Anomalous Behavior Detection Using Radio Frequency Fingerprints and Access Credentials

• US 20150350902A1
• Filed: 01/30/2015
• Published: 12/03/2015
• Est. Priority Date: 06/02/2014
• Status: Active Grant

• Current Assignee: Bastille Networks, Inc.
• Original Assignee: Bastille Networks, Inc.
• Inventors: Baxley, Robert John, Rouland, Christopher Jay, Engle, Michael Thomas
• Granted Patent: US 9,485,267 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G07C 2209/61 Signal comprising different frequencies, e.g. frequency hopping
• CPC Class Codes: G07C 2209/63 Comprising locating means for detecting the position of the data carrier, i.e. within the vehicle or within a certain distance from the vehicle
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence
• CPC Class Codes: H04B 17/318 Received signal strength
• CPC Class Codes: H04B 17/391 Modelling the propagation channel
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 4/027 using movement velocity, acceleration information
• CPC Class Codes: H04W 4/90 Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]

Abstract

Electromagnetic (EM)/radio frequency (RF) emissions may be detected and corresponding EM personas may be created. One or more EM personas may be associated with a super persona corresponding to a particular entity. EM personas, super personas, and/or supplemental identifying information can be used to enforce security protocols.

Claims

1. A system, comprising:

a transceiver;

at least one memory that stores computer-executable instructions; and

at least one processor operationally coupled to the transceiver and the at least one memory, wherein the at least one processor is configured to access the at least one memory and execute the computer-executable instructions to;

receive a radio frequency (RF) fingerprint of an RF signal detected by the transceiver within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

determine a stored persona that includes a stored RF fingerprint that matches the received RF fingerprint;

determine that the electronic device that emitted the RF signal is associated with the stored persona and identify a user associated with the stored persona;

identify, from the stored persona, access credentials of the user, wherein the access credentials provide access to one or more ingress points of the AUS via one or more access control devices;

receive access control information indicating that the access credentials have not been received at any of the one or more access control devices; and

determine that the user is in violation of a security protocol based at least in part on receipt of the RF fingerprint and receipt of the access control information indicating that the access credentials have not been received.

2. The system of claim 1, wherein the at least one processor is further configured to execute the computer-executable instructions to generate an alert indicating the violation of the security protocol.

3. The system of claim 1, wherein the at least one processor is further configured to execute the computer-executable instructions to:

determine, based at least in part on the stored persona, that the user is authorized to be in the AUS.

4. The system of claim 1, wherein the at least one processor is further configured to execute the computer-executable instructions to:

determine, based at least in part on the stored persona, that the user is unauthorized to be in the AUS; and

generate an alert indicating that the user is present in the AUS.

5. The system of claim 5, wherein the AUS is a first AUS and the user is authorized to be in a second AUS.

6. A system, comprising:

a transceiver;

at least one memory that stores computer-executable instructions; and

at least one processor operationally coupled to the transceiver and the at least one memory, wherein the at least one processor is configured to access the at least one memory and execute the computer-executable instructions to;

receive a first radio frequency (RF) fingerprint of a first RF signal detected by the transceiver within an area under surveillance (AUS), the first RF fingerprint comprising at least one of;

i) a hardware address of a first electronic device that emitted the first RF signal or ii) a first radio type identifier of a first radio of the first electronic device;

determine a first stored persona that includes a first stored RF fingerprint that matches the received first RF fingerprint;

determine that the first electronic device that emitted the RF signal is associated with the first stored persona and identify a first user associated with the stored persona;

identify, from the first stored persona, first access credentials of the first user, wherein the first access credentials provide access to one or more ingress points of the AUS via one or more access control devices;

receive a second RF fingerprint of a second RF signal detected by the transceiver within the AUS, the second RF fingerprint comprising at least one of;

i) a second hardware address of a second electronic device that emitted the second RF signal or ii) a second radio type identifier of a second radio of the second electronic device;

receive, from at least one of the one or more access control devices, access control information including second access credentials matching the first access credentials;

determine that a first time at which the first RF signal is detected by the transceiver is within a threshold period of time from a second time at which the second RF signal is detected by the transceiver;

determine that a first position from which the first RF signal is emitted is within a threshold distance from a second position from which the second RF signal is emitted;

determine that a second user of the second electronic device entered the ingress point of the AUS in violation of a security protocol; and

generate an alert indicative of the determination that the second user of the second electronic device entered the AUS in violation of the security protocol.

7. The system of claim 6, wherein the alert is a first alert and the at least one processor is further configured to execute the computer-executable instructions to:

determine that the second RF fingerprint does not match a stored RF fingerprint included in any stored persona; and

generate a second alert indicting that the second electronic device is unauthorized in the AUS.

8. The system of claim 6, wherein the alert is a first alert and the at least one processor is further configured to execute the computer-executable instructions to:

determine that the second RF fingerprint matches a second stored RF fingerprint of a second stored persona;

identify the second user based at least in part on the second stored persona;

determine that the second user is unauthorized to enter the AUS; and

generate a second alert indicting that the second user is unauthorized in the AUS.

9. The system of claim 8, wherein the AUS is a first AUS and the second user is authorized to be in a second AUS.

10. A method, comprising:

receiving, by a security system comprising one or more processors, a radio frequency (RF) fingerprint of an RF signal detected by the transceiver within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

determining, by the security system, a stored persona that includes a stored RF fingerprint that matches the received RF fingerprint;

determining, by the security system, that the electronic device that emitted the RF signal is associated with the stored persona and identify a user associated with the stored persona;

identifying, by the security system, from the stored persona, access credentials of the user, wherein the access credentials provide access to one or more ingress points of the AUS via one or more access control devices;

receiving, by the security system, access control information indicating that the access credentials have not been received at any of the one or more access control devices; and

determining, by the security system, that the user is in violation of a security protocol based at least in part on receiving the RF fingerprint and receiving the access control information indicating that the access credentials have not been received.

11. The method of claim 10, further comprising generating, by the security system, an alert indicating the violation of the security protocol.

12. The method of claim 10, further comprising:

determining, by the security system and based at least in part on the stored persona, that the user is authorized to be in the AUS.

13. The method of claim 10, further comprising:

determining, by the security system and based at least in part on the stored persona, that the user is unauthorized to be in the AUS; and

indicating, by the security system, that the user is present in the AUS.

14. A method, comprising:

receiving, by a security system comprising one or more processors, a first radio frequency (RF) fingerprint of a first RF signal detected by the transceiver within an area under surveillance (AUS), the first RF fingerprint comprising at least one of;

i) a hardware address of a first electronic device that emitted the first RF signal or ii) a first radio type identifier of a first radio of the first electronic device;

determining, by the security system, a first stored persona that includes a first stored RF fingerprint that matches the received first RF fingerprint;

determining, by the security system, that the first electronic device that emitted the RF signal is associated with the first stored persona and identify a first user associated with the stored persona;

identifying, by the security system, from the first stored persona, access credentials of the first user, wherein the access credentials provide access to one or more ingress points of the AUS via one or more access control devices;

receiving, by the security system, a second RF fingerprint of a second RF signal detected by the transceiver within the AUS, the second RF fingerprint comprising at least one of;

i) a second hardware address of a second electronic device that emitted the second RF signal or ii) a second radio type identifier of a second radio of the second electronic device;

receiving, by the security system and from at least one of the one or more access control devices, access control information including the access credentials;

determining, by the security system, that a first time at which the first RF signal is detected by the transceiver is within a threshold period of time from a second time at which the second RF signal is detected by the transceiver;

determining, by the security system, that a first position from which the first RF signal is emitted is within a threshold distance from a second position from which the second RF signal is emitted;

determining, by the security system, that a second user of the second electronic device entered the ingress point of the AUS in violation of a security protocol; and

generating, by the security system, an alert indicative of the determination that the second user of the second electronic device entered the AUS in violation of the security protocol.

15. The method of claim 14, wherein the alert is a first alert and further comprising:

determining, by the security system, that the second RF fingerprint does not match a stored RF fingerprint included in any stored persona; and

generating, by the security system, a second alert indicting that the second electronic device is unauthorized in the AUS.

16. The method of claim 14, wherein the alert is a first alert and further comprising:

determining, by the security system, that the second RF fingerprint matches a second stored RF fingerprint of a second stored persona;

identifying, by the security system, the second user based at least in part on the second stored persona;

determining, by the security system, that the second user is unauthorized to enter the AUS; and

generating a second alert indicting that the second user is unauthorized in the AUS.

17. One or more non-transitory computer-readable media storing computer-executable instructions that responsive to execution cause one or more computer processors to perform operations comprising:

receiving a radio frequency (RF) fingerprint of an RF signal detected by the transceiver within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

determining a stored persona that includes a stored RF fingerprint that matches the received RF fingerprint;

determining that the electronic device that emitted the RF signal is associated with the stored persona and identify a user associated with the stored persona;

identifying, from the stored persona, access credentials of the user, wherein the access credentials provide to one or more ingress points of the AUS via one or more access control devices;

receiving, access control information indicating that the access credentials of the user have not been received at any of the one or more access control devices; and

determining that the user is in violation of a security protocol based at least in part on receiving the RF fingerprint and receiving the access control information indicating that the access credentials have not been received.

18. The one or more non-transitory computer-readable media of claim 17, the operations further comprising generating an alert indicating the violation of the security protocol.

19. The one or more non-transitory computer-readable media of claim 17, the operations further comprising determining, based at least in part on the stored persona, that the user is authorized to be in the AUS.

20. The one or more non-transitory computer-readable of claim 17, the operations further comprising:

determining, based at least in part on the stored persona, the user is unauthorized to be in the AUS; and

indicating that the user is present in the AUS.