Apparatus and method for detection of cyber tampering, physical tampering, and changes in performance of electronic devices

Patent metadata

Field	Value
Publication number	US-2021091829-A1
Application number	US-201916406590-A
Country	US
Kind code	A1
Filing date	May 8, 2019
Priority date	May 8, 2019
Publication date	Mar 25, 2021
Grant date	—

Abstract

An analog tamper-detection apparatus (ATAMP) for onboard analysis of a target device includes a plurality of antennas, each antenna of the plurality of antennas disposed within the target device and being electrically isolated from components of the target device. The ATAMP device further includes radio frequency (RF) front-end (RFFE) transmitter circuitry coupled to the plurality of antennas, the RFFE transmitter circuitry configured to illuminate the target device with a plurality of electromagnetic signals emitted via the plurality of antennas, to generate a plurality of mixed RF signals. The ATAMP device further includes RFFE receiver circuitry configured to receive emissions from the target device based on the mixed RF signals, and processing circuitry configured to perform subsequent analysis and evaluation of the target device based on the received emissions. The processing circuitry further generates a notification of the subsequent analysis and evaluation.

First claim

1 . An analog tamper-detection (ATAMP) apparatus for onboard analysis of a target device, the apparatus comprising:
a plurality of antennas, each antenna of the plurality of antennas disposed within the target device and being electrically isolated from components of the target device; radio frequency (RF) front-end (RFFE) transmitter circuitry coupled to the plurality of antennas, the RFFE transmitter circuitry configured to illuminate the target device with a plurality of electromagnetic signals emitted via the plurality of antennas, to generate a plurality of mixed RF signals; RFFE receiver circuitry configured to receive emissions from the target device based on the mixed RF signals; and processing circuitry configured to perform subsequent analysis and evaluation of the target device based on the received emissions, and generate a notification of the subsequent analysis and evaluation.

2 . The apparatus of claim 1 , wherein each antenna of the plurality of antennas is air-gapped from the target device.

3 . The apparatus of claim 1 , wherein the RFFE transmitter circuitry comprises a plurality of transmitters, each transmitter of the plurality of transmitters coupled to a corresponding antenna of the plurality of antennas.

4 . The apparatus of claim 3 , wherein to illuminate the target device with the plurality of electromagnetic signals, each transmitter of the plurality of transmitters is configured to transmit a corresponding electromagnetic signal of the plurality of electromagnetic signals, the plurality of electromagnetic signals being at a frequency offset from each other and covering a first predetermined frequency range.

5 . The apparatus of claim 4 , wherein the RFFE receiver circuitry is configured to:
scan a second predetermined frequency range to detect the emissions from the target device.

6 . The apparatus of claim 5 , wherein the second predetermined frequency range is non-overlapping with the first predetermined frequency range.

7 . The apparatus of claim 5 , wherein scanning the second predetermined frequency range takes place when the target device is in a powered off state.

8 . The apparatus of claim 1 , wherein the received emissions from the target device comprise a resonant RF signal generated from reflections of the plurality of mixed RF signals by components of the target device.

9 . The apparatus of claim 1 , wherein to perform the subsequent analysis and evaluation of the target device the processing circuitry is to:
compare a reference evaluation of the target device with the received emissions to detect physical alteration or tampering of the target device.

10 . The apparatus of claim 1 , wherein the plurality of antennas comprises a plurality of loop antennas, and wherein the plurality of loop antennas, the RFFE transmitter circuitry, and the RFFE receiver circuitry is electrically isolated from the components of the target device.

11 . The apparatus of claim 1 , wherein the target device comprises at least one of a computer system, a communications system, an Internet-connected device, an avionics system, a military system, and a business system.

12 . A method for onboard analysis of a target device, the method comprising:
illuminating the target device with a plurality of electromagnetic signals emitted via a plurality of antennas that are air-gapped with the target device to generate a plurality of mixed radio frequency (RF) signals, generating the plurality of mixed RF signals resulting in a resonant RF signal radiating from the target device; receiving the resonant RF signal using receiver circuitry for subsequent analysis and evaluation of the target device; and generating a notification based on the analysis and evaluation of the target device.

13 . The method of claim 12 , further comprising:
comparing a reference evaluation of the target device with the received resonant RF signal to detect physical alteration or tampering of the target device; and generating the notification based on the detected physical alteration or tampering of the target device.

14 . The method of claim 12 , wherein the illuminating takes place while the target device is powered off.

15 . The method of claim 12 , further comprising:
illuminating the target device with a single electromagnetic signal emitted via one of the plurality of antennas while the target device is powered on, the single electromagnetic signal mixing with operational electromagnetic signals in the target device to produce forced non-linear emissions that radiate from the target device; receiving the forced non-linear emissions using the receiver circuitry; and comparing a reference evaluation of the target device with the received forced non-linear emissions to detect tampering with software executing on the target device.

16 . The method of claim 12 , further comprising:
monitoring, using the receiver circuitry, a predetermined frequency band; detecting within the predetermined frequency band and using the receiver circuitry, unintended RF emissions from the target device; and comparing a reference evaluation of the target device with the unintended RF emissions to detect one or more of: tampering with software executing on the target device, failure of the target device, or sub-standard performance of the target device.

17 . A non-transitory computer-readable storage medium that stores instructions for execution by one or more processors of an analog tamper detection (ATAMP) device, the instructions to configure the one or more processors to cause the ATAMP device to:
illuminate a target device with a plurality of electromagnetic signals emitted via a corresponding plurality of antennas that are air-gapped with the target device to generate a plurality of mixed radio frequency (RF) signals, the plurality of mixed RF signals resulting in a resonant RF signal radiating from the target device; receive the resonant RF signal using receiver circuitry of the ATAMP device for subsequent analysis and evaluation of the target device; compare a reference evaluation of the target device with the received resonant RF signal to detect physical alteration or tampering of the target device; and generate a notification based on the detected physical alteration or tampering of the target device.

18 . The non-transitory computer-readable storage medium of claim 17 , wherein the illuminating takes place while the target device is powered off.

19 . The non-transitory computer-readable storage medium of claim 17 , wherein the instructions further configure the one or more processors to cause the ATAMP device to:
illuminate the target device with a single electromagnetic signal emitted via one of the plurality of antennas while the target device is powered on, the single electromagnetic signal mixing with operational electromagnetic signals in the target device to produce forced non-linear emissions that radiate from the target device; receive the forced non-linear emissions using the receiver circuitry; compare a reference evaluation of the target device with the received forced non-linear emissions to detect tampering with software executing on the target device; and generate the notification based on a result of the comparing.

20 . The non-transitory computer-readable storage medium of claim 17 , wherein the instructions further configure the one or more processors to cause the ATAMP device to:
monitor, using the receiver circuitry, a predetermined frequency band; detect within the predetermin

Assignees

• Raytheon Bbn Technologies Corp

Inventors

• Shake Tyler
• Dishon John
• Mergen John-Francis
• Leuschner Zachary
• Wilkerson Thomas
• Miller David Brian
• Buikema Ronald

Classifications

• Y04S40/20

  Information technology specific aspects, e.g. CAD, simulation, modelling, system security · CPC title

• H04B7/0426 Primary

  Power distribution · CPC title

• H04B7/0689

  using different transmission schemes, at least one of them being a diversity transmission scheme · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• G06F21/87 Primary

  by means of encapsulation, e.g. for integrated circuits · CPC title