High Sec Labs K204 User manual

User Manual
Model covered in this user manual:
K204 - Secure 4-port DVI-I KVM Switch
K204E - Secure 4-port DVI-I KVM Switch w/ DPP
Rev: 2.5 Doc No: HDC06148
User Manual: K204 & K204E Secure KVM Switch: 4-Port, DVI Video,
(DPP for 204E)

Table of Content
Introduction ....................................................................................... 2
Security Features ............................................................................... 3
Operational Features ......................................................................... 5
Equipment Requirements .................................................................. 6
Safety Precautions ............................................................................. 7
Front Panel Features –K204/K204E .................................................. 8
Rear Panel Features –K204/K204E.................................................... 9
Tamper Evident Labels..................................................................... 10
Active Anti-Tampering System......................................................... 10
Product Specifications...................................................................... 11
Before Installation............................................................................ 12
Installation ....................................................................................... 13
Operation......................................................................................... 16
DPP Operation.................................................................................. 17
Troubleshooting Guide .................................................................... 18
Copyright and Legal Notice.............................................................. 21
Record of Revisions
Rev
Date
Description of changes
1.0
Nov 11, 2010
Initial release
1.1
Nov 20, 2011
Internal review for CC evaluation
2.1
Dec 30, 2011
Released for customers
2.2
Feb 4, 2012
Added security procedures text
2.3
April 19, 2012
Added support for composite
devices
2.4
January 05, 2014
Change of composite port and
new DPP
2.5
February 15,
2015
Updated images and data

2
K204 & K204E Secure KVM Switch User Manual
Introduction
Thank you for purchasing this HSL Secure DVI-I KVM Switch.
The K204 and K204E are secure 4-port, DVI-I KVM Switches that allow
users to share peripherals - keyboard, mouse and monitor - between
four different security-level networks/computers. In addition to
supporting DVI-I dual-link signals, they support VGA and HDMI
interfaces with the use of the applicable adapters.
The K204E is also equipped with a USB user authentication port (DPP)
that enables connecting a Biometric or Smart Card Reader, requiring
the insertion of a physical authentication card or identification of a
fingerprint to access the various computers/networks.
The K204 and K204E are a perfect fit for high-security organizations
such as government agencies, military and financial institutions, and
any other organization that handles sensitive and confidential
information and are fully compatible with Common Criteria security
requirements.
This User Manual provides all the details you’ll need to install and
operate your new Switch, in addition to troubleshooting guidance—
in the unlikely event of a problem.
Package Contents
Inside product packaging you will find the following:
HSL Secure DVI-I KVM Switch unit
12V 1.5A DC Power Supply
DVI to VGA adapter plug

3
K204 & K204E Secure KVM Switch User Manual
Security Features
HSL Secure KVM Switch is the most advanced and secure
commercially available KVM Switch available today. This product is a
derivative of high security KVM product used in newest NATO nuclear
submarines. Below is a summary of some of the security features
incorporated into the product.
Unidirectional Data Paths
Optical diodes used to enforce unidirectional data flow from the
peripheral devices to computers preventing potential leakage paths
between computers even in the severe threat of two infected
computers attacking the KVM.
No Shared Resources
This KVM Switch designed to securely operate even when peripheral
devices are vulnerable to signaling attacks. This KVM Switch does not
allow computer access to any shared resource and does not share
controllable power sources.
Dedicated Processors for Emulation
The Switch features a dedicated processor per computer port to
emulate peripheral devices. This keeps each computer running on
different security levels physically separated and secure at all times,
and prevents any unintended data leakage between computers.
Non-Reprogrammable Firmware
The Switch features custom firmware that is not reprogrammable,
preventing the ability to remotely attack the KVM control logic.
EDID Emulation and Firewall
HSL Secure KVM Switch blocks the computer access to the shared
display by using isolated EDID emulators. This arrangement together
with the internal EDID firewall protects from KVM attacks targeting
the external memory effect of the shared display.
USB Ports Protection
Console USB ports are protected from the use of storage and other
unsafe USB devices through strong filtering (independent of
computer protection means). Unqualified devices are rejected when
connected to the Switch. Only mouse and keyboard data are passed
through.
Heavy-duty Steel Enclosure
HSL Secure KVM Switches uses thick steel components to protect the
product from physical tampering and to minimize radiated
electromagnetic emissions that can be snooped or intercepted.
Active Always-On Anti-Tamper
Active chassis anti-tamper system prevents the KVM electronic
circuitry from being accessed and tampered with by permanently
disabling the product once tampering is detected.
Holographic Tamper-Evident Labels
Four serially numbered holographic security tamper-evident labels
are placed on the enclosure surface to provide a visual indication if
the Switch has been opened or compromised.

4
K204 & K204E Secure KVM Switch User Manual
High Inter-Channel Analog Isolation
HSL Secure KVM Switches offers exceptionally high isolation between
computer channels to prevent analog leakages across the KVM.
Dedicated Peripheral Port
HSL patented Dedicated Peripheral Ports enables secure use of CAC
or smart-card readers leveraging security.
Common Criteria Listing
The Switch is listed by the Common Criteria organization.

5
K204 & K204E Secure KVM Switch User Manual
Operational Features
The HSL Secure KVM Switch was designed with the user in mind for
today’s IT environment. Below is a summary of some of the features
incorporated into the Product.
USB Support
HSL Secure KVM Switch product designed and tested to support the
widest variety of USB keyboards and mice.
Dedicate Peripheral Port
HSL K20xE Secure KVM Switch products supports parallel switching
of wide set of user authentication devices including CAC, smart-card
and biometric readers.
Keyboard Shortcuts Support
HSL Secure KVM Switch is the only Secure KVM that supports
keyboard shortcuts switching mode while providing highest level of
isolation.
DVI-I, HDMI & VGA Support
The Switch supports both digital (DVI-D and HDMI) and analog video
(VGA) displays and video cards.
Dual-link Video Support
HSL Secure KVM Switch supports dual-link digital video signals to
enable highest available display quality and resolutions.
Audio Support
Switch support audio out switching. Microphone switching not
supported to prevent analog leakages through audio ports.
Display Diagnostic LED
Special display diagnostic LEDs near each one of the console display
connectors provides essential guidance during installation.
KVM Extenders Support
HSL Secure KVM Switch supports most copper and fiber KVM
extenders connected to the console port.

6
K204 & K204E Secure KVM Switch User Manual
Equipment Requirements
Cables
It is highly recommended to use HSL Cable Kits for product to ensure
optimal security and performance.
One Cable Kit is required per connected computer.
Operating Systems
Product is compatible with devices running on the following
operating systems:
• Microsoft® Windows®
• Red Hat®, Ubuntu® and other Linux® platforms
• Mac OS® X v10.3 and higher.
USB Keyboard console port
The product console USB keyboard port is compatible with Standard
USB keyboards.
Notes:
a. For security reasons products do not support wireless
keyboards. In any case do not connect wireless keyboard to
product.
b. Non-standard keyboards, such as keyboards with integrated
USB hubs and other USB-integrated devices, may not be fully
supported due to security policy. If they are supported, only
classical keyboard (HID) operation will be functional. It is
recommended to use standard USB keyboards.
USB Mouse console port
The product console USB mouse port is compatible with standard
USB mice.
Notes:
a. Console USB keyboard and mouse ports are switchable, i.e.
you can connect keyboard to mouse port and vice versa.
However, for optimal operation it is recommended to
connect USB keyboard to console USB keyboard port and
USB mouse to console USB mouse port.
b. Console USB mouse port supports Standard KVM Extender
composite device having a keyboard/mouse functions.
c. For security reasons products do not support wireless mice.
In any case do not connect wireless mouse to product.
PS/2 Mouse and Keyboard console ports
The product console PS/2 keyboard and mouse ports are compatible
with standard PS/2 keyboards and mice.
Video Support
K204/K204E supports DVI-I displays as well as VGA and
HDMI via compatible cables.
Resolutions Supported
DVI Dual-link supports resolution up to 2560 x 1600.
DVI Single-link supports resolution up to 1920x1200.
User Audio Devices
Product is compatible with the following types of user audio
devices:
Stereo headphones;
Amplified stereo speakers.
Note: In any case do not connect a microphone to product audio
output port including headsets.
DPP Port (K204E)
The product operates with authorized USB devices plugged into the
console DPP Port, such as USB smart-card reader or Common Access
Card (CAC) reader.

7
K204 & K204E Secure KVM Switch User Manual
Safety Precautions
Please read the following safety precautions carefully before using
the product:
Before cleaning, disconnect the product from DC
power.
Be sure not to expose the product to excessive
humidity.
Be sure to install the product on a clean secure
surface.
Do not place the DC power cord in a path of foot
traffic.
If the product is not used for a long period of time,
remove the product’s wall-mount power supply from
the mains jack.
If one of the following situations occurs, get the
product checked by a qualified service technician:
The product’s power supply is overheated,
damaged, broken, causes smoke or shortens
the mains power socket.
Liquid penetrates the product’s case.
The product is exposed to excessive moisture
or water.
The product is not working well even after
carefully following the instructions in this
user’s manual.
The product has been dropped or is physically
damaged.
The product has obvious signs of breakage or
loose internal parts.
The product should be stored and used only in
temperature and humidity controlled environments
as defined in the product’s environmental
specifications.
The wall-mount power supply used with this product
should be the model supplied by the manufacturer
or an approved equivalent provided by HSL or an
authorized service provider. The use of improper
power source will void product warranty.

8
K204 & K204E Secure KVM Switch User Manual
Front Panel Features –K204/K204E
3
1a
2
1b
1c
1a-1c –Holographic Tamper Evident Labels
2 –DPP (Dedicated Peripheral Port) Freeze push-button and LED & selected channel LED [K204E model]
3 –Channel Select push-buttons and LEDs

9
K204 & K204E Secure KVM Switch User Manual
Rear Panel Features –K204/K204E
5
1a –Holographic Tamper Evident Label
2 –DPP (Dedicated Peripheral Port) console USB jack
[K204E only]
3 –RDC (Remote Desktop Controller) port RJ-45
4 –Audio console output 3.5 mm stereo jack
5 –USB Keyboard & Mouse jack
6 –PS/2 Keyboard & Mouse jack (Mini-DIN)
7 –Display diagnostic LED
8 –Console output DVI-I video connector
6
12
13
14
9 –Computer #2 group Keyboard/Mouse USB jack
10 - Computer #2 group DVI-I video input jack
11 - Computer #2 group audio input jack 3.5 mm stereo
12 –Computer #2 group DPP USB jack (Model K204E)
13 –DC Power input jack –barrel type
14 –Chassis ground connection screw
7
2
4
3
10
1a
8
9
11

10
K204 & K204E Secure KVM Switch User Manual
Tamper Evident Labels
HSL Secure KVM Switch uses 4 holographic tamper evident labels to
provide visual indications in case of enclosure intrusion attempt.
These labels indicate white dots or the text “VOID”once removed.
When opening product packaging inspect the 4 tampering evident
labels.
If for any reason one or more tamper-evident label is missing,
appears disrupted, or looks different than the example shown here,
please call HSL Technical Support and avoid using that product.
HSL Holographic Tampering Evident Label
Active Anti-Tampering System
HSL Secure KVM Switch is equipped with always-on active anti-
tampering system. If mechanical intrusion is detected by this
system, the Switch will be permanently disabled and LED will blink
continuously.
If product indication tampered state (all LEDs blinking) - please call
HSL Technical Support and avoid using that product.

11
K204 & K204E Secure KVM Switch User Manual
Product Specifications
Enclosure Steel metal enclosure
Power Requirements 12V DC, 1.5A (maximum) power
adapter with center-pin-positive
polarity
AC Input 100 to 240VAC
No. of Secure Channels 4
No. of Users Supported 1
No. of Computers Supported 4
Supported Displays and Resolutions
DVI Dual-link supports
resolution up to 2560 x 1600
DVI Single-link supports
resolution up to 1920x1200
HDMI supported through
adapters or cables
VGA display supported.
Resolution up to 2048x1536
Console Keyboard Input USB Type-A female connector or
PS/2 Mini-DIN 6 pin female
connector
Console Mouse Input USB Type-A female connector or
PS/2 Mini-DIN 6 pin female
connector
Console DPP Input USB Type A (K204E only)
Console Display Port 1 DVI-I dual-link female connector
Console Audio-Out 3.5mm stereo jack
CPU Keyboard/Mouse Ports USB Type-B jack
CPU DPP Ports USB Type-B jack (K204E)
CPU Audio Input 3.5mm stereo jack
CPU Video Input Port DVI-I dual-link female
Port Selectors 4
LED Indicators 4 channel LEDS.
DPP activation and chosen channel
LEDs (K204E only)
Operating Temp 32° to 104° F (0° to 40° C)
Storage Temp -4° to 140° F (-20° to 60° C)
Humidity 0-80% RH, non-condensing
Warranty 2 years; can be extended to up to 7
years at cost.
Dimensions 320(W) x 130 (D) x 52 (H) mm / 12.8
(W) x 5.2 (D) x 2 (H) inch
Weight 1.47 Kg. (3.2 lbs.)
Security Accreditation Common Criteria EAL 4+
Made in Israel
Product design life-cycle 10 years

12
K204 & K204E Secure KVM Switch User Manual
Before Installation
Unpacking the Product
Before opening the product packaging, inspect the packaging
condition to assure that product was not damaged during delivery.
When opening the package, inspect that the product Tamper Evident
Labels are intact.
Where to locate the Product?
The enclosure of the product is designed for desktop or under the
table configurations. An optional Mount Kit is available.
Product must be located in a secure and well protected environment
to prevent potential attacker access.
Consider the following when deciding where to place product:
Product front panel must be visible to the user at all times.
The location of the computers in relation to the product and
the length of available cables (typically 1.8 m)
Warning: Avoid placing cables near fluorescent lights, air-
conditioning equipment, RF equipment or machines that create
electrical noise (e.g., vacuum cleaners).).
Important:
1. If the unit’s enclosure appears disrupted or if all channel-
select LEDs flash continuously, please remove product
from service immediately and contact HSL Technical
Support at http://highseclabs.com/support/case/.
2. Do not connect product to computing devices:
a. That are TEMPEST computers;
b. That include telecommunication equipment;
c. That include frame grabber video cards
d. That include special audio processing cards.

13
K204 & K204E Secure KVM Switch User Manual
Installation
Connecting devices to product console
Product requires connection of all devices and computers prior to
powering it up.
Note: some devices such as user display would not be recognized if
connected after product is already powered up.
See figures above for connector locations.
Connect user display/s. Mark which display is coupled with which
computer. It is also recommended to mark which computer is
coupled with which channel.
Connect user keyboard and mouse to console keyboard and
mouse ports.
Connect headphones/speakers to console audio out port
(optional).
If the computer uses a smart card reader/USB device, connect
the smart card reader/USB device to the console DPP port
(optional, model pending).
Notes:
1. Console USB mouse and keyboard ports are switchable, i.e. you
can connect keyboard to mouse port. However, for optimal
operation it is recommended to connect USB keyboard to
console USB keyboard port and USB mouse to console USB
mouse port.
2. For security reasons products do not support wireless keyboards.
In any case do not connect wireless keyboard to product.
3. Non-standard keyboards, such as keyboards with integrated USB
hubs and other USB-integrated devices, may not be fully
supported due to security policy. If they are supported, only
classical keyboard (HID) operation will be functional. It is
recommended to use standard USB keyboards.
4. Console USB mouse port supports Standard KVM Extender
composite device having a keyboard/mouse functions.
2. Connecting the Computers
Using USB cables, connect each computer to the USB type B port
in "computer interface ports" area on product.
If computer uses audio output, e.g. speakers/headphones,
connect audio cable from its audio output port to the
corresponding audio input port on product.
If the computer uses a smart card reader/USB device, connect a
USB cable between the DPP-enabled computer and the
corresponding DPP port on product.
Note:
1. If the number of product channels is larger than the number
of sources used, make sure the computers are connected in
a row starting from computer #1. For example, if there are 3
channels used, connect computers to channels #1, #2 and
then #3.
2. The USB cable must be connected directly to a free USB port
on the computer, with no USB hubs or other devices in
between.
3. Power up
Connect DC power supply.
Power up user display/s. Select through display setup menu the
appropriate video input if applicable.
Power up the connected computers.
Power up the product.

14
K204 & K204E Secure KVM Switch User Manual
When you power up your computers, the product emulates display,
mouse and keyboard on each port and allows your computers to boot
normally. You should be able to move the mouse cursor on the
primary display connected to computer #1.
Check to see that the keyboard and mouse are working properly on
each computer.
Repeat this check with all occupied ports to verify that all computers
are connected and responding correctly.
If you encounter an error, check your cable connections for that
computer and reboot. If the problem persists, please refer to the
Troubleshooting section in this User Manual.
DPP Installation (204E)
In case computer and product support DPP functionality, such as
user authentication smart card reader, do the following:
1. Connect USB device, such as smart card reader, to DPP port
on product console
2. Connect DPP input port on product to any free USB port on
computer using a USB cable.
Note: Do not connect the USB cable if DPP functionality is
not needed for that computer.
If only some of the computers use DPP functionality, such as user
authentication, make sure that computer #1 is connected to the USB
device. If needed, switch channels/computer mapping to create this
configuration.
When product is powered ON and connected USB device is qualified
and ready for use, the DPP status LED ("Freeze") will illuminate steady
green.
If the USB device is detected but not authorized, as not being a
Smart Card or CAC reader, it will be rejected for security reasons.
This will be indicated by DPP status LED illuminating steady red.

15
K204 & K204E Secure KVM Switch User Manual
Typical system installation diagram (K204E)

16
K204 & K204E Secure KVM Switch User Manual
Operation
Now that you have connected your console and computers to the
Switch, it is ready for use. Default channel after power up is channel
#1 as indicated by channel select LED #1 illumination. You can select
which computer you wish to control by one of the following methods:
Default Channel
After product boots up, the default active channel will be channel
#1. This will be indicated by white color illumination of
push-button #1.
Product Mapping to Sources
Product mapping to sources is indicated by stickers/labels specifying
which channel is mapped to which computer.
Front Panel Push-Buttons
Following power up, the default channel is #1.
The user can select any other channel by pressing the appropriate
front panel push button.
The mouse cursor will be positioned at the center of the selected
computer display.
The currently selected channel is indicated by white color
illumination of the appropriate push-button.

17
K204 & K204E Secure KVM Switch User Manual
DPP Operation
The product is equipped with DPP port enabling connectivity to
external USB-devices such as smartcard reader.
Summary of rules that apply to DPP switching:
It is assumed that a "connected channel" is when:
1. Product is powered ON
2. The USB device connected to product console is qualified
and ready for use, as indicated by the DPP status LED
illuminating steady green.
3. The channel DPP port on product is connected via USB cable
to a USB port on computer.
When the USB device connected to the DPP console port is
qualified, the DPP status LED on the front panel would
illuminate steady green.
oWhen connecting a USB device that is rejected for
security reasons to the product's DPP port, the DPP
LED will illuminate steady red and USB device will be
inoperable. In such case the USB device must be
replaced with a qualified device, either USB smart
card or CAC reader.
Since channel #1 is the default active channel after power up
and in case only some of the channels operate with a USB
device, it is recommended to make sure computer #1 is
connected to USB device.
Once the user switches channels, for example to channel #3,
DPP functionality will move to computer #3 and be indicated
by channel #3 DPP LED turning steady green.
In case user switches to a channel that is not connected to a
USB device, the DPP function will remain with the last
channel that had DPP connection.

18
K204 & K204E Secure KVM Switch User Manual
Troubleshooting Guide
General
Problem: No power - No video output, none of the front panel LEDs
are illuminating.
Solutions:
Check AC cable connection to make sure product receives power
properly. Replace cable if needed. If problem persists, contact
your system administrator or our technical support.
Problem: Product enclosure appears disrupted or all channel-
select LEDs flash continuously.
Solution: The product may have been tampered with. Please
remove product from service immediately and contact
Technical Support.
Important Security Note:
If you are aware of potential security vulnerability while
installing or operating this product, we encourage you to
contact us immediately in one of the following ways:
Web form: http://www.highseclabs.com/support/case/
Email: [e-mail]
Tel: [phone] or [phone]
Important: If the unit’s enclosure appears disrupted or if all
channel-select LEDs flash continuously, please remove product
from service immediately and contact HSL Technical Support at
http://www.highseclabs.com/support/case/
Important: This product is equipped with always-on active anti-
tampering system. Any attempt to open the product enclosure
will activate the anti-tamper triggers and render the unit
inoperable and warranty void.

19
K204 & K204E Secure KVM Switch User Manual
Keyboard
Problem: Mouse and keyboard are not working (two channels)
Solutions:
Check that computer USB and video cables are not crossed
i.e. computer #1 video is connected to channel #1 while USB
keyboard and mouse cables are connected to channel #2.
Problem: Keyboard does not work (all channels)
Solutions:
Check that the keyboard you are using is properly connected
to product.
Check that the USB cable between the product and computer
is properly connected.
Try connecting keyboard to a different USB port on
computer.
Make sure the keyboard works when directly connected to
computer, i.e. the HID USB driver is installed on computer;
this may require computer reboot.
It is recommended to use standard USB keyboards and not a
keyboard with an integrated USB hub or other USB-
integrated devices.
If the computer is coming out of standby mode, allow up to
one minute to regain mouse function.
Try a different keyboard.
Do not use a wireless keyboard.
Mouse
Problem: Mouse cursor does not switch from primary to secondary
display.
Solutions: Driver supporting multiple displays was not installed or
not installed properly on computer. Reinstall driver.
Problem: Mouse and keyboard are not working (two channels)
Solutions:
Check that computer USB and video cables are not crossed
i.e. computer #1 video is connected to channel #1 while USB
keyboard and mouse cables are connected to channel #2.
Problem: Mouse does not work (all channels)
Solutions:
Check that the mouse you are using is properly connected to
product.
Check that USB cable between the product and computer is
properly connected.
Try connecting mouse to a different USB port on computer.
Make sure the mouse works when directly connected to
computer, i.e. the HID USB driver is installed on computer;
this may require computer reboot.
It is recommended to use standard USB mice.
If the computer is coming out of standby mode, allow up to
one minute to regain mouse function.
Try a different mouse.
Do not use a wireless mouse.
Problem: both keyboard and mouse are not working (one channel)
Solution: Use computer Device Manager Utility to see product and
solve problem.