SYSTEM, APPARATUS AND METHOD FOR DETECTION OF UNAUTHORIZED HARDWARE TAMPERING IN AC CIRCUITS OF A PRODUCT - Patent application

Abstract

A system, apparatus, and method are provided for detecting unauthorized implantation of a power line communication module in a product under test without requiring disassembly of the product under test.

Description

[Technical field]

[0001] The present invention relates to the field of unauthorized hardware tampering. More specifically, the disclosed system, apparatus and method are used for detecting unauthorized hardware tampering of the AC circuitry of a product. [Background technology]

[0002] Nowadays, the hardware design of products has become more complex, so it is very difficult to detect unauthorized hardware modifications in such products. In some cases, unauthorized hardware modifications can be the embedding of power line communication modules that act as Trojan horses. Such Trojan horses can be used for eavesdropping, cyber attacks, etc. Therefore, it has become essential for many companies and organizations to ensure that the products they use do not have hardware modifications, and in some cases, it is essential to check that these products are not modified before they are used.

[0003] Currently, several methods are used to detect the unauthorized embedding of a power line communication module in a product under test.

[0004] One method is to perform a visual inspection of the product under test checking for visible modifications to the hardware (compared to a trusted, unmodified counterpart), but one drawback of this method is the fact that such an inspection can take a very long time and may require dismantling of the product under test.

[0005] Another method is to monitor the power consumption of the product under test and compare it to the power consumption of a trusted, unmodified counterpart under the same scenario. One drawback of this method is that it is limited in its ability to determine whether differences in power consumption are due to natural-based power consumption variance or the presence of the power line communications module.

[0006] Another method is to sense and detect the presence of a power line communication signal coming from the product under test. One drawback of this method is that it relies on the occurrence of a transmission initiated by a power line communication module in the product under test (if there is no transmission, the sensor will not detect the power line communication module).

[0007] Therefore, there is a need in the art for reliable and efficient systems, apparatus, and methods that can be used to detect unauthorized implantation of power line communications modules in products under test (in some cases even before the products are authorized for use) without requiring disassembly of the products under test. Summary of the Invention

[0008] In its embodiments, the present invention provides systems, apparatus, and methods that enable highly reliable and efficient detection of unauthorized embedding of power line communications modules in products under test, without the need to disassemble the products under test.

[0009] Such products may be, for example, computer-related products (e.g., PCs, display screens, routers, printers, etc.), household appliances (e.g., coffee machines, microwaves, toaster ovens, etc.), lab equipment (e.g., spectrum analyzers, oscilloscopes, signal generators, etc.), or any other product that can be connected to a mains power source.

[0010] In some embodiments, an apparatus is provided for detection of unauthorized implantation of a power line communications module in a connected product, the apparatus may include a controller, a signal generator configured to generate a signal, a current sensor configured to measure a current generated from the generated signal, an AC output connector configured to connect the apparatus to the product, an AC input connector configured to connect the apparatus to a mains power source, and an analog front end unit (AFE) configured to couple the signal generator and the current sensor to the AC output connector.

[0011] In some embodiments, the device may further include an on / off switch configured to control the on / off state of a connected product.

[0012] In some embodiments, the device may further include a power line filter configured to create a low noise and / or high impedance environment at the AC output side of the device.

[0013] In some embodiments, the device may further include a local database, a processing unit, a user interface (a command and / or control unit), a power source, or any combination thereof.

[0014] In some embodiments, the device may further include a network connection.

[0015] In some embodiments, the signal generator may be configured to generate an output signal in a frequency range of approximately 10 KHz to 30 MHz.

[0016] In some embodiments, the output signal of the signal generator may be a chirp.

[0017] In some embodiments, the current sensor may be configured to measure current in a frequency range of the input signal between about 10 KHz and 30 MHz.

[0018] In some embodiments, the combined frequency of the input / output signals combined by the AFE may range from approximately 10 KHz to 30 MHz.

[0019] In some embodiments, the power line filter may be configured to operate in a frequency range of approximately 10 KHz to 30 MHz.

[0020] In some embodiments, the measured current generated from the generated signal may be used to determine an impedance fingerprint of the product.

[0021] In some embodiments, the product fingerprint may be obtained in a product off state and / or a product on state.

[0022] In some embodiments, the device may be configured to perform a method for detecting unauthorized implantation of a power line communications module in a connected product, which may include comparing an impedance fingerprint of the connected product to a corresponding reference impedance fingerprint obtained from a trusted, unaltered corresponding product.

[0023] In some embodiments, a method is provided for detecting unauthorized embedding of a power line communications module in a product. The method can include one or more of the steps of obtaining an impedance fingerprint of an AC circuit of the product and comparing the impedance fingerprint of the product with an AC impedance circuit fingerprint (golden fingerprint) of a trusted, unaltered counterpart product. A difference in values ​​of the compared fingerprints indicates unauthorized embedding of a power line communications module in the product.

[0024] In some embodiments, obtaining the impedance fingerprint may include applying a signal onto an AC circuit of the product and measuring the resulting current to create the impedance fingerprint.

[0025] In some embodiments, the signal may be a chirp.

[0026] In some embodiments, the frequency range of the chirp may be in the range of approximately 10 KHz to 30 MHz.

[0027] In some embodiments, the fingerprint may be taken with the product in an off state and / or an on state.

[0028] In some embodiments, the golden fingerprint and / or product fingerprint may be created, for example, by applying a signal onto the AC circuit of a trusted, unaltered product and measuring the resulting current to create a golden finger point.

[0029] In some embodiments, the fingerprint may be created on a server.

[0030] In some embodiments, the fingerprint may be created within the device.

[0031] In some embodiments, the golden fingerprint may be obtained from a database.

[0032] In some embodiments, the method may further include storing the product fingerprint and / or the golden fingerprint on a database.

[0033] In some embodiments, the database may be a local database of a detection device connected to the product and configured to apply a signal onto an AC circuit of the product and measure the resulting current.

[0034] In some embodiments, the database may be a network database connected to a server.

[0035] In some embodiments, the generation of the fingerprint may occur on a server.

[0036] In some embodiments, the generation of the fingerprint may be performed by the device.

[0037] In some embodiments, comparing the fingerprints may include loading a golden fingerprint, loading an impedance fingerprint of the product under test, and comparing the golden fingerprint with the impedance fingerprint of the product under test.

[0038] In some embodiments, comparing the fingerprints may further include storing and / or displaying the test results.

[0039] In some embodiments, the golden fingerprint may be loaded from a network database connected to the server.

[0040] In some embodiments, the golden fingerprint may be loaded from a local database in the detection device.

[0041] In some embodiments, the comparison process may be performed by a server or by the detection device.

[0042] In some embodiments, the test results may be stored on a local and / or network database.

[0043] In some embodiments, the test results may be displayed on the detection device and / or on the server.

[0044] In some embodiments, a system for detecting unauthorized embedding of a power line communications module in a product under test is provided. The system can include a server, a database, and a detection device. The detection device can include: A controller; a signal generator configured to generate a signal; a current sensor configured to measure a current generated from the generated signal; and an AC output connector configured to connect the device to a product; The device may comprise an AC input connector configured to connect the device to a mains power supply, and an analog front end unit (AFE) configured to connect the signal generator and the current sensor to the AC output connector.

[0045] In some embodiments, the detection device of the system may be configured to perform a method for detecting unauthorized embedding of a power line communications module in a product under test. The method may include comparing an impedance fingerprint of the product with an AC impedance circuit fingerprint of a trusted, unaltered counterpart product (golden fingerprint). A difference in values ​​of the compared fingerprints may indicate unauthorized embedding of a power line communications module in the product.

[0046] Certain embodiments of the present disclosure may include some, all, or none of the above advantages. One or more other technical advantages may be readily apparent to one skilled in the art from the figures, descriptions, and claims contained herein. Additionally, although certain advantages are enumerated above, various embodiments may include all, some, or none of the enumerated advantages. [Brief description of the drawings]

[0047] Exemplary embodiments are illustrated in the referenced figures. Dimensions of components and features shown in the figures are generally chosen for convenience and clarity of presentation and are not necessarily shown to scale. The figures are listed below. [Figure 1] A general scheme of a system for obtaining a golden fingerprint of a trusted, unaltered product, according to some embodiments. [Diagram 2] 1 is a flowchart of steps in a method for obtaining an impedance fingerprint of a trusted, unaltered product, according to some embodiments. [Diagram 3]1 is a general scheme of a system for detecting unauthorized implantation of a power line communication module in a product under test, according to some embodiments. [Figure 4] 1 is a flowchart of steps in a method for detecting unauthorized implantation of a power line communications module in a product under test, according to some embodiments. [Diagram 5] 1 is a graph of an exemplary impedance fingerprint (in the frequency domain), according to some embodiments. [Figure 6] 1 is a graph illustrating the difference (in the frequency domain) between an impedance fingerprint of a product under test and a corresponding golden fingerprint, according to some embodiments. [Figure 7] 1 is a block diagram of an apparatus for detecting unauthorized implantation of a power line communications module in a product under test, according to some embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0048] The principles, uses and implementations of the teachings herein may be better understood with reference to the accompanying description and figures. With reference to the description and figures present herein, one skilled in the art will be able to practice the teachings herein without undue effort or experimentation. In the drawings, like reference numerals refer to like parts throughout.

[0049] In the following description, various aspects of the present invention are described. For purposes of explanation, specific details are set forth to provide a thorough understanding of the present invention. However, it will be apparent to one skilled in the art that the present invention may be practiced without the specific details presented herein. Furthermore, well-known features may be omitted or simplified so as not to obscure the present invention.

[0050] The following description of the preferred embodiment(s) is merely exemplary in nature and is in no way intended to limit the invention, its application, or uses.

[0051] The description of illustrative embodiments according to the principles of the invention is intended to be read in connection with the accompanying drawings, which are to be considered part of the entire written description.

[0052] According to some embodiments, systems, apparatus, and methods are provided that allow for highly reliable and efficient detection of unauthorized implantation of a power line communications module in a product under test, without the need to disassemble the product under test.

[0053] For ease of understanding, the following terms are defined: As used herein, the term "impedance fingerprint" refers to a product's AC circuit impedance magnitude and phase values ​​versus frequency. As used herein, the term "golden fingerprint" refers to the impedance fingerprint of a trusted, unaltered product. As used herein, the term "comparable product" refers to an identical product, particularly with respect to the AC circuitry of the product.

[0054] According to some embodiments, the product can be any product that can be connected (directly or indirectly) to a mains power source. According to some exemplary embodiments, the product can be selected from, but is not limited to, computer-related products (e.g., PCs, display screens, routers, printers, etc.); home appliances (e.g., coffee machines, microwaves, toaster ovens, etc.); lab equipment (e.g., spectrum analyzers, oscilloscopes, signal generators, etc.); and the like. Each possibility is a separate embodiment.

[0055] According to some embodiments, without wishing to be bound by any theory or mechanism, a powerline communications module is connected to a powerline such that the embedding of a powerline communications module (certified or uncertified) within a product alters the impedance fingerprint of the product. Thus, as disclosed herein, detection of the embedding of a powerline communications module may be achieved by comparing the impedance fingerprint of the product under test to a golden fingerprint of a corresponding product.

[0056] Referring to Fig. 1, a general scheme of a system for obtaining a golden fingerprint of a trusted, unaltered product is shown according to some embodiments. As shown in Fig. 1, a trusted, unaltered product (102) is connected to (and powered by) a detection device (101). The detection device (101) is connected to a mains power supply (100) and may also be optionally connected to a server (104) via a communication network (103). The server may further be connected to a database (105). The detection device may include, among other things, an A / C output connection configured to connect to a product (such as a test product, a standard product, a modified product, an unmodified product, etc.) and an A / C input connection configured to connect the device to a mains power supply, as described in more detail below.

[0057] Reference is now made to Figure 2, which illustrates a flow chart of steps in a method for obtaining an impedance fingerprint of a trusted, un-tampered product, according to some embodiments. In step 200, the trusted, un-tampered product is connected to a detection device. Next, in step 201, the detection device is configured to turn off the power to the trusted, un-tampered product. Next, in step 202, an impedance fingerprint of the trusted, un-tampered product (in the power-off state) is obtained, for example, by applying a chirp signal onto the AC circuit of the product and measuring the resulting current. The current measurement can be used by the detection device (or a connected server, if applicable) to create an impedance fingerprint of the trusted, unmodified product (powered off state). Then, in step 203, the detection device is configured to turn on the power to the trusted, unmodified product. Then, in step 204, an impedance fingerprint of the trusted, unmodified product (powered on state) is obtained, for example, by applying a chirp signal on the AC circuit of the product and measuring the resulting current. The current measurement can be used by the detection device (or server) to create an impedance fingerprint of the trusted, unmodified product (powered on). In a final step (205), the impedance fingerprint of the trusted, unmodified product can be stored / saved in a local database (in the detection device) and / or in a network database (e.g., connected to a server).

[0058] Referring to FIG. 3, a general scheme of a system for detection of unauthorized embedding of a power line communication module in a product under test is shown, according to some embodiments. As shown in FIG. 3, a product under test (302) is connected to (configured to be powered by) a detection device (301). As detailed herein, the product may include any type of product that can be connected to a mains power source. The product under test may be connected to the detection device via an AC output connection of the detection device. As detailed herein, the detection device 301 is connected to a mains power source 300 (via an AC input connection) and may also optionally be connected to a server 304 via a communication network 303. The server may further optionally be connected to a database (305).

[0059] With reference to FIG. 4, a flow chart of steps in a method for detecting unauthorized embedding of a power line communication module in a product under test is shown according to some embodiments. In a first step (400), the product under test is connected to a detection device. In a next step (401), a golden fingerprint of the corresponding product is loaded. The golden fingerprint can be loaded by / from either a local database (connected to the detection device) or a network database (connected to the server) by the server or the detection device. Then, in step 402, the detection device is configured to switch off (turn off) the power to the product under test and obtain a fingerprint of the product under test, for example by applying a chirp signal on the AC circuit of the product and measuring the generated current. The measurement of the current can be used by the detection device or by the server (in the power off state) to create / form an impedance fingerprint of the product under test. Then, in step 403, the detection device is configured to power on the product under test and obtain a fingerprint of the product under test, for example by applying a chirp signal on the AC circuit of the product and measuring the generated current (in the power on state). The current measurements can be used by the detection device or server to create an impedance fingerprint of the product under test (power-on state). In a next step (404), the impedance fingerprint of the product under test is compared to the corresponding golden fingerprint. The comparison process can be performed by the detection device or the server. The comparison process can be performed, for example, in the impedance time domain and / or the frequency domain. If the comparison test (406) is successful (i.e., the impedance fingerprint of the product under test is similar to the corresponding golden fingerprint), it means that no hardware modification of the product under test has been detected (405). If the comparison test (406) is unsuccessful (i.e., the impedance fingerprint of the product under test is different from the corresponding golden fingerprint), it means that a hardware modification of the product under test has been detected (407).In a final step (408), the test results are stored and / or displayed by the detection device and / or the server in a local database (connected to the detection device) and / or a network database (connected to the server).

[0060] In some embodiments, the determination of "similar" or "different" between the impedance fingerprints may be based on a predefined threshold. For example, "similar" may include a similarity or identity in the range of about 90-100%. For example, a "similar" result may be 100% identity between the impedance fingerprint of the product being tested and the corresponding golden fingerprint. For example, a "similar" result may be 95-100% identity between the impedance fingerprint of the product being tested and the corresponding golden fingerprint. For example, a "similar" result may be greater than 90% identity between the impedance fingerprint of the product being tested and the corresponding golden fingerprint. For example, "different" may include a similarity of identity in the range of about 90%-less than 100%. For example, a "different" result may be less than 100% identity between the impedance fingerprint of the product being tested and the corresponding golden fingerprint. For example, a "different" result may be less than about 99% identity between the impedance fingerprint of the product being tested and the corresponding golden fingerprint. For example, a "different result" can be less than about 95% identity between the impedance fingerprint of the product under test and the corresponding golden fingerprint. For example, a "different" result can be less than about 90% identity between the impedance fingerprint of the product under test and the corresponding golden fingerprint.

[0061] Please refer to FIG. 5, which shows an example of an impedance fingerprint graph (in the frequency domain), according to some embodiments. As shown in FIG. 5, graph 500 is the impedance fingerprint of a product under test having an unauthorized power line communication module embedded therein. Graph 501 is the corresponding golden fingerprint of an unregistered product. In sections marked as 503 and 504, the two graphs are similar, but the difference in the graph in section 502 indicates that the product under test includes the embedding of an unauthorized power line communication module.

[0062] Please refer to Figure 6, which shows a difference graph (frequency domain) between the impedance fingerprint of the product under test and the corresponding golden fingerprint, according to some embodiments. As shown in Figure 6, in sections 600 and 602 of the graph, the difference between the graphs is less than 0.6 dB (mostly less than 0.2 dB), while in section 601 the difference between the graphs is much higher (picks more than 3.5 dB). Such a difference indicates that the product under test includes the embedding of an unauthorized power line communication module.

[0063] Referring to Figure 7, a block diagram of an apparatus for detecting unauthorized embedding of a power line communication module in a product under test is shown, according to some embodiments. As shown in Figure 7, the apparatus (700) can include one or more of a controller (704), a local database (701), a processing unit (707), a signal generator (705), a current sensor (708), a command and control unit (GUI interface) (702), an AC input connector (710), an AC output connector (709), an analog front end (AFE) block / element / unit (706), a power supply (711). In some embodiments (as shown in Figure 7), the apparatus can further include a power line filter (712), an on / off switch (713), and a network connection (703).

[0064] According to some embodiments, the command and control unit (702) provides a graphic user interface (GUI) that allows a user to initiate commands (e.g., using a keyboard, push buttons, etc.) and receive status and test results (e.g., using a display screen, LEDs, etc.). In some embodiments, some (or all) of the command and control unit functions can be initiated remotely (e.g., via a network connection (703)).

[0065] In some embodiments, a signal generator (705) and a current sensor (708) are used to obtain an impedance fingerprint of the product. According to some embodiments, the signal generator is configured to generate an appropriate signal. For example, a chirp signal (e.g., in the range of about 10 KHz to 30 MHz) may be applied by the signal generator (705) while the current sensor (708) is configured to measure / determine / detect the generated current.

[0066] In some embodiments, the current measurements are processed within the processing unit (707) to create an impedance fingerprint of the product. Alternatively, according to some embodiments, the current measurements (either original values ​​or after partial processing by the processing unit (707)) can be transferred (via the network connection (703)) to a server, which can generate an impedance fingerprint of the product. In some embodiments, the processing unit is external to the device.

[0067] In some embodiments, the analog front end block (AFE) (706) is configured to couple the signal generator and current sensor to an AC output connection (709). The AC output is used to connect the device to a product. According to some embodiments, the coupling can be in the frequency range of, for example, 10 KHz to 30 MHz.

[0068] In some embodiments, the power line filter (712) may be configured to create a low noise, high impedance environment at the AC output side (709), for example in the frequency range of 10 KHz to 30 MHz. Such a filtered environment can eliminate potential bias in the measurement of the product fingerprint due to noise and / or changing impedance conditions at the AC input side (710) of the device.

[0069] In some embodiments, an on / off switch (713) can be used to control the power on and power off states of the product under test, thus obtaining an impedance fingerprint of the product in the power on and / or power off states.

[0070] In some embodiments, a controller (704) may be used to communicate and coordinate between elements / components / units of the detection apparatus and to communicate with remote elements (e.g., a remote server) via a network connection (703).

[0071] In some embodiments, an apparatus is provided for detection of unauthorized implantation of a power line communication module in a product under test. The apparatus may include one or more of a controller, a local database, a processing unit, a signal generator, a current sensor, a command and control unit, an AC input connector, an AC output connector, an analog front end (AFE), and a power supply. In some embodiments, the apparatus may further include a power line filter, an on / off switch, a network connection, or any combination thereof. Each possibility is a separate embodiment.

[0072] In some embodiments, the frequency range of the signal generator is about 10 KHz to 30 MHz. In some embodiments, the frequency range of the current sensor is about 10 KHz to 30 MHz. In some embodiments, the frequency range of the analog front end is about 10 KHz to 30 MHz. In some embodiments, the frequency range of the power line filter is about 10 KHz to 30 MHz.

[0073] In some embodiments, a method is provided for detecting unauthorized implantation of a power line communications module in a product under test. The method can include an integrity verification of the AC circuit impedance of the product. In some embodiments, the integrity verification of the AC circuit impedance of the product can include obtaining an impedance fingerprint of a trusted, unaltered counterpart product (golden fingerprint), obtaining an impedance fingerprint of the product under test, and comparing the fingerprint with the golden fingerprint of the product under test.

[0074] In some embodiments, obtaining the golden fingerprint may include connecting a trusted, unaltered product to a detection device, applying a signal onto the AC circuit of the product, measuring the resulting current therefrom, and creating an impedance fingerprint.

[0075] In some embodiments, the applied signal is a chirp signal, hi some embodiments, the frequency range of the chirp is between about 10 KHz and 30 MHz.

[0076] In some embodiments, the current measurements can be used to create a golden fingerprint. In some embodiments, the creation of the golden fingerprint can occur on the detection device. In some embodiments, the creation of the golden fingerprint can occur on a server.

[0077] In some embodiments, the method of obtaining the golden fingerprint may be performed while the trusted, unaltered product is disconnected from power (powered off state).

[0078] In some embodiments, the method of obtaining the golden fingerprint may be performed while the trusted, unaltered product is connected to a power source (powered on state).

[0079] In some embodiments, the method of obtaining the golden fingerprint may further include storing the golden fingerprint in a database.

[0080] In some embodiments, the database may be a local database (within the detection device) and / or a network database (connected to a server).

[0081] In some embodiments, obtaining an impedance fingerprint of the product under test may include connecting the product under test to a detection device, applying a signal onto the AC circuit of the product, measuring the resulting current, and creating an impedance fingerprint.

[0082] In some embodiments, the frequency range of the chirp is between about 10 KHz and 30 MHz.

[0083] In some embodiments, the current measurements can be used to create an impedance fingerprint of the product under test.

[0084] In some embodiments, the creation of an impedance fingerprint of the product under test can be performed on the detection device.

[0085] In some embodiments, the creation of the impedance fingerprint of the product under test can occur on a server.

[0086] In some embodiments, the method of obtaining an impedance fingerprint of a product under test may be performed while the product is disconnected from a power source (power off state).

[0087] In some embodiments, the method of obtaining an impedance fingerprint of a product under test may be performed while the product is connected to power (powered on state).

[0088] In some embodiments, the method of obtaining an impedance fingerprint of the product under test can further include storing the impedance fingerprint of the product under test in a database.

[0089] In some embodiments, the database may be a local database (within the detection device) and / or a network database (connected to a server).

[0090] In some embodiments, comparing the golden fingerprint to the fingerprint of the product under test may include loading the golden fingerprint, loading an impedance fingerprint of the product under test, and comparing the impedance fingerprint of the product under test to the golden fingerprint. In some embodiments, the comparing may further include storing and / or displaying the test results.

[0091] In some embodiments, the golden fingerprints (used in the comparison tests) can be loaded from a network database (connected to a server).

[0092] In some embodiments, the golden fingerprints (used in the comparison test) may be loaded from a local database (within the detection device).

[0093] In some embodiments, the impedance fingerprint of the product under test (used in the comparative test) can be loaded from a network database (connected to a server).

[0094] In some embodiments, the impedance fingerprint of the product under test (used in the comparative test) can be loaded from a local database (within the detection device).

[0095] In some embodiments, the comparison process is performed by a server or by the detection device.

[0096] In some embodiments, the test results may be stored and / or displayed on the detection device and / or on a server.

[0097] In some embodiments, test results of a product involving unauthorized implantation of a powerline communications module may be compared to test results of similar products involving unauthorized implantation of a powerline communications module, and a positive result of such a comparison may suggest that the same powerline communications module was likely implanted by the same unauthorized planter.

[0098] In some embodiments, a system for detecting unauthorized embedding of a power line communication module in a product under test is provided. The system can include a server, a database, and a detection device capable of performing a method for detecting unauthorized embedding of a power line communication module in a product under test. The device can include a controller, a local database, a processing unit, a signal generator, a current sensor, a command and control unit, an AC input connector, an AC output connector, an analog front end, and a power supply. In some embodiments, the device can further include a power line filter, an on / off switch, and a network connection.

[0099] In some embodiments, the server may execute a method for detecting unauthorized implantation of a power line communications module in a product under test.

[0100] In some embodiments, the apparatus may be configured to perform a method for detecting unauthorized implantation of a power line communications module in a product under test by determining an integrity verification of the AC circuit impedance of the product.

[0101] As used herein, the term "about" may be used to specify the value of an amount or parameter within a continuous range of values ​​in the vicinity of a given (recited) value. According to some embodiments, "about" may specify the value of a parameter to be between 80% and 120% of the given value. According to some embodiments, "about" may specify the value of a parameter to be between 90% and 110% of the given value. According to some embodiments, "about" may specify the value of a parameter to be between 95% and 105% of the given value.

[0102] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains. In case of conflict, the patent specification, including definitions, will control. The indefinite articles "a" and "an" as used herein mean "at least one" or "one or more" unless the context clearly dictates otherwise. The processes and displays presented herein are not inherently related to any particular computer or other apparatus. Various general-purpose systems may be used in accordance with the programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to carry out the desired methods. The description that follows will show the desired structure of a variety of these systems. Furthermore, the embodiments of the present disclosure are not described with reference to any particular programming language. It will be understood that a variety of programming languages ​​may be used to implement the teachings of the present disclosure as described herein.

[0103] Although steps of methods according to some embodiments may be described in a particular order, methods of the present disclosure may include some or all of the described steps performed in a different order. Methods of the present disclosure may include some of the described steps or all of the described steps. No particular step in a disclosed method should be considered an essential step of the method unless expressly designated as such.

[0104] The present invention is not limited to the specific embodiments described herein. Indeed, various modifications of the present invention in addition to those described herein will become apparent to those skilled in the art from the foregoing description and accompanying drawings. Such modifications are intended to be within the scope of the appended claims.

Claims

1. 1. An apparatus for detecting unauthorized implantation of a power line communications module in a connected product, comprising: A controller; a signal generator configured to generate a signal; a current sensor configured to measure a current resulting from the generated signal; an AC output connector configured to connect the device to the product; an AC input connector configured to connect the device to a mains power source; An apparatus comprising: an analog front-end unit (AFE) configured to connect the signal generator and the current sensor to the AC output connector.

2. The device of claim 1 , further comprising an on / off switch configured to control an on / off state of the connected product.

3. the apparatus further comprising a power line filter configured to create a low noise and / or high impedance environment at an AC output side of the apparatus; An apparatus according to any preceding claim, wherein the power line filter is configured to operate in a frequency range of approximately 10 KHz to 30 MHz.

4. The apparatus of any one of claims 1 to 3, further comprising a local database, a processing unit, a user interface (command and control unit), a power supply, a network connection, or any combination thereof.

5. Apparatus according to any one of claims 1 to 4, wherein the signal generator is configured to generate an output signal in a frequency range of approximately 10 KHz to 30 MHz.

6. The apparatus of any one of claims 1 to 5, wherein the current sensor is configured to measure current in an input signal frequency range of about 10 KHz to 30 MHz.

7. The apparatus of any one of claims 1 to 6, wherein a combined frequency of input / output signals combined by the AFE is in the range of approximately 10 KHz to 30 MHz.

8. Measurements of the current produced from the generated signal are used to determine an impedance fingerprint of the product; and / or The impedance fingerprint of the product is obtained in an off state of the product and / or in an on state of the product.

2. The apparatus of claim 1.

9. 9. An apparatus as claimed in any one of claims 1 to 8, configured to perform a method for detecting unauthorized implantation of a power line communications module in the connected product, the method comprising comparing an impedance fingerprint of the connected product with a corresponding reference impedance fingerprint obtained from a trusted, unaltered corresponding product.

10. 1. A method for detecting unauthorized embedding of a power line communications module in a product, comprising: obtaining an impedance fingerprint of an AC circuit of the product; comparing the impedance fingerprint of the product to a golden fingerprint, which is an AC impedance circuit fingerprint of a trusted, unaltered corresponding product; A method, wherein a difference in the compared fingerprint values ​​indicates unauthorized embedding of a power line communications module in the product.

11. obtaining an impedance fingerprint of the product includes creating an impedance fingerprint of the product by applying a signal onto an AC circuit of the product and measuring the resulting current; and / or the frequency range of the signal is in the range of about 10 KHz to 30 MHz; and / or The method of claim 10, wherein the impedance fingerprint of the product is obtained in an off-state and / or an on-state of the product.

12. the golden fingerprint is created by applying a signal onto the AC circuit of the trusted, unaltered product and measuring the resulting current to create the golden fingerprint; and / or The golden fingerprint and / or the impedance fingerprint of the product are created on a server; and / or said golden fingerprint and / or said impedance fingerprint of said product are created on an apparatus; and / or The golden fingerprint is obtained from a database. The method according to any one of claims 10 to 11.

13. The method further comprises storing the impedance fingerprint and / or the golden fingerprint on a database; and / or The database includes: a local database of detection devices connected to the product and configured to apply the signal onto an AC circuit of the product and measure the resulting current; or A network database connected to a server, and / or The generation of the fingerprint is performed by a server or the detection device. The method according to any one of claims 10 to 12.

14. Comparing the fingerprints includes loading the golden fingerprint, loading an impedance fingerprint of the product, and comparing the golden fingerprint with the impedance fingerprint of the product; and / or The comparison is performed by a server or by a detection device; and / or Comparing the golden fingerprint to the impedance fingerprint of the product further comprises storing and / or displaying a result of the comparison; and / or the golden fingerprint and the impedance fingerprint of the product are loaded from a network database connected to the server and / or from a local database within the detection device; and / or The results of the comparison are stored in a local database and / or in the network database; and / or The results of the comparison are displayed on the detection device and / or on a network server. The method according to any one of claims 10 to 13.

15. 1. A system for detecting unauthorized embedding of a power line communications module in a product under test, comprising: A server, a database, and a detection device, The detection device includes: A controller; a signal generator configured to generate a signal; a current sensor configured to measure a current resulting from the generated signal; an AC output connector configured to connect the detection device to the product under test; The system includes an AC input connector configured to connect the detection device to a mains power source, and an analog front end unit (AFE) configured to connect a signal generator and a current sensor to an AC output connector.

Images