IT security
Air-gapped training room without a network
alphadidact® Digital distributes picture, sound and control over dedicated cabling between the workstations, and is connected to no data network to do so.
Definition
What an air-gapped training room is
An air-gapped training room shares screen content over dedicated cabling between the workstations instead of over the building's data network; no software runs on the training computers for it, and the AV system is connected to no network.
Between the computer and the monitor of each workstation sits a connection unit that picks up the picture signal where it leaves the computer anyway. The units are cabled to one another and to the central unit, where it is switched which picture appears at which position. No data network is involved at any point along this path.
There is one radio link, and it is optional: the tablet connects to the system directly over Bluetooth. It joins no network and needs no access to the building's Wi-Fi. Where even that is unwanted, the room is operated from the touchscreen, the system keyboard or the serial interface — cabled throughout.
The function of the system sits in the hardware of the connection units, not in software. That removes from procurement what would otherwise have to be examined: no service running on the computers, no licence with a term, and no account for anyone to administer.
Signal path
What leaves the room — and what does not
The signal path runs from the instructor position through the central unit to the participant positions and ends there. The building's data network runs alongside and touches no point of that path.
- Instructor position with Instructor Matrix — sends a signal and views any source at the same time
- Central unit — switches which picture appears at which position
- Participant position with a connection unit between computer and monitor
- The building's data network — no connection to the system
Checkpoints
Five questions a security assessment asks
The following five points come up in every procurement process. Here are the answers for alphadidact® Digital, in the order in which they are usually examined.
Which cables leave the room?
In a single training room, no signal cable of the system leaves the room. Where two rooms are coupled, or where the distances between the source and the workstation are long, extenders and repeaters are added: they recondition and amplify the picture signal, and they do so over DVI — not over a network.
- One room: no signal cable to the outside
- Coupled rooms: dedicated cabling between the rooms
- Extenders and repeaters work over DVI, not over IP
What is installed on the training computers?
Nothing is installed on the training computers. The connection unit sits in the picture path between computer and monitor, not inside the computer; which operating system runs there, and who administers it, makes no difference to the distribution of the picture.
- No service, no driver package, no agent
- No licence and no account per workstation
- Independent of the computers' operating system
Which radio links are there?
There is exactly one radio link, and it is optional: Bluetooth between the tablet and the system. The tablet connects directly to the system, joins no network, registers with no access point and needs no access to the building's Wi-Fi. Without a tablet, the system works entirely over cable.
- No Wi-Fi, no access point, no network join
- Bluetooth only between the tablet and the system
- Cabled operation from touchscreen, system keyboard or RS232
Who maintains the system?
Maintenance and changes take place on site. Because the system hangs on no network, there is neither an update channel from outside nor remote access that would have to be approved. Development and manufacturing are in Heusenstamm near Frankfurt; the equipment carries three years of warranty, extendable to five years on request.
- No remote access, no updates from the network
- Spare parts from our own production
- Three years of warranty, five as an option
What happens in the event of a failure?
If part of the system fails, the workstations stay usable. A fail-safe circuit keeps computers, monitors, keyboards and mice connected through, so that work in the room can continue. In a star layout, every position is wired individually to the central unit; a unit that drops out has no effect on the remaining positions.
- Fail-safe keeps the workstation usable
- Star: one unit fails, the others carry on
- Ring: the touchscreen reports where the break is
Technical data
Details for the assessment record
These rows give, for alphadidact® Digital, the details that a security assessment asks for.
- Connection to the building network
- none
- Software on the training computers
- none
- Remote access to the system
- none
- Sockets on the units
- DVI-D (HDMI signal, with audio)
- Transmission
- uncompressed, without encoding and without buffering
- Radio links
- one, optional: Bluetooth between tablet and system
- Cabled operation
- touchscreen, system keyboard, RS232
- Size in a star layout
- up to 100 workstations via a satellite layout
- Size in a ring layout
- up to 50 student positions
- Behaviour on failure
- fail-safe: computer, monitor, keyboard and mouse stay connected through
- Development and manufacturing
- Heusenstamm near Frankfurt
- Warranty
- 3 years, extendable to 5 years as an option
How an installation is equipped depends on the room, the number of positions and the sources already in place. None of that changes the details above.
Common questions
What procurement and IT security clarify beforehand
Each answer stands on its own and can be taken into an assessment record as it is.
Does alphadidact® Digital need a network connection?
No. Picture, sound and control travel over dedicated cabling between the connection units and the central unit. The system is connected to no data network, and none of its functions requires one.
Is software installed on the training computers?
No. The connection unit picks up the picture signal between computer and monitor. Nothing runs on the computer itself for this, no licence per workstation is needed, and the operating system is left untouched.
How is the tablet connected?
Over Bluetooth, straight to the system. The tablet joins no network and needs no access to the building's Wi-Fi. Tablet control is optional: the touchscreen, the system keyboard and the serial interface operate the same functions over cable.
What happens if a device in the system fails?
The workstation concerned can still be used, because a fail-safe circuit keeps computer, monitor, keyboard and mouse connected through. In a ring layout, the touchscreen at the instructor position also shows where the link is broken.
Can the system be tied into an existing AV control system?
Yes, over a serial protocol on RS232. The commands are handed over documented and taken into the existing control system; no network connection arises from this.
How many workstations can a room have?
Up to 100 workstations in a star layout, spread over a satellite layout. The ring layout is intended for smaller rooms and reaches up to 50 student positions.
What connectors does the equipment have?
What is transmitted is an HDMI signal with audio. The sockets on the units are DVI-D and can be screwed down, so in a permanently installed system the plug connection stays where it belongs.
Next step
Working out the system for your room
For a quotation, the size of the room, the number of workstations and the sources to be included are enough.
EBS Euchner, Heusenstamm near Frankfurt — development and manufacturing in house since 1984.