Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-10235523-B1
Publication Date
2019-03-19
Expiration Date
Abstract
An apparatus for a network of electrical and/or electronic devices coupled to a data bus comprises a sensor coupled to the data bus and configured to capture information content communicated through the data bus in a form of electromagnetic emissions being at least one of differential mode electromagnetic emissions, common mode electromagnetic emissions, coupled radiated electromagnetic emissions, and data bit streams; one or more processors or logic devices, and a non-transitory computational medium comprising executable instructions. The apparatus measure a feature value in at least one region of a time domain or a frequency domain of the captured electromagnetic emissions, calculates a difference value between the measured feature value and one or more baseline feature values, and determines, based on the calculated value, a presence or an absence of anomalies indicative of at least one of cyber intrusion attempt, cyber attack, cyber-physical attacks, malware, etc.
Core Innovation
The invention provides an apparatus for protecting electrical and/or electronic device(s) coupled to a data bus from a threat, where the data bus comprises two differential signal lines within a shield. A data bus coupler acquires analog signal(s) conducted through the differential signal line(s), and a sensor captures the acquired analog signals. One or more processors or logic devices perform measuring of a feature value in at least one region of a time domain or a frequency domain of the captured analog signals, followed by calculating a difference value between the measured feature value and one or more baseline feature values.
Based on the calculated difference value, the apparatus determines a presence or an absence of the threat to the electrical and/or electronic devices. The threat determination is grounded in comparing measured time-domain and/or frequency-domain feature values against baseline feature values. The same captured analog signals are processed by the computational medium having executable instructions executed by the processors or logic devices to carry out these operations.
In related systems, the protection approach is extended using multi-modal couplers and sensor systems that capture different emission forms, including unintended and intended digital/analog emissions and radiated/conducted emissions through the differential signal lines. The captured signal forms provide information for intrusion detection, health monitoring, equipment operational status, equipment presence, remaining useful life, operational mode, fault detection, software authenticity, and software change in progress, and can be used for status determination and control actions.
Claims Coverage
The independent claims cover an apparatus, a multimodal coupler system, a sensor system, a method, and an aircraft electronic device protection system, with a total of five independent claim bodies contributing inventive features related to multi-form electromagnetic sensing, baseline comparison using time/frequency features, and threat/status determination.
Shielded differential data bus coupler with analog acquisition
A data bus coupler comprising one or more connections with at least one differential signal line, where the one or more connections are configured to acquire analog signal(s) conducted through the at least differential signal line.
Sensor capturing acquired analog signals for protection
A sensor coupled to the data bus coupler, where the sensor is configured to capture the acquired analog signals.
Time- or frequency-domain feature measurement and baseline difference
Measuring a feature value in at least one region of a time domain or a frequency domain of the captured analog signals, calculating a difference value between the measured feature value and one or more baseline feature values.
Threat presence/absence determination from baseline difference value
Determining, based on the calculated value, a presence or an absence of said threat to the electrical and/or electronic devices.
Multimodal coupler with plurality of analog sensing input forms for intended/unintended emissions
A plurality of analog sensing input forms comprising connection(s) with at least the differential signal lines, where the analog sensing input forms include at least one of unintended digital radiated, unintended analog radiated, unintended digital conducted, unintended analog conducted, intended digital radiated, intended analog radiated, intended digital conducted and intended analog conducted emissions through the differential signal lines.
Emission information for intrusion detection and equipment/software status
Analog sensing input forms provide information on at least one of intrusion detection, health monitoring, equipment operational status, equipment presence, remaining useful life, operational mode, fault detection, software authenticity, software download in progress, and software change in progress.
Sensor system for common-mode and differential-mode unintended emissions plus digital bus data
A sensor system configured to sense analog signal forms originating in a bus common mode unintended emissions, bus differential mode unintentional emissions, and digital bus data.
Using sensed signal forms to determine device status, operational or configuration information
The sensor system is further configured to use said signal forms to determine status, operational information, or configuration information related to devices connected to said bus.
MIL-STD-1553 conducted-emissions protection method including multiple conducted/free-field/data bit streams
Providing an apparatus comprising a sensor and a controller coupled to said sensor, the apparatus being configured to receive and process electromagnetic emissions conducted through said differential signal lines in said MIL-STD-1553 data bus, where said conducted emissions are at least one of differential mode electromagnetic emissions, common mode electromagnetic emissions, coupled radiated electromagnetic emissions, free field electromagnetic emissions and data bit streams; providing a coupling device configured to acquire said conducted emissions; coupling said coupling device to at least said differential signal lines in said MIL-STD-1553 data bus; operatively connecting said coupling device to said apparatus; acquiring, with said coupling device, said conducted emissions; capturing, with said sensor, said acquired conducted emissions; processing, with said controller, said captured conducted emissions; and determining, with said controller based on processing of said captured conducted emissions, a presence or an absence of said threat.
Aircraft electronic device protection system for MIL-STD-1553 conducted emissions
An aircraft electronic device protection system comprising a MIL-STD-1553 data bus comprising signal lines within a shield and coupled to one or more electronic devices within the aircraft; a coupling device being coupled to at least said signal lines in said MIL-STD-1553 data bus, where the coupling device acquires analog signal(s) conducted through said signal lines; a sensor coupled to said coupling device and configured to capture emissions of electromagnetic energy conducted from one or more electronic devices through said signal lines; and a controller configured to process said conducted emissions of electromagnetic energy and determine a presence or an absence of a threat to the one or more electronic devices, where the conducted emissions are at least one of differential mode electromagnetic emissions, common mode electromagnetic emissions, coupled radiated electromagnetic emissions, free field electromagnetic emissions and data bit streams.
Across the independent claims, the core inventive theme is protecting or monitoring devices on a shielded differential data bus (including MIL-STD-1553) by capturing analog signals/emissions via a coupler and sensor, extracting feature information in time and/or frequency domains (for baseline comparison in claim 1), and determining a threat presence/absence, while additional independent coverage defines multi-modal sensing input forms and bus-specific sensing (common-mode/differential-mode plus digital bus data) for security and equipment/software status.
Stated Advantages
Real-time operation.
Low false alarm rate (FAR) and high probability of detection (Pd).
Bandwidth for wideband high-resolution signature acquisition.
Health monitoring and prognostics for condition-based maintenance.
Integration for aircraft LRU protection and remote monitoring.
Documented Applications
Protecting electrical and/or electronic devices coupled to a data bus, including aircraft electronic devices coupled to a MIL-STD-1553 data bus.
Intrusion detection and cyber/cyber-physical threat detection for aircraft avionics/data-bus protection.
Electronic Health Monitoring (EHM) including prognostics for condition-based maintenance of equipment connected to the data bus.
Remote monitoring and protection of aircraft LRU(s) using the described avionics/data-bus protection apparatus.
Interested in licensing this patent?