Tektronix MSO56, MSO58, MSO64 Declassification and Security Instructions

xx
5/6 Series MSO With Option 5-SEC or 6-SEC Enhanced Security Instrument
ZZZ
Declassication and Security
Instructions
www.tektronix.com
077-1408-03
Copyright © Tektronix. All rights reserved. Licensed software products are owned by Tektronix or its subsidiaries or suppliers, and are protected by national copyright laws and international treaty provisions.
Tektronix products are covered by U.S. and foreign patents, issued and pending. Information in this publication supersedes that in all previously published material. Specications and price change privileges reserved.
TEKTRONIX and TEK are registered trademarks of Tektronix, Inc.
TekSecure is a trademark of Tektronix; Inc.
Contacting Tektronix
Tektronix, Inc. 14150 SW Karl Braun Drive P.O. B o x 5 0 0 Beaverton, OR 97077 USA
For product information, sales, service, and technical support:
In North America, call 1-800-833-9200. Worldwide, visit www.tek.com to nd contacts in your area.
Table of Contents
Preface ........... ................................ .................................. ................................ ................................................. iii
Supported products ........................................................................................................................................... iii
About the option .............................................................................................................................................. iv
Terms............................................................................................................................................................ v
Clear and sanitize procedures ..... . ..... ..... . ..... . ..... . .... . ..... . ..... . ..... ..... . ..... . ..... . .... . ..... . ..... . ..... . .... . ........ ............................ 1
Nonvolatile, volatile memory device table terminology.. . .... . . .... . ..... . ..... . ... . . ..... . ..... . ..... . .... . ..... . ..... . ..... . .... . ...................... 1
Memory devices ............................... ................................ .................................. .............................................. 2
Media and data export devices ............................................................................................................................... 6
Sanitizing the instrument...................................................................................................................................... 7
Resetting the instrument clock after CMOS reset.......................................................................................................... 8
How to clear or sanitize a nonfunctional instrument .... . ..... . ..... . .... . . .... . ..... . ..... . ..... . .... . ..... . ..... . ..... . .... . . .... . .......................... 10
Carrier interface assembly removal instructions ......... ................................ .................................. ............................... 10
Repair charges................................................................................................................................................. 17
Declassication and Security Instructions i
Table of Contents
ii Declassication and Security Instructions
Preface
This document helps customers with data security concerns to clear or sanitize the following instruments:
5 Series MSO with a serial number below B020000 or C040000 and factory-installed Option 5-SEC
6 Series MSO with factory-installed Option 6-SEC
This series of instruments contain a processor system with nonremovable mass storage.
These products have data storage (memory) devices and data export interfaces (USB and Ethernet). These instructions describe how to clear or sanitize the memory devices and disable the data output interfaces. The instructions also describe how to sanitize an instrument that is not functioning.
Reference
Supported products
The procedures in this document are written to meet the requirements specied in:
National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22–M, Chapter 8
Defense Security Service Manual for the Certication and Accreditation of Classied Systems under the NISPOM
Tektronix 5 Series and 6 Series Mixed Signal Oscilloscope products are covered by this d ocument:
NOTE.
The Option 5-SEC and 6-SEC must be ordered at the same time you order an instrument.
Declassication and Security Instructions iii
Preface
About the option
Option 5-SEC and 6-SEC provide the highest level of instrument security for the products. Option features include:
Oscilloscope hardware is configured to easily declassify the oscilloscope:
No user access to the internal m.2 storage to store or save any user data to the oscilloscope memory. Data can only
be saved to or read from a USB port on the instrument, a mounted network drive, or through the programmatic interface
The optional Windows OS solid state drive cannot be installed, because the hard drive connection bracket is
not available in the instrument
Password protection to enable/disable external USB Host, USB Device and Ethernet communication ports
Password protection to enable/disable rmware upgrades or downgrades
PasswordprotectiontopreventBIOSmodification and booting from USB flash devices.
NOTE.
iv Declassication and Security Instructions
Option 5-SEC and 6-SEC must be ordered at the same time you order an instrument.
Terms
Preface
The following terms may be used in this document:
Clear.
deny access to previously stored information by standard means of access.
Erase.
Media.
drive or USB port.
Sanitize.
This is typically used when the device is moved (temporarily or permanently) from a secured area to a nonsecured area.
Scrub.
Remove.
are available in the product service manual.
User-Accessible.
User-Modiable.
instrument user interface or remote control.
Volatile memory.
Nonvolatile memory.
Power off.
data, putting the instrument in Standby mode does not qualify as powering off. For these products, you m ust either push a rear-panel OFF switch or remove the power source from the instrument.
This eradicates data on media/memory before reusing it in a secured area. All reusable memory is cleared to
This is equivalent to clear.
Storage/data export device. A device that stores or exports data from the instrument, such as a USB ash
This removes the data from media/memory so that the data cannot be recovered using any known technology.
This is equivalent to sanitize.
This is a physical means to clear the data by removing the memory device from the instrument. Instructions
The user can directly retrieve the memory device contents.
The memory device can be written to by the user during normal instrument operation, using the
Memory that loses data when the instrument is powered off.
Memory that retains data when the instrument is powered off.
Some instruments have a “Standby” mode, in which power is still supplied to the instrument. For clearing
Instrument Declassication.
removed from a secure environment. Declassication procedures include memory sanitization, memory removal, and sometimes both.
Declassication and Security Instructions v
A term that refers to procedures that must be undertaken before an instrument can be
Preface
vi Declassication and Security Instructions
Clear and sanitize procedures
Nonvolatile, volatile memory device table terminology
The tables in this section use the following terms:
User data
information representing signals connected to the instrument by users.
User settings
changed by the user.
Both.
stored in the device.
None.
stored in the device.
Directly.
Indirectly.
the user cannot modify the data.
. Describes the type of information stored i n the device. Refers to waveforms or othe r measurement
. Describes the type of information stored in the device. Refers to instrument settings that can be
Describes the type of information stored in the device. It means that both user data and user settings are
Describes the type of information stored in the device. It means that neither user data or user settings are
Describes how data is modied. It means that the user can modify the data.
Describes how data is modied. It means that the instrument system resources modies the data and that
Declassication and Security Instructions 1
Clear and sanitize procedures
Memory devices
Table1: Volatilememorydevices
The following tables list the volatile and nonvolatile memory devices in the instrument1.
Type of user
Type and size Function
SDRAM 16 GB (All models)
SDRAM MSO54: 4 GB MSO56/8: 8 GB MSO64: 16 GB
SDRAM 4 GB
CMOS RAM 256 bytes
FPGA <30 MB Interface between
1
These are the memory capacities at the time of publishing this document, but are subject to change.
Host processor memory
Holds active acquisition data
Holds video graphics data
Holds clock and BIOS conguration data
compute system and acquisition system
info stored
User data No Indirectly Written by
User data No Indirectly Application
User data No Indirectly Application
None Yes Indirectly
None No None Written by
Backed-up by battery
Method of modication
Data input method Location
processor system
software operations
software operations
BIOS operations
processor system
Module socket (SODIMM) on the carrier interface assembly
Module socket (SODIMM) on the acquisition board
Acquisition board
Carrier interface assembly
Acquisition board
User accessible To clear To sanitize
No Unplug the instrument
No Unplug the instrument
No Unplug the instrument
Yes Unplug the instrument
No Unplug the instrument
for at least 30 seconds
for at least 30 seconds
for at least 30 seconds
for a minimum of 30 seconds.
Push the CMOS clear button on the bottom of the instrument for a minimum of 30 seconds. (See
Resetting the
page 8,
instrument clock after CMOS reset
for a minimum of 30 seconds.
.)
Unplug the instrument for at least 30 seconds
Unplug the instrument for at least 30 seconds
Unplug the instrument for at least 30 seconds
Unplug the instrument for a minimum of 30 seconds.
Push the CMOS clear buttononthebottom of the instrument for a minimum of 30 seconds. (See
Resetting the
page 8,
instrument clock after CMOS reset
Unplug the instrument for a minimum of 30 seconds.
.)
2 Declassication and Security Instructions
Clear and sanitize procedures
Table 2: Nonvolatile memory devices
Type and size Function
Linux Solid State Drive Card 512 GB
EEPROM 2Kbit
EEPROM 2Kbit
EEPROM 64 Kbit
Host instrument Linux operating system, application software, and Ethernet IP and related settings
Stores factory data, maintenance data
Holds AFG calibration data, USB/Ethernet port access password
Holds t he front panel USB conguration
2
Type of user info stored
Instrument settings including analog channel, digital channel, AFG, DVM, etc. AFG waveform information. User-saved waveforms, screen shots, and settings les. Option licenses. SPC
None Indirect Factory
Port access password
User Password: Allows user to specify a string in the About menu and lock it with password
None None Factory
1
.
Method of modication
Directly settable from UI or by using PI commands
Directly settable from UI or by using PI commands
Data input method Location
Written by processor system, software operations
operations
Factory operations
operations
Socket (m.2) on the carrier interface assembly
Acquisition board
AFG riser board
Front panel LED board
User accessible To clear To sanitize
Yes
Yes Not applicable, does
No
No Not applicable, does
(See page 7,
the instrument
not contain user data or settings. Clearing would disable instrument functionality.
(See page 7,
the instrument
not contain user data or settings. Clearing would disable instrument functionality.
Sanitizing
.)
Sanitizing
.)
(See page 7,
instrument
Not applicable, does not contain user data or settings. Clearing would disable instrument functionality.
(See page 7,
instrument
Not applicable, does not contain user data or settings. Sanitizing would disable instrument functionality.
Sanitizing the
.)
Sanitizing the
.)
Declassication and Security Instructions 3
Clear and sanitize procedures
Type and size Function
EEPROM 1Kb Four to six pieces depending on model
Flash Memory 16 Mbit Two pieces
Flash Memory 128 Mbit
Flash Memory 32 Kbit Three pieces
Flash Memory 32 KB
Holds the SODIMM memory conguration data (SPD)
Holds a part of the Acquisition FPGA conguration
Stores processor BIOS rmware, BIOS conguration, and embedded controller rmware. The Ethernet MAC address is stored in this device.
Stores power supply conguration data
Stores power management controller rmware
Type of user info stored
None None Factory
None Indirect Application
None Indirect
None Indirect Application
None Indirect Application
Method of modication
Data input method Location
operations
software operations
BIOS operations, operating system operations and factory operations
software operations
software operations
Module socket (SODIMM) on the carrier interface assembly and module socket (SODIMM) on acquisition board
Acquisition board
Processor module board
Internal to the UCD9248 power supply controller on the acquisition board and carrier interface assembly
Internal to the MC9S08 microcontroller on the acquisition board
User accessible To clear To sanitize
No Not applicable, does
not contain user data or settings. Clearing would disable instrument functionality.
No Not applicable, does
not contain user data or settings. Clearing would disable instrument functionality.
No Not applicable, does
not contain user data or settings. Clearing would disable instrument functionality.
No Not applicable, does
not contain user data or settings. Clearing would disable instrument functionality.
No Not applicable, does
not contain user data or settings. Clearing would disable instrument functionality.
Not applicable, does not contain user data or settings. Sanitizing would disable instrument functionality.
Not applicable, does not contain user data or settings. Sanitizing would disable instrument functionality.
Not applicable, does not contain user data or settings. Sanitizing would disable instrument functionality.
Not applicable, does not contain user data or settings. Sanitizing would disable instrument functionality.
Not applicable, does not contain user data or settings. Sanitizing would disable instrument functionality.
4 Declassication and Security Instructions
Clear and sanitize procedures
Type of user
Type and size Function
Flash Memory 64 KB MSO64: 1 piece MSO54: 2 pieces MSO56: 3 pieces MSO58: 4 pieces
Flash Memory (6 Series MSO) 43 KB Four pieces
Flash Memory
0.33 Mbit
1
SPC (signal path compensation) information is stored on the Linux m.2 card. SPC does not contain any user settings.
2
These are the memory capacities at the time of publishing this document, but are subject to change.
Stores analog board microcontroller rmware
Stores analog board microcontroller rmware
Stores the processor carrier FPGA conguration
info stored
None Indirect Application
None Indirect Application
None None Factory
Method of modication
Data input method Location
software operations
software operations
operations
Internal to the MKL14 microcontroller on the analog board
Internal to the MKL02 microcontroller on the analog board
Internal to the LCMXO2 FPGA on the carrier interface assembly
User accessible To clear To sanitize
No Not applicable, does
not contain user data or settings. Clearing would disable instrument functionality.
No Not applicable, does
not contain user data or settings. Clearing would disable instrument functionality.
No Not applicable, does
not contain user data or settings. Clearing would disable instrument functionality.
Not applicable, does not contain user data or settings. Sanitizing would disable instrument functionality.
Not applicable, does not contain user data or settings. Sanitizing would disable instrument functionality.
Not applicable, does not contain user data or settings. Sanitizing would disable instrument functionality.
Declassication and Security Instructions 5
Clear and sanitize procedures
Media and data export devices
The following table lists the data export devices in the instrument.
Table 3: Media and data export devices
Type Function
USB Host ports User storage and recall of
reference waveforms, screen images, and instrument setups, and installation of rmware updates using removable USB ash drives
USB Device port
Ethernet
Remote control and data transfer to a PC
Transfer data and remote control of instrument.
Method of modication
Directly User writeable
Directly Remote control
Directly Remote control
Data input method Location User accessible To disable
using USBTMC
using LXI, VISA, or Socket Server
Three USB Host ports on front of the instrument; four USB Host ports on the back of the instrument
USB Device port on back of the instrument
Ethernet port on back of instrument
Yes
Yes
Yes
Use the to disable all USB ports (Host and Device). Requires a password (user-created when rst disabled)
Use the to disable all USB ports (Host and Device). Requires a password (user-created when rst disabled)
Use the to disable the Ethernet LAN port. Requires a password (user-created when rst disabled)
Utility > Security
Utility > Security
Utility > Security
menu
menu
menu
6 Declassication and Security Instructions
Sanitizing the instrument
1.
2.
Clear and sanitize procedures
Remove any USB memory devices from the instrument, and store or destroy the USB memory devices in accordance with your organization’s guidelines.
Clear the Ethernet port settings:
a.
Disconnect the Ethernet cable from the instrument.
b.
Open the
c.
Clear all information from the
d.
Click the Network Address
e.
Manually change the information to
f.
Tap
g.
Tapoutsidethemenutoclosethemenu.
NOTE.
instrument to your network, enter the instrument’s IP address into a Web browser on a PC that is connected to the same network a s the instrument, click the Mode box, clear all information from all elds, and click the
3.
4.
You can also clear the instrument Address settings by accessing the instrument’s web-based interface. Connect the
Open the
Clear the Network Conguration password:
a.
Enter the instrument’s IP address into a Web browser on a PC that has network access to the instrument.
b.
Click the
Utility > I/O
00.00.00.00
Apply Changes
Utility > Security
Security for Network Cong
menu.
Instrument IP Address,Subnet Mask,Gateway IP Address
.
. It will take several moments for the changes to take effect.
menu and clear the password used to access enabling/disabling ports and software updates.
Host Name,Domain Name
Manual
Network Conguration
button.
link on the left side of the screen.
Service Name
,and
link on the left side of the screen, select the Manual TCP/IP
Submit
button for the Address Settings.
elds.
DNS IP Address
,and
Declassication and Security Instructions 7
Clear and sanitize procedures
c.
5.
Clear the network mDNS Hostname and description:
a.
b.
c.
d.
e.
6.
Tap
7.
Push the
Submit
Click
If a password was set for this function, you are requested to enter the password. If the password is accepted, the
password is set to blank (the default setting of the access password elds).
If a password was not set for this function, the screen displays the message that the password was successfully
changed (to a blank password).
Enter the instrument’s IP address into a Web browser on a PC that has network access to the instrument.
Click the
Delete any existing text in both of the Host Settings elds.
Click the Host Settings the original factory default value.
ClickOK. The message closes and the elds are restored to their original factory settings.
TekSecure Erase Memory
Default Setup
:
Network C onguration
Submit
button before powering off the instrument.
Resetting the instrument clock after CMOS reset
link on the left side of the screen.
button. A message appears stating that the eld is empty, and will be configured to
to clear/reset internal m emory.
Do the following steps to reset the instrument clock after a CMOS reset:
1.
Connect a keyboard to the instrument.
2.
Power on the instrument.
3.
While the instrument is powering on, continuously tap the
8 Declassication and Security Instructions
F11
function key until the
BIOS Login
screen appears.
Clear and sanitize procedures
4.
Enter the password (yours or the default password). If you are logging in for the rst time, the factory installed password is “ password in accordance with your organization’s policies.
Tektronix
”. Once you have logged in using the factory default BIOS password, create and enter a new
WAR NI NG .
for Tektro nix to gain access to the instrument BIOS settings once the password is changed from the factory default value. If youneedtoreturntheinstrumenttoTektronixforservice,you must reset the BIOS password back to the factory default value “
5.
The
6.
Use the down arrow key to select
7.
In the Main tab (default), use the down arrow to select describedonthescreentoselectandenter correct information in the date elds.
8.
In the Main tab (default), use the down arrow to select described on the screen to select and enter correct Coordinated Universal Time (UTC) information in the date elds. Use the Web to determine the current UTC time. (note; Do not enter your local time.)
9.
Once the time is set, press theF4key to save this value and exit the setup screen. The instrument powers on to the normal oscilloscope view.
10.
Double-tap the
11.
Tap the Time Zone eld and select the correct time zone for your instrument location.
12.
Enable the
Make sure to keep a record of the instrument BIOS password in your organization’s records. There is no way
Tektr onix
Please select a boot device
” before sending to the Tektronix Service Center.
screen appears.
Enter Setup
Date and Time
Automatically adjust clock for Daylight Savings Time
badge in the lower right of the screen.
and press
Enter
.
System Date
System Time
. If the date is not current, use the keys as
. If the time is not current, use the keys as
functionifusedinyourtimezone.
13.
Tap outside the menu to close the time zone setting.
Declassication and Security Instructions 9
How to clear or sanitize a nonfunctional instrument
How to clear or sanitize a nonfunctional instrument
An instrument with this option only stores user instrument settings, last waveform acquisition data, port-enable passwords, and Ethernet IP settings on the instrument. Do the following to clear or sanitize your instrument if it is not functioning and must be returned to Tektronix for repair:
1.
Remove all external USB memory devices and store or destroy the USB memory devices in accordance with your organization’s guidelines.
2.
Follow the instructions in section Carrier interface assembly removal instructions to get access to the rear chassis and remove the carrier interface assembly. Store or destroy the carrier interface assembly in accordance with your organization’s guidelines. (See page 10.)
3.
Reassemble the instrument without the carrier interface assembly and return it to Tektronix. The instrument will then be repaired and calibrated as necessary.
In North America, contact the Tektronix Customer Care Center (1-800-833-9200) for assistance with returning the instrument to a repair center. Worldwide, visit www.tektronix.com to nd contacts in your area.
Carrier interface assembly removal instructions
Use these procedures to get access to the rear chassis and remove the carrier interface assembly, to sanitize a nonfunctional instrument before returning the instrument to Tektronix for repair. Refer to your company's internal policies regarding handling or disposal of the carrier interface assembly. A new carrier interface assembly is installed and the instrument is repaired and adjusted as necessary.
WARNING.
cause serious injury or death.
CAUTION.
with proper electrostatic discharge controls in place.
10 Declassication and Security Instructions
Before doing this procedure, disconnect the power cord from the line voltage source. Failure to do so could
To avoid damaging other circuits in the instrument, perform the following procedure in a static-safe environment
Separate the rear chassis
from the front chassis
How to clear or sanitize a nonfunctional instrument
1.
Remove the handle from the instrument:
a.
Use a Torx T10 screwdriver to remove two screws from each end of the handle.
b.
Separate the handle from the hubs.
c.
Set the handle and the two plastic hub parts aside.
2.
Lay the instrument on its front on a soft antistatic foam pad or similar, to protect the buttons and knobs from damage while disassembling the instrument.
3.
Remove the metal grill from the rear of the instrument:
a.
Use a Torx T8 screwdriver to remove the six (6) screws located on the grill.
b.
Remove the grill.
4.
Remove the feet from the bottom of the instrument:
a.
Open the feet.
b.
Use a Torx T10 screwdriver to remove the four (4) screws from each foot.
c.
Remove the feet and set aside.
5.
Remove the rear case from the instrument:
a.
Use a Torx T10 screwdriver to remove the six (6) screws from the back of the instrument.
b.
Lift the rear case off the back of the instrument, and set it aside.
Declassication and Security Instructions 11
How to clear or sanitize a nonfunctional instrument
6.
Separate the rear chassis from the front chassis:
a.
For 5 Series instruments: use needle nose pliers to carefully remove the aluminum tape along the bottom edge of the chassis. Discard or recycle the removed aluminum tape pieces.
WARNING.
CAUTION.
Do not use ngers to remove the aluminum tape. The tape is sharp and can cause injury.
Be careful when removing tape from across cables to prevent damage. Pull the tape off parallel to (across) the chassis surface; do not pull the tape off by pulling straight out from the cable. Hold down the exposed cable when removing the rest of the tape.
b.
Use a Torx T-10 screwdriver to remove the 18 screws (5 Series instruments) or 19 screws (6 Series instruments) securing the rear chassis to the front chassis. There are ve screws each along the top and bottom, and four screws on each side.
c.
Insert a large at blade screwdriver no more than 1/4 inch into the rectangular slot on the corner of the rear chassis (see following image). Rotate the screwdriver to lift the corner of the rear chassis from the front chassis. Repeat on each corner. There may be a little resistance from the front right corner of the bottom edge, where the rear chassis interconnects to the front chassis.
12 Declassication and Security Instructions
Remove the carrier
interface assembly
How to clear or sanitize a nonfunctional instrument
d.
When loose, lift off the rear chassis of the instrument.
7.
Set the front half of the instrument aside.
1.
Use a Torx T10 screwdriver to remove the eight (8) screws from the bottom of the rear chassis.
2.
Use a Torx T10 screwdriver to remove the one (1) screw from the back of the rear chassis.
Declassication and Security Instructions 13
How to clear or sanitize a nonfunctional instrument
3.
Use a 3/16 nut driver or wrench to remove the four (4) standoff jack screws from the back of the rear chassis. See above image.
4.
Inside the rear chassis, remove the bafe:
a.
Use a Torx T10 screwdriver to remove the 4 (5 Series instruments) or 12 (6 Series instruments) screws holding the bafeinplace.
5SeriesMSO:
14 Declassication and Security Instructions
How to clear or sanitize a nonfunctional instrument
6SeriesMSO:
b.
For 5 Series instrument: lift from the end farthest from the sides and pull the bafe from the instrument. The baffle end has tabs that t into the side chassis, and registration bumps near the right edge of the fan. The baffle fits tight and can require some effort to remove.
For 6 Series instrument: lift from the right side and pull the bafe from the instrument. The baffle fi ts tight and can require some effort to remove.
c.
Set the baffleaside.
5.
Disconnect the four (4) cables from the carrier interface assembly, AFG riser board, and AC power lter.
Declassication and Security Instructions 15
How to clear or sanitize a nonfunctional instrument
6.
On the 5 Series MSO: Inside the rear chassis, use a Torx T8 screwdriver to remove the two (2) screws at the front edge of the carrier interface assembly bracket (tray).
7.
On the 6 Series MSO: Inside the rear chassis, use a Torx T8 screwdriver to remove the two (2) screws at the front edge of the carrier interface assembly bracket (tray).
16 Declassication and Security Instructions
How to clear or sanitize a nonfunctional instrument
8.
Lift the front half of the carrier interface assembly off the rear case enough to clear the mounting screw posts, and slide the carrier interface assembly out of the instrument. There is slight resistance from the spring clips on the rear panel I/O connectors. If the carrier interface assembly will not slide out, check that you have removed the eight screws from the bottom of the chassis (step 1) and the one screw and four jack screws from the rear of the chassis (steps 2, 3).
9.
Secure or dispose of the carrier interface assembly as directed by your organization’s internal policies regarding handling or disposal of secure devices.
10.
To reassemble the instrument, reverse the disassembly process.
a.
Tighten Torx T10 screws to torque of 0.65 Newton meters.
b.
Tighten Torx T8 screws to torque of 0.45 Newton meters.
Repair charges
Replacement of damaged and missing hardware is charged according to the rate at the time of replacement.
Declassication and Security Instructions 17
Loading...