Electromagnetic persona generation based on radio frequency fingerprints

• US 9,635,044 B2
• Filed: 01/30/2015
• Issued: 04/25/2017
• Est. Priority Date: 06/02/2014
• Status: Active Grant

• Current Assignee: Bastille Networks, Inc.
• Original Assignee: Bastille Networks, Inc.
• Inventors: Baxley, Robert John, Rouland, Christopher Jay, Engle, Michael Thomas
• Primary Examiner(s): File, Erin
• Application Number:
  US14/610,612
• Publication Number:
  US 20150348342A1
• Time in Patent Office: 816 Days
• CPC Class Codes: G07C 2209/61 Signal comprising different frequencies, e.g. frequency hopping
• CPC Class Codes: G07C 2209/63 Comprising locating means for detecting the position of the data carrier, i.e. within the vehicle or within a certain distance from the vehicle
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence
• CPC Class Codes: H04B 17/318 Received signal strength
• CPC Class Codes: H04B 17/391 Modelling the propagation channel
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 4/027 using movement velocity, acceleration information
• CPC Class Codes: H04W 4/90 Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]

Abstract

Electromagnetic (EM)/radio frequency (RF) emissions may be detected and corresponding EM personas may be created. One or more EM personas may be associated with a super persona corresponding to a particular entity. EM personas, super personas, and/or supplemental identifying information can be used to enforce security protocols.

Claims

1. A system, comprising:

a transceiver;

at least one memory that stores computer-executable instructions; and

at least one processor operationally coupled to the transceiver and the at least one memory, wherein the at least one processor is configured to access the at least one memory and execute the computer-executable instructions to;

receive a radio frequency (RF) fingerprint of an RF signal detected by the transceiver within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

determine a stored persona that includes a stored RF fingerprint that matches the received RF fingerprint;

determine that the electronic device that emitted the RF signal is associated with the stored persona;

determine, based at least in part on the determination that the electronic device is associated with the stored persona, that a user associated with the stored persona is authorized to be present in the AUS;

receive, from an access control system, access control information including access credentials received at an access control device associated with an ingress point of the AUS; and

determine that the stored persona includes stored access credentials that match the received access credentials, wherein the determination that the user associated with the stored persona is authorized to be present in the AUS is further based at least in part on the determination that the stored persona includes access credentials that match the received access credentials.

2. The system of claim 1, wherein the at least one processor is further configured to execute the computer-executable instructions to:

determine, from the access control information, a first timestamp associated with receipt of the access credentials at the access control device;

determine, from the RF fingerprint of the RF signal, a second timestamp associated with receipt of the RF signal at the transceiver; and

determine that the first timestamp is within a threshold time period from the second timestamp, wherein the determination that the stored persona includes access credentials that match the received access credentials of the user of the electronic device is based at least in part on the determination that the first timestamp is within the threshold time period from the second timestamp.

3. The system of claim 1, wherein the at least one processor is further configured to execute the computer-executable instructions to:

identify, based at least in part on the stored persona, that the electronic device associated with the stored persona is unauthorized to be present in the AUS; and

determine, based at least in part on the determination that the electronic device is associated with the stored persona, that the user of the electronic device is unauthorized to be present in the AUS.

4. The system of claim 1, wherein the RF fingerprint is a first RF fingerprint, the stored RF fingerprint is a first stored RF fingerprint, the RF signal is a first RF signal, the stored persona is a first stored persona, and the electronic device is a first electronic device, and wherein the at least one processor is further configured to execute the computer-executable instructions to:

receive a second RF fingerprint of a second RF signal detected by the transceiver within the AUS, the second RF fingerprint comprising at least one of;

i) a hardware address of a second electronic device that emitted the second RF signal or ii) a radio type identifier of a radio of the second electronic device;

determine a second stored persona that includes a second stored RF fingerprint that matches the second RF fingerprint; and

determine that the second electronic device that emitted the second RF signal is associated with the second stored persona.

5. The system of claim 4, wherein the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, and the electronic device is a first electronic device and wherein the at least one processor is further configured to execute the computer-executable instructions to:

determine a first position from which the first RF signal is emitted and a second position from which the second RF signal is emitted;

determine a first time at which the first RF signal is detected and a second time at which the second RF signal is detected;

determine that the first time is within a threshold amount of time from the second time;

determine the first position is within a threshold distance from the second position; and

associate the second RF fingerprint with the first stored persona.

6. A method, comprising:

receiving, by a security system comprising one or more computer processors and a transceiver, a radio frequency (RF) fingerprint of an RF signal emitted within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

determining, by the security system, a stored persona that includes a stored RF fingerprint that matches the received RF fingerprint;

determining, by the security system, that the electronic device that emitted the RF signal is associated with the stored persona;

determining, by the security system and based at least in part on determining that the electronic device is associated with the stored persona, that a user of the electronic device is authorized to be present in the AUS;

receiving, by the security system, from an access control system, access control information including access credentials received at an access control device associated with an ingress point of the AUS; and

determining, by the security system, that the stored persona includes stored access credentials that match the received access credentials, wherein determining that the user of the electronic device is authorized to be present in the AUS is further based at least in part on determining that the stored persona includes access credentials that match the received access credentials.

7. The method of claim 6, further comprising:

generating, by the security system, an event notification that the user of the electronic device is authorized to be present in the AUS.

8. The method of claim 6, further comprising:

determining, by the security system, from the access control information, a first timestamp associated with receipt of the access credentials at the access control device;

determining, by the security system, from the RF fingerprint of the RF signal, a second timestamp associated with receipt of the RF signal at the transceiver; and

determining, by the security system, that the first timestamp is within a threshold time period from the second timestamp, wherein determining that the user of the electronic device is authorized to be present in the AUS is further based at least in part on determining that the first timestamp is within the threshold time period from the second timestamp.

9. The method of claim 6, further comprising:

identifying, by the security system and based at least in part on the stored persona, that the electronic device associated with the stored persona is unauthorized to be present in the AUS; and

determining, by the security system and based at least in part on the determination that the electronic device is associated with the stored persona, that the user of the electronic device is unauthorized to be present in the AUS.

10. The method of claim 6, wherein the RF fingerprint is a first RF fingerprint, the stored RF fingerprint is a first stored RF fingerprint, the RF signal is a first RF signal, the stored persona is a first stored persona, and the electronic device is a first electronic device, the method further comprising:

receiving, by the security system, a second RF fingerprint of a second RF signal emitted within the AUS, the second RF fingerprint comprising at least one of;

i) a hardware address of a second electronic device that emitted the second RF signal or ii) a radio type identifier of a radio of the second electronic device;

determining, by the security system, a second stored persona that includes a second stored RF fingerprint that matches the second RF fingerprint; and

determining, by the security system, that the second electronic device that emitted the second RF signal is associated with the second stored persona.

11. The method of claim 10, wherein the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, and the electronic device is a first electronic device, the method further comprising:

receiving, by the security system, a second RF fingerprint of a second RF signal detected by the transceiver within the AUS, the second RF fingerprint comprising at least one of;

i) a hardware address of a second electronic device that emitted the second RF signal or ii) a radio type identifier of a radio of the second electronic device;

determining, by the security system, that the second RF fingerprint does not match a stored RF fingerprint included in any stored persona; and

determining, by the security system, that the second electronic device is unauthorized to be present in the AUS.

12. The method of claim 9, wherein the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, and the electronic device is a first electronic device and the method further comprising:

determining, by the security system, a first position from which the first RF signal is emitted and a second position from which the second RF signal is emitted;

determining, by the security system, a first time at which the first RF signal is detected and a second time at which the second RF signal is detected;

determining, by the security system, that the first time is within a threshold amount of time from the second time;

determining, by the security system, the first position is within a threshold distance from the second position; and

associating, by the security system, the second RF fingerprint with the stored persona.

13. One or more non-transitory computer-readable media storing computer-executable instructions that responsive to execution cause one or more computer processors to perform operations comprising:

receiving a radio frequency (RF) fingerprint of an RF signal detected at a transceiver within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

determining a stored persona that includes a stored RF fingerprint that matches the received RF fingerprint;

determining that the electronic device that emitted the RF signal is associated with the stored persona;

determining, based at least in part on determining that the electronic device is associated with the stored persona, that a user of the electronic device is authorized to be present in the AUS;

receiving from an access control system, access control information including access credentials received at an access control device associated with an ingress point of the AUS; and

determining that the stored persona includes stored access credentials that match the received access credentials, wherein determining that the user of the electronic device is authorized to be present in the AUS is further based at least in part on determining that the stored persona includes access credentials that match the received access credentials.

14. The one or more non-transitory computer-readable media of claim 13, the operations further comprising:

generating an event notification that the user of the electronic device is authorized to be present in the AUS.

15. The one or more non-transitory computer-readable of claim 13, the operations further comprising:

determining, from the access control information, a first timestamp associated with receipt of the access credentials at the access control device;

determining, from the RF fingerprint of the RF signal, a second timestamp associated with receipt of the RF signal at the transceiver; and

determining that the first timestamp is within a threshold time period from the second timestamp, wherein determining that the user of the electronic device is authorized to be present in the AUS is further based at least in part on determining that the first timestamp is within the threshold time period from the second timestamp.

16. The one or more non-transitory computer-readable of claim 13, wherein the RF fingerprint is a first RF fingerprint, the stored RF fingerprint is a first stored RF fingerprint, the RF signal is a first RF signal, the stored persona is a first stored persona, and the electronic device is a first electronic device, the operations further comprising:

receiving a second RF fingerprint of a second RF signal detected by the transceiver within the AUS, the second RF fingerprint comprising at least one of;

i) a hardware address of a second electronic device that emitted the second RF signal or ii) a radio type identifier of a radio of the second electronic device;

determining a second stored persona that includes a second stored RF fingerprint that matches the second RF fingerprint;

determining that the second electronic device that emitted the second RF signal is associated with the second stored persona; and

determining, based at least in part on the determination that the second electronic device is associated with the second stored persona, that a user of the second electronic device is unauthorized to be present in the AUS.

17. The one or more non-transitory computer-readable of claim 16, wherein the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, and the electronic device is a first electronic device and the operations further comprising:

determining a first position from which the first RF signal is emitted and a second position from which the second RF signal is emitted;

determining a first time at which the first RF signal is detected and a second time at which the second RF signal is detected;

determining that the first time is within a threshold amount of time from the second time;

determining the first position is within a threshold distance from the second position; and

associating the second RF fingerprint with the stored persona.