AU9453598A

AU9453598A - Tamper respondent enclosure

Info

Publication number: AU9453598A
Application number: AU94535/98A
Authority: AU
Inventors: Stephen Baird Hunter
Original assignee: WL Gore and Associates UK Ltd
Current assignee: WL Gore and Associates UK Ltd
Priority date: 1997-10-17
Filing date: 1998-10-19
Publication date: 1999-05-10
Also published as: WO1999021142A1; EP1023707A1; JP2001521231A; CA2306101A1; GB9721932D0

Description

WO99/21142 PCT/GB98/03125 1 TAMPER RESPONDENT ENCLOSURE This invention relates to a tamper respondent enclosure. A tamper respondent enclosure may be used in the transport and storage of sensitive information, including 5 information which is stored electronically. A tamper respondent enclosure includes means which, on detection of an attempt to penetrate the enclosure, initiates an appropriate response, for example activation of an alarm, or destruction or erasure of the sensitive material 10 contained within the enclosure. Typically, a tamper respondent enclosure features a wall including appropriate penetration detection circuitry. Examples of tamper respondent enclosures, and laminates suitable for forming the walls of tamper respondent enclosures are described in 15 our earlier patent application Nos. GB 2220513 A, GB 2258075 A, GB 2256956 A, GB 2256957 A, GB 2256958 A, GB 2270785 A, GB 2275914 A, and GB 2292709 A, the disclosures of which are incorporated herein by reference. The enclosures disclosed in these documents are typically in 20 the form of envelopes or shallow boxes, the walls of which are formed by folding flexible sheets incorporating tamper respondent features around the subject to be protected, to leave no direct opening through which penetration may be accomplished. 25 The flexible sheets may include tracks or lines of WO99/21142 PCT/GB98/03125 2 conductive material forming part of one or more sensor circuits; an attempt to penetrate the enclosure resulting in damage to one or more of the lines creates a detectable change in the electrical state of the lines. However, 5 drills having a diameter of as little as 0.05 mm are available, and using such a drill it may be possible to drill a hole through a tamper respondent sheet without breaking one of the monitored lines. Accordingly, it is conceivable that a small diameter hole could be drilled 10 through a tamper respondent sheet and the penetration of the sheet remain undetected. It is among the objectives of embodiments of the present invention to obviate or mitigate this disadvantage. According to the present invention there is provided 15 a tamper respondent enclosure comprising: a wall including at least two layers; at least a first layer of the wall comprising a sheet of insulating material having lines of conductive material on first and second sides thereof, said lines forming part of at least one sensor circuit; means 20 for detecting an interruption in said at least one circuit; a second layer of the wall comprising an area of conductive material separated from said lines by insulating material; and means for detecting an electrical connection between at least one of said lines and said area, the layers being 25 arranged such that, at any point in the wall, the wall section includes at least one of said lines and said area. The invention is useful in detecting attempted penetration of the wall of the enclosure using metal drills WO99/21142 PCT/GB98/03125 3 which are small enough to penetrate an individual line without cutting the line, and thus will not create an interruption in the sensor circuit. However, if a drill passes through one of the lines, the drill will create a 5 detectable electrical connection on contacting the area of conductive material. In one embodiment, at least one of the lines and the area is formed of a low melt material which is fluidised by the heat created by a drilling operation, such that the fluidised material will flow 10 through the drilled hole and create an electrical connection between the line and the area; of course this arrangement would also detect penetration by a small diameter drill of non-conductive material. Preferably, the area of conductive material of the 15 second layer is provided by a conductive enclosure, most preferably a metal enclosure. The enclosure may be provided internally or externally of the layer including the lines of conductive material. The enclosure may be rigid or may be formed of a flexible material. 20 The area of conductive material of the second layer may be earthed. In an alternative embodiment the area of conductive material of the second layer may be provided by lines of conductive material of a layer comprising a sheet of 25 insulating material with lines of conductive material on first and second sides thereof. Said lines may form part of a sensor circuit and be provided in combination with means for detecting an interruption in said circuit. The WO99/21142 PCT/GB98/03125 4 sensor circuit may form part of the sensor circuit for the first layer or may be operate independently thereof. Similarly, the detection means may be common to the first and second layers or separate detection means may be 5 provided for each layer. The first and second layers may be of similar form. Preferably also, the lines of conductive material on the first and second sides of the first layer are arranged such that at any point in the layer a layer section 10 includes at least one of said lines. Most preferably, the lines are non-rectilinear. Preferably also, the insulating material tends to be disrupted by drilling, for example the material may incorporate fibres, or may bind to a drill, or may fracture 15 on contact with a drill or the like. According to a further aspect of the present invention there is provided a method of forming a tamper respondent enclosure, the method comprising the steps: providing at least a first layer comprising a sheet of 20 insulating material having lines of conductive material on first and second sides thereof; connecting said lines to at least one sensor circuit including means for detecting an interruption in said at least one circuit; 25 providing a second layer comprising an area of conductive material; providing means for detecting an electrical connection between at least one of said lines and said area; and WO99/21142 PCT/GB98/03125 5 arranging the layers to define a wall of an enclosure such that, at any point in the wall, the wall thickness includes at least one of said lines and said area. According to a still further aspect of the present 5 invention there is provided a tamper respondent enclosure comprising: a first enclosure portion having a wall including a layer of insulating material carrying lines of conductive material thereon, said lines forming part of at least one sensor circuit; means for detecting an 10 interruption in said at least one circuit; a metal second enclosure portion; and means for detecting an electrical connection between at least one of said lines and said second enclosure portion. According to another aspect of the present invention 15 there is provided a tamper respondent enclosure comprising an insulated conductive enclosure portion; and means for detecting an change in an electrical characteristic of said enclosure portion. In this aspect of the invention a reference voltage 20 may be applied to the enclosure portion and on the enclosure portion being contacted by an earthed metal drill or other electrically conductive object there will be a detectable change in the monitored reference voltage. In another embodiment, the capacitance of the enclosure 25 portion may be monitored, by application of an AC reference potential, and there will be a detectable change in the monitored capacitance of the enclosure portion if another conductive object is brought into contact with the WO99/21142 PCT/GB98/03125 6 enclosure portion. These and other aspects of the present invention will now be described, by way of example, with reference to the accompanying drawings, in which: 5 Figure 1 is a perspective cut-away view of a tamper respondent enclosure in accordance with an embodiment of the present invention; Figure 2 is a greatly enlarged schematic cross sectional view of a portion of the wall of the enclosure of 10 Figure 1; Figure 3 is a plan view of the wall portion of Figure 2; Figure 4 corresponds to Figure 2, and shows a small diameter drill penetrating part of the wall; 15 Figure 5 is a schematic illustration of elements of the enclosure of Figure 1; Figure 6 is a greatly enlarged schematic cross sectional view of a portion of a wall of an enclosure in accordance with a further embodiment of the present 20 invention; and Figure 7 is a circuit diagram representing the wall portions of Figure 6. Reference is first made to Figure 1 of the drawings, which illustrates a tamper respondent enclosure in 25 accordance with a preferred embodiment of the present invention. The enclosure 10 carries security sensitive information in an encryption module 12, access to the module 12 requiring use of a variable key, the nature of WO 99/21142 PCT/GB98/03125 7 the key being retained in a memory 14. As will be described, the enclosure is arranged to detect attempts to tamper with or penetrate the enclosure and accordingly contains an enclosure monitor 16 which, if tampering is 5 detected, activates an erase circuit 18 to erase the information stored in the memory 14 and encryption module 12. These components are mounted on and interconnected by a printed circuit board (PCB) 20, and are powered by a single battery 22. 10 The walls of the enclosure comprise three primary components: an inner metal enclosure portion 24; an intermediate enclosure portion 26 in form of a folded tamper respondent laminate 32; and an outer enclosure portion in the form of a moulding 28. As will be 15 described, the tamper respondent laminate 32 includes various detection layers which are monitored, via ribbon cable 30, by the enclosure monitor 16. The metal enclosure portion 24 provides physical protection against violent attempts to penetrate the enclosure 10 and disengage the 20 enclosure monitor 16 or erase circuit 18 before information can be erased from the encryption module 12. The enclosure portion 24 also operates in conjunction with the laminate 32 to detect attempts to penetrate the enclosure using small diameter metal drills, as will be described. 25_ The tamper respondent laminate 32 may take a variety of forms, as described in the above-identified patent applications. In this embodiment, the laminate 32 includes two primary layers 34, 35, as illustrated schematically in WO99/21142 PCT/GB98/03125 8 Figure 2 of the drawings. Each layer 34 comprises a thin insulating film 36, 37 carrying conductive tracks 38, 39, 40, 41 on the first and second sides thereof. The tracks 38 - 41 form a number of continuous conductors which will 5 be broken if attempts are made to penetrate the films 36, 37. The tracks 38 - 41 are connected to the monitor 16, which continually monitors the electrical condition of the tracks. The tracks 38 - 41 may be arranged in any suitable 10 pattern, and Figure 3 of the drawings illustrates non rectilinear "saw tooth" tracks 38 on the upper face of the film 36. The tracks 38 are formed of semi-conductive ink which has been printed onto the film 36. The tracks 39 on the opposite side of the film 36 are the same pattern but 15 are offset to lie directly below the spaces 42 between the tracks 38; the tracks 38, 39 are of a width and pitch, for example 250 and 500 microns, such that piercing of the film 36 at any point results in damage to at least one of the tracks 38, 39. 20 The films 36, 37 are adhered to one another by adhesive (not shown) and are adhered to and folded around the metal enclosure portion 24 (adhesive not shown), in a similar manner to gift wrapping a parcel. The film-wrapped metal enclosure portion 24 is located within a mould which 25 is filled with cold pour thermosetting resin. The resin is cured and hardened to form the outer enclosure portion 28. The PCB 20 carrying the encryption module 12, memory 14, monitor 16, erase circuit 18 and battery 22 are located WO99/21142 PCT/GB98/03125 9 within the metal enclosure portion 24, and the metal enclosure portion 24 is earthed to the PCB 20, as illustrated at 44 in Figure 5 of the drawings. If an attempt is made to penetrate the enclosure 10 5 using a small diameter metal drill 46 (see Figure 4), the drill 46 may pass relatively easily through the moulding 28 and the intermediate enclosure portion 26, before encountering the metal enclosure portion 24, and such a partial penetration of the enclosure 10 is illustrated in LO Figure 4 of the drawings. If the drill 46 is of sufficiently small diameter, it is possible that the drill may pass through one or more tracks 38 - 41 without interrupting the conductive path through the tracks. However, if, as illustrated in Figure 4, the drill 46 .5 passes through two tracks 38, 40, the metal drill 46 will form an electrical connection between the tracks 38, 40, which connection will result in a detectable change in an electrical characteristic of the conductors of which the tracks 38, 40 form a part. Further, even if the drill 48 .0 only passed through one of the tracks 38, on the drill 46 contacting the metal enclosure portion 24, the track would be earthed to the PCB 20, via the drill 46, the enclosure portion 24 and the earth connection 44, again providing a detectable change in one or more electrical characteristics .5 of the circuit of which the track 38 forms a part. In addition, the tracks 38 - 41 are formed of a low melt material, that is conductive ink which will melt at the elevated temperatures created by the action of the WO99/21142 PCT/GB98/03125 10 drill 46 passing through the intermediate enclosure portion 26. Thus, the conductive material which forms the tracks 38, 40 through which the drill 46 passes will be fluidised, and will flow through the holes 48, 49 created in the films 5 36, 37 by the drill 46; the fluidised material will provide a detectable electrical connection between the tracks 38, 40 and also between the tracks 38, 40 and the metal enclosure portion 24. Reference is now made to Figure 6 of the drawings, 10 which illustrates part of the wall 60 of an enclosure in accordance with another embodiment of the present invention. The wall 60 incorporates a tamper respondent laminate 32 as described above. However, located inwardly of the laminate 32 is a further laminate 62, as described 15 below. The laminate 62 comprises a very thin insulating film 63 of PET, PVC, polypropylene or PEN coated on each side with a layer of semi-conductive ink 64, 66. The ink is a low melt composition such that the ink will melt and flow 20 when drilled. Further, the ink is printed relatively thickly to the same thickness as the film 62. The elements of the laminates 32, 62 are connected to form a sensor circuit 68 as illustrated in Figure 7 of the drawings. The tracks are arranged to define conductors 70, 25 71, 72, 73 and are arranged as a balanced bridge circuit with reference voltages being applied at appropriate points in the circuit. The ink layers 64, 66 are illustrated as a normally open switch element.

WO99/21142 PCT/GB98/03125 11 Passage of a metal drill through the laminate 62 will create an electrical connection between the layer 64, 66, which will create a significant and detectable electrical imbalance in the circuit 68, detectable by the monitor 16. 5 Of course, the drill may also disrupt one or more of the tracks 38 - 41, which disruption will also be detected. From the above-description it will be apparent to those of skill in the art that the enclosures described above are secure against penetration attempts using small 10 diameter drills, and other small diameter probes. It will further be clear to those of skill in the art that the above-described embodiments are merely exemplary of the present invention, and that various modifications and improvements may be made to the enclosures without 15 departing from the scope of the invention. In particular, an enclosure in accordance with the invention may incorporate one or more of the many tamper respondent features described in the above-described patent applications. Further, in other embodiments, only a single 20 tamper respondent layer 34, 35 may be provided in combination with the metal enclosure portion. Alternatively, an enclosure wall of an embodiment of the invention may consist of a normally insulated metal enclosure or a conductive ink laminate which is monitored 25 to detect a conductive object, such as a metal drill or probe, contacting the enclosure or laminate and changing an electrical characteristic thereof.

Claims

1. A tamper respondent enclosure comprising: a wall including at least two layers; at least a first layer of the wall comprising a sheet 5 of insulating material having lines of conductive material on first and second sides thereof, said lines forming part of at least one sensor circuit; means for detecting an interruption in said at least one circuit; L0 a second layer of the wall comprising an area of conductive material separated from said lines by insulating material; and means for detecting an electrical connection between at least one of said lines and said area, L5 the layers of the wall being arranged such that, at any point in the wall, the wall section includes at least one of said lines and said area.

2. The enclosure of claim 1, wherein at least one of the layers of the wall is flexible. 20

3. The enclosure of claim 3, wherein at least one of the layers of the wall is formed of a folded sheet.

4. The enclosure of claim 1, 2 or 3, wherein at least one of the lines or the area is formed of a low melt material WO99/21142 PCT/GB98/03125 13 which is fluidised by the heat created by a drilling operation, such that the fluidised material will flow through the drilled hole and create an electrical connection between the line and the area.

5 5. The enclosure of any of claims 1 to 4, wherein the area of conductive material of the second layer comprises a conductive enclosure portion.

6. The enclosure of any of claims 1 to 5, wherein the area of conductive material of the second layer is of 10 metal.

7. The enclosure of any of the preceding claims wherein the area of conductive material of the second layer is provided by a rigid enclosure portion.

8. The enclosure of any of the claims 1 to 6, wherein the 15 area of conductive material of the second layer is of a flexible material.

9. The enclosure of any of the preceding claims wherein the second layer of the wall is provided internally of the first layer. 20

10. The enclosure of any of the preceding claims wherein the second layer of the wall is provided externally of the first layer. WO99/21142 PCT/GB98/03125 14

11. The enclosure of any of the preceding claims wherein the area of conductive material of the second layer is earthed.

12. The enclosure of claim 1, 2 or 3, wherein the area of 5 conductive material of the second layer is provided by lines of conductive material and said second layer comprises a sheet of insulating material with lines of conductive material on first and second sides thereof, said lines forming part of a sensor circuit and being provided 10 in combination with means for detecting an interruption in said circuit.

13. The enclosure of claim 12, wherein the sensor circuit of the second layer forms part of the sensor circuit for the first layer. 15

14. The enclosure of claim 12 or 13, wherein the detection means of the second layer also serves as the detection means for the first layer.

15. The enclosure of any of claims 1, 2, 3, 12, 13 or 14, wherein the first and second layers are of similar form. 20

16. The enclosure of any of the preceding claims wherein the lines of conductive material on the first and second sides of the first layer are arranged such that at any point in the layer a layer section includes at least one of WO99/21142 PCT/GB98/03125 15 said lines.

17. The enclosure of any of the preceding claims, wherein the lines of conductive material on the first and second sides of the first layer are non-rectilinear. 5

18. A method of forming a tamper respondent enclosure, the method comprising the steps: providing at least a first layer comprising a sheet of insulating material having lines of conductive material on first and second sides thereof; 10 connecting said lines to at least one sensor circuit including means for detecting an interruption in said at least one circuit; providing a second layer comprising an area of conductive material; 15 providing means for detecting an electrical connection between at least one of said lines and said area; and arranging the layers to define a wall of an enclosure such that, at any point in the wall, the wall thickness includes at least one of said lines and said area. 20

19. The method of claim 18, wherein at least one of the layers is flexible and is folded to define an enclosure.

20. A tamper respondent enclosure comprising: a first enclosure portion having a wall including a layer of insulating material carrying lines of conductive WO99/21142 PCT/GB98/03125 16 material thereon, said lines forming part of at least one sensor circuit; means for detecting an interruption in said at least one circuit; 5 a metal second enclosure portion; and means for detecting an electrical connection between at least one of said lines and said second enclosure portion.

21. The enclosure of claim 20, wherein the first enclosure 10 portion is defined by a folded flexible sheet.

22. The enclosure of claim 20 or 21, wherein the lines are formed of a low melt material which is fluidised by the heat created by a drilling operation, such that the 15 fluidised material will flow through the drilled hole and create an electrical connection between the lines and the area.

23. A tamper respondent enclosure comprising an insulated conductive enclosure portion and means for detecting a 20 change in an electrical characteristic of said enclosure portion resulting from a conducting object coming into electrical contact with the enclosure portion.

24. A method of protecting an enclosure against attempted penetration by a conductive object, the method comprising 25 the steps of: providing an insulated conductive enclosure WO99/21142 PCT/GB98/03125 17 portion; monitoring an electrical characteristic of said enclosure portion; and activating penetration response means in response to a change in said electrical characteristic resulting from a conductive object coming 5 into electrical contact with the enclosure portion.