Method and apparatus for identifying wireless transmitters

• US 8,249,028 B2
• Filed: 07/24/2006
• Issued: 08/21/2012
• Est. Priority Date: 07/22/2005
• Status: Active Grant

• Current Assignee: SRI International, Inc.
• Original Assignee: SRI International, Inc.
• Inventors: Porras, Phillip Andrew, Corr, Michael G., Dawson, Steven Mark, Watt, David, Manseau, David, Marcotullio, John Peter
• Primary Examiner(s): TORRES, MARCOS L
• Application Number:
  US11/492,398
• Publication Number:
  US 20070025245A1
• Time in Patent Office: 2,220 Days
• Field of Search: 370/335, 370/338, 370/332, 370/328, 455410-411, 455423-425, 455/67.11, 455/67.16, 455/550.1, 342/44
• US Class Current: 370/335
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04W 99/00 Subject matter not provided for in other groups of this subclass

Abstract

In one embodiment, the present invention is a method and apparatus for identifying wireless transmitters. In one embodiment, a method for identifying a transmitter in a wireless computing network includes extracting one or more radio frequency signal characteristics from a communication from the transmitter and generating a fingerprint of the transmitter in accordance at least one of the extracted radio frequency signal characteristics.

Claims

1. A method for identifying a transmitter in a wireless computing network, the method comprising:

extracting a plurality radio frequency signal characteristics from a plurality of frames, the plurality of frames being contained in a plurality of signals sent by the transmitter; and

generating a fingerprint of the transmitter in accordance with at least one of the plurality of radio frequency signal characteristics, wherein said generating comprises constructing an expectation of a set of radio frequency signal characteristics in a future transmission event associated with the transmitter, in accordance with the at least one of the plurality of radio frequency signal characteristics, wherein those of the plurality of radio frequency signal characteristics that are extracted from more recent ones of the plurality of signals are weighted more heavily in the constructing than those of the plurality of radio frequency signal characteristics that are extracted from less recent ones of the plurality of signals, wherein the generating comprises;

generating a full fingerprint for an initial authentication of the transmitter to the wireless computing network, where the full fingerprint is generated in accordance with all of the plurality of radio frequency signal characteristics;

generating a light-weight fingerprint for each of one or more communications received from the transmitter after the initial authentication, where the light-weight fingerprint is generated in accordance with a subset of the plurality of radio frequency signal characteristics; and

determining how to treat a given one of the one or more communications in accordance with a light-weight fingerprint associated with the given one of the one or more communications.

2. The method of claim 1, wherein the subset includes at least one of:

an angle of arrival, a signal strength, or a center frequency error.

3. The method of claim 1, wherein the plurality of radio frequency signal characteristics further include at least one of:

a data rate of an orthogonal frequency-division multiplexing frame of the communication, a number of symbols in a frame of the communication, a common pilot error, an error vector magnitude, a pilot subcarrier error vector magnitude, a center frequency error, an IQ offset, a quadrature skew error, an IQ gain imbalance, a synchronization correlation, or a symbol clock frequency error.

4. The method of claim 1, wherein the wireless computing network is an Institute of Electrical and Electronics Engineers 802.11wireless computing network.

5. The method of claim 1, further comprising:

receiving a plurality of independent transmission events that are purported to be from the transmitter;

verifying, in accordance with the fingerprint and the plurality of independent transmission events, whether the plurality of independent transmission events are from the transmitter; and

detecting an instance of traffic injection when the plurality of independent transmission events are not verified as being from the transmitter.

6. The method of claim 1, further comprising:

receiving a plurality of independent transmission events from a plurality of transmitters, including the transmitter; and

determining, in accordance with a plurality of respective fingerprints for the plurality of transmitters and the plurality of independent transmission events, whether the plurality of transmitters belong to a common manufacturer or product model.

7. The method of claim 1, further comprising:

receiving a transmission event from the transmitter, the transmission event including an assertion that the transmitter is assigned to a given media access control address; and

validating the assertion, in accordance with the fingerprint and the transmission event.

8. The method of claim 1, wherein the transmitter is a known source of interference in the wireless computing network, and the one or more radio frequency signal characteristics indicate a radio frequency disruption pattern.

9. The method of claim 1, further comprising:

receiving a transmission event from the transmitter, where the transmitter is a fixed-location transmitter;

identifying the transmitter, in accordance with the fingerprint and the transmission event;

identifying a location from which the transmitter is expected to transmit; and

verifying that the transmitter is transmitting from the location.

10. The method of claim 1, further comprising:

exporting the fingerprint to a network security system associated with a network other than the wireless computing network or to a management station that sends fingerprints to a plurality of network security systems.

11. The method of claim 1, further comprising:

detecting suspicious activity originating from the transmitter; and

reporting the fingerprint to an intrusion prevention system.

12. The method of claim 1, further comprising:

detecting suspicious activity originating from the transmitter; and

marking an entry associated with the fingerprint in a fingerprint store to indicate the suspicious activity.

13. The method of claim 1, wherein those of the plurality of radio frequency signal characteristics that are extracted from more recent ones of the plurality of signals and those of the plurality of radio frequency signal characteristics that are extracted from less recent ones of the plurality of signals are weighted with respective non-zero weights.

14. The method of claim 1, wherein the fingerprint further comprises a tolerance indicative of a permissible deviation from a stored fingerprint.

15. The method of claim 1, wherein the generating further comprises:

estimating a location of the transmitter in accordance with the plurality of radio frequency signal characteristics.

16. The method of claim 1, further comprising:

storing the fingerprint in a database.

17. The method of claim 16, wherein a database entry for the fingerprint further comprises a corporate asset identifier.

18. The method of claim 1, wherein the plurality of radio frequency signal characteristics include at least one of:

one or more characteristics of a turn-on section of each of the plurality of frames, one or more characteristics of a turn-off section of each of the plurality of frames, one or more Legendre polynomial coefficients generated from a log-magnitude power within the turn- on section, one or more Legendre polynomial coefficients generated from a log- magnitude power within the turn-off section, a turn-on step duration, a turn-off step duration, a turn-on time placement, a turn-off time placement, a turn-on normalized power level, or a turn-off normalized power level.

19. The method of claim 18, wherein the turn-on section of each of the plurality of frames and the turn-off section of each of the plurality of frames are defined with respect to a symbol start time definition.

20. The method of claim 1, further comprising:

receiving a transmission event from the transmitter;

verifying that the transmitter is authorized to access the wireless computing network, in accordance with the fingerprint and the transmission event; and

prompting a user of the transmitter for additional data when it is determined that the transmitter is not authorized to access the wireless computing network.

21. The method of claim 20, wherein the additional data comprises at least one of:

monetary payment information or identifying information relating to the user.

22. The method of claim 1, wherein the one or more radio frequency signal characteristics further include one or more characteristics that are at least one of:

device-unique, model-unique, or session-unique.

23. The method of claim 22, wherein the device-unique characteristics include at least one of:

a carrier signal frequency, a clock offset, a jitter, a phase noise, or sideband characteristics.

24. The method of claim 22, wherein the model-unique characteristics include at least one of:

a signal drift, a shift recovery characteristic, a signal constellation stability, a signal amplitude rise time, or an active gain control.

25. The method of claim 22, wherein the session-unique characteristics include at least one of:

a signal strength intensity, an angle of arrival, or an angle/delay spread.

26. A computer readable medium containing an executable program for identifying a transmitter in a wireless computing network, where the program performs steps of:

extracting a plurality of radio frequency signal characteristics from a plurality of frames, the plurality of frames being contained in a plurality of signals sent by the transmitter; and

generating a fingerprint of the transmitter in accordance with at least one of the plurality of radio frequency signal characteristics, wherein said generating comprises constructing an expectation of a set of radio frequency signal characteristics in a future transmission event associated with the transmitter, in accordance with the at least one of the plurality of radio frequency signal characteristics, wherein those of the plurality of radio frequency signal characteristics that are extracted from more recent ones of the plurality of signals are weighted more heavily in the constructing than those of the plurality of radio frequency signal characteristics that are extracted from less recent ones of the plurality of signals, wherein the generating comprises;

generating a full fingerprint for an initial authentication of the transmitter to the wireless computing network, where the full fingerprint is generated in accordance with all of the plurality of radio frequency signal characteristics;

generating a light-weight fingerprint for each of one or more communications received from the transmitter after the initial authentication, where the light-weight fingerprint is generated in accordance with a subset of the plurality of radio frequency signal characteristics; and

determining how to treat a given one of the one or more communications in accordance with a light-weight fingerprint associated with the given one of the one or more communications.

27. The computer readable medium of claim 26, wherein the subset includes at least one of:

an angle of arrival, a signal strength, or a center frequency error.

28. The computer readable medium of claim 26, wherein the plurality of radio frequency signal characteristics further include at least one of:

a data rate of an orthogonal frequency-division multiplexing frame of the communication, a number of symbols in a frame of the communication, a common pilot error, an error vector magnitude, a pilot subcarrier error vector magnitude, a center frequency error, an IQ offset, a quadrature skew error, an IQ gain imbalance, a synchronization correlation, or a symbol clock frequency error.

29. The computer readable medium of claim 26, wherein the wireless computing network is an Institute of Electrical and Electronics Engineers 802.11 wireless computing network.

30. The computer readable medium of claim 26, wherein the plurality of radio frequency signal characteristics include at least one of:

one or more characteristics of a turn-on section of each of the plurality of frames, one or more characteristics of a turn-off section of each of the plurality of frames, one or more Legendre polynomial coefficients generated from a log-magnitude power within the turn-on section, one or more Legendre polynomial coefficients generated from a log-magnitude power within the turn-off section, a turn-on step duration, a turn-off step duration, a turn-on time placement, a turn-off time placement, a turn-on normalized power level, or a turn-off normalized power level.

31. The computer readable medium of claim 26, wherein the fingerprint further comprises a tolerance indicative of a permissible deviation from a stored fingerprint.

32. The computer readable medium of claim 26, wherein the generating further comprises:

estimating a location of the transmitter in accordance with the one or more radio frequency signal characteristics.

33. The computer readable medium of claim 26, wherein the plurality of radio frequency signal characteristics further include characteristics that are at least one of:

device-unique, model-unique, or session-unique.

34. The computer readable medium of claim 33, wherein the device-unique characteristics include at least one of:

a carrier signal frequency, a clock offset, a jitter, a phase noise, or sideband characteristics.

35. The computer readable medium of claim 33, wherein the model-unique characteristics include at least one of:

a signal drift, a shift recovery characteristic, a signal constellation stability, a signal amplitude rise time, or an active gain control.

36. The computer readable medium of claim 33, wherein the session-unique characteristics include at least one of:

a signal strength intensity, an angle of arrival, or an angle/delay spread.

37. The computer readable medium of claim 26, further comprising:

storing the fingerprint in a database.

38. The computer readable medium of claim 37, wherein a database entry for the fingerprint further comprises a corporate asset identifier.

39. A method for identifying a transmitter in a wireless computing network, the method comprising:

extracting a plurality of radio frequency signal characteristics from a plurality of frames, the plurality of frames being contained in a plurality of signals sent by the transmitter;

generating a fingerprint of the transmitter in accordance with at least one of the plurality of radio frequency signal characteristics, wherein said generating comprises constructing an expectation of a set of radio frequency signal characteristics in a future transmission event associated with the transmitter, in accordance with the at least one of the plurality of radio frequency signal characteristics, wherein those of the plurality of radio frequency signal characteristics that are extracted from more recent ones of the plurality of signals are weighted more heavily in the constructing than those of the plurality of radio frequency signal characteristics that are extracted from less recent ones of the plurality of signals

receiving a transmission event from the transmitter, the transmission event including an assertion that the transmitter is assigned to a given media access control address; and

validating the assertion, in accordance with the fingerprint and the transmission event.