DETECTING MALICIOUS HARDWARE BY MEASURING RADIO FREQUENCY EMISSIONS

• US 20130162241A1
• Filed: 12/22/2011
• Published: 06/27/2013
• Est. Priority Date: 12/22/2011
• Status: Active Grant

• Current Assignee: Lenovo International Limited (Lenovo Group Ltd.)
• Original Assignee: International Business Machines Corporation
• Inventors: Jones, Phillip D., Pahel, Thomas D. Jr., Parker, Adam J., Rodriguez, Adrian X.
• Granted Patent: US 8,901,916 B2
• Time in Patent Office: Days
• US Class Current: 324/76.41
• CPC Class Codes: G01R 29/0814 Field measurements related to measuring influence on or from apparatus, components or humans EMC, EMI and similar testing in general G01R31/001, e.g. in ESD, EMI, EMC, EMP testing, measuring radiation leakage; detecting presence of micro- or radiowave emitters; dosimetry; testing shielding; measurements related to lightning

Abstract

A method of testing an electronic device comprises measuring radio frequency emissions at a plurality of positions relative to a trusted unit of a particular electronic device during operation of the trusted unit, and measuring radio frequency emissions at the same plurality of positions relative to a second unit of the particular electronic device. For each of the plurality of positions, the radio frequency emissions measured from the second unit are compared to the radio frequency emissions measured from the trusted unit. The method then determines whether there is any frequency at which the measured amplitude of the radio frequency emissions from the second unit and the measured amplitude of the radio frequency emissions from the trusted unit exhibit a statistically significant difference.

Claims

1. A method, comprising:

measuring radio frequency emissions at a plurality of positions relative to a trusted unit of a particular electronic device during operation of the trusted unit;

measuring radio frequency emissions at the same plurality of positions relative to a second unit of the particular electronic device;

for each of the plurality of positions, comparing the radio frequency emissions measured from the second unit to the radio frequency emissions measured from the trusted unit; and

determining whether there is any frequency at which the measured amplitude of the radio frequency emissions from the second unit and the measured amplitude of the radio frequency emissions from the trusted unit exhibit a statistically significant difference.

2. The method of claim 1, wherein measuring radio frequency emissions includes measuring the amplitude of energy emitted at each of a plurality of frequencies.

3. The method of claim 1, further comprising:

operating the electronic device under a workload while the radio frequency emissions are being measured.

4. The method of claim 3, wherein the workload is a fixed percentage of the maximum nominal workload of the electronic device.

5. The method of claim 3, further comprising:

for each electronic device, running the same portion of the workload while measuring the radio frequency emissions at each of the plurality positions.

6. The method of claim 3, wherein operating the electronic device under a workload while the radio frequency emissions are being measured, includes reading or writing to a segment of the hardware that is near a current position where the radio frequency emissions are being measured.

7. The method of claim 1, further comprising:

positioning a frequency sensitive antenna at the plurality of positions relative to the electronic device.

8. The method of claim 7, wherein the plurality of positions lie in a plane adjacent the electronic device.

9. The method of claim 7, wherein positioning the frequency sensitive antenna at the plurality of positions relative to the electronic device includes continuous movement of the frequency sensitive antenna along a known path.

10. The method of claim 7, wherein positioning the frequency sensitive antenna at the plurality of positions relative to the electronic device includes incremental movement of the frequency sensitive antenna to each of the plurality of positions and pausing movement to measure the radio frequency emissions.

11. The method of claim 7, wherein positioning the frequency sensitive antenna at the plurality of positions relative to the electronic device includes moving the electronic device.

12. The method of claim 1, further comprising:

using a plurality of frequency sensitive antennas to simultaneously measure radio frequency emissions at two or more of the plurality of positions

13. The method of claim 1, further comprising:

removing the electronic device from any enclosure prior to measuring the radio frequency emissions.

14. The method of claim 1, wherein the electronic device includes a circuit board.

15. The method of claim 1, further comprising:

repeating the radio frequency emissions measurement at any of the plurality of positions as a function of time.

16. The method of claim 15, wherein measuring radio frequency emissions at a plurality of positions relative to a trusted unit of a particular electronic device during operation of the trusted unit, includes measuring radio frequency emissions at the plurality of positions relative to a plurality of trusted units of the electronic device.

17. The method of claim 16, further comprising:

creating the radio frequency emissions standard based upon the radio frequency emissions measured from the plurality of trusted electronic devices, wherein the

18. The method of claim 1, further comprising:

identifying a component on the second unit of the electronic device as being suspicious in response to determining that the radio frequency emissions measured at a position adjacent the component on the second unit are different than the radio frequency emissions measured at the same position from the trusted unit.

19. The method of claim 1, wherein determining whether there is any frequency at which the measured amplitude of the radio frequency emissions from the second unit and the measured amplitude of the radio frequency emissions from the trusted unit exhibit a statistically significant difference, includes determining whether there is any frequency at which the measured amplitude of the radio frequency emissions from the second unit are more than 5 dBμ

V/m greater than the measured amplitude of the radio frequency emissions from the trusted unit.

20. A computer program product including computer usable program code embodied on a computer usable medium, the computer program product including:

computer usable program code for measuring radio frequency emissions at a plurality of positions relative to a trusted unit of a particular electronic device during operation of the trusted unit;

computer usable program code for measuring radio frequency emissions at the same plurality of positions relative to a second unit of the particular electronic device;

computer usable program code for comparing, for each of the plurality of positions, the radio frequency emissions measured from the second unit to the radio frequency emissions measured from the trusted unit; and

computer usable program code for determining whether there is any frequency at which the measured amplitude of the radio frequency emissions from the second unit and the measured amplitude of the radio frequency emissions from the trusted unit exhibit a statistically significant difference.

21. The computer program product of claim 20, further comprising:

computer usable program code for operating the electronic device under a workload while the radio frequency emissions are being measured.