Cross-modality electromagnetic signature analysis for radio frequency persona identification

• US 9,560,060 B2
• Filed: 06/02/2015
• Issued: 01/31/2017
• Est. Priority Date: 06/02/2014
• Status: Active Grant

• Current Assignee: Bastille Networks, Inc.
• Original Assignee: Bastille Networks, Inc.
• Inventors: Baxley, Robert John, Maynor, David, Lamb, Logan Michael
• Primary Examiner(s): TALUKDER, MD K
• Application Number:
  US14/728,954
• Publication Number:
  US 20150349810A1
• Time in Patent Office: 609 Days
• Field of Search: 455/500, 455/404.2, 455/9, 455/448
• US Class Current: 1/1
• CPC Class Codes: G06K 7/0095 Testing the sensing arrangement, e.g. testing if a magnetic card reader, bar code reader, RFID interrogator or smart card reader functions properly testing of electrical circuits G01R31/28
• CPC Class Codes: H04B 1/0028 wherein the AD/DA conversion occurs at baseband stage
• CPC Class Codes: H04B 1/0064 with separate antennas for the more than one band H04B1/0053 takes precedence
• CPC Class Codes: H04B 7/01 Reducing phase shift
• CPC Class Codes: H04K 2203/34 involving multiple cooperating jammers
• CPC Class Codes: H04K 3/22 including jamming detection and monitoring
• CPC Class Codes: H04K 3/42 characterized by the control of the jamming frequency or wavelength
• CPC Class Codes: H04K 3/44 characterized by the control of the jamming waveform or modulation type
• CPC Class Codes: H04K 3/65 using deceptive jamming or spoofing, e.g. transmission of false signals for premature triggering of RCIED, for forced connection or disconnection to/from a network or for generation of dummy target signal
• CPC Class Codes: H04K 3/825 by jamming
• CPC Class Codes: H04K 3/84 related to preventing electromagnetic interference in petrol station, hospital, plane or cinema
• CPC Class Codes: H04K 3/86 related to preventing deceptive jamming or unauthorized interrogation or access, e.g. WLAN access or RFID reading record carriers with integrated circuit chips including means for preventing undesired reading or writing from or to record carriers by hindering electromagnetic reading or writing G06K19/07318; arrangements for sensing record carriers including arrangements for protecting the interrogation against piracy attacks G06K7/10257
• CPC Class Codes: H04K 3/88 related to allowing or preventing alarm transmission
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 72/0453 : Resources in frequency domain, e.g. a carrier in FDMA
• CPC Class Codes: H04W 72/20 : Control channels or signalling for resource management
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

Systems and methods can support identifying multiple radio transmitters as being integrated within a single communications device. Radio frequency signals may be collected using one or more sensors incorporating radio receivers. A first radio frequency signature and a second radio frequency signature may be identified within one or more of the radio frequency signals as originating respectively from a first radio transmitter and a second radio transmitter. Characteristics of the first and second radio frequency signatures may be analyzed to evaluate a relationship between the first and second radio frequency signatures. It may be determined whether or not the first and second radio transmitters are integrated within a common wireless electronic device based upon the evaluated relationship between the first radio frequency signature and the second radio frequency signature. Characteristics and behaviors associated with the wireless electronic device may be determined therefrom.

Claims

1. A method for identifying multiple radio transmitters within a single wireless communications device, comprising:

receiving radio frequency signals using one or more sensors, wherein the sensors comprise radio receivers;

identifying a first radio frequency signature within one or more of the radio frequency signals as originating from a first radio transmitter;

identifying a second radio frequency signature within one or more of the radio frequency signals as originating from a second radio transmitter;

analyzing characteristics of the first radio frequency signature and of the second radio frequency signature to evaluate a relationship between the first radio frequency signature and the second radio frequency signature;

determining if the first radio transmitter and the second radio transmitter are integrated together within the single wireless communications device based upon the evaluated relationship between the first radio frequency signature and the second radio frequency signature; and

determining operational characteristics associated with the single wireless communications device in response to determining that the first radio transmitter and the second radio transmitter are integrated within the single wireless communications device.

2. The method of claim 1, wherein the operational characteristics comprise a likelihood of association between the single wireless communications device and a human user.

3. The method of claim 1, wherein the operational characteristics comprise a threat indication.

4. The method of claim 1, wherein analyzing characteristics of the first radio frequency signature and of the second radio frequency signature comprises estimating relative transmit locations of the first radio frequency signature and of the second radio frequency signature.

5. The method of claim 1, wherein analyzing characteristics of the first radio frequency signature and of the second radio frequency signature comprises determining a first unique identifier or address within the first radio frequency signature, determining a second unique identifier or address within the second radio frequency signature, and examining a relationship between the first unique identifier or address and the second unique identifier or address.

6. The method of claim 1, wherein analyzing characteristics of the first radio frequency signature and of the second radio frequency signature comprises determining a Wi-Fi hardware address within the first radio frequency signature, determining a Bluetooth hardware address within the second radio frequency signature, and examining a relationship between the Wi-Fi hardware address and the Bluetooth hardware address.

7. The method of claim 1, wherein determining if the first radio transmitter and the second radio transmitter are integrated within the single wireless communications device comprises determining if the first radio transmitter and the second radio transmitter operate in association with common chips, circuitry, or software.

8. The method of claim 1, wherein determining if the first radio transmitter and the second radio transmitter are integrated together within the single wireless communications device comprises determining if the first radio transmitter and the second radio transmitter originate from a common manufacturer.

9. The method of claim 1, wherein determining if the first radio transmitter and the second radio transmitter are integrated together within the single wireless communications device comprises determining if the first radio transmitter and the second radio transmitter operate with common timing, signal characteristics, or signal strengths.

10. The method of claim 1, wherein determining operational characteristics comprises determining details associated with the first radio transmitter given details determined to be associated with the second radio transmitter.

11. A system for identifying multiple radio transmitters within a single wireless device, comprising:

one or more sensor antennas;

one or more sensors configured to couple radio frequency signals from the one or more sensor antennas and generate data samples representing at least a portion of the radio frequency signals; and

a signal analysis engine comprising one or more processing units, and one or more processing modules configuring the one or more processing units to;

identify a first radio signature within the data samples as originating from a first transmitting radio;

identify a second radio signature within the data samples as originating from a second transmitting radio;

analyze characteristics of the first radio frequency signature and of the second radio frequency signature to evaluate a relationship between the first radio frequency signature and the second radio frequency signature;

determine if the first transmitting radio and the second transmitting radio are integrated together within the single wireless device based upon the evaluated relationship between the first radio frequency signature and the second radio frequency signature; and

determine operational characteristics associated with the single wireless device in response to determining that the first transmitting radio and the second transmitting radio are integrated within the wireless device.

12. The system of claim 11, wherein the operational characteristics comprise a likelihood of association between the single wireless device and a particular human user.

13. The system of claim 11, wherein the operational characteristics comprise an indication or a wireless threat or attack.

14. The system of claim 11, wherein analyzing characteristics of the first radio frequency signature and of the second radio frequency signature comprises estimating relative transmit locations of the first transmitting radio and of the second transmitting radio.

15. The system of claim 11, wherein analyzing characteristics of the first radio frequency signature and of the second radio frequency signature comprises determining a first unique identifier or address within the first radio frequency signature, determining a second unique identifier or address within the second radio frequency signature, and examining a relationship between the first unique identifier or address and the second unique identifier or address.

16. The system of claim 11, wherein analyzing characteristics of the first radio frequency signature and of the second radio frequency signature comprises determining a Wi-Fi hardware address within the first radio frequency signature, determining a Bluetooth hardware address within the second radio frequency signature, and examining a relationship between the Wi-Fi hardware address and the Bluetooth hardware address.

17. The system of claim 11, wherein determining if the first transmitting radio and the second transmitting radio are integrated together within the single wireless device comprises determining if the first transmitting radio and the second transmitting radio operate in association with common chips, circuitry, or software.

18. The system of claim 11, wherein determining if the first transmitting radio and the second transmitting radio are integrated together within the single wireless device comprises determining if the first transmitting radio and the second transmitting radio operate with common timing, signal characteristics, or signal strengths.

19. The system of claim 11, wherein determining operational characteristics comprises determining details associated with the first transmitting radio given details determined to be associated with the second transmitting radio.

20. A system for identifying multiple radio transmitters within a single wireless device, comprising:

one or more sensor antennas within the electromagnetic environment;

one or more updatable analysis databases configured to provide signatures of known radio types;

one or more operator interfaces for communicating information associated with wireless devices;

one or more software radio receivers configured to couple a radio frequency signal from one or more of the sensor antennas and generate data samples representing a portion of the radio frequency signal; and

a signal analysis engine comprising one or more processing units, and one or more processing modules configuring the one or more processing units to;

receive the data samples,

generate feature vectors comprising at least a portion of the data samples,

cluster and extract signal features from within one or more of the feature vectors and update the feature vectors with attributes associated with clustering and extraction,

identify, within one or more of the feature vectors, a first radio signature as originating from a first transmitting radio according to the provided signatures of known radio types,

identify, within one or more of the feature vectors, a second radio signature as originating from a second transmitting radio according to the provided signatures of known radio types,

determine if the first transmitting radio and the second transmitting radio are integrated within the single wireless device based upon the identified first radio signature and the identified second radio signature, and

present, via the one or more operator interfaces, a status of the first transmitting radio and the second transmitting radio being integrated within the single wireless device.