Intrusion Detection and Communication

• US 20130044003A1
• Filed: 12/22/2011
• Published: 02/21/2013
• Est. Priority Date: 08/18/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Forin, Alessandro, Eguro, Kenneth, Bittner, Ray A. Jr., Sun, Ji
• Granted Patent: US 8,896,455 B2
• Time in Patent Office: Days
• US Class Current: 340/653
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/86 Secure or tamper-resistant housings
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

An intrusion detection system disclosed herein includes a detector circuit that measures a change in value of impedance of an interconnection circuitry. A decoder coupled to the detector decodes the measured value of the change in the impedance of the interconnection circuitry to determine existence of an abnormal condition. In an example implementation of the intrusion detection system, the change in the value of the impedance of the interconnection circuitry is represented by a change in the phase delay on the interconnection circuitry. An implementation of the intrusion detection circuit terminates communication using the interconnection circuitry upon detection of the abnormal condition. The intrusion detection system is further configured to interpret the abnormal condition as a communication signal to the interconnection circuitry.

Claims

1. A method comprising:

storing a baseline value of a phase delay between a signal generated by a first integrated circuit (IC) and a signal received at the first IC from a second IC, the first IC and the second IC located on a circuit board;

measuring a test value of a phase delay between a signal generated by the first IC and a signal received at the first IC;

determining a difference between the test value of the phase delay and the baseline value of the phase delay; and

generating a notification signal identifying a tampering with the circuit board if the difference is larger than a threshold.

2. The method of claim 1 wherein the baseline value of the phase delay is determined upon first usage of the circuit board.

3. The method of claim 1 wherein the signal received at the first IC is a signal from the second IC.

4. The method of claim 1 wherein the phase delay between the signal generated by the first IC and the signal received at the first IC is a function of the impedance of a circuit connecting the first IC and the second IC.

5. The method of claim 1 further comprising operating the circuit board in a debugging mode in response to the notification signal.

9. The device of claim 5 wherein the decoder is further configured to decode the measured value of the operating characteristics of the interconnection circuitry by comparing the measured value of the operating characteristics of the interconnection circuitry with a baseline value of the operating characteristics of the interconnection circuitry.

10. The device of claim 9 wherein the decoder is further configured to compare the measured value of the operating characteristic of the interconnection circuitry with the baseline value of the operating characteristic of the interconnection circuitry to generate a difference value.

11. The device of claim 10 wherein the decoder is further configured to generate a notification signal if the difference value is above a threshold value.

12. The device of claim 11 further comprising an actuator circuit configured to terminate communication using the interconnection circuitry in response to the notification.

6. A device comprising:

a detector configured to measure a change in value of an operating characteristics of an interconnection circuitry, the operating characteristics of the interconnection circuitry being dependent upon an impendence of the interconnection circuitry; and

a decoder coupled to the detector to receive the measured value of the operating characteristics from the detector and configured to decode the measured value of the operating characteristics to determine existence of an abnormal condition.

7. The device of claim 6 wherein the operating characteristic of the interconnection circuitry is a phase delay on a component of the interconnection circuitry.

8. The device of claim 7 wherein the phase delay on the component of the interconnection circuitry is represented by a slew rate of a signal communicated on the component of the interconnection circuitry.

13. The device of claim 6 further comprising a transmitter device configured to send a communication signal to the interconnection circuitry and wherein the decoder is further configured to decode the measured value of the operating characteristics to determine the communication signal.

14. A device comprising:

a detector configured to measure a change in value of an impedance of a circuitry in response to an external input; and

a decoder configured to decode the measured value of the change to determine existence of an abnormal condition.

15. The device of claim 14 wherein the decoder is further configured to identify the abnormal condition as a tampering with a circuit board comprising the circuitry.

16. The device of claim 14 wherein the circuitry is an interconnection circuitry between a first integrated circuit and a second integrated circuit on a circuit board.

17. The device of claim 14 wherein the change in the value of the impedance is represented by a change in the phase delay on the circuitry.

18. The device of claim 14 wherein the change in the value of the impedance is calculated as a difference between a baseline value of impedance on the circuitry and a test value of impedance on the circuitry.

19. The device of claim 14 further comprising an actuator circuit configured to terminate communication on the circuit in response to the notification signal.

20. The device of claim 14 wherein the decoder is further configured to identify the abnormal condition as a communication signal from a transmitter.