SYSTEMS AND METHODS FOR DETERMINING WHETHER A CIRCUIT IS OPERATING PROPERLY

• US 20170082680A1
• Filed: 09/22/2015
• Published: 03/23/2017
• Est. Priority Date: 09/22/2015
• Status: Active Grant

• Current Assignee: Raytheon Company (Rtx Corporation)
• Original Assignee: Raytheon Company (Rtx Corporation)
• Inventors: Eck, Christopher R., Gee, Linda A., Cogliandro, John A.
• Granted Patent: US 10,184,974 B2
• Time in Patent Office: Days
• CPC Class Codes: G01R 31/2815 Functional tests, e.g. boundary scans, using the normal I/O contacts contacting devices G01R31/2808; testing digital circuits G01R31/317, G06F11/00
• CPC Class Codes: G01R 31/2817 Environmental-, stress-, or burn-in tests of IC's G01R31/2855; of individual semiconductors G01R31/2642; of other circuits G01R31/2849
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2127 Bluffing
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Generally discussed herein are systems, devices, and methods for determining if a circuit is acting improperly. A system can include a module to receive proper performance values of a circuit, a module to receive improper performance values of the circuit, a module to compare actual circuit input characteristics (X_a) and actual circuit output characteristics (Y_a) to X, Y, D, and Z to determine if the circuit is more likely operating properly or more likely operating improperly, and an alert module to, in response to determining the circuit is operating improperly, provide an alert to personnel indicating that the circuit is operating improperly or providing one or more signals to the circuit that cause the circuit to alter its current operation.

Claims

1. A system for determining and indicating whether a circuit is performing properly comprising:

one or more memories;

processing circuitry coupled to the one or more memories to execute instructions stored on the one or more memories so as to implement modules including;

a proper performance ingest module to receive proper performance values of components of a circuit based on two or more of a differential power analysis, a specification sheet for the circuit, signal to noise ratio, radio frequency interference pattern, power consumption, heat produced, and a measurement of electrical potential or current values at electrical contacts of the circuit, the proper performance values include a proper input characteristic (X) and a proper output characteristic (Y);

an improper performance module to receive improper performance values of the circuit, the improper performance values including improper input values (D) and improper output values (Z), wherein the improper input values (D) include one or more of an improper electromagnetic radiation, improper noise, improper forcing function, obfuscated input, and malicious code and the improper output values (Z) include an output of the circuit in response to being stimulated by the improper input value;

a compare module to compare actual circuit input characteristics (X_a) and actual circuit output characteristics (Y_a) to X, Y, D, and Z to determine if the circuit is more likely operating properly or more likely operating improperly; and

an alert module to, in response to determining the circuit is operating improperly, provide an alert to personnel indicating that the circuit is operating improperly or providing one or more signals to the circuit that cause the circuit to alter its current operation.

2. The system of claim 1, wherein the compare module further comprises:

a Kalman filter module to estimate the state of the actual circuit input characteristics (X_a) based on a limited, incomplete dataset before comparing to the proper performance values and the improper performance values; and

an interacting multiple models module to compare X_a and Y_a to X, Y, D, and Z and evaluate, using interacting multiple models, whether Y_a more closely matches Y or Z.

3. The system of claim 2, wherein the Kalman filter module further predicts other proper performance values and improper performance values based on the proper performance values (X and Y), improper performance values (D and Z), and actual performance parameters (X_a and Y_a).

4. The system of claim 2, wherein Z={Z₁, Z₂, . . . Z_N}, where each Z_i is an individual set of improper performance values of a number of improper performance values (Z), and wherein the compare module further includes an interacting multiple models module to evaluate, using interacting multiple models, whether Y_a more closely matches Y or a hybrid pattern that is a mathematical combination of two or more of {Z₁, Z₂, . . . Z_N}.

5. The system of claim 4, wherein the compare module further comprises a multiple hypothesis manipulation module to determine a set of input characteristics that most likely caused improper performance values.

6. The system of claim 5, wherein the alert module is to include the set of input characteristics determined by the multiple hypothesis manipulation module in the alert to personnel or the circuit including a location of a component of the components determined to be operating improperly based on the comparison by the interacting multiple models module.

7. The system of claim 5, wherein the compare module includes a graph theory module to evaluate, using graph theory, pattern match scores between (1) Y_a and Y and (2) Y_a and Z to determine if the circuit is operating improperly.

8. The system of claim 7, further comprising a trace determination module to determine, using X, Y, D, Z, X_a, and Y_a, a trace at which the circuit is behaving improperly and wherein the alert module is to provide an indication of the trace or a component of the circuit connected to the trace, using a circuit diagram of the circuit, in the alert to the personnel or the circuit set.

9. The system of claim 8, further comprising a vlookup/hlookup module to determine, based on at least one of a type of improper behavior, the component connected to the trace, and concept of operations (CONOPS), an alarm tolerance from zero to infinity that indicates a criticality of the component to the CONOPS and which improper behavior will cause the alert module to perform at least one of provide an alert to personnel indicating that the circuit is operating improperly and provide one or more signals to the circuit that cause the circuit to alter its current operation and wherein, in response to the alert module determining that the improper behavior exceeds the tolerance, the alert module is to provide one or more instruction signals to the circuit or personnel based on at least one of the type of improper behavior, the component connected to the trace, and the CONOPS, wherein the instruction signals include text instructions or machine commands determined using the vlookup/hlookup module.

10. The system of claim 9, wherein the alert module is to provide a signal to the processing circuitry that causes the processing circuitry to continue operating with decoy signals that include signals that are asserted by the processor to spoof that the circuit is continuing normal operation or continue operation with obfuscated signals that include hidden signals embedded in normal operation signals.

11. A method for determining and indicating whether a circuit is performing properly, the method comprising:

determining proper performance values of a circuit based on two or more of a differential power analysis, a specification sheet for the circuit, signal to noise ratio, radio frequency interference pattern, heat produced and a measurement of electrical potential or current values at electrical contacts of the circuit, the proper performance values include a proper input characteristic (X) and a proper output characteristic (Y);

determining improper performance values of the circuit, the improper performance values including improper input values and improper output values (Z), wherein the improper input values include one or more of an improper power consumption, improper electromagnetic radiation, improper noise, improper forcing function, obfuscated input, and malicious code and the improper output values include an output of the circuit in response to being stimulated by the improper input value;

comparing actual circuit input characteristics (Xa) and actual circuit output characteristics (Ya) to the proper performance values and the improper performance values to determine if the circuit is more likely operating properly or more likely operating improperly; and

in response to determining the circuit is operating improperly, providing an alert to personnel indicating that the circuit is operating improperly or providing one or more signals to the circuit that cause the circuit to alter its current behavior.

12. The method of claim 11, further comprising:

estimating the state of the actual circuit input characteristics (Xa) using Kalman filtering before comparing to the proper performance values and the improper performance values; and

wherein comparing Xa and Ya to X, Y, and Z includes evaluating, using interacting multiple models, whether Ya more closely matches Y or Z including evaluating using interacting multiple models, whether Ya more closely matches Y or a hybrid pattern that is a combination of two or more of {Z₁, Z₂, . . . Z_N}.

13. The method of claim 12, further comprising:

using multiple hypothesis manipulation to determine a set of input characteristics that most likely caused improper performance values; and

using graph theory to evaluate a pattern match score between Ya, Y, and Z to determine if the circuit is operating improperly.

14. The method of claim 13, further comprising:

determining based on at least one of a type of improper behavior, the component connected to the trace, and concept of operations (CONOPS) an alarm tolerance from zero to infinity that indicates a criticality of the component to the CONOPS and which improper behaviors will cause at least one of provide an alert to personnel indicating that the circuit is operating improperly and provide one or more signals to the circuit that cause the circuit to alter its current operation; and

in response to determining that the improper behavior exceeds the tolerance, providing one or more instruction signals to the circuit or personnel based on at least one of the type of improper behavior, the component connected to the trace, and the CONOPS, wherein the instruction signals include text instructions or machine commands.

15. The method of claim 14, further comprising providing instruction signals to the circuit that causes the circuit to continue operating with decoy signals that include signals that are asserted by the processor to spoof that the circuit is continuing normal operation or continue operation with obfuscated signals that include hidden signals embedded in normal operation signals.

16. A non-transitory, machine-readable storage device including instructions stored thereon which, when executed by a machine, cause the machine to perform operations for determining and indicating whether a circuit is performing properly, the operations comprising:

determining proper performance values of a circuit based on two or more of a differential power analysis, a specification sheet for the circuit, signal to noise ratio, radio frequency interference pattern, heat produced and a measurement of electrical potential or current values at electrical contacts of the circuit, the proper performance values include a proper input characteristic (X) and a proper output characteristic (Y);

determining improper performance values of the circuit, the improper performance values including improper input values (D) and improper output values (Z), wherein the improper input values include one or more of an improper power consumption, improper electromagnetic radiation, improper noise, improper forcing function, obfuscated input, and malicious code and the improper output values include an output of the circuit in response to being stimulated by the improper input value;

comparing actual circuit input characteristics (Xa) and actual circuit output characteristics (Ya) to the proper performance values and the improper performance values to determine if the circuit is more likely operating properly or more likely operating improperly; and

in response to determining the circuit is operating improperly, providing an alert to personnel indicating that the circuit is operating improperly or providing one or more signals to the circuit that cause the circuit to alter its current behavior.

17. The storage device of claim 16 further comprising instructions stored thereon which, when executed by the machine, cause the machine to perform operations comprising estimating the state of the actual circuit input characteristics (Xa) using Kalman filtering before comparing to the proper performance values and the improper performance values.

18. The storage device of claim 17, wherein the instructions for comparing Xa and Ya to X, Y, and Z include instructions which, when executed by the machine, cause the machine to perform operations including evaluating, using interacting multiple models, whether Ya more closely matches Y or Z.

19. The storage device of claim 17, wherein Z={Z₁, Z₂, . . . Z_N} and wherein the instructions for comparing Xa and Ya to X, Y, and Z include instructions for evaluating, using interacting multiple models, whether Ya more closely matches Y or a hybrid pattern that is a combination of two or more of {Z₁, Z₂, . . . Z_N}.

20. The method of claim 19 further comprising instructions stored thereon which, when executed by the machine, cause the machine to perform operations comprising:

using multiple hypothesis manipulation to determine a set of input characteristics that most likely caused improper performance values; and

using graph theory to evaluate a pattern match score between Ya, Y, and Z to determine if the circuit is operating improperly.