Detection of malicious software, firmware, IP cores and circuitry via unintended emissions
Inventors
Keller, Walter John • Pathak, Bogdan Amaru • Portune, Andrew Richard • Chornenky, Todd Eric
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-10395032-B2
Publication Date
2019-08-27
Expiration Date
Abstract
An apparatus for testing, inspecting or screening an electrically powered device for modified or unmodified hardware, firmware or software modifications including Malware, Trojans, adware, improper versioning, worms, or virus and the like, includes an antenna positioned at a distance from the electrically powered device and a signal receiver or sensor for examining a signal from the electrically powered device. The receiver or sensor collects unintended RF energy components emitted by the electrically powered device and includes one or more processors and executable instructions that perform analysis in a response to the acquired signal input while the electrically powered device is active or powered. The characteristics of the collected RF energy may be compared with RF energy characteristics of an unmodified device. The comparison determines one of a modified, unmodified or score of certainty of modified condition of the electrically powered device.
Core Innovation
The invention provides an apparatus and computational analysis for detecting and classifying malicious software, anomalous software, modified software, malicious firmware, anomalous firmware, modified firmware, malicious circuitry, anomalous circuitry, and modified circuitry within one or more electrical devices by capturing unintended emitted electromagnetic energy and/or unintended conducted energy. The capturing is performed with a sensor that includes a hollow enclosure with an access to an interior, one or more antennas, low noise amplifier(s), RF tuner(s), and analog to digital converter(s), where electrical devices are inserted into the sensor interior during operation of the apparatus.
The captured unintended emitted energy and/or unintended conducted energy is analyzed by measuring a feature value in at least one spectral frequency region and calculating a difference value between the measured feature value and a baseline feature value. The analysis verifies, based on the calculated difference value, whether sub-threshold and/or super-threshold values have been exceeded in amplitude, frequency, phase and time domains of signature(s) elements, and determines a presence or an absence of at least one of the malicious, anomalous, or modified software, firmware, and circuitry categories.
In additional embodiments, the invention uses an integrated antenna enclosure and an electromagnetic pattern sensor to capture unintended emissions from multiple physical electrical devices that are determined and/or validated to be constructed, coded, programmed, loaded, burned-in, and functioning identically, and then identifies differences between corresponding quantified features. Other embodiments use an RF shielded enclosure and an emissions acquisition assembly to convert amplified unintended emissions into digitized data, then identify anomalous software, anomalous firmware, and anomalous circuitry based on distinct changes in measured parameter values over subsequent unintended emissions.
Claims Coverage
The partial content includes four independent claims, each centered on capturing unintended electromagnetic emissions from electrical devices and determining presence/absence or anomalous classification of malicious/anomalous/modified software, firmware, and/or circuitry via spectral-feature comparison and threshold/difference-based verification across amplitude, frequency, phase, and time domains.
Capture unintended emitted and/or unintended conducted energy in a hollow enclosure sensor
A sensor with a hollow enclosure having an access to an interior, one or more antennas, low noise amplifier(s), RF tuner(s), and analog to digital converter(s) configured to capture unintended emitted electromagnetic energy and/or unintended conducted energy from one or more electrical devices inserted into the interior during operation.
Spectral feature measurement and baseline-difference verification across domains
Measuring a feature value in at least one spectral frequency region; calculating a difference value between the measured feature value and a baseline feature value; verifying whether sub-threshold and super-threshold values have been exceeded in amplitude, frequency, phase and time domains of signature elements based on the calculated difference value.
Determine presence or absence of malicious, anomalous, or modified software, firmware, and circuitry
Determining, based on the calculated difference value, a presence or an absence of at least one of malicious software, anomalous software, modified software, malicious firmware, anomalous firmware, modified firmware, malicious circuitry, anomalous circuitry and modified circuitry within the one or more electrical devices.
Integrated antenna enclosure for comparing multiple identically constructed devices
An integrated antenna enclosure with a hollow enclosure and an access, one or more antennas arranged in or integrated into the enclosure, disposed external to the electrical devices, and an electromagnetic pattern sensor capturing unintended emissions, where quantified feature values in at least one spectral frequency region are determined for at least two different physical electrical devices that are determined and/or validated to be constructed, coded, programmed, loaded, burned-in and functioning identically.
Difference-based quantification and parameter comparison across devices
Identifying differences between corresponding quantified features for each of the at least two different physical electrical devices; calculating a value based on a comparison of corresponding quantified features forming at least one parameter of the spectral frequency region in the unintended emission.
RF shielded enclosure with integrated antenna and emissions acquisition assembly
A hollow enclosure with a door selectively opening and closing an access, the enclosure being a radio frequency shielded enclosure when the door is closing the access; an antenna integrated into the hollow enclosure; and an emissions acquisition assembly configured to receive, from the antenna in analog form, unintended emissions from an electrical device inserted into the interior during operation, amplify the unintended emissions, and convert amplified unintended emissions into digitized data.
Distinct changes in measured parameters across subsequent emissions
Identifying a spectral frequency region within a sample unintended emission; measuring a value of a parameter of the spectral frequency region in the sample unintended emission; measuring value(s) of the parameter in one or more subsequent unintended emissions; determining, based on distinct changes in the values of the parameter, at least one of anomalous software, anomalous firmware and anomalous circuitry of the electrical device.
Signature analysis using multiple specified analysis types
Analyzing signature(s) of the captured emissions by at least one of a spectrographic analysis, an amplitude analysis, a time-frequency analysis, a frequency analysis, an electromagnetic emission radiation response analysis, input signal variations, a phase analysis, an informatics analysis, and a statistical analysis.
Threshold exceedance verification in amplitude, frequency, phase and time domains
Verifying whether at least one of sub-threshold and super-threshold values have been exceeded in one or more of amplitude, frequency, phase and time domains of signature(s) elements of the captured emissions, thereby enabling presence or absence determination for at least one of anomalous circuitry, anomalous firmware or anomalous software.
Across the independent claims, the core determination is performed by capturing unintended emitted and/or unintended conducted electromagnetic energy in an RF-shielded or enclosure-based sensor, extracting spectral-frequency feature values from emission signature(s), calculating differences against baseline or cross-device comparisons, and verifying sub-threshold or super-threshold exceedance or distinct changes in measured parameters to determine presence or absence of malicious, anomalous, or modified software, firmware, and circuitry.
Stated Advantages
Non-destructive detection and classification are described via capturing unintended emitted electromagnetic energy and/or unintended conducted energy for determining presence or absence of malicious, anomalous, or modified software, firmware, and circuitry.
100% screening across a device lifecycle is described.
Documented Applications
Detecting whether malicious software, anomalous software, modified software, malicious firmware, anomalous firmware, modified firmware, malicious circuitry, anomalous circuitry, and modified circuitry are present or absent within electrical devices such as wafers, dies, electronic parts, circuit boards, system/sub-system, FPGA, VLSI, CPLD, SoC, and DRAM.
Analyzing a plurality of wafers, dies, electronic parts, circuit boards, circuit board assemblies, sub-systems and systems for presence or absence of at least one of anomalous circuitry, anomalous firmware or anomalous software.
Interested in licensing this patent?