Legacy Thunderbolt Support; Thunderbolt Security Levels: Available Functions And Ports - HP Elite Dock with Thunderbolt 3 Technical White Paper

Technical white paper | HP Elite Dock with Thunderbolt 3 & HP ZBook Dock with Thunderbolt 3
– All four displays connected to the dock may be active only when both HDMI and USB Type-C™ ports on the notebook or
mobile workstation are not in use
– When a display on HDMI (or USB Type-C™) on the notebook or mobile workstation is active: either displays on (a) dock's
USB Type-C™ or (b) Dock's VGA+DP+DP can be active, but not both sets

Legacy Thunderbolt support

• The use of legacy Thunderbolt devices requires a Thunderbolt 3 to Thunderbolt adapter

Thunderbolt security levels: available functions and ports

The Thunderbolt interface supports Direct Memory Access (DMA), which some customers consider a security risk. The HP
BIOS-based settings described here for the Thunderbolt connection policy allow the customer to select the appropriate
trade-off between convenience and security for the Thunderbolt-capable USB Type-C™ interface port on the notebook or
mobile workstation�
The Thunderbolt security level that controls the Thunderbolt connection policy of any USB Type-C™ connectors on the
notebook or mobile workstation can be changed in the BIOS setup (refer to Figure 7). The BIOS setup can be accessed
by pressing the F10 key when booting the HP Notebook or HP ZBook Mobile Workstation� The policies are also remotely
manageable via Public WMI interfaces.
Figure 7. Thunderbolt™ security levels
• Security level 0: PCIe and Display Port: no security
– No security level. Any Thunderbolt device attached to the notebook or mobile workstation USB Type-C™ port or the HP
Elite Dock with Thunderbolt 3 or HP ZBook Dock with Thunderbolt 3 will automatically be accessible without approval
– External displays will function when attached directly to the notebook or mobile workstation USB Type-C™ port or the
dock through display or USB Type-C™ ports
• Security level 1: PCIe and Display Port: user authorization
– This is the default BIOS policy. Same functionality as Security level 0, but the customer must approve access to devices.
– Each Thunderbolt peripheral, including the HP Elite Dock with Thunderbolt 3 and HP ZBook Dock with Thunderbolt 3,
includes a unique GUID which is saved on the PC and used to determine if the device has been previously connected. In
the event the user has chosen to suppress future prompts for that particular GUID (device), the Thunderbolt device will
automatically be enabled when attached�
– This policy also applies to any Thunderbolt peripherals attached "behind" the HP Elite Dock with Thunderbolt 3 and
HP ZBook Dock with Thunderbolt 3 via the USB Type-C™ connector on the dock
6
BIOS Setting for Thunderbolt™
PCIe and Display port - No Security
PCIe and Display Port - User
Authorization
PCIe and Display Port - Secure Connect
Display Port and USB
Port options
USB Ports Type A and Type C
Thunderbolt Security Level
USB Charging Port Function
Disable Charging Port
In sleep/off if battery below (%):
Media Card Reader
Possible Security
Functionality
TBT, USB, DP Auto connects, No user
response needed
TBT, USB, DP User must approve device before
functionality is allowed
TBT, USB, DP Only devices with saved key can connect
USB, DP Auto connects to USB, DP.
No TBT/PCIe allowed
PCIe and DisplayPort - User Authorization
10
Unchecking this
option completely
disables the
ports, including
Thunderbolt™.