Unmanned aerial vehicle intrusion detection and countermeasures

• US 10,588,021 B2
• Filed: 02/04/2019
• Issued: 03/10/2020
• Est. Priority Date: 09/28/2015
• Status: Active Grant

• Current Assignee: Department 13, Inc. (Department 13 International Ltd.)
• Original Assignee: Genghiscomm Holdings, LLC
• Inventors: Shattil, Steve, Sen, Robi
• Primary Examiner(s): Pham, Brenda H
• Application Number:
  US16/266,353
• Publication Number:
  US 20200037166A1
• Time in Patent Office: 400 Days
• Field of Search: 3703102, 370328, 370338, 370349
• CPC Class Codes: H04K 2203/22 for communication related to vehicles
• CPC Class Codes: H04K 3/44 characterized by the control of the jamming waveform or modulation type
• CPC Class Codes: H04K 3/45 characterized by including monitoring of the target or target signal, e.g. in reactive jammers or follower jammers for example by means of an alternation of jamming phases and monitoring phases, called "look-through mode"
• CPC Class Codes: H04K 3/65 using deceptive jamming or spoofing, e.g. transmission of false signals for premature triggering of RCIED, for forced connection or disconnection to/from a network or for generation of dummy target signal
• CPC Class Codes: H04K 3/92 related to allowing or preventing remote control
• CPC Class Codes: H04L 27/0012 arrangements for identifying the type of modulation
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 69/323 in the physical layer [OSI layer 1]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/79 Radio fingerprint

Abstract

A system deploys electronic countermeasures against unmanned aerial vehicles (UAVs) that are determined to be a threat. A radio transceiver coupled to at least one antenna detects if radio signals are being communicated between a remote control unit and a UAV. A mitigation engine communicatively coupled to the radio transceiver synthesizes an exploit signal to be transmitted to the UAV, wherein the exploit signal is configured to inject commands into the UAV'"'"'s navigation system. If the system determines that the UAV is operating in an autopilot mode, it transmits an induce-mode signal that causes the UAVs to switch to a communication mode so the UAV is responsive to the exploit signal.

Claims

1. An apparatus, comprising:

a radio transceiver coupled to at least one antenna and configured to detect if radio signals are being communicated between a remote control unit and a remote-controlled vehicle, and to transmit signals to the remote-controlled vehicle; and

a mitigation engine communicatively coupled to the radio transceiver and configured to synthesize an exploit signal to be transmitted to the remote-controlled vehicle, the exploit signal configured to inject commands into the remote-controlled vehicle'"'"'s navigation system;

wherein the exploit signal is configured to exploit a radio protocol format employed by the remote-controlled vehicle to manipulate a radio in the remote-controlled vehicle without affecting at least one other radio using the same radio protocol format.

2. The apparatus recited in claim 1, wherein

the mitigation engine comprises at least one computing device including a processor, non-transitory memory and a plurality of applications configured to run on the processor;

and

the radio transceiver comprises at least one radio receiver coupled to the computing device and configured to;

select specific radio signals, wherein the radio receiver is configured to detect signals in a predetermined radio frequency spectrum;

detect the remote-controlled vehicle by receiving radio transmissions involving the vehicle, wherein the radio transmissions include data sent from the remote-controlled vehicle;

select a unique identifier for the remote-controlled vehicle using at least a portion of the data; and

perform a threat assessment of the remote-controlled vehicle using at least a portion of the data.

3. The apparatus recited in claim 1, wherein the exploit signal is transmitted to the remote control unit.

4. The apparatus recited in claim 1, wherein the mitigation engine manipulates a messaging protocol employed by at least one of the remote control unit and the remote-controlled vehicle, to read messages and modify message contents.

5. The apparatus recited in claim 1, wherein the mitigation engine is configured to perform at least one of a man-in-the-middle attack, a de-authentication/disassociation attack, a denial-of-service attack, a network-layer attack, a transport-layer attack, and a collision attack.

6. The apparatus recited in claim 1, wherein the mitigation engine is configured to determine at least one of manufacturer, model number, operating system, and operating state of at least one of the remote control unit and the remote-controlled vehicle;

and synthesize the exploit signal therefrom.

7. The apparatus recited in claim 1, further comprising a threat-assessment module configured to determine if the remote-controlled vehicle is a threat based on at least one of proximity, altitude, speed, heading, size, shape, remote-controlled vehicle type, and remote-controlled vehicle model;

the threat-assessment module further configured to activate the mitigation engine upon determining that the remote-controlled vehicle is a threat.

8. The apparatus recited in claim 1, wherein the radio transceiver is configured to identify a radio protocol from at least one of signal features and protocol behavior features of the radio signal.

9. The apparatus recited in claim 1, wherein the radio transceiver is configured to communicate via authentication messages with the remote-controlled vehicle.

10. The apparatus recited in claim 1, wherein the mitigation engine is configured to cause the remote-controlled vehicle to change at least one of its operating mode and state.

15. The apparatus recited in claim 1, wherein the mitigation engine is configured to perform at least one of a man-in-the-middle attack, a de-authentication/disassociation attack, a denial-of-service attack, a network-layer attack, a transport-layer attack, and a collision attack.

11. An apparatus, comprising:

a radio transceiver coupled to at least one antenna and configured to detect if radio signals are being communicated between a remote control unit and a remote-controlled vehicle, and to transmit signals to the remote-controlled vehicle;

a memory; and

one or more processors operatively coupled to the memory and the radio transceiver, the one or more processors configured to;

synthesize an exploit signal to be transmitted to the remote-controlled vehicle, the exploit signal configured to inject commands into the remote-controlled vehicle'"'"'s navigation system, wherein the exploit signal comprises spoofed packets, which take control of the remote-controlled vehicle.

12. The apparatus recited in claim 11, wherein the one or more processors are configured to:

select specific radio signals, wherein the radio receiver is configured to detect signals in a predetermined radio frequency spectrum;

detect the remote-controlled vehicle by receiving radio transmissions involving the vehicle, wherein the radio transmissions include data sent from the remote-controlled vehicle;

select a unique identifier for the remote-controlled vehicle using at least a portion of the data; and

perform a threat assessment of the remote-controlled vehicle using at least a portion of the data.

13. The apparatus recited in claim 11, wherein the spoofed packets are transmitted to the remote control unit.

14. The apparatus recited in claim 11, wherein the mitigation engine manipulates a messaging protocol employed by at least one of the remote control unit and the remote-controlled vehicle, to read messages and modify message contents.

16. The apparatus recited in claim 11, wherein the mitigation engine is configured to determine at least one of manufacturer, model number, operating system, and operating state of at least one of the remote control unit and the remote-controlled vehicle;

and synthesize the exploit signal therefrom.

17. The apparatus recited in claim 11, further comprising a threat-assessment module configured to determine if the remote-controlled vehicle is a threat based on at least one of proximity, altitude, speed, heading, size, shape, remote-controlled vehicle type, and remote-controlled vehicle model;

the threat-assessment module further configured to activate the mitigation engine upon determining that the remote-controlled vehicle is a threat.

18. The apparatus recited in claim 11, wherein the radio transceiver is configured to identify a radio protocol from at least one of signal features and protocol behavior features of the radio signal.

19. The apparatus recited in claim 11, wherein the radio transceiver is configured to communicate via authentication messages with the remote-controlled vehicle.

20. The apparatus recited in claim 11, wherein the mitigation engine is configured to cause the remote-controlled vehicle to change at least one of its operating mode and state.