Raritan Compliant Desktop KVM Secure Switch

This document contains proprietary information that is protected by copyright. All rights reserved. No part of this document may be photocopied, reproduced, or translated into another language without the express prior written consent of Raritan, Inc.

© Copyright 2024 Raritan, Inc. All third-party software and hardware mentioned in this document are registered trademarks or trademarks of and are the property of their respective holders.

FCC Information
This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a commercial installation. This equipment generates, uses, and can radiate radio frequency energy and if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. Operation of this equipment in a residential environment may cause harmful interference.

VCCI Information (Japan)

Raritan is not responsible for damage to this product resulting from accident, disaster, misuse, abuse, non- Raritan modification of the product, or other events outside of Raritan’s reasonable control or not arising under normal operating conditions. If a power cable is included with this product, it must be used exclusively for this product.

Attention

Read the following sections before operating the Secure Switch.

Important Message:
The device is equipped with a 3-wire grounding type plug as safety. If you are unable to insert the plug into the outlet, contact your electrician to replace your obsolete outlet. Do not attempt to defeat the purpose of the grounding-type plug. Always follow your local/national wiring codes.

DO NOT use the product in these scenarios:
When you observe any issues below, do not use the product and contact your dealer immediately.

• The tamper-evident seal is missing or peeled. The diagram below indicates the location of the seal.
• All front panel LEDs flash continuously.
• The Secure Switch’s enclosure appears breached.

Chassis-intrusion-detection security:

• This Secure Switch is equipped with active always-on chassis intrusion detection. Any attempt to open the enclosure will permanently damage or disable the Secure Switch, and void the warranty.

Introduction

Overview
Raritan Secure Switch series is NIAP-certified and compliant with NIAP PP 4.0 (Protection Profile for Peripheral Sharing Switch version 4.0) requirements, meeting the latest security requirements set by the U.S. Department of Defense for peripheral sharing switches. Compliance ensures maximum information security while sharing a single set of HIDs (keyboards, mice, speakers, and CAC readers) between multiple computers. Conformity with Protection Profile v4.0 certifies that other USB peripherals cannot be connected to the console ports of Secure Switch, and that only a keyboard and a mouse are accommodated, therefore providing high-level security, protection and safe-keeping of data.

The Secure Switch’s hardware security includes tamper-evident tape, chassis intrusion detection, and tamper-proof hardware, while software security includes restricted USB connectivity – non HIDs (Human Interface Devices) are ignored on port switching. An isolated channel per port makes it impossible for data to be transferred between secure and unsecure computers. In addition, the keyboard and mouse buffer are cleared on port switching. By combining physical security with controlled USB connectivity and controlled unidirectional data flow from devices to connected computers only, the Secure Switch series gives you the means to consolidate multiple workstations of various security classification levels with one KVM (keyboard, monitor and mouse) console.

Notes:

• The National Information Assurance Partnership (NIAP) is a United States government initiative to meet the security testing needs of IT consumers and manufacturers. It is operated by the National Security Agency (NSA) and the National Institute of Standards and Technology (NIST).
• Raritan Secure Switch series additionally satisfies Protection Profile version 4.0 for Peripheral Sharing Device (PSD).
• USB 1.1 for keyboard, mouse connections, and USB 2.0 for CAC reader connection.

Features

Product Overview

4 port HDMI Dual Head Secure Switch with CAC :
Model: RSS4-104-DUAL

Front View

Rear View

• 4‑port DisplayPort Dual Head Secure Switch with CAC:
• Model: RSS4-104-DUAL-DP

Front View

Rear View

Package Contents

A Raritan Secure Switch package consists of:

• 1 Secure Switch
• 1 power cord
• 1 user guide
• 1 warranty card

Note: Secure Switch KVM cables are NOT included with the Secure Switch. You must purchase them from Raritan separately.
Note: Remote Port Selector (RSS4-WPS) can be purchased separately

Configuration Requirements

User Console Connection
On the Secure Switch, HDMI and Display port models can be connected using standard cables. All HDMI/Display port models support the digital video as per their  resolution capabilities.

User console connection requires:

• HDMI/Display port cables for digital video
• A USB mouse
• A USB keyboard
• Analog speakers or headphones (optional)
• A USB smart card or Common Access Card (CAC) reader (optional)
  Important: Secure Switch does NOT support all USB keyboards or all card readers. For details, see: Using Qualified Peripheral Devices Only (on page 14).

Connected Computers or Servers

The computers or servers to be connected to the Secure Switch using standard cables must have the following ports and connectors.

• A DisplayPort or HDMI video output connector, depends on the selected models
• A USB Type A port for keyboard and mouse
• A USB Type A port for smart card or CAC reader
• A 3.5mm-jack audio port for speakers
  Important: For security purposes, DO NOT connect any audio cable supporting Microphone audio input or Line in to the Secure Switch.

Operating Systems
It is suggested the connected computers (or servers) should only run one of the following operating systems.

Note: The Secure Switch also supports Linux Kernel 2.6 and higher.

Secure Switch Ports and Connectors

The following diagrams illustrate the RSS4-104-DUAL model, a 4-port Dual Head USB HDMI Secure Switch which supports CAC.

Front View

Rear View

Remote Port Selector (RSS4-WPS)
The remote port selector allows you to switch between connected computers

Hardware Setup

Before You Begin
Before using the Secure Switch, make sure you have read Attention (on page 4).

Tampering Prevention and Detection

• The Secure Switch and Remote Port Selector include a tamper-evident tape to provide visual indications of intrusion to its enclosure. If the tamper-evident seal is missing, peeled, or looks as if it’s been adjusted, DO NOT use it and contact your Raritan dealer immediately
• The Secure Switch and Remote Port Selector are equipped with active always-on chassis intrusion detection. If a mechanical intrusion is detected, the Secure Switch will be permanently disabled and its front panel LEDs will flash continuously. If this product’s enclosure appears breached or all LEDs are flashing continuously, stop using it, remove it from service immediately and contact your dealer.
• Never attempt to open the Secure Switch’s or Remote Port Selector’s enclosure. Any attempt to open the enclosure will permanently damage and disable this product. The attempt to open its enclosure will activate the chassis intrusion detection security, which will render it inoperable and void the warranty.
• The Secure Switch and Remote Port Selector cannot be upgraded, serviced or repaired.
• The Secure Switch contains an internal battery which is non-replaceable. Never attempt battery replacement or open the Secure Switch’s enclosure.

Using Qualified Peripheral Devices Only
For security purposes, you must always connect supported and authorized peripheral devices to the Secure Switch. Otherwise, the Secure Switch may not function properly.

USB keyboard and mouse:

• The Secure Switch only supports a standard USB keyboard and mouse (or pointing device).
• DO NOT use the following keyboards and/or mice.
• A wireless keyboard or mouse
• A keyboard or mouse with internal USB hub or composite device functions
• If connecting an unsupported keyboard, the keyboard will not function. No keystrokes will be displayed on the screen.Using Qualified Peripheral Devices Only For security purposes, you must always connect supported and authorized peripheral devices to the Secure Switch. Otherwise, the Secure Switch may not function properly.

USB keyboard and mouse:

• The Secure Switch only supports a standard USB keyboard and mouse (or pointing device).
• DO NOT use the following keyboards and/or mice.
• A wireless keyboard or mouse
• A keyboard or mouse with internal USB hub or composite device functions
• If connecting an unsupported keyboard, the keyboard will not function. No keystrokes will be displayed on the screen.

Note that the Secure Switch automatically disables some functions on the connected keyboard for security purposes.

• Num Lock LED
• Caps Lock LED
• Scroll Lock LED
• Special multimedia keys
• If connecting an unsupported mouse, the mouse will not function. No mouse cursor movement will be displayed on the screen.

Video:

• You can use a HDMI or DisplayPort monitor connected to the HDMI or DisplayPort port of the Secure Switch User Console, depending on the selected model
• Only use a supported monitor. When connecting a monitor to the Secure Switch, the Secure Switch will filter the connected monitor by checking the monitor’s EDID (Extended display identification data). If the check fails, the Secure Switch will reject the monitor and the video content will not be displayed on the monitor.
• DO NOT use wireless video transmitters or any docking device.

Audio:

• Connect standard “analog” speakers or headphones only.
• The Secure Switch does not support an analog microphone or line-in audio input. Do not connect a microphone to the Secure Switch’s audio output port, including a headset with the microphone.
• NO Thunderbolt™ technology devices:
• DO NOT connect any Thunderbolt™ technology device.

USB card reader (optional):

• The Secure Switch’s USB CAC port supports only authorized User-Authentication Devices by default, such as a USB smart card or CAC reader.
• DO NOT connect non-User-Authentication USB devices to the USB CAC port. Unqualified or unauthorized USB devices will be rejected.
• DO NOT use a USB CAC Authentication Device or other peripheral devices that adopt an external power source.
• For a list of supported card readers, see: Supported Card Readers (on page 15).

Supported Card Readers
The following USB smart card or CAC readers are supported by Secure Switch. Other types of card readers may also work but Raritan has not tested their operation.

• Omnikey6121
• SCM_SCR3310
• CHERRY_ST-1044U
• ACS ACR38U-A1
• ACS ACR38T-IBS-R
• InfoLink_IT100
  Important: It is highly recommended that you install the proprietary driver of your card reader onto the computer(s), which is either shipped with the card reader or can be downloaded from the official website of the card reader’s vendor. If not, the card reader may not function properly.

Secure Installation Guidelines

• DO NOT attempt to connect or install the following devices to the computers connected to the Secure Switch.
• TEMPEST computers
• Telecommunications equipment
• Frame grabber video cards
• Special audio processing cards
• Before installation, make sure the power sources to all devices involved in the installation are turned off.
• Hot-swapping of the console monitor is NOT supported. You must power OFF the Secure Switch and console monitor before changing or re‑connecting the monitor. Power them back ON after finishing the monitor connection.
• A computer should only be powered on after all of the cable connections to the Secure Switch are finished, including video, USB and audio.
• Important safety information regarding the placement of this device is provided in the topic titled Safety Instructions (admin) in the Administrators Guide. Please review it before proceeding.

Secure Operation and Administration

Stacking

• The Secure Switch features a rugged, metal enclosure which provides stability and allows the device to be stacked on the desktop.
• It can be placed on any level surface that can safely support its weight and the weight of all attached cables.
• Ensure that the surface is clean and free of materials that can block the exhaust vents or otherwise interfere with normal operation of the Secure Switch.

Installation Procedure
To install your Secure Switch system, power OFF all devices and then follow the procedure below, which corresponds to the numbers of the installation diagram following this topic.

Important: You CANNOT mix digital and analog video on a single Secure Switch. Make sure all devices connected to Secure Switch are DP or HDMI-video-based devices. Read Secure Installation Guidelines (on page 16) before proceeding with the installation.

• To connect all equipment:
  1. Plug your USB keyboard and USB mouse into the USB User Console ports on the Secure Switch’s rear panel.
     • Only a standard USB keyboard/mouse are supported. See Using Qualified Peripheral Devices Only (on page 14).
  2. Optionally connect your console monitor to the Secure Switch’s console Video port on the rear panel, and then power on the monitor.
     • The connected monitor will be filtered after connecting it to the Secure Switch. An unsupported monitor will be rejected.
  3. Plug your speakers into the console’s speaker jack located on the Secure Switch’s front panel.
  4. Plug any standard cable’s HDMI or DisplayPort connectors to the Secure Switch’s KVM ports and it’s USB and speaker connectors to the computer. Repeat this setup for each computer you are connecting. For the CAC feature, connect the Type B end of the USB Type A-to-B cable to the CAC port on one of the Secure Switch’s KVM ports.
  5. If you are installing a Secure Switch with CAC feature, connect the USB smart card / CAC reader to the CAC port on the Secure Switch’s front panel.
     • Only appropriate supported USB Authentication devices, including smart card and CAC readers, can be connected to this port. During KVM operation, unsupported or unauthorized USB devices will be filtered and rejected, which is indicated by a flashing CAC LED. See LED Indicators (on page 20) for visual indication.
     • For a list of supported USB smart card / CAC readers, see Supported Card Readers (on page 15).
     • It is HIGHLY recommended to install the proprietary card reader driver onto the computer(s), which is shipped with the card reader or can be downloaded from the card reader vendor’s website. Or the card reader may not function properly.
  6. Attach the power cord into the Secure Switch’s power socket, and plug the end into an AC power source.
  7. Turn on the Secure Switch and check that the LEDs light up. The Secure Switch will automatically start KVM self-test.
  8. Note: The Secure Switch performs security self-test at power-on and at each power cycle. Front panel LEDs will indicate self-test status and test result. See Operation (on page 19) and LED Indicators (on page 20) for visual identification.

Installation Diagram

Power ON
When you power on, reset, or power cycle the Secure Switch, the Secure Switch will perform a self-test to check the device’s integrity and security functions.

Self-test process:

• All Port LEDs will turn ON and then OFF one by one.
• When the self-test completes successfully, it will switch to Port 1, with the Port 1’s LED turning GREEN.

Self-test failure:
In case of self-test failure, the Secure Switch becomes inoperable, with the port LED(s) flashing, which indicates a potential cause to the failure.

• The pre-defined port LED status indicates the failure cause.
• Button jammed: The port LED of a jammed button will flash green.
• When all port LEDs flash, it means the KVM tampering is detected or there is an integrity issue. For security, the Secure Switch becomes inoperable after self test fails. Please verify your KVM installation, pushbuttons, and then power cycle the Secure Switch. If the selftest failure remains, stop using the Secure Switch, remove it from service and contact your Raritan reseller.
• After the Secure Switch is powered on and ready, power on your computers. By default the Secure Switch will switch to Port 1 after self test. The Secure Switch filters and emulates both the mouse and keyboard on each port after it is powered on. If the keyboard, mouse, monitor, or smart card / CAC reader fails to operate properly, make sure that you are using the appropriate peripherals that are supported and authorized peripherals. Then power off the Secure Switch, check all cable connections, and power on the device again.

Manual Switching
For enhanced security, the Secure Switch offers manual port switching only. This is achieved by pressing the port-selection pushbuttons located on the Secure Switch’s front panel.

Press and release a port-selection pushbutton to select the corresponding port where the desired computer is attached. For information on port IDs, see: Port ID Numbering (on page 20). To meet maximum security and channel isolation requirements, control of the keyboard, mouse, video, audio, and USB CAC reader will be switched together.

The selected port’s LED turns GREEN to indicate that the connected keyboard, mouse, monitor, speakers (or headset), and CAC reader are redirected to the computer attached to the corresponding port. The selected computer should be able to detect the peripherals after port switching.

If the computer fails to detect your keyboard, mouse, or CAC card reader, check the following:

• Verify if you are using a supported keyboard, mouse, or CAC card reader. See: Using Qualified Peripheral Devices Only (on page 14) and Supported Card Readers (on page 15).
• Verify if your keyboard, mouse, or CAC reader fails to operate properly.
• For USB CAC card reader (USB authentication device), verify the USB CAC cable has been securely connected, and the CAC function is enabled.
• For USB CAC card reader port, verify if the device you use has been authorized. See: Supported Card Readers (on page 15) or consult your administration.

Port ID Numbering
Each KVM port on the Secure Switch is assigned a port number. 1 and 2 for 2-port models, 1 to 4 for 4- port models, and 1 to 8 for 8-port models. The port numbers are marked on the rear of the Secure Switch. See Secure Switch Ports and Connectors (on page 10). The port ID of a computer is derived from the KVM port number it is connected to.

LED Indicators
In addition to the power LED, there are port LEDs and CAC LED on the Secure Switch’s front panel to indicate Port / CAC reader operation status. These LEDs also serve as the alarm notification for KVM security issues.

Chassis Intrusion Detection
To help prevent malicious tampering with the Secure Switch, when a chassis intrusion, such as the cover being removed, is detected, the Secure Switch becomes inoperable, and front panel LEDs flash GREEN continuously.The Chassis Intrusion Detection is an always-on function. If all your front panel LEDs flash continuously, or the Secure Switch’s enclosure appears breached, DO NOT use this product and contact your Raritan dealer immediately.

Appendix A Specifications

Secure Switch HDMI Models with CAC

Secure Switch DisplayPort Models with CAC

Secure Switch Series Resolution

Secure Switch with HDMI Port Series

Secure Switch with DP Port Series

Appendix A Supported Protocols for Connection Ports

Protocols for Console Ports
Secure Switch console ports support the following protocols. For the location of console ports, see Secure Switch Ports and Connectors (on page 10).

• Models with CAC: RSS4‑HDMI and DisplayPort Models
  

  Video Output Interface		Keyboard		Mouse		Audio Output	CAC Reader
  DisplayPort	HDMI	USB 1.1/2.0	PS/2	USB 1.1/2.0	PS/2	Analogue Audio output (Speaker)	USB 1.1/2.0
  Yes	Yes	Yes		Yes		Yes	Yes

• Protocols for KVM Ports
  Secure Switch KVM ports for connecting computers support the following protocols. For the location of this product’s KVM ports, see Secure Switch Ports and Connectors (on page 10).
• Models with CAC: RSS4 HDMI and DisplayPort Models:
  

  Video Output Interface		Keyboard		Mouse		Audio Output	CAC Reader
  DisplayPort	HDMI	USB 1.1/2.0	PS/2	USB 1.1/2.0	PS/2	Analogue Audio output (Speaker)	USB 1.1/2.0
  Yes	Yes	Yes		Yes		Yes	Yes

Documents / Resources

Raritan Compliant Desktop KVM Secure Switch [pdf] User Guide Compliant Desktop KVM Secure Switch, Desktop KVM Secure Switch, KVM Secure Switch, Secure Switch, Switch

References

• User Manual