Apparatus and method for detection of cyber tampering, physical tampering, and changes in performance of electronic devices

Patent metadata

Field	Value
Publication number	US-11201641-B2
Application number	US-201916406590-A
Country	US
Kind code	B2
Filing date	May 8, 2019
Priority date	May 8, 2019
Publication date	Dec 14, 2021
Grant date	Dec 14, 2021

Abstract

An analog tamper-detection apparatus (ATAMP) for onboard analysis of a target device includes a plurality of antennas, each antenna of the plurality of antennas disposed within the target device and being electrically isolated from components of the target device. The ATAMP device further includes radio frequency (RF) front-end (RFFE) transmitter circuitry coupled to the plurality of antennas, the RFFE transmitter circuitry configured to illuminate the target device with a plurality of electromagnetic signals emitted via the plurality of antennas, to generate a plurality of mixed RF signals. The ATAMP device further includes RFFE receiver circuitry configured to receive emissions from the target device based on the mixed RF signals, and processing circuitry configured to perform subsequent analysis and evaluation of the target device based on the received emissions. The processing circuitry further generates a notification of the subsequent analysis and evaluation.

First claim

The invention claimed is:

1. An analog tamper-detection (ATAMP) apparatus for onboard analysis of a target device, the apparatus comprising:
a plurality of antennas, each antenna of the plurality of antennas disposed within the target device and being electrically isolated from components of the target device;
radio frequency (RF) front-end (RFFE) transmitter circuitry coupled to the plurality of antennas, the RFFE transmitter circuitry configured to interrogate the target device with a plurality of electromagnetic signals emitted via the plurality of antennas, to generate a plurality of mixed RF signals;
RFFE receiver circuitry configured to receive emissions from the target device, the emissions generated by the target device based on the mixed RF signals; and
processing circuitry configured to perform subsequent analysis and evaluation of the target device based on a comparison of a first signal characteristic associated with the received emissions and a second signal characteristic associated with the plurality of electromagnetic signals interrogating the target device via the plurality of antennas, and generate a notification of the subsequent analysis and evaluation based on the comparison.

2. The apparatus of claim 1 , wherein each antenna of the plurality of antennas is air-gapped from the target device, and wherein the first signal characteristic and the second signal characteristic include at least one of:
a signal frequency;
a frequency distribution metric;
a spectral power distribution metric;
a spectral density;
a signal pattern derived from changes in frequency, amplitude, or phase; and
existence of non-linear mixing spurs or mixing products.

3. The apparatus of claim 1 , wherein the RFFE transmitter circuitry comprises a plurality of transmitters, each transmitter of the plurality of transmitters coupled to a corresponding antenna of the plurality of antennas.

4. The apparatus of claim 3 , wherein to interrogate the target device with the plurality of electromagnetic signals, each transmitter of the plurality of transmitters is configured to transmit a corresponding electromagnetic signal of the plurality of electromagnetic signals, the plurality of electromagnetic signals being at a frequency offset from each other and covering a first predetermined frequency range.

5. The apparatus of claim 4 , wherein the RFFE receiver circuitry is configured to:
scan a second predetermined frequency range to detect the emissions from the target device.

6. The apparatus of claim 5 , wherein scanning the second predetermined frequency range takes place when the target device is in a powered off state.

7. The apparatus of claim 1 , wherein the received emissions from the target device comprise a resonant RF signal generated from reflections of the plurality of mixed RF signals by components of the target device.

8. The apparatus of claim 1 , wherein to perform the subsequent analysis and evaluation of the target device the processing circuitry is to:
compare a reference evaluation of the target device with the received emissions to detect physical alteration or tampering of the target device.

9. The apparatus of claim 1 , wherein the plurality of antennas comprises a plurality of loop antennas, and wherein the plurality of loop antennas, the RFFE transmitter circuitry, and the RFFE receiver circuitry is electrically isolated from the components of the target device.

10. The apparatus of claim 1 , wherein the target device comprises at least one of a computer system, a communications system, an Internet connected device, an avionics system, a military system, and a business system.

11. An analog tamper-detection (ATAMP) apparatus for onboard analysis of a target device, the apparatus comprising:
a plurality of antennas, each antenna of the plurality of antennas disposed within the target device and being electrically isolated from components of the target device;
radio frequency (RF) front-end (RFFE) transmitter circuitry coupled to the plurality of antennas, the RFFE transmitter circuitry configured to illuminate the target device with a plurality of electromagnetic signals emitted via the plurality of antennas, to generate a plurality of mixed RF signals;
RFFE receiver circuitry configured to receive emissions from the target device based on the mixed RF signals; and
processing circuitry configured to perform subsequent analysis and evaluation of the target device based on the received emissions, and generate a notification of the subsequent analysis and evaluation,
wherein the RFFE transmitter circuitry comprises a plurality of transmitters, each transmitter of the plurality of transmitters coupled to a corresponding antenna of the plurality of antennas,
wherein to illuminate the target device with the plurality of electromagnetic signals, each transmitter of the plurality of transmitters is configured to transmit a corresponding electromagnetic signal of the plurality of electromagnetic signals, the plurality of electromagnetic signals being at a frequency offset from each other and covering a first predetermined frequency range,
wherein the RFFE receiver circuitry is configured to scan a second predetermined frequency range to detect the emissions from the target device, and

wherein the second predetermined frequency range is non-overlapping with the first predetermined frequency range.

12. A method for onboard analysis of a target device, the method comprising:
interrogating the target device with a plurality of electromagnetic signals emitted via a plurality of antennas that are air-gapped with the target device to generate a plurality of mixed radio frequency (RF) signals, generating the plurality of mixed RF signals resulting in a resonant RF signal radiating from the target device;
receiving the resonant RF signal from the target device using receiver circuitry;
performing subsequent analysis and evaluation of the target device based on a comparison of a first signal characteristic associated with the resonant RF signal received from the target device and a second signal characteristic associated with the plurality of electromagnetic signals interrogating the target device via the plurality of antennas; and
generating a notification based on the analysis and evaluation of the target device.

13. The method of claim 12 , further comprising:
comparing a reference evaluation of the target device with the received resonant RF signal to detect physical alteration or tampering of the target device; and
generating the notification based on the detected physical alteration or tampering of the target device.

14. The method of claim 12 , wherein the interrogating takes place while the target device is powered off.

15. The method of claim 12 , further comprising:
interrogating the target device with a single electromagnetic signal emitted via one of the plurality of antennas while the target device is powered on, the single electromagnetic signal mixing with operational electromagnetic signals in the target device to produce forced non-linear emissions that radiate from the target device;
receiving the forced non-linear emissions using the receiver circuitry; and
comparing a reference evaluation of the target device with the received forced non-linear emissions to detect tampering with software executing on the target device.

16. The method of claim 12 , further comprising:
monitoring, using the receiver circuitry, a predetermined frequency band;

detecting within the predetermined frequency band and using the receiver circuitry, unintended RF emissio

Assignees

• Raytheon Bbn Technologies Corp

Inventors

• Shake Tyler
• Dishon John
• Mergen John-Francis
• Leuschner Zachary
• Wilkerson Thomas
• Miller David Brian
• Buikema Ronald

Classifications

• Y04S40/20

  Information technology specific aspects, e.g. CAD, simulation, modelling, system security · CPC title

• H04B7/0426 Primary

  Power distribution · CPC title

• H04B7/0689

  using different transmission schemes, at least one of them being a diversity transmission scheme · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• G06F21/87 Primary

  by means of encapsulation, e.g. for integrated circuits · CPC title