Detection system for detecting changes to circuitry and method of using the same

• US 10,452,872 B2
• Filed: 08/19/2016
• Issued: 10/22/2019
• Est. Priority Date: 05/26/2016
• Status: Active Grant

• Current Assignee: Raytheon Company (Rtx Corporation)
• Original Assignee: Raytheon Company (Rtx Corporation)
• Inventors: Jennings, William T., Hoffman, John, Craig, Johnathan W.
• Primary Examiner(s): Dada, Beemnet W
• Assistant Examiner(s): Saadoun, Hassan
• Application Number:
  US15/242,474
• Publication Number:
  US 20170344760A1
• Time in Patent Office: 1,159 Days
• Field of Search: None
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 21/75 by inhibiting the analysis of circuitry or operation
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3278 using physically unclonable functions [PUF]

Abstract

A system for detecting changes to circuitry includes: a processor; and a memory, and the memory has stored thereon instructions that, when executed by the processor, cause the processor to: periodically measure physical characteristic data of the circuitry, operational data of the circuitry, and environmental data; periodically capture the measured data; generate a dynamic fingerprint based on an aggregation of a first set of the captured data, and the dynamic fingerprint is a compound data structure encapsulating the aggregated data; associate metadata with the dynamic fingerprint; periodically update the dynamic fingerprint according to successive sets of the captured data; and compare the updated dynamic fingerprint to a previous dynamic fingerprint, to detect the changes to the circuitry.

Claims

1. A system for detecting changes to circuitry comprising a transmitter and a receiver configured to communicate over a communication link, the system comprising:

a processor; and

a memory, wherein the memory has stored thereon instructions that, when executed by the processor, cause the processor to;

periodically measure physical characteristic data of the circuitry, operational data of the circuitry, and environmental data;

periodically capture the measured data from the communication link;

generate a dynamic fingerprint based on aggregated data, the aggregated data being an aggregation of a first set of the captured data, wherein the dynamic fingerprint is a compound data structure encapsulating the aggregated data;

generate associate metadata associated with the dynamic fingerprint, the metadata comprising information associated with circumstances under which measured data was measured and/or captured;

detect a triggering event comprising a modification of an operational state of the circuit or an environment surrounding the circuit, the modification being induced by an external source; and

in response to detecting the triggering event,

periodically update the dynamic fingerprint according to a successive set of sets of the captured data and associated generate updated metadata associated with the updated dynamic fingerprint; and

detect the changes to the circuitry by comparing the updated dynamic fingerprint and the associated updated metadata to the dynamic fingerprint and the associated metadata.

2. The system of claim 1, wherein the instructions that cause the processor to generate the dynamic fingerprint comprise instructions for refining the captured data by applying a mask or a shaping function to the captured data.

3. The system of claim 2, wherein the instructions that cause the processor to generate the dynamic fingerprint further comprise instructions for deriving statistics from the refined data by applying a statistical function to the refined data.

4. The system of claim 3, wherein the instructions that cause the processor to generate the dynamic fingerprint further comprise instructions for refining the derived statistics by applying a mask or a shaping function to the derived statistics.

5. The system of claim 4, wherein the instructions that cause the processor to generate the dynamic fingerprint further comprise instructions for applying a compression function or a hash function to the refined derived statistics.

6. The system of claim 1, wherein the metadata comprises at least one of:

a time when the measured data was captured, a capture sequence number, an associated dynamic fingerprint, and actual measured data.

7. The system of claim 1, wherein the metadata comprises at least one of:

rules for applying statistical analysis to the captured data, parameters for applying statistical analysis to the captured data, and attributes of the dynamic fingerprint.

8. The system of claim 1, wherein the metadata comprises at least one of:

an identifier of the circuit, an operation state of the circuit, and environmental information of the circuit.

9. The system of claim 1, wherein the instructions further cause the processor to:

capture an initial data set of the physical characteristic data;

identify an expected behavior of the circuitry based on the initial data set; and

compare at least one of the dynamic fingerprint and the updated dynamic fingerprint with the expected behavior.

10. The system of claim 1, wherein the instructions further cause the processor to correlate the detected changes with a presence of an unauthorized observer of the circuit.

11. The system of claim 1, wherein physical characteristic data comprises at least one of transmitter filter coefficients, receiver filter coefficients, and eye diagram data corresponding to the transmitter and the receiver.

12. The system of claim 11, wherein the eye diagram data comprises at least one of:

a height of the eye diagram, a leading edge of the eye diagram, a falling edge of the eye diagram, and a width of the eye diagram.

13. The system of claim 11, wherein the measured data comprises data received by the receiver.

14. The system of claim 1, wherein the communication link comprises a high-speed Serializer/Deserializer communications link.

15. The system of claim 1, wherein the communication link comprises a plurality of communications channels between the transmitter and the receiver, and the dynamic fingerprint is generated based on an aggregation of captured data from the plurality of communications channels.

16. A method of detecting changes to circuitry comprising a transmitter and a receiver configured to communicate over a communication link, the method comprising:

periodically measuring, by a processor, physical characteristic data of the circuitry, operational data of the circuitry, and environmental data;

periodically capturing, by the processor, the measured data from the communication link;

generating, by the processor, a dynamic fingerprint based on aggregated data, the aggregated data being an aggregation of a first set of the captured data, wherein the dynamic fingerprint is a compound data structure encapsulating the aggregated data;

generating associating, by the processor, metadata associated with the dynamic fingerprint, the metadata comprising information associated with circumstances under which measured data was measured and/or captured;

detecting a triggering event comprising a modification of an operational state of the circuit or an environment surrounding the circuit, the modification being induced by an external source; and

in response to detecting the triggering event,

periodically updating, by the processor, the dynamic fingerprint according to a successive set of sets of the captured data and associated generate updated metadata associated with the updated dynamic fingerprint; and

detect the changes to the circuitry by comparing, by the processor, the updated dynamic fingerprint and the associated updated metadata to the dynamic fingerprint and the associated metadata.

17. The method of claim 16, wherein generating the dynamic fingerprint comprises refining, by the processor, the captured data by applying a mask or a shaping function to the captured data.

18. The method of claim 17, wherein generating the dynamic fingerprint further comprises deriving, by the processor, statistics from the refined data by applying a statistical function to the refined data.

19. The method of claim 18, wherein generating the dynamic fingerprint further comprises refining, by the processor, the derived statistics by applying a mask or a shaping function to the derived statistics.

20. The method of claim 19, wherein generating the dynamic fingerprint further comprises applying, by the processor, a compression function or a hash function to the refined derived statistics.

21. The method of claim 16, wherein the metadata comprises at least one of:

a time when the measured data was captured, a capture sequence number, an associated dynamic fingerprint, and actual measured data.

22. The method of claim 16, wherein the metadata comprises at least one of:

rules for applying statistical analysis to the captured data, parameters for applying statistical analysis to the captured data, and attributes of the dynamic fingerprint.

23. The method of claim 16, wherein the metadata comprises at least one of:

an identifier of the circuit, an operation state of the circuit, and environmental information of the circuit.

24. The method of claim 16, further comprising:

capturing, by the processor, an initial data set of the physical characteristic data;

identifying, by the processor, an expected behavior of the circuitry based on the initial data set; and

comparing, by the processor, at least one of the dynamic fingerprint and the updated dynamic fingerprint with the expected behavior.

25. The method of claim 16, further comprising correlating, by the processor, the detected changes with a presence of an unauthorized observer of the circuit.

26. The method of claim 16, wherein the physical characteristic data comprises at least one of transmitter filter coefficients, receiver filter coefficients, and eye diagram data corresponding to the transmitter and the receiver.

27. The method of claim 26, wherein the eye diagram data comprises at least one of:

a height of the eye diagram, a leading edge of the eye diagram, a falling edge of the eye diagram, and a width of the eye diagram.

28. The method of claim 26, wherein the measured data comprises data received by the receiver.

29. The method of claim 16, wherein the communication link comprises a high-speed Serializer/Deserializer communications link.

30. The method of claim 16, wherein the communication link comprises a plurality of communications channels between the transmitter and the receiver, and the dynamic fingerprint is generated based on an aggregation of captured data from the plurality of communications channels.