Fingerprinting digital devices using electromagnetic characteristics of their communications

• US 7,639,806 B2
• Filed: 03/23/2005
• Issued: 12/29/2009
• Est. Priority Date: 03/24/2004
• Status: Expired due to Fees

• Current Assignee: Iowa State University Research Foundation Incorporated (Iowa State University)
• Original Assignee: Iowa State University Research Foundation Incorporated (Iowa State University)
• Inventors: Russell, Steve F., Daniels, Thomas E., Mina, Mani
• Primary Examiner(s): Zia; Syed A.
• Assistant Examiner(s): Moorthy; Aravind K
• Application Number:
  US11/087,365
• Publication Number:
  US 20050213755A1
• Time in Patent Office: 1,742 Days
• Field of Search: 380/203
• US Class Current: 380/203
• CPC Class Codes: H04K 1/00 Secret communication
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

Methods and apparatus or systems for providing security based on innate characteristics of devices are disclosed. A method of providing security associated with communications from a digital device includes observing an analog signal associated with communications from the digital device, characterizing the digital device at least partially based on the analog signal, and providing a security feature at least partially based on the step of characterizing.

Claims

1. A method of providing security associated with communications from a digital device, comprising:

accessing an analog signal associated with communications from the digital device through a passive analog tap;

observing the analog signal associated with communications from the digital device;

characterizing the digital device at least partially based on the analog signal;

providing a security feature at least partially based on the step of characterizing.

2. The method of claim 1 wherein the security feature is an intrusion detection security feature.

3. The method of claim 1 wherein the security feature includes forensic data collection.

4. The method of claim 1 wherein the security feature includes authentication.

5. The method of claim 1 wherein the security feature includes identification.

6. The method of claim 1 wherein the security feature includes failure detection.

7. The method of claim 1 further comprising tracking changes in characteristics of the digital device over time.

8. The method of claim 1 wherein the step of characterizing comprises analyzing the analog signal.

9. The method of claim 8 wherein the analyzing includes performing signature analysis.

10. The method of claim 8 wherein the analyzing includes performing pattern recognition.

11. The method of performing pattern recognition of claim 10 wherein the step of performing pattern recognition includes applying at least one of a set of techniques comprising cross-correlation comparison, amplitude and power spectrum comparison, matched filter detection, wavelet analysis, and differential spectral analysis.

12. The method of claim of claim 8 wherein the analyzing includes using Kolomogorov-Smirnov tests.

13. The method of claim 8 wherein the analyzing includes analytic modeling of signal components and signature behavior.

14. The method of claim 1 wherein the digital device is selected from a set comprising a network hub, a network switch, a network card, a wireless network card, a wireless access point, a smartcard, a smartcard reader, an RFLD tag, and an REID reader.

15. The method of claim 1 wherein the step of characterizing includes characterizing the digital device by manufacturer and model.

16. The method of claim 1 wherein the step of characterizing includes characterizing the digital device as being authorized or unauthorized.

17. An apparatus for providing security related to communications from a digital device, comprising:

an analog tap configured to provide access to an analog signal associated with outputs of the digital device;

a signal analysis component for providing an analysis of the analog signal associated with the digital device and accessed through the analog tap, wherein the analysis includes determining characteristics of the digital device based on the analog signal;

a decision component for characterizing the analysis of the analog signal associated with the digital device and determining whether or not to activate a security feature based on policy functions.

18. The apparatus of claim 17 wherein the signal analysis component is partially implemented in software.

19. The apparatus of claim 17 wherein the signal analysis component is partially implemented in hardware.

20. The apparatus of claim 19 wherein the hardware includes a signal digitizer.

21. The apparatus of claim 17 wherein the decision component is at least partially implemented in software.

22. A system for providing security, comprising:

a controlled device having a controlled interface to a medium, the controlled interface comprising an analog tap;

an analog-to-digital converter operatively connected to the controlled interface for receiving an analog signal and providing digital samples;

a data selection and reduction component operatively connected to the analog-to-digital converter for receiving the digital samples and selectively storing selected or reduced digital samples within a storage component;

an analysis component for analyzing the digital samples and determining characteristics of the controlled device based on the digital samples;

a policy component for making decisions based on output from the analysis component.

23. The system of claim 22 wherein the analysis component is adapted to access historical data stored in the storage component.

24. The system of claim 22 wherein the controlled device is a network device.

25. The system of claim 24 wherein the networked device is an Ethernet network device.