Passive probe chip detection by monitoring induced magnetic field against dynamic electromagnetic interference

Abstract

Embodiments for passive denseness chip detection through polarizability and advanced pattern recognition are described. For example, one method includes: inducing a magnetic field in a passive component of a target system while the target system is emitting EMI having amplitude variations repeating at a time interval; generating a time series of measurements of the induced magnetic field and the combined magnetic field strength of the EMI; performing a frequency domain to time domain transform on the time series of measurements to create a time series signal of a combined magnetic field strength over time within a specific frequency range; monitoring the time series signal using an ML model trained to predict the correct signal value to determine whether the predicted value and the measured value of the time series are consistent; and indicating that the target device may contain a passive detection chip in the event that the abnormality is detected, and indicating that the target device does not contain a passive detection chip in the event that the abnormality is not detected.

Description

Background Art

[0001] There are currently significant security concerns throughout the enterprise computing industry surrounding spy chips in electronic systems. A spy chip is a device that can be surreptitiously incorporated into an electronic system to modify software or firmware, exfiltrate data, or perform other malicious activities. Electromagnetic interference (EMI) fingerprinting techniques—that is, techniques that identify component configurations of electronic devices based on the unique electromagnetic signals emitted by a particular configuration during operation—have been developed to detect the presence of spy chips and counterfeit components that are actively "on" and emitting EMI frequencies. However, spy chips may not always be actively on. Instead, a spy chip may be "off" most of the time when the electronic system is active, and briefly "on" to perform malicious activities before returning to the "off" state. Such passive spy chips may not be detected in EMI fingerprinting scans that run over a few minutes.

[0002] What is needed is a detection method that can detect the presence (or prove the absence) of a passive spy chip in an electronic system without continuous EMI emissions from the spy chip. Summary of the invention

[0003] In one embodiment, a method for detecting a passive spy chip in a target electronic system comprises: inducing a magnetic field in a passive component of the target electronic system when the target electronic system is emitting electromagnetic interference having amplitude variations that repeat at time intervals; generating a time series of measurement results of the combined magnetic field strength of the induced magnetic field and the electromagnetic interference within a frequency spectrum and a time period; performing a frequency domain to time domain transform on the time series of measurement results to create a set of time series signals describing the combined magnetic field strength over time within a specific frequency range; monitoring the time series signals using a machine learning model that is trained to predict correct signal values ​​for devices constructed the same as the target electronic device to determine whether there are abnormal measurement signal values ​​in the time series signals; and presenting a message that (i) indicates that the target device may contain a passive spy chip if there are abnormal measurement signal values ​​in the time series signals, and (ii) indicates that the target device does not have a passive spy chip if there are no abnormal measurement signal values ​​in the time series signals.

[0004] In one embodiment, the method further comprises: placing a transmitting coil adjacent to the target electronic system, wherein inducing a magnetic field in a passive component further comprises injecting eddy currents having one or more specified magnetizing frequencies into the transmitting coil via a radio transmitter; and placing a receiving coil adjacent to the target electronic system, wherein generating the time series of measurements further comprises detecting the combined magnetic field strength via the receiving coil via a radio receiver; wherein the target electronic system is executing a waveform workload such that the target electronic system emits the electromagnetic interference, and wherein the time interval is a period of the waveform workload.

[0005] In one embodiment, the method further includes: inducing a second magnetic field in a passive component of the target golden system when it is verified that the target golden system without a passive spy chip is emitting electromagnetic interference; generating a golden time series of measurement results of the combined magnetic field strength of the induced second magnetic field and the electromagnetic interference within the spectrum and the time period; performing a frequency domain to time domain transform on the golden time series of measurement results to create a set of golden time series signals describing the combined magnetic field strength of the golden system over time within a specific frequency range; and training the machine learning model using the golden time series signals.

[0006] In one embodiment, the method, wherein performing the frequency domain to time domain transformation further comprises selecting a frequency having a highest peak value within the specific frequency range as a time series signal describing the combined magnetic field strength over time within the specific frequency range.

[0007] In one embodiment, the method, wherein the machine learning model is a multivariable state estimation technique model.

[0008] In one embodiment, a computing system for detecting a passive spy chip in a target electronic system includes: a processor; a memory operably connected to the processor; a radio transmitter operably connected to the processor and the memory; a radio receiver operably connected to the processor and the memory; a non-transitory computer-readable medium operably connected to the processor and the memory and storing computer-executable instructions, wherein the computer-executable instructions, when executed by at least the processor, cause the computing system to: when the target electronic system is emitting electromagnetic interference having an amplitude variation that repeats at time intervals, use the radio transmitter to induce a magnetic field in a passive component of the target electronic system; use the radio receiver to acquire the induced magnetic field and A method of providing a method for providing a plurality of electronic devices having a plurality of electromagnetic interference signals, comprising: providing a plurality of electromagnetic interference signals having a plurality of electromagnetic interference signals, and providing a plurality of electromagnetic interference signals having a plurality of electromagnetic interference signals. The method comprises: providing a plurality of electromagnetic interference signals having a plurality of electromagnetic interference signals, and a plurality of electromagnetic interference signals having a plurality of electromagnetic interference signals. The method comprises: providing a plurality of electromagnetic interference signals having a plurality of electromagnetic interference signals, and a plurality of electromagnetic interference signals having a plurality of electromagnetic interference signals. The method comprises: providing a plurality of electromagnetic interference signals having a plurality of electromagnetic interference signals, and a plurality of electromagnetic interference signals having a plurality of electromagnetic interference signals.

[0009] In one embodiment, the computing system further comprises: a transmitting coil connected as a transmitting antenna of the radio transmitter and configured to be placed adjacent to the target electronic system, wherein the instructions for inducing a magnetic field in a passive component further comprise instructions for causing the computing system, when executed, to add eddy currents having one or more specified magnetizing frequencies to the transmitting coil via the radio transmitter; and a receiving coil connected as a receiving antenna of the radio receiver and configured to be placed adjacent to the target electronic system, wherein the instructions for acquiring the time series of the measurement results further comprise instructions for causing the computing system, when executed, to detect the combined magnetic field strength via the receiving coil via the radio receiver; wherein the target electronic system executes a waveform workload to cause the target electronic system to emit the electromagnetic interference, and wherein the time interval is a period of the waveform workload.

[0010] In one embodiment, the computing system, wherein the instructions further cause the processor to: induce a second magnetic field in a passive component of the target golden system when it is verified that no passive spy chip is emitting electromagnetic interference; generate a golden time series of measurement results of the combined magnetic field strength of the induced second magnetic field and the electromagnetic interference within the frequency spectrum and the time period; perform a frequency domain to time domain transform on the golden time series of measurement results to create a set of golden time series signals describing the combined magnetic field strength of the golden system over time within a specific frequency range; and train the machine learning model using the golden time series signals.

[0011] In one embodiment, the computing system, wherein the instructions for performing frequency domain to time domain transformation further include instructions for causing the processor to select a frequency having a highest peak value within the specific frequency range as a time series signal describing the combined magnetic field strength over time within the specific frequency range.

[0012] In one embodiment, the computing system wherein the machine learning model is a non-linear, non-parametric regression model.

[0013] In one embodiment, a non-transitory computer-readable medium includes computer-executable instructions stored thereon for detecting a passive spy chip in a target electronic system, the computer-executable instructions, when executed by at least one processor of a computer, cause the computer to: induce a magnetic field in a passive component of the target electronic system when the target electronic system is emitting electromagnetic interference having amplitude variations that repeat at time intervals; generate a time series of measurement results of the combined magnetic field strength of the induced magnetic field and the electromagnetic interference within a frequency spectrum and a time period; perform a frequency domain to time domain transform on the time series of measurement results to create a set of time series signals describing the combined magnetic field strength over time within a specific frequency range; monitor the time series signals using a machine learning model that is trained to predict correct signal values ​​for devices with the same construction as the target electronic device to determine whether there are abnormal measurement signal values ​​in the time series signals; and present a message that (i) indicates that the target device may contain a passive spy chip if there are abnormal measurement signal values ​​in the time series signals, and (ii) indicates that the target device does not have a passive spy chip if there are no abnormal measurement signal values ​​in the time series signals.

[0014] In one embodiment, the non-transitory computer-readable medium, wherein the instructions for inducing a magnetic field in a passive component further cause the computer to add eddy currents having one or more specified magnetizing frequencies to a transmitting coil via a radio transmitter, wherein the instructions for generating a time series of the measurement results further cause the computer to detect the combined magnetic field strength via a receiving coil by a radio receiver; wherein the target electronic system is executing a waveform workload so that the target electronic system emits the electromagnetic interference, and wherein the time interval is a period of the waveform workload.

[0015] In one embodiment, the non-transitory computer-readable medium, wherein the instructions further cause the computer to: induce a second magnetic field in a passive component of the target gold system when it is verified that no passive spy chip is emitting electromagnetic interference; generate a golden time series of measurement results of the combined magnetic field strength of the induced second magnetic field and the electromagnetic interference within the frequency spectrum and the time period; perform a frequency domain to time domain transform on the golden time series of measurement results to create a set of golden time series signals describing the combined magnetic field strength of the gold system over time within a specific frequency range; and train the machine learning model using the golden time series signals.

[0016] In one embodiment, the non-transitory computer readable medium, wherein the instructions for performing frequency domain to time domain transformation further cause the computer to select a frequency having a highest peak value within the specific frequency range as a time series signal describing the combined magnetic field strength over time within the specific frequency range.

[0017] In one embodiment, the non-transitory computer readable medium, wherein the machine learning model is a multivariable state estimation technology model or is implemented as a nonlinear, non-parametric regression algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings that are incorporated into the specification and constitute a part of the specification illustrate various systems, methods and other embodiments of the present disclosure. It should be appreciated that the element boundaries (e.g., boxes, groups of boxes or other shapes) illustrated in the figure represent an embodiment of boundaries. In some embodiments, an element can be implemented as multiple elements, or multiple elements can be implemented as one element. In some embodiments, an element represented as an internal component of another element can be implemented as an external component, and vice versa. In addition, each element may not be drawn to scale.

[0019] Figure 1 An embodiment of a system associated with passive spy chip detection through polarizability and advanced pattern recognition is illustrated.

[0020] Figure 2AIllustrated is one embodiment of an inferred magnetic sensor associated with passive spy chip detection through polarizability and advanced pattern recognition applied in a basic detection scenario of scanning empty space.

[0021] Figure 2B Illustrated is one embodiment of an inferred magnetic sensor associated with passive spy chip detection through polarizability and advanced pattern recognition applied in a detection scenario of scanning an empty silicon box.

[0022] Figure 2C Illustrated is one embodiment of an inferred magnetic sensor associated with passive spy chip detection through polarizability and advanced pattern recognition applied in an inspection scenario of scanning a silicon box encapsulating a copper core block.

[0023] Figure 2D Illustrated is one embodiment of an inferential magnetic sensor associated with passive spy chip detection through polarizability and advanced pattern recognition applied in a scanning copper core block inspection scenario.

[0024] Figure 2E Illustrated is one embodiment of an inferential magnetic sensor associated with passive spy chip detection through polarizability and advanced pattern recognition applied in a detection scenario of scanning copper core blocks and passive spy chips.

[0025] Figure 2F Illustrated is one embodiment of an inferred magnetic sensor associated with passive spy chip detection through polarizability and advanced pattern recognition applied in an inspection scenario of scanning a silicon box encapsulating a copper core block and a passive spy chip.

[0026] Figure 3 Illustrated in reference to one embodiment of passive spy chip detection by polarizability and advanced pattern recognition Figure 2A to Figure 2F Example bar graphs of detected magnetic field strength for each detection scenario shown and described.

[0027] Figure 4A Illustrated is an example 3D surface mapping between time, measurement frequency, and polarizability response (magnetic field measurements) for a golden server that is proven to not include a spy chip, associated with one embodiment of passive spy chip detection through polarizability and advanced pattern recognition.

[0028] Figure 4B Illustrated is an example 3D surface mapping between time, measurement frequency, and polarizability response (magnetic field measurements) for a compromised server including a spy chip, in association with one embodiment of passive spy chip detection through polarizability and advanced pattern recognition.

[0029] Figure 5One embodiment of a method associated with passive snoop chip detection through polarizability and advanced pattern recognition is illustrated.

[0030] Figure 6 An embodiment of a computing system that may be configured with the disclosed example systems and / or methods is illustrated. DETAILED DESCRIPTION

[0031] Described herein are systems, methods, and other embodiments that provide for passive spy chip detection by monitoring induced magnetic fields against dynamic electromagnetic interference. Passive spy chip detection of the systems, methods, and other embodiments may be accomplished through polarizability and advanced pattern recognition. The embodiments described herein enable non-invasive determination that an electronic device, such as a server computing device or a firewall device, (i) does not have a passive spy chip, or (ii) includes one or more passive spy chips. The embodiments described herein further enable this determination to be made in near real time.

[0032] EMI signals are generated by electronic devices such as computers, servers, routers, switches, and firewalls during operation. These EMI signals are often viewed as noise, but these EMI signals can also carry information that can be used to generate a unique EMI fingerprint for an electronic device. For example, an electronic device with a specific component configuration can be operated according to a test sequence (deterministic stress load), and the emission spectrum emitted by the electronic device can be scanned to generate an EMI fingerprint for the electronic device. In the case where the electronic device has a known configuration that has been verified to have no spy chips or counterfeit components - also known as a "golden system" - the generated EMI fingerprint can be used as a reference fingerprint for the electronic device. Other electronic devices that are believed to have the same configuration as the golden system running the same test sequence can be scanned in a similar manner to create an EMI fingerprint for the other device. This EMI fingerprint of the other device can be compared to the reference fingerprint to confirm that the other electronic device has or does not have the same configuration as the golden system. Electronic devices that do not have the same configuration may contain one or more spy chips or counterfeit components. In addition, electronic devices known to have a specific spy chip can be similarly scanned to generate a reference fingerprint for that specific configuration of a damaged electronic device, allowing direct matching against a database of known spy chip damaged configurations. Generally speaking, it works best to scan the emission spectrum of a suspect system while it is running a deterministic stress load and compare the emission spectrum to the emission spectrum of a real, uncompromised system running the same deterministic stress load. This type of EMI fingerprinting operation is the best solution for use cases where the counterfeit component or spy chip is always actively emitting EMI. EMI fingerprinting is able to detect almost all types of active spy chip (or counterfeit component) scenarios where the spy chip or other suspect electronic component is actively working during the test sequence, but there is a risk of failure if the spy chip is not emitting any EMI when scanned.

[0033] There is a small class of spy chips – passive spy chips – that remain off or inactive most of the time (99% or more of the time), turn on or activate briefly to perform malicious activity, and then return to an inactive off state. When inactive, these passive spy chips do not emit any EMI at all. The rare but real challenge posed by these passive spy chips is that they may not be detected by previous EMI fingerprinting solutions. This is especially true in situations where an EMI fingerprinting scan of an electronic device lasts about 10 minutes (during which the passive spy chip may not be active).

[0034] The systems and methods described herein for passive spy chip detection by polarizability and advanced pattern recognition are not proposed for the detection of actively emitting spy chips and other counterfeit components. These active components can be satisfactorily detected by other EMI fingerprinting techniques. Instead, the systems and methods described herein for passive spy chip detection by polarizability and advanced pattern recognition effectively and accurately detect passive spy chips in electronic devices by using the polarizability phenomenon to drive the response from the passive spy chip. This improves the identification capability of EMI fingerprinting by enabling the detection of the presence (or proof of the absence) of any unexpected electronic component (with any metal component inside) without the need for a continuous emission EMI spectrum from the unexpected electronic component. The technology for passive spy chip detection by polarizability and advanced pattern recognition is a robust, non-invasive, non-destructive method for detecting small objects (such as spy chips) that contain metal or are otherwise conductive within electronic devices. Thus, advantageously, the EMI fingerprinting systems and methods described herein for passive spy chip detection by polarizability and advanced pattern recognition can detect passive spy chips even when the passive spy chips are not actively transmitting or are turned off. This eliminates the small probability of missed alarms in EMI fingerprinting where rare passive spy chips are present but the passive spy chips are not turned on when scanned. The systems and methods described herein for passive spy chip detection by polarizability and advanced pattern recognition are applicable to all areas of computing hardware, thereby enabling passive spy chip detection in enterprise computing systems and networks, as well as in defense military electronic systems.

[0035] In another advantage, the EMI fingerprinting system and method described herein for passive spy chip detection by polarizability and advanced pattern recognition does not involve disassembling the device for visual or photographic inspection. Such disassembly may cause damage to the electronic device or otherwise impair the performance of the electronic device. In addition, in one embodiment, the EMI fingerprinting system and method described herein for passive spy chip detection by polarizability and advanced pattern recognition can provide a simple, concise "completely clear" decision, indicating that the target electronic device being scanned does not contain a passive spy chip, or generates an alarm, alert or warning that the target electronic device being scanned contains one or more passive spy chips. This makes the scanning procedure available to non-professionals who can understand the results without training in EMI radiation science, data science, machine learning or spy chip detection technology. In addition, in one embodiment, the EMI fingerprinting system and method described herein for passive spy chip detection by polarizability and advanced pattern recognition can detect and identify spy chips in an autonomous manner, allowing personnel involved in acceptance testing of electronic devices to quickly identify electronic devices containing spy chips, or prove that electronic devices do not have spy chips.

[0036] Any action or function described or claimed herein is not performed by the human brain. The interpretation that any action or function can be performed in the human brain is inconsistent and contrary to the present disclosure.

[0037] - Sample system for passive spy chip detection -

[0038] Figure 1 An embodiment of a system 100 associated with passive spy chip detection by utilizing advanced ML pattern recognition against induced magnetic fields (attributable to polarizability) for dynamic EMI monitoring is illustrated. Environment 100 includes an EMI fingerprinting service 105, a polarizability spy chip scanner 110, and an enterprise network 115, all interconnected by a communication network 120 (such as the Internet and a private network connected to the Internet).

[0039] In one embodiment, the EMI fingerprinting service 105 includes various component systems, such as a polarizability-based passive spy chip detection component 125, a web interface server 127, a data repository 129, and other EMI fingerprinting service components 131. Each of these component systems is configured with logic, such as through various software modules, for performing the functions they are described as performing. In one embodiment, the components of the EMI fingerprinting service 105 are implemented on one or more hardware computing devices or hosts interconnected by a data network or cloud network. For example, the components of the EMI fingerprinting service 105 can be executed by network-connected computing devices of one or more computing hardware shapes (such as a general-purpose central processing unit (CPU) shape, an intensive input / output (I / O) shape, a graphics processing unit (GPU) shape, a high-performance computing (HPC) shape, or other enterprise server hardware shape). In one embodiment, the components of the EMI fingerprinting service 105 are all implemented by dedicated computing devices. In one embodiment, several or all components of the EMI fingerprinting service 105 are implemented by a common (or shared) computing device, even in Figure 1 In one embodiment, the components of the EMI fingerprinting service 105 may be implemented across multiple computing devices.

[0040] In one embodiment, the polarizability-based passive spy chip detection component 125 of the EMI fingerprinting service 105 includes an advanced pattern recognition component 133 and a test sequence library 135. The advanced pattern recognition component 133 may include an ML predictive analysis module 137, a trained ML model library 139, an ML model training module 141, and a domain transformation module 142. In one embodiment, the advanced pattern recognition component 133 is configured to implement one or more nonlinear nonparametric (NLNP) regression algorithms for multivariate anomaly detection, including neural networks (NN), support vector machines (SVM), auto-associative kernel regression (AAKR), and similarity-based modeling (SBM), such as multivariate state estimation technology (MSET) (including Oracle's proprietary multivariate state estimation technology (MSET2)) (collectively referred to as "ML anomaly detection" algorithms). The ML model training module 141 is configured to train the ML anomaly detection algorithm to predict or estimate time series magnetic field values ​​based on measured time series magnetic field values ​​of the golden system electronic device, such as shown and described in further detail herein. The trained ML model library 139 is configured to accept the trained ML anomaly detection algorithms / models from the ML model training module 141 in order to store, store them, and provide them in response to the retrieval request of the ML prediction analysis module 137. In one embodiment, the ML prediction analysis module 137 is configured to execute the trained ML anomaly detection algorithm / model to generate an estimated time series magnetic field value based on the monitored time series magnetic field value of the unit under test. The ML prediction analysis module is also configured to then determine whether the monitored time series magnetic field value deviates abnormally from the predicted value, indicating the presence of a passive spy chip, for example as further shown and described in detail herein. In one embodiment, the MSET algorithm produces superior results compared to other ML anomaly detection algorithms.

[0041] In one embodiment, the EMI fingerprinting service 105 may be implemented as a service on a cloud infrastructure. In one embodiment, the EMI fingerprinting service 105 may be hosted by a dedicated third party, such as in an infrastructure as a service (IAAS), platform as a service (PAAS), or software as a service (SAAS) architecture. In one embodiment, the EMI fingerprinting service 105 may be implemented on an on-premise infrastructure such as a collection of one or more dedicated servers.

[0042] In one embodiment, the EMI fingerprinting service 105 may be hosted by a third party and / or operated by a third party for the benefit of multiple account owners / tenants, each of which operates a business and each of which has an associated enterprise network 115. In one embodiment, either the EMI fingerprinting service 105 and the enterprise network 115 may be associated with a discrete enterprise entity. In one embodiment, the EMI fingerprinting service 105 is configured with logic, such as a software module, to operate the EMI fingerprinting service 105 to detect passive spy chips through polarizability and advanced pattern recognition in accordance with the systems and methods described herein.

[0043] In one embodiment, the data repository 129 includes one or more databases (such as a time series database or a signal database) or other data structures configured to store and provide time series data representing one or more scans performed by the polarizability spy chip scanner 110. The time series data may consist of EMI amplitude values ​​sensed at fixed time intervals (or observations) in one or more frequency bins and stored in association with both the frequency bins and observations in which the values ​​were sensed. In one embodiment, the time series database is configured to store and provide time series data. In one embodiment, the data repository 129 may also include one or more relational databases that can be used to store the test sequence library 135 and the trained ML model library 139. In some example configurations, the data repository 129 may use one or more The API calls may include queries against a database. Depending on the type of target database in the data repository 129, the queries may be written in SQL and executed in a SQL runtime, or using other appropriate query languages ​​and environments, such as the Not Just SQL (NOSQL) query language and runtime specific to time series databases.

[0044] In one embodiment, the polarizability spy chip scanner 110 is a mobile device (such as mobile device 151) or a computer (such as computers 145, 147 and 149) coupled to a radio transceiver and an appropriate antenna. In one embodiment, the polarizability spy chip scanner 110 includes a polarizability-based passive spy chip scanning control component 155, a radio 157, a network interface 159, and other local computing components 161 such as a local storage device. The radio 157 also includes a transmitter 163 operably connected to a transmit antenna (Tx) 165 and a receiver 167 operably connected to a receive antenna (Rx) 169.

[0045] In one embodiment, the polarizability-based passive spy chip scanning control component 155 is configured to cause the polarizability-based passive spy chip scanner 110 to perform passive spy chip scanning by causing the transmitter 163 to transmit electromagnetic energy 171 at a specified frequency and monitoring the EMI 175 received by the receiver 167 from the target device 173 when the test sequence is performed by the target electronic device 173 (such as a unit under test (UUT) or a golden system), such as as shown and described in further detail herein. Therefore, when the target electronic system is transmitting a test sequence of dynamic electromagnetic interference (EMI) with a regular dynamic period, the spy chip scanner 110 induces a magnetic field in the passive components of the target electronic system. The emitted EMI is dynamic because its amplitude varies with time. The regular dynamic period is the time interval at which the amplitude variation pattern in the emitted EMI repeats. Based on the EMI 175 received by the receiver 167, the polarizability-based passive spy chip scanning control component 155 generates a time series of measurements of the combined magnetic field strength of the induced magnetic field from the passive component and the dynamic electromagnetic interference caused by the test sequence. The time series of measurements collects multiple observations across the values ​​on the spectrum sensed by the receiver 167 and over a period of time for testing or scanning. The target electronic device 173 can be any type of computing device, such as a server, personal computer, mobile device, firewall, router, switch or other computing device that may be easily inserted with a passive spy chip.

[0046] In one embodiment, the radio 157 is a radio transceiver (or a combined radio transmitter and receiver) that can simultaneously transmit and receive electromagnetic energy. In one embodiment, the radio 157 is a software defined radio (SDR) transceiver that includes a local oscillator (such as a crystal oscillator), a frequency synthesizer (such as a phase locked loop frequency synthesizer) that generates a frequency from multiple oscillations of the local oscillator, and other radio front-end hardware components. In one embodiment, the radio 157 is two discrete SDR units, one SDR unit configured to operate in a transmit mode and act as a transmitter 163, and one SDR unit configured to operate in a receive mode and act as a receiver 167. In one embodiment, the polarizability-based passive spy chip scanning control 155 is configured to generate a digital data stream and convert it to an analog signal for transmission by the radio 157 transmitter 163 as electromagnetic energy 171. In one embodiment, the polarizability-based passive spy chip scanning control 155 is configured to convert the analog EMI 175 collected by the radio 157 receiver 167 into a digital data stream for storage as time series data in a local storage device of the polarizability spy chip scanner 110 or in a data repository 129 of the EMI fingerprinting service 105. In one embodiment, the digital values ​​of the EMI 175 collected by the radio 157 receiver 167 are stored as discrete observations in a time series data structure, such as a time series database. In one embodiment, the transmit antenna (Tx) 165 and the receive antenna (Rx) 169 are coils arranged to form an inferred magnetic sensor, for example, as shown and described in further detail herein.

[0047] In one embodiment, the network interface 159 is configured to enable the passive chip scanner 110 to interact with the EMI fingerprinting service 105 or one or more other remote computers through the communication network 120. In one embodiment, the passive chip scanner 110 can send requests to and receive responses from a network server such as a web interface server 127. In one embodiment, the web interface server 127 is configured to enable the passive chip scanner 110 to access resources provided by the EMI fingerprinting service 105. In one embodiment, in response to a request from the passive chip scanner 110, analysis of the passive chip scan data is performed by the advanced pattern recognition component 133, and the results are returned to the passive chip scanner 110 for display to the user. In another embodiment, analysis of the passive chip scan data is performed locally by the passive chip scanner 110.

[0048] In one embodiment, other local computing components 161 include a local storage device, a display for showing text output or a GUI, a processor, memory, or other components of a computing device (such as shown and described with reference to computing system 600).

[0049] In one embodiment, the enterprise network 115 is a network of one or more computers associated with an entity (such as an enterprise entity) that is authorized to access the EMI fingerprinting service 105. For simplicity and clarity of explanation, the enterprise network 115 is represented by an on-site local area network 143 to which one or more personal computers 145 or servers 147 are operably connected, together with one or more remote user computers 149 or mobile devices 151 connected to the enterprise network 115 via the network 120 or other suitable communication network or combination of networks. The personal computers 145, remote user computers 149, and mobile devices 151 can be, for example, desktop computers, laptop computers, tablet computers, smart phones, or other devices that have the ability to connect to the local area network 143 or the network 120 or have other synchronization capabilities. The computers of the enterprise network 115 interface with the EMI fingerprinting service 105 across the network 120 or other suitable communication network or combination of networks.

[0050] In one embodiment, a remote computing system (such as a computing system of the polarizability spy chip scanner 110 or the enterprise network 115) can access information or applications provided by the EMI fingerprint recognition service 105 through the web interface server 127. For example, the polarizability scanner 110 or the computers 145, 147, 149, and 151 of the enterprise network 115 can access the polarizability-based passive spy chip detection component 125 from the EMI fingerprint recognition service 105. In one embodiment, the remote computing system can send a request to the web interface server 127 and receive a response therefrom. In one example, access to the information or application of the EMI fingerprint recognition service 105 can be achieved by using a web browser executed by a computing device. For example, these computing devices 145, 147, 149, and 151 of the enterprise network 115 can request and receive a web-based graphical user interface (GUI) for accessing the results of the spy chip scan analysis from the advanced pattern recognition component 133, downloading a test sequence from the test sequence library 135, or otherwise executing commands to access or configure components of the polarizability-based passive spy detection component 125. In one example, access to information or applications of the EMI fingerprinting service 105 may be achieved using a dedicated software application. For example, the polarizability spy chip scanner 110 may include a software application module that sends polarizability scan information to the advanced pattern recognition component 133 and in return receives an alert indicating the presence or absence of a spy chip in the scanned target electronic device 173, as well as other software application modules that access or configure components of the polarizability-based passive spy chip detection component 125. In one example, these communications may be exchanged through a web interface server 127 and may take the form of, for example, remote representational state transfer (REST) ​​requests using JavaScript Object Notation (JSON) as a data exchange format, or simple object access protocol (SOAP) requests to and from an XML server.

[0051] In one embodiment, the components (including subcomponents) of system 100 communicate with each other via electronic messages or signals. These electronic messages or signals can be configured as calls to functions or processes that access features or data of components, such as application programming interface (API) calls. In one embodiment, these electronic messages or signals are sent between hosts in a format compatible with Transmission Control Protocol / Internet Protocol (TCP / IP) or other computer networking protocols. Components of system 100 can (i) generate or compose electronic messages or signals to issue commands or requests to other components, (ii) use the infrastructure of system 100 to send the messages or signals to other components, and (iii) parse the content of received electronic messages or signals to identify commands or requests that the component can perform, and in response to identifying the command, the component will automatically perform the command or request.

[0052] -Fully utilizing polarizability for passive component testing-

[0053] The systems and methods described herein for passive spy chip detection through polarizability and advanced pattern recognition introduce a detection method that fully exploits the polarizability phenomenon to detect passive malicious electronic components (such as spy chips) that are not always active. The term "polarizability" as used herein refers to the tendency of a substance to acquire an induced dipole moment that is proportional to an applied electromagnetic field. Different materials acquire different dipole moments in response to the same applied electromagnetic field. For example, when two objects with different materials (and therefore different polarizabilities) are placed in an electromagnetic field, the polarizability responses are expected to be different. The polarizability can be characterized by induced voltage eddy currents and magnetic field strength.

[0054] In one embodiment, the working principle of detecting objects using polarizability is to have two coils, a transmit coil (Tx) that transmits a series of frequencies and a receive coil (Rx) that detects "backscattered" frequencies. In one example arrangement, the coils are concentric, with the smaller inner coil being the transmit coil (Tx) and the larger outer coil being the receive coil. Backscatter is a physical property of all matter that produces different (but complex) responses in an electromagnetic field. The received backscattered frequencies carry information that can be used to determine the presence of a passive object and even its type. The systems and methods described herein for passive spy chip detection through polarizability and advanced pattern recognition sense the backscattered EMI response from a passive spy chip in an electronic device, and then detect and analyze the response.

[0055] Polarizability has been applied in detecting small passive (i.e., no active circuits and no EMI emissions) objects in ordinary metal detectors, which can detect coins in the electromagnetically quiet sand of a beach, for example. However, ordinary metal detectors cannot detect the presence (or prove the absence) of passive or non-emitting objects (such as spy chips) against the EMI "photon chaos" environmental background caused by many dynamic emitting components. This EMI photon chaos occurs in complex computing devices such as enterprise servers, which can have multiple distributed CPU or GPU cores, dozens of dual in-line memory modules (DIMMs), solid-state drives (SSDs) or rotating hard disk drives (HDDs), fast peripheral component interconnect (PCIE) cards, and application-specific integrated circuits (ASICs). In this EMI photon chaos, no metal detector can detect coins or any other components (such as spy chips). Therefore, the induced backscatter response from the passive spy chip is lost in the EMI photon chaos and cannot be detected without the system and method described herein.

[0056] In one embodiment, the systems and methods described herein for passive spy chip detection by polarizability and advanced pattern recognition overcome these and other challenges by applying a novel frequency domain to time domain transform, analyzing the transformed time series signals using an advanced pattern recognition machine learning (ML) algorithm trained on a golden system that is proven to contain no spy chips. In one embodiment, the ML algorithm is a multivariate state estimation technique (MSET) algorithm. In the event that the ML algorithm detects a change in the complex photonic chaos inside the operating electronic device compared to the golden system, the possible presence of a passive spy chip can be inferred. In the event that the ML algorithm does not detect a change in the complex photonic chaos inside the operating electronic device compared to the golden system, the absence of any passive objects can be used to prove the absence of a passive spy chip.

[0057] More specifically, the challenges posed by photonic chaos are overcome by temporarily creating controlled chaos in a very large and very dynamic ambient radio frequency background (EMI). This ambient background EMI is detected in a running golden system (an electronic device that is proven to be free of spy chips). A frequency-domain to time-domain transform is applied to the detected EMI to produce a binned-frequency time series that can be consumed by an advanced pattern recognition ML algorithm. The resulting binned-frequency time series and the system-varying ambient background are used to apply polarizability first to the golden system (to generate training data for training the ML algorithm) and then to a unit under test of the same make and model as the golden system (to generate test data that can be evaluated by the trained ML algorithm to determine the presence or absence of a spy chip). The absence of any disturbance detected by the ML algorithm in the system-controlled ambient background is inferred to prove the absence of a spy chip, while the presence of disturbances detected by the ML algorithm in the complex ambient electric field acts as a trigger to initiate an alarm or alert for "suspected spy chip" detection. The alarm may generate an emergency service request for inspection of the unit under test by a service and / or safety engineer.

[0058] Therefore, in one embodiment, the system and method described herein for passive spy chip detection through polarizability and advanced pattern recognition fully utilizes polarizability and system dynamic environmental background generation scripts and frequency domain to time domain transformation to create frequency bin time series, which are fed into an advanced pattern recognition ML algorithm (such as MSET), which is trained on a golden system and can then be used to evaluate an unlimited number of similar brands and models of units under test, for which the sensed 3D EMI fingerprint is systematically compared with the golden system fingerprint to prove the absence of passive (non-emitting) spy chips, or if any spy chips are detected, a "suspected spy chip" alarm is initiated.

[0059] - Example polarization detection scenario -

[0060] Figure 2A An embodiment of an inferred magnetic sensor 200 associated with passive spy chip detection by utilizing advanced ML pattern recognition versus dynamic EMI monitoring of induced magnetic fields (attributed to polarizability) applied in a basic detection scenario (Scenario I) of scanning an empty space 202 is illustrated. In one embodiment, the inferred magnetic sensor includes two miniature toroidal coils: a transmit coil (Tx) 204 at the top and a receive coil (Rx) 206 at the bottom. An example arrangement of the toroidal coils is shown in a three-dimensional (3D) magnetic space relative to the X-axis 208, the Y-axis 210, and the Z-axis 212. The receive coil 206 has 10 turns and is located at (0, 0, 0) mm with the Z-axis 212 as the center on the plane defined by the X-axis 208 and the Y-axis 210. In one embodiment, the receive coil 206 is used as the receive antenna (Rx) 169 of the polarizability spy chip scanner 110. The transmit coil 204 has 5 turns and is located, for example, at (0, 0, 15) mm, centered on the Z axis 212 in a plane above and parallel to the plane defined by the X axis 208 and the Y axis 210. In one embodiment, the transmit coil 204 is used as the transmit antenna (Tx) 165 of the polarizability spy chip scanner 110.

[0061] Small eddy currents can be added to the transmitting coil 204 to induce a magnetic field around the transmitting coil 204 and the receiving coil 206. When a metal object is placed in the magnetic field generated by the loop coils 204 and 206, it induces a secondary magnetic field. Thus, the entire magnetic field is affected by both the primary field and the secondary field. As a result, the change in the magnetic field can be fully utilized to detect the presence of an object. This example infers that the magnetic sensor configuration is used in each of the six example detection scenarios described below, which illustrate the ability of the systems and methods described herein to distinguish between the presence or absence of a passive non-transmitting object, or even the presence of two different objects.

[0062] In each of the six example spy chip detection use cases discussed below, an excitation (eddy current) current of 1 ampere is applied to the transmit coil 204. No current is applied to the receive coil 206. Figure 3 The magnitude of the total magnetic field generated in each scenario is shown in . Scenario I is shown in Figure 2A , scene I is a basic scene in which there is nothing (empty space 202) in the space except the toroidal coils 204 and 206.

[0063] Figure 2BAn embodiment of an inferred magnetic sensor 215 associated with passive spy chip detection by utilizing advanced ML pattern recognition versus dynamic EMI monitoring of induced magnetic fields (attributed to polarizability) is illustrated in a detection scenario (Scenario II) of scanning an empty silicon box 217. For example, the empty silicon box 217 may be placed below a plane defined by the X-axis 208 and the Y-axis 210 centered on the Z-axis 212 at approximately (0, 0, -5) mm.

[0064] Figure 2C An embodiment of an inferred magnetic sensor 230 associated with passive spy chip detection by utilizing advanced ML pattern recognition versus dynamic EMI monitoring of induced magnetic fields (attributed to polarizability) is illustrated in a detection scenario (Scenario III) of scanning a silicon box 217 encapsulating a copper core block 232. In Scenario III, the copper core block 232 is placed within the silicon box 217 near the Z-axis 212.

[0065] Figure 2D An embodiment of an inferred magnetic sensor 245 associated with passive spy chip detection by utilizing advanced ML pattern recognition versus dynamic EMI monitoring of induced magnetic fields (attributed to polarizability) is illustrated in a detection scenario (Scenario IV) of scanning a copper core block 232 alone. In Scenario IV, the copper core block 232 is placed alone in space without the silicon box 217 at the same location near the Z axis 212 as in Scenario III.

[0066] Figure 2E An embodiment of an inferred magnetic sensor 260 associated with passive spy chip detection by utilizing advanced ML pattern recognition versus dynamic EMI monitoring of induced magnetic fields (attributed to polarizability) is illustrated in a detection scenario (Scenario V) of scanning a copper core block 232 and a passive spy chip 262. In Scenario IV, a copper core block 232 is placed in space at the same location near the Z axis 212 as in Scenarios III and IV. At another location near the Z axis 212, a simulated passive spy chip 262, a radio frequency identification (RFID) tag chip that can be set to an on or off state, is also placed in the space.

[0067] Figure 2F An embodiment of an inferred magnetic sensor 275 associated with passive spy chip detection by utilizing advanced ML pattern recognition versus dynamic EMI monitoring to sense magnetic fields (attributed to polarizability) is illustrated in a detection scenario (Scenario VI) of scanning a silicon box 217 encapsulating a copper core block 232 and a passive spy chip 262. In Scenario VI, the copper core block 232 and the passive spy chip are placed in the same position as in Scenario V and are encapsulated within the silicon box 217.

[0068] In scenarios II, III and VI, the size of the silicon box 217 is 25 mm (X) × 10 mm (Y) × 5 mm (Z). In scenarios III, IV, V and VI, the size of the copper core block 232 is 10 mm. In scenarios V and VI, the RFID chip 262 is 2 mm long and is turned off to simulate a spy chip in a passive state.

[0069] Each of the six scenarios was simulated using Ansys Maxwell, a commercially available electromagnetic field solver, in order to determine the magnitude of the total detected magnetic field for each scenario. Figure 2A to Figure 2F The magnetic field (h) in each of the six spy chip detection scenarios described in is measured at a measurement frequency of 1 MHz. The results are presented in Figure 3 middle. Figure 3 References associated with one embodiment of passive spy chip detection through polarizability and advanced pattern recognition Figure 2A to Figure 2F An example bar graph 300 of magnetic field strength detected in each of the six detection scenarios shown and described. The bar graph 300 includes an amplitude axis 305 of the magnetic field in amperes per meter. A legend 310 briefly describes the scenario represented by each bar in the bar graph 300. The magnetic field strength detected under scenario I 315 (a scan of an empty space 202) is just over 700,000 milliamps per meter (mA / m). The magnetic field strength detected under scenario II 320 (a scan of an empty silicon box 217) is just over 800,000 mA / m. The magnetic field strength detected under scenario III 325 (a scan of a silicon box 217 containing a copper core block 232) is just over 200,000 mA / m. The magnetic field strength detected under scenario IV 330 (a scan of the copper core block 232 itself) is also approximately 200,000 mA / m. The magnetic field strength detected under scenario V 335 (scanning of the copper core block 232 and the passive spy chip 262) is slightly less than 600,000 mA / m. The magnetic field strength detected under scenario VI 340 (scanning of the copper core block 232 and the passive spy chip 262 within the silicon box 217) is just over 600,000 mA / m. Based on these measurements, a 3-fold difference is observed between scenarios I-II and III-IV, where the silicon box 217 is present or absent. In addition, in the case where different metal objects are placed in the box, the difference in the magnetic field h generated is obvious because the magnetic field has changed by more than 2 times. In addition, even if the object is placed in a non-metallic box, we can still observe such a difference. This analysis illustrates the feasibility of metal detection of passive spy chips using polarizability.

[0070] - Passive spy chip detection based on polarizability response -

[0071] In one embodiment, the polarizability response (magnetic field strength) is fully utilized to implement passive spy chip detection using advanced pattern recognition technology. In one embodiment, in order to provide a control measure for the photon chaos of the environmental background EMI of the target asset (such as an enterprise server or other electronic device) with internal electronic components, a sinusoidal waveform input excitation is introduced to the target asset. In one embodiment, this is achieved by causing the electronic device to execute a test sequence that causes the EMI emission to oscillate in a sinusoidal manner. For example, the test sequence configures the target asset (through software or firmware) to run a specific pulse width modulation (PWM) workload in the form of a sine wave, thereby generating a deterministic waveform environmental background. In this way, regular repetitive changes are applied to the chaotic EMI of the target asset, and polarizability-induced emissions can be detected against it. In one embodiment, test sequences for enterprise servers and other electronic devices of various brands / models can be stored in the test sequence library 135. Other test sequences can be used to run workloads that cause the target electronic device to emit a deterministic background EMI with a waveform other than a sine waveform (such as a square wave or an irregular (but predetermined) waveform). Authorized users and administrators can download a test sequence for a specific UUT of a certain make and model, load the test sequence into the UUT, and cause the test sequence to be executed to generate a deterministic environmental background of oscillations for the asset.

[0072] In one embodiment, the Tx antenna 165 and Rx antenna 169 (configured as Tx coil 204 and Rx coil 206, respectively) of the polarizability spy chip scanner 110 are placed in the example enterprise server gold server, and the polarizability spy chip scanner 110 continuously measures the magnetic field over the frequency spectrum and time period. The polarizability spy chip scanner 110 thus obtains a time series of magnetic field measurement results associated with the frequency spectrum of the gold server. Figure 4A4. An example 3D surface mapping 400 between time, spectrum, and polarizability responses (magnetic field measurements) for a gold server that is proven to not include a spy chip, in association with one embodiment of passive spy chip detection using advanced ML pattern recognition versus induced magnetic fields (attributed to polarizability) for dynamic EMI monitoring. A 3D surface 405 of an example time series of magnetic field measurements associated with the spectrum for the gold server is plotted against a magnetic field magnitude axis 410 measured in decibels, a time axis 415 measured in minutes, and a frequency axis 420 measured in megahertz. Note that the time series data represented by surface 405 is noisy data, but for simplicity of representation in the figure, surface 405 does not show the noise, instead, surface 405 represents the time series data as a smooth wireframe. In this example, the sinusoidal form of the server environment background driven by the sinusoidal workload of the test sequence is visible in surface 405. The elevated ridge 425 is a specific frequency induced by the Tx antenna 165 (Tx coil 204) of the polariton chip scanner 110 superimposed on the sinusoidal ambient background EMI of the server.

[0073] In one embodiment, the same measurements are performed on a test server (denoted as a "unit under test") of the same brand / model as the golden server. The Tx antenna 165 and Rx antenna 169 (configured as Tx coil 204 and Rx coil 206, respectively) of the polarizability spy chip scanner 110 are placed within the unit under test that is compromised due to the inclusion of a passive spy chip, and the polarizability spy chip scanner 110 continuously measures the magnetic field over a spectrum and time period. In one embodiment, the measurement frequency (or sampling rate) is fixed, for example, fixed at 1 MHz. The polarizability spy chip scanner 110 thus obtains a time series of magnetic field measurement results of the unit under test associated with the spectrum. Due to the presence of the passive spy chip in the unit under test, a different mapping occurs between the magnetic field measurements and the spectrum, such as Figure 4B as shown in . Figure 4B The diagram illustrates an example 3D surface mapping 450 between time, spectrum, and polarizability responses (magnetic field measurements) for a compromised server including a passive spy chip in association with one embodiment of passive spy chip detection utilizing advanced ML pattern recognition versus induced magnetic fields (attributed to polarizability) for dynamic EMI monitoring. A 3D surface 405 of an example time series of magnetic field measurements associated with the spectrum for a compromised server is plotted against a magnetic field amplitude axis 410, a time axis 415, and a frequency axis 420. As discussed above, the time series data represented by surface 455 is noisy data, but for simplicity of representation in the figure, surface 455 does not show the noise, instead, surface 455 represents the time series data as a smooth wireframe. Figure 4AThe polarizability perturbation caused by the presence of the spy chip can be observed by the higher ridge 460 superimposed on the sinusoidal ambient background EMI of the server at the frequency induced by the Tx antenna 165 (Tx coil 204), compared to the ridge 425 of FIG.

[0074] Although example surfaces 405 and 455 are visually different, this is an example case shown for explanation purposes, and the difference between the magnetic field measurements between the golden server and the compromised server over the frequency spectrum and time period may be more subtle. Thus, advanced pattern recognition is applied to determine whether the difference is abnormal. In one embodiment, the polarizability spy chip scanner 110 has collected a time series of magnetic field measurements associated with the frequency spectrum for the unit under test and stored them in a local storage device. In one embodiment, the polarizability-based passive spy chip scanning control 155 generates instructions that send the collected time series of magnetic field measurements to the advanced pattern recognition component 133 of the polarizability-based passive spy chip detection component 125 in the EMI fingerprinting service 105, and further request an ML predictive analysis using an ML model trained for a golden server of the same brand and model as the unit under test to distinguish the presence or absence of an unknown electronic component such as a spy chip in the unit under test.

[0075] In response to the request of the polarizability spy chip scanner 110, the advanced pattern recognition component 133 presents the time series of magnetic field measurement results associated with the spectrum of the unit under test to the domain transformation module 142 for frequency domain to time domain transformation. In one embodiment, in order to achieve frequency domain to time domain transformation, the domain transformation module 142 divides the spectrum of the unit under test into a set of frequency bins or a continuous range of spectrum. In one embodiment, the frequency bin can have a uniform width. For example, the spectrum of 0 to 1000 MHz can be divided into 20 50 MHz wide frequency bins, such as 1-50 MHz, 51-100 MHz, ... 901-950 MHz and 951-1000 MHz. A greater or lesser number of frequency bins is allowed. As few as 5 frequency bins or as many as 100 frequency bins can be used, but practical experience has found that 20 frequency bins are satisfactory. Each frequency bin tracks a discrete time series signal of the magnetic field measurement results over time. Each frequency bin can be represented by a single frequency within the frequency bin, for example, the frequency with the highest peak in the frequency bin.

[0076] A set of some or all of the frequency bins may then be selected as input to the machine learning anomaly detection model performed by the ML predictive analysis module 137. Although the frequency bins may be arbitrarily selected when initially training the machine learning anomaly detection model, the frequency bins selected for the unit under test are the same as the frequency bins used for the spectrum of the golden server of the same brand and model as the unit under test. That is, the trained model is tested on the same frequency bins on which the model was trained. In the case where the unit under test has one or more non-transmitting devices (such as passive spy chips) inside, there should be multiple anomaly alarms on the signal due to the difference between the ML model estimates and the measured values, indicating that there are passive devices in the unit under test that were not present when the measurements were collected from the golden system. In response to the result, the polarizability-based passive spy chip detection component 125 may compose a message and send it to an email or other message address of an authorized technician or administrator to alert the recipient to the suspected presence of a passive spy chip. In the case where there are no non-transmitting devices (such as passive spy chips) inside the unit under test, no anomaly alarms should occur.

[0077] Domain transformation and anomaly analysis are performed in near real time, and messages indicating the status of the unit under test can be sent back to the polarizability spy chip scanner 110 so that the results are displayed to the user of the spy chip scanner 110 in near real time. In one embodiment, in response to receiving and parsing a message indicating that no anomalies were found between the magnetic field measurement results for the unit under test and the magnetic field measurement results for the gold server, the polarizability-based passive spy chip scanning control 155 causes a graphical notification to be presented on the display component of the polarizability spy chip scanner indicating that no passive spy chips were detected. The graphical notification can, for example, present a green circle and text that reads "Passive spy chip scan passed" or words of similar meaning. In one embodiment, in response to receiving and parsing a message indicating that an anomaly was found between the magnetic field measurement results for the unit under test and the magnetic field measurement results for the gold server, the polarizability-based passive spy chip scanning control 155 causes a graphical notification to be presented on the display component of the polarizability spy chip scanner indicating that a passive spy chip may be present. The graphical notification may, for example, present a red octagon and text reading "SUSPECTED PASSIVE SPY CHIP! DO NOT USE UNIT UNDER TEST" or words to similar effect.

[0078] - Example Method -

[0079] In one embodiment, each step of the computer-implemented method described herein may be performed by a processor of one or more computing devices (e.g., Figure 6 The processor 610 shown and described above performs the following operations to: (i) access a memory (such as a reference Figure 6615 and / or other computing device components shown and described), and (ii) configured with logic that causes the system to perform the steps of the method (such as reference Figure 6 The passive spy chip detection logic 630 based on polarizability shown and described herein). For example, the processor accesses the memory and reads from or writes to the memory to perform the steps of the computer-implemented method described herein. These steps may include (i) retrieving any necessary information, (ii) calculating, determining, generating, classifying, or otherwise creating any data, and (iii) storing any data calculated, determined, generated, classified, or otherwise created for subsequent use. References to storage or storing indicate storage as a data structure in a memory or storage device / disk of a computing device (e.g., reference to Figure 6 The memory 615 or storage device / disk 635 of the computing device 605 or remote computer 665 shown and described, or with reference to Figure 1 129 as shown and described).

[0080] In one embodiment, each subsequent step of the method is automatically initiated in response to parsing a received signal or retrieved stored data indicating that the previous step has been performed at least to the extent necessary to initiate the subsequent step. Typically, the received signal or retrieved stored data indicates completion of the previous step.

[0081] Figure 5 An embodiment of a method 500 associated with passive spy chip detection by using advanced ML pattern recognition against induced magnetic fields (attributed to polarizability) for dynamic EMI monitoring is illustrated. In one embodiment, the steps of method 500 are performed by EMI fingerprinting service 105 in conjunction with polarizability spy chip scanner 110 (see reference Figure 1 In one embodiment, the polarizability spy chip scanner 110 is a dedicated computing device (such as computing device 605) configured with polarizability-based passive spy chip detection logic 630. In one embodiment, the EMI fingerprinting service 105 is provided by one or more dedicated computing devices configured with logic 630. In one embodiment, the EMI fingerprinting service 105 is a module of one or more dedicated computing devices configured with logic 630. In one embodiment, the steps of method 500 enable real-time EMI detection of passive spy chips in electronic devices, wherein such real-time detection of passive spy chips was previously impossible.

[0082] The method 500 may be automatically initiated based on various triggers, such as in response to receiving a signal over a network or parsing stored data indicating that (i) a user (or administrator) of the polarizability spy chip scanner 110 has initiated the method 500, (ii) the method 500 is scheduled to be initiated at a defined time or at defined intervals, (iii) the polarizability spy chip scanner 110 has begun scanning for passive spy chips in a target system, (iv) in response to the completion of an EMI fingerprinting scan of active spy chips or counterfeit components in a target system. In response to parsing a received signal or retrieving stored data and determining that the signal or stored data indicates that the method 500 should be initiated, the method 500 is initiated at a start block 505. Processing continues to processing block 510.

[0083] At processing block 510 , a processor induces a magnetic field in a passive component of a target electronic system while the target electronic system is emitting electromagnetic interference having amplitude variations that repeat at time intervals.

[0084] In one embodiment, the processor generates and sends instructions to the radio 157 transmitter 163 to add eddy currents to the transmit antenna 165 (which may be configured as a transmit coil). The instructions include one or more specified magnetizing frequencies to be included in the eddy currents. The radio 157 receives and interprets the instructions, and configures and activates the transmitter 163 to apply eddy current (or excitation) currents to the transmit antenna 165, thereby generating a primary magnetic field. The primary magnetic field induces a secondary magnetic field in the passive components of the target electronic device 173. Thus, inducing a magnetic field in the passive components of the target device includes adding eddy currents having one or more specified magnetizing frequencies to the transmit coil via the radio transmitter.

[0085] In order to detect the induced magnetic field from the passive components, the active components of the target electronic device 173 should be operated so as to emit dynamic (amplitude-varying) EMI with a regular (or always-repeating) dynamic period during the induction of the magnetic field. This provides a deterministic (i.e., predictable) environmental background against which the induced magnetic field and backscatter can be detected. In one embodiment, the target electronic system 173 is executing a waveform workload so that the target electronic system emits dynamic electromagnetic interference. In one embodiment, the emitted dynamic electromagnetic interference has a regular dynamic period, that is, the amplitude of the EMI changes in a pattern that repeats at regular time intervals. For example, the waveform can be a sinusoidal waveform generated by pulse width modulation, or in some cases, a simple power-on, power-off square wave with a regular period. The regular dynamic period of the dynamic EMI has the same time period as the waveform workload.

[0086] In one embodiment, the transmit antenna 165 (transmit coil) is placed proximate to the target electronic system. As used herein, the target electronic system may refer to a unit under test or a golden system. Typically, a location "proximate" to the target electronic system means within a few feet or inches of the target electronic system. Note that when configured as a transmit coil 204, the transmit antenna 165 has a diameter of several centimeters. Thus, a location "proximate" to the target electronic system may even be within the housing of the target electronic system, and such a location may be desirable for enhanced reception of the signal.

[0087] Once the processor has accomplished inducing a magnetic field in a passive component of the target electronic system while the target electronic system is emitting electromagnetic interference having amplitude variations that repeat at time intervals, processing at processing block 510 is complete and processing continues to processing block 515 .

[0088] At processing block 515, the processor generates a time series of measurements of the combined magnetic field strength of the induced magnetic field and the dynamic electromagnetic interference over a frequency spectrum and a time period.

[0089] In one embodiment, the receiving antenna 169 is affected by the combined magnetic field of the induced magnetic field of the passive components of the target electronic device and the dynamic EMI background. In one embodiment, the receiving antenna 169 (which can be configured as a receiving coil) is placed adjacent to the target system. The impact on the receiving antenna 169 is processed into an analog signal by the receiver 167, for example. The software defined radio 157 generates a digital signal amplitude value for each frequency in a set of discrete frequencies across the frequency spectrum from the analog signal. In this way, generating a time series of measurement results includes detecting the combined magnetic field strength by the radio receiver through the receiving coil.

[0090] In one embodiment, in order to cause the target electronic system to emit dynamic electromagnetic interference with a regular dynamic period, the target electronic system executes a waveform workload during the test, wherein the regular dynamic period is the same as the period of the waveform workload. In one embodiment, the waveform workload is a test sequence such as described elsewhere herein. Therefore, in one embodiment, the target electronic system executes a waveform workload to cause the target electronic system to emit electromagnetic interference, and wherein the time interval (the time interval at which the EMI changes amplitude) is the period of the waveform workload.

[0091] The digital signal amplitude values ​​generated by the software defined radio 157 can be accessed through the interface of the radio 157. The polarizability-based spy chip scanning control 155 samples or observes a set of digital signal amplitude values ​​at regular observation intervals during a period of time when the polarizability spy chip scanner 110 scans the unit under test - the scanning period - and records the sampled signal values ​​as one observation of the time series of the measurement results of the combined magnetic field intensity in the spectrum during the scanning period. During the scanning period, the observation and recording cycle is repeated at regular observation intervals. The same set of values ​​is sampled at each observation, so that for each observation, digital signal values ​​are recorded at a consistent set of signals. In one embodiment, the interval between observations is 1 second or less, down to the minimum interval that can be generated by the polarizability spy chip scanner 110. In one embodiment, the scanning period is about 10 minutes. In one embodiment, the observations are stored in a data structure for time series as an observation data structure. In one embodiment, the sequence of observations is stored in the local storage device of the polarizability spy chip scanner 110 until the scan is completed. After the scan is complete, the polarizability-based passive spy chip scan control retrieves the time sequence of the completed scan and causes the network interface 159 to send the time sequence to the EMI fingerprinting service 105 for storage in the data repository 129 for further processing.

[0092] In one embodiment, the spectrum is between 0 megahertz (MHz) and 1 gigahertz (GHz). The spectrum can be extended beyond 1 gigahertz to include expected responses of passive spy chips that are more easily detected or strongest at frequencies greater than 1 gigahertz; or conversely, the spectrum can be reduced in the case where the expected responses of passive spy chips are easily detected or strongest in a frequency range less than 0 MHz-1 GHz, such as 250 MHz-750 MHz. In one embodiment, the set of discrete frequencies generated by the radio 157 is every integer megahertz value on the spectrum. In one embodiment, the set of discrete frequencies is more granular, for example, the set of discrete frequencies can be every fifth or tenth megahertz value along the spectrum. In one embodiment, the set of discrete frequencies is less granular, for example, the set of discrete frequencies can be every 10 megahertz or 20 megahertz along the spectrum. In one embodiment, the set of frequencies sampled or observed by the polarizability-based spy chip scanning control 155 is the entire set of discrete frequencies generated by the radio 157. In one embodiment, the set of frequencies sampled or observed by the polarizability-based spy chip scanning control 155 is an evenly spaced subset of the discrete frequencies generated by the radio 157, depending on the desired, user-selected level of granularity of observations across the frequency spectrum.

[0093] Once the processor has thus completed generating the time series of measurements of the combined magnetic field strength of the induced magnetic field and the dynamic electromagnetic interference over a frequency spectrum and time period, processing at processing block 515 is complete and processing continues to processing block 520 .

[0094] At processing block 520, the processor performs a frequency domain to time domain transform on the time series of measurements to create a set of time series signals describing the combined magnetic field strength over time within a particular frequency range.

[0095] In one embodiment, the domain transformation module 142 retrieves the time series of completed scans - the time series of measurements of the combined magnetic field strength of the induced magnetic field and dynamic electromagnetic interference within the frequency spectrum and time period - from the location of the time series of completed scans in a storage device (such as in the data repository 129). The processor executing the domain transformation module 142 then converts the time series of measurements within the frequency spectrum from the frequency domain to the time domain, such as by performing a fast Fourier transform (FFT) or other appropriate transformation on the time series of measurements within the frequency spectrum to generate a set of time series of amplitudes at specific frequencies within the frequency spectrum. In one embodiment, the conversion from the frequency domain to the time domain generates a time series of amplitudes for each sampling / observation frequency included in the scan. The time series of amplitudes at each frequency is included in the set of time series of amplitudes.

[0096] In one embodiment, the processor executing the domain transformation module 142 further divides or segments the time series of a set of amplitudes at each frequency into multiple "frequency bins" and represents each discrete bin with a representative frequency value. For example, a spectrum (such as a range from 0 MHz to about 1 GHz) can be divided into, for example, 20 bins, forming bins of 50 MHz width. Or, in another example, the spectrum can be divided into 100 bins, forming bins of 10 MHz width. In one embodiment, these frequency bins and associated representative frequency values ​​are equal in size and spaced equally along the spectrum. In one embodiment, as further described in detail above, in accordance with the observation that such a signal may also have the highest signal-to-noise ratio, the representative frequency value may be the frequency value with the highest peak on the power spectral density (PSD) diagram within the range of the frequency bin. Identify and select the representative frequency value. In one embodiment, the frequency bins and representative frequencies are stored, for example, in the data repository 129. In this way, the execution of the frequency domain to time domain transformation includes selecting the frequency with the highest peak in a specific frequency range as a time series signal describing the combined magnetic field strength over time within the specific frequency range. In another embodiment, the representative frequency value may be a frequency value in the middle of the range of the frequency bin, equidistant from the upper and lower frequency limits of the frequency bin.

[0097] Once the processor has thus completed performing a frequency domain to time domain transform on the time series of measurements to create a set of time series signals describing the combined magnetic field strength over time within a particular frequency range, processing at processing block 520 is complete and processing continues to processing block 525 .

[0098] At processing block 525 , the processor monitors the time series signal using a machine learning model trained to predict correct signal values ​​for devices of the same configuration as the target electronic device to determine if there are abnormal measured signal values ​​in the time series signal.

[0099] In one embodiment, a processor (e.g., a processor executing ML predictive analysis module 137) retrieves a trained ML model for the claimed configuration of the unit under test (target device), for example, from a trained ML model library 139. In one embodiment, the trained ML model is configured to predict the behavior of a golden system that is certified to have the correct configuration (thus, without passive spy chips) for its brand and model. In one embodiment, the trained ML model is a NLNP regression model, such as an MSET model. In one embodiment, the trained ML model is trained on a training time series of the same frequency values ​​selected in processing block 520 above. In one embodiment, the training time series is derived from signals detected during the golden system performing an oscillation test sequence that results in the emission of dynamic electromagnetic interference with a regular dynamic period. In one embodiment, the training time series is derived from signals detected during the golden system performing an oscillation test sequence, and polarizability responses in passive components of the golden system to the application of an electromagnetic field by the polarizability spy chip scanner 110.

[0100] For example, a method for training an ML model includes the following steps: when a target golden system that is verified to have no passive spy chips is emitting electromagnetic interference, inducing a second magnetic field in a passive component of the target golden system (e.g., as described herein with reference to processing box 510); generating a golden time series of measurements of the combined magnetic field strength of the induced second magnetic field and the dynamic electromagnetic interference over a frequency spectrum and a time period (e.g., as described herein with reference to processing box 515); performing a frequency domain to time domain transform on the golden time series of measurements to create a set of golden time series signals describing the combined magnetic field strength of the golden system over time within a specific frequency range (e.g., as described herein with reference to processing box 520); and training a machine learning model using the golden time series signals, such as by establishing a mathematical model of each signal value based on the values ​​of all other input signal values ​​through regression.

[0101] In one embodiment, where the time series of a set of amplitudes at each frequency are not divided into multiple frequency bins, the time series of each frequency is provided as input to and monitored by a trained machine learning model, where the trained machine learning model is trained using the same set of frequencies. This is a more computationally resource intensive analysis. In one embodiment, where the time series of a set of amplitudes at each frequency are divided into multiple frequency bins, a set of time series of representative frequencies of some or all of the frequency bins are provided as input to and monitored by a trained machine learning model, where the trained machine learning model is trained using the same set of representative frequencies. This is a less computationally resource intensive analysis.

[0102] In one embodiment, the processor executes the trained ML model to predict or estimate the value of the input signal at each observation. These estimated values ​​are recorded together with the actual measured values ​​of the time series. For example, the time series may include a data structure for each observation of the signal, which allows both measured values ​​and predicted values. The processor uses a fault detection model to analyze the predicted values ​​and actual measured values ​​at each observation to identify abnormal deviations between the predicted signal and the measured signal. In one embodiment, the fault detection model uses a sequential probability ratio test (SPRT), which detects abnormal deviations (or faults) from normal operation by comparing the cumulative sum of the log-likelihood ratios of each consecutive residual between the measured signal and the predicted value with a threshold indicating that a fault has been detected. In one embodiment, for a time series, the detection (or non-detection) of anomalies or faults can be recorded observation by observation. For example, a time series may include a data structure for each observation of the signal, which allows abnormal detection values ​​in addition to measured values ​​and predicted values. The detection of anomalies between the predicted value and the actual value of the signal in the unit under test indicates the presence of an unexpected passive component, i.e., a possible passive spy chip.

[0103] Once the processor has thus completed monitoring the time series signal using a machine learning model that has been trained to predict the correct signal values ​​for a device constructed identically to the target electronic device to determine whether there are abnormal measured signal values ​​in the time series signal, processing at processing box 525 is completed and processing continues to determination box 530.

[0104] At determination block 530, the processor determines whether there are abnormal measured signal values ​​in the time series signal. In one embodiment, the processor, for example, executing the ML predictive analysis module 137, parses the SPRT results of the monitored signal and determines whether any of the SPRT results indicate an abnormality. If the SPRT result indicates an abnormality (Anomaly Detected?: Yes), the processing at determination block 530 is complete and the processing continues to processing block 535. If the SPRT result indicates no abnormality (Anomaly Detected?: No), the processing at determination block 530 is complete and the processing continues to processing block 540.

[0105] At processing block 535, the processor presents a message indicating that the target device may contain a passive spy chip. In one embodiment, the processor generates a message indicating that the target device (unit under test) may contain a passive spy chip, or otherwise fails a polarizability-based passive spy chip scan, and sends the message to the polarizability spy chip scanner 110 via the network 120 for presentation to the user. The message (or other indication of failure to pass the passive spy chip scan) can also be sent via email to a designated account, such as an account of an administrator or engineer who can take further action on the damaged unit under test. The message (or other indication of failure to pass the passive spy chip scan) can also be recorded or documented in, for example, a log stored in the data repository 129.

[0106] In one embodiment, the polarizability spy chip scanner 110 presents a message to the user of the device following the conclusion of the scan and analysis of the target unit under test. In one embodiment, the polarizability-based passive spy chip scanning control 155 parses the message and extracts information indicating that the passive spy chip scan failed, and in response, generates a GUI indicating that a passive spy chip is suspected, and presents the GUI on the display of the polarizability spy chip scanner 110. In one embodiment, the GUI includes a message or other information indicating that the passive spy chip scan failed. In one embodiment, the displayed GUI includes a visual warning of the possible presence of a passive spy chip, such as a red octagonal icon in the color and form of a stop sign, so as to advise the user that the damaged unit under test should not be installed or continued to be used.

[0107] Once the processor has thus completed presentation of a message indicating that the target device may contain a passive spy chip, processing at processing block 535 is complete and processing continues to end block 545 where process 500 ends.

[0108] At processing block 540, the processor presents a message indicating that the target device does not have a passive spy chip. In one embodiment, the processor generates a message indicating that the target device (unit under test) does not have a passive spy chip, or has otherwise been scanned by a polarizability-based passive spy chip, and sends the message to the polarizability spy chip scanner 110 via the network 120 for presentation to the user. The message (or other indication of a passive spy chip scan) can also be sent via email to a designated account, such as an account of an administrator or engineer who can take further action on the verified unit under test. The message (or other indication of a passive spy chip scan) can also be recorded or documented in, for example, a log stored in the data repository 129.

[0109] In one embodiment, the polarizability spy chip scanner 110 presents a message to the user of the device following the conclusion of the scan and analysis of the target unit under test. In one embodiment, the polarizability-based passive spy chip scanning control 155 parses the message and extracts information indicating that the unit under test has been scanned by a passive spy chip, and in response, generates a GUI indicating that the unit under test does not have a passive spy chip, and presents the GUI on the display of the polarizability spy chip scanner 110. In one embodiment, the GUI includes a message or other information indicating that the passive spy chip has been scanned. In one embodiment, the displayed GUI includes a visual verification of the absence of a passive spy chip, such as a green icon suggesting a "green light", to signal to the user that the user can install or continue to use the verified unit under test.

[0110] Once the processor has thus completed presenting the message indicating that the target device does not have a passive snoop chip, processing at processing block 540 is complete and processing then continues to end block 535 where process 500 ends.

[0111] -Computing Device Embodiment-

[0112] Figure 6 An example computing device 600 is illustrated, which is configured and / or programmed as a special purpose computing device having one or more of the example systems and methods described herein, and / or equivalent. The example computing device can be a computer 605, which includes a processor 610, a memory 615, and an input / output port 620 operably connected via a bus 625. In one example, the computer 605 can include polarizability-based passive spy chip detection logic 630, which is configured similarly to the reference Figure 1-5The logic, systems, and methods shown and described facilitate passive spy chip detection by advanced pattern recognition ML versus dynamic EMI monitoring of induced magnetic fields (polarizability). In various examples, the logic 630 may be implemented in hardware, a non-transitory computer-readable medium having stored instructions 637, firmware, and / or a combination thereof. While the logic 630 is illustrated as a hardware component attached to the bus 625, it should be appreciated that in other embodiments, the logic 630 may be implemented in the processor 610, stored in the memory 615, or stored in the disk 635.

[0113] In one embodiment, the logic 630 or computer is a device (e.g., structure: hardware, non-transitory computer-readable medium, firmware) for performing the described actions. In some embodiments, the computing device can be a server operating in a cloud computing system, a server configured in a software as a service (SaaS) architecture, a smart phone, a laptop computer, a tablet computing device, etc.

[0114] For example, the apparatus may be implemented as a passive spy chip ASIC programmed to detect through polarizability and advanced pattern recognition. The apparatus may also be implemented as stored computer executable instructions presented to the computer 605 as data 640, which is temporarily stored in the memory 615 and then executed by the processor 610.

[0115] Logic 630 may also provide means (eg, hardware, a non-transitory computer-readable medium storing executable instructions, firmware) for performing passive snoop chip detection through polarizability and advanced pattern recognition.

[0116] Generally describing an example configuration of the computer 905, the processor 610 can be a variety of different processors, including dual microprocessors and other multi-processor architectures. The memory 615 can include volatile memory and / or non-volatile memory. Non-volatile memory can include ROM, PROM, etc., for example. Volatile memory can include RAM, SRAM, DRAM, etc., for example.

[0117] Storage disk 635 can be operably connected to computer 905, for example, through input / output (I / O) interface (e.g., card, device) 645 and input / output port 620 controlled by at least input / output (I / O) controller 647. Disk 635 can be, for example, a magnetic disk drive, a solid state disk drive, a floppy disk drive, a tape drive, a Zip drive, a flash card, a memory stick, etc. In addition, disk 635 can be a CD-ROM drive, a CD-R drive, a CD-RW drive, a DVD ROM, etc. Memory 615 can store, for example, processes 650 and / or data 640. Disk 635 and / or memory 615 can store an operating system that controls and allocates resources of computer 900.

[0118] The computer 905 can interact with, control, and / or be controlled by input / output (I / O) devices via an input / output (I / O) controller 647, an I / O interface 645, and an input / output port 620. The input / output devices may include one or more displays 670, a printer 672 (such as an inkjet printer, a laser printer, or a 3D printer), and an audio output device 674 (such as a speaker or a headset), a text input device 680 (such as a keyboard), an indication and selection device 682 (such as a mouse, a trackball, a touchpad, a touch screen, a joystick, a pointer, a stylus mouse), an audio input device 684 (such as a microphone), a video input device 686 (such as a video camera and a camera), a video card (not shown), a disk 635, a network device 655, a sensor (not shown), etc. The input / output port 620 may include, for example, a serial port, a parallel port, and a USB port. In one embodiment, the computer can be connected to the radio receiver 690, the receiving antenna 692, the radio transmitter 694 and the transmitting antenna (Tx) 696 via the I / O port 910 or the network 960 to transmit polarized frequencies and receive ambient background EMI and polarization-induced EMI from the unit under test, as well as to otherwise control and receive data from the radio receiver 690 and the radio transmitter 694.

[0119] The computer 605 can operate in a network environment and therefore can be connected to a network device 655 via the I / O interface 545 and / or the I / O port 620. Through the network device 655, the computer 905 can interact with a network 660. Through the network 660, the computer 905 can be logically connected to a remote computer 665 and to the remote computer's radio receiver and transmitter (and associated antenna). The networks with which the computer 905 can interact include, but are not limited to, LANs, WANs, and other networks.

[0120] -Software Module Embodiment-

[0121] Typically, software instructions are designed to be executed by accessing memory through one or more appropriately programmed processors. These software instructions may include, for example, computer executable code and source code that can be compiled into computer executable code. These software instructions may also include instructions written in an interpreted programming language such as a scripting language.

[0122] In complex systems, such instructions may be arranged into program modules, each of which performs a specific task, process, function, or operation. The entire collection of modules may be controlled or coordinated in its operation by an operating system (OS) or other form of organizational platform.

[0123] In one embodiment, one or more of the components described herein are configured as modules stored in a non-transitory computer-readable medium. The modules are configured with stored software instructions that, when executed by at least one processor accessing a memory or storage device, cause a computing device to perform corresponding functions as described herein.

[0124] - Cloud or Enterprise Implementation -

[0125] In one embodiment, the EMI fingerprint recognition service 105 is a computing / data processing system including a collection of applications or distributed applications for an enterprise organization. The applications and computing systems can be configured to operate with a cloud-based network computing system, infrastructure as a service (IAAS), platform as a service (PAAS), or software as a service (SAAS) architecture, or other types of networked computing solutions, or be implemented as a cloud-based network computing system, infrastructure as a service (IAAS), platform as a service (PAAS), or software as a service (SAAS) architecture, or other types of networked computing solutions. In one embodiment, the present system is a centralized server-side application that provides at least one or more of the functions disclosed herein and a graphical user interface for accessing and operating them, and is accessed by many users via a computing device / terminal that communicates with the present computing system (acting as a server) through a computer network.

[0126] -Definitions and Other Embodiments-

[0127] In another embodiment, the described method and / or its equivalent may be implemented with computer executable instructions. Therefore, in one embodiment, a non-temporary computer readable / storage medium is configured with computer executable instructions of a stored algorithm / executable application, which, when executed by a machine, causes the machine (and / or associated components) to perform the method. Example machines include, but are not limited to, processors, computers, servers operating in a cloud computing system, servers configured in a SAAS architecture, smart phones, etc.). In one embodiment, a computing device is implemented with one or more executable algorithms configured to perform any of the disclosed methods.

[0128] In one or more embodiments, the disclosed method or its equivalent is performed by any of the following: computer hardware configured to perform the method; or computer instructions contained in a module stored in a non-transitory computer-readable medium, wherein the instructions are configured as an executable algorithm, and the executable algorithm is configured to perform the method when executed by at least one processor of a computing device.

[0129] Although for the sake of simplicity of explanation, the method illustrated in the figure is shown and described as a series of frames of the algorithm, it should be appreciated that these methods are not limited by the order of the frames. Some frames may appear in an order different from that shown and described and / or appear simultaneously with other frames. In addition, the example method can be implemented using frames less than the frames shown in all the diagrams. Frames can be combined or separated into multiple actions / components. In addition, additional and / or alternative methods can adopt additional actions not illustrated in the frame.

[0130] The following includes definitions of selected terms used herein. The definitions include various examples and / or forms of components that fall within the scope of the terms and can be used for implementation. These examples are not intended to be limiting. Both singular and plural forms of the terms may be within the scope of the definitions.

[0131] References to "one embodiment," "an embodiment," "an example," "example," etc. indicate that one or more embodiments or one or more examples described herein may include a particular feature, structure, characteristic, property, element, or limitation, but not every embodiment or example must include the particular feature, structure, characteristic, property, element, or limitation. Furthermore, repeated use of the phrase "in one embodiment" does not necessarily refer to the same embodiment, although it may.

[0132] AAKR: Auto-Associative Kernel Regression

[0133] API: Application Programming Interface

[0134] ASIC: Application-Specific Integrated Circuit

[0135] CD: compact disc

[0136] CD-R: Recordable CD

[0137] CD-RW: CD-Rewritable

[0138] CPU: Central Processing Unit

[0139] DIMM: Dual In-line Memory Module

[0140] DRAM: Dynamic RAM

[0141] DVD: Digital Versatile Disc and / or Digital Video Disc

[0142] EMI: Electromagnetic Interference

[0143] EEPROM: Electrically Erasable PROM

[0144] EPROM: Erasable PROM

[0145] FFT: Fast Fourier Transform

[0146] GPU: Graphics Processing Unit

[0147] GUI: Graphical User Interface

[0148] HDD: Hard Disk Drive

[0149] HPC: High Performance Computing

[0150] HTTP: Hypertext Transfer Protocol

[0151] I / O: Input / Output

[0152] IAAS: Infrastructure as a Service

[0153] JSON: JavaScript Object Notation

[0154] LAN: Local Area Network

[0155] ML: Machine Learning

[0156] MSET: Multivariable State Estimation Technique

[0157] MSET2: Oracle's proprietary multivariable state estimation technology implementation

[0158] NAS: Network Attached Storage

[0159] NLNP: Nonlinear Nonparametric

[0160] NN: Neural Network

[0161] NOSQL: Not Just SQL

[0162] OS: Operating System

[0163] PAAS: Platform as a Service

[0164] PCI: Peripheral Component Interconnect

[0165] PCIE: PCI Express Service

[0166] PROM: Programmable ROM

[0167] PWM: Pulse Width Modulation

[0168] RAM: Random Access Memory

[0169] REST: Representational State Transfer

[0170] ROM: Read Only Memory

[0171] Rx: receiving antenna / coil

[0172] SDR: Software Defined Radio

[0173] SOAP: Simple Object Access Protocol

[0174] SQL: Structured Query Language

[0175] SRAM: Synchronous RAM

[0176] SSD: Solid State Drive

[0177] SVM: Support Vector Machine

[0178] TCP / IP: Transmission Control Protocol / Internet Protocol

[0179] Tx: Transmitting antenna / coil

[0180] USB: Universal Serial Bus

[0181] UUT: Unit Under Test

[0182] XML: Extensible Markup Language

[0183] WAN: Wide Area Network

[0184] As used herein, a "data structure" is an organization of data stored in a memory, storage device, or other computerized system in a computing system. A data structure may be, for example, any of a data field, a data file, a data array, a data record, a database, a data table, a graph, a tree, a linked list, and the like. A data structure may be formed of and include many other data structures (e.g., a database includes many data records). Other examples of data structures are possible according to other embodiments.

[0185] As used herein, "computer-readable medium" or "computer storage medium" refers to a non-temporary medium that stores instructions and / or data that are configured to perform one or more of the disclosed functions when executed. In some embodiments, data can serve as instructions. Computer-readable media can take the form of, but are not limited to, non-volatile media and volatile media. Non-volatile media can include, for example, optical disks, magnetic disks, etc. Volatile media can include, for example, semiconductor memories, dynamic memories, etc. Common forms of computer-readable media can include, but are not limited to, floppy disks, flexible disks, hard disks, tapes, other magnetic media, application-specific integrated circuits (ASICs), programmable logic devices, compact disks (CDs), other optical media, random access memories (RAMs), read-only memories (ROMs), memory chips or cards, memory sticks, solid-state storage devices (SSDs), flash drives, and other media that computers, processors, or other electronic devices can work with. Each type of medium, if selected for implementation in one embodiment, can include instructions for algorithms that are configured to perform one or more of the disclosed and / or claimed functions.

[0186] As used herein, "logic" means a component implemented using a computer or electrical hardware, a non-transitory medium with instructions of an executable application or program module stored, and / or a combination of these, to perform any function or action as disclosed herein, and / or to cause functions or actions from other logics, methods, and / or systems to be performed as disclosed herein. Equivalent logic may include firmware, a microprocessor programmed with an algorithm, discrete logic (e.g., ASIC), at least one circuit, an analog circuit, a digital circuit, a programmed logic device, a storage device containing instructions of an algorithm, etc., any of which may be configured to perform one or more of the disclosed functions. In one embodiment, logic may include one or more gates, a combination of gates, or other circuit components configured to perform one or more of the disclosed functions. In the case of describing multiple logics, it is possible to merge multiple logics into one logic. Similarly, in the case of describing a single logic, it is possible to distribute the single logic between multiple logics. In one embodiment, one or more of these logics are corresponding structures associated with performing the disclosed and / or claimed functions. The choice of which type of logic is implemented may be based on the desired system conditions or specifications. For example, if higher speed is considered, hardware will be selected to implement the function. If lower cost is a consideration, stored instructions / executable applications will be chosen to implement these functions.

[0187] An "operable connection," or a connection through which entities are "operably connected," is a connection through which signals, physical communications, and / or logical communications can be sent and / or received. An operable connection may include a physical interface, an electrical interface, and / or a data interface. An operable connection may include different combinations of interfaces and / or connections sufficient to allow operable control. For example, two entities may be operably connected to transmit signals to each other directly or through one or more intermediate entities (e.g., a processor, an operating system, logic, a non-transitory computer-readable medium). Logical and / or physical communication channels may be used to create an operable connection.

[0188] As used herein, "user" includes, but is not limited to, one or more individuals, computers or other devices, or a combination thereof.

[0189] Although the disclosed embodiments have been illustrated and described in considerable detail, it is not intended that the scope of the appended claims be limited or in any way restricted to such details. Of course, it is not possible to describe every expected and conceivable combination of components or methods for the purpose of describing various aspects of the subject matter. Thus, the present disclosure is not limited to the specific details or illustrative examples shown and described. Therefore, the present disclosure is intended to cover changes, modifications and variations that fall within the scope of the appended claims.

[0190] To the extent that the detailed description or claims use the term "comprising," that term is intended to be inclusive in a manner similar to how the term "comprises" is interpreted when used as a transitional word in a claim.

[0191] To the extent that the detailed description or claims use the term "or" (e.g., A or B), the term is intended to mean "A or B or both." When the applicants intend to indicate "only A or B but not both," then the phrase "only A and B but not both" will be used. Thus, use of the term "or" herein is inclusive, rather than exclusive.

Claims

1. A method for detecting a passive spy chip in a target electronic system, the method comprising: inducing a magnetic field in a passive component of the target electronic system while the target electronic system is emitting electromagnetic interference having amplitude variations that repeat at time intervals; generating a time series of measurements of the combined magnetic field strength of the induced magnetic field and the electromagnetic disturbance over a frequency spectrum and a time period; performing a frequency domain to time domain transform on the time series of measurements to create a set of time series signals describing the combined magnetic field strength over time within a specific frequency range; monitoring the time series signal using a machine learning model trained to predict correct signal values ​​for a device having the same configuration as the target electronic device to determine whether there are abnormal measured signal values ​​in the time series signal; as well as Presenting a message, the message (i) when there is an abnormal measurement signal value in the time series signal, indicating that the target device may contain a passive spy chip; and (ii) In the case where there is no abnormal measurement signal value in the time series signal, it indicates that the target device does not have a passive spy chip.

2. The method according to claim 1, further comprising: placing a transmitting coil adjacent to the target electronic system, wherein inducing a magnetic field in the passive component further comprises introducing eddy currents having one or more specified magnetizing frequencies into the transmitting coil via a radio transmitter; and placing a receiving coil adjacent to the target electronic system, wherein generating the temporal sequence of measurements further comprises detecting the combined magnetic field strength via the receiving coil by a radio receiver; The target electronic system is executing a waveform workload so that the target electronic system emits the electromagnetic interference, and the time interval is a period of the waveform workload.

3. The method according to claim 1 or 2, further comprising: Inducing a second magnetic field in a passive component of the target gold system when it is verified that no passive spy chip is emitting electromagnetic interference; generating a golden time series of measurement results of the combined magnetic field strength of the induced second magnetic field and the electromagnetic interference within the frequency spectrum and the time period; performing a frequency domain to time domain transform on the golden time series of measurements to create a set of golden time series signals describing the combined magnetic field strength of the golden system over time within a specific frequency range; as well as The machine learning model is trained using the golden time series signal.

4. The method according to claim 1, 2 or 3, wherein performing a frequency domain to time domain transformation further comprises selecting a frequency having a highest peak value within the specific frequency range as a time series signal describing the combined magnetic field strength over time within the specific frequency range.

5. A method according to claim 1, 2, 3 or 4, wherein the machine learning model is a multivariable state estimation technology model.

6. A computing system for detecting a passive spy chip in a target electronic system, the system comprising: processor; a memory operably connected to the processor; a radio transmitter operably connected to the processor and the memory; a radio receiver operably connected to the processor and the memory; a non-transitory computer-readable medium operably connected to the processor and the memory and storing computer-executable instructions that, when executed by at least the processor, cause the computing system to: inducing a magnetic field in a passive component of the target electronic system using the radio transmitter while the target electronic system is emitting electromagnetic interference having amplitude variations that repeat at time intervals; Acquiring, using the radio receiver, a time series of measurement results of the combined magnetic field strength of the induced magnetic field and the electromagnetic interference in a frequency spectrum and a time period; performing a frequency domain to time domain transform on the time series of measurements to create a set of time series signals describing the combined magnetic field strength over time within a specific frequency range; monitoring the time series signal using a machine learning model trained to predict correct signal values ​​for a device having the same configuration as the target electronic device to determine whether there are abnormal measured signal values ​​in the time series signal; as well as Presenting a message, the message (i) in the event that there is an abnormal measurement signal value in the time series signal, indicating that the target device may contain a passive spy chip, and (ii) In the case where there is no abnormal measurement signal value in the time series signal, it indicates that the target device does not have a passive spy chip.

7. The computing system of claim 6, further comprising: a transmitting coil connected as a transmitting antenna of the radio transmitter and configured to be placed proximate to the target electronic system, wherein the instructions for inducing a magnetic field in a passive component further comprise instructions that, when executed, cause the computing system to add eddy currents having one or more specified magnetizing frequencies to the transmitting coil via the radio transmitter; as well as a receiving coil connected as a receiving antenna of the radio receiver and configured to be placed proximate to the target electronic system, wherein the instructions for acquiring the time series of measurements further include instructions that, when executed, cause the computing system to detect the combined magnetic field strength by the radio receiver through the receiving antenna; The target electronic system executes a waveform workload so that the target electronic system emits the electromagnetic interference, and the time interval is a period of the waveform workload.

8. The computing system of claim 6 or 7, wherein the instructions further cause the processor to: Inducing a second magnetic field in a passive component of the target gold system when it is verified that no passive spy chip is emitting electromagnetic interference; generating a golden time series of measurement results of the combined magnetic field strength of the induced second magnetic field and the electromagnetic interference within the frequency spectrum and the time period; performing a frequency domain to time domain transform on the golden time series of measurements to create a set of golden time series signals describing the combined magnetic field strength of the golden system over time within a specific frequency range; as well as The machine learning model is trained using the golden time series signal.

9. A computing system according to claim 6, 7 or 8, wherein the instructions for performing frequency domain to time domain transformation also include instructions for causing the processor to select the frequency with the highest peak value within the specific frequency range as the time series signal describing the combined magnetic field strength over time within the specific frequency range.

10. A computing system according to claim 6, 7, 8 or 9, wherein the machine learning model is a non-linear, non-parametric regression model.

11. A non-transitory computer-readable medium comprising computer-executable instructions stored thereon for detecting a passive spy chip in a target electronic system, the computer-executable instructions, when executed by at least one processor of a computer, causing the computer to: inducing a magnetic field in a passive component of the target electronic system while the target electronic system is emitting electromagnetic interference having amplitude variations that repeat at time intervals; generating a time series of measurements of the combined magnetic field strength of the induced magnetic field and the electromagnetic disturbance over a frequency spectrum and a time period; performing a frequency domain to time domain transform on the time series of measurements to create a set of time series signals describing the combined magnetic field strength over time within a specific frequency range; monitoring the time series signal using a machine learning model trained to predict correct signal values ​​for a device having the same configuration as the target electronic device to determine whether there are abnormal measured signal values ​​in the time series signal; as well as Presenting a message, the message (i) when there is an abnormal measurement signal value in the time series signal, indicating that the target device may contain a passive spy chip; and (ii) In the case where there is no abnormal measurement signal value in the time series signal, it indicates that the target device does not have a passive spy chip.

12. The non-transitory computer readable medium of claim 11, wherein the instructions for inducing a magnetic field in the passive component further cause the computer to introduce eddy currents having one or more specified magnetizing frequencies into the transmitting coil via a radio transmitter, wherein the instructions for generating the time series of measurements further cause the computer to detect the combined magnetic field strength by a radio receiver through a receiving coil; wherein the target electronic system is executing a waveform workload so that the target electronic system emits the electromagnetic interference, and The time interval is a period of the waveform workload.

13. The non-transitory computer readable medium of claim 11 or 12, wherein the instructions further cause the computer to: When it is verified that a target gold system without a passive spy chip is emitting electromagnetic interference, inducing a second magnetic field in a passive component of the target gold system; generating a golden time series of measurement results of the combined magnetic field strength of the induced second magnetic field and the electromagnetic interference within the frequency spectrum and the time period; performing a frequency domain to time domain transform on the golden time series of measurements to create a set of golden time series signals describing the combined magnetic field strength of the golden system over time within a specific frequency range; as well as The machine learning model is trained using the golden time series signal.

14. The non-transitory computer-readable medium of claim 11, 12 or 13, wherein the instruction for performing the frequency domain to time domain transformation further causes the computer to select a frequency having a highest peak value within the specific frequency range as a time series signal describing the combined magnetic field strength over time within the specific frequency range.

15. The non-transitory computer readable medium of claim 11, 12, 13 or 14, wherein the machine learning model is a multivariable state estimation technique model or is implemented as a non-linear, non-parametric regression algorithm.

Images