Intrusion detection device and method thereof

Abstract

An intrusion detection device and method are provided. The intrusion detection device includes a state detector, a front-end signal processor, a delay device, and a signal sampler. The state detector generates an indication signal based on its active state. The front-end signal processor receives the indication signal and performs noise filtering on the indication signal to generate a processed indication signal. The delay device delays the processed indication signal to generate a delayed indication signal. The signal sampler samples the processed indication signal based on the delayed indication signal to generate a detection result.

Description

Technical Field

[0001] The present invention relates to an intrusion detection device and a detection method thereof, and more particularly to a low-power intrusion detection device and a detection method thereof. Background Art

[0002] In today's technology, electronic device intrusion detection refers to the process whereby a detection device detects and records the movement or opening of an electronic device's chassis. This information is then reported to a system for analysis to determine whether the device has been illegally intruded. This mechanism requires long-term operation, a long-term backup power supply, and instant reporting capabilities.

[0003] In the existing technology, intrusion detection can be performed by using registers within a computer device's Platform Controller Hub (PCH) or Baseboard Management Controller (BMC) in conjunction with intrusion detection circuitry. This approach requires the PCH or BMC to be activated to effectively execute, consumes significant power, and is unable to effectively and immediately detect intrusion activity. Summary of the Invention

[0004] In view of this, the present invention provides an intrusion detection device and a detection method thereof, which can operate with low power consumption.

[0005] One embodiment of the present invention discloses an intrusion detection device, comprising a state detector, a front-end signal processor, a delay device, and a signal sampler. The state detector generates an indication signal based on its activation state. The front-end signal processor is coupled to the state detector. The front-end signal processor receives the indication signal and performs noise filtering on the indication signal to generate a processed indication signal. The delay device is coupled to the front-end signal processor and is configured to delay the processed indication signal to generate a delayed indication signal. The signal sampler is coupled to the front-end signal processor and the delay device and is configured to sample the processed indication signal based on the delayed indication signal to generate a detection result.

[0006] One embodiment of the present invention discloses an intrusion detection method for an intrusion detection device, comprising: generating an indication signal based on the power-on status of the intrusion detection device; performing a noise filtering operation on the indication signal to generate a processed indication signal; delaying the processed indication signal to generate a delayed indication signal; sampling the processed indication signal based on the delayed indication signal; and generating a detection result.

[0007] Based on the above, the intrusion detection device of the present invention generates an indication signal based on the status of the detection status detector. Through noise filtering and delaying, the signal sampler samples the delayed indication signal and processes it to generate a detection result. In this way, the intrusion detection device of the present invention can perform intrusion detection operations using a small number of circuit components without waking up the system controller. Furthermore, since the intrusion detection device can operate under low power conditions, the reliable generation of detection results can be guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 A schematic diagram of an intrusion detection device according to an embodiment of the present invention is shown.

[0009] Figure 2A FIG. 1 is a circuit diagram of a front-end signal processor of an intrusion detection device according to an embodiment of the present invention.

[0010] Figure 2B A schematic diagram of a delay device of an intrusion detection device according to an embodiment of the present invention is shown.

[0011] Figure 2C FIG. 4 is a diagram showing a signal waveform generated by an intrusion detection device according to an embodiment of the present invention.

[0012] Figure 2D FIG. 1 is a schematic diagram illustrating a voltage threshold setting operation of a delay device in an intrusion detection device according to an embodiment of the present invention.

[0013] Figure 3 A schematic diagram of an intrusion detection device according to an embodiment of the present invention is shown.

[0014] Figure 4 FIG. 1 is a schematic diagram illustrating an implementation of a signal sampler in an intrusion detection device according to an embodiment of the present invention.

[0015] Figure 5 FIG. 4 is a signal waveform diagram of an intrusion detection device according to an embodiment of the present invention.

[0016] Figure 6 A flowchart of an intrusion detection method according to an embodiment of the present invention is shown.

[0017] The description of the accompanying drawings is as follows:

[0018] 100, 300: Intrusion detection device

[0019] 110, 201, 310: Front-end signal processor

[0020] 120, 202, 320: Delay

[0021] 130, 330, 400: Signal samplers

[0022] 210: Filter

[0023] 220: Buffer

[0024] 340: Power isolator

[0025] 350: Baseboard Management Controller

[0026] BAT: Battery

[0027] BOX: chassis

[0028] C1: capacitor

[0029] CLK: clock terminal

[0030] CLR: Cleanup Side

[0031] CSA, CSB: Clear signal

[0032] D: Data terminal

[0033] DFF: D-type flip-flop

[0034] DINT: Delayed indication signal

[0035] DOUT: Detection output signal

[0036] DR; detection results

[0037] DSET: Delay set value

[0038] INT: indication signal

[0039] N1, N2: noise

[0040] PINT: Processed indication signal

[0041] Q: Output

[0042] R1: resistor

[0043] S610-S640: Intrusion Detection Steps

[0044] SW: Status Detector

[0045] SWA: Transistor Switch

[0046] t1~t4: time points

[0047] tDLY: time delay

[0048] tLA, tRLA: time interval

[0049] tR: reaction time

[0050] V1, V2: power supply

[0051] VSET: threshold voltage setting information

[0052] VSS: reference ground voltage

[0053] VTH1: rising threshold voltage

[0054] VTH2: Falling threshold voltage DETAILED DESCRIPTION

[0055] Please refer to Figure 1 , Figure 1 A schematic diagram of an intrusion detection device according to an embodiment of the present invention is shown. The intrusion detection device 100 is applicable to an electronic device (not shown). The intrusion detection device 100 includes a status detector SW, a front-end signal processor 110, a delay 120, and a signal sampler 130. The status detector SW includes a switch, a signal detector, a distance detector, or a light sensor. For example, the status detector SW can be a switch and is disposed on a case BOX of the electronic device. The status detector SW can generate an indication signal INT based on the opening state of the case BOX or the opening state of the status detector SW itself. The indication signal INT is used to indicate whether the case BOX is forcibly opened. Alternatively, the aforementioned activated state may be generated in response to the electronic device or intrusion detection device 100 being moved. Specifically, the state detector SW may generate the indication signal INT based on a change in distance when the electronic device or intrusion detection device 100 is moved. Alternatively, the state detector SW may generate the indication signal INT based on a change in light intensity when the electronic device or intrusion detection device 100 is moved. The front-end signal processor 110 is coupled to the state detector SW. The front-end signal processor 110 receives the indication signal INT. The front-end signal processor 110 performs noise filtering on the indication signal INT to generate a processed indication signal PINT. The delayer 120 is coupled to the front-end signal processor 110. The delayer 120 is configured to delay the processed indication signal PINT to generate a delayed indication signal DINT. Furthermore, the signal sampler 130 is coupled to the front-end signal processor 110 and the delayer 120. The signal sampler 130 samples the processed indication signal PINT based on the delayed indication signal DINT to generate a detection result DR.

[0056] In detail, the state detector SW, front-end signal processor 110, delay unit 120, and signal sampler 130 of the present embodiment receive power V1 supplied by a battery BAT as their operating power source. When the case BOX is forcibly opened, the state detector SW can be turned on or off, and accordingly, an indication signal INT is generated. In one embodiment, the indication signal INT can initially be a first logic value. When the case BOX is forcibly opened, the state detector SW can change the indication signal INT to a second logic value, where the first logic value and the second logic value are different.

[0057] Because the state detector SW switches and generates bounce, the generated indication signal INT may experience voltage instability. The front-end signal processor 110 receives the indication signal INT and performs noise filtering on the indication signal INT to generate a processed indication signal PINT. Specifically, the front-end signal processor 110 performs a debounce operation on the indication signal INT to perform noise filtering on the indication signal INT.

[0058] Furthermore, delayer 120 is configured to delay processed indication signal PINT to generate delayed indication signal DINT. Delayer 120 can delay processed indication signal PINT based on a delay setting value. The delay setting value can be fixed or variable. The delaying operation of delayer 120 can create a certain phase difference between processed indication signal PINT and delayed indication signal DINT, i.e., the processed indication signal PINT and delayed indication signal DINT have different phases.

[0059] In one embodiment, both the delayer 120 and the signal sampler 130 receive the processed indication signal PIN generated by the front-end signal processor 110. The signal sampler 130 can further sample the processed indication signal PINT based on the delayed indication signal DINT to generate the detection result DR. Because the delayed indication signal DINT lags behind the processed indication signal PINT in phase, sampling the processed indication signal PINT using the delayed indication signal DINT avoids sampling portions of the processed indication signal PINT where the voltage is unstable. Therefore, the signal sampler 130 can accurately generate the correct detection result DR.

[0060] Note that the bounce conditions generated by each electronic component in the state detector SW may vary. Therefore, the signal delay effect generated by the delay element 120 in this embodiment of the present invention is adjustable. By dynamically adjusting the delay between the delayed indication signal DINT and the processed indication signal PINT, the delay element 120 can reduce the probability of errors in the detection result DR generated by the signal sampler 130 due to noise (including noise generated by the bounce phenomenon in the state detector SW), thereby improving the accuracy of the detection result DR.

[0061] Incidentally, in one embodiment, the intrusion detection device 100 only needs to be powered by the battery BAT, completing the intrusion detection operation under the premise of low power consumption, and the signal sampler 130 can latch the status of the detection result DR. At this time, the basic input and output system (BIOS) or baseboard management controller of the platform path controller of the electronic device is not booted. Then, after the firmware of the electronic device is booted, for example, the basic input and output system of the platform path controller of the electronic device can be effectively provided to the electronic device for reading, and the detection event will not be lost due to the lack of power to the electronic device.

[0062] In one embodiment, the battery BAT can be a rechargeable battery to maintain the long-term operation of the intrusion detection device 100. In addition, the battery BAT can be a battery from the intrusion detection device 100 itself, a battery from a platform path controller or baseboard management controller of an electronic device, or a backup power source.

[0063] Please refer to the following Figure 2A , Figure 2A The following is a circuit diagram of a front-end signal processor of an intrusion detection device according to an embodiment of the present invention. The front-end signal processor 201 includes a filter 210 and a buffer 220. Filter 210, which may be a low-pass filter, includes a resistor R1 and a capacitor C1. A first end of resistor R1 receives an indication signal INT, and a second end of resistor R1 is coupled to a first end of capacitor C1. A second end of capacitor C1 receives a reference ground voltage VSS. Filter 210 filters the indication signal INT and transmits the filtered output signal to buffer 220.

[0064] The buffer 220 is coupled to the output terminal of the filter 210. The buffer 220 generates the processed indication signal PINT according to the output signal of the filter 210. In one embodiment, the buffer 220 receives a power source V1 as an operating power source, wherein the power source V1 may come from, for example, Figure 1The buffer 220 can shape the output signal of the filter 210 and generate a square wave processed indication signal PINT. To further reduce noise in the processed indication signal PINT, the buffer 220 can be implemented using a Schmitt trigger, but is not limited thereto.

[0065] Please refer to the following Figure 2B , Figure 2B A schematic diagram illustrates a delay device in an intrusion detection device according to an embodiment of the present invention. Delay device 202 receives the processed indication signal PINT, a delay setting value DSET, and threshold voltage setting information VSET. In one embodiment, delay device 202 delays the processed indication signal PINT according to the delay setting value DSET to generate a delayed indication signal DINT. Delay device 202 also sets a rising threshold voltage and a falling threshold voltage based on the threshold voltage setting information VSET. Delay device 202 compares the processed indication signal PINT with the rising threshold voltage and the falling threshold voltage to generate the delayed indication signal DINT.

[0066] In one embodiment, the delay setting value DSET and the threshold voltage setting information VSET may both be programmable information and do not necessarily have to be fixed values.

[0067] Please refer to the following Figure 2A 、 Figure 2B as well as Figure 2C ,in Figure 2C FIG. 1 is a diagram showing a signal waveform generated by an intrusion detection device according to an embodiment of the present invention. Figure 2C In the embodiment of the present invention, at time t1, the chassis of the electronic device is opened. The status detector SW causes the indication signal INT to be pulled high to a first logic value (e.g., logic 1) starting at time t1. At time t2, the chassis of the electronic device is closed. The status detector SW causes the indication signal INT to be pulled low to a second logic value (e.g., logic 0) starting at time t2.

[0068] The filter 210 and the buffer 220 in the front-end signal processor 201 perform filtering and shaping operations on the indication signal INT, respectively, and generate a processed indication signal PINT. The phase of the processed indication signal PINT is delayed compared to the phase of the indication signal INT.

[0069] On the other hand, the delay device 202 sets the time delay tDLY, the rising threshold voltage VTH1, and the falling threshold voltage VTH2 based on the delay setting value DSET and the threshold voltage setting information VSET. The delay device 202 delays the processed indication signal PINT by the time delay tDLY and processes the processed indication signal PINT based on the rising threshold voltage VTH1 and the falling threshold voltage VTH2 to generate the delayed indication signal DINT. In one embodiment, the time delay tDLY may be, for example, 100 milliseconds to 350 milliseconds, but is not limited thereto.

[0070] The details of the operation of setting the rising threshold voltage VTH1 and the falling threshold voltage VTH2 can be found in Figure 2D The diagram shows a schematic diagram of the voltage threshold setting operation of the delay device in the intrusion detection device according to an embodiment of the present invention. Figure 2D In the example, the processed indication signal PINT may also carry a certain degree of noise N1 and N2. Noise N1 is distributed in the portion of the processed indication signal PINT where it is at logic 0, while noise N2 is distributed in the portion of the processed indication signal PINT where it is at logic 1. In other words, noise N2 is higher than noise N1. To filter out noise N1 and N2, in one embodiment, the falling threshold voltage VTH2 is set to a voltage distribution range higher than the noise N1, and the rising threshold voltage VTH1 is set to a voltage distribution range lower than the noise N2. This ensures that the delayed indication signal DINT generated by the delay circuit 230 is not affected by noise N1 and N2 and maintains a correct logic value.

[0071] Please refer to the following Figure 3 , Figure 3 A schematic diagram of an intrusion detection device according to an embodiment of the present invention is shown. Intrusion detection device 300 is applicable to an electronic device. Intrusion detection device 300 includes a status detector SW, a front-end signal processor 310, a delay 320, a signal sampler 330, and a power isolator 340. Power isolator 340 can be coupled to a baseboard management controller 350 in the electronic device.

[0072] In one embodiment, the status detector SW can generate an indication signal INT based on the opening status of the chassis BOX. The indication signal INT is used to indicate whether the chassis BOX is forcibly opened. The front-end signal processor 310 is coupled to the status detector SW. The front-end signal processor 310 receives the indication signal INT. The front-end signal processor 310 performs a noise filtering operation on the indication signal INT to generate a processed indication signal PINT. The delayer 320 is coupled to the front-end signal processor 310. The delayer 320 is used to delay the processed indication signal PINT to generate a delayed indication signal DINT. In addition, the signal sampler 330 is coupled to the front-end signal processor 310 and the delayer 320. The signal sampler 330 samples the processed indication signal PINT based on the delayed indication signal DINT to generate a detection result DR.

[0073] The power isolator 340 is coupled between the signal sampler 330 and the baseboard management controller 350. In one embodiment, the power isolator 340 receives power sources V1 and V2 and has two corresponding sides. The first side of the power isolator 340 is coupled to the signal sampler 330, and the second side of the power isolator 340 is coupled to the baseboard management controller 350. The power isolator 340 receives a detection result DR based on the power source V1 and generates a detection output signal DOUT based on the power source V2 according to the detection result DR. The power isolator 340 provides the detection output signal DOUT to the baseboard management controller 350, and the baseboard management controller 350 performs operations based on the power source V2.

[0074] In one embodiment, the power source V1 may be provided by Figure 1 In this embodiment, the power supply can be provided by the battery BAT. Power supply V2 can serve as the standby power supply for the electronic device. Power isolator 340 can isolate the power supply via a built-in transistor switch SWA, where the transistor switch SWA can be controlled by power supply V2 to perform its operation. Of course, in other embodiments of the present invention, power isolator 340 can also utilize other components to achieve power isolation, such as an optocoupler. However, any power isolation circuit known to those skilled in the art can be used to implement power isolator 340 of the present invention, without limitation.

[0075] In one embodiment, when a tampering event occurs, the signal sampler 330 can temporarily store the generated detection result DR. At this time, the baseboard management controller 350 of the electronic device does not need to be activated, and the detection result DR will not disappear. After the baseboard management controller 350 is activated, the signal sampler 330 can provide the generated detection result DR to the baseboard management controller 350 via the power isolator 340, allowing the baseboard management controller 350 to detect the tampering of the electronic device. Correspondingly, in one embodiment, the baseboard management controller 350 can transmit a clear signal CSA, which in turn transmits a clear signal CSB to the signal sampler 330 via the power isolator 340 to clear the detection result DR.

[0076] Please refer to Figure 4 , Figure 4 A schematic diagram illustrates an implementation of a signal sampler in an intrusion detection device according to an embodiment of the present invention. The signal sampler 400 is a D-type flip-flop DFF. The data terminal D of the D-type flip-flop DFF is configured to receive the processed indication signal PINT. The clock terminal CLK of the D-type flip-flop DFF receives the delayed indication signal DINT. The output terminal Q of the D-type flip-flop DFF generates a detection result DR. Furthermore, the D-type flip-flop DFF has a clear terminal CLR. The clear terminal CLR of the D-type flip-flop DFF is configured to receive a clear signal CSB. The D-type flip-flop DFF clears the detection result DR generated at its output terminal Q in response to the clear signal CSB.

[0077] Please refer to the following Figure 5 , Figure 5 Illustrate the present invention Figure 3 Signal waveforms of an intrusion detection device 300 according to an embodiment. The signal sampler 330 receives a processed indication signal PINT and a delayed indication signal DINT that is delayed by a time delay tDLY from the processed indication signal PINT. The signal sampler 330 samples the processed indication signal PINT based on the rising edge of the delayed indication signal DINT and, after a response time tR, generates a detection result DR of logic 1. The detection result DR of logic 1 remains latched during a time interval tLA. After the firmware of the baseboard management controller 350 is activated, the baseboard management controller 350 reads the detection result DR and sends a clear signal CSA of logic 0 at time t3. The signal sampler 330 clears the detection result DR to logic 0 at time t4 based on the clear signal CSA of logic 0. The latch of the signal sampler 330 is released during a time interval tRLA following time t4.

[0078] It is worth noting that in this embodiment of the present invention, the logical values ​​displayed by the processed indication signal PINT, the delayed indication signal DINT, and the detection result DR when an intrusion event occurs can be set by the designer. The diagrams in this embodiment of the present invention are merely illustrative and are not intended to limit the scope of the present invention. Similarly, whether signal sampler 330 performs a clearing operation based on whether clear signal CSA is a logic 0 or a logic 1 can also be set by the designer without any specific limitations.

[0079] Please refer to the following Figure 6 , Figure 6 A flowchart of an intrusion detection method according to one embodiment of the present invention is shown. In step S610, an indication signal is generated based on the activation status of the intrusion detection device. In step S620, noise is filtered out of the indication signal to generate a processed indication signal. Furthermore, in step S630, the processed indication signal is delayed to generate a delayed indication signal. In step S640, the processed indication signal is sampled based on the delayed indication signal to generate a detection result.

[0080] The implementation details of the above steps have been described in detail in the aforementioned multiple embodiments and implementation methods, and will not be repeated here.

[0081] In summary, the intrusion detection device of the present invention requires only a small amount of power and performs intrusion detection on electronic devices without requiring the system controller to be activated. Furthermore, the intrusion detection system of the present invention implements rigorous debounce of the indication signal generated by the status detector of the intrusion detection mechanism. The detection result is generated and latched by a signal sampler. This ensures the accurate generation of the detection result and its effective reading by the electronic device, preventing misidentification or omission of intrusion events and effectively enhancing system security.

Claims

1. An intrusion detection device, comprising: a state detector for generating an indication signal according to an activated state; a front-end signal processor coupled to the status detector, configured to receive the indication signal and perform a noise filtering operation on the indication signal to generate a processed indication signal; a delayer coupled to the front-end signal processor, for delaying the processed indication signal to generate a delayed indication signal; as well as a signal sampler coupled to the front-end signal processor and the delayer, for sampling the processed indication signal according to the delayed indication signal to generate a detection result; The delayer is used to delay the processed indication signal according to a delay setting value to generate the delayed indication signal, wherein the delay setting value is a programmable value. The delayer is further used to set a rising threshold voltage and a falling threshold voltage according to a threshold voltage setting information. The delayer compares the processed indication signal with the rising threshold voltage and the falling threshold voltage to generate the delayed indication signal.

2. The intrusion detection device as claimed in claim 1, used in an electronic device, wherein the status detector is disposed on a chassis of the electronic device, and is used to generate the indication signal according to the opened state of the chassis.

3. The intrusion detection device as claimed in claim 1 , wherein the front-end signal processor comprises: a filter coupled to the status detector and configured to perform a filtering operation on the indication signal; as well as A buffer is coupled to an output terminal of the filter and is used to generate the processed indication signal according to an output signal of the filter. 4 . The intrusion detection device as claimed in claim 3 , wherein the buffer is a Schmitt trigger. 5 . The intrusion detection device as claimed in claim 1 , wherein the threshold voltage setting information is programmable information.

6. The intrusion detection device as claimed in claim 1 , wherein the signal sampler is a D-type flip-flop, a data terminal of the D-type flip-flop is used to receive the processed indication signal, a clock terminal of the D-type flip-flop is used to receive the delayed indication signal, and an output terminal of the D-type flip-flop is used to generate the detection result.

7. The intrusion detection device according to claim 6, further comprising: A power isolator has a first side and a second side, wherein the first side is coupled to the signal sampler and the second side is coupled to a baseboard management controller. The power isolator receives the detection result based on a first power source, generates a detection output signal based on a second power source according to the detection result, and provides the detection output signal to the baseboard management controller. 8 . The intrusion detection device as claimed in claim 7 , wherein the baseboard management controller transmits a clear signal to a clear terminal of the D-type flip-flop through the power isolator to clear the detection result.

9. An intrusion detection method, used in an intrusion detection device, comprising: generating an indication signal according to an activated state of the intrusion detection device; performing a noise filtering operation on the indication signal to generate a processed indication signal; delaying the processed indication signal to generate a delayed indication signal; sampling the processed indication signal according to the delayed indication signal; as well as Generate a detection result, The step of delaying the processed indication signal to generate the delayed indication signal comprises: delaying the processed indication signal according to a delay setting value; and Generate the delayed indication signal, wherein the delay setting value is a programmable value, The step of delaying the processed indication signal to generate the delayed indication signal further comprises: Setting a rising threshold voltage and a falling threshold voltage according to a threshold voltage setting information; and The processed indication signal is compared with the rising threshold voltage and the falling threshold voltage to generate the delayed indication signal.

10. The intrusion detection method as claimed in claim 9, wherein the step of performing noise filtering on the indication signal to generate the processed indication signal comprises: performing a filtering action on the indication signal; as well as The processed indication signal is generated according to an output signal.

11. The intrusion detection method as claimed in claim 9, wherein the threshold voltage setting information is programmable information.

12. The intrusion detection method according to claim 9, further comprising: receiving the detection result based on a first power source, and generating a detection output signal based on a second power source according to the detection result; as well as The detection output signal is provided.

13. The intrusion detection method according to claim 9, further comprising: A clear signal is provided to clear the detection result.

Images