Systems and methods for preventing radio frequency based attacks on secured systems using machine learning-based radio fingerprinting

Abstract

An authentication device for preventing radiofrequency (RF)-based attacks, such as relay or replay attacks, on a secured system, such as a vehicle, is provided, using machine learning- based radio fingerprinting. The authentication device includes a radio module, configured to receive at least a first RF signal, the first RF signal comprising a first passcode and corresponding to at least one first radio fingerprint feature; a memory module, including one or more trained machine learning models; and a processing device. The processing device is configured to generate, using the first trained machine learning model, a first matching score based on the at least one radio fingerprint feature; generate an authentication indication based on the matching score exceeding a predefined confidence threshold; and send, to the secured system, the authentication signal. The secured system may deny access if a negative authentication indication is received from the processing device.

Description

TITLE: SYSTEMS AND METHODS FOR PREVENTING RADIO FREQUENCY BASED ATTACKS ON SECURED SYSTEMS USING MACHINE LEARNING-BASED RADIO FINGERPRINTINGRELATED APPLICATIONS

[0001] The present application claims the benefit of priority of co-pending United States provisional patent application no. 63 / 762893 filed on February 25, 2025, the contents of which are incorporated herein by reference in their entirety.FIELD

[0002] The present disclosures relate to the field of radiofrequency (RF) communications. Specifically, present disclosures relate to the field of radiofrequency (RF) communications to mitigate RF-based attack vectors for secured systems that use RF-based access controls features.INTRODUCTION

[0003] The following is not an admission that anything discussed below is part of the prior art or part of the common general knowledge of a person skilled in the art.

[0004] Auto thefts have become a rapidly increasing problem in recent years. In Canada, it is estimated that more than 200 vehicles are stolen every day. Auto theft insurance claim costs in Canada have also increased by 524% between 2018 and 2023. There are societal and economic costs to the rising problem of car thefts. Even if one is not a direct victim of car theft, burdens are generally be passed down to all individuals through higher insurance premiums, greater strain on law enforcement and court resources, and general societal malaise stemming from a perception of decreasing public safety.

[0005] Thieves frequently target vehicles equipped with remote keyless entry and / or keyless ignition technology. These technologies can be vulnerable to a number of radio frequency (RF) attack vectors such as relay attacks, key programming, key code capture, and raw record-and-playback attacks.

[0006] For example, vehicles equipped with passive keyless entry may unlock automatically when the key fob is in close proximity to the vehicle. One attacker stands near the owner, capturing the key's signal with a relay device, while an accomplice near the carretransmits the signal, thus tricking the system into thinking the vehicle and fob are in close proximity, thereby allowing access to the vehicle without possession of the key.SUMMARY

[0007] In a first broad aspect, in accordance with one or more embodiments, there is generally described an authentication device for preventing radiofrequency (RF)-based attacks on a secured system. The secured system may comprise one or more secured features, using machine learning-based radio fingerprinting. The authentication device comprises: a radio module, configured to receive a plurality of RF signals from a plurality of transmitters, wherein the plurality of RF signals comprises a first RF signal and the plurality of transmitters comprises a first transmitter, the first RF signal being transmitted by the first transmitter, the first RF signal comprising a first passcode and corresponding to at least one first radio fingerprint feature; a memory module, having stored thereon: a radio processing module; and one or more trained machine learning models; and a processing device, configured to: generate, using the first trained machine learning model, a first matching score based on the at least one radio fingerprint feature; generate an authentication indication based on a comparison of the matching score with a predefined confidence threshold; and transmit, to the secured system, the authentication indication, wherein the secured system is configured to deny access to at least one secured feature of the one or more secured features if a negative authentication indication is detected from the processing device.

[0008] In some embodiments, the processing device may be further configured to decode, using the radio processing module, the RF signal to extract the passcode, and the generating the authentication indication may be further based on the first passcode matching an authorized passcode.

[0009] In some embodiments, the radio module may be configured to convert the RF signal into a first digital signal; and the processing device may be further configured to generate, using the first trained machine learning model, the matching score based on the first digital signal.

[0010] In some embodiments, the authentication indication may be received at an entry system of the secured system, and the entry system may be operable to only allowaccess to the at least one secured feature upon at least detecting a positive authentication indication.

[0011] In some embodiments, the entry system may be operable to deny access to the at least one secured feature further upon determining that the passcode fails to match an authorized passcode.

[0012] In some embodiments, the secured system comprises a vehicle, and the entry system comprises a keyless entry system.

[0013] In some embodiments, the one or more secured feature comprises one or more of: a vehicle door lock; and a vehicle starting capability.

[0014] In some embodiments, the transmitter comprises a vehicle key fob.

[0015] In some embodiments, the one or more trained machine learning models comprises: a first trained machine learning model, wherein the first machine learning model corresponds to the first transmitter; and a second trained machine learning model, wherein the second machine trained learning model corresponds to a second transmitter.

[0016] In some embodiments, the plurality of RF signals further comprises a second RF signal and the plurality of transmitters further comprises of second transmitter, the second RF signal being transmitted by the second transmitter and comprising a second passcode and a second plurality of radio fingerprint features; and the processing device is further configured to: convert, using the radio processing module, the second RF signal into a second digital signal; and generate, using the second machine learning model, a second matching score based on the second digital signal; generate the authentication indication based on the second matching score exceeding the predefined confidence threshold; and send, to the secured system, the authentication indication.

[0017] In some embodiments, the processing device is further configured to: decode, using the radio processing module, the second RF signal to extract the second passcode, and wherein the processor generating the authentication indication is further based on: the second passcode matching a second authorized passcode.

[0018] In some embodiments, the plurality of radio fingerprint features of the RF signal derives from a combination of one or more hardware components of the transmitter.

[0019] In some embodiments, there is generally described a system for preventing RF-based attacks on an access-controlled system, comprising the authentication device and the access-controlled system in communication with the authentication device, the access-controlled system comprising the secured system.

[0020] In another broad aspect, in accordance with one or more embodiments, there is generally disclosed a method for preventing radiofrequency (RF)-based attacks on a secured system, wherein the secured system comprises one or more secured features, using machine learning-based radio fingerprinting, comprising: receiving, at a radio module, a first RF signal from a first transmitter, the first RF signal comprising a first passcode and at least one first radio fingerprint feature; generating, at the processor, using one or more trained machine learning model, a first matching score based on the RF signal; generating, at the processor, an authentication indication based a comparison of the matching score with a predefined confidence threshold; and transmit, at the processor, the authentication indication to the secured system, wherein the secured system is configured to deny access to at least one secured feature of the one or more secured features if a negative authentication indication is detected from the processing device.

[0021] In some embodiments, the processing device is further configured to decode, using a radio processing module, the RF signal to extract the passcode, and the generating the authentication indication is further based on the first passcode matching an authorized passcode.

[0022] In some embodiments, the radio module is configured to convert the RF signal into a first digital signal; and the processing device is further configured to generate, using the first trained machine learning model, the matching score based on the first digital signal.

[0023] In some embodiments, the authentication indication is received at an entry system of the secured system, and the entry system is operable to only allow access to the at least one secured feature upon at least detecting a positive authentication indication.

[0024] In some embodiments, the entry system is operable to deny access to the at least one secured feature further upon determining that the passcode fails to match an authorized passcode.

[0025] In some embodiments, the secured system comprises a vehicle, and the entry system comprises a keyless entry system.

[0026] In some embodiments, the one or more secured feature comprises one or more of: a vehicle door lock; and a vehicle starting capability.

[0027] In some embodiments, the transmitter comprises a vehicle key fob.

[0028] In some embodiments, the one or more trained machine learning models comprises a first trained machine learning model corresponding to the first transmitter and comprises a second machine learning model corresponding to a second transmitter.

[0029] In some embodiments, the plurality of RF signals further comprises a second RF signal and the plurality of transmitters further comprises of second transmitter, the second RF signal being transmitted by the second transmitter and comprising a second passcode and a second plurality of radio fingerprint features; and the processing device is further configured to: convert, using the radio processing module, the second RF signal into a second digital signal; generate, using the second machine learning model, a second matching score based on the second digital signal; generate the authentication indication based on the second matching score exceeding the predefined confidence threshold; and send, to the secured system, the authentication indication.

[0030] In some embodiments, the processing device is further configured to: decode, using a radio processing module, the second RF signal to extract the second passcode, and the processor generating the authentication indication is further based on: the second passcode matching a second authorized passcode.

[0031] In some embodiments, the plurality of radio fingerprint features of the RF signal derives from a combination of one or more hardware components of the transmitter.

[0032] In another broad aspect, in accordance with one or more embodiments, there is generally described a system for training and deploying machine learning models for authenticating access requests to a secured system, the secured system comprising one or more secured features, the system comprising: an authentication device, configured to: record a plurality of positive sample RF signals, wherein: the plurality of positive sample RF signals comprises at least a first set of samples from a first authorized transmitter recordedin a first environment and a second set of samples from the first authorized transmitter recorded in a second environment; the first environment comprises a first set of RF transmissive properties; and the second environment comprises a second set of RF transmissive properties, different from the first set of RF transmissive properties; transmit the plurality of positive sample RF signals to one or more computing devices; receive one or more trained machine learning models from the one or more computing devices; produce an authentication indication, using the one or more trained machine learning models, based on an input RF signal; and send the authentication output to the secured system, wherein the secured system is configured to deny access to the one or more secured features if a negative authentication indication is received from the authentication device; and one or more computing devices, configured to: receive the plurality of positive RF signals from the authentication device; assemble a training dataset and a testing dataset based on the plurality of positive sample RF signals; train one or more machine learning models based on the training dataset and testing dataset to produce one or more trained machine learning models; and transmit the one or more trained machine learning models to the authentication device.

[0033] In some embodiments, the training dataset and testing dataset is further assembled based on a plurality of negative sample RF signals, the plurality of negative sample RF signals comprising RF signals associated with unauthorized transmitters.

[0034] In some embodiments, the one or more computing devices is further configured to generate at least a portion of the plurality of negative sample RF signals based on the plurality of positive sample RF signals by adding at least one impairment to the plurality of positive sample RF signals.

[0035] In some embodiments, the system further comprises: an RF device testbed, the testbed comprising at least one unauthorized RF device, wherein the at least one unauthorized RF device is configured to generate at least a portion of the plurality of negative sample RF signals.

[0036] In some embodiments, the training dataset and testing dataset is further assembled based on a plurality of augmented sample RF signals, the plurality of augmentedsample RF signals being generated from adding one or more augmentations to the plurality of positive sample RF signals.

[0037] In some embodiments, the first environment further comprises a first set of RF impeding obstacles, and the second environment further comprises a second set of RF impeding obstacles, wherein the second set of RF impeding obstacles is arranged substantially differently from the first set of RF impeding obstacles.

[0038] In some embodiments, the one or more machine learning models comprises one or more pre-trained models, and the training the one or more machine learning models comprises fine-tuning the pre-trained models.

[0039] In some embodiments, the one or more machine learning models comprises at least a first model corresponding to a first transmitter and a second model corresponding to a second transmitter; the plurality of positive sample RF signals further comprises at least a first set of samples from a second authorized transmitter recorded in the first environment and a second set of samples form the second authorized transmitter recorded in the second environment; and the training dataset and testing dataset further comprises: a first training dataset and a first testing dataset for training the first model; and a second training dataset and a second testing data set for training the second model.

[0040] In some embodiments, the computing device is hosted on an external server and is in communication with the authentication device through an internet network connection.

[0041] In another broad aspect, in accordance with one or more embodiments, there is generally provided a method for training and deploying machine learning models for authenticating access requests to a secured system, the secured system comprising one or more secured features, the method comprising: recording, using an authentication device, a first set of samples from a first authorized transmitter in a first environment; recording, using the authentication device, a second set of samples from the first authorized transmitter in a second environment, wherein the first environment comprises a first set of RF transmissive properties and the second environment comprises a second set of RF transmissive properties different from the first set of RF transmissive properties; transmitting, from the authentication device to one or more computing devices, a plurality of positive RF signals,the plurality of positive RF signals comprising the first set of samples and the second set of samples; receiving, at the one or more computing devices, the plurality of positive RF signals; assembling, at the one or more computing devices, a training dataset and a testing dataset based on the plurality of positive sample RF signals; training, at the one or more computing devices, one or more machine learning models based on the training dataset and the testing dataset to produce one or more trained machine learning models; transmitting, from the computing device to an authentication device, the one or more trained machine learning models; receiving, at the authentication device, the one or more trained machine learning models; and producing, at the authentication device, an authentication indication, using the one or more trained machine learning models, based on an input RF signal, wherein the authentication device is configured to send, to the secured system, the authentication indication, wherein the secured system is configured to deny access to the one or more secured features if a negative authentication indication is received from the authentication device.

[0042] In some embodiments, the training dataset and testing dataset is further assembled based on a plurality of negative sample RF signals, the plurality of negative sample RF signals comprising RF signals associated with unauthorized transmitters.

[0043] In some embodiments, the one or more computing devices is further configured to generate at least a portion of the plurality of negative sample RF signals based on the plurality of positive sample RF signals by adding at least one impairment to the plurality of positive sample RF signals.

[0044] In some embodiments, the method further comprises: generating, using at least one unauthorized RF device on an RF device testbed, at least a portion of the plurality of negative sample RF signals.

[0045] In some embodiments, the training dataset and testing dataset is further assembled based on a plurality of augmented sample RF signals, the plurality of augmented sample RF signals being generated from adding one or more augmentations to the plurality of positive sample RF signals.

[0046] In some embodiments, the first environment further comprises a first set of RF impeding obstacles, and the second environment further comprises a second set of RFimpeding obstacles, wherein the second set of RF impeding obstacles is arranged substantially differently from the first set of RF impeding obstacles.

[0047] In some embodiments, the one or more machine learning models comprises one or more pre-trained models, and wherein the training the one or more machine learning models comprises fine-tuning the pre-trained models.

[0048] In some embodiments, the one or more machine learning models comprises at least a first model corresponding to a first transmitter and a second model corresponding to a second transmitter; the plurality of positive sample RF signals further comprises at least a first set of samples from a second authorized transmitter recorded in the first environment and a second set of samples form the second authorized transmitter recorded in the second environment; and the training dataset and testing dataset further comprises: a first training dataset and a first testing dataset for training the first model; and a second training dataset and a second testing data set for training the second model.

[0049] In some embodiments, the computing device is hosted on an external server and is in communication with the authentication device through an internet network connection.

[0050] In another broad aspect, in accordance with one or more embodiments, there is generally provided a system for training and deploying machine learning models for authenticating access requests to a secured system, the secured system comprising one or more secured features, the system comprising: an RF capture device, configured to: record a plurality of positive sample RF signals, wherein: the plurality of positive sample RF signals comprises at least a first set of samples from a first authorized transmitter recorded in a first environment and a second set of samples from the first authorized transmitter recorded in a second environment; the first environment comprises a first set of RF transmissive properties; and the second environment comprises a second set of RF transmissive properties, different from the first set of RF transmissive properties; transmit the plurality of positive sample RF signals to one or more computing devices; an authentication device, configured to: receive one or more trained machine learning models from the one or more computing devices; produce an authentication indication, using the one or more trained machine learning models, based on an input RF signal; and send the authenticationindication to the secured system, wherein the secured system is configured to deny access to the one or more secured features if a negative authentication indication is received from the authentication device; and one or more computing devices, configured to: receive the plurality of positive RF signals from the authentication device; assemble a training dataset and a testing dataset based on the plurality of positive sample RF signals; train one or more machine learning models based on the training dataset and testing dataset to produce one or more trained machine learning models; and transmit the one or more trained machine learning models to the authentication device.DRAWINGS

[0051] For a better understanding of the embodiments described herein and to show more clearly how they may be carried into effect, reference will now be made, by way of example only, to the accompanying drawings which show at least one exemplary embodiment, and in which:

[0052] FIG. 1 is an example environment in which an authentication device for preventing RF-based attacks on a secured system may be used, in accordance with an example embodiment.

[0053] FIG. 2 is a schematic diagram of an example authentication device for preventing RF-based attacks on a secured system, in accordance with an example embodiment.

[0054] FIG. 3 is a flowchart of an example method for preventing RF-based attacks on a secured system, in accordance with an example embodiment.

[0055] FIG. 4 is a flowchart of an example method for training and deploying machine learning models for authenticating access requests to a secured system, in accordance with an example embodiment.

[0056] FIG. 5 is an example method for installing the authentication device of FIG. 1 , in accordance with an example embodiment.

[0057] FIG. 6 is another example method for installing the authentication device of FIG. 1 , in accordance with an example embodiment.

[0058] FIG. 7 is another example method for installing the authentication device of FIG. 1 , in accordance with an example embodiment.

[0059] FIG. 8 is an example dataset generation process, in accordance with an example embodiment.

[0060] FIG. 9 is a schematic diagram of an example system for training and deploying machine learning models for authenticating access requests to a secured system, in accordance with an example embodiment.

[0061] Further aspects and features of the example embodiments described herein will appear from the following description taken together with the accompanying drawings.DESCRIPTION OF VARIOUS EMBODIMENTS

[0062] Various embodiments in accordance with the teachings herein will be described below to provide an example of at least one embodiment of the claimed subject matter. No embodiment described herein limits any claimed subject matter. The claimed subject matter is not limited to devices, systems or methods having all of the features of any one of the devices, systems or methods described below or to features common to multiple or all of the devices, systems or methods described herein. It is possible that there may be a device, system or method described herein that is not an embodiment of any claimed subject matter. Any subject matter that is described herein that is not claimed in this document may be the subject matter of another protective instrument, for example, a continuing patent application, and the applicants, inventors or owners do not intend to abandon, disclaim or dedicate to the public any such subject matter by its disclosure in this document.

[0063] For simplicity and clarity of illustration, reference numerals may be repeated among the figures to indicate corresponding or analogous elements. In addition, numerous specific details are set forth in order to provide a thorough understanding of the subject matter described herein. However, it will be understood by those of ordinary skill in the art that the subject matter described herein may be practiced without these specific details. In other instances, well-known methods, procedures and components have not been described in detail so as not to obscure the subject matter described herein. The description is not to be considered as limiting the scope of the subject matter described herein.

[0064] It should also be noted that the terms “coupled” or “coupling” as used herein can have several different meanings depending in the context in which these terms are used. For example, the terms coupled or coupling can have a mechanical, fluidic or electrical connotation. For example, as used herein, the terms coupled or coupling can indicate that two elements or devices can be directly connected to one another or connected to one another through one or more intermediate elements or devices via an electrical or magnetic signal, electrical connection, an electrical element or a mechanical element depending on the particular context. Furthermore, coupled electrical elements may send and / or receive data.

[0065] Unless the context requires otherwise, throughout the specification and claims which follow, the word “comprise” and variations thereof, such as, “comprises” and “comprising” are to be construed in an open, inclusive sense, that is, as “including, but not limited to”.

[0066] It should also be noted that, as used herein, the wording “and / or” is intended to represent an inclusive-or. That is, “X and / or Y” is intended to mean X or Y or both, for example. As a further example, “X, Y, and / or Z” is intended to mean X or Y or Z or any combination thereof.

[0067] It should be noted that terms of degree such as "substantially", "about" and "approximately" as used herein mean a reasonable amount of deviation of the modified term such that the end result is not significantly changed. These terms of degree may also be construed as including a deviation of the modified term, such as by 1%, 2%, 5% or 10%, for example, if this deviation does not negate the meaning of the term it modifies.

[0068] Furthermore, the recitation of numerical ranges by endpoints herein includes all numbers and fractions subsumed within that range (e.g. 1 to 5 includes 1, 1.5, 2, 2.75, 3, 3.90, 4, and 5). It is also to be understood that all numbers and fractions thereof are presumed to be modified by the term "about" which means a variation of up to a certain amount of the number to which reference is being made if the end result is not significantly changed, such as 1%, 2%, 5%, or 10%, for example.

[0069] Reference throughout this specification to “one embodiment”, “an embodiment”, “at least one embodiment” or “some embodiments” means that one or moreparticular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments, unless otherwise specified to be not combinable or to be alternative options.

[0070] As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” include plural referents unless the content clearly dictates otherwise. It should also be noted that the term “or” is generally employed in its broadest sense, that is, as meaning “and / or” unless the content clearly dictates otherwise.

[0071] Similarly, throughout this specification and the appended claims the term “communicative” as in “communicative pathway,” “communicative coupling,” and in variants such as “communicatively coupled,” is generally used to refer to any engineered arrangement for transferring and / or exchanging information. Exemplary communicative pathways include, but are not limited to, electrically conductive pathways (e.g., electrically conductive wires, electrically conductive traces), magnetic pathways (e.g., magnetic media), optical pathways (e.g., optical fiber), electromagnetically radiative pathways (e.g., radio waves), or any combination thereof. Exemplary communicative couplings include, but are not limited to, electrical couplings, magnetic couplings, optical couplings, radio couplings, or any combination thereof.

[0072] Throughout this specification and the appended claims, infinitive verb forms are often used. Examples include, without limitation: “to detect,” “to provide,” “to transmit,” “to communicate,” “to process,” “to route,” and the like. Unless the specific context requires otherwise, such infinitive verb forms are used in an open, inclusive sense, that is as “to, at least, detect,” to, at least, provide,” “to, at least, transmit,” and so on.

[0073] The example systems and methods described herein may be implemented as a combination of hardware or software. In some cases, the examples described herein may be implemented, at least in part, by using one or more computer programs, executing on one or more programmable devices comprising at least one processing element, and a data storage element (including volatile memory, non-volatile memory, storage elements, or any combination thereof). These devices may also have at least one input device (e.g. a keyboard, mouse, touchscreen, or the like), and at least one output device (e.g. a display screen, a printer, a wireless radio, or the like) depending on the nature of the device.

[0074] Some elements that are used to implement at least part of the systems, methods, and devices described herein may be implemented via software that is written in a high-level procedural language. The program code may be written in C++, C#, JavaScript, Python, or any other suitable programming language and may comprise varying components including but not limited to modules, classes, and functions, as is known to those skilled in software development. Alternatively, or in addition thereto, some of these elements implemented via software may be written in assembly language, machine language, or firmware as needed. In either case, the language may be a compiled or interpreted language.

[0075] At least some of these software programs may be stored on a computer readable medium such as, but not limited to, a ROM, a magnetic disk, an optical disc, a USB key, and the like that is readable by a device having at least one processor, an operating system, and the associated hardware and software that is used to implement the functionality of at least one of the methods described herein. The software program code, when read by the device, configures the device to operate in a new, specific, and predefined manner (e.g., as a specific-purpose computer) in order to perform at least one of the methods described herein.

[0076] The drawings, described below, are provided for purposes of illustration, and not of limitation, of the aspects and features of various examples of embodiments described herein. For simplicity and clarity of illustration, elements shown in the drawings have not necessarily been drawn to scale. The dimensions of some of the elements may be exaggerated relative to other elements for clarity. It will be appreciated that for simplicity and clarity of illustration, where considered appropriate, reference numerals may be repeated among the drawings to indicate corresponding or analogous elements or steps.

[0077] As described in the background section, vehicular theft through RF based attack vectors such as relay or replay attacks has become increasingly prevalent. Although existing keyless entry systems in vehicles attempt to tackle these issues by implementing various information-theoretically secure cryptographic systems as solutions to mitigate RF-based attack vectors (e.g., rolling codes generated using symmetric cryptographic algorithms), vulnerabilities still exist in the RF channel that can be exploited by using, for example, the techniques described in the background section.

[0078] Other existing technologies for indirectly securing against such attacks include engine immobilizers, kill switches, Faraday pouches around key fobs, biometric authentication, cloud authentication, and vehicle trackers. Alternative methods of securing vehicles have also been suggested, including mechanical steering wheel locks, wheel locks, and installing bollards.

[0079] However, the above-described solutions suffer from a number of disadvantages. For one, they do not address security vulnerabilities in the communication channel between a prover and a verifier, and are accordingly not secure. Additionally, they are often inconvenient to use, can be detrimental to the driving experience, or may be too costly to implement. For example, methods such as bollards are additionally location dependent, as they can only be used in certain secure areas.

[0080] In contrast, the presently disclosed systems and methods may directly address security vulnerabilities in the RF channel. The presently disclosed systems and methods may provide an additional layer of security to combat the problem of car thefts being conducted through radio frequency attack vectors. The presently disclosed solutions can distinguish between entry from authorized transmitters attempting to unlock the vehicle and unauthorized entry from unauthorized transmitters attempting an attack. Additionally, exceptional cases that may be construed as an attack can be detected as well, such as the jamming of entry key fobs.

[0081] The presently disclosed systems and methods may be combined into a compact hardware package containing integrated signal-processing software capable of operating machine-learning based algorithms for the detection of specific events, such as unauthorized unlocking requests and starting of the vehicle, and perform corresponding response actions, such as denying access to the vehicle.

[0082] The presently disclosed systems and methods may be easily implemented and integrated in existing and new vehicles with minimal modification to the operation of the vehicle and almost no apparent impairment to the user experience. For example, no additional steps need to be taken in operating the additional security measures from an enduser perspective. To an end-user, the process may be perceived as seamless, invisible, and take place in the background. In contrast, other methods, such as biometric authenticationor steering wheel locks, may require additional steps that are taken before a vehicle can be used or unlocked, which can be inconvenient and hinder the user experience. Additionally, the presently disclosed system can be easily installed in an existing car without major effort or be integrated into a new vehicle. An end user may be able to continue to use their existing key, or an existing key in conjunction with a pre-authorized key, after implementation of the presently disclosed system.

[0083] The presently disclosed systems and methods may leverage the capabilities of radio fingerprinting to reduce vulnerabilities in communication channels between key fobs and vehicles, adding an extra layer of protection to the authentication chain. Radio fingerprinting, also known as RF fingerprinting, operates on the principle that every radio transmitter has slight variations in its physical hardware components, which imparts a unique “fingerprint” on signals transmitted by the transmitter. By examining the effects of these subtle variations, it is possible to distinguish one transmitting device from another. As such, radio fingerprinting may facilitate the identification of individual RF transmitters. As such, the presently described authentication technique enables a secured system, such as a vehicle or a building, to utilize not just the content of the message sent in deciding whether to allow access, but the unique characteristics of the transmitter of the message.

[0084] The presently disclosed systems and methods may use machine learningbased algorithms trained to perform radio fingerprinting. Trained machine learning models may be loaded into a local hardware device integrated with the vehicle. The machine learning models may be operational at all times and may be capable of responding in a short time. In some instances, within the order of milliseconds to microseconds.

[0085] While the presently disclosed systems and methods will be primarily described in a vehicular context below, it should be appreciated that the presently disclosed techniques can be used with any secure system that implements RF-based access control features that may be vulnerable to RF-based attack vectors such as relay attacks, replay attacks, key programming attacks, and more. For example, other secure systems may include homes and buildings equipped with wireless locks configured to receive RF-based access signals from keys. Other examples include appliances, machinery, or equipment that may be enabled wirelessly from transmitters configured to send RF-based access signals.

[0086] Reference is first made to FIG. 1, which shows an example secured system 104 in which an authentication device 102 for preventing RF-based attacks can be used. In the presently described embodiment, the secured system 104 may be a vehicle. Secured system 104 may have one or more secured features that is only accessible to authenticated users of the system. For example, secured features for vehicle 104 may include unlocking of one or more doors of the vehicle, starting the vehicle, opening a gas / charging port, and any other feature of the vehicle that one may require some form of authorization.

[0087] In other embodiments, secured system 104 may be any system that contains one or more secured features that can be accessed through RF-communication means. For example, secured system 104 can be a home equipped with a lock that can be accessed through an RF-transmitter based key. The secured features may include, for example, unlocking a door of the home.

[0088] Secured system 104 may contain an entry module 110. Entry module 110 may be configured to allow access to secured system 104 in response to a signal received from an authorized transmitter 112. For example, entry module 110 may be a keyless entry module for a vehicle that may contain hardware and software capabilities to unlock one or more doors of the vehicle 104. Entry module may contain capabilities to communicate with a central processor of the vehicle or may be directly in communication with circuitry for unlocking one or more doors of the vehicle 104. It should be appreciated that allowing access to the vehicle 104 may include capabilities beyond just unlocking one or more doors of vehicle 104. For example, allowing access may include enabling or making accessible any functionality of the vehicle that may require authorization, such as starting the vehicle, accessing a trunk or hood compartment, accessing a gas / charging port, and any such similar functionality that may require permission from an authorized user.

[0089] Entry module 110 may be configured to receive a passcode for accessing vehicle 104. The passcode may be received from transmitter 112 via RF signal 120. Entry module 110 may contain a radio module configured to receive, process, and extract a passcode that is encoded in RF signal 120. For example, the radio can include circuitry and hardware for receiving and decoding RF signals including, but not limited to, suchcomponents as antennae, amplifiers, mixers, integrated circuitry, processing devices, memory devices, and power supplies.

[0090] Transmitter 112 may contain a user interface, which can include means of input such as buttons or a touchscreen, that can be operated by a user 150 to operate transmitter 112 to send an RF signal 120. Transmitter 112 may contain a radio module and processing equipment configured to encode a passcode in and transmit RF signal 120. For example, the radio module can include circuitry and hardware for sending and encoding RF signals including, but not limited to, such components as antennae, amplifiers, mixers, integrated circuitry, processing devices, memory devices, and power supplies.

[0091] In some embodiments, no input from the user is required to send the access request. For example, vehicle 104 may be equipped with passive keyless entry (PKE) capability. For example, entry module 110 may be a PKE module configured to send an interrogation signal to transmitter 102. The transmitter 102 may be configured to receive the interrogation signal, which may cause transmitter 112 to emit RF signal 120 containing the passcode. Entry module 110 may then unlock vehicle 104 upon verifying both the passcode transmitted in RF signal 120 and the radio fingerprint of transmitter 112.

[0092] Transmitter 112 may be operated by a user 150 to unlock vehicle 104. Transmitter 112 may alternatively or additionally be operated by a user 150 to start vehicle 104. Transmitter 112 may be configured to send, among other items, a passcode for vehicle 104 for unlocking or starting vehicle 104, which is encoded in the RF signal 120. The access request can contain a passcode for authentication against an expected passcode. The passcode can be encrypted, for example using symmetric encryption protocols, asymmetric encryption protocols, or any combination thereof. The RF signal 120 may be received at keyless entry module 110, which may be configured to extract the passcode, to authenticate the passcode for unlocking the vehicle.

[0093] In some embodiments, a rolling code system may be used, in which a different expected passcode is generated each time an unlock happens. For example, both transmitter 112 and entry module 110 implement, whether through hardware or software or a combination of both, a shared synchronized algorithm and counter, which operates to generate a new expected passcode each time the passcode is used. In some embodiments,a fixed code system may be implemented in which the same passcode is sent by the transmitter and expected at the receiver each time.

[0094] Secure system 104 may be subject to one or more RF attack vectors to get around the security protocols that have been implemented. For example, a malicious user 160 may desire to obtain access to system 104. Malicious user 160 may use an attacking device 130, which may be configured to transmit an RF signal 122, which encodes an authorized passcode for accessing system 104. Attacking device may be equipped with radio hardware for transmitting RF signal 122, as well as memory and processing hardware for storing and encoding the authorized passcode. Entry module 110, upon receiving RF signal 122 and decoding the password encoded therein, may unlock the doors and / or grant access to other secured features of vehicle 104 to malicious user 160 as the password would match an authorized password, even though the original authorized transmitter 112 was not used.

[0095] Attacking device may have obtained the authorized passcode through various means. In some embodiments, system 104 uses a constant authorized passcode. In such cases, attacking device may be a replay device that is configured to listen to and record RF signals transmitted from authorized transmitters, such as RF signal 120 from transmitter 112. Attacking device may be equipped with hardware to record and store RF signal 120. At a later time, attacking device 130 can replay RF signal 120. As such RF signal 122 may be a recorded and replayed copy of RF signal 120 or some other authorized signal from an authorized transmitter that contains a valid passcode for accessing system 104.

[0096] In some embodiments, even where system 104 uses a more sophisticated rolling code system, attacking device 130 may be capable of capturing and replaying signals from authorized transmitter 112 to system 104. For example, entry module 110 may be a PKE system for a vehicle as described above, configured to use rolling-code encryption to validate unlock requests. Attacking device 130 could operate to intercept and block signal 120 transmitted by authorized transmitter 112 from reaching system 104. As 104 did not successfully unlock, user 150 may operate transmitter 112 once again to send a second RF signal requesting an unlock from system 104. Attacking device 130 may then operate to intercept and block the second RF signal, while retransmitting the original signal 120, which may successfully allow access to system 104. Attacking device 130 may store the secondRF signal. Malicious user 160 may now have the next code in the rolling sequence for use in accessing system 104 at a later time.

[0097] It will be appreciated that any number of approaches may be used to obtain a valid passcode to encode into RF signal 122. However, the particular approach does not matter in the operation of the described systems and methods, only that the source of the RF signal containing the passcode does not come from a transmitter device that is authorized to access secured system 104, such as transmitter 112. This is because the systems and method described herein may operate independent of the content of the transmitted message.

[0098] To address this problem, system 104 may include an authentication device 102 for preventing radio frequency (RF)-based attacks on the secured system. The authentication device 102 may be configured to utilize machine learning techniques to authenticate the radio fingerprint of a received RF signal based on whether the radio fingerprint matches the radio fingerprint of an authenticated device, such as device 112. In this way, authentication device 102 ensures that the received RF signal comes from an authenticated source, notwithstanding the contents of the RF signal. The authentication device 102 may be in electronic communication with entry module 110. For example, if the secured system 104 is a vehicle, the authentication device 102 can be connected to a wiring harness of the vehicle, allowing it to communicate with the entry module 110. The authentication device 102 may be configured to transmit an authentication indication to entry module 110. The authentication indication may indicate whether a received RF signal has a radio fingerprint that matches the radio fingerprint of an authorized transmitter. A positive authentication indication can indicate the presence of a match, and may take the form of, for example, an electronic signal encoding a binary 1. A negative authentication indication can indicate a lack of a match, and could take the form of, for example, an electronic signal encoding a binary ‘O’. The entry module 110 may be configured to deny access to the secured features of secured system 104 if a negative authentication indicator is detected from authentication device 102. In some embodiments, the entry module 110 may be configured to detect the absence of a positive authentication indication as a negative authentication indication, or vice versa, depending on the specific configuration of the system.

[0099] Reference is made to FIG. 2, in conjunction with FIG. 1, which shows a schematic diagram of various components of an example authentication device 102 in accordance with one or more embodiments. Authentication device 102 may be configured to receive an RF signal and determine whether the received RF signal was transmitted by an authorized transmitter using machine learning techniques. Authentication device 102 may be configured to use one or more trained machine learning models to process received RF signals and generate an indication that the RF signals are received from an authorized transmitter. For example, the machine learning models may output a binary ‘yes’ or ‘no’ output. Alternatively, the machine learning models may output a matching score indicating a percentage confidence. A higher percentage may be indicative of a higher likelihood of match. In some embodiments, a higher percentage score may be indicative of a higher likelihood of a malicious attack, depending on what the model is trained to recognize.

[0100] The machine learning models may be trained on data corresponding to authorized transmitters, such as RF signals captured directly from authorized transmitters, and can then determine a level of similarity between the received RF signal and the RF signals comprising its training data, based on the radio fingerprint characteristics of the received signals.

[0101] Authentication device 102 may include a radio module 210, a processing device 220, a memory module 230, and an interface module 240. Radio module 210 may be configured to receive RF signals. Radio module may include antennae tuned to receive RF signals at particular frequencies, as well as RF front-end components such as mixers, amplifiers, and filters for further processing of received RF signals. In some embodiments, radio module 210 may cooperate with a processing device configured to implement a software defined radio to perform functions of processing received RF signals.

[0102] Processing device 220 may be a processing device configured to operate trained machine learning models and RF processing algorithms. Processing device 220 may be any device capable with sufficient processing capabilities capable of executing machine code to operate a trained machine learning model and a software defined radio. Processing device 220 may be a lightweight chip configured for low power consumption with compact size. For example, processing device 220 could be a low-end processing unit ormicrocontroller such as an ARM Cortex-M, as may be included in compact computing devices such as a Raspberry Pi or Orange Pi, or any other similar processing device.

[0103] In some embodiments, processing device 220 can contain multiple processing units, with functionalities of processing device 220 divided between the multiple processing units. For example, machine learning inference may be performed on a first processing unit containing hardware acceleration capabilities while RF processing algorithms may be run on a second, more lightweight processing unit.

[0104] Memory module 230 may be configured to store one or more trained machine learning models 242 and a radio processing module 244. Memory module can be any memory or storage device with sufficient capacity and read / write speed to facilitate the operation of machine learning models and radio processing module 244 on processing device 220. For example, memory module 230 may include flash memory such as SD cards, eMMC, onboard memory, and more. Memory module 230 may store and make available machine learning models 242 and radio processing module 244 for use so that processing device 220 may operate models 242 and module 244 during operation. In some embodiments, memory module 230 can contain a combination of memory components. For example, random-access memory (RAM) can be provided to provide faster read speeds where required.

[0105] Machine learning models 242 may contain one or more trained machine learning models for performing various processing functions relating to radio fingerprinting of received RF signals. Machine learning models 242 may be configured to take in digital signal information and produce an output. Machine learning models 242 can take RF signal information in any number of ways, including in the form of raw l / Q data, spectrogram data, feature vectors, encodings, and more. For example, one or more of machine learning models 242 may be configured to take in a time-series of complex numbers representing l / Q data of the corresponding RF signal and output a number representing a confidence score representing the degree to which the radio fingerprint of the input signal data matches the radio fingerprint of an authorized transmitter. Machine learning models 242 may be trained in a manner such that the training data emphasizes transmitter-related features such as nonlinearities, noise levels, hardware filter shape, oscillator waveforms, IQ imbalances, and otherfeatures that relate to hardware variations, and accordingly, the radio fingerprint, of a signal. The training may de-emphasize environmental features such as multipath profile, received power of signal, carrier frequency offset, mismatched center frequencies, sample rate offsets between RX and TX. For example, the training data may be collected in multiple environments that have different environmental transmission characteristics, thus enabling the model to learn transmitter specific features while de-emphasizing environmental features.

[0106] Machine learning models 242 may include any type of model containing architectures suitable for RF processing, including, for example, any one or a combination of the following: convolutional neural networks, recurrent neural networks, long short-term memory, transformers, autoencoders, support vector machines, and any other suitable type of model. Machine learning model 242 may include all required files for operating the machine learning model on processing device 220, including software code, executable code, configuration settings, libraries, and / or any other files as may be required depending on the specifics of processing device 220 as would be understood by a person of skill in the art.

[0107] Machine learning models 242 can include a plurality of models, each configured to perform different functions as a part of the overall process. For example, one or more models can be configured to perform inference to determine radio fingerprint matching, with each model configured to determine matches corresponding to a different transmitter. A further number of the models may perform other supporting processing functionalities. For example, machine learning models 242 may further include models for performing crosschecking. The models may cooperate to facilitate the completion of the overall radio fingerprinting process.

[0108] Radio processing module 244 may include software configured to execute algorithms for RF signal processing. Radio processing module 244 may cooperate with radio module 210 to implement a software defined radio for receiving and processing RF signals.

[0109] In some embodiments, memory module 230 may include operating systems, such as Linux, along with various other programs required for operating the processing device 220.

[0110] I / O interface 240 may be configured to interface with system 104 to send signals from processing device 220 to system 104, such as the generated authenticationindication. I / O interface 240 can include hardware for connecting with entry module 110 of system 104. For example, I / O interface 240 could include hardware for interfacing and connecting with a wiring harness of a vehicle, such as GPIO pins, CAN bus interface modules, ethernet connectors, and any other suitable hardware. I / O interface 240 may connect with system 104, whether through an entry module 110 or through other means, to communicate the authentication indication generated by processing device 240 for requesting access to the secured features of system 104

[0111] Reference is next made to FIG. 3, in conjunction with FIGS. 1 and 2, which shows a flowchart of a method 300 for preventing radiofrequency (RF)-based attacks on a secured system using machine learning-based radio fingerprinting. The secured system may be, for example, secured system 104 of FIG. 1. The secured system may include one or more secured features. For example, the secured system may be a vehicle, and the one or more secured features may be the unlocking of a one or more doors of the vehicle or the starting of the vehicle. Method 300 may be implemented using authentication device 102.

[0112] The method begins, at 302, with receiving, at a radio module, a first RF signal from a first transmitter. The first RF signal may include a first passcode and at least one first radio fingerprint feature. For example, the radio module may be radio module 210 of authentication device 102. The first RF signal may be signal 120 from transmitter 112. Transmitter 112 may, for example, be a key fob for a vehicle. RF signal 120 may include a passcode for accessing a secure feature of system 104, such as a rolling passcode for unlocking the doors of a vehicle.

[0113] The RF signal may carry with it at least one first radio fingerprint feature. A radio fingerprint feature may be any feature of the RF signal that derives from a combination of the unintended variations inherent in one or more hardware components of the transmitter, which may be caused by manufacturing tolerances. Examples of radio fingerprinting features can include, l / Q imbalance, phase noise, spectral distortion, timing offset, gain imbalance, skew / phase imbalance, DC offset, compression, and more. For example, slight imperfections in an oscillator can cause variations, noise, and offsets in phase and frequency. As another example, non-linearities in the amplifier components may cause spectral distortions in the signal. As a further example, slight mismatches between mixers or filters can createimbalances between the in-phase and quadrature components of the signal. It should be noted that there are numerous examples of radio fingerprinting features that may not be enumerated but may be understood to be such features by the person of skill in the art. In any case, any feature of the signal that is transmitter specific that stems from one or a combination of hardware imperfections or variances and not environmental factors may be regarded as a radio fingerprinting feature.

[0114] In some embodiments, the radio module may be configured to convert the RF signal into a first digital signal. For example, the radio module may contain analog-to-digital converters for digitizing the electromagnetic signals into digital signals for processing using the radio processing module.

[0115] The method continues to 304 with generating, at the processor, using a first trained machine learning model, a first matching score based on the RF signal. For example, the first trained machine learning model can be a model of machine learning models 242 stored on the memory of authentication device 102. The machine learning model can be operated using processing device 220 of authentication device 102. The machine learning model can accept a representation of the RF signal as input and produce an output matching score. The representation of the RF signal may be a digital signal, as produced by the radio module 210. The output matching score can be a confidence score. For example, a higher score can indicate that the model has a higher confidence that the RF features contained in the received signal match the RF features of a signal transmitted by an authorized transmitter, and a lower score can indicate a lack of confidence as to the presence of a match. It will be appreciated that in some embodiments, a higher score can indicate a lack of a confidence about matching and a lower score can indicate a high confidence towards a match, depending on the specific design choices of the particular model used.

[0116] For example, the first trained machine learning model may be trained on sample RF signal data from transmitter 112 of FIG. 1. When it receives signal 120 from transmitter 112, the first trained machine learning model may output a high matching score, indicating a high likelihood of a match.

[0117] In a similar manner, attacking device 130 may send signal 122 to authentication device 102, which may be a replica of signal 120. Signal 120 may be replicated, for example,through relaying or replaying techniques. However, signal 122 may carry its own distinct set of radio fingerprinting characteristics, such as unique phase noise, IQ imbalances, gain imbalances, etc., stemming from its own RF hardware transmitting the signal. The radio fingerprint characteristics of signal 122 may not match that of signal 120. When the first machine learning model receives signal 122, the first machine learning model may generate a matching score indicating a low likelihood of match. It will be appreciated that although signal 122 may contain a valid passcode for the secured system, the radio fingerprint characteristics associated with the attacking device 130 will cause the model to generate a matching score indicative of a low likelihood of match.

[0118] The method continues to 306 with generating, at the processor, an authentication indication based on a comparison of the matching score with a predefined confidence threshold. The authentication indication may be a positive indication that a match is likely to exist, or a negative indication that a match does not exist. For example, a binary output comprising a 1 or 0 can be generated based on comparing the matching score with the predefined threshold. The predefined threshold can be any pre-selected number, such as 80%. For example, for models configured to produce a high matching score when a match is detected, a positive authentication indication, such as a binary ‘T, may be generated if the matching score exceeds the predefined confidence threshold. Similarly, a negative authentication signal may be generated if the matching score does not exceed the predefined confidence threshold. Conversely, for models that are configured to produce a high matching score when a match is not detected, a negative authentication signal may be produced if the confidence score exceeds a predefined confidence threshold.

[0119] In some embodiments, the authentication indication can comprise the absence of any signal. For example, if the output matching score indicates a match, a positive authentication indication can be produced, represented, for example, by a binary T. If the output matching score does not indicate a match, the negative authentication indication can be represented by a binary ‘O’, or by no signal being produced at all.

[0120] The method continues to 308 with transmitting, at the processor, the authentication indication to the secured system, wherein the secured system is configured to deny access to at least one secured feature of the one or more secured features if a negativeauthentication indication is detected from the processing device. As described, the negative authentication indication can be in the form of, for example, a signal containing a message indicating of a lack of a match, the lack of a positive signal, a binary 0, no signal at all, or any other similarly suitable way of indicating the lack of a match, depending on the specific configurations of the system. It should be appreciated that in any case, the secured system can be configured to detect that a negative authentication indication has been received, regardless of the specific choice of form for the negative authentication indication. For example, the negative authentication indication could be the lack of any signal, or the lack of a positive authentication indication, in which case transmitting the authentication indication may comprise sending no signals at all to the secured system. The secured system may be configured to detect this condition as a negative authentication indication, and thereby deny access to the secured features.

[0121] The secured system may be configured to receive a passcode from the transmitter containing a passcode to use one of the secured features. For example, the secured system can be a vehicle, and the at least one secured feature can include a vehicle door lock or a vehicle starting capability. The vehicle may receive a passcode from its wireless key fob for unlocking the doors of the vehicle, or to remotely start the vehicle.

[0122] The secured system may include an entry system. For example, system 104 includes entry module 110. The entry system can be configured to allow access to one or more of the secured features. For example, entry module 110 may be a keyless entry system of a vehicle connected to circuitry for unlocking the doors of the vehicle or for starting the engines of the vehicle. The entry module 110 may be operable to only allow access to the at least one secured feature upon at least detecting a positive authentication indication. For example, entry module 110 may require both the reception of a valid passcode from a received RF signal and the detection of a positive authentication indication before it unlocks the doors of the vehicle. As such, even if attacking device 130 was able to encode the correct passcode into signal 122 transmitted to authentication device 102, system 104 would not grant access to its secured features, as signal 122 would not pass the radio fingerprinting check implemented by the machine learning models. Thus, entry module would only have the reception of a valid passcode, but not a positive authentication indication from authentication device 102, and would correspondingly not allow access. As described, apositive authentication indication can take any form suitable to communicate the presence of a match. For example, the positive authentication indication could include a message or a binary T. In some embodiments, a positive authentication indication could include the absence of detecting any negative authentication indications.

[0123] In some embodiments, the processing device may be further configured to decode, using a radio processing module, the RF signal to extract the passcode, and wherein the generating the authentication indication is further based on the first passcode matching an authorized passcode. The radio processing module may be a software defined radio software system configured to process digitized RF signals. Radio processing module may implement algorithms capable of demodulating RF signals and decoding the contents thereof. For example, the authentication device 102 may receive RF signal 120 and decode the signal to extract a passcode. The authentication device may then, in addition to processing RF signal 120 using machine learning models to determine a radio fingerprint match, also determine whether the extracted passcode matches an expected passcode. The authentication device may allow access to the secured features (e.g., unlocking a door or starting the vehicle) when both the radio fingerprint and the passcode pass authentication.

[0124] In some embodiments, the authentication device 102 may be able to replace the role of a keyless entry system in a vehicle 104. Authentication device 102 may be directly connected to or may be able to directly access the secured features. For example, authentication device 102 may be capable of directly unlocking the doors of the vehicle. In this way, the authentication device 102 may perform all aspects entry control for the vehicle, from receiving a signal from a key fob, to authenticating the signal, to unlocking the doors of the vehicle and / or starting the vehicle.

[0125] In some embodiments, authentication device may be configured to authenticate multiple transmitters. For example, for a vehicle, multiple keys, such as one primary and one backup key, may be configured to open the vehicle’s doors and to start the vehicle. In some embodiments, machine learning models 242 may include multiple trained machine learning models, with one model corresponding to each transmitter. For example, a first trained machine learning model can be trained on data corresponding to one transmitter, and a second trained machine learning model can be trained on datacorresponding to a second transmitter. In some embodiments, one model may be trained on data corresponding to more than one transmitter, and may thus be capable of authenticating RF signals transmitted from multiple transmitters. For example, in one embodiment, one model is trained on data corresponding to two transmitters, such as, for example, two key fobs. In such embodiment, the model is capable of authenticating RF signals transmitted from either key fob.

[0126] It will be appreciated that there may be advantages to using one model for each transmitter. For example, as a model learns a greater diversity of radio fingerprinting features associated with a positive inference, the ability of the model to correctly make a negative inference may decrease, and the model may produce more false positives as a result. Therefore, there may be a practical limit as to the maximum number of transmitters that a single model can be trained on, which may relate to a minimum desired level of effectiveness.

[0127] For example, where the authentication device is configured to authenticate multiple transmitters, the plurality of RF signals may further include a second RF signal. The plurality of transmitters may further include a second transmitter. The second RF signal may be transmitted by the second transmitter and may include a second passcode and a second plurality of radio fingerprint features. For example, a second key fob may be provided for a vehicle. The first and second key fobs may both be operable to transmit RF signals containing passcodes for accessing the vehicle. The first and second RF signals may encode the same passcode, or each key fob may encode a unique keycode that is configured to unlock the vehicle. As with the first RF signal from the first key fob, the processing device 220 may be similarly convert the second RF signal into a second digital signal. The processing device 220 may then operate the second machine learning model to produce a second matching score based on the second digital signal.

[0128] In some embodiments, the processing device may, for each received RF signal, try each stored machine learning model in order. For example, for the first RF signal, the processing device 220 may perform inference using the first RF signal as input to the first machine learning model, which may produce a matching score exceeding the required confidence threshold, thereby producing a positive authentication indication for, for example, unlocking the vehicle. For the second RF signal, the processing device may performinference using the first machine learning model, which is trained on the first transmitter. The resulting matching score may not meet the required threshold. The processing device 220 may then try inference using the second machine learning model, which may result in a sufficiently high matching score. As a result, the processing device 220 may generate a positive authentication indication, which is sent to the secured system 104, and allows access to the secured features.

[0129] In some embodiments, a plurality of RF signals may be exchanged between the transmitter and receiver. A combination of the plurality of RF signals can then be fingerprinted by authentication device 102 to verify the identity of the transmitter.

[0130] Reference is next made to FIG. 9, which shows an example system 1100 that may be used for training and deploying machine learning models for authenticating access requests to a secured system. The trained machine learning models may be deployed in authentication device 102 of FIG. 1 for the purposes of authenticating access requests in RF signals 120 and 130 to secured system 104.

[0131] System 1100 may include a computing device 1110 and an authentication device 1120. Authentication device 1120 may record sample RF signals from one or both of authorized transmitters 1130 and 1132. The recorded sample RF signals may be transferred to computing device 1110 to generating training and testing data for training a machine learning model. The computing device 1110 may further train the machine learning model and transmit the trained model to authentication device 1120. The authentication device can then be integrated into a secured system, such as system 104 of FIG. 1 , to perform inference using the machine learning models to determine if the received RF signals match that of the recorded sample RF signals.

[0132] Authentication device 1120 may be configured to capture data (i.e. , RF signals) for generating a training data set. Authentication device 1120 may be configured to store a plurality of received RF signals for transmitting to the computing device to generate a training data set after each data capture session. Alternatively, authentication device 1120 may be configured to transfer captured RF signals to computing device 120 as they are received. For example, authentication device 1120 can be in communication with computing device 1110, whether wirelessly or via a communication cable, and may be configured to continuouslytransfer data as the data is processed. The authentication device 1120 may be configured to operate a locally stored machine learning model for inferring whether the radio fingerprint of a received RF signal matches the radio fingerprints of signals transmitted by an authorized transmitter. For example, the authentication device 1120 may be the same device as authentication device 102 of FIG. 1 and may therefore be operable to both perform inference for authenticating validating radio fingerprints using trained models and capture data to train the models used for inference.

[0133] Authentication device 1120 may include a user interface component for enabling the data capture functionality. For example, a button or switch can be provided that activates a data capture mode. The operator of the system may use the user interface component to activate data capture mode, and then operate transmitters 1130 and 1132 to transmit one or more RF signals, which may be received and captured by authentication device 1120. Authentication device 1120 may be configured to capture positive sample RF signals, containing RF signals that may be used as examples of RF signals from an authorized transmitter. The positive sample RF signals may contain examples of signals that the machine learning model should learn to positively infer a match from (i.e., infer the presence of a match). In some embodiments, authentication device 1120 may also be configured to capture negative sample RF signals, containing RF signals that may be used as examples of RF signals from unauthorized transmitters. The negative sample RF signals may contain examples of signals that the machine learning model should learn to negative infer a match from (i.e., infer the absence of a match). In some embodiments, the authentication device 1120 may include user interface components for labelling negative data as it is recorded. For example, a 3-way switch can be provided for “not capturing”, “positive capturing”, and “negative capturing”. In some embodiments, the positive and negative data can be labelled after the fact. For example, a user operator can use the computing device to manually perform labelling. Alternatively, an automatic routine may be configured to perform the labelling at the computing device.

[0134] In some embodiments, a device may be provided for capturing the training data that is separate from the device performing inference using the trained models. For example, an RF capture device comprising an RF receiver with storage and processing capabilities may be provided to capture a plurality of sample RF signals. The computing device may usethe plurality of sample RF signals to generate a training data set and train machine learning models using the training data set. The trained models may then be loaded onto an authentication device, separate from the RF capture device, to perform inference. However, it will be appreciated that embodiments which provide a single device with combined data capture and inference capability may be advantageous in a number of ways. For example, as the authentication device 102 requires RF receive capability during inference runtime, providing one device rather than two separate devices may lower the overall cost of the system. Additionally, there may be greater ease of use for technicians or operators of the system, as only one device needs to be operated and learned. Additionally, as the receive chain (i.e. , radio hardware) for capturing the training data would be the same receive chain as for inference, there is less chance for variations contained in the processed signal that stem from the receiving hardware to affect inference accuracy.

[0135] The computing device 1110 may be configured to receive a plurality of sample RF signals and to process the sample RF signals to generate a training dataset and a testing dataset. For example, a subset of the plurality of sample signals may be taken to be used as training data for training the machine learning model and the rest may be used as testing data to verify the performance of the model after training. In some embodiments, the computing device 1110 may be configured to augment the dataset by creating new samples and new data. New positive data may be created from the existing positive data samples. In some embodiments, computing device 1110 may be configured to produce negative data from positive data. For example, impairments can be added to positive data samples in a fashion that would change the radio fingerprint of the samples, thus generating negative data samples. In some embodiments, computing device 1110 may be configured to implement a dataset curation process for generating training datasets, as will be described with respect to FIG. 8.

[0136] The computing device 1110 may further be configured to operate algorithms to train a machine learning model. The machine learning model may include any type of model architecture suitable for RF processing, including, for example, any one or a combination of: convolutional neural networks, recurrent neural networks, long short-term memory, transformers, autoencoders, support vector machines, or any other suitable type of model as may be known to the person of skill in the art.

[0137] The computing device 1110 may be configured to implement algorithms for training the machine learning models. In some embodiments, the models may begin from an untrained state (i.e., initialized at random weights) and may be trained using one or more training algorithms. The training algorithms can include any one or a combination of suitable algorithm for adjusting the model’s parameters to minimize a loss function, such as, for example, stochastic gradient descent, adaptive moment estimation, root mean square propagation, adaptive gradient algorithm, or any other suitable algorithm as may be known to the person of skill in the art. In some embodiments, the models may be pre-trained, and only fine-tuning may be performed. For example, a model may be used in which the model weights have been pre-set during a prior learning process, and fine tuning may involve further training using a new dataset with a smaller learning rate. Additionally, or alternatively, certain layers may be frozen while other layers are tuned.

[0138] In some embodiments, the computing device 1110 may include one or more computing devices. Some functions of the computing device 1110 may be performed by separate computing devices. For example, one computing device may perform the creation of the training dataset, and another device may perform the training of the machine learning model.

[0139] In some embodiments, testing system 110 may include an RF testbed 1140. RF testbed 1140 may be configured to produce positive and negative RF samples for inclusion into the training and testing dataset for training the machine learning models. RF testbed 1140 may contain connected physical devices capable of recording, replaying, or relaying signals from authorized transmitters, such as signals from transmitters 1130 and 1132, thereby generating unauthorized signal samples to use as negative training data. For example, an authorized transmitter can be present at the testbed to transmit authorized RF signals, and the connected physical devices can be configured to relay and replay the signal to generate negative RF samples, which can be recorded at the RF testbed to be captured as negative RF samples. RF testbed 1140 may further contain one or more computing device in communication with and configured to operate the connected physical devices. For example, the connected physical devices may be automatically operated by the one or more computing devices to produce RF samples for training. In some embodiments, the connectedphysical devices may include contain authorized transmitters, the operation of which can be automated to produce positive RF samples for model training.

[0140] Reference is next made to FIG. 4, which shows a flowchart of an example method 400 for training and deploying machine learning models for authenticating access requests to a secured system. Method 400 may be used by system 1100 of FIG. 9 to train and deploy the machine learning models used in authentication device 1120. The secured system may comprise one or more secured features. For example, the secured system may be system 104 of FIG. 1.

[0141] The method begins at 402 with recording, using an authentication device, a first set of samples from a first authorized transmitter in a first environment. For example, the authentication device 1120 of FIG. 9 may be used to record a first set of sample RF signals from transmitter 1130.

[0142] The method proceeds to 404 with recording, using the authentication device, a second set of samples from the first authorized transmitter in a second environment. For example, authentication device 1120 may record a second set of samples from transmitter 1130, but in a different environment from that in which the first set of samples was recorded. The first environment may have a first set of RF transmissive properties and the second environment may have a second set of RF transmissive properties different from the first set of RF transmissive properties. In some embodiments, three, four, five, or any number of additional environments can be used to record samples. As the samples will be included as training data, including multiple different environments may enhance the model’s ultimate ability to de-emphasize the contribution of features of a signal that may arise due to specific environmental conditions, while prioritizing transmitter specific radio fingerprint features that remain common between all of the environments.

[0143] The set of RF transmissive properties may include different multipath profiles. For example, a different set of RF impeding or reflecting obstacles may be present in the first environment as compared to the second environment. The different combination of obstacles in the environment could result in different received signal characteristics, due primarily to the unique obstacles present in the environments. It can be seen then that exposing a model to training data corresponding to various different environmental obstacles may mitigate thecontribution of any individual set of obstacles. As another example, the received power of the signal may vary between a first environment containing RF impeding obstacles in the way of the signal, such as barriers or walls, versus a second environment with only empty space between the transmitter and the receiver. Along the same lines of reasoning, the various environments could include different distances between the transmitter and the receiver.

[0144] The method proceeds to 406 with transmitting, from the authentication device to one or more computing devices, a plurality of positive sample RF signals, the plurality of positive sample RF signals including the first set of samples and the second set of samples. The method proceeds to 408 with receiving, at the one or more computing devices, the plurality of positive sample RF signals. For example, the authentication device could be the authentication device 1120 and the one or more computing devices can include computing device 1110. The authentication device 1120 may be in communication with computing device 1110 and may be capable of transferring the captured sample RF signals to computing device 1110.

[0145] In some embodiments, the computing device is hosted on an external server and is in communication with the RF capture device and the authentication device through an internet network connection. For example, computing device 1110 may be an external server. Authentication device 1120 may transmit the captured data via an internet connection to the external device to perform training data creation and model training.

[0146] The method proceeds to 410 with assembling, at the one or more computing devices, a training dataset and a testing dataset based on the plurality of positive sample RF signals. For example, computing device 1110 may assembly the training and testing datasets based on the sample RF signals received from authentication device 1120.

[0147] In some embodiments, the method may include performing a dataset curation process. Reference is next made to FIG. 8, which shows an example dataset curation process in accordance with one or more embodiments. At 802, recordings can be captured. For example, the authentication device may record data samples, per steps 402 and 404 of method 400. In at least one embodiment, metadata for each of the recordings can be captured and / or saved simultaneously at the time of capturing the RF recordings. The metadata can also be assigned to each of the corresponding RF recordings. At 802, therecordings can further be indexed. In at least one embodiment, indexing the recordings comprises numbering the recordings. At 804, the indexed recording can be masked, labeled and / or annotated. The masking, labeling and / or annotating steps can be completed for all time and all frequency bands, for all of the recordings. In at least one embodiment, the annotating step can comprise exposing the metadata.

[0148] The dataset curation process 800 may involve locating at least one event within the recordings. At 806, the annotated RF recordings can be quantified and sliced. Slicing refers to separating the RF recording into smaller recordings around each of the located events. Each of the recordings having events can be sliced into an example. At 808, the examples 810 may be grouped and packaged and quality testing may be performed on each of the examples 810 by applying an acceptance criteria / threshold for each example. At 808, a label may be assigned to each example. The method can further comprise an optional step at 812 and 814 to augment, diversify or edit the examples 810 to produce an augmented or diversified dataset. At 816, each of the labeled examples may be grouped into a subset of the dataset that shares at least one metadata set category to produce a dataset 816, which may be used as the training and testing dataset.

[0149] In some embodiments, the training dataset and testing dataset may be further assembled based on a plurality of negative sample RF signals, the plurality of negative sample RF signals including RF signals associated with unauthorized transmitters. For example, as described, negative data may be created by computing device 1110 based on positive data. For example, the one or more computing devices may be further configured to generate at least a portion of the plurality of the negative sample RF signals based on the plurality of positive sample RF signals by adding at least one impairment to the plurality of positive sample RF signals.

[0150] In some embodiments, the method may further include generating, using at least one unauthorized RF device on an RF device testbed, at least a portion of the plurality of negative sample RF signals. For example, the RF device testbed may be RF testbed 1140 of FIG. 9. The at least one unauthorized device can include an RF replay device, or an RF relaying device. An authorized transmitter can be present at the RF testbed to generate authorized RF signals. The at least one unauthorized device may be configured to capturethe authorized RF signals from the authorized transmitter and replay the signal. The relayed / replayed signals may be captured and used as negative training data for model training.

[0151] In some embodiments, the RF device testbed may be used to automate the generation of positive sample RF signals for model training. The RF device test bed can be configured to integrate with one or more authorized RF transmitters to automate the production of authorized RF signals, which may be captured as positive sample RF signals for model training.

[0152] In some embodiments, the training dataset and testing dataset may further be assembled based on a plurality of augmented sample RF signals, the plurality of augmented sample RF signals being generated from adding one or more augmentations to the plurality of positive sample RF signals. For example, the one or more augmentations may include l / Q switching, switching samples in the recording, creating IQ imbalances, dropping samples, adding noise, decimation, interpolation, FIR filters, changing center frequency, rotating in-phase, and any other suitable technique of creating new data from existing data. One or more augmentations may be added to the sample RF signals, creating new RF signals that can be used to extend the training and testing data set.

[0153] The method proceeds to 412 with training, at the one or more computing devices, one or more machine learning models based on the training dataset and the testing dataset to produce one or more trained machine learning models. For example, computing device 1110 may implement one or more training algorithms to train the machine learning models using the training dataset and the testing dataset.

[0154] In some embodiments, the one or more machine learning models may include one or more pre-trained models, and the training the one or more machine learning models may involve fine-tuning the pre-trained models. For example, the machine learning models may be pre-trained models. Fine tuning can be performed, which may involve using training algorithms, but with a smaller training step, or directing the training towards specific layers of the model.

[0155] The method proceeds to 414 with transmitting, from the computing device to an authentication device, the one or more trained machine learning models, and to 416 withreceiving, at the authentication device, the one or more trained machine learning models. For example, once the computing device 1110 has completed the training process, the trained machine learning models may be deployed onto authentication device 1120, where it may be stored on authentication device 1120 to be run by authentication device 1120 to perform inference.

[0156] The method proceeds to 418 with producing, at the authentication device, an authentication indication, using the one or more trained machine learning models, based on an input RF signal, wherein the authentication device is configured to send, to the secured system, the authentication indication, wherein the secured system is configured to deny access to the one or more secured features if a negative authentication indication is received from the authentication device. For example, the authentication device may operate the trained machine learning models to authenticate a received RF signal to infer whether the source of the RF signal was an authorized transmitter. The authentication device may perform the role of authentication device 102 in FIG. 1.

[0157] In some embodiments, the one or more machine learning models comprises at least a first model corresponding to a first transmitter and a second model corresponding to a second transmitter. For example, as described with reference to FIG. 1, multiple machine learning models may be trained, with one model corresponding to one transmitter. The plurality of positive sample RF signals further includes at least a first set of samples from a second authorized transmitter recorded in the first environment and a second set of samples from the second authorized transmitter recorded in the second environment. For example, similar to the first transmitter, the second transmitter could be recorded in multiple environments to capture difference sets of samples in a diverse range of environments for the purposes of generating a diverse dataset for the second transmitter.

[0158] The training dataset and testing dataset further comprises a first training dataset and a first testing dataset for training the first model and a second training dataset and a second testing data set for training the second model. For example, the computing device 1110 may be configured to produce a training dataset and testing dataset for the second transmitter. The second model may be trained using the training dataset and testingdataset corresponding to the second transmitter, so that the second model learns only radio fingerprint features corresponding to the second transmitter.

[0159] Reference is next made to FIG. 5, which shows an example method 500 for installing an authentication device in a secured system. Specifically, method 500 may be directed to the installation of device 102 in a secured system 104 where the secured system is a vehicle. Method 500 may be used when an existing owner of a vehicle wishes to perform an aftermarket installation of authentication device 102 into the vehicle and brings the vehicle to, for example, a mechanic shop.

[0160] At 502, the vehicle may be brought to a mechanic shop, along with key fobs that are desired to be operated to unlock and start the vehicle. Alternatively, new key fobs may be provided that are preconfigured to work with the authentication device.

[0161] At 504, the mechanic may install the authentication device, which may be authentication device 102 of FIG. 1 and authentication device 1120 of FIG. 9. The authentication device may be configured to be installable in a similar manner to that of installing a remote starter for a vehicle. The entire process may take approximately 1 hour.

[0162] At 506, the mechanic may begin a signal capture procedure on the authentication device. This may include steps 402 and 404 of method 400. The mechanic may capture a variety of RF signal data, in a variety of different locations. For example, the mechanic may bring the vehicle to various different locations with different quantities and arrangements of RF reflective or impeding obstacles present to capture a diverse dataset.

[0163] At 508, the training data is created using the data collected at 506. At 510, the model may be trained using the training data. This may include steps 406, 408, 410, and 412 of method 400. The data collected at 506 may be transferred to a computing device, such as computing device 1110 of FIG. 9, and one or more models may be trained using the computing device.

[0164] At 512, the trained models may be deployed back onto the authentication device. This may essentially include steps 414 and 416 of method 400. The authentication device may be configured to operate the machine learning models to perform radio fingerprinting to verify the source of any RF signal to access the car.

[0165] At 514, the customer leaves with the vehicle. The customer may, at the end of the process, be able to continue using the same keys, with no alteration to the user experience.

[0166] Reference is next made to FIG. 6, which shows an example method 600 for installing the authentication device in a secured system. Specifically, method 600 may be directed to the installation of device 102 in a secured system 104 where the secured system is a vehicle. Method 600 may be used when an existing owner of a vehicle wishes to perform an aftermarket installation of authentication device 102 into the vehicle and brings the vehicle to, for example, a mechanic shop. Method 600 may generally be similar to method 500, except the authentication module is pre-configured with compatible key fobs, and is installed post configuration.

[0167] At 602, one or more key fobs pre-configured to be compatible with the authentication device may be selected.

[0168] At 604, the signal capture procedure is performed on the authentication device using the one or more key fobs. This may include steps 402 and 404 of method 400. This is essentially similar to step 506 of method 500, except the signal capture procedure is being performed before installation of the unit, at the time the authentication device is being produced.

[0169] At 606, the training data is created using the data collected at 604. At 608, the model may be trained using the training data. This may include steps 406, 408, 410, and 412 of method 400. The data collected at 604 may be transferred to a computing device, such as computing device 1110 of FIG. 9, and one or more models may be trained using the computing device.

[0170] At 610, the trained models may be deployed back onto the authentication device. This may include steps 414 and 416 of method 400. The authentication device may be configured to operate the machine learning models to perform radio fingerprinting to verify the source of any RF signal to access the car. The authentication device may, at this point, be delivered to market. For example, the pre-configured authentication device may be delivered to the mechanic, along with pre-configured keys configured for use with the authentication device.

[0171] At 612, a customer may bring a vehicle to be fitted with the authentication device to an installer, for example, a mechanic.

[0172] At 614, the mechanic may install the authentication device. Similar to step 504 of method 500, the authentication device may be configured to be installable in a similar manner to that of installing a remote starter for a vehicle. The entire process may take approximately 1 hour.

[0173] At 616, the customer leaves with the vehicle. Similarly to method 500, the customer may, at the end of the process, leave with minimal to no alteration to the driving process. However, the customer may be required to use a new set of keys that has been pre-configured to work with the authentication device.

[0174] Reference is next made to FIG. 7, which shows an example method 700 for installing the authentication device in a secured system. Specifically, method 700 may be directed to the installation of device 102 in a secured system 104 where the secured system is a vehicle. Method 700 may be used when the authentication device 102 is installed at the factory at the time of manufacture of the vehicle.

[0175] At 702, one or more key fobs to be compatible with the authentication device may be selected.

[0176] At 704, the signal capture procedure is performed on the authentication device using the one or more key fobs. This may include steps 402 and 404 of method 400. This is essentially similar to step 506 of method 500, except the signal capture procedure is being performed before installation of the unit.

[0177] At 706, the training data is created using the data collected at 704. At 708, the model may be trained using the training data. This may include steps 406, 408, 410, and 412 of method 400. The data collected at 704 may be transferred to a computing device, such as computing device 1110 of FIG. 9, and one or more models may be trained using the computing device.

[0178] At 708, the trained models may be deployed onto the authentication device. This may include steps 414 and 416 of method 400. The authentication device may be configured to operate the machine learning models to perform radio fingerprinting to verifythe source of any RF signal to access the car. The authentication device may then be installed into the vehicle at the factory.

[0179] At 712, the vehicle leaves the factory after customer purchase. As the authentication device operates in the background and does not modify any functionality of the vehicle from the user perspective, the customer may operate the vehicle as with any vehicle, and may not perceive the presence of the authentication device to any significant degree, if at all.

[0180] While the above description describes features of example embodiments, it will be appreciated that some features and / or functions of the described embodiments are susceptible to modification without departing from the spirit and principles of operation of the described embodiments. For example, the various characteristics which are described by means of the represented embodiments or examples may be selectively combined with each other. Accordingly, what has been described above is intended to be illustrative of the claimed concept and non-limiting. It will be understood by persons skilled in the art that other variants and modifications may be made without departing from the scope of the invention as defined in the claims appended hereto. The scope of the claims should not be limited by the preferred embodiments and examples, but should be given the broadest interpretation consistent with the description as a whole.

Claims

CLAIMS:

1. An authentication device for preventing radiofrequency (RF)-based attacks on a secured system using machine learning-based radio fingerprinting, wherein the secured system comprises one or more secured features, the authentication device comprising:a radio module, configured to receive a plurality of RF signals from a plurality of transmitters, wherein the plurality of RF signals comprises a first RF signal and the plurality of transmitters comprises a first transmitter, the first RF signal being transmitted by the first transmitter, the first RF signal comprising a first passcode and corresponding to at least one first radio fingerprint feature;a memory module, having stored thereon:a radio processing module; andone or more trained machine learning models; and a processing device, configured to:generate, using the first trained machine learning model, a first matching score based on the at least one radio fingerprint feature;generate an authentication indication based on a comparison of the matching score with a predefined confidence threshold; andtransmit, to the secured system, the authentication indication, wherein the secured system is configured to deny access to at least one secured feature of the one or more secured features if a negative authentication indication is detected from the processing device.

2. The system of claim 1 , wherein: the processing device is further configured to decode, using the radio processing module, the RF signal to extract the passcode, and wherein the generating the authentication indication is further based on the first passcode matching an authorized passcode.

3. The system of any one of claims 1 to 2, wherein:the radio module is configured to convert the RF signal into a first digital signal; andthe processing device is further configured to generate, using the first trained machine learning model, the matching score based on the first digital signal.

4. The system of any one of claims 1 to 3, wherein the authentication indication is received at an entry system of the secured system, and wherein the entry system is operable to only allow access to the at least one secured feature upon at least detecting a positive authentication indication.

5. The system of claim 4 except when dependent upon claim 2, wherein the entry system is operable to deny access to the at least one secured feature further upon determining that the passcode fails to match an authorized passcode.

6. The system of any one of claims 1 to 5, wherein the secured system comprises a vehicle, and the entry system comprises a keyless entry system.

7. The system of any one of claims 1 to 6, wherein the one or more secured feature comprises one or more of:a vehicle door lock; anda vehicle starting capability.

8. The system of any one of claims 1 to 7, wherein the transmitter comprises a vehicle key fob.

9. The system of any one of claims 1 to 8, wherein the one or more trained machine learning models comprises:a first trained machine learning model, wherein the first machine learning model corresponds to the first transmitter;and a second trained machine learning model, wherein the second machine trained learning model corresponds to a second transmitter.

10. The system of any one of claims 1 to 9, wherein:the plurality of RF signals further comprises a second RF signal and the plurality of transmitters further comprises of second transmitter, the second RF signal being transmitted by the second transmitter and comprising a second passcode and a second plurality of radio fingerprint features; andthe processing device is further configured to:convert, using the radio processing module, the second RF signal into a second digital signal;generate, using the second machine learning model, a second matching score based on the second digital signal;generate the authentication indication based on the second matching score exceeding the predefined confidence threshold; andsend, to the secured system, the authentication indication.

11. The system of any one of claims 1 to 10, wherein the processing device is further configured to:decode, using the radio processing module, the second RF signal to extract the second passcode, andwherein the processor generating the authentication indication is further based on: the second passcode matching a second authorized passcode.

12. The system of any one of claims 1 to 10, wherein the plurality of radio fingerprint features of the RF signal derives from a combination of one or more hardware components of the transmitter.

13. A system for preventing RF-based attacks on an access-controlled system, comprising:the authentication device of any one of claims 1 to 12; andthe access-controlled system in communication with the authentication device, the access-controlled system comprising the secured system.

14. A method for preventing radiofrequency (RF)-based attacks on a secured system, wherein the secured system comprises one or more secured features, using machine learning-based radio fingerprinting, comprising:receiving, at a radio module, a first RF signal from a first transmitter, the first RF signal comprising a first passcode and at least one first radio fingerprint feature;generating, at the processor, using one or more trained machine learning model, a first matching score based on the RF signal;generating, at the processor, an authentication indication based on a comparison of the matching score with a predefined confidence threshold; and transmit, at the processor, the authentication indication to the secured system, wherein the secured system is configured to deny access to at least one secured feature of the one or more secured features if a negative authentication indication is detected from the processing device.

15. The method of claim 14, wherein: the processing device is further configured to decode, using a radio processing module, the RF signal to extract the passcode, and wherein the generating the authentication indication is further based on the first passcode matching an authorized passcode.

16. The method of any one of claims 14 to 15, wherein:the radio module is configured to convert the RF signal into a first digital signal; andthe processing device is further configured to generate, using the first trained machine learning model, the matching score based on the first digital signal.

17. The method of any one of claims 14 to 16, wherein the authentication indication is received at an entry system of the secured system, and wherein the entry system is operable to only allow access to the at least one secured feature upon at least detecting a positive authentication indication.

18. The method of claim 17 except when dependent upon claim 15, wherein the entry system is operable to deny access to the at least one secured feature further upon determining that the passcode fails to match an authorized passcode.

19. The method of any one of claims 14 to 18, wherein the secured system comprises a vehicle, and the entry system comprises a keyless entry system.

20. The method of any one of claims 14 to 19, wherein the one or more secured feature comprises one or more of:a vehicle door lock; anda vehicle starting capability.re21. The method of any one of claims 14 to 20, wherein the transmitter comprises a vehicle key fob.

22. The method of any one of claims 14 to 21 , wherein the one or more trained machine learning models comprises a first trained machine learning model corresponding to the first transmitter and comprises a second machine learning model corresponding to a second transmitter.

23. The method of any one of claims 14 to 22, wherein:the plurality of RF signals further comprises a second RF signal and the plurality of transmitters further comprises of second transmitter, the second RF signal being transmitted by the second transmitter and comprising a second passcode and a second plurality of radio fingerprint features; andthe processing device is further configured to:convert, using the radio processing module, the second RF signal into a second digital signal;generate, using the second machine learning model, a second matching score based on the second digital signal;generate the authentication indication based on the second matching score exceeding the predefined confidence threshold; andsend, to the secured system, the authentication indication.

24. The method of any one of claims 14 to 23, wherein the processing device is further configured to:decode, using a radio processing module, the second RF signal to extract the second passcode, andwherein the processor generating the authentication indication is further based on: the second passcode matching a second authorized passcode.

25. The method of any one of claims 14 to 24, wherein the plurality of radio fingerprint features of the RF signal derives from a combination of one or more hardware components of the transmitter.

26. A system for training and deploying machine learning models for authenticating access requests to a secured system, the secured system comprising one or more secured features, the system comprising:an authentication device, configured to:record a plurality of positive sample RF signals, wherein:the plurality of positive sample RF signals comprises at least a first set of samples from a first authorized transmitter recorded in a first environment and a second set of samples from the first authorized transmitter recorded in a second environment;the first environment comprises a first set of RF transmissive properties; andthe second environment comprises a second set of RF transmissive properties, different from the first set of RF transmissive properties;transmit the plurality of positive sample RF signals to one or more computing devices;receive one or more trained machine learning models from the one or more computing devices;produce an authentication indication, using the one or more trained machine learning models, based on an input RF signal; andsend the authentication output to the secured system, wherein the secured system is configured to deny access to the one or more secured features if a negative authentication indication is received from the authentication device; and one or more computing devices, configured to:receive the plurality of positive RF signals from the authentication device;assemble a training dataset and a testing dataset based on the plurality of positive sample RF signals;train one or more machine learning models based on the training dataset and testing dataset to produce one or more trained machine learning models; andtransmit the one or more trained machine learning models to the authentication device.

27. The system of claim 26, wherein the training dataset and testing dataset is further assembled based on a plurality of negative sample RF signals, the plurality of negative sample RF signals comprising RF signals associated with unauthorized transmitters.

28. The system of claim 27, wherein the one or more computing devices is further configured to generate at least a portion of the plurality of negative sample RF signals based on the plurality of positive sample RF signals by adding at least one impairment to the plurality of positive sample RF signals.

29. The system of claim 28, further comprising:an RF device testbed, the testbed comprising at least one unauthorized RF device, wherein the at least one unauthorized RF device is configured to generate at least a portion of the plurality of negative sample RF signals.

30. The system of any one of claims 26 to 29, wherein the training dataset and testing dataset is further assembled based on a plurality of augmented sample RF signals, the plurality of augmented sample RF signals being generated from adding one or more augmentations to the plurality of positive sample RF signals.

31. The system of any one of claims 26 to 29, wherein the first environment further comprises a first set of RF impeding obstacles, and the second environment further comprises a second set of RF impeding obstacles, wherein the second set of RF impeding obstacles is arranged substantially differently from the first set of RF impeding obstacles.

32. The system of any one of claims 26 to 31 , wherein the one or more machine learning models comprises one or more pre-trained models, and wherein the training the one or more machine learning models comprises fine-tuning the pre-trained models.

33. The system of any one of claims 26 to 32, wherein:the one or more machine learning models comprises at least a first model corresponding to a first transmitter and a second model corresponding to a second transmitter;the plurality of positive sample RF signals further comprises at least a first set of samples from a second authorized transmitter recorded in the first environment and a second set of samples form the second authorized transmitter recorded in the second environment; andthe training dataset and testing dataset further comprises:a first training dataset and a first testing dataset for training the first model; anda second training dataset and a second testing data set for training the second model.

34. The system of any one of claims 26 to 33, wherein the computing device is hosted on an external server and is in communication with the authentication device through an internet network connection.

35. A method for training and deploying machine learning models for authenticating access requests to a secured system, the secured system comprising one or more secured features, the method comprising:recording, using an authentication device, a first set of samples from a first authorized transmitter in a first environment;recording, using the authentication device, a second set of samples from the first authorized transmitter in a second environment, wherein the first environment comprises a first set of RF transmissive properties and the second environment comprises a second set of RF transmissive properties different from the first set of RF transmissive properties;transmitting, from the authentication device to one or more computing devices, a plurality of positive RF signals, the plurality of positive RF signals comprising the first set of samples and the second set of samples;receiving, at the one or more computing devices, the plurality of positive RF signals;assembling, at the one or more computing devices, a training dataset and a testing dataset based on the plurality of positive sample RF signals;training, at the one or more computing devices, one or more machine learning models based on the training dataset and the testing dataset to produce one or more trained machine learning models;transmitting, from the computing device to an authentication device, the one or more trained machine learning models;receiving, at the authentication device, the one or more trained machine learning models; andproducing, at the authentication device, an authentication indication, using the one or more trained machine learning models, based on an input RF signal, wherein the authentication device is configured to send, to the secured system, the authentication indication, wherein the secured system is configured to deny access to the one or more secured features if a negative authentication indication is received from the authentication device.

36. The method of claim 35, wherein the training dataset and testing dataset is further assembled based on a plurality of negative sample RF signals, the plurality of negative sample RF signals comprising RF signals associated with unauthorized transmitters.

37. The method of claim 36, wherein the one or more computing devices is further configured to generate at least a portion of the plurality of negative sample RF signals based on the plurality of positive sample RF signals by adding at least one impairment to the plurality of positive sample RF signals.

38. The method of claim 37, further comprising:generating, using at least one unauthorized RF device on an RF device testbed, at least a portion of the plurality of negative sample RF signals.

39. The method of any one of claims 35 to 38, wherein the training dataset and testing dataset is further assembled based on a plurality of augmented sample RF signals, the plurality of augmented sample RF signals being generated from adding one or more augmentations to the plurality of positive sample RF signals.

40. The method of any one of claims 35 to 39, wherein the first environment further comprises a first set of RF impeding obstacles, and the second environment further comprises a second set of RF impeding obstacles, wherein the second set of RF impeding obstacles is arranged substantially differently from the first set of RF impeding obstacles.

41. The method of any one of claims 35 to 40, wherein the one or more machine learning models comprises one or more pre-trained models, and wherein the training the one or more machine learning models comprises fine-tuning the pre-trained models.

42. The method of any one of claims 35 to 41 , wherein:the one or more machine learning models comprises at least a first model corresponding to a first transmitter and a second model corresponding to a second transmitter;the plurality of positive sample RF signals further comprises at least a first set of samples from a second authorized transmitter recorded in the first environment and a second set of samples form the second authorized transmitter recorded in the second environment; andthe training dataset and testing dataset further comprises:a first training dataset and a first testing dataset for training the first model; anda second training dataset and a second testing data set for training the second model.

43. The method of any one of claims 35 to 42, wherein the computing device is hosted on an external server and is in communication with the authentication device through an internet network connection.

44. A system for training and deploying machine learning models for authenticating access requests to a secured system, the secured system comprising one or more secured features, the system comprising:an RF capture device, configured to:record a plurality of positive sample RF signals, wherein:the plurality of positive sample RF signals comprises at least a first set of samples from a first authorized transmitter recorded in a first environment and a second set of samples from the first authorized transmitter recorded in a second environment;the first environment comprises a first set of RF transmissive properties; andthe second environment comprises a second set of RF transmissive properties, different from the first set of RF transmissive properties;transmit the plurality of positive sample RF signals to one or more computing devices;an authentication device, configured to:receive one or more trained machine learning models from the one or more computing devices;produce an authentication indication, using the one or more trained machine learning models, based on an input RF signal; andsend the authentication indication to the secured system, wherein the secured system is configured to deny access to the one or more secured features if a negative authentication indication is received from the authentication device; and one or more computing devices, configured to:receive the plurality of positive RF signals from the authentication device;assemble a training dataset and a testing dataset based on the plurality of positive sample RF signals;train one or more machine learning models based on the training dataset and testing dataset to produce one or more trained machine learning models; and transmit the one or more trained machine learning models to the authentication device.

Images