LED Arrays of Laser Printers as Valuable Sources of Electromagnetic Waves for Acquisition of Graphic Data

Abstract

Classified information may be derivable from unintended electromagnetic signals. This article presents a technical analysis of LED arrays used in monochrome computer printers and their contribution to unintentional electromagnetic emanations. Analyses were based on realistic type sizes and distribution of glyphs. Usable pictures were reconstructed from intercepted radio frequency (RF) emanations. We observed differences in the legibility of information receivable at a distance that we attribute to different ways used by printer designers to control the LED arrays, particularly the difference between relatively high voltage single-ended waveforms and lower-voltage differential signals. To decode the compromising emanations required knowledge of—or guessing—printer operating parameters including resolution, printing speed, and paper size. Measurements were carried out across differences in construction and control of the LED arrays in tested printers.

1. Introduction

Printers translate the symbolic form of data processed by computers into a graphical form during their operation. As with every electronic device, printers are sources of electromagnetic emanations. Besides control signals, which carry no information (e.g., directing the operation of stepper motors or heaters), there are other signals (useful signals) that are correlated with the information being processed. Such emissions are called sensitive or valuable or compromising emanations from the point of view of electromagnetic protection of processed information (Figure 1).

Like other devices included in a computer system [1,2], the printer can be subject to electromagnetic infiltration, or eavesdropping [3,4]. Therefore, efforts to reduce the level of susceptibility to electromagnetic eavesdropping are initiated for such devices. Organizational and technical solutions are the most often-used methods for limiting infiltration sensitivity of devices [5]. Technical solutions are limited to changes in the design of devices that typically increase the cost of such devices and sometimes limit their functionality. Therefore, it is desirable to find solutions that avoid these drawbacks and at the same time allow “safe” processing of classified information [6,7].

One technical method that is commonly used in the field of electromagnetic compatibility—both to reduce the amount of electromagnetic interference emitted from the device and the susceptibility of the device to electromagnetic disturbance—is the use of differential-mode signals.

In this paper, analysis of useful signals [8] in the operation of LED arrays used inside printers (Figure 2) shows that such a design was used by printer B in its photoconductor exposure system. Is this sufficient, however, to foil non-invasive information gathering? The clear answer is that the solution adopted in the design of printer B (Figure 2a) significantly reduces the susceptibility of the device to infiltration, in comparison to printer A (Figure 2b). Moreover, the level of electromagnetic emission of printer A is higher than that of a typical single or dual diode laser printers [9].

2. Materials and Methods

The analyses were carried out on two printers that use LED array technology. Different ways of controlling the LED array—chosen by the printer’s designer—affect the number of useful signals (Figure 3) and the structure of those signals. In the case of printer, A.; we can distinguish four useful signals and six control signals in the cable (Figure 3a). The next ten wires are ground wires. Printer B has eight useful signals (four differential pairs) in the cable leading to its LED array (Figure 3b).

The other signals are control wires and ground wires (32 in all). By probing signal wires while exercising the printer, we were able to learn the structure of the control signals, how the LED array is controlled, and the way in which different print quality options are achieved depending on the operating mode and the toner-save option. Each of the tested printers uses different methods of controlling the LED array, which can affect the level of electromagnetic emanations. Examples of waveforms of useful and control signals for printer A are shown in the oscilloscope traces of Figure 4 and Figure 5.

The structure of the useful signals, based on the example of the signal on pin 2, does not change for the 300 dpi and 600 dpi operating modes of the printer. In the case of the 1200 dpi mode, the frequency of signal repetition increases by a factor of two. The amplitude is constant at approximately 3.5 V (

Table 1. Parameters of useful signals of printer A in relation to printing parameters.

Operating Mode	Parameters of Useful Signal
	Frequency [kHz]	Amplitude [V]
300 dpi, Eco	~4.7	3.5
300 dpi, Best	~4.7	3.5
600 dpi, Eco	~4.7	3.5
600 dpi, Best	~4.7	3.5
1200 dpi, Eco	~9.4	3.5
1200 dpi, Best	~9.4	3.5

).

The structure of the signal (waveform shape and duty cycle) does not change. This proves that the level of risk of electromagnetic emanations that are correlated with the processed information is not affected by print quality options (resolution and toner-save), in contrast to the situation found earlier with single and dual diode laser printers [4].

For laser printers, changes of operating mode print quality options do have an effect on the structure of useful signals and thus the characteristics of sensitive RF emissions [10,11]. Information about the operating mode and print quality for printer A is encoded in the structure of the control signals (Figure 6, Figure 7 and Figure 8). The amplitude of these signals is approximately 4 to 5 V. The pulse repetition frequency also changes depending on operating mode and use of the toner-save option. However, these signals carry no information at all about the information being printed [12,13].

Moreover, the amplitude of the control signals is higher than that of the useful signals. The control signals might be considered a serendipitous source of masking emissions which disturb the reception of sensitive emanations. This phenomenon is advantageous from an electromagnetic protection point of view [14,15,16].

A completely different method of control of the LED array was implemented in printer B despite using the same xerographic technology in its photosensitive drum. Here, some information about modes of operation and the toner-save option is visible in the useful signal. The amplitude of the signal is approximately 250 mV. The amplitude is less than a tenth of similar signals in printer, A. Moreover, the signaling method is differential. Figure 9, Figure 10 and Figure 11 show example waveforms of useful signals.

For these signals, the pulse repetition frequency changes when printing mode of operation and printout quality are changed (

Table 2. Parameters of useful signals from printer B in relation to printing parameters.

Operating Mode	Signal Parameters
		Amplitude (mV)
	PRF of Differential Signals (kHz)	First Differential Pair (1, 3, 5, 7)	Second Differential Pair (2, 4, 6, 8)
600 dpi Eco	2.07	−250	+250
600 dpi Best	4.14	−250	+250
1200 dpi Eco	4.14	−250	+250
1200 dpi Best	8.28	−250	+250

). The structure of these signals (duty cycle) does not change.

By analysis of the parameters of useful signals, we can derive an important property crucial to reconstructing images from intercepted RF signals that contain printed data. In the case of printer, B.; a change of printing quality (from Eco to Best and vice versa), for a fixed printing mode, causes predictable changes of the pulse repetition rate of the useful signal. For printer, A.; changes to these parameters (printing mode and printing quality) are not reflected in the behavior of the useful signal.

3. Results

3.1. Reconstructed Images from Sensitive Emissions

Images of printed data were recreated from recorded RF useful signals transmitted in the wires supplying signals to the LED array. The test signal bandwidth was determined according to the equation:

$$B=\frac{W\cdot L\cdot {\left(dpi\right)}^2}{t}$$

(1)

where:

• B—is the signal bandwidth for printing one pixel;
• W—is the width of the printing area in inches;
• L—is the length of the printing area in inches;
• dpi—is the printing resolution in dots per inch, and
• t—is the time to print one page.

We have to know the printing parameters in order to reconstruct the original information. These parameters are the length of printer video line (in pixels), and the number of video lines on a sheet of paper. As we can see, full reconstructed images can have very large dimensions; for example, for a:

• resolution of 1200 × 1200 dpi,
• printing speed of 30 pages per minute,
• paper size of A4 (about 8.27 by 11.69 inches, that is 9924 × 14 028 pixels), and
• three samples per pixel collected,

We obtain a data size of about 450 MB. Therefore, further analyses are based on fragments of images [17,18].

Fragments of these images are presented in Figure 12 and Figure 13. The reconstructed glyphs contained in the image are constructed from horizontal lines at intervals equal to the width of the line [5] apart from the repetition frequency of the useful signal and use of options Best or Eco and for the default printing resolution of printer, B.

In two-diode laser printers, a phenomenon occurs that causes the reconstructed images from sensitive emissions to contain only single points, corresponding to the beginning and endpoint of each horizontal line comprising the printed glyphs (essentially run-length encoding the reconstructed images) [19].

However, these useful signals were not differential signals. In the case of printer, B.; despite the predictable structure of character glyphs, the differential signaling used tends to help protect printed data against electromagnetic infiltration [20].

3.2. Levels of Electromagnetic Emissions

Printer B uses differential transmission of useful signals. Its primary aim is probably to lower the levels of electromagnetic emission and increase resistance to external disturbances. Since the differential signal is responsible for the transfer of information from the printer’s raster image processor (RIP) to the LED array, its characteristics correspond to characteristics of the processed information. Therefore, the solution adopted by the printer’s designer (in the form of a differential signal) also reduces the levels of electromagnetic emission correlated with printed data [21]. Such a solution was not used in printer, A.; despite the fact that the amplitude of useful signals are over ten times higher than in the case of printer, B. This necessarily translates into a level of electromagnetic emission. The number of wires carrying useful signals is also half that of printer, B.

An anechoic chamber (Figure 14) was used to test these predictions. During the tests, sensitive emissions were measured with a bandwidth of 1 MHz in the frequency range from 2 MHz to 1 GHz. This frequency range was selected as a result of many years of experience in testing of laser printers and display screens. The aforementioned bandwidth value is the most effective for sensitive emissions from laser printers. During the tests, a TEMPEST DSI 1550A receiving system (20 Hz to 22 GHz), which can be seen in Figure 15, was used.

The printers to be tested were connected to a TEMPEST computer, which is certified for electromagnetic safety. The reason for using a TEMPEST computer for this purpose is because typical computers have much higher levels of electromagnetic emissions. These emissions can “cover” the target emissions. When that happens, the electromagnetic infiltration process becomes impossible. TEMPEST printers exist and would be used along with TEMPEST computers in a TEMPEST environment. However, we aimed to measure the compromising emanations of normal, non-TEMPEST printers. (TEMPEST computers and printers are much more expensive, and hence are not used in most places.) The potential RF masking effect of a non-TEMPEST computer located near a non-TEMPEST printer is a valid objection, and we acknowledge it. However, our methodology, including testing in an anechoic chamber, was designed to lower the noise floor as much as possible in order to gather the cleanest possible data. Results of the TEMPEST measurements are shown in Figure 16.

4. Discussions

4.1. Printer A

The useful signals are sent by four wires. The parameters of the signals are constant regardless of the printing mode and toner-save option. The only change relates to the frequency of repetition of the useful signals for the 1200 dpi mode, which is twice as high as for the two lower modes (300 dpi and 600 dpi). The reconstructed images, regardless of the operating mode of the printer, are visually similar, precluding identification of the operating mode of the printer (Figure 17 and Figure 18). At the same time, the operating mode does not change the radiated characteristic of the emission source or the level of susceptibility to infiltration. In this printer, information about print quality is sent by additional control wires. In this case, different printing modes generate control signals having different timing structures.

As we can see, the xerographic printing technology of a photosensitive drum illuminated by LED arrays, which is used in these printers, has significant characteristics from the point of view of electromagnetic protection of the processed data. The reconstructed data do not directly contain characteristics that would facilitate their identification, as is the case with conventional laser printers for the same printing modes [22]. Even the use of digital image processing—such as an extension of pixel amplitude histogram, pixel amplitude thresholding, logical filtering, or edge detection filtering—failed to yield satisfactory results [5,23,24].

4.2. Printer B

Printer B uses a similar xerographic exposure process comprising a photosensitive drum as printer, A. However, in the structure of the original image, we can distinguish horizontal gaps spaced at the same interval as one line—this is the Eco option in action—which has a beneficial effect, from the point of view of the defender, against the effectiveness of a side-channel attack (SCA). This printer uses differential signaling, which gives the attacker a much lower amplitude signal that is also missing some signal features that would facilitate electromagnetic eavesdropping.

In order to prove the conclusions above, sensitive emission signals were recorded, and then images reconstructed from the recordings. Undoubtedly the image in Figure 19 contains some glyphs [25]. However, due to the elimination of a number of distinctive features caused by differential transmission and reduction of the repetition frequency of the signal (the Eco option), these elements prevent reading any information related to the printed data.

4.3. Generality

There are four commonly used technologies underlying almost all modern printers: impact, thermal, inkjet or dye sublimation, and xerographic (toner-based) raster engines—what we think of as laser printers (pen plotters, wet electrolytic processes, and older technologies are not used as often anymore.) The majority of printers used in offices are the xerographic type examined here, and universally they are built on a selection from only a few photosensitive drum engines made by a few manufacturers. This inevitably constrains the design performance envelope of active optical components used to write images on the photosensitive drums. Only two photonics technologies are used: serial (a scanning laser beam) or parallel (LED arrays). Both have technical and cost advantages and disadvantages. Both are about equally used. They have noticeably different characteristics from an RF emanations point of view, and we have fully described the behavior of LED array-based printers here. RF emanations from scanning laser-based printers have been fully described previously [14,23,26].

4.4. Further Exploration

One of the anonymous reviewers suggested an extremely interesting line of inquiry. Would it be possible to reverse the effect, and somehow inject a signal from a distance into the printer to affect the single-ended or differential signals applied to the LED arrays, either control or data or both? To do so, in this case, was outside the administrative limits imposed by the agreement for use of the anechoic chamber for the duration of our experiments but we would like to try it.

Glyphs in some of the recovered images (Figure 19) seem almost legible and it is exactly this kind of high volume, noisy data that are sometimes amenable to analysis by neural networks and machine learning (ML). It was a different anonymous reviewer who put us onto the ML line of attack [27].

5. Conclusions

We offer the results of tests conducted on useful and control signals to the LED array for two different printers representative of different internal design decisions. The tests were carried out from an electromagnetic-protection-of-information point of view. The dependency of the structure of signals on the printing mode and toner-save option was shown. In general, the use of LED array technology in printers increases the level of electromagnetic protection of information (as compared to laser printers). The level of protection from RF electromagnetic eavesdropping is greater than for printers employing a dual diode laser system [27] and it does not require changes of construction in the printers. Printers using the dual diode laser system use serial signal transmission, compared with the parallel mode of LED printers. That design decision is advantageous to the electromagnetic eavesdropper (Figure 20).

The LED array system requires parallel signal transmission. Overlapping signals in time cause successful reception and decoding of sensitive emissions to be very difficult. The reconstructed images from valuable emissions obtained from LED-array based printers can be seen to contain glyphs, but they are not legible.

Printer B goes further by using differential signaling. This method, if adopted, significantly reduces the level of useful electromagnetic emission (from the perspective of an eavesdropper) and thus reduces the effectiveness of the attack. The reconstructed images cannot be read by humans. Therefore the resistance level of printer B to electromagnetic eavesdropping is much higher than printer A—and that of typical laser printers (with the dual diode laser system). On the basis of recorded signals and reconstructed images, we may draw the conclusion that the method works. However, the low quality of the decoded data stands in the way of easy and simple interpretation.

The collected information related to printout quality and its impact on the forms of recreated data are presented in

Table 3. Comparison of the quality of reconstructed data—depending on resolution (DPI) and the use of “Best” or “Eco” options—for laser printers that use a dual diode laser system or an LED array from an electromagnetic protection point of view.

Type of Printer	600 dpi		1200 dpi
	Best	Eco	Best	Eco
Dual diode printer *	W1	K1	W1	K1
Dual diode printer **	W1	W1	K1	W1
Dual diode printer ***	W1	W1	W1	W1
LED array printer A	K2	K2	K2	K2
LED array printer B	W2	W2	W2	W2

* Producer 1, ** Producer 2, *** Producer 3.

. The results obtained by analysis of the A and B printers were compared with results of analogous analyses of printers using a dual diode laser system. In summary, the best approach to increase resistance to electromagnetic infiltration is the LED array system.

Legend:

K1—only the edges of glyphs appear in the reconstructed image, but the information is legible;

K2—visible filled glyphs appear in the reconstructed image, but the information is not legible;

W1—visible filled glyphs appear in the reconstructed image, and the information is legible;

W2—glyphs in the reconstructed image are not visible, and the information is not legible.