DETECTION SYSTEM AND METHOD

• US 20170344760A1
• Filed: 08/19/2016
• Published: 11/30/2017
• Est. Priority Date: 05/26/2016
• Status: Active Grant

• Current Assignee: Raytheon Company (Rtx Corporation)
• Original Assignee: Raytheon Company (Rtx Corporation)
• Inventors: Jennings, William T., Hoffman, John, Craig, Johnathan W.
• Granted Patent: US 10,452,872 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 21/75 by inhibiting the analysis of circuitry or operation
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3278 using physically unclonable functions [PUF]

Abstract

A system for detecting changes to circuitry includes: a processor; and a memory, and the memory has stored thereon instructions that, when executed by the processor, cause the processor to: periodically measure physical characteristic data of the circuitry, operational data of the circuitry, and environmental data; periodically capture the measured data; generate a dynamic fingerprint based on an aggregation of a first set of the captured data, and the dynamic fingerprint is a compound data structure encapsulating the aggregated data; associate metadata with the dynamic fingerprint; periodically update the dynamic fingerprint according to successive sets of the captured data; and compare the updated dynamic fingerprint to a previous dynamic fingerprint, to detect the changes to the circuitry.

Claims

1. A system for detecting changes to circuitry, the system comprising:

a processor; and

a memory, wherein the memory has stored thereon instructions that, when executed by the processor, cause the processor to;

periodically measure physical characteristic data of the circuitry, operational data of the circuitry, and environmental data;

periodically capture the measured data;

generate a dynamic fingerprint based on an aggregation of a first set of the captured data, wherein the dynamic fingerprint is a compound data structure encapsulating the aggregated data;

associate metadata with the dynamic fingerprint;

periodically update the dynamic fingerprint according to successive sets of the captured data; and

compare the updated dynamic fingerprint to a previous dynamic fingerprint, to detect the changes to the circuitry.

2. The system of claim 1, wherein the instructions that cause the processor to generate the dynamic fingerprint comprise instructions for refining the captured data by applying a mask or a shaping function to the captured data.

3. The system of claim 2, wherein the instructions that cause the processor to generate the dynamic fingerprint further comprise instructions for deriving statistics from the refined data by applying a statistical function to the refined data.

4. The system of claim 3, wherein the instructions that cause the processor to generate the dynamic fingerprint further comprise instructions for refining the derived statistics by applying a mask or a shaping function to the derived statistics.

5. The system of claim 4, wherein the instructions that cause the processor to generate the dynamic fingerprint further comprise instructions for applying a compression function or a hash function to the refined derived statistics.

6. The system of claim 1, wherein the metadata comprises at least one of:

a time when the measured data was captured, a capture sequence number, an associated dynamic fingerprint, and actual measured data.

7. The system of claim 1, wherein the metadata comprises at least one of:

rules for applying statistical analysis to the captured data, parameters for applying statistical analysis to the captured data, and attributes of the dynamic fingerprint.

8. The system of claim 1, wherein the metadata comprises at least one of:

an identifier of the circuit, an operation state of the circuit, and environmental information of the circuit.

9. The system of claim 1, wherein the measured data comprises data corresponding to a modification of an operational state of the circuit or an environment surrounding the circuit, the modification being induced by an external source, and the instructions further cause the processor to update the dynamic fingerprint according to the modification.

10. The system of claim 1, wherein the instructions further cause the processor to:

capture an initial data set of the physical characteristic data, prior to fielding of the circuitry;

identify an expected behavior of the circuitry based on the initial data set; and

compare at least one of the dynamic fingerprint and the updated dynamic fingerprint with the expected behavior, after fielding of the circuitry.

11. The system of claim 1, wherein the instructions further cause the processor to correlate the detected changes with a presence of an unidentified observer of the circuit.

12. The system of claim 1, wherein the circuitry comprises a transmitter and a receiver, and the physical characteristic data comprises at least one of transmitter filter coefficients, receiver filter coefficients, and eye diagram data corresponding to the transmitter and the receiver.

13. The system of claim 12, wherein the eye diagram data comprises at least one of:

a height of the eye diagram, a leading edge of the eye diagram, a falling edge of the eye diagram, and a width of the eye diagram.

14. The system of claim 12, wherein the measured data comprises data received by the receiver.

15. The system of claim 1, wherein the circuitry comprises at least two entities communicating over a high-speed Serializer/Deserializer communications link.

16. The system of claim 1, wherein the measured data corresponds to a plurality of communications channels between a plurality of entities, and the dynamic fingerprint is generated based on an aggregation of captured data from the plurality of communications channels.

17. A method of detecting changes to circuitry, the method comprising:

periodically measuring, by a processor, physical characteristic data of the circuitry, operational data of the circuitry, and environmental data;

periodically capturing, by the processor, the measured data;

generating, by the processor, a dynamic fingerprint based on an aggregation of a first set of the captured data, wherein the dynamic fingerprint is a compound data structure encapsulating the aggregated data;

associating, by the processor, metadata with the dynamic fingerprint;

periodically updating, by the processor, the dynamic fingerprint according to successive sets of the captured data; and

comparing, by the processor, the updated dynamic fingerprint to a previous dynamic fingerprint, to detect the changes to the circuitry.

18. The method of claim 17, wherein generating the dynamic fingerprint comprises refining, by the processor, the captured data by applying a mask or a shaping function to the captured data.

19. The method of claim 18, wherein generating the dynamic fingerprint further comprises deriving, by the processor, statistics from the refined data by applying a statistical function to the refined data.

20. The method of claim 19, wherein generating the dynamic fingerprint further comprises refining, by the processor, the derived statistics by applying a mask or a shaping function to the derived statistics.

21. The method of claim 20, wherein generating the dynamic fingerprint further comprises applying, by the processor, a compression function or a hash function to the refined derived statistics.

22. The method of claim 17, wherein the metadata comprises at least one of:

a time when the measured data was captured, a capture sequence number, an associated dynamic fingerprint, and actual measured data.

23. The method of claim 17, wherein the metadata comprises at least one of:

rules for applying statistical analysis to the captured data, parameters for applying statistical analysis to the captured data, and attributes of the dynamic fingerprint.

24. The method of claim 17, wherein the metadata comprises at least one of:

an identifier of the circuit, an operation state of the circuit, and environmental information of the circuit.

25. The method of claim 17, wherein the measured data comprises data corresponding to a modification of an operational state of the circuit or an environment surrounding the circuit, the modification being induced by an external source, and the method further comprises updating, by the processor, the dynamic fingerprint according to the modification.

26. The method of claim 17, further comprising:

capturing, by the processor, an initial data set of the physical characteristic data, prior to fielding of the circuitry;

identifying, by the processor, an expected behavior of the circuitry based on the initial data set; and

comparing, by the processor, at least one of the dynamic fingerprint and the updated dynamic fingerprint with the expected behavior, after fielding of the circuitry.

27. The method of claim 17, further comprising correlating, by the processor, the detected changes with a presence of an unidentified observer of the circuit.

28. The method of claim 17, wherein the circuitry comprises a transmitter and a receiver, and the physical characteristic data comprises at least one of transmitter filter coefficients, receiver filter coefficients, and eye diagram data corresponding to the transmitter and the receiver.

29. The method of claim 28, wherein the eye diagram data comprises at least one of:

a height of the eye diagram, a leading edge of the eye diagram, a falling edge of the eye diagram, and a width of the eye diagram.

30. The method of claim 28, wherein the measured data comprises data received by the receiver.

31. The method of claim 17, wherein the circuitry comprises at least two entities communicating over a high-speed Serializer/Deserializer communications link.

32. The method of claim 17, wherein the measured data corresponds to a plurality of communications channels between a plurality of entities, and the dynamic fingerprint is generated based on an aggregation of captured data from the plurality of communications channels.