Security Measures Based on Signal Strengths of Radio Frequency Signals

• US 20150350862A1
• Filed: 01/30/2015
• Published: 12/03/2015
• Est. Priority Date: 06/02/2014
• Status: Active Grant

• Current Assignee: Bastille Networks, Inc.
• Original Assignee: Bastille Networks, Inc.
• Inventors: Baxley, Robert John, Rouland, Christopher Jay, Engle, Michael Thomas
• Granted Patent: US 9,485,266 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G07C 2209/61 Signal comprising different frequencies, e.g. frequency hopping
• CPC Class Codes: G07C 2209/63 Comprising locating means for detecting the position of the data carrier, i.e. within the vehicle or within a certain distance from the vehicle
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence
• CPC Class Codes: H04B 17/318 Received signal strength
• CPC Class Codes: H04B 17/391 Modelling the propagation channel
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 4/027 using movement velocity, acceleration information
• CPC Class Codes: H04W 4/90 Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]

Abstract

Electromagnetic (EM)/radio frequency (RF) emissions may be detected and corresponding EM personas may be created. One or more EM personas may be associated with a super persona corresponding to a particular entity. EM personas, super personas, and/or supplemental identifying information can be used to enforce security protocols.

Claims

1. A system, comprising:

a radio frequency (RF) sensor configured to detect RF signals;

at least one memory that stores computer-executable instructions; and

an RF controller operationally coupled to the transceiver and the at least one memory, wherein the RF controller is configured to access the at least one memory and execute the computer-executable instructions to;

receive an RF fingerprint of an RF signal detected by the RF sensor within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

identify a first receive signal strength indicator (RSSI) value of the RF signal at the RF sensor at a first time;

identify a second RSSI value of the RF signal at the RF sensor at a second time;

determine a velocity of the electronic device based at least in part on the first RSSI value, the second RSSI value, and a span of time between the first time and the second time;

determine that the velocity is greater than a threshold velocity value;

generate an alarm indicating that a velocity of movement of the electronic device has been detected greater than the threshold velocity value.

2. The system of claim 1, wherein the alarm indicates an emergency situation.

3. The system of claim 1, wherein the at least one processor is further configured to execute the computer-executable instructions to:

determine a stored persona that includes a stored RF fingerprint that matches the received RF fingerprint; and

determine that the electronic device that emitted the RF signal is associated with the stored persona and identify a user associated with the stored persona, wherein the alarm includes an identification of the user.

4. The system of claim 1, wherein the electronic device is a first electronic device, the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, the velocity is a first velocity, and the RF controller is configured to generate the alarm further comprises the RF controller is configured to access the at least one memory and execute the computer-executable instructions to:

receive a second RF fingerprint of a second RF signal detected by the RF sensor within the AUS, the second RF fingerprint comprising at least one of;

i) a second hardware address of a second electronic device that emitted the second RF signal or ii) a second radio type identifier of a second radio of the second electronic device;

identify a third receive signal strength indicator (RSSI) value of the second RF signal at a third time;

identify a fourth RSSI value of the RF signal at a fourth time;

determine a second velocity of the second electronic device based at least in part on the third RSSI value, the fourth RSSI value, and a span of time between the third time and the fourth time;

determine that the second velocity is greater than the threshold velocity value, wherein the alarm indicates that the second velocity is greater than the threshold velocity.

5. The system of claim 4, wherein the RF controller is further configured to execute the computer-executable instructions to:

determine a first direction of movement of the first electronic device based at least in part on the first RSSI value and the third RSSI value;

determine a second direction of movement of the second electronic device based at least in part on the third RSSI value and the fourth RSSI value; and

identify based at least in part on the first direction of movement and the second direction of movement that the first electronic device and the second electronic device are moving toward at least one egress point of the AUS, wherein the alarm is based at least in part on the first electronic device and the second electronic device moving toward the at least one egress point.

6. The system of claim 4, wherein the RF controller is further configured to execute the computer-executable instructions to:

determine a first direction of movement of the first electronic device based at least in part on the first RSSI value and the third RSSI value;

determine a second direction of movement of the second electronic device based at least in part on the third RSSI value and the fourth RSSI value; and

identify that the first direction of movement and the second direction of movement is in substantially the same direction, wherein the alarm is based at least in part on the first direction and the second direction being substantially the same direction.

7. The system of claim 1, wherein the RF sensor is a first RF sensor and the system further includes a second RF sensor and a third RF sensor, and the RF controller is configured to determine a velocity of the electronic device further comprises the RF controller is configured to access the at least one memory and execute the computer-executable instructions to:

identify a third RSSI value of the RF signal at the second RF sensor at substantially the first time;

identify a fourth RSSI value of the RF signal at the second RF sensor at substantially the second time;

identify a fifth RSSI value of the RF signal at the third RF sensor at substantially the first time; and

identify a sixth RSSI value of the RF signal at the third RF sensor at substantially the second time,

wherein the velocity of the electronic device is further based at least in part on the third RSSI value, the fourth RSSI value, the fifth RSSI value, and the sixth RSSI value.

8. A method, comprising:

receiving, by a security system comprising one or more processors, a RF fingerprint of a RF signal detected by an RF sensor within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

identifying, by the security system, a first receive signal strength indicator (RSSI) value of the RF signal at the RF sensor at a first time;

identifying, by the security system, a second RSSI value of the RF signal at the RF sensor at a second time;

determining, by the security system, a velocity of the electronic device based at least in part on the first RSSI value, the second RSSI value, and a span of time between the first time and the second time;

determining, by the security system, that the velocity is greater than a threshold velocity value; and

generating, by the security system, an alarm indicating that a velocity of movement of the electronic device has been detected greater than the threshold velocity value.

9. The method of claim 8, wherein the alarm indicates an emergency situation

10. The method of claim 8, further comprising:

determining, by the security system, a stored persona that includes a stored RF fingerprint that matches the received RF fingerprint; and

determining, by the security system, that the electronic device that emitted the RF signal is associated with the stored persona and identify a user associated with the stored persona, wherein the alarm includes an identification of the user.

11. The method of claim 8, wherein the electronic device is a first electronic device, the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, the velocity is a first velocity, and wherein generating the alarm further comprises:

receiving, by the security system, a second RF fingerprint of a second RF signal detected by the RF sensor within the AUS, the second RF fingerprint comprising at least one of;

i) a second hardware address of a second electronic device that emitted the second RF signal or ii) a second radio type identifier of a second radio of the second electronic device;

identifying, by the security system, a third receive signal strength indicator (RSSI) value of the second RF signal at a third time;

identifying, by the security system, a fourth RSSI value of the RF signal at a fourth time;

determining, by the security system, a second velocity of the second electronic device based at least in part on the third RSSI value, the fourth RSSI value, and a span of time between the third time and the fourth time; and

determining, by the security system, that the second velocity is greater than the threshold velocity value, wherein the alarm indicates that the second velocity is greater than the threshold velocity.

12. The method of claim 11, further comprising:

determining, by the security system, a first direction of movement of the first electronic device based at least in part on the first RSSI value and the third RSSI value;

determining, by the security system, a second direction of movement of the second electronic device based at least in part on the third RSSI value and the fourth RSSI value; and

identifying, by the security system and based at least in part on the first direction of movement and the second direction of movement, that the first electronic device and the second electronic device are moving toward at least one egress point of the AUS, wherein the alarm is based at least in part on the first electronic device and the second electronic device moving toward the at least one egress point.

13. The method of claim 11, further comprising:

determining, by the security system, a first direction of movement of the first electronic device based at least in part on the first RSSI value and the third RSSI value;

determining, by the security system, a second direction of movement of the second electronic device based at least in part on the third RSSI value and the fourth RSSI value; and

identifying, by the security system, that the first direction of movement and the second direction of movement is in substantially the same direction, wherein the alarm is based at least in part on the first direction and the second direction being substantially the same direction.

14. The method of claim 8, wherein the RF sensor is a first RF sensor and further comprising:

identifying, by the security system, a third RSSI value of the RF signal at a second RF sensor at substantially the first time;

identifying, by the security system, a fourth RSSI value of the RF signal at the second RF sensor at substantially the second time;

identifying, by the security system, a fifth RSSI value of the RF signal at a third RF sensor at substantially the first time; and

identifying, by the security system, a sixth RSSI value of the RF signal at the third RF sensor at substantially the second time,

wherein the velocity of the electronic device is further based at least in part on the third RSSI value, the fourth RSSI value, the fifth RSSI value, and the sixth RSSI value.

15. One or more non-transitory computer-readable media storing computer-executable instructions that responsive to execution cause one or more computer processors to perform operations comprising:

receiving a RF fingerprint of a RF signal detected by an RF sensor within an area under surveillance (AUS), the RF fingerprint comprising at least one of;

i) a hardware address of an electronic device that emitted the RF signal or ii) a radio type identifier of a radio of the electronic device;

identifying a first receive signal strength indicator (RSSI) value of the RF signal at the RF sensor at a first time;

identifying a second RSSI value of the RF signal at the RF sensor at a second time;

determining a velocity of the electronic device based at least in part on the first RSSI value, the second RSSI value, and a span of time between the first time and the second time;

determining that the velocity is greater than a threshold velocity value; and

generating an alarm indicating that a velocity of movement of the electronic device has been detected greater than the threshold velocity value.

16. The one or more non-transitory computer-readable media of claim 15, the operations further comprising:

determining a stored persona that includes a stored RF fingerprint that matches the received RF fingerprint; and

determining that the electronic device that emitted the RF signal is associated with the stored persona and identify a user associated with the stored persona, wherein the alarm includes an identification of the user.

17. The one or more non-transitory computer-readable media of claim 15, wherein the electronic device is a first electronic device, the RF fingerprint is a first RF fingerprint, the RF signal is a first RF signal, the velocity is a first velocity, and the operations further comprising:

receiving a second RF fingerprint of a second RF signal detected by the RF sensor within the AUS, the second RF fingerprint comprising at least one of;

i) a second hardware address of a second electronic device that emitted the second RF signal or ii) a second radio type identifier of a second radio of the second electronic device;

identifying a third receive signal strength indicator (RSSI) value of the second RF signal at a third time;

identifying a fourth RSSI value of the RF signal at a fourth time;

determining a second velocity of the second electronic device based at least in part on the third RSSI value, the fourth RSSI value, and a span of time between the third time and the fourth time; and

determining that the second velocity is greater than the threshold velocity value, wherein the alarm indicates that the second velocity is greater than the threshold velocity.

18. The one or more non-transitory computer-readable of claim 17, the operations further comprising:

determining a first direction of movement of the first electronic device based at least in part on the first RSSI value and the third RSSI value;

determining a second direction of movement of the second electronic device based at least in part on the third RSSI value and the fourth RSSI value; and

identifying, based at least in part on the first direction of movement and the second direction of movement, that the first electronic device and the second electronic device are moving toward at least one egress point of the AUS, wherein the alarm is based at least in part on the first electronic device and the second electronic device moving toward the at least one egress point.

19. The one or more non-transitory computer-readable of claim 17, the operations further comprising:

determining a first direction of movement of the first electronic device based at least in part on the first RSSI value and the third RSSI value;

determining a second direction of movement of the second electronic device based at least in part on the third RSSI value and the fourth RSSI value; and

identifying that the first direction of movement and the second direction of movement is in substantially the same direction, wherein the alarm is based at least in part on the first direction and the second direction being substantially the same direction.

20. The one or more non-transitory computer-readable of claim 15, the operations further comprising:

identifying a third RSSI value of the RF signal at a second RF sensor at substantially the first time;

identifying a fourth RSSI value of the RF signal at the second RF sensor at substantially the second time;

identifying a fifth RSSI value of the RF signal at a third RF sensor at substantially the first time; and

identifying a sixth RSSI value of the RF signal at the third RF sensor at substantially the second time,

wherein the velocity of the electronic device is further based at least in part on the third RSSI value, the fourth RSSI value, the fifth RSSI value, and the sixth RSSI value.