Location-based intrusion detection system

• US 8,660,526 B1
• Filed: 06/24/2005
• Issued: 02/25/2014
• Est. Priority Date: 06/24/2005
• Status: Active Grant

• Current Assignee: Rockwell Collins, Inc. (Raytheon Technologies Corporation d/b/a RTX)
• Original Assignee: Rockwell Collins, Inc. (Raytheon Technologies Corporation d/b/a RTX)
• Inventors: Heiderscheit, David D.
• Primary Examiner(s): Cai, Wayne
• Assistant Examiner(s): HEIBER, SHANTELL LAKETA
• Application Number:
  US11/166,698
• Time in Patent Office: 3,168 Days
• Field of Search: 455/410, 455/411, 455/456.1, 455/404.2
• US Class Current: 455/410
• CPC Class Codes: H04M 1/663 Preventing unauthorised calls to a telephone set
• CPC Class Codes: H04M 1/72457 according to geographic location

Abstract

A method of detecting messages from an unwanted source in an ad-hoc network is disclosed. According to the method, a first message is received that purports to be from a mobile communication device. The first purported message has a first location component incorporated therein. A second message is received that purports to be from the mobile communication device. The second message has a second location component incorporated therein. The first location component is compared with the second location component. It is determined that one of the first purported message and the second purported message is not from the mobile communication device when the first location component is inconsistent with the second location component.

Claims

1. In an ad-hoc network, a method of detecting messages from an unwanted intruder, the method comprising:

receiving a first message purporting to be from a mobile communication device in the ad-hoc network, the first message having a first location component incorporated therein;

receiving a second message purporting to be from the mobile communication device, the second message having a second location component incorporated therein;

determining movement based upon the first location component and the second location component; and

determining whether at least one of the first message and the second message is from the intruder by comparing the movement with a distance required for the mobile communication device to change direction, wherein the distance required for the mobile communication device to change direction is determined based on physical movement capabilities of a vehicle or person with which the mobile communication device is associated and the distance required for the mobile communication device to change direction is stored in a database, and wherein determining whether at least one of the first message and the second message is from the intruder comprises determining that at least one of the first message and the second message is from the intruder when the movement and the distance required for the mobile communication device to change direction indicate that the mobile communication device could not have changed direction quickly enough to travel from a location associated with the first location component to a location associated with the second location component.

2. The method of claim 1, wherein the at least one of the first and second messages further provides information relating to one of a topology and a connectivity of the ad-hoc network.

3. The method of claim 1, further comprising:

receiving a third message purporting to be from the mobile communication device, the third message having a third location component incorporated therein;

comparing the third location component with the first and second location components; and

determining which of the first, second and third messages is from the unwanted intruder.

4. The method of claim 1, wherein determining whether at least one of the first message and the second message is from the intruder further comprises comparing the movement with a turning radius.

5. The method of claim 1, wherein the mobile communication device is a first mobile communication device, and wherein the first message is received by a second communication device, and further wherein the first and second devices are nodes in the ad-hoc network.

6. The method of claim 1, wherein determining whether at least one of the first message and the second message is from the intruder further comprises comparing at least one of the first location component, the second location component, and the movement with known transportation routes.

7. The method of claim 1, further comprising:

initiating a response when it is determined that at least one of the first message and the second message is from the intruder.

8. The method of claim 7, wherein the response includes disregarding messages purporting to be from the mobile communication device.

9. The method of claim 1, wherein a device type of the mobile communications device includes at least one of a hand-held mobile communications device, an aircraft-mounted mobile communications device and a road-vehicle-mounted mobile communications device.

10. A method of detecting an intruder in a communication network having a plurality of nodes, wherein a position of a first node is determined, the first node being mobile, the method comprising:

receiving the position of the first node at a second node in the network;

determining movement of the first node;

receiving at the second node a message purporting to be from the first node, the message containing a location identifier; and

determining whether the message is from the intruder by comparing a location associated with the location identifier with the position of the first node, the movement of the first node, and a distance required for the first node to change direction, wherein the distance required for the first node to change direction is stored in a database and is determined based on physical movement capabilities of a vehicle or person with which the first node is associated, and wherein determining whether the message is from the intruder comprises determining that the message is from the intruder when the movement of the first node and the distance required for the first node to change direction indicate that the first node could not have changed direction quickly enough to travel from the received position of the first node to the location associated with the location identifier of the message.

11. The method of claim 10, wherein the position of the first node is communicated to the second node by incorporating the position of the first node into a data packet transmitted from the first node to the second node.

12. The method of claim 10, wherein the position of the first node is communicated to the second node by incorporating the position of the first node into a transmission sent between nodes in the network, wherein the transmission provides information relating to one of a topology and a connectivity of the nodes within the network.

13. The method of claim 10, wherein determining whether the message is from the intruder comprises comparing at least one of the location associated with the location identifier, the position of the first node, and the movement of the first node with an altitude.

14. The method of claim 10, wherein the position communicated to the second node is one of a plurality of successive positions of the first node that are communicated to the second node, and further wherein the plurality of successive positions are compared with the location identifier to determine that the message is not from the first node when the location identifier is inconsistent with the plurality of successive positions of the first node.

15. The method of claim 10, further comprising:

disregarding communications from the first node when the message is not from the first node.

16. A communications device configured for use in an ad-hoc communications network, the device comprising:

a communicating portion that receives messages from devices in the ad-hoc communications network and sends messages to devices in the ad-hoc communications network, the messages including location information of another device in the network;

a processing portion configured to determine whether messages from another device can be trusted based on a plurality of messages received at the communications device that were purportedly sent from said another device, each of the plurality of messages including a location component, wherein the processing portion is configured to compare the location components of at least two of the plurality of messages with a distance required for said another device to change direction, wherein the distance required for said another device to change direction is stored in a database determined based on physical movement capabilities of a vehicle or person with which said another device is associated, and wherein the processing portion is configured to determine that messages from said another device cannot be trusted when the comparison of the location components of the at least two messages and the distance required for said another device to change direction indicates that said another device could not have changed direction quickly enough to travel between locations associated with the location components of the at least two messages.

17. The communications device of claim 16, further comprising:

a memory portion configured to store the previously received location information.

18. The communications device of claim 17, wherein the previously received location information comprises information relating to a plurality of previous locations of said another device.

19. The communications device of claim 17, wherein the memory portion is further configured to store a time when the previously received location information was transmitted by said another device.

20. The communications device of claim 17, wherein the memory portion is further configured to store at least one of a plurality of characteristics of said another device, said plurality of characteristics describing at least one of movement and performance of said another device.