a sensing circuit, or a plurality of sensing circuits comprising the at least one sensor for detecting opening of the casing. The one or more sensors may comprise surface contacts adapted to form electrical contact with corresponding surface contacts mounted within the casing. Those skilled in the art will appreciate that any type of suitable sensor may be adapted for use within the casing which is able to open and close an electrical circuit. For example, part of a connector system may be attached to a part of the casing which is openable and the mating part of the connector attached within the casing. On closing the casing, the connector system may form an electrical circuit. If the casing is opened, the electrical circuit may be broken, thereby detecting the opening of the casing. Alternatively, a switch such as a microswitch may be used which forms a circuit when the casing is closed and breaks a circuit when the casing is opened or, indeed, break a circuit when the casing is closed and form a circuit when the casing is opened.
The second sensing means may comprise other systems such as magnetically operated reed switches, Hall effect devices or other proximity devices known to one skilled in the art. Similarly photosensitive, magnetically sensitive, or acoustically sensitive devices could be utilised in the second sensing means. In an embodiment in which the casing is attached to a surface such as printed circuit board the second sensing means may comprise conductive contact pads connected to circuit traces on the surface of the printed circuit board.
Conveniently, the enclosure may be opened and closed for access, servicing and modification of an item enclosed therein. On opening, information held in any protected item within the enclosure may be ‘zeroised’. On re-closing full functionality is restored to the enclosure without requiring new sensors to be fitted. The zeroised information would then be reloaded via circuit board traces, the I/O cables or connector. The opening and closing may be performed as many times as necessary.
Within the casing, there may be the at least one item to be contained and protected. The item may be an electronic device containing information in an electronic format. The information may be in the form of an algorithm, encryption codes, a program or the like. Preferably, the item contains information which it is desired to protect.
The item within the casing may be selected from but not limited to any of the following: items utilised in financial systems or transactions such as in banking, or in ticketing systems or machines; items utilised in the measurement of a commodity such as in electricity meters for reading, recording or transmitting electricity, gas or water; items utilised in encryption devices; items utilised in set-top boxes such as television set-top boxes; items or components utilised in hand-held terminals; items utilised in secure wireless communication systems or devices; items utilised in USB tokens; items utilised with electronic memory devices, for example RAM or ROM devices; items utilised in secure authentication tokens; items utilised in a PCMCIA card; items utilised in a motherboard; items utilised in a single board computer; devices used in weapons and aerospace control systems; biological material; mineralogical material; or hazardous material.
In a further embodiment of the invention the enclosure may be used to contain for storage or transportation items to which unauthorised access is undesirable. Items such as valuables, documents, biological samples, toxic substances or the like could be contained in the enclosure and any unauthorised attempts at access would trigger the first and/or second sensing means which may in turn activate an alarm system, data recorder or similar device.
Typically, any unwanted attempt to access the enclosure results in information stored on a contained item being erased or destroyed, activation of an alarm, activation of a recording device or any combination thereof.
According to a third aspect of the present invention there is provided a method of protecting at least one item comprising the steps of:
providing a casing adapted to be opened and closed and wherein at least one item may be stored and protected;
providing a first sensing means comprising at least one detecting element which is capable of detecting any damage to the detecting element by forming an electrical circuit including said detecting element and monitoring for detectable variations in a characteristic of the detecting element;
providing a second sensing means comprising at least one sensor and forming an electrical circuit including said sensor wherein the sensor is capable of detecting the opening of the casing;
whereby said detectable variations activate a system to erase or destroy information contained in the at least one item or to signal or otherwise notify of tampering.
Typically, detectable changes may also activate an alarm.
Although reference is made primarily herein to elements having certain electrical characteristics, those of skill in the art will recognise that elements having other detectable characteristics, for example, optical transmission characteristics, or surface acoustic wave propagation characteristics, may be utilised as an alternative or additional detection means.
These and other aspects of the present invention will now be described, by way of example only, with reference to the accompanying drawings in which:
Referring to
As shown in
The covering 26,38 for the bottom and top parts 12, 14 is initially formed in a planar configuration by printing resistive ink tracks 44 onto both sides of a suitable flexible substrate 46, the substrate 46 being formed of a material such as a polyester, for example, PET. The substrate 46 may be laser-drilled at various points to permit electrical connections to be formed through the substrate 46. Although only one track 44 is shown in
The tracks 44 are formed of a carbon-loaded polyester and are black in colour. The tracks 44 may thus be obscured by overprinting the tracks 44 with a thin layer of black polymer resin, or an opaque cover film which is fixed by adhesive to the outer phase of the substrate 46.
An adhesive layer is used to fix the covering 26,38 to the bottom and top parts 12,14. For simplicity in figures 5 and 6 covering 38 is shown cut to form butt joins at the vertical edges when wrapped round the casing but in practice this arrangement would leave the corners vulnerable to undetected attack. It is therefore preferable for the covering 38 to be cut such that the covering would overlap at the vertical edging in an anti- probing fold arrangement.
The tracks 44 form part of an electrical circuit through which a voltage is applied. Monitoring means detect any change in the voltage. Any change in voltage results in information in a stored item being erased or destroyed.
The covering 26,38 thus provides a relatively simple and inexpensive means of protecting an enclosed item.
The first switch 48 comprises a first part 50 mounted on base 16 of bottom part 12. The second part 52 is mounted on the inside surface of top side 28 of top part 14. The second part 52 comprises pins 54 which are adapted to be inserted into sockets 56 in the first part 50. On insertion of the pins 54 into the sockets 56, an electrical connection is made and a circuit is formed. If the top part 14 is removed from the bottom part 12, the electrical connection formed by switch 48 and the resulting circuit is broken whereupon information stored in protected items are erased or destroyed.
Switch 58 comprises a spring-mounted arm 60. At the end of arm 60 there is a contact roller 62 mounted on a pin 64 between two ends 66,68. As the top part 14 is inserted on top of the bottom part 12, the spring-mounted arm 60 abuts against the top side 28 of the top part 14 and is forced downwards. This switches the switch 58 ‘on’.
If the top part 14 is removed, the spring-mounted arm 60 rises, and switch 58 is switched ‘off’. The circuit is broken and the information within the item is erased or destroyed.
If a wireless communication device, such as used in WLAN (wireless local area network) or RFID (radio frequency identification) systems were incorporated, a tamper attack on the enclosure could trigger the RF transponder to emit a notification signal. If the wireless communication device were housed inside the casing, a tamper respondent covering with conductive tracks may attenuate the emitted RF signal. Preferably, the conductive tracks in the tamper respondent covering are highly resistive which will absorb less RF energy than highly conductive tracks. A material such as semi-resistive carbon ink is preferred over conductive silver traces.
On removal of the top part 14 from the bottom part 12, the tamper respondent enclosure 10 can be reset. This allows access, servicing and modification of the item to be performed within the casing 11. The top part 14 may then be placed on top of the bottom part 12 again and the tamper respondent enclosure may be reset, ready for further use. Such an enclosure 10 has the advantage that none of the sensors need to be replaced on opening and closing. This is in contrast to prior art devices which can only be used once.
A venting tube utilised to equalise gas pressure between the inside of the casing and the environment external to the casing may be similarly routed to avoid breaching the casing and the tamper respondent covering of the casing.
The present invention has application in many areas where it is desired to protect an item, including devices or items utilised in any of the following: financial systems or transactions such as in banking, or in ticketing systems or machines; items concerned with measurement of a commodity, such as in electricity meters for reading, recording or transmitting electricity, gas or water; or in many other items including but not limited to encryption devices, set-top boxes such as television set-top boxes, hand-held terminals, secure wireless communication devices, USB tokens, electronic memory devices such as EPROMs/PROMs or RAMS, secure authentication tokens, part of PCMCIA card, or part of a motherboard or single board computer. The tamper respondent enclosures of the present invention may also be used in military applications such as weapon systems or aerospace control systems; and protecting biological material, mineralogical material or hazardous material.
Furthermore the tamper respondent enclosures of the present invention may be used as “smart containers” i.e. to protect items, during storage or transport, from unauthorised access and to record and/or provide notification of attempts at such unauthorised access.
While particular embodiments of the present invention have been illustrated and described herein, the present invention should not be limited to such illustrations and descriptions. It should be apparent that changes and modifications may be incorporated and embodied as part of the present invention within the scope of the following claims.
| Number | Name | Date | Kind |
|---|---|---|---|
| 3644825 | Davis, Jr. | Feb 1972 | A |
| 4188549 | Dorais | Feb 1980 | A |
| 4325089 | Hsu | Apr 1982 | A |
| 4593384 | Kleijne | Jun 1986 | A |
| 4860351 | Weingart | Aug 1989 | A |
| 4931770 | Abramson | Jun 1990 | A |
| 5117457 | Comerford et al. | May 1992 | A |
| 5832772 | McEwan | Nov 1998 | A |
| 5858500 | MacPherson | Jan 1999 | A |
| 6396400 | Epstein, III | May 2002 | B1 |
| 6400268 | Lindskog | Jun 2002 | B1 |
| 6606123 | Mizuno | Aug 2003 | B2 |
| 6791342 | Ono | Sep 2004 | B2 |
| 6996953 | Perreault et al. | Feb 2006 | B2 |
| 7005733 | Kommerling et al. | Feb 2006 | B2 |
| 20020092672 | Primavera | Jul 2002 | A1 |
| 20020171439 | Ono | Nov 2002 | A1 |
| Number | Date | Country |
|---|---|---|
| 2 220 513 | Jan 1990 | GB |
| 2 256 956 | Dec 1992 | GB |
| 2 256 957 | Dec 1992 | GB |
| 2 256 958 | Dec 1992 | GB |
| 2 258 075 | Feb 1993 | GB |
| 2 270 785 | Mar 1994 | GB |
| Number | Date | Country | |
|---|---|---|---|
| 20060049941 A1 | Mar 2006 | US |
