System and method for monitoring and enforcing a restricted wireless zone

• US 7,142,108 B2
• Filed: 08/18/2005
• Issued: 11/28/2006
• Est. Priority Date: 08/19/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cognio, Inc. (Cisco Systems, Inc.)
• Inventors: Diener, Neil R., Floam, D. Andrew, Kloper, David S.
• Primary Examiner(s): Wu, Daniel
• Assistant Examiner(s): Previl, Daniel
• Application Number:
  US11/206,117
• Publication Number:
  US 20060038677A1
• Time in Patent Office: 467 Days
• Field of Search: 340/539.1, 340/540, 340/568.1, 340/541, 340/572.1, 340/551, 340/460, 340/572.3, 340/572.5, 340/517, 340/426.1, 340/5.2, 340/5.1, 340/5.61, 340/5.6, 340/539.22, 340/539.13, 340/691.6, 180/287
• US Class Current: 340/539.1
• CPC Class Codes: G01R 29/0871 Complete apparatus or systems; circuits, e.g. receivers or amplifiers G01R29/0878, G01R29/0892 take precedence; dosimeters, warning devices G01R29/0857
• CPC Class Codes: H04B 17/345 Interference values signal-to-interference ratio [SIR] or carrier-to-interference ratio [CIR] H04B17/336
• CPC Class Codes: H04B 17/354 Adjacent channel leakage power
• CPC Class Codes: H04K 2203/34 involving multiple cooperating jammers
• CPC Class Codes: H04K 3/28 with jamming and anti-jamming mechanisms both included in a same device or system, e.g. wherein anti-jamming includes prevention of undesired self-jamming resulting from jamming
• CPC Class Codes: H04K 3/42 characterized by the control of the jamming frequency or wavelength
• CPC Class Codes: H04K 3/43 characterized by the control of the jamming power, signal-to-noise ratio or geographic coverage area
• CPC Class Codes: H04K 3/45 characterized by including monitoring of the target or target signal, e.g. in reactive jammers or follower jammers for example by means of an alternation of jamming phases and monitoring phases, called "look-through mode"
• CPC Class Codes: H04K 3/822 by detecting the presence of a surveillance, interception or detection
• CPC Class Codes: H04K 3/84 related to preventing electromagnetic interference in petrol station, hospital, plane or cinema
• CPC Class Codes: H04K 3/86 related to preventing deceptive jamming or unauthorized interrogation or access, e.g. WLAN access or RFID reading record carriers with integrated circuit chips including means for preventing undesired reading or writing from or to record carriers by hindering electromagnetic reading or writing G06K19/07318; arrangements for sensing record carriers including arrangements for protecting the interrogation against piracy attacks G06K7/10257
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 4/02 Services making use of location information

Abstract

Monitoring for unauthorized RF energy emitted or transmitted in a particular zone or portion of a building, etc. Radio frequency energy is received in a region that encompasses a zone in which it is desired to monitor for unauthorized radio frequency energy. At least one characteristic of the received radio frequency energy is analyzed to determine whether unauthorized radio frequency energy is occurring in the zone. Unauthorized RF energy may be detected by analyzing at least one spectral characteristic of the received radio frequency energy and comparing the at least one spectral characteristic with data associated with authorized and/or unauthorized radio frequency energy. Alternatively, signal classification techniques can be applied to data derived from the received radio frequency energy to classify by type signals contained in the received radio frequency energy. Certain signal types may be designated as unauthorized in a particular restricted zone and the results of the signal classification analysis is compared with data for authorized and/or unauthorized signal types.

Claims

1. A method for monitoring for unauthorized radio frequency energy, comprising:

a. receiving radio frequency energy in a region that encompasses at least a zone in which it is desired to monitor for unauthorized radio frequency energy;

b. analyzing spectral characteristics of the received radio frequency energy to determine whether unauthorized radio frequency energy is occurring in the zone, wherein analyzing comprises classifying one or more signals occurring based on said spectral characteristics derived from the received radio frequency energy and comparing spectral data pertaining to signals classified from the received radio frequency energy with spectral data for signals deemed to be authorized in the zone and/or data for signals to be unauthorized in the zone; and

c. declaring that unauthorized radio frequency energy is occurring in the zone when it does not match spectral data for signals that are authorized in the zone or matches spectral data for signals that are unauthorized in the zone.

2. The method of claim 1, and further comprising storing data pertaining to said spectral characteristics during a time interval when unauthorized radio frequency energy is determined to be occurring;

and at a later time, retrieving and displaying the spectral characteristics from said time interval when unauthorized radio frequency energy is determined to be occurring.

3. The method of claim 1, wherein analyzing further comprises analyzing one or more of:

power versus frequency data, signal pulse data including pulse center frequency, pulse bandwidth, pulse duration and time between pulses of radio frequency energy, and histograms of signal pulse data associated with signal pulses detected over time.

4. The method of claim 1, wherein analyzing further comprises analyzing for a portion of the frequency band one or more of:

average power, duty cycle, pulses per second and average pulse duration.

5. The method of claim 1, wherein analyzing further comprises during a time interval, computing a series of a plurality of Fast Fourier Transforms (FFTs) of the received radio frequency energy during each of a plurality of time intervals, wherein the series of FETs during a time interval span the same frequency sub-band, but the frequency sub-band is different across the time intervals, and wherein the plurality of frequency sub-bands are substantially contiguous and span a frequency band of interest;

accumulating data associated with each of the series of FFTs during ea the plurality of time intervals; and

for each time interval, storing a value representing the maximum power that has occurred in each frequency bin over all FFTs taken during that time interval.

6. The method of claim 1, and further comprising determining a location of the source of the unauthorized radio frequency energy based on data derived from receiving the radio frequency energy at one or more known positions.

7. The method of claim 6, and further comprising tracking a source of unauthorized radio frequency energy as it moves over time.

8. The method of claim 1, and further comprising defining physical dimensions and position for the zone, and parameters associated with radio frequency energy that is to be considered unauthorized and/or authorized in the zone.

9. The method of claim 1, and further comprising invoking an action in response to determining that unauthorized radio frequency energy is occurring in the zone.

10. The method of claim 9, wherein invoking an action comprises determining the type of action to take in response to detection of unauthorized radio frequency energy based on at least one spectral related characteristic of the unauthorized radio frequency energy determined to be occurring in the zone.

11. The method of claim 1, and further comprising defining a plurality of zones in which it is desired to monitor for unauthorized radio frequency energy, and invoking an action in response to detection of unauthorized radio frequency energy in one of the plurality of zones, wherein said action is based on which a particular one of the plurality of zones in which the unauthorized radio frequency energy is determined to be occurring.

12. The method of claim 11, and further comprising selecting one or more of a plurality of available actions depending on which particular one of the plurality of zones the unauthorized radio frequency energy is detected.

13. The method of claim 12, wherein selecting comprises selecting one or more of the plurality of available actions based further on at least one spectral related characteristic of the unauthorized radio frequency energy that is determined to be occurring.

14. The method of claim 1, and further comprising generating an alert when an unauthorized device is detected, said alert comprising one or more of:

an email message, visual display, audio announcement and SNMP trap.

15. The method of claim 1, wherein receiving comprises receiving radio frequency energy at a plurality of positions in said region, and analyzing comprises analyzing at least one spectral related characteristic of the received radio frequency energy at each of the plurality of positions to determine whether there is unauthorized radio frequency energy occurring, and further comprising correlating information pertaining to unauthorized radio frequency energy received at each of the plurality of positions.

17. The method of claim 1, and further comprising transmitting a jamming signal having characteristics to cause interference with the unauthorized radio frequency energy.

18. The method of claim 17, wherein transmitting comprises transmitting a jamming signal from at least one device that is determined to be close to the source of the unauthorized radio frequency energy.

19. The method of claim 1, wherein receiving comprises receiving radio frequency energy in a region that encompasses at least two or more zones, and wherein analyzing comprises analyzing spectral characteristics of the received radio frequency energy in each of the two or more zones, wherein each zone may have associated therewith different spectral related parameters of radio frequency energy that is to be considered unauthorized radio frequency energy.

20. The method of claim 19, and further comprising defining physical dimensions and position for the two or more zones, and parameters associated with radio frequency energy that is to be considered unauthorized and/or authorized in each of the respective two or more zones.

16. A method for monitoring for unauthorized radio frequency energy, comprising:

a. receiving radio frequency energy in a region that encompasses at least a zone in which it is desired to monitor for unauthorized radio frequency energy;

b. analyzing spectral characteristics of the received radio frequency energy to determine whether unauthorized radio frequency energy is occurring in the zone;

c. comparing spectral data pertaining to signals classified from the received radio frequency energy with spectral data for signals deemed to be authorized in the zone and/or data for signals to be unauthorized in the zone; and

d. declaring that unauthorized radio frequency energy is occurring in the zone when it does not match spectral data for signals that are authorized in the zone or matches spectral data for signals that are unauthorized in the zone.

21. A system for monitoring for unauthorized radio frequency energy, comprising:

a. a plurality of radio sensor devices each at a corresponding position in a region that encompasses a zone in which it is desired to monitor for unauthorized radio frequency energy, wherein each radio sensor device receives radio frequency energy and analyzes spectral characteristics of the radio frequency energy it receives to determine whether unauthorized radio frequency energy is occurring; and

b. a computer connected to each of the plurality of radio sensor devices that receives data from the radio sensor devices concerning radio frequency energy that they monitor, and wherein the computer correlates the data received from the radio sensor devices with respect to data for unauthorized radio frequency energy determined to be occurring in the zone.

22. The system of claim 21, wherein the computer stores data received from at least one radio sensor device pertaining to spectral characteristics associated with received radio frequency energy by at least one radio sensor device during a time interval when unauthorized radio frequency energy is determined to be occurring, and at a later time, retrieves and displays the spectral characteristics from said time interval when unauthorized radio frequency energy is determined to be occurring.

23. A radio device comprising:

a. a radio receiver that receives radio frequency energy;

b. a processor coupled to the radio receiver the characteristic of the received radio frequency energy to determine whether unauthorized radio frequency energy is occurring in the zone; and

c. a spectrum analysis device coupled to the radio receiver and to the processor, wherein the spectrum analysis device produces data pertaining to spectral characteristics of the received radio frequency energy, and wherein the processor analyzes said spectral characteristics to determine whether unauthorized radio frequency energy is occurring in the zone.

24. The radio device of claim 23, wherein the processor analyzes for a portion of the frequency band one or more of:

average power, duty cycle, pulses per second and average pulse duration.

25. The radio device of claim 23, wherein the spectrum analysis device computes a series of a plurality of Fast Fourier Transforms (FFTs) of the received radio frequency energy during each of a plurality of time intervals, wherein the series of FFTs during a time interval span the same frequency sub-band, but the frequency sub-band is different across the time intervals, and wherein the plurality of frequency sub-bands are substantially contiguous and span a frequency band of interest;

accumulating data associated with each of the series of FFTs during each of the plurality of time intervals; and

for each time interval, the processor stores a value representing the maximum power that has occurred in each frequency bin over all FFTs taken during that time interval.

26. The radio device of claim 23, wherein the processor classifies one or more signals occurring based on data derived from the received radio frequency energy.

27. The radio device of claim 26, wherein the processor compares data pertaining to signals classified from the received radio frequency energy with data for signals deemed to be authorized in the zone and/or data for signals to be unauthorized in the zone, and declares that unauthorized radio frequency energy is occurring in the zone when it does not match data for signals that are authorized in the zone or matches data for signals that are unauthorized in the zone.

28. The radio device of claim 23, wherein the processor compares data pertaining to one or more characteristics of the received radio frequency energy with data for authorized radio frequency energy in the zone, and declares that unauthorized radio frequency energy is occurring in the zone when it does not match data for authorized radio frequency energy in the zone.

29. The radio device of claim 23, wherein the processor processes data output by the spectrum analysis device associated with received radio frequency energy in each of two or more zones and processes the data such that each zone has different parameters of radio frequency energy that is to be considered unauthorized radio frequency energy.

30. The radio device of claim 29, wherein the processor is responsive to user interface commands to define physical dimensions and position for the two or more zones, and parameters associated with radio frequency energy that is to be considered unauthorized and/or authorized in each of the respective two or more zones.

31. The radio device of claim 23, wherein the processor is responsive to user interface commands to define physical dimensions and position for the zone, and parameters associated with radio frequency energy that is to be considered unauthorized and/or authorized in the zone.

32. The radio device of claim 23, wherein the processor is responsive to user interface commands for defining a plurality of zones in which it is desired to monitor for unauthorized radio frequency energy, and invokes an action in response to detection of unauthorized radio frequency energy in one of the plurality of zones, wherein said action is based on which a particular one of the plurality of zones in which the unauthorized radio frequency energy is determined to be occurring.

33. The radio device of claim 23, wherein the processor selects one or more of a plurality of available actions based on at least one of:

which particular one of the plurality of zones the unauthorized radio frequency energy is detected and at least one characteristic of the unauthorized radio frequency energy that is determined to be occurring.

34. The radio device of claim 23, and further comprising a memory that stores for later retrieval and display data pertaining to said spectral characteristics during a time interval when unauthorized radio frequency energy is determined to be occurring.

35. A processor readable medium storing instructions that, when executed by a processor, cause the processor to:

analyze at least one characteristic associated with received radio frequency energy to determine whether unauthorized radio frequency energy is occurring in a zone where said radio frequency energy is received, and to store data pertaining to characteristics associated with radio frequency energy received during a time interval when unauthorized radio frequency energy is determined to be occurring, and at a later time, effect retrieval and display of the spectral characteristics from said time interval when unauthorized radio frequency energy is determined to be occurring.

36. The processor readable medium of claim 35, wherein the instructions to analyze comprise instructions to analyze one or more of:

power versus frequency data, signal pulse data including pulse center frequency, pulse bandwidth, pulse duration and time between pulses of radio frequency energy, and histograms of signal pulse data associated with signal pulses detected over time.

37. The processor readable medium of claim 35, wherein the instructions to analyze comprise instructions for analyzing one or more of:

average power, duty cycle, pulses per second and average pulse duration.

38. The processor readable medium of claim 35, wherein the instructions to analyze comprise instructions for classifying one or more signals occurring based on data derived from the received radio frequency energy.

39. The processor readable medium of claim 38, and further comprising instructions stored on the medium for comparing data pertaining to signals classified from the received radio frequency energy with data for signals deemed to be authorized in the zone and/or data for signals to be unauthorized in the zone, and declaring that unauthorized radio frequency energy is occurring in the zone when it does not match data for signals that are authorized in the zone or matches data for signals that are unauthorized in the zone.

40. The processor readable medium of claim 35, and further comprising instructions stored on the medium for comparing data pertaining to one or more characteristics of the received radio frequency energy with data for authorized radio frequency energy in the zone, and declaring that unauthorized radio frequency energy is occurring in the zone when it does not match data for authorized radio frequency energy in the zone.

41. The processor readable medium of claim 35, wherein the instructions to analyze comprise instructions for analyzing characteristics associated with received radio frequency energy in each of the two or more zones, wherein each zone may have associated therewith different parameters of radio frequency energy that is to be considered unauthorized radio frequency energy.

42. A method for monitoring for unauthorized radio frequency energy, comprising:

a. receiving radio frequency energy in a region that encompasses at least two or more zones in which it is desired to monitor for unauthorized radio frequency energy; and

b. analyzing spectral characteristics of the received radio frequency energy in each of the two or more zones to determine whether unauthorized radio frequency energy is occurring in the zone, wherein each zone may have associated therewith different spectral related parameters of radio frequency energy that is to be considered unauthorized radio frequency energy.

43. The method of claim 42, and further comprising defining physical dimensions and position for the two or more zones, and parameters associated with radio frequency energy that is to be considered unauthorized and/or authorized in each of the respective two or more zones.

44. A method for monitoring for unauthorized radio frequency energy, comprising:

a. receiving radio frequency energy at a plurality of positions in a region that encompasses at least one zone in which it is desired to monitor for unauthorized radio frequency energy;

b. analyzing at least one spectral related characteristic of the received radio frequency energy at each of the plurality of positions to determine whether there is unauthorized radio frequency energy occurring; and

c. correlating information pertaining to unauthorized radio frequency energy received at each of the plurality of positions.

45. A method for monitoring for unauthorized radio frequency energy, comprising:

a. receiving radio frequency energy in a region that encompasses at least a zone in which it is desired to monitor for unauthorized radio frequency energy;

b. analyzing spectral characteristics of the received radio frequency energy to determine whether unauthorized radio frequency energy is occurring in the zone; and

c. storing data pertaining to said spectral characteristics during a time interval when unauthorized radio frequency energy is determined to be occurring; and

d. at a later time, retrieving and displaying the spectral characteristics from said time interval when unauthorized radio frequency energy is determined to be occurring.

46. A method for monitoring for unauthorized radio frequency energy, comprising:

a. receiving radio frequency energy in a region that encompasses at least a zone in which it is desired to monitor for unauthorized radio frequency energy; and

b. analyzing spectral characteristics of the received radio frequency energy to determine whether unauthorized radio frequency energy is occurring in the zone, wherein analyzing comprises;

i. during a time interval, computing a series of a plurality of Fast Fourier Transforms (FFTs) of the received radio frequency energy during each of a plurality of time intervals, wherein the series of FFTs during a time interval span the same frequency sub-band, but the frequency sub-band is different across the time intervals, and wherein the plurality of frequency sub-bands are substantially contiguous and span a frequency band of interest;

ii. accumulating data associated with each of the series of FFTs during each of the plurality of time intervals; and

iii. for each time interval, storing a value representing the maximum power that has occurred in each frequency bin over all FFTs taken during that time interval.