Detecting counterfeit devices using EMI fingerprinting

Abstract

Detecting whether a target utility device including multiple electronic components is genuine or suspected to be counterfeit is performed by executing a test sequence that powers and de-powers the target device to collect electromagnetic interference (EMI) signals emitted by the target device, generating a target EMI fingerprint from the collected EMI signals, and retrieving multiple reference EMI fingerprints from a database library, each reference EMI fingerprint corresponding to a different configuration of electronic components of a genuine device of the same make and model as the target device, and the detecting is further performed by iteratively comparing the target EMI fingerprint with the retrieved reference EMI fingerprints to generate a similarity metric between each compared set, and (i) indicating that the target device is genuine if the similarity metric for any individual reference EMI fingerprint satisfies a threshold test, and indicating that the target device is a suspected counterfeit device if the similarity metric for any individual reference EMI fingerprint does not satisfy the test.

Description

[Background technology]

[0001] background Counterfeit electronic components in the international supply chain are estimated to be worth $200 billion annually across all industries that use electronics, including information technology, medical, military, gaming, transportation, and utilities. Counterfeit systems often look so realistic that service engineers cannot distinguish them from authentic systems by simple visual inspection. However, counterfeit systems often contain scrap parts from discarded systems, cheaply manufactured parts, or old parts from recycled vintage systems that have been repackaged to look like authentic systems.

[0002] Such systems are then incorporated into the supply chain via broker channels. When counterfeit systems are shipped to customers, they are often faulty on arrival or fail after a very short period of time, resulting in large warranty losses, reduced mean time between failures, and customer dissatisfaction. In some situations, counterfeit systems even contain spy chips that may allow unauthorized access or control to the counterfeit systems. In the utility sector, the use of counterfeit electronic components is not only a costly nuisance, but also a major safety concern. Failure of utility components can result in life-threatening situations such as power outages and fires.

[0003] The North American Electric Reliability Council (NARC), the utility regulator, has issued the Supply Chain Risk Management Rule (No. CIP-013-1) to mitigate risks to the reliable operation of the bulk electric system. The rule mandates that by July 2020, all utilities in North America must implement technology to detect counterfeit parts in all power system assets used in generating equipment, supervisory control and data acquisition (SCADA) subsystems, and electric grid assets. Summary of the Invention [Means for solving the problem]

[0004] overview In one embodiment, a method for detecting whether a target utility device including a plurality of electronic components is genuine or suspected to be a counterfeit comprises the steps of: executing a test sequence of powering and unpowering a target device of a particular model to collect electromagnetic interference (EMI) signals emitted by the target device during the powering and unpowering; generating a target EMI fingerprint from the EMI signals collected during the powering and unpowering of the target device; and retrieving a plurality of reference EMI fingerprints from a database library, each reference EMI fingerprint corresponding to a different configuration of electronic components of a genuine device of the particular model identical to the target device, each reference EMI fingerprint corresponding to a powering and unpowering of the corresponding configuration of the genuine device. and a power-off sequence, the method further comprising the steps of: repeatedly comparing the target EMI fingerprint with each of the reference EMI fingerprints among the plurality of reference EMI fingerprints to generate a similarity metric between each compared pair of the target EMI fingerprint and each of the reference EMI fingerprints; and (i) generating a signal indicating that the target device is a genuine device if the similarity metric for any of the individual reference EMI fingerprints satisfies a threshold test, and (ii) generating a signal indicating that the target device is a suspected counterfeit device if the similarity metric for any of the individual reference EMI fingerprints does not satisfy the threshold test.

[0005] In one embodiment, a method for detecting whether a target utility device including a plurality of electronic components is genuine or suspected to be counterfeit, wherein collecting EMI signals emitted from the target device while powered and while unpowered includes collecting a first set of EMI signals while the target device is powered and collecting a second set of EMI signals while the target device is unpowered, and the target EMI fingerprint is generated from a combination of the first set of EMI signals and the second set of EMI signals.

[0006] In one embodiment, a method for detecting whether a target utility device including multiple electronic components is genuine or suspected to be a counterfeit, wherein the test sequence of powering and de-powering the target device includes multiple powering or de-powering.

[0007] In one embodiment, a method for detecting whether a target utility device including a plurality of electronic components is genuine or suspected to be a counterfeit further comprises receiving a telemetry signal from a sensor component of the target device and classifying the target device as being of the particular model of target device based on the telemetry signal, wherein the retrieval of the plurality of reference EMI fingerprints from the database library is based on the classification of the target device.

[0008] In one embodiment, the method for detecting whether a target utility device including a plurality of electronic components is genuine or suspected to be a counterfeit further comprises generating the similarity metric for each particular frequency in the reference EMI fingerprint by generating residuals between a reference amplitude-time series signal at the particular frequency in the reference EMI fingerprint and a Multivariate State Estimation Technique (MSET) estimate of a target amplitude-time series signal at the particular frequency in the target EMI fingerprint, and combining the generated residuals to generate the similarity metric.

[0009] In one embodiment, a method for detecting whether a target utility device including multiple electronic components is genuine or suspected to be a counterfeit, wherein the similarity metric is based on a mean absolute error over a particular set of frequencies between the reference EMI fingerprint and the target EMI fingerprint.

[0010] In one embodiment, a method for detecting whether a target utility device including multiple electronic components is genuine or suspected to be a counterfeit, wherein the similarity metric is surface mean absolute error.

[0011] In one embodiment, the method for detecting whether a target utility device including multiple electronic components is genuine or suspected to be counterfeit further comprises at least one of the steps of: (i) trimming the collected EMI signal to an optimal length for comparison with one or more of the reference EMI fingerprints; or (ii) synchronizing a first phase of the collected EMI signal with a second phase of one of the reference EMI fingerprints.

[0012] In one embodiment, a method for detecting whether a target utility device including a plurality of electronic components is genuine or suspected to be a counterfeit further comprises generating a visual image of a 3D residual surface based on one of the reference EMI fingerprint and the target EMI fingerprint and displaying it on a graphical user interface; (i) if the signal indicates that the target device is a genuine device, displaying a visual indication on the graphical user interface that the target device is genuine and displaying a description of the make, model and component configuration on the graphical user interface; and (ii) if the signal indicates that the target device is a suspected counterfeit device, displaying a visual indication on the graphical user interface that the target device is suspect or counterfeit.

[0013] In one embodiment, a non-transitory computer readable medium storing computer executable instructions, the instructions, when executed by at least a processor of a computer, cause the computer to collect, using a software defined radio and an antenna, electromagnetic interference (EMI) signals emitted by a target device while the target device is powered and de-powered in a repeatable test sequence, generate a target EMI fingerprint from the EMI signals collected while the target device is powered and de-powered, and retrieve a plurality of reference EMI fingerprints from a database library, each reference EMI fingerprint corresponding to a different configuration of electronic components of a real device of the same particular model as the target device, each reference EMI fingerprint being collected while the real device is powered and de-powered in the repeatable test sequence. The instructions, when executed by at least the processor of the computer, further cause the computer to repeatedly compare the target EMI fingerprint with each reference EMI fingerprint among the plurality of reference EMI fingerprints to generate a similarity metric between each compared pair of the target EMI fingerprint and each reference EMI fingerprint, generate and display on a graphical user interface a visual indication that the target device is genuine if the similarity metric for any individual reference EMI fingerprint satisfies a threshold test, and generate and display on a graphical user interface a visual indication that the target device is suspicious or counterfeit if the similarity metric for any individual reference EMI fingerprint does not satisfy the threshold test.

[0014] In one embodiment, a non-transitory computer-readable medium, wherein collecting EMI signals emitted from the target device while the target device is powered and while the target device is not powered includes collecting a first set of EMI signals while the target device is powered and collecting a second set of EMI signals while the target device is not powered, and the target EMI fingerprint is generated from a combination of the first set of EMI signals and the second set of EMI signals.

[0015] In one embodiment, the non-transitory computer readable medium, wherein the test sequence of powering and de-powering the target device includes powering or de-powering multiple times.

[0016] In one embodiment, the non-transitory computer-readable medium further comprises instructions that, when executed at least by the processor, cause the computer to receive a telemetry signal from a sensor component of the target device and classify the target device as being a target device of the particular model based on the telemetry signal, and the search for the plurality of reference EMI fingerprints from the database library is based on the classification of the target device.

[0017] In one embodiment, the non-transitory computer-readable medium further comprises instructions that, when executed by at least the processor, cause the computer to at least one of: (i) trim the collected EMI signal to an optimal length for comparison with one or more of the reference EMI fingerprints; or (ii) synchronize a first phase of the collected EMI signal with a second phase of one of the reference EMI fingerprints.

[0018] In one embodiment, a system for detecting whether a target utility device of a particular model including a plurality of electronic components is genuine or suspected to be a counterfeit includes a test sequence generator configured to automatically control power to alternately energize and de-energize the target device in a repeatable test sequence, and an EMI fingerprint counterfeit scanner configured to (i) collect electromagnetic interference (EMI) signals emitted by the target device while the target device is powered and de-energized, (ii) generate a target EMI fingerprint from the EMI signals collected while the target device is powered and de-energized, and (iii) retrieve a plurality of reference EMI fingerprints from a data store, each reference EMI fingerprint corresponding to a genuine reference device of the particular model, and (iv) retrieve a plurality of reference EMI fingerprints from a data store, each reference EMI fingerprint corresponding to a genuine reference device of the particular model. Further corresponding to separate configurations of electronic components of the genuine reference device, the EMI fingerprint counterfeit scanner is further configured to (iv) repeatedly compare the target EMI fingerprint with each reference EMI fingerprint among the plurality of reference EMI fingerprints to generate a similarity metric between each compared pair of the target EMI fingerprint and each reference EMI fingerprint, and (v) generate and display on a graphical user interface a visual indication that the target device is genuine if the similarity metric for any each reference EMI fingerprint satisfies a threshold test, and generate and display on the graphical user interface a visual indication that the target device is suspect or counterfeit if the similarity metric for any each reference EMI fingerprint does not satisfy the threshold test.

[0019] The accompanying drawings, which are incorporated in and form a part of the specification, illustrate various systems, methods, and other embodiments of the present disclosure. It will be understood that the element boundaries (e.g., a box, boxes, or other shapes) shown in the drawings represent one embodiment of the boundaries. In some embodiments, an element may be realized as multiple elements, or the multiple elements may be realized as one element. In some embodiments, an element shown as an internal component of another element may be realized as an external component, and vice versa. Additionally, the elements are not drawn to scale. [Brief description of the drawings]

[0020] [Figure 1] FIG. 1 illustrates one embodiment of an EMI fingerprint counterfeit scanner and an exemplary target utility device. [Diagram 2] FIG. 1 illustrates one embodiment of an environment in which an EMI fingerprint counterfeit scanner operates. [Diagram 3] FIG. 1 illustrates an embodiment of a method associated with utility asset configuration discovery and counterfeit detection. [Figure 4] FIG. 1 illustrates an embodiment of a method associated with generating an EMI fingerprint from EMI signals collected while a utility device is powered and de-powered. [Diagram 5] FIG. 1 illustrates an example utility device having different makes / models pre-classified into categories of similar makes and models using sensor telemetry signals. [Figure 6] FIG. 1 illustrates an embodiment of a method associated with pre-classifying target utility devices based on sensor telemetry readings. [Figure 7]FIG. 1 illustrates a reference waveform ("Golden System" or "GS") along with a target waveform ("Unit Under Test" or "UUT") for an example of distinguishing a target EMI fingerprint using the EMI fingerprint of a corresponding GS. [Figure 8] FIG. 13 illustrates identical EMI fingerprint signature frequencies in both the reference and target EMI fingerprints after automatic edge detection has been applied to trim the signal vector to an optimal length. [Figure 9] FIG. 1 illustrates the effect of optimal synchronization using an analysis resampling process on a reference (GS) signal and a target (UUT) signal. [Figure 10] FIG. 13 illustrates an example EMI residual using untrimmed and trimmed EMI signals for an example raw signal to contrast signal comparison metrics. [Figure 11(a)] FIG. 1 illustrates one embodiment of a schematic and procedure for automatic type-model configuration discovery for counterfeit detection techniques. [Figure 11(b)] FIG. 1 illustrates one embodiment of a method for performing MSET-based MAE characterization. [Figure 12] FIG. 1 illustrates an example 3D EMI residual surface generated by a comparison of two different utility devices. [Figure 13] FIG. 1 illustrates an exemplary 3D EMI residual surface generated by comparison of two similar (or identical) utility devices. [Figure 14] FIG. 1 illustrates an example EMI residual between two different utility devices across one of the frequency bins that trips an MSET alarm. [Figure 15] FIG. 1 illustrates an example EMI residual between two similar (or identical) utility devices across one of the frequency bins that does not trip an MSET alarm. [Figure 16]1A-1C illustrate two views of one embodiment of a graphical user interface used in conjunction with the display of an EMI fingerprint counterfeit scanner to visually display the results of an EMI fingerprint scan of a target utility device. [Figure 17] FIG. 1 illustrates one embodiment of a computing system configured with the example systems, methods and / or special purpose devices disclosed herein. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] Detailed Description Described herein are systems and methods that provide automated asset configuration discovery and counterfeit detection in critical utility assets via electromagnetic interference (EMI) fingerprinting.

[0022] EMI signals are generated by power utility devices such as transformers, generators, inverters, meters or other power grid systems during operation. Although these EMI signals are generally considered noise, these EMI signals can also carry information that can be used to generate a unique EMI fingerprint (EMIF) for the utility device. For example, the EMI emitted by a target utility device having an unknown component configuration can be scanned to generate a target EMI fingerprint for the target utility device. The generated target EMI fingerprint can be compared to a reference EMI fingerprint of a reference utility device of known configuration to confirm that the target utility device is a utility device of known make, model and configuration, or to indicate that the target utility device is not a utility device of known make, model and configuration and therefore may contain one or more suspected counterfeit components or may be suspected to be completely counterfeit.

[0023] Counterfeit detection for power utility devices is most conveniently performed at a point along the supply chain, such as at a loading or receiving dock, or at an entry or exit port, or other control boundary, prior to final installation of the utility device. The people performing the EMI fingerprint scans at these locations have little time to spare for scanning. However, requiring the scanner to verify the exact make, model, and internal component configuration of the target utility device before scanning it is a labor-intensive, error-prone process.

[0024] It should be noted that there are actually more permutations of acceptable genuine internal component configurations than there are makes and models of utility devices. The make and model assigned to a utility device does not necessarily change every time the internal components are upgraded in a new production run of the utility device (this is especially true for complex and / or high-cost utility devices). Thus, even though the make and model may not change for years, the internal components may change with the "vintage" of the shipment or production run of the utility device. For example, the internal components may change as they are produced or purchased in incremental batches. These batches may meet all quality and performance specifications but have different EMI characteristics. These multiple internal component refreshes may result in multiple distinct EMI fingerprints for genuine utility devices of the same make and model according to the vintage of the shipment or production date, but this information is not readily available to the person performing the EMI fingerprint scan. Thus, it may be impossible for the person performing the EMI fingerprint scan to completely identify the internal configuration of the target device by simple inspection.

[0025] However, an incorrect selection of the make, model, and internal component configuration of the reference EMI fingerprint is likely to result in a false positive identification of the target utility device as a possible counterfeit. Thus, it is not feasible or desirable for the person conducting the scan to have to identify and enter into the scanning equipment the exact make, model, and internal component configuration of the utility device being scanned.

[0026] Instead, the scanning procedure needs to be quick, as easy as possible, and completely agnostic, no matter what make, model, and part configuration of the target utility device is being scanned. Additionally, those performing EMI fingerprint scans at these locations need a scanning procedure that does not require the person performing the scan to hold an advanced data science degree to interpret the results.

[0027] In one embodiment, the make / model and internal part manufacturer for each target utility device to be scanned are automatically discovered by a novel autonomous utility asset type, model and part configuration discovery pattern recognition framework. In one embodiment, a reference EMI fingerprint is obtained from a reference utility device for the make, model and configuration (or "type") of the utility device. The reference utility device for the make, model and configuration is one that is confirmed to be an authentic example of the make, model and configuration of the utility device ("golden system"). In one embodiment, the target utility device is subjected to an iterative pattern recognition process that compares the target EMI fingerprint against a library of reference EMI fingerprints using a configuration similarity metric called EMI Fingerprint Surface Mean Absolute Error (EMIF SMAE). This recognition process quickly infers the configuration of the target utility device (or unit under test (UUT)) and then provides an alert of possible counterfeits or proof that the asset just scanned is a genuine, authentic, acceptable configuration and does not contain counterfeits.

[0028] Although the present invention is described in the context of a power utility device, the general principles and techniques of the present invention are applicable to any electronic system comprising at least one electronic component.

[0029] -An exemplary EMI fingerprint forgery detector- FIG. 1 illustrates one embodiment of an EMI fingerprint counterfeit scanner 100 and an exemplary target utility device 105. The EMI fingerprint counterfeit scanner 100 includes an antenna (or other EMI signal sensor) 115 connected to a radio 120, such as a software defined radio. In one embodiment, the EMI fingerprint counterfeit scanner 100 also includes a telemetry collector 125, which may be connected to the sensor component 130 of the target utility device 105 by a telemetry bus 135, or alternatively by radio frequency transmission between transceivers 140 and 145. The EMI fingerprint counterfeit scanner 100 also includes a local data storage 150 connected to the radio 120 and the telemetry collector 125. The EMI fingerprint counterfeit scanner 100 also includes a utility device configuration discovery and counterfeit detection logic 155. The EMI fingerprint counterfeit scanner 100 also includes a network interface 160 and a display 165.

[0030] It is noted that the utility device 105 generates the EMI signal 110 when power is provided to the utility device 105. Additionally, it is noted that the utility device 105 may continue to generate the EMI signal 110 for at least some time after power to the utility device 105 is disconnected. The EMI signal is generated from one or more internal components of the utility device 105, which may include, but are not limited to, controls, switches, motors, inductors / transformer windings, capacitors, sensors, and other components. In some examples, the EMI signal may be generated by interactions between multiple components. In one embodiment, the antenna 115 is configured to detect the EMI signal 110 and apply these EMI signals to the radio 120 coupled to the antenna 115. Depending on the configuration of the antenna 115 and the radio 120, the EMI signal is detected across a wide spectrum of frequencies, for example, from about 1 megahertz to about 4 gigahertz.

[0031] In one embodiment, the antenna 115 may include a dipole antenna, a Yagi-Uda antenna, a loop antenna, an electrically shorted antenna (e.g., an open-ended wire having a length less than a quarter wavelength), a fractal antenna, a parabolic antenna, a microstrip antenna, a quad antenna, a random wire antenna (e.g., an open-ended wire having a length greater than one wavelength), a beverage antenna, a helical antenna, a phased array antenna, and other types of antennas now known or later developed. In one simple and inexpensive embodiment, the antenna 115 may be an insulated wire with a fixed length of insulation stripped. In one embodiment, the type and length of the antenna may be selected to achieve optimal discrimination sensitivity and robustness.

[0032] The antenna 115 may be positioned close to the target utility device 105 or far away from the target utility device 105. To achieve better sensitivity in the antenna 115 and therefore a higher signal-to-noise ratio (SNR) in the EMI fingerprint counterfeit scanner 100, it is preferable for the distance between the target utility device 105 and the antenna 115 to be small. In addition to distance, the sensitivity of the antenna 115 may also be affected by its orientation with respect to the target utility device 105.

[0033] In one embodiment, antenna 115 is positioned at a predetermined distance and orientation relative to target utility device 105 during scanning. This predetermined distance and orientation may be the same as the distance and orientation used to detect a reference EMI signal from a reference utility device of the same make and model as target utility device 105. Consistency of antenna placement relative to the utility device being scanned may improve the ability of EMI fingerprint counterfeit scanner 100 to match a target EMI fingerprint with a reference EMI fingerprint and distinguish the target EMI fingerprint from the reference EMI fingerprint.

[0034] In one embodiment, the antenna 115 may be attached to the EMI fingerprint counterfeit scanner 100. In one embodiment, the antenna 115 may be at a fixed location (distance and orientation) relative to the target utility device 105 during scanning of the target utility device 105 by the EMI fingerprint counterfeit scanner 100. For example, the antenna 115 may be placed in close proximity to the target utility device 105 and not moved during scanning. The antenna 115 may be attached to or within the housing of the target utility device 105. In one embodiment, multiple antennas and radios (not shown) may be positioned at various locations and orientations relative to the target utility device 105 during scanning. In one embodiment, the antenna 115 is moved to multiple different locations and orientations relative to the target utility device 105 during scanning. These various antenna positions and configurations, as well as other position and configuration implementations, may be selected as desired to improve the signal-to-noise ratio (SNR) of the EMI signal detected for the entire target utility device 105, or to highlight EMI signals emitted by particular parts of the target utility device 105.

[0035] In one embodiment, radio 120 is configured to convert received EMI signals from analog to digital signals and record the power amplitude and frequency of these signals at prescribed time intervals. In one embodiment, radio 120 may store the recorded signals as data structures in local data storage 150 or provide them directly to utility asset configuration discovery and counterfeit detection logic 155 for analysis.

[0036] Utility devices, such as target utility device 105, are typically manufactured with sensor components 130 that provide sensor telemetry signals describing the status of various aspects of the utility device, such as temperature, current, voltage, or other detectable information. For example, sensor components 130 may be configured to interface with a remote terminal unit (RTU) of a SCADA or other distributed control system. In one embodiment, telemetry collector 125 is configured to present an RTU interface with sensor components 130.

[0037] In one embodiment, telemetry collector 125 receives and processes the sensor telemetry signals. For example, telemetry collector 125 may parse the sensor telemetry signals received over telemetry bus 135 to extract status information. Telemetry collector 125 may then store the status information as data structures in local data storage 150 or provide them directly to utility asset configuration discovery and counterfeit detection logic 155 for analysis.

[0038] In one embodiment, local data storage 150 is a local data store of a mobile device or computer. In one embodiment, utility asset configuration discovery and counterfeit detection logic 155 is a processor of a mobile device or computer specially configured with instructions to perform one or more of the functions of the system described herein.

[0039] -Example environment for EMI fingerprint scanning- FIG. 2 is a diagram illustrating one embodiment of an environment 200 in which the EMI fingerprint counterfeit scanner 100 operates.

[0040] In one embodiment, the EMI fingerprint counterfeit scanner 100 is a mobile device 205 or computer 210 coupled to a software defined radio 120 and an antenna 115. In one embodiment, the network interface 160 is configured to enable the EMI fingerprint counterfeit scanner 100 to interact with one or more remote computers over a communication network 215. In one embodiment, the EMI fingerprint counterfeit scanner 100 may send requests to and receive responses from a web server, such as the web interface server 220. These communications may take the form of Remote Representational State Transfer (REST) ​​requests using JavaScript Object Notation (JSON) as the data exchange format, or Simple Object Access Protocol (SOAP) requests with an XML server.

[0041] In one embodiment, the web interface server 220 is configured to enable the EMI fingerprint counterfeit scanner 100 to access resources provided by the cloud application infrastructure 225. In addition to the web interface server 220, the cloud application infrastructure 225 also includes a server-side utility asset configuration discovery and counterfeit detection system 230 and one or more data storage devices 235. The web interface server 220, the system 230 and the data storage devices 235 are interconnected by a local network 240. In one embodiment, the server-side utility asset configuration discovery and counterfeit detection system 230 is one or more computing devices specially configured with instructions to perform one or more of the functions of the system described herein. In one embodiment, the analysis of the target EMI fingerprint is performed by the server-side utility asset configuration discovery and counterfeit detection system 230 in response to a request from the EMI fingerprint counterfeit scanner 100, and the results are returned to the EMI fingerprint counterfeit scanner 100 for display to the user. In another embodiment, the analysis of the target EMI fingerprint is performed by the EMI fingerprint counterfeit scanner 100.

[0042] In one embodiment, a test sequence generator 245 is also provided. The test sequence generator 245 operates to control power through one or more components in the target utility device 105. In operation, the test sequence generator 245 may create square waves of power amplitude through the components of the target utility device 105. Instructions for the test sequences, including the amplitude and duration of these square waves, may be pre-programmed in the test sequence generator 245 and / or controlled by the EMI fingerprint counterfeit scanner 100.

[0043] In one embodiment, for some types of utility devices, the appropriate square wave may be generated by switching the power supply provided to the target utility device 105 between a high power supply state and a low power supply state to bring the target utility device 105 into a "powered" operating state (high power supply) and an "unpowered" operating state (low power supply). In one embodiment, the powered state may be a full power supply state. In one embodiment, the powered state may be a relatively higher power supply state than the low power supply state, and the unpowered state is a relatively lower power supply state than the high power supply state. In one embodiment, the unpowered state may be a power supply state with the power supply completely cut off, i.e., a "no power" power supply state. In one embodiment, the unpowered state may be an "idle" power supply state, where the power supplied to the target utility device 105 is the minimum power required to maintain operation of the target utility device 105 at the lowest possible power level. In this configuration, the test sequence generator 245 is installed in line between the power source 250 and the target utility device 105 and controls the supply of power from the power source 250 to the target utility device 105. The test sequence generator is configured to provide test sequences of high and low power supplies to the target utility device 105 according to instructions for the test sequences to energize and de-energize the target utility device 105.

[0044] In another embodiment, for some types of utility devices, the appropriate square wave may be generated by switching the load on the target utility device 105 between a high power consumption state and a low power consumption state to bring the target utility device 105 into a powered (high power consumption) and unpowered (low power consumption) operating state. In one embodiment, the powered state may be a full power consumption state. In one embodiment, the powered state may be a relatively higher power consumption state than the low power consumption state, and the unpowered state is a relatively lower power consumption state than the high power consumption state. In one embodiment, the unpowered state may be a power consumption state of complete removal of the load, i.e., a "no power" power consumption state. In one embodiment, the unpowered state may be an "idle" power consumption state, where the power drawn from the target utility device 105 is the minimum power required to maintain operation of the target utility device 105 at the lowest possible power level. In this alternative configuration, the test sequence generator 245 is placed in line between the target utility device 105 and ground 255 to control the power load drawn from the target utility device 105. The test sequence generator is configured to provide test sequences of high and low power consumption (loads) to the target utility device 105 according to instructions for the test sequences to energize and de-energize the target utility device 105 .

[0045] In one embodiment, the test sequence generator 245 can be added to an initial power-on self-test staging area. Utility assets are generally unpackaged and therefore first powered on in POST testing before being installed in a production system. Therefore, a convenient time to perform an EMI fingerprint counterfeit scan is while the target utility device is being set up for POST testing. In one embodiment, a test sequence is applied to the target utility device while the target utility device is being set up in the staging area for testing.

[0046] Exemplary Configuration Discovery and Forgery Detection Methods In one embodiment, one or more steps of the methods described herein may be performed by one or more computing device processors (such as processor 1710 shown and described with reference to FIG. 17 ) configured with logic to (i) access memory (such as memory 1715 and / or other computing device components shown and described with reference to FIG. 17 ) and (ii) cause the system to perform the method steps (such as utility asset configuration discovery and counterfeit detection logic 1730 shown and described with reference to FIG. 17 ). For example, the processor accesses the memory and reads and writes to the memory to perform the computer-implemented method steps described herein. These steps may include (i) retrieving any required information, (ii) calculating, determining, generating, classifying or creating any data, and (iii) storing any calculated, determined, generated, classified or created data. References to storage or storing refer to storage as a data structure in a memory of a computing device or in a storage / disk (such as memory 1715 or storage / disk 1735 of computing device 1705 or remote computer 1765 shown and described with reference to FIG. 17). In one embodiment, a subsequent step of the method may commence in response to parsing a received signal or retrieved stored data indicating that a previous step has been performed, at least to the extent necessary for the subsequent step to commence. Generally, a received signal or retrieved stored data indicates completion of a previous step.

[0047] 3 illustrates one embodiment of a method 300 associated with utility asset configuration discovery and counterfeit detection. Method 300 is a method for detecting whether a target utility device including multiple electronic components is genuine or suspected to be counterfeit (e.g., includes at least one counterfeit component).

[0048] Method 300 may be initiated based on a variety of triggers, such as (i) receiving a signal over a network indicating that a user (or administrator) of the EMI fingerprint counterfeit scanner has initiated method 300, or parsing stored data indicating that a user (or administrator) of the EMI fingerprint counterfeit scanner has initiated method 300, or (ii) other triggers. Method 300 begins at start block 305 in response to parsing a received signal or retrieved stored data to determine that the signal or stored data indicates that method 300 should begin. Processing proceeds to process block 310.

[0049] At process block 310, the system executes a test sequence that powers and unpowers a particular model of target device to collect electromagnetic interference (EMI) signals emitted by the target device while powered and unpowered. Processing at process block 310 is then complete and processing proceeds to process block 315.

[0050] At process block 315, the system generates a target EMI fingerprint from the EMI signals collected while the target device is powered and unpowered. Processing at process block 315 is complete and processing proceeds to process block 320.

[0051] At process block 320, the system retrieves a plurality of reference EMI fingerprints from the database library, each of which corresponds to a different configuration of electronic components of a genuine device of the same particular model as the target device, and each of which is generated from reference EMI signals collected during power-on and power-off sequences for the corresponding configuration of the genuine device. Processing at process block 320 is complete and processing proceeds to process block 325.

[0052] At process block 325, the system iteratively compares the target EMI fingerprint to each of the reference EMI fingerprints in the plurality of reference EMI fingerprints to generate a similarity metric between each compared pair of the target EMI fingerprint and each of the reference EMI fingerprints. Processing at process block 325 is complete and processing proceeds to decision block 330.

[0053] At decision block 330, the system determines whether the similarity metric for any individual reference EMI fingerprint satisfies a threshold test. If the similarity metric for any individual reference EMI fingerprint satisfies the threshold test (YES), processing at decision block 330 is complete and processing proceeds to process block 335. If the similarity metric for any individual reference EMI fingerprint does not satisfy the threshold test (NO), processing at decision block 330 is complete and processing proceeds to process block 340.

[0054] At process block 335, the system generates a signal indicating that the target device is a genuine device. Upon completion of processing at process block 335, processing proceeds to end block 345 where process 300 ends.

[0055] At process block 340, the system generates a signal indicating that the target device is a suspected counterfeit device. Processing at process block 335 is complete and processing proceeds to end block 345 where process 300 ends.

[0056] Each of the above process blocks of method 300 is described in further detail below. --Run the test sequence and collect the signal-- Referring again to process block 310, in one embodiment, a test sequence for powering and de-powering a particular model of target device is performed, for example, by the test sequence generator 245. In one embodiment, the test sequence for powering and de-powering the target device includes multiple powering or de-powering. In one embodiment, the test sequence cycles between approximately equal portions of (i) providing a high power supply or load to bring the target device to a powered state and (ii) providing a low power supply or load to bring the target device to a de-powered state. In one embodiment, a test sequence having a cycle of 30 seconds of high power supply or load (powered) to the target device and 30 seconds of low power supply or load (de-powered) to the target device would be appropriate. In other embodiments, other test sequences, for example, having shorter or longer powering / de-powering periods or unequal powering / de-powering periods, would be appropriate. In one embodiment, the test sequence generator is configured to automatically control the power or load to alternately power and de-power the target device in a repeatable test sequence.

[0057] In one embodiment in which the test sequence generator 245 controls the power supply to the target devices, the test sequence generator 245 provides high and low power from the power source 250 to an input (such as one of the primary terminals of a transformer) for energizing and de-energizing the target devices, respectively, in a test sequence. For example, power to the target devices is alternately provided and interrupted in a repeated cycle. In another embodiment in which the test sequence generator 245 controls the power load drawn from the target devices, the test sequence generator 245 provides high and low power loads to an output (such as one of the secondary terminals of a transformer) for energizing and de-energizing the target devices, respectively, in a test sequence. For example, the load to the target devices is alternately provided and interrupted in a repeated cycle.

[0058] In one embodiment, the test sequence performed on the target device in process block 310 is the same as the test sequence originally performed on the reference device to generate each of the reference EMI fingerprints - in other words, the same test sequence is used to generate both the reference EMI fingerprint and the target EMI fingerprint.

[0059] Still referring to process block 310, in one embodiment, the antenna 115 and radio 120 collect electromagnetic interference (EMI) signals emitted by the target device during powering and de-powering performed by the test sequence generator 245. In one embodiment, the EMI fingerprint counterfeit scanner 100 is configured to collect electromagnetic interference (EMI) signals emitted by the target device using the software defined radio 120 and antenna 115 while the target device is powered and de-powered in a repeatable test sequence. The antenna may be positioned as described above with reference to FIG. 1 during collection of the EMI signals. The collection of EMI signals from the target device may be referred to as "scanning" the target device. The EMI signals are collected from the target device while the target device is both powered and de-powered. For example, collecting EMI signals emitted from the target device during powering and de-powering includes collecting a first set of EMI signals while the target device is powered and collecting a second set of EMI signals while the target device is de-powered. In other words, the continuous time series signal includes a "top" of the square wave (representing a high power or energized state) and a "bottom" of the square wave (representing a low power or unenergized state). When the target utility device is turned off, the bottom of the square wave will be zero. When the target utility device is switched to "idle", the bottom of the square wave will be non-zero but in some low power state. However, regardless of the nature of the EMI signal collected for the bottom of the square wave, the entire collected square wave sequence for the target EMI signal, both the top and bottom, will be included in the target EMI fingerprint. The target EMI fingerprint is generated from a combination of the first set of EMI signals and the second set of EMI signals. The second set of EMI signals may be useful to generate an EMI fingerprint even when the target utility device is turned off in a low power state because the target device may continue to generate EMI signals even after the power to the utility device is interrupted.Therefore, when generating the target EMI fingerprint, the bottom of the square wave is treated exactly the same as the top of the square wave: all of the periodic repetitions of the top and bottom are included in one long time series that spans the test sequence.

[0060] --Generate a fingerprint-- Referring again to process block 315, in one embodiment, the system generates a target EMI fingerprint from EMI signals collected while the target device is powered and unpowered. As noted above, in one embodiment, the collected signals include EMI signals collected while the target device is in a powered state as well as EMI signals collected while the target device is in an unpowered state.

[0061] 4 illustrates one embodiment of a method 400 associated with generating an EMI fingerprint from EMI signals collected while a utility device is energized and de-energized, such as process block 315 of method 300. It should be noted that both the target EMI fingerprint of a target utility device and the reference EMI fingerprint of a reference (confirmed to be authentic) utility device may be generated from collected EMI signals in a similar manner. Method 400 begins at start block 405 in response to parsing a received signal or retrieved stored data indicating that method 400 should begin.

[0062] At process block 410, the system divides the frequency range associated with the collected EMI signal into a number of "bins" with each individual bin represented by a representative frequency value. In one embodiment, the frequency bins and associated frequency values ​​are equally spaced. In one embodiment, the bins and representative frequencies are stored in local data storage 150 or data store 235. Processing at process block 410 is complete and processing proceeds to process block 415.

[0063] At process block 415, the system extracts amplitude-time pairs for each representative frequency value at regular time intervals (such as once per second) to form an amplitude-time series for that representative frequency. In one embodiment, the amplitude-time pairs can be retrieved from a data structure of recorded signals stored in local data storage 150, and the resulting time series can be stored in local data storage 150 or data store 235. Processing at process block 415 is complete and processing proceeds to process block 420.

[0064] At process block 420, the system selects a subset of N representative frequency values ​​associated with the strongest power spectral frequencies. Signals with the highest signal-to-noise ratios generally have the highest peaks on a power spectral density (PSD) plot. In one embodiment, a transform such as a Fast Fourier Transform (FFT) is performed on the amplitude-time series of each representative frequency. These representative frequencies are ranked in order of the transform result, ranking the representative frequencies in order of peak height. The top N representatives with the highest peaks are selected. In one embodiment of the present invention, N is typically 20 or less. These N selected frequencies may be referred to as "signature frequencies." In one embodiment, an indicator of the signature frequencies may be stored in local data storage 150 or data store 235. Processing at process block 420 is complete and processing proceeds to process block 425.

[0065] At process block 425, the system generates an EMI fingerprint using the amplitude-time series associated with the signature frequencies. In one embodiment, the generated EMI fingerprint is stored in local data storage 150 or data store 235. Upon completion of processing at process block 425, processing proceeds to end block 430 where process 400 ends.

[0066] -Search for standard EMI fingerprints- Referring back to method 300, at process block 320, the system retrieves a number of reference EMI fingerprints from a database library. In one embodiment, the database library is a repository of reference EMI fingerprints for all possible valid permutation part configurations of all authentic makes and models of reference utility devices. For each make, model, and configuration, a reference EMI fingerprint is created by executing test sequences on a utility device that is authenticated, confirmed, or known to be an authentic example of that make, model, and configuration of the utility device, and collecting EMI signals emanating from that utility device. The resulting EMI fingerprints are then stored in the database library with reference to the make, model, and configuration of the utility device. In one embodiment, the database library is managed remotely, such as on a cloud server, for example in the data store 235. The EMI fingerprint counterfeit scanner 100 initiates the search with a request (e.g., a REST request) to the web interface server 220 to retrieve the reference EMI fingerprints from the data store 235. The web interface server 220 retrieves the reference EMI fingerprints from the data store 235 and returns the reference EMI fingerprints when a REST request is sent to the network interface 160 of the EMI fingerprint counterfeit scanner 100. In another embodiment, the database library is maintained in the local data storage 150 of the EMI fingerprint counterfeit scanner 100. The EMI fingerprint counterfeit scanner 100 generates and executes commands to retrieve the reference EMI fingerprints from the local data storage 150. The locally managed database library may be updated from time to time compared to the cloud-managed database library.

[0067] In one embodiment, the EMI fingerprint counterfeit scanner 100 is configured to retrieve a number of reference EMI fingerprints from a data store, in one embodiment, the reference EMI fingerprints correspond to authentic reference devices of a particular model and further correspond to individual configurations of electronic components of the authentic reference devices of a particular model.

[0068] -Pre-classification of target utility devices- In one embodiment, similar utility devices may exhibit similar characteristics detectable by sensor component 130. As noted above, there may be many component configurations of a given make-model utility device. Different makes, models and component configurations of utility devices may have completely different transducer sets and different numbers of sensors, but it is the general patterns that the utility devices exhibit that are relevant to configuration discovery. The information detected by sensor component 130 and provided to telemetry collector 125 enables the EMI fingerprint counterfeit scanner to determine one or more of the following:

[0069] 1. (i) Rate of change of individual gases per external ambient temperature and (ii) per load signature (from winding current) 2. Temperature signal, e.g., internal temperature sensor reading - delta in external ambient temperature per load signature 3. A moving window partial discharge correlation coefficient of the partial discharge signal (if available) compared to a bivariate function of the ambient temperature and load signature, and 4. Normalized ratios of other signals that show pre-failure trends in utility devices exposed to degradation in this field, but do not show the same patterns in healthy assets. For example, a first make and model utility device may operate at 80-100°C, while a second make and model utility device may operate at 150-200°C. These physical characteristics can be detected by the sensor components 130 to prove that these two types have completely different properties. Thus, based on one or more of the sensor telemetry signals and the metrics derived therefrom, a wide variety of utility device makes, models and component configurations can be classified as shown in FIG. 5. FIG. 5 illustrates an example utility device 505 having different makes / models pre-classified into similar make and model categories 510 using the sensor telemetry signals.

[0070] In one embodiment, the target utility device can thus be pre-classified as belonging to a particular make and model subset of the set of all possible types of makes, models and component configurations based on the sensor telemetry readings. This reduces the number of reference EMI fingerprints that need to be searched and compared to the target EMI fingerprint. This reduction in the number of reference EMI fingerprints for comparison may be very significant. For example, if a database library contains tens of thousands of reference EMI fingerprints, the ability to identify the target utility device as belonging to a particular make and model reduces the number of reference EMI fingerprints for comparison to only select the few associated with that make and model. This reduction in the number of comparisons significantly reduces the time required to identify the target utility device as genuine or suspected counterfeit, and also reduces the search processing load on the cloud application infrastructure 225.

[0071] 6 illustrates one embodiment of a method 600 associated with pre-classifying target utility devices based on sensor telemetry signals. Method 600 may be initiated based on a variety of triggers, such as, for example, receiving a signal over a network indicating that a user of EMI fingerprint counterfeit scanner 100 has initiated method 600, or, for example, parsing stored data indicating that a user of EMI fingerprint counterfeit scanner 100 has initiated method 600. Method 600 begins at start block 605 in response to a trigger indicating that method 600 should begin. Processing proceeds to process block 610.

[0072] At process block 610, the system receives telemetry signals from a sensor component of a target device. In one embodiment, the EMI fingerprint counterfeit scanner 100 receives telemetry signals from the sensor component 130 via the telemetry collector 125. Processing at process block 610 is complete and processing proceeds to process block 615.

[0073] At process block 615, the system classifies the target device as being of a particular model of target device based on the telemetry signal. In one embodiment, the system trains a machine learning model (multivariate state estimation technique (hereinafter denoted by "MSET")) on the sensor telemetry information for the real utility device that is labeled as being the make and model of the detected utility device. The sensor telemetry signal received from the target utility device is provided to the trained machine learning model to assign the make and model. In one embodiment, the reference EMI fingerprints retrieved from the database library are limited to those applicable to the identified make and model. In other words, the retrieval of the multiple reference EMI fingerprints from the database library (at process block 320 of method 300) is based on the classification of the target device. Processing at process block 615 is completed and processing proceeds to end block 620 where process 600 ends.

[0074] The above sensor telemetry pre-classification analysis is a convenient front-end pre-processing that significantly reduces the number of reference EMI fingerprints that need to be repeatedly compared with target EMI fingerprints, thereby reducing the time and computational burden required for automatic configuration discovery for counterfeit detection.

[0075] -Repeatedly comparing EMI fingerprints- Referring again to process blocks 325-340, the system iteratively compares the target EMI fingerprint to each of the reference EMI fingerprints in the plurality of reference EMI fingerprints to generate a similarity metric between each compared pair of the target EMI fingerprint and each of the reference EMI fingerprints. In one embodiment, each of the M reference EMI fingerprints is compared in turn to the target EMI fingerprint. This comparison process continues until (i) a respective reference EMI fingerprint is found where the generated similarity metric satisfies a threshold test, or (ii) after comparing the target EMI fingerprint to each of the M reference EMI fingerprints, the similarity metric does not satisfy the threshold test. Satisfying the threshold test means that the target EMI fingerprint and the reference EMI fingerprint match, and not satisfying the threshold test means that the target EMI fingerprint and the reference EMI fingerprint do not match.

[0076] In one embodiment, multiple target EMI fingerprints from multiple target utility devices have been obtained, for example in a process where an EMI fingerprint scan is completed for multiple target devices and then stored for subsequent batch processing. The M reference EMI fingerprints and the N target EMI fingerprints are paired through a permutation operation that systematically takes into account all possible reference-target pairs. As above, a similarity metric is generated for each comparison, where meeting a threshold test indicates a match and failure to meet indicates a mismatch between the compared EMI fingerprints.

[0077] If the similarity metric is satisfied by any of the reference EMI fingerprints, the system generates a signal that the target device has been verified to be a genuine and authentic device. If the similarity metric is not satisfied by any of the reference EMI fingerprints, the system generates a signal that the target device may be counterfeit, or at least built in a configuration that does not have an EMI fingerprint in the database library.

[0078] It should be noted that failure to satisfy the similarity metric and the resulting signal that the target device may be counterfeit does not necessarily mean that the entire target device is comprised of counterfeit parts. Instead, it means that the target device is suspected of containing one or more counterfeit parts. While in some circumstances the entire target device may be counterfeit, it is more likely that the target device only has one or a few internal counterfeit parts. This may be especially true when the target device is a large system of many parts. In this specification, the target utility device may be referred to as "suspected / suspected counterfeit" as shorthand for "suspected of containing one or more counterfeit parts."

[0079] In one embodiment, the EMI fingerprint counterfeit scanner 100 is configured to (i) generate and display on a graphical user interface a visual indication that the target device is authentic if the similarity metric for any individual reference EMI fingerprint satisfies a threshold test, and (ii) generate and display on a graphical user interface a visual indication that the target device is suspect or counterfeit if the similarity metric for any individual reference EMI fingerprint does not satisfy the threshold test.

[0080] In one embodiment, this visual display may include displaying a make, model, and part configuration description on a graphical user interface. This may be as simple as displaying the make, model, and configuration number or vintage information of the target utility device. Or, the description may include additional information about the particular configuration of the target utility device.

[0081] In one embodiment, a "green light" alert is displayed when each target utility device (UUT) is proven to have no internal counterfeit parts. Alternatively, a "red light alarm" is displayed when a target utility device (UUT) is suspected of having one or more internal counterfeits. The system may flag target utility devices (UUTs) for subsequent detailed analysis by service and security staff, for example, by storing the flag as a data structure in data store 235.

[0082] In one embodiment, if the signal indicates that the target device is a genuine device, the system displays a visual indication on the graphical user interface that the target device is genuine. For example, this visual indication may be a large green icon indicating that the target utility device is "genuine," "authentic," "verified," or other wording indicating that the target EMI fingerprint for the target utility device matches the reference EMI fingerprint for a genuine device.

[0083] The alarm also activates for authentic systems that do not yet have a reference (GS) EMI fingerprint in the database library. The make / model / configuration scanned from this target utility device can then be added to the reference (GS) EMI fingerprint for that make and model in the database library. Normally, this situation is not expected, since the utility device rollout procedure involves uploading a reference (GS) EMI fingerprint to the database library for each new part configuration introduced. Thus, it is much more likely that a red light alarm will signal a safety concern. However, it is useful that this system also allows for a quick correction in the case of failure to include a reference (GS) EMI fingerprint in the database library. Additionally, if there is a process or business failure that prevents an acceptable configuration from becoming the latest update to the database library of reference (GS) EMI fingerprints, it will be caught during this step.

[0084] -Signal alignment for EMI fingerprint comparison- When comparing the target EMI fingerprint with the reference EMI fingerprint, the signals being compared should be pre-processed (e.g., cleaned) and aligned to avoid false positive detection of a potentially counterfeit utility device. FIG. 7 illustrates a reference waveform ("golden system" or "GS") (top) 705 along with a target waveform ("unit under test" or "UUT") (bottom) 710 for one exemplary signature frequency of an EMI fingerprint. The reference waveform 705 and the target waveform 710 are shown here for comparison before any signal cleaning process and alignment. Values ​​on the x-axis of the waveform plot are shown in units of the number of samples taken of the EMI signal, and values ​​on the y-axis are shown in units of decibel-milliwatts (dBm). The sampling rate is consistent between the reference EMI fingerprint and the target EMI fingerprint. The roughly square wave pattern of the power signal plotted in FIG. 7 is due to the on / off, energized / de-energized, high power / low (no) power operation of the reference and target utility devices according to the test sequence.

[0085] In one embodiment, signal quality and alignment are improved by trimming the target signal to an optimal length. FIG. 8 illustrates identical EMI fingerprint signature frequencies in both the reference and target EMI fingerprints after automatic edge detection has been applied to trim the signal vector to an optimal length that starts and ends at the high amplitude transitions in the fingerprint signature. This trimming roughly aligns the reference and target signals. This alignment prevents undesirable spikes in the residual between the EMI fingerprints near the transition between high and low amplitude states. Note that the reference (GS) signal (top) 805 is out of phase with the target (UUT) signal (bottom) 810. This phase shift is visible when inspecting the sample point domains of both signals (along the x-axis). This out-of-phase alignment is unavoidable since the scan is manually actuated by a human scanning the target utility device. Thus, in one embodiment, the system (i) trims the target (collected) EMI signal to an optimal length for comparison to one or more of the reference EMI fingerprints, (ii) trims the reference EMI signal to an optimal length for comparison to the target (collected) EMI signal, or (iii) trims both the target (collected) EMI signal and the reference EMI fingerprints to optimal lengths for comparison to each other.

[0086] In one embodiment, the phase alignment is further improved and the phase shift is corrected by applying a phase shift synchronization such as Oracle Labs' Analytical Resampling Process (ARP). FIG. 9 illustrates the effect of optimal synchronization using ARP on the reference (GS) signal and the target (UUT) signal. The original reference (GS) signal and the target (UUT) signal are shown plotted on the same axis (top) 905 to show how significantly the two signals are out of alignment. The reference (GS) signal and the target (UUT) signal are also shown plotted on the same axis (bottom) 910 after ARP is applied to show how the two signals are actually synchronized. Thus, the stored time series EMI signals of the reference (GS) utility device and the target (UUT) are optimally synchronized by ARP. Thus, in one embodiment, the system synchronizes the first phase of the target (collected) EMI signal with the second phase of one of the reference EMI fingerprints.

[0087] Recall that each signature frequency is one of the top N frequency bins with the highest signal-to-noise ratio selected to be included in the EMI fingerprint as being the most informative. In one embodiment, N=20 bins are selected to represent the 3D EMI fingerprint of each system. However, the framework is flexible and can be extended to a larger or smaller number of bins. In practice, N=20 bins work well. The signal cleaning and alignment process, including trimming of the signal vector as described with reference to FIG. 8 and phase shift synchronization as described with reference to FIG. 9, is repeated in an iterative loop for all N signature frequencies (top frequency bins) of the EMI fingerprint. Each pair of reference (GS) and target (UUT) signals for the signature frequency is trimmed and phase shifted to ensure a more accurate comparison of the reference and target EMI fingerprints.

[0088] -EMI Fingerprint Surface Mean Absolute Error - Similarity Metric - An autonomous similarity metric or "similar" metric called EMI Fingerprint Surface Mean Absolute Error (EMIF SAME or SMAE) is introduced herein to rapidly infer unknown configurations of target utility devices. In one embodiment, the similarity metric described with reference to method 300 is the EMI Fingerprint Surface Mean Absolute Error. SMAE and its component Mean Absolute Error (MAE) are quantitative numerical metrics for the differentiation of three-dimensional surfaces. SMAE enables automated empirical selection of the exact authentic configuration of the target utility device to be scanned, without requiring interaction / distraction of the user of the system.

[0089] A human visual comparison between two 3D EMI fingerprint surfaces only results in a qualitative comparison of similarity. This qualitative comparison is an inconsistent indicator of whether the reference (GS) utility device and the target (UUT) are in a love-love or love-dislike configuration. Furthermore, human visual comparison does not scale. Humans do not have the ability to handle increasing amounts of work by adding resources to the system. Here, we introduce a quantitative metric called the Mean Absolute Error (MAE) applied to the individual signals after trimming and phase shift synchronization described above, and then introduce the Surface MAE (SMAE), which is the sum over the 3D surface of the EMI fingerprint for all N signature frequencies selected to represent the asset "fingerprint".

[0090] In one embodiment, the similarity metric is based on the mean absolute error over a particular set of frequencies between the reference EMI fingerprint and the target EMI fingerprint.

[0091] The mean absolute error MAE between the reference signal and the target signal at the signature frequency can be expressed by the following equation:

[0092]

number

[0093] where M is the total number of amplitude-time pairs that make up the amplitude-time series for the signature frequency (the length of the target signal), i is a subscript, y is the value of the reference signal at subscript i, and x is the value of the target signal at subscript i.

[0094] The surface mean absolute error SMAE across each signature frequency of the fingerprint can be expressed by the following equation:

[0095]

number

[0096] where N is the total number of signature frequencies in the EMI fingerprint and j is the subscript. Therefore, the entire square wave time series for the target (UUT) EMI fingerprint is subtracted from the entire square wave time series for the reference (GS) EMI fingerprint to calculate the surface MAE.

[0097] FIG. 10 illustrates exemplary untrimmed residuals 1005 and trimmed residuals 1010 for exemplary raw signals for contrasting signal comparison metrics. The residuals between the reference (GS) and target (UUT) EMI signals before and after ARP synchronization is applied (top) are the metrics used to determine correlation between the signals. The MAE is a scalar representation of the residuals of the individual time series signals, and the SMAE is a scalar value used to determine cumulative correlation between the signals (bottom). As can be inferred from the diagram, phase differences can falsely indicate differences between signals, and ARP substantially improves all of the MAE metrics of the individual signals, here accurately identifying similarities between 3D EMIFs in pairwise comparisons for all permutations of the reference (GS) and target (UUT) EMI signals.

[0098] The bin and surface residuals are characterized by the MAE and SMAE before and after the trimming operation and ARP optimal synchronization. Note that the original pre-trimming SMAE 1015 is large, nearly 560. By trimming the signal, the SMAE is reduced to 272 as shown in the pre-ARP characterization 1020. The final optimized similarity metric 1025 shows an SMAE of only 6. For this example data, these improvements reduce the raw SMAE from 560 to 6. This provides an indication of the size of the threshold that may be set for the comparison between the target and reference EMI fingerprints.

[0099] - Exemplary automatic type-model configuration discovery for counterfeit detection In one embodiment, for each particular frequency in the reference EMI fingerprint, the similarity metric is generated by generating residuals between the MSET estimates of the reference amplitude-time series signal at the particular frequency in the reference EMI fingerprint and the target amplitude-time series signal at the particular frequency in the target EMI fingerprint, and combining the generated residuals to generate a similarity metric.

[0100] FIG. 11(a) illustrates one embodiment of an overview and procedure 1100 of automatic type-model configuration discovery for counterfeit detection techniques. FIG. 11(b) illustrates one embodiment of a method for MSET-based MAE characterization. The modules in FIG. 11(a) and FIG. 11(b) are further described in the following numbered steps.

[0101] 1. Power up / power down (1103, 1105 and 1107) utility assets (also referred to herein as “utility devices” having various variants of square wave signatures from which N 15 minute periods of conventional sensor telemetry signals can be collected).

[0102] 2. Classify utility asset types / models via any single scalar-based metric (e.g., MAE) (1109).

[0103] 3. The classified system having M configurations is analyzed by performing a scope scan to result in M ​​EMI fingerprints, which are stored in a reference (GS) EMI fingerprint library. To reduce the signal-to-noise ratio (SNR), the fine-grained RF frequencies comprising each EMIF (in the preferred embodiment, 4000 fine bin frequencies) are further subgrouped into 100 coarse frequency bins (1111, 1151-1161).

[0104] 4. From the 100 bins, the 20 best frequency bins are determined whose time series EMI content exhibits significant periodicity in the frequency domain. This significant periodicity reflects the load dynamics on the target utility asset (UUT). In one embodiment, the 20 best frequency bins are. These reference frequency bins are then left unchanged (1163) for the remainder of the operation.

[0105] 5. The target utility assets (UUTs) are also classified by traditional telemetry and then analyzed by scope scanning (1113, 1115), the fine frequency bins are again coalesced into 100 coarse frequency bins, and then the same 20 best frequencies previously determined for the standard (GS) are used on each target utility asset (UUT) to be scanned (1111, 1151-1161). A pre-stored GS library of configuration EMIFs corresponding to the make / model of the UUT is retrieved from the database library.

[0106] 6. The M reference (GS) EMI fingerprints and the N target (UUT) EMI fingerprints are paired through a permutation operation that systematically takes into account all possible reference-target (GS-UUT) pairs. iThe MSET model is constructed by training 20 frequency bins for the target UUT. j MSET estimates are generated for 20 frequency bins for MSET-UUT j results in (1175).

[0107] 7. Correspondingly, G.S. i and MSET-UUT j The 20 frequency bins for both are merged again resulting in two time-synchronized EMI surfaces (1177).

[0108] 8. The two EMI surfaces are processed by a 2D surface subtraction operation, resulting in a noisy 2D residual surface in 3D space (1181) (example visual image below), and the MAE is calculated from this residual surface and recorded (1183).

[0109] 9. GS i and UUT j Steps 6-8 are parametrically repeated over all possible pairs of EMIFs (1157-1189 defining a loop).

[0110] 10. A pair of reference (GS) and target (UUT) with a high MAE value suggests that the two systems are different (illustrated in FIG. 12), while a pair with a low MAE value means that they are identical (illustrated in FIG. 13).

[0111] 12 illustrates an example 3D EMI residual surface 1200 generated by a comparison of two different utility devices. Subtraction and merging operations between EMI fingerprints for two different utility devices are performed over 20 time-synchronized frequency bins to produce a residual surface with high variance. The MAE or SMAE calculated from this surface will be high.

[0112] 13 illustrates an exemplary 3D EMI residual surface 1300 generated by comparing two similar (or identical) utility devices. Subtraction, merging and synchronization operations between the EMI fingerprints for the two identical (or similar) utility devices are performed bin-by-bin for 20 time-synchronized frequency bins and then aggregated across the surface to produce a substantially flat residual surface with low variance. The MAE or SMAE calculated from this surface will be low.

[0113] 14 illustrates an example EMI signal residual 1400 between two different utility devices across one of the 20 frequency bins that make up the 3D EMI residual surface 1200. In one embodiment, anomalies in the residual versus the corresponding stored GS frequency time series are found and identified by MSET. MSET anomaly alerts are indicated by dots all having a logical 1 value indicating an anomaly alert for this residual (see y-scale on the right). The EMI signal residual 1400 is identified by MSET to be in an anomaly state all the time, as indicated by the solid line of dots at logical 1 1 1405.

[0114] No anomaly vs. corresponding stored GS frequency time series signal, there is no anomaly in the MSET result (logic value 0).

[0115] 15 illustrates an example EMI signal residual 1500 between two similar (or identical) utility devices across one of the 20 frequency bins that make up the 3D EMI residual surface 1300. No obvious anomalies are visually found in the 3D residual surface. This is confirmed by MSET. The absence of anomaly alerts is indicated by the dots all having a logical value of 0 (see y-scale on the right). MSET determines that the EMI signal residual 1500 is always in a non-anomalous (or compliant) state, as indicated by the solid line of dots at logical value 0.

[0116] -Graphical User Interface- FIG. 16 illustrates two views of one embodiment of a graphical user interface used in conjunction with the display 165 of the EMI fingerprint counterfeit scanner 100 to visually display the results of an EMI fingerprint scan of a target utility device.

[0117] In one embodiment, a "fail" indication 1600 may be displayed if the result signal indicates that the target utility device is not in a known valid configuration. In one embodiment, the "fail" indication 1600 includes a large visual indicator 1605, which may be a red octagon, indicating that the target device is suspected to be counterfeit (contains at least one counterfeit component). In one embodiment, the "fail" indication 1600 may also include a scan result summary 1610.

[0118] In one embodiment, a "success" indication 1650 may be displayed if the result signal indicates that the target utility device is of a known valid configuration. In one embodiment, the "success" indication 1650 includes a large visual indicator 1655, which may be a green circle, indicating that the target device is a genuine device. In one embodiment, the "success" indication 1650 may also include a scan results summary 1610, which may include make, model and configuration number or vintage information of the target utility device.

[0119] In one embodiment, the system further generates and displays on the graphical user interface a visual image 1675 of the 3D residual surface based on one of the reference EMI fingerprints and the target EMI fingerprint. In another embodiment, any type of visual image may be displayed on the graphical user interface, including those described with reference to Figures 12-15. This may provide the user with further information as to why the target device was or was not confirmed as authentic.

[0120] -Cloud or enterprise implementation- In one embodiment, the database library and / or other system portions shown and described herein are computing / data processing systems that include database applications or collections of distributed database applications. The applications and data processing systems may be configured to operate or be implemented as a cloud-based networking system, a Software-as-a-Service (SaaS) architecture, a Platform-as-a-Service (PaaS) architecture, an Infrastructure-as-a-Service (IaaS) architecture, or other type of networked computing solution. In one embodiment, the cloud computing system is a server-side system that provides one or more of the functions disclosed herein and is accessible by many users via the EMI fingerprint counterfeit scanner 100 or other client computing devices that communicate with the cloud computing system (which acts as a server) over a computer network.

[0121] -Computing device embodiment- FIG. 17 illustrates an exemplary computing device 1700 configured and / or programmed with one or more of the exemplary systems and methods described herein and / or their equivalents. The exemplary computing device may be a computer 1705 including a processor 1710, a memory 1715, and input / output ports 1720 operatively connected by a bus 1725. In one example, the computer 1705 may include utility asset configuration discovery and counterfeit detection logic 1730 configured to facilitate utility asset configuration discovery and counterfeit detection similar to the logic and systems illustrated in FIGS. 1-16. In other examples, the logic 1730 may be implemented in hardware, a non-transitory computer readable medium having stored instructions, firmware, and / or combinations thereof. Although the logic 1730 is illustrated as a hardware component attached to the bus 1725, it should be understood that in other embodiments, the logic 1730 may be executed in the processor 1710, stored in the memory 1715, or stored on a disk 1735.

[0122] In one embodiment, logic 1730 or a computer is a means (e.g., structure: hardware, non-transitory computer readable medium, firmware) for performing the actions described. In some embodiments, the computing device may be a server operating in a cloud computing system, a server configured in a Software as a Service (SaaS) architecture, a smartphone, a laptop, a tablet computing device, etc.

[0123] The means may be implemented, for example, as an ASIC programmed for utility asset configuration discovery and counterfeit detection, or as stored computer-executable instructions provided to computer 1705 as data 1740 that are temporarily stored in memory 1715 and then executed by processor 1710.

[0124] The logic 1730 may also provide the means (e.g., hardware, non-transitory computer-readable medium storing executable instructions, firmware) for performing utility asset configuration discovery and counterfeit detection.

[0125] To broadly describe an exemplary configuration of computer 1705, processor 1710 may be a variety of different processors, including dual microprocessors and other multi-processor architectures. Memory 1715 may include volatile and / or non-volatile memory. Non-volatile memory may include, for example, ROM, PROM, etc. Volatile memory may include, for example, RAM, SRAM, DRAM, etc.

[0126] The storage disk 1735 may be operatively connected to the computer 1700, for example, via an input / output (I / O) interface (e.g., card, device) 1745 and an input / output port 1720. The disk 1735 may be, for example, a magnetic disk drive, a solid state disk drive, a floppy disk drive, a tape drive, a zip drive, a flash memory card, a memory stick, etc. Furthermore, the disk 1735 may be a CD-ROM drive, a CD-R drive, a CD-RW drive, a DVD ROM, etc. The memory 1715 may store, for example, processes 1750 and / or data 1740. The disk 1735 and / or the memory 1715 may store an operating system that controls and allocates resources of the computer 1705.

[0127] The computer 1705 may interact with input / output (I / O) devices via an I / O interface 1745 and input / output ports 1720. The input / output devices may be, for example, a keyboard 1780, a microphone 1784, a pointing and selection device 1782, a camera 1786, a video card, a display 1770, a scanner 1788, a printer 1772, speakers 1774, a disk 1735, a network device 1755, etc. The input / output ports 1720 may include, for example, serial ports, parallel ports, and USB ports. The input / output devices may include a software defined radio 1790 and associated antenna 1792.

[0128] The computer 1705 can operate in a networked environment and thus can be connected to a network device 1755 via the I / O interface 1745 and / or the I / O port 1720. Through the network device 1755, the computer 1705 can interact with a network 1760. Through the network 1760, the computer 1705 can be logically connected to a remote computer 1765. The networks with which the computer 1705 can interact include, but are not limited to, a LAN, a WAN, and other networks.

[0129] -Definitions and other embodiments- In another embodiment, the described methods and / or their equivalents may be implemented with computer executable instructions. Thus, in one embodiment, a non-transitory computer readable / storage medium is configured with stored computer executable instructions of an algorithm / executable application that, when executed by the machine, causes the machine (and / or associated components) to perform the method. Exemplary machines include, but are not limited to, processors, computers, servers operating in a cloud computing system, servers configured in a Software-as-a-Service (SaaS) architecture, smartphones, etc. In one embodiment, a computing device is implemented with one or more executable algorithms configured to perform any of the disclosed methods.

[0130] In one or more embodiments, the disclosed methods or their equivalents are performed by either computer hardware configured to perform the methods, or by computer instructions embodied in modules stored on a non-transitory computer-readable medium, the instructions being configured as executable algorithms configured to perform the methods when executed by at least a processor of a computing device.

[0131] For ease of explanation, the methodologies illustrated in the figures are shown and described as a series of algorithmic blocks, but it should be understood that these methodologies are not limited by the order of the blocks. Some blocks may occur in different orders and / or occur simultaneously with other blocks than those shown and described. Furthermore, example methodologies may be implemented using fewer than all blocks shown. The blocks may be combined or separated into multiple actions / components. Furthermore, still other and / or alternative methodologies may use still other actions not shown in the blocks.

[0132] The following contains definitions of selected terms used herein. These definitions include various examples and / or forms of components that may be used to implement those terms that fall within the scope of the terms. These examples are not intended to be limiting. Both the singular and plural forms of the terms are within the scope of the definitions.

[0133] References to "one embodiment," "embodiment," "one example," "example," etc. mean that the embodiment or example so described may include a particular feature, structure, characteristic, property, element, or limitation, but not all embodiments or examples necessarily include that particular feature, structure, characteristic, property, element, or limitation. Moreover, repeated use of the phrase "in one embodiment" may, but does not necessarily, refer to the same embodiment.

[0134] ASIC: Application Specific Integrated Circuit CD:Compact Disc CD-R: Recordable CD CD-RW: Rewritable CD DVD: Digital Versatile Disc and / or Digital Video Disc LAN: Local Area Network RAM: Random Access Memory DRAM: Dynamic RAM SRAM: Synchronous RAM ROM: Read-only memory PROM: Programmable ROM EPROM: Erasable PROM EEPROM: Electrically Erasable PROM USB: Universal Serial Bus XML: Extensible Markup Language WAN: Wide Area Network As used herein, a "data structure" is an organization of data in a computing system, stored in a memory, storage device or other computerized system. A data structure may be, for example, any of a data field, a data file, a data array, a data record, a database, a data table, a graph, a tree, a linked list, etc. A data structure may be formed from and contain many other data structures (e.g., a database contains many data records). Other examples of data structures are possible according to other embodiments.

[0135] As used herein, "computer readable medium" or "computer storage medium" refers to a non-transitory medium that stores instructions and / or data configured to be executed to perform one or more of the disclosed functions. In some embodiments, data may function as instructions. Computer readable media may take forms including, but not limited to, non-volatile media and volatile media. Non-volatile media may include, for example, optical disks, magnetic disks, and the like. Volatile media may include, for example, semiconductor memory, dynamic memory, and the like. Common forms of computer readable media may include, but are not limited to, floppy disks, flexible disks, hard disks, magnetic tapes, other magnetic media, application specific integrated circuits (ASICs), programmable logic devices, compact disks (CDs), other optical media, random access memory (RAM), read only memory (ROM), memory chips or cards, memory sticks, solid state storage devices (SSDs), flash drives, and other media with which a computer, processor, or other electronic device may function. Each type of media may include stored instructions of an algorithm that, when selected for implementation in one embodiment, is configured to perform one or more of the functions disclosed and / or claimed.

[0136] As used herein, "logic" refers to components implemented in computer or electrical hardware, non-transitory media having stored instructions of an executable application or program module, and / or combinations thereof to perform any of the functions or actions disclosed herein and / or cause another logic, method, and / or system to perform a function or action as disclosed herein. Equivalent logic may include firmware, a microprocessor programmed with an algorithm, discrete logic (e.g., ASIC), at least one circuit, analog circuit, digital circuit, programmed logic device, memory device containing algorithmic instructions, etc., any of which may be configured to perform one or more of the disclosed functions. In an embodiment, logic may include one or more gates, combinations of gates, or other circuit components configured to perform one or more of the disclosed functions. Where multiple logics are described, it would be possible to combine these multiple logics into one logic. Similarly, where a single logic is described, it would be possible to distribute the single logic among multiple logics. In an embodiment, one or more of these logics are corresponding structures associated with performing the disclosed and / or claimed functions. The choice of what type of logic to implement may be based on desired system requirements or specifications. For example, if speed is a consideration, hardware would be selected to implement the function. If low cost is a consideration, stored instructions / executable applications would be selected to implement the function.

[0137] An "operative connection" or a connection where entities are "operatively connected" is one where signals, physical communications and / or logical communications may be transmitted and / or received. An operative connection may include a physical interface, an electrical interface and / or a data interface. An operative connection may include various combinations of interfaces and / or connections sufficient to enable operative control. For example, two entities may be operatively connected to communicate signals to each other directly or through one or more intermediate entities (e.g., a processor, an operating system, logic, non-transitory computer-readable media). Logical and / or physical communication channels may be used to create an operative connection.

[0138] As used herein, a "user" includes, but is not limited to, one or more people, computers or other devices, or a combination thereof.

[0139] Although the disclosed embodiments have been shown and described in considerable detail, it is not intended to restrict or in any way limit the scope of the appended claims to such details. It is, of course, not possible to describe every conceivable combination of components or methodologies for purposes of describing various aspects of the subject matter. As such, the present disclosure is not limited to the specific details or illustrative examples shown and described. Thus, the present disclosure is intended to embrace modifications, variations and alterations that fall within the scope of the appended claims.

[0140] The terms "includes" or "including," when used in the detailed description or the claims, are intended to be inclusive in the same manner as the term "comprising," as such terms are interpreted when used as transitional terms in the claims.

[0141] The term "or," to the extent that it is used in the detailed description or claims (e.g., A or B), is intended to mean "A or B or both." If the applicant wishes to indicate "only A or only B, but not both," the phrase "only A or only B, but not both" would be used. Thus, use of the term "or" herein is inclusive and not exclusive.

Claims

1. 1. A method for detecting whether a target device including a plurality of electronic components is genuine or suspected to be a counterfeit, comprising: executing a test sequence that energizes and de-energizes the target device of a particular model and collecting electromagnetic interference (EMI) signals emitted by the target device during the energizing and de-energizing steps; generating a target EMI fingerprint from the EMI signals collected during the powered and unpowered states of the target device; and retrieving a plurality of reference EMI fingerprints from a database library, each reference EMI fingerprint corresponding to a different configuration of electronic components of a genuine device of the particular model identical to the target device, each reference EMI fingerprint being generated from reference EMI signals collected during execution of power-on and power-off sequences for the corresponding configuration of the genuine device, the method further comprising: iteratively comparing the target EMI fingerprint with individual reference EMI fingerprints in the plurality of reference EMI fingerprints to generate a similarity metric between each compared set of the target EMI fingerprint and the individual reference EMI fingerprints; (i) generating a signal indicating that the target device is a genuine device if the similarity metric for any individual reference EMI fingerprint satisfies a threshold test, and (ii) generating a signal indicating that the target device is a suspected counterfeit device if the similarity metric for any individual reference EMI fingerprint does not satisfy the threshold test.

2. collecting EMI signals emitted from the target device while the target device is powered and while the target device is not powered includes collecting a first set of EMI signals while the target device is powered and collecting a second set of EMI signals while the target device is not powered; The method of claim 1 , wherein the target EMI fingerprint is generated from a combination of the first set of EMI signals and the second set of EMI signals.

3. The method of claim 1 or 2, wherein the test sequence of powering and de-powering the target device includes multiple powering or de-powering.

4. receiving a telemetry signal from a sensor component of the target device; and classifying the target device as being a target device of the particular model based on the telemetry signal. The method according to any of claims 1 to 3, wherein the retrieval of the plurality of reference EMI fingerprints from the database library is based on the classification of the target device.

5. generating, for each particular frequency in the reference EMI fingerprint, a residual between a reference amplitude-time series signal at the particular frequency in the reference EMI fingerprint and a Multivariate State Estimation Technique (MSET) estimate of a target amplitude-time series signal at the particular frequency in the target EMI fingerprint; The method according to any of claims 1 to 4, further comprising generating said similarity metric by: combining said generated residuals to generate said similarity metric.

6. The method of any of claims 1 to 5, wherein the similarity metric is based on the mean absolute error over a particular set of frequencies between the reference EMI fingerprint and the target EMI fingerprint.

7. The method of any of claims 1 to 6, wherein the similarity metric is surface mean absolute error.

8. The method of any of claims 1 to 7, further comprising at least one of the steps of: (i) trimming the collected EMI signal to an optimal length for comparison with one or more of the reference EMI fingerprints; or (ii) synchronizing a first phase of the collected EMI signal with a second phase of one of the reference EMI fingerprints.

9. generating a visual image of a 3D residual surface based on one of the reference EMI fingerprint and the target EMI fingerprint and displaying the visual image on a graphical user interface; (i) if the signal indicates that the target device is a genuine device, displaying a visual indication on the graphical user interface that the target device is genuine and displaying a make, model, and component configuration description on the graphical user interface; (ii) if the signal indicates that the target device is a suspected counterfeit device, displaying a visual indication on the graphical user interface that the target device is suspect or counterfeit.

10. A computer program storing computer executable instructions which, when executed by at least a processor of a computer, cause the computer to carry out a method according to any of claims 1 to 9.

11. 1. A system for detecting whether a target device of a particular model containing a plurality of electronic components is genuine or suspected to be counterfeit, comprising: a test sequence generator configured to automatically control power to alternately energize and de-energize the target device in a repeatable test sequence; and an EMI fingerprint counterfeit scanner, the EMI fingerprint counterfeit scanner comprising: (i) collecting electromagnetic interference (EMI) signals emitted by the target device while the target device is powered and de-powered; (ii) generating a target EMI fingerprint from the EMI signals collected while the target device is powered and unpowered; (iii) configured to retrieve a plurality of reference EMI fingerprints from a data store, each reference EMI fingerprint corresponding to an authentic reference device of the particular model and further corresponding to a distinct configuration of electronic components of the authentic reference device of the particular model, and the EMI fingerprint counterfeit scanner further configured to: (iv) iteratively comparing the target EMI fingerprint with each reference EMI fingerprint in the plurality of reference EMI fingerprints to generate a similarity metric between each compared set of the target EMI fingerprint and each reference EMI fingerprint; (v) the system is configured to generate and display on a graphical user interface a visual indication that the target device is genuine if the similarity metric for any individual reference EMI fingerprint satisfies a threshold test, and to generate and display on the graphical user interface a visual indication that the target device is suspicious or counterfeit if the similarity metric for any individual reference EMI fingerprint does not satisfy the threshold test.

12. A memory storing the computer program according to claim 10; and one or more processors for executing the computer program.

Images