Security measures based on signal strengths of radio frequency signals

• US 9,485,266 B2
• Filed: 01/30/2015
• Issued: 11/01/2016
• Est. Priority Date: 06/02/2014
• Status: Active Grant

• Current Assignee: Bastille Networks, Inc.
• Original Assignee: Bastille Networks, Inc.
• Inventors: Baxley, Robert John, Rouland, Christopher Jay, Engle, Michael Thomas
• Primary Examiner(s): TRAN, MONG-THUY THI
• Application Number:
  US14/610,640
• Publication Number:
  US 20150350862A1
• Time in Patent Office: 641 Days
• Field of Search: 455/404.2, 455/456.1, 455/456.3, 455/404.1, 455/456.2, 455/457
• US Class Current: 1/1
• CPC Class Codes: G07C 2209/61 Signal comprising different frequencies, e.g. frequency hopping
• CPC Class Codes: G07C 2209/63 Comprising locating means for detecting the position of the data carrier, i.e. within the vehicle or within a certain distance from the vehicle
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence
• CPC Class Codes: H04B 17/318 Received signal strength
• CPC Class Codes: H04B 17/391 Modelling the propagation channel
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 4/027 using movement velocity, acceleration information
• CPC Class Codes: H04W 4/90 Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]

Abstract

Electromagnetic (EM)/radio frequency (RF) emissions may be detected and corresponding EM personas may be created. One or more EM personas may be associated with a super persona corresponding to a particular entity. EM personas, super personas, and/or supplemental identifying information can be used to enforce security protocols.

Claims

1. A system, comprising:

a radio frequency (RF) sensor configured to detect RF signals;

at least one memory that stores computer-executable instructions; and

an RF controller operationally coupled to a transceiver and the at least one memory, wherein the RF controller is configured to access the at least one memory and execute the computer-executable instructions to;

receive an RF fingerprint of an RF signal detected by the RF sensor within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

identify a first receive signal strength indicator (RSSI) value of the RF signal at the RF sensor at a first time;

identify a second RSSI value of the RF signal at the RF sensor at a second time;

determine a velocity of the electronic device based at least in part on the first RSSI value, the second RSSI value, and a span of time between the first time and the second time;

determine that the velocity is greater than a threshold velocity value;

determine, based at least in part on the first RSSI value and the second RSSI value, a direction of movement of the first electronic device toward an egress point of the AUS; and

generate an alarm indicating that the velocity of the electronic device toward the egress point has been detected greater than the threshold velocity value.

2. The system of claim 1, wherein the alarm indicates an emergency situation.

3. The system of claim 1, wherein the at least one processor is further configured to execute the computer-executable instructions to:

determine a stored persona that includes a stored RF fingerprint that matches the received RF fingerprint; and

determine that the electronic device that emitted the RF signal is associated with the stored persona and identify a user associated with the stored persona, wherein the alarm includes an identification of the user.

4. The system of claim 1, wherein the electronic device is a first electronic device, the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, the velocity is a first velocity, and the RF controller is configured to generate the alarm further comprises the RF controller is configured to access the at least one memory and execute the computer-executable instructions to:

receive a second RF fingerprint of a second RF signal detected by the RF sensor within the AUS, the second RF fingerprint comprising at least one of;

i) a second hardware address of a second electronic device that emitted the second RF signal or ii) a second radio type identifier of a second radio of the second electronic device;

identify a third receive signal strength indicator (RSSI) value of the second RF signal at a third time;

identify a fourth RSSI value of the RF signal at a fourth time;

determine a second velocity of the second electronic device based at least in part on the third RSSI value, the fourth RSSI value, and a span of time between the third time and the fourth time;

determine that the second velocity is greater than the threshold velocity value, wherein the alarm indicates that the second velocity is greater than the threshold velocity.

5. The system of claim 4, wherein the direction of movement is a first direction of movement and the egress point is a first egress point, and wherein the RF controller is further configured to execute the computer-executable instructions to:

determine a second direction of movement of the second electronic device based at least in part on the third RSSI value and the fourth RSSI value; and

identify based at least in part on the second direction of movement that the second electronic device is moving toward a second egress point of the AUS, wherein the alarm is based at least in part on the second electronic device moving toward the second egress point.

6. The system of claim 4, wherein the direction of movement is a first direction of movement, and wherein the RF controller is further configured to execute the computer-executable instructions to:

determine a second direction of movement of the second electronic device based at least in part on the third RSSI value and the fourth RSSI value; and

identify that the first direction of movement and the second direction of movement is in substantially the same direction, wherein the alarm is based at least in part on the first direction and the second direction being substantially the same direction.

7. The system of claim 1, wherein the RF sensor is a first RF sensor and the system further includes a second RF sensor and a third RF sensor, and the RF controller is configured to determine a velocity of the electronic device further comprises the RF controller is configured to access the at least one memory and execute the computer-executable instructions to:

identify a third RSSI value of the RF signal at the second RF sensor at substantially the first time;

identify a fourth RSSI value of the RF signal at the second RF sensor at substantially the second time;

identify a fifth RSSI value of the RF signal at the third RF sensor at substantially the first time; and

identify a sixth RSSI value of the RF signal at the third RF sensor at substantially the second time,

wherein the velocity of the electronic device is further based at least in part on the third RSSI value, the fourth RS SI value, the fifth RSSI value, and the sixth RSSI value.

8. A method, comprising:

receiving, by a security system comprising one or more processors, a RF fingerprint of a RF signal detected by an RF sensor within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

identifying, by the security system, a first receive signal strength indicator (RSSI) value of the RF signal at the RF sensor at a first time;

identifying, by the security system, a second RSSI value of the RF signal at the RF sensor at a second time;

determining, by the security system, a velocity of the electronic device based at least in part on the first RSSI value, the second RSSI value, and a span of time between the first time and the second time;

determining, by the security system, that the velocity is greater than a threshold velocity value;

determining, by the security system and based at least in part on the first RSSI value and the second RSSI value, a direction of movement of the first electronic device toward an egress point of the AUS; and

generating, by the security system, an alarm indicating that the velocity of the electronic device toward the egress point has been detected greater than the threshold velocity value.

9. The method of claim 8, wherein the alarm indicates an emergency situation.

10. The method of claim 8, further comprising:

determining, by the security system, a stored persona that includes a stored RF fingerprint that matches the received RF fingerprint; and

determining, by the security system, that the electronic device that emitted the RF signal is associated with the stored persona and identify a user associated with the stored persona, wherein the alarm includes an identification of the user.

11. The method of claim 8, wherein the electronic device is a first electronic device, the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, the velocity is a first velocity, and wherein generating the alarm further comprises:

receiving, by the security system, a second RF fingerprint of a second RF signal detected by the RF sensor within the AUS, the second RF fingerprint comprising at least one of;

i) a second hardware address of a second electronic device that emitted the second RF signal or ii) a second radio type identifier of a second radio of the second electronic device;

identifying, by the security system, a third receive signal strength indicator (RSSI) value of the second RF signal at a third time;

identifying, by the security system, a fourth RSSI value of the RF signal at a fourth time;

determining, by the security system, a second velocity of the second electronic device based at least in part on the third RSSI value, the fourth RSSI value, and a span of time between the third time and the fourth time; and

determining, by the security system, that the second velocity is greater than the threshold velocity value, wherein the alarm indicates that the second velocity is greater than the threshold velocity.

12. The method of claim 11, wherein the direction of movement is a first direction of movement and the egress point is a first egress point, the method further comprising:

determining, by the security system, a second direction of movement of the second electronic device based at least in part on the third RS SI value and the fourth RS SI value; and

identifying, by the security system and based at least in part on the second direction of movement, that the second electronic device is moving toward a second egress point of the AUS, wherein the alarm is based at least in part on the second electronic device moving toward the second egress point.

13. The method of claim 11, wherein the direction of movement is a first direction of movement, the method further comprising:

determining, by the security system, a second direction of movement of the second electronic device based at least in part on the third RSSI value and the fourth RSSI value; and

identifying, by the security system, that the first direction of movement and the second direction of movement is in substantially the same direction, wherein the alarm is based at least in part on the first direction and the second direction being substantially the same direction.

14. The method of claim 8, wherein the RF sensor is a first RF sensor and further comprising:

identifying, by the security system, a third RSSI value of the RF signal at a second RF sensor at substantially the first time;

identifying, by the security system, a fourth RSSI value of the RF signal at the second RF sensor at substantially the second time;

identifying, by the security system, a fifth RSSI value of the RF signal at a third RF sensor at substantially the first time; and

identifying, by the security system, a sixth RSSI value of the RF signal at the third RF sensor at substantially the second time,

wherein the velocity of the electronic device is further based at least in part on the third RSSI value, the fourth RSSI value, the fifth RSSI value, and the sixth RSSI value.

15. One or more non-transitory computer-readable media storing computer-executable instructions that responsive to execution cause one or more computer processors to perform operations comprising:

receiving a RF fingerprint of a RF signal detected by an RF sensor within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

identifying a first receive signal strength indicator (RSSI) value of the RF signal at the RF sensor at a first time;

identifying a second RSSI value of the RF signal at the RF sensor at a second time;

determining a velocity of the electronic device based at least in part on the first RSSI value, the second RSSI value, and a span of time between the first time and the second time;

determining that the velocity is greater than a threshold velocity value;

determining, based at least in part on the first RSSI value and the second RSSI value, a direction of movement of the first electronic device toward an egress point of the AUS; and

generating an alarm indicating that the velocity of the electronic device toward the egress point has been detected greater than the threshold velocity value.

16. The one or more non-transitory computer-readable media of claim 15, the operations further comprising:

determining a stored persona that includes a stored RF fingerprint that matches the received RF fingerprint; and

determining that the electronic device that emitted the RF signal is associated with the stored persona and identify a user associated with the stored persona, wherein the alarm includes an identification of the user.

17. The one or more non-transitory computer-readable media of claim 15, wherein the electronic device is a first electronic device, the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, the velocity is a first velocity, and the operations further comprising:

receiving a second RF fingerprint of a second RF signal detected by the RF sensor within the AUS, the second RF fingerprint comprising at least one of;

i) a second hardware address of a second electronic device that emitted the second RF signal or ii) a second radio type identifier of a second radio of the second electronic device;

identifying a third receive signal strength indicator (RSSI) value of the second RF signal at a third time;

identifying a fourth RSSI value of the RF signal at a fourth time;

determining a second velocity of the second electronic device based at least in part on the third RSSI value, the fourth RSSI value, and a span of time between the third time and the fourth time; and

determining that the second velocity is greater than the threshold velocity value, wherein the alarm indicates that the second velocity is greater than the threshold velocity.

18. The one or more non-transitory computer-readable of claim 17, wherein the direction of movement is a first direction of movement and the egress point is a first egress point, the operations further comprising:

determining a second direction of movement of the second electronic device based at least in part on the third RSSI value and the fourth RSSI value; and

identifying, based at least in part on the second direction of movement, that the second electronic device is moving toward a second egress point of the AUS, wherein the alarm is based at least in part on the second electronic device moving toward the second egress point.

19. The one or more non-transitory computer-readable of claim 17, wherein the direction of movement is a first direction of movement, the operations further comprising:

determining a second direction of movement of the second electronic device based at least in part on the third RSSI value and the fourth RS SI value; and

identifying that the first direction of movement and the second direction of movement is in substantially the same direction, wherein the alarm is based at least in part on the first direction and the second direction being substantially the same direction.

20. The one or more non-transitory computer-readable of claim 15, the operations further comprising:

identifying a third RSSI value of the RF signal at a second RF sensor at substantially the first time;

identifying a fourth RSSI value of the RF signal at the second RF sensor at substantially the second time;

identifying a fifth RSSI value of the RF signal at a third RF sensor at substantially the first time; and

identifying a sixth RSSI value of the RF signal at the third RF sensor at substantially the second time,

wherein the velocity of the electronic device is further based at least in part on the third RSSI value, the fourth RSSI value, the fifth RSSI value, and the sixth RSSI value.