Radio frequency fingerprint detection

• US 9,591,013 B2
• Filed: 01/30/2015
• Issued: 03/07/2017
• Est. Priority Date: 06/02/2014
• Status: Active Grant

• Current Assignee: Bastille Networks, Inc.
• Original Assignee: Bastille Networks, Inc.
• Inventors: Baxley, Robert John, Rouland, Christopher Jay, Engle, Michael Thomas
• Primary Examiner(s): Vo, Don N
• Application Number:
  US14/610,651
• Publication Number:
  US 20150348341A1
• Time in Patent Office: 767 Days
• Field of Search: 340/5.2
• US Class Current: 1/1
• CPC Class Codes: G07C 2209/61 Signal comprising different frequencies, e.g. frequency hopping
• CPC Class Codes: G07C 2209/63 Comprising locating means for detecting the position of the data carrier, i.e. within the vehicle or within a certain distance from the vehicle
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence
• CPC Class Codes: H04B 17/318 Received signal strength
• CPC Class Codes: H04B 17/391 Modelling the propagation channel
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 4/027 using movement velocity, acceleration information
• CPC Class Codes: H04W 4/90 Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]

Abstract

Electromagnetic (EM)/radio frequency (RF) emissions may be detected and corresponding EM personas may be created. One or more EM personas may be associated with a super persona corresponding to a particular entity. EM personas, super personas, and/or supplemental identifying information can be used to enforce security protocols.

Claims

1. A system, comprising:

a radio frequency (RF) sensor configured to detect RF signals in a first frequency band and a second frequency band;

at least one memory that stores computer-executable instructions; and

an RF controller operationally coupled to the transceiver and the at least one memory, wherein the RF controller is configured to access the at least one memory and execute the computer-executable instructions to;

direct the RF sensor to detect RF signals in the first frequency band;

determine that no RF signals are detected by the RF sensor in the first frequency band;

direct the RF sensor to detect RF signals in the second frequency band;

receive, from the RF sensor, a first RF signal corresponding to an RF signal transmission in the second frequency band;

identify a protocol by which the RF signal transmission was transmitted based at least in part on an identification of the range of the second frequency band;

determine an RF fingerprint associated with the RF signal transmission based at least in part on the RF signal and identification of the protocol, wherein the RF fingerprint comprises at least one of;

a hardware address of an electronic device that emitted the RF signal, or a radio type identifier of a radio of the electronic device; and

transmit an indication of the RF fingerprint to a security server.

2. The system of claim 1, wherein the RF controller is further configured to execute the computer-executable instructions to:

determine a receive signal strength indicator (RSSI) of the RF signal; and

determine a distance between the RF sensor and the electronic device.

3. The system of claim 1, wherein the RF sensor is a first RF sensor, the system further comprises a second RF sensor and a third RF sensor, and the RF controller is further configured to execute the computer-executable instructions to:

determine a first receive signal strength indicator (RSSI) of the first RF signal associated with the first RF sensor;

direct the second RF sensor to detect the first RF signal;

determine a second RSSI of the first RF signal associated with the second RF sensor;

direct the third RF sensor to detect the first RF signal;

determine a third RSSI of the first RF signal associated with the third RF sensor; and

determine a location of the electronic device based at least in part on the first RSSI, second RSSI, and third RSSI.

4. The system of claim 1, wherein the RF controller is further configured to execute the computer-executable instructions to:

receive a location associated with the RF sensor; and

identify that the location is within a threshold distance of a target location of the RF sensor.

5. The system of claim 4, wherein the RF controller is further configured to execute the computer-executable instructions to:

determine that the location is within an area under surveillance (AUS) based at least in part on directing the RF sensor to detect RF signals in the first frequency band determining that the location is within an area under surveillance (AUS).

6. The system of claim 1, wherein the RF controller is further configured to execute the computer-executable instructions to:

receive a location associated with the RF sensor;

identify that the location is outside of a threshold distance of a target location of the RF sensor; and

provide an indication of potential tampering with the RF sensor.

7. The system of claim 1, wherein the security server is configured to identify that the RF fingerprint is associated with a user authorized to be in an area under surveillance (AUS) within which the RF fingerprint is detected.

8. The system of claim 1, wherein the RF sensor is a fourth RF sensor, the system further comprises a fifth RF sensor, wherein a first radio range of the fourth RF sensor at least partially overlaps with a second radio range of the fifth RF sensor and wherein the RF controller is further configured to execute the computer-executable instructions to:

direct the fourth RF sensor at a particular time to detect RF signals in the first frequency band; and

direct the fifth RF sensor at the particular time to detect RF signals in the second communications band.

9. A method, comprising:

directing, by an RF controller comprising one or more processors, an RF sensor to detect RF signals in the first communications band;

determining, by the RF controller, that there are no RF signals detected by the RF sensor in the first frequency band;

directing, by the RF controller, the RF sensor to detect RF signals in the second communications band;

receiving, by the RF controller and from the RF sensor, a signal corresponding to an RF signal transmission in the second frequency band;

identifying, by the RF controller, a protocol by which the RF signal transmission was transmitted based at least in part on an identification of the range of the second frequency band;

determining, by the RF controller, an RF fingerprint associated with the RF signal transmission based at least in part on the signal and identification of the protocol, wherein the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device; and

transmitting, by the RF controller, an indication of the RF fingerprint to a security server.

10. The method of claim 9, further comprising:

determining, by the RF controller, a receive signal strength indicator (RSSI) of the RF signal; and

determining, by the RF controller, a distance between the RF sensor and the electronic device.

11. The method of claim 9, wherein the RF sensor is a first RF sensor and further comprising:

determining, by the RF controller, a first receive signal strength indicator (RSSI) of the RF signal associated with the first RF sensor;

directing, by the RF controller, the second RF sensor to detect the RF signal;

determining, by the RF controller, a second RSSI of the RF signal associated with a second RF sensor;

directing, by the RF controller, the third RF sensor to detect the RF signal;

determining, by the RF controller, a third RSSI of the RF signal associated with a third RF sensor; and

determining, by the RF controller, a location of the electronic device based at least in part on the first RSSI, second RSSI, and third RSSI.

12. The method of claim 9, further comprising:

receiving, by the RF controller, a location associated with the RF sensor; and

identifying, by the RF controller, that the location is within a threshold distance of a target location of the RF sensor.

13. The method of claim 12, further comprising:

determining, by the RF controller, that the location is within an area under surveillance (AUS).

14. The method of claim 9, further comprising:

receiving, by the RF controller, a location associated with the RF sensor;

identifying, by the RF controller, that the location is outside of a threshold distance of a target location of the RF sensor; and

providing, by the RF controller, an indication of potential tampering with the RF sensor.

15. The method of claim 9, further comprising identifying, by the RF controller, that the RF fingerprint is associated with a user that is unauthorized to be in an area under surveillance (AUS) within which the RF fingerprint is detected.

16. The method of claim 9, wherein the RF sensor is a first RF sensor, the method further comprising:

directing, by the RF controller, the first RF sensor at a particular time to detect RF signals in the first communications band; and

directing, by the RF controller, a second RF sensor at substantially the particular time to detect RF signals in the second communications band, wherein a first radio range of the first RF sensor at least partially overlaps with a second radio range of the second RF sensor.

17. A non-transitory computer-readable media storing computer-executable instructions that responsive to execution cause one or more computer processors to perform operations comprising:

directing an RF sensor to detect RF signals in the first communications band;

determining that there are no RF signals detected by the RF sensor in the first frequency band;

directing the RF sensor to detect RF signals in the second communications band;

receiving, from the RF sensor, a signal corresponding to an RF signal transmission in the second frequency band;

identifying a protocol by which the RF signal transmission was transmitted based at least in part on an identification of the range of the second frequency band;

determining an RF fingerprint associated with the RF signal transmission based at least in part on the signal and identification of the protocol, wherein the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device; and

transmitting an indication of the RF fingerprint to a security server.

18. The non-transitory computer-readable media of claim 17, the operations further comprising:

determining a receive signal strength indicator (RSSI) of the RF signal; and

determining a distance between the RF sensor and the electronic device.

19. The non-transitory computer-readable media of claim 17, the operations further comprising:

receiving a location associated with the RF sensor;

identifying that the location is within a threshold distance of a target location of the RF sensor; and

determining that the location is within an area under surveillance (AUS).

20. The non-transitory computer-readable media of claim 17, wherein the RF sensor is a first RF sensor and the operations further comprise:

determining a first receive signal strength indicator (RSSI) of the RF signal associated with the first RF sensor;

directing the second RF sensor to detect the RF signal;

determining a second RSSI of the RF signal associated with a second RF sensor;

directing the third RF sensor to detect the RF signal;

determining a third RSSI of the RF signal associated with a third RF sensor; and

determining a location of the electronic device based at least in part on the first RSSI, second RSSI, and third RSSI.