Detection of malicious software, firmware, IP cores and circuitry via unintended emissions

• US 10,395,032 B2
• Filed: 03/19/2015
• Issued: 08/27/2019
• Est. Priority Date: 10/03/2014
• Status: Active Grant

• Current Assignee: Nokomis Inc.
• Original Assignee: Nokomis Inc.
• Inventors: Keller, Walter John, Pathak, Bogdan Amaru, Portune, Andrew Richard, Chornenky, Todd Eric
• Primary Examiner(s): Wang, Harris C
• Application Number:
  US14/663,156
• Publication Number:
  US 20160098561A1
• Time in Patent Office: 1,622 Days
• Field of Search: 726 24
• CPC Class Codes: G01R 31/001 Measuring interference from external sources to, or emission from, the device under test, e.g. EMC, EMI, EMP or ESD testing measuring electromagnetic fields G01R29/08; circuits for generating HV pulses in dielectric strength testing G01R31/14
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 2221/033 Test or assess software

Abstract

An apparatus for testing, inspecting or screening an electrically powered device for modified or unmodified hardware, firmware or software modifications including Malware, Trojans, adware, improper versioning, worms, or virus and the like, includes an antenna positioned at a distance from the electrically powered device and a signal receiver or sensor for examining a signal from the electrically powered device. The receiver or sensor collects unintended RF energy components emitted by the electrically powered device and includes one or more processors and executable instructions that perform analysis in a response to the acquired signal input while the electrically powered device is active or powered. The characteristics of the collected RF energy may be compared with RF energy characteristics of an unmodified device. The comparison determines one of a modified, unmodified or score of certainty of modified condition of the electrically powered device.

Claims

1. An apparatus comprising:

a sensor comprising a hollow enclosure with an access to an interior thereof, said access configured to allow insertion of one or more electrical devices therethrough, one or more antennas, low noise amplifier(s) coupled to said one or more antennas, RF tuner(s) and analog to digital converter(s), said sensor configured, to capture unintended emitted electromagnetic energy and/or unintended conducted energy from one or more electrical devices inserted into said interior through said access and disposed, during operation of said apparatus, within said interior;

one or more processors or logic devices; and

a computational medium comprising executable instructions that, when executed by said one or more processors or logic devices, cause said one or more processors or logic devices to perform the following steps on said captured unintended emitted electromagnetic energy and/or said unintended conducted energy;

measuring a feature value in at least one spectral frequency region of said captured unintended emitted electromagnetic energy and/or unintended conducted energy from said one or more electrical devices,

calculating a difference value between said measured feature value and a baseline feature value,

verifying, based on said calculated difference value, whether at least one of sub-threshold and super-threshold values have been exceeded in one or more of amplitude, frequency, phase and time domains of signature(s) elements of said captured unintended emitted electromagnetic energy and/or unintended conducted energy, and

determining, based on said calculated difference value, a presence or an absence of at least one of malicious software, anomalous software, modified software, malicious firmware, anomalous firmware, modified firmware, malicious circuitry, anomalous circuitry and modified circuitry within the one or more electrical devices.

2. The apparatus of claim 1, further comprising fixture(s) positionable within said hollow enclosure, said fixture(s) being sized and shaped to receive the one or more electrical devices and configured to stimulate the one or more electrical devices being tested into an operating state wherein unintended emissions are generated.

3. The apparatus of claim 2, wherein at least one of a stimuli used to stimulate the one or more electrical devices is configured to sweep across at least one of a frequency span, a voltage range, a duty cycle, a pulse duration, a time interval, a power amplitude and an electromagnetic illumination range.

4. The apparatus of claim 1, wherein said baseline feature value is obtained from captured unintended emissions being given off by a baseline electrical device and wherein said one or more electrical devices are determined and/or validated to be at least one of constructed, coded, programmed, loaded, burned-in and functioning identically to said baseline electrical device.

5. The apparatus of claim 4, wherein said baseline electrical device is located, during said operation of said apparatus, within said hollow enclosure having said antenna being integrated therewithin.

6. The apparatus of claim 1, wherein said one or more electrical devices is at least one of a wafer, a die, an electronic part, a circuit board, system, sub-system, and a circuit board assembly and wherein two are serially, concurrently or simultaneously tested using apparatus.

7. The apparatus of claim 1, wherein said one or more electrical devices is a circuit board or a circuit assembly, each including plurality of electronic components and wherein said plurality of electronic components are being simultaneously determined to have said presence or said absence of said at least one of malicious software, anomalous software, modified software, unmodified software, malicious firmware, anomalous firmware, modified firmware, unmodified firmware, malicious circuitry, anomalous circuitry and modified circuitry, unmodified circuitry during operation of said apparatus.

8. The apparatus of claim 1, wherein said step of measuring said feature value is performed serially or concurrently with a step of measuring said baseline feature value.

9. The apparatus of claim 1, wherein said executable instructions, when executed by said one or more processors or logic devices, cause said one or more processors or logic devices to perform an additional step of electromagnetic emissions analysis including at least one of a spectrographic analysis, a time-frequency analysis, an electromagnetic emission radiation response analysis related to input signal variations, a phase analysis, an informatics analysis, and a statistical analysis.

10. The apparatus of claim 1, wherein said one or more electrical devices is at least one of a wafer, a die, an electronic part, a circuit board, circuit board assembly, a subsystem, a system and a network and wherein said executable instructions, when executed by said one or more processors or logic devices, further cause said one or more processors or logic devices to determine an authenticity or an unmodified state of at least one of a software, a firmware and a circuitry present in said at least one of wafer, die, electronic part, circuit board, circuit board assembly, subsystem, system and network.

11. The apparatus of claim 1, wherein at least one of said at least one of malicious software, anomalous software, modified software, malicious firmware, anomalous firmware, modified firmware, malicious circuitry, anomalous circuitry and modified circuitry includes at least one of tainted, bug, malware, tampered, subversively altered, worm, zombie, Trojan, Trojan horse, Rootkit, virus, spyware, adware, checksum exploit, scareware, incorrect software, exploit, SQL injection attack, privacy-invasive software, backdoor, Rowhammer exploit, update, tainted part, tampered with, counterfeit, and denial of service.

29. The apparatus of claim 1, wherein said change of said second measured location relative to said first measured location is a symmetrical shift towards or away from a central peak in said at least one spectral frequency region.

12. An apparatus for analyzing at least one electrical device being at least one of a wafer, a die, an electronic part, a circuit board, system or sub-system or a circuit board assembly, said apparatus comprising:

an integrated antenna enclosure including a hollow enclosure with a door selectively opening and closing an access to an interior thereof and one or more antennas being at least one of integrated into, inserted into or configured in an array within said enclosure, said one or more antennas receiving unintended emissions of electromagnetic energy given off by one or more electrical devices inserted into said hollow interior through said access and disposed, during operation of said apparatus, within said interior, said one or more antennas disposed external to the one or more electrical devices;

an electromagnetic pattern sensor, configured, in a combination with said integrated antenna enclosure, to capture said unintended emissions of electromagnetic energy being given off by the at least one electrical device;

one or more processors or logic devices; and

a computational medium comprising executable instructions that, when executed by said one or more processors or logic devices, cause said one or more processors or logic devices to perform the following steps on said captured unintended emissions of said electromagnetic energy;

quantifying a feature value in at least one spectral frequency region of said unintended emissions for at least two different physical electrical devices that are determined and/or validated to be at least one of constructed, coded, programmed, loaded, burned-in and functioning identically to each other, wherein said at least two different physical electrical devices are serially or concurrently emplaced and measured in said integrated antenna enclosure,

identifying differences between at least one corresponding quantified feature of said spectral frequency region in said unintended emission for each of said at least two different physical electrical devices,

calculating a value based on a comparison of said two corresponding quantified features forming at least one parameter of said spectral frequency region in said unintended emission, and

determining, based on said calculated difference value, a presence or an absence of at least one of malicious software, anomalous software, modified software, malicious firmware, anomalous firmware, modified firmware, malicious circuitry, anomalous circuitry and modified circuitry within the one or more electrical devices.

13. The apparatus of claim 12, wherein said at least two different physical electrical devices includes at least one of a baseline electrical device and an unexamined device, at least two different baseline electrical devices of a different type, at least two unexamined devices of the same type, at least two different baseline electrical devices of the same type, and at least two unexamined devices of a different type.

14. An apparatus comprising:

a hollow enclosure with a door selectively opening and closing an access to an interior of said enclosure,

said enclosure is being a radio frequency (RF) shielded enclosure when said door is closing said access;

an antenna integrated into said hollow enclosure;

an emissions acquisition assembly, configured, to receive, from said antenna, in an analog form, unintended emissions of electromagnetic energy being given off by an electrical device inserted into said interior through said access and disposed, during operation of said apparatus, within said interior, amplify said unintended emissions and to convert said amplified unintended emissions into a digitized data;

one or more processors; and

a computational medium comprising executable instructions that, when executed by said one or more processors, cause said one or more processors to perform the steps of;

identifying a spectral frequency region within a sample unintended emission,

measuring a value of a parameter of said spectral frequency region in said sample unintended emission,

measuring value(s) of said parameter in one or more of subsequent unintended emissions, and

determining, based on distinct changes in said values of said parameter, at least one of anomalous software, anomalous firmware and anomalous circuitry of the electrical device.

15. The apparatus of claim 14, wherein said value of said parameter changes over time.

16. The apparatus of claim 14, wherein said value of said parameter differs across frequency ranges.

17. The apparatus of claim 14, wherein said executable instructions, when executed by said one or more processors, further cause said one or more processors to at least one of locate or geolocate said electrical device.

18. The apparatus of claim 14, wherein said executable instructions, when executed by said one or more processors, further cause said one or more processors to determine location(s) of said unintended emissions within said electrical device and/or associate said emissions to a distinct electronic component within said electronic device.

19. The apparatus of claim 14, wherein the emissions of distinct electronic components on a circuit board are associated with the corresponding distinct physical electronic components on the circuit board.

20. The apparatus of claim 14, wherein said executable instructions, when executed by said one or more processors, further cause said one or more processors to determine a type of and/or classify said electrical device.

21. The apparatus of claim 14, wherein digital representations of electromagnetic emissions are compared and contrasted with a specific focus on at least one of emission homogeneity, consistency, and uniformity.

22. A computer-implemented method for analyzing plurality of wafers, dies, electronic parts, circuit boards, circuit board assemblies, sub-systems and systems for presence or absence of at least one of anomalous circuitry, anomalous firmware or anomalous software, said method comprising the steps of:

providing a hollow enclosure with a door selectively opening and closing an access to an interior of said enclosure and with one or more antenna integrated therewithin, said enclosure is being a radio frequency (RF) shielded enclosure when said door is closing said access;

capturing, with an electromagnetic pattern sensor, emissions of electromagnetic energy radiating from said at least one of wafers, dies, electronic parts, circuit boards, circuit board assemblies, sub-systems and systems placed within said interior;

analyzing, with one or more processors and a computational medium comprising executable instructions, signature(s) of said captured emissions by at least one of a spectrographic analysis, an amplitude analysis, a time-frequency analysis, a frequency analysis, an electromagnetic emission radiation response analysis, input signal variations, a phase analysis, an informatics analysis, and a statistical analysis; and

verifying, with said one or more processors and said computational medium comprising executable instructions, whether at least one of sub-threshold and super-threshold values have been exceeded in one or more of amplitude, frequency, phase and time domains of signature(s) elements of said captured emissions.

23. The method of claim 22, further comprising the step of providing a calibration specimen, the step of capturing emissions radiating from said calibration specimen and the step of defining a calibrating emission signature.

24. The method of claim 23, further comprising the step of analyzing at least one of said captured emissions radiating from said calibration specimen and said calibrated emission signature using at least one of manual or automatic means to define, select or enhance the at least one calibrating emission signature to find more discriminating comparison characteristics of said calibration specimen.

25. The method of claim 22, further comprising the step of assuring by way of comparing signature of said captured emissions with said calibrating emission signature, a proper operation of said at least one of wafers, dies, electronic parts, circuit boards, circuit board assemblies, sub-systems and systems.

26. The method of claim 22, further comprising the step of analyzing operation of said calibration specimen at different time instances during analysis of said wafers, dies, electronic parts, circuit boards, circuit board assemblies, sub-systems and systems.

27. The method of claim 22, further comprising the step of comparing a signature of captured emissions from baseline wafers, dies, electronic parts, circuit boards, circuit board assemblies, sub-systems and systems at different time instances to wafers, dies, electronic parts, circuit boards, circuit board assemblies, sub-systems and systems under test, inspection and/or examination.

28. The method of claim 22, further comprising the step of combining results of at least one of spectrographic analysis, frequency analysis, time-frequency analysis, electromagnetic emission radiation response analysis, input signal variations, phase analysis, informatics analysis, and statistical analysis for at least one of said feature values with results of at least one of spectrographic analysis, frequency analysis, time-frequency analysis, electromagnetic emission radiation response analysis, input signal variations, phase analysis, informatics analysis, and statistical analysis for at least one of another feature value in at least one frequency region from at least one time interval.