Patent Application
20070264939
Referring first to
Turning to
The pulse identification circuit 120 comprises a Fast Fourier Transform (FFT) engine 112, a pulse detector 124 and a snapshot buffer (SB) 126. The FFT engine 122 generates real-time power spectral data and the pulse detector 124 continuously monitors the output of the FFT to detect pulses worthy of further analysis by the device identification algorithms according to the present invention. The snapshot buffer 126 stores a segment of received (I/Q) waveform samples over time. For example, in one embodiment the snapshot buffer 126 stores a 35 ms segment of complex 20-bit I/Q waveform samples at a sample frequency of 40 M symbols per second (Msps). Examples of a spectrum analysis subsystem are described in commonly assigned U.S. Patent Publication No. 20050002473A1, entitled “Signal Pulse Detection Scheme for Use in Real-Time Spectrum Analysis” and U.S. Pat. No. 6,714,605 B2, the entirety of each of which are incorporated herein by reference. The pulse detector 124 determines where in the snapshot buffer 126 the I/Q samples are located for a particular pulse.
The pulse identification circuit 120 may be implemented as a plurality of digital logic gates on an integrated circuit (IC) in a VLSI implementation, such as on an application specification IC (ASIC). Alternatively, it should be understood that the functions of the pulse identification circuit 120 may be implemented by software in the host device 20. In either case, the pulse identification circuit 120 identifies pulses in time and frequency in the snapshot buffer 126.
The output data from the spectrum analysis subsystem 110 comprises pulse event records that are stored in a buffer, such as a circular buffer. For example, a pulse event record comprises data identifying the start time, duration, power, carrier frequency, and bandwidth of a pulse. In addition, the pulse event records points to the location in the snapshot buffer where the raw digital data is located for the I/Q waveform associated with a pulse.
The host device 20 comprises a microprocessor 200 and memory 210. The microprocessor 200 and memory 210 may be integrated on a single system-on-chip (SOC) or may be separate components in a device, such as a laptop computer. The memory 210 is a computer readable medium that stores the software instructions for performing the device identification techniques according to the embodiments of the present invention. The software instructions may be viewed as separate modules comprising a pulse fingerprint analysis module 220 and a pulse sequence analysis module 230. In addition, there are templates 240 stored in the memory that are data that specify how to identify devices based on their pulse fingerprints. The microprocessor 200 executes the software stored in the memory 210 and generates device up and device messages. A “device up” message indicates the name of a device that is detected and a device down message indicates the name of a device that was previously being detected and tracked that is no longer detected.
The device identification methods according to the embodiments of the present invention use a combination of RF fingerprinting, pulse event filtering, and pulse statistics to identify wireless emitters. The pulse identification circuit 120 outputs signal pulses detected by the pulse detector 124 and raw digital signal data stored in the snapshot buffer 126. The pulse fingerprint analysis module 220 characterizes each of the pulses received from the spectrum analysis subsystem 110. To this end, a useful set of pulse metrics are defined and are measured and recorded for each detected pulse. The pulse fingerprint analysis module 220 computes pulse metrics, described hereinafter, for each identified pulse in the snapshot buffer 126 and in so doing creates a record called a pulse fingerprint record that comprises the pulse metrics for a pulse, and the pulse fingerprint records are coupled as an input to the pulse sequence analysis module 230. The pulse sequence analysis module 230 partitions pulse records into groups and identifies devices and networks using the algorithms described herein. The pulse sequence analysis module 230 iteratively partitions the pulse groups into subgroups based on pulse metrics until each subgroup contains pulses that are determined to be from a single source. For purposes of the description of the embodiments of the invention herein, a “named device” is a device that emits or transmits a signal having an a priori known transmission protocol (known to the sensor device) and an “unnamed device” is a device that emits or transmits a signal having an unknown transmission protocol (unknown to the sensor device).
There is an interface between pulse fingerprint analysis module 220 and the pulse sequence analysis module 230 that allows the pulse sequence analysis module 230 to adjust the computational workload of the pulse sequence analysis module 230 based on device detection status. For example, after the pulse sequence analysis module 230 has detected a DECT-like connected pair of wireless devices, it can send a message to the pulse fingerprint analysis module 230 to do less fingerprinting on pulses that match a specific fingerprinting criteria (in this case, time frequency and phase, or bandwidth, etc.). As another example, when the pulse sequence analysis module 230 determines that a jamming signal may be present, it may send a message to the pulse fingerprint analysis module 220 to compute a bandwidth pulse metric for pulses matching specified fingerprint criteria. After the pulse sequence analysis module 230 confirms whether the signal is a jamming signal, it sends a follow-up message to pulse fingerprint analysis module 220 to remove the slew rate task from its list of operations to perform. According to still another variation, when the sensor first powers up, the pulse sequence analysis module 230 may analyze data to detect named devices only, followed by unnamed devices in order to distribute its workload.
The pulse sequence analysis module 230 captures a relatively long list of pulse fingerprint records and uses event filtering and statistics to infer which and how many devices are transmitting in the frequency band. The pulse sequence analysis module 230 executes a process that is similar to how one might use the primary, secondary, tertiary, etc., sort feature of a spreadsheet application in an iterative manner to filter, manipulate and group a set of records in a spreadsheet.
The pulse metrics used to partition the pulse records comprise characteristics associated with communication protocols, called protocol-specific characteristics, and characteristics associated with devices (but not protocols), called device-specific characteristics. The terms protocol-specific pulse data, protocol-specific characteristics and protocol-specific pulse metrics are used interchangeably herein and the terms device-specific pulse data, device-specific characteristics and device-specific pulse metrics are used interchangeably herein.
Examples of protocol-specific pulse metrics are:
The most basic way to partition a set of pulses received from multiple devices is based on whether the pulses are short bursts of energy at a particular frequency (which we refer to using the “burst” pulse type) or long pulses that persist for 35 ms or longer at a particular frequency (which we refer to using the “continuous” pulse type).
Certain types of devices, such as radar devices, emit so-called “chirp” pulses. Chirp pulses are short bursts of RF energy that are usually implemented by linearly increasing the transmit carrier frequency between the beginning and end of the burst. Although chirp pulses technically could be considered as a subtype under burst pulses, they are treated as a separate pulse type since they are somewhat of a special case (chirp pulses are the only burst waveforms that we consider that do not carry any digital information).
Some radars use non-linear frequency modulated (FM) chirp waveforms. The frequency vs. time “trajectory” or wave shape in this case is arbitrary. To characterize these pulses, the pulse fingerprinting analysis module 220 may fit one or multiple polynomials to the wave shape. A distortion metric between fitted polynomials (e.g., mean-square error) may then be used to distinguish one group of non-linear FM chirp pulses from another.
Examples of device-specific pulse metrics are:
Carrier frequency error is the difference between a device's intended carrier frequency and its actual carrier frequency, as measured by a receiving device. Frequency errors are usually caused by inaccuracies in the transmitting device's reference oscillator. For simplicity, in this description, it is assumed that all devices attempt to use center frequencies that are multiples of 500 kHz. In reality, this simplification is often but not always true, e.g., some cell phones use frequencies that are multiples of 30 kHz, some DECT cordless phones use frequencies that are non-zero down to the Hertz. Thus, a more robust way to deal with this issue is to estimate the channelization schemes used by each of the devices from the received set of pulses, and to group the pulses by their associated channelization scheme. For the purposes of this description, a “channelization scheme” is defined as an indication of whether the device uses a fixed carrier frequency or is a frequency-hopped scheme, and the carrier frequency for each of the hop channels if a frequency-hopped is determined. In the case of a frequency-hopped scheme, the carrier frequency error is the difference between a device's intended carrier frequency and its actual or measured carrier frequency at any one of the hops.
After grouping the pulses by their channelization scheme, for each pulse group, one may compute the frequency error for each device in that group by subtracting its measured carrier frequency from the nearest transmit frequency for that group at the receiving device.
Pulse Grouping Algorithm
Turning now to
At 310, the pulses are partitioned into groups based on their protocol-specific pulse metrics and device-specific pulse metrics. The groups of pulses are each further subdivided until each group is determined to be an “atomic” group, i.e., has pulses that come from only one device. There are tests, described hereinafter, that are executed on a group to determine whether it is an atomic group. For example, at 310, pulses are parsed or partitioned into groups based on their protocol-specific pulse metrics, e.g., pulse type, modulation type, data rate, etc., and then each group of pulses is further sub-divided based on device-specific pulse metrics, e.g., carrier frequency error, power, timing phase. Pulse groups continue to be subdivided until each resulting subgroup becomes an “atomic” group, i.e., it is comprised of pulses from only one device. Next, at 308, the device characteristics are estimated and recorded for each atomic group and a device up message is accordingly generated using statistics.
Thus, to summarize, the pulse grouping algorithm provides a method to identify devices that are sources of wireless signals from received radio frequency (RF) energy, comprising receiving RF energy; generating pulse metric data from the received RF energy, the pulse metric data representing characteristics associated with pulses of received RF energy; partitioning the pulses into pulse groups based on their pulse metric data; and identifying the sources of the received wireless signals based on said partitioning. Furthermore, the partitioning comprises iteratively subdividing each group into subgroups until all resulting subgroups contain pulse metric data for pulses determined to be from a single source. At each iteration, subdividing and formation of new subgroups is performed based on one or more different items of pulse metric data than what was used for subdividing at the prior iteration. Ultimately, output data is generated that identifies a source of wireless signals for any subgroup that is determined to contain pulse metric data for a single source.
The pulse sequence analysis module 230 may have two operation states or modes: an acquisition mode and a tracking mode. In the acquisition mode, the pulse sequence analysis module 230 searches for new (not yet detected) devices, and declares a device “up” when it identifies an atomic group of pulses that have not been claimed by any of the other devices that are already “up”. In the tracking mode, the pulse sequence analysis module 230 looks to see that a sufficient number of pulses matching the original fingerprint criteria found in acquisition mode are still present for the devices that are “up”. If the pulse sequence analysis module 230 determines that the criteria for a device are no longer met, then that device is declared “down”. Thus, the state information for all detected devices may be maintained between invocations for tracking purposes.
When a group of pulse records cannot be subdivided into atomic subgroups, the pulse records for that group may be simply discarded or exported to a software tool that in a user interface to allow for further manual filtering or statistical analysis.
Referring initially to
The following are the atomic group tests, that is, those tests that are performed after a grouping procedure to determine whether any of the resulting groups are atomic groups. In one embodiment of the invention, this atomic group testing procedure is performed after any grouping procedure throughout the pulse partitioning process 310.
As used herein, “named devices” refers to devices that have an a priori known transmission protocol at the sensor (radio receiver) device and “unnamed devices” refers to devices that have a transmission protocol that is unknown to the sensor device.
Atomic Group Test for Group of Pulses that are Continuous Type Pulses:
Atomic Group Test for Group of Pulses that are Burst Type Pulses:
Atomic Group Test for Group of Pulses that are Chirp Type Pulses:
In many real-world situations, it is often true that two or more devices are time-division multiplexed together on the same network (e.g., a DECT-like cordless phone and base station). The following is a description of tests that may be used to determine which devices are networked together in such a fashion.
If the pulse type is burst, then pulse records for two or more devices are said to belong to the same TDM network if any of (1) through (3) are true:
Thus, when an atomic group test involves the synchronicity pulse metric and/or periodicity pulse metric, these metrics are computed for a sequence of pulses derived from arrival times (pulse timestamps) of pulses in the sequence. The computed synchronicity pulse metric and/or periodicity pulse metric is then examined to determine whether that pulse metric is such that it indicates that a subgroup of pulses corresponding to the sequence of pulses is from a single source.
Still referring to
Turning now to
At 332, all of the remaining non-atomic sub-groups are further sub-divided into sub-groups by frequency span (RF bandwidth) such that a plurality of sub-groups are created where pulse records in each sub-group have the same RF bandwidth. Next, at 334, the atomic group tests are performed for each of the resulting sub-groups from the partitioning by bandwidth at 332. At 336, for any of the sub-groups determined to be atomic, data is output at 338 for generation of an appropriate “device up” message. All sub-groups that fail the atomic group test at 336 are further processed.
At 340, the remaining non-atomic sub-groups are further sub-divided based on average power. At 342, each of the sub-groups resulting from the partitioning at 340 are subjected to the atomic group tests. At 344, for any sub-group determined to be atomic, data is output at 346 for generation of an appropriate “device up” message.
As indicated in
Reference is now made to
The non-atomic sub-groups remaining up to this point are then further sub-divided based on whether their pulses correspond to named or unnamed devices. For the sub-group of named devices, the pulse records are further sub-divided by MAC address or other device at 366 and at 368 data is output for generation of a “device up” message for each of sub-groups that are atomic, i.e., made up of pulse records with the same MAC address or other device record. For sub-groups of unnamed pulses, the sub-groups are further partitioned and subjected to atomic group tests in order, at 369 by: RF bandwidth, then modulation type, then data rate and then by power. Data for each of the atomic sub-groups resulting from partitioning at 369 is output for generation of a “device up” message.
Referring now to
In the flow charts describe above, when pulse records are to be grouped by time period and phase, it should be understood that synchronous pulses are grouped by time period and phase, and non-synchronous pulses are kept in one group. Further, when pulse records are to be grouped by carrier frequency, fixed frequency pulse records are grouped by their carrier frequency and sub-grouped by their carrier frequency error; frequency hopping pulse records are grouped first by their channelization scheme (start, stop and step frequencies) and then by their carrier frequency error. Thus, two devices with the same nominal frequency hopset may be differentiated by small differences in their start frequencies.
Consider still another example where pulse records are accumulated for the following pulses:
A valid set of pulse grouping traversals through the tree-like diagram on
Further Examples of Pulse Grouping Procedures
Suppose the following unnamed devices are present.
A. 5 isochronous FHSS devices, comprising:
B. Fixed-frequency narrowband asynchronous carrier sense multiple access (CSMA) data network with the following characteristics:
For the purposes of this example, it is assumed that all of the above devices have the same average received signal strength, identical ramp up/down characteristics, and they have randomly assigned carrier and clock frequency errors from their nominal frequencies (normal distribution, 7.5 ppm standard deviation).
A simulation was run using a Matlab script to generate pulse records one would expect to see after a 10 second duration for this example. The simulation randomly discarded 75% of all pulses to simulate a scanning receiver in a sensor. The simulated time stamp jitter standard deviation was 5 μs. The histograms for the probability density functions (PDFs) and cumulative distribution functions (CDFs) are shown in
To apply pulse grouping the four PDF plots are examined to determine the plot having the highest peak. In this case, the highest peak occurs in the pulse duration PDF (83% probability at 1000 microseconds).
Sorting the pulse records by duration helped somewhat but it is still difficult to determine the nature of the received energy. Additional grouping is performed. Next, one of the five peaks in the carrier frequency error PDF is the focus.
The histograms for the remaining pulses (i.e., the original 1500 with all the FHSS pulses removed) are shown in
The pulse grouping approach described herein uses statistics based on relatively large batches of data, for example pulse data spanning as much as five to ten seconds, rather than small chunks (e.g., 35 ms), in order to group pulses for device identification/classification. As a result, this approach involves less time-critical processing. The only time-critical aspect of the approach occurs during pulse fingerprinting, not pulse sequence analysis. Moreover, essentially the same pulse grouping algorithm is invoked to identify all types of signals rather than multiple loosely related frameworks. This algorithm may identify certain “generic” devices that use a FHSS transmission protocol and devices that use an asynchronous time-division duplex (TDD) transmission protocol. Current signal identification approaches do not scale in order to detect these kinds of devices because they do not use enough pulse metrics. The use of such secondary pulse metrics as carrier frequency error, ramp-up/ramp-down time, etc., enable the algorithm to perform better in terms of detection time, false alarm rate, etc.
As shown in
More generally speaking, the central computing device 50 may be used to clarify any ambiguity as to whether pulse metric data generated by two or more sensors are caused by the same or different devices. In this scenario, each sensor wherein receives RF energy, generates pulse metric data for pulses of RF energy, and partitions pulses into groups based on the pulse metric data. The central computing device 50 may transmit on a periodic or occasional basis a message to each of the sensors to synchronize them with respect to a common clock such that each sensor receives RF energy, generates pulse metric data and partitions pulse metric data with respect to a common clock. This allows the central computing device to look for similarities (within some tolerance) in the pulse metric data across multiple sensors for the same pulses in order to resolve whether certain pulses are for the same source device or different source devices. Alternatively, the sensor devices may operate with respect to their own clocks (without being synchronized) and the central computing device processes the pulse metric data that it receives from the plurality of sensor devices to adjust for offsets of system clocks among the plurality of sensor devices, and then makes its comparisons of the pulse metric data to look for similarities in order to resolve whether certain pulses are from the same source device, or different source devices.
The Synchronicity and Periodicity Pulse Metrics
A periodic transmitter emits data bursts every T seconds, where T is its transmit period. A synchronous transmitter transmits at (some but not necessarily all) integer multiples of a reference period T. We define the synchronicity of a sequence of pulses with timestamps t1, . . . ,tN to be
minTsdev{(tn/T+0.5)mod 1,n=1, . . . ,N} (1)
Synchronicity is expressed in terms of periods or ppm. The synchronicity measured for a truly synchronous transmitter is the RMS sum of the transmitter's RMS timing jitter and the RMS timing error in the sensor's pulse arrival time (i.e., time stamp) estimator. As an example, in one digital logic hardware implementation of the pulse detector circuit 124, the standard deviation is approximately about 12 μs at a clock frequency of 40 MHz. If the pulse detection function is performed by software rather than hardware, the standard deviation can be made to be approximately 5 μs or less. If transmitter happens to be a Bluetooth™ data device such as a mouse or a keyboard (T=625 μs) that has, say, 50 ns timing jitter on its transmit pulses, the measured synchronicity would be approximately sqrt(0.052+52)/625=0.8%.
The signal identification algorithms used herein will declare a sequence of pulses to be synchronous with synchronicity period T0 and phase to if T0 minimizes equation (1) with a synchronicity below a pre-determined threshold, where
t
0=mean {tn/T0 mod 1,n=1, . . . ,N}.
It can be shown that this definition yields maximum likelihood estimates for to and T0.
The periodicity of a sequence of pulses with timestamps t1, . . . ,tN is defined as
maxM in {1, 2, . . . floor(T/tN)}NMT·p/tN, (2)
where p is the probability that the sensor device “sees” the pulses (i.e., the probability that the transmit pulse appears at the output of the sensor's baseband filter).
The signal identification algorithms used herein will declare a sequence of pulses to be periodic with period MT and phase t0 if
These equations are used by the pulse fingerprint analysis module 220 to compute the synchronicity pulse metric and periodicity pulse metrics. Recall that the synchronicity and periodicity pulse metrics are used in the atomic group tests referred to above. In addition, these pulse metrics are used when grouping pulses by time period and phase as described above.
Consider the following example. A Bluetooth (BT) device transmitting with the asynchronous control link (ACL) function transmits at times t1n=T10·M1n+t10, where T10 is nominally 625 μs, M1n is an increasing (but usually not sequentially) sequence of integers starting at M10=0, M1n, n=1,2, . . . are relatively prime, and t10 is the transmit time of the first pulse. The packets captured in a sensor with a scanning receiver for this device will have timestamps rn=T0·Mn+t0+νn, where T0 and t0 are the measured period and phase using the sensor's time reference, νn is the measurement noise of the time stamp algorithm used in the pulse detector circuit 124 (modeled as real, zero mean additive white Gaussian noise (AWGN)), and Mn is a subset of M1n to account for the asynchronous scanning of the sensor and BT device.
Consider the following assumptions for purposes of explaining how synchronicity and periodicity are used to identify devices for this example. The clock drift between the BT device and the sensor receiver is approximately 2.1 ppm. The BT device randomly decides to transmit every 2.625 μs with probability 0.25. The sensor can detect pulses from the BT device with probability 10% since the sensor has a scanning receiver. A Matlab simulation was used to generate pulse records for the above scenario, and to compute and display various statistics.
Approximately 0.1 ppm measurement accuracy on the sync period is needed to discriminate between different devices, or to determine whether multiple devices are time-synchronized.
A simulation was run to characterize sync period estimation error for various sync periods and measurement durations.
The following observations about the sync period measurement error can be made based on the simulation results shown in
With reference back to
Pulse Metrics Based on Pulse Timestamps
According to another embodiment, a method is provided for identifying one or more synchronous or periodic wireless transmitters using only a sequence of timestamps for their transmissions. This pulse timestamp device identification technique may be used alone to identify a device from a batch of pulse records. Alternatively, the pulse timestamp metrics may be a subset of the pulse metrics in the pulse grouping algorithms described earlier to reduce the chance that pulse records for two or more devices are confused as the same device. There are two pulse metrics based on pulse timestamps: timing period and timing phase. Pulse records may be grouped and subgrouped based on these metrics assuming the pulses come from a periodic or synchronous device. In addition, timing period and timing phase may be used to separate periodic from aperiodic pulses. The timing period and timing phase pulse metrics are measured relative to a reference clock in the sensor. The pulse timestamp is also referred to herein as the start time of a pulse. The output of the pulse timestamp signal identification algorithm includes (1) the number of synchronous or periodic transmitter devices detected; (2) the period and phase for each device, (3) an indication of which devices are time division multiplexed on the same network(s).
More specifically, a sensor with a scanning receiver captures and fingerprints pulses from one or more wireless devices and generates a sequence of pulse records comprising timestamp pulse metrics (timing period and timing phase), and identifies: (1) the number of wireless transmitters; (2) whether each transmitter is synchronous or periodic; (3) the timing period and phase for the synchronous and periodic transmitters; (4) which synchronous/periodic transmitters are on the same network; and (5) which pulses are from one or more asynchronous devices.
Device 1: Period 5 ms, phase 0 ms
Device 2: Period 5 ms, phase 0.4 ms
Device 3: Period 7.5 ms, phase 0.8 ms
Device 4: Period 7.5 ms, phase 1.25 ms
Device 5: Period 10 ms, phase 1.67 ms
Device 6: Period 10 ms, phase 2.1 ms
The pulse timestamp approach is based on autocorrelation analysis. To begin with, an appropriate sampling rate is defined (fs=100 kHz in the simulations for the examples described herein), and a discrete time sequence x(n) is defined by placing impulses at the nearest sampling instants to each of the time stamps ts(k), i.e.,
where T=1/fs is the sampling period. Next, an autocorrelation function is defined:
A new function Q(.) is defined to quantify the amount of synchronous activity at a candidate time period n or τ:
where M is some appropriate number of terms to use in the sum. Q(.) is a normalized product of harmonics of the autocorrelation values. The product structure is used to ensure that all the harmonics are present, i.e., Q(.) will be zero if even one harmonic is zero.
FIGS. 24A,24B through FIGS. 27A,27B illustrate plots for R(.) and Q(.) for several exemplary signals.
Now that the Q(.) function has been motivated and defined, a signal identification algorithm based on pulse timestamp data is defined. The Q(.) function is used to identify a set of candidate pulse periods for the received RF signals. Then, successive pulse filtering and histogram analysis are used to identify the number of devices and pulse phases for each candidate pulse period.
Turning to
The next step is to further subdivide the timestamps in the second buffer TS, to identify different devices that transmit at different phases in the period T1. To do so, at 550, a histogram is computed over the extracted timestamps stored in TS1 modulo the period T1 (i.e., the histogram is computed over the set {mod(ts,T1), for each ts in TS1}). At 560, the different phases are identified as peaks p1, . . . ,pK in the histogram computed at 550 to form atomic groups G1, . . . ,GK for each phase, where atomic groups are groups of pulses that appear to be received from a single source device as described above in connection with the pulse grouping algorithm 300 shown in
The above process of extracting synchronous pulses from the buffer TS and subdividing the extracted pulses by their phase is repeated for each remaining candidate period T2, T3, . . . , TN as shown by the loop in
Next, at 570, the number of synchronous devices is equal to the number of atomic groups determined at 560 over the iterations of the loop (T1 to TN). A set of devices are concluded to be in the same (time-synchronized) wireless network if they share the same pulse period (within some tolerance, e.g., +/−0.2 ppm), and their phases and pulse durations are offset such that their transmissions do not overlap in time.
The following is an example to explain the operation of the algorithm depicted in
A further example is described that is similar to the one above, except an asynchronous network that transmits every 1-9 ms (uniformly distributed) is added. In addition, to simulate the effects of frequency hopping and sensor scanning, only 50% of the pulses (selected randomly to simulate frequency hopping) are accepted for the first 100 ms of each second (thereby simulating a 1 second scan interval). Note that 95% of the pulses are discarded using this approach. After pulse removal, start out with 668 timestamps over 10 seconds.
The examples above demonstrate that the technique depicted by the flowchart shown in
The following are explanations of certain special cases for the timestamp analysis technique according to the embodiments of the present invention.
Consider a situation where there are two T-synchronous devices transmitting 180 degrees out-of-phase and one T/2-synchronous transmitter device (for example, two 9 ms transmitters 180 degrees out of phase, and one 4.5 ms transmitter). There are several analysis possibilities. The phase offset between the two transmitters must be exactly 180 degrees, otherwise the Q(.) function approach will characterize them as T-synchronous devices. The two devices are likely to have other distinguishing physical layer characteristics, e.g., power, or carrier frequency error. As described herein in connection with other embodiments of the present invention, the carrier frequency error is the difference between a device's intended carrier frequency and its actual carrier frequency, as measured by the sensor. Carrier frequency errors are caused by inaccuracies in the reference oscillators in the device's radio transmitter.
Consider another situation in which there are two periodic FHSS networks that have the same nominal period (for example, 10 ms), but that drift slowly in frequency. Assuming, without loss of generality, that one FHSS network of devices has a 10 ms period exactly, and that the other FHSS network has a small offset, say, 10.00003 ms (3 ppm). When the pulses are partitioned into atomic groups using the histogram of their timestamps mod 10 ms, a very accurate estimate of the pulse period for each atomic group is determined by finding the period T that minimizes the variance of the timestamps in the group modulo T (as described above). It is then is possible to conclude that there are two different 10 ms networks, and the consequently possible to identify which devices belong to which FHSS network. Another interesting fact is that the Q(.) function itself can be used to produce very accurate pulse period measurements. For example, the plot shown in
There is a possibility that the T/N pulses may “leak” into the T pulses. In the example of
Consider the situation when a FHSS device transmits (1) periodic voice in one time slot and sporadic data in another, or (2) transmits voice in two different time slots for time/frequency diversity. The timestamp device identification will conclude that there are two devices that belong to the same network, since their pulse periods are identical and their phases do not overlap. Pulse metrics described above, such as carrier frequency error, modulation type, pulse power, etc., may be used to conclude that the pulses actually belong to the same device.
The autocorrelation is computed using the timestamps themselves. In the example depicted in
It will take approximately 50*668 cycles to compute one correlation point. R(τ) needs to be computed for all integer multiples of τ=n*1 ms, n=1, . . . ,10,000 and τ=0.625 ms, n=1, . . . ,16,000. This will require approximately 50*668*26,000=88.4 million cycles. Q(τ) needs to be computed for τ=n*1 ms, n=1, . . . , 100 and τ=n*625 μs, n=1, . . . ,6. The computation for Q(.) may be implemented as a sum of logarithms over the harmonics of R(k) rather than a product. For τ as defined above, this means that approximately 60,000 logarithms need to be computed. If it is assumed that 100 cycles are required to compute a logarithm, then the total computation for Q(.) adds an additional 6 million cycles to the total workload.
The mod( ) operation may be implemented with two multiplies, a floor function, and a subtract function. Assuming 20 cycles per timestamp, this yields only 668*20=14K cycles for the example of
Thus, a real-world scenario such as the example of
Approximately 90% of the computational workload comes from computing the autocorrelation sequence. Another technique that can be shown to produce an output sequence that is very similar to the autocorrelation sequence output is to compute a histogram over the set of differences between timestamps. Let {d(n)} be the set of timestamp differences, i.e., d(n)=ts(m)−ts(n), n=1, . . . ,N; m=n+1, . . . ,N, where N is the number of timestamps. Let S(k) be the histogram over {d(n)}. The spacing between histogram cells can be any desired time duration, for example, 10 μs. Q(k) is computed over S(k) instead of over the autocorrelation sequence R(k) to save CPU time and resources. FIGS. 42A,42B and 43A,43B show plots for S(k) and Q(k) over S(k) for the examples shown in FIGS. 25A,25B and FIGS. 26A,26B, respectively. Note the similarity between the plots.
The follow describes the requirements for the histogram computation implementation. For this explanation, it is assumed there are N=668 timestamps, per the example of
Using the timestamp information described above, the pulse sequence analysis module 230 (
The pulse timestamp analysis algorithm can be summarized as follows. Pulses of RF energy are detected. The arrival times (timestamps) of the pulses are determined. Candidate periods for pulses are determined based on the arrival times. The pulses are partitioned into groups based on their candidate periods such that pulses with similar candidate periods are grouped together. Next, phases are derived for the pulses in each of the groups. Then, each of the groups is further partitioned into subgroups based on their phases, such that each subgroup comprises pulses (having the same candidate period) and same phase. Finally, sources of wireless signals are identified based on the subgroups formed by partitioning based on phase and other remaining pulses that were not grouped based on candidate period. Furthermore, asynchronous sources are identified from those pulses that were not included in a group formed based on candidate periods. Synchronous sources are identified as corresponding to pulses contained in a group formed based on candidate periods. The candidate periods are derived by computing autocorrelation values from the arrival times of the sequence of pulses and analyzing the autocorrelation values to identify the candidate periods. Moreover, in one embodiment, a function is computed that is a normalized product of harmonics of the autocorrelation values. The results of this function are analyzed for peaks such that the peaks correspond to said candidate periods.
This pulse timestamp analysis algorithm may also be embodied in a computer readable medium encoded with instructions that, when executed by computer or processor, cause the computer or processor to identify sources of wireless signals from data representing received radio frequency (RF) energy, the instructions comprising instructions for: deriving candidate periods for pulses of received RF energy based on arrival times of the pulses; partitioning pulses into groups on their candidate periods; deriving phases for each of the groups of pulses that have been formed based on candidate periods; partitioning the groups into subgroups based on their phases; and identifying sources of wireless signals based on the subgroups formed by partitioning based on phase and other pulses remaining that were not grouped based on candidate period.
Similarly, this pulse timestamp analysis algorithm may be embodied in a device that receives radio frequency (RF) energy and identifies devices that are sources of wireless signals in the RF energy. The device comprises a receiver that receives RF energy, an analog-to-digital converter that converts received RF energy to a digital data; and a processor coupled to the analog-to-digital converter that analyzes the digital data by: deriving candidate periods for pulses of received RF energy based on arrival times of the pulses; partitioning pulses into groups on their candidate periods; deriving phases for each of the groups of pulses that have been formed based on candidate periods; partitioning the groups into subgroups based on their phases; and identifying sources of wireless signals based on the subgroups formed by partitioning based on phase and other pulses remaining that were not grouped based on candidate period.
The Carrier Frequency Pulse Metric
According to another embodiment of the present invention, a technique is provided for distinguishing a group of wireless transmitters based on multiple observations of their estimated carrier frequencies. This technique exploits small frequency differences among the transmitters caused by manufacturing inaccuracies in their reference oscillators. If the frequency estimation error variance is significantly less than the carrier frequency differences between devices (which in many applications, it often is), this technique can readily distinguish transmissions from a plurality of devices.
The term “carrier frequency” may also be the center frequency for certain types of signals depending on their modulation type. However, it should be understood there are also modulation schemes where the carrier frequency and center frequency are not the same, such as signals that use sideband modulation techniques in which case the carrier frequency is offset from the carrier frequency of a signal.
The term “channelization scheme” is introduced to represent a set of one or more transmit frequencies that are used by devices in accordance with a transmit protocol. For example, a frequency hopping channelization scheme uses a set of frequencies (called a frequency hopset) that reside in a frequency range specified by a start frequency (lowest frequency in the set), stop frequency (highest frequency in the set) and frequency step or increment. The frequency step or increment specifies the spacing between frequencies in the hopset within the start-stop frequency range. In the case of a fixed frequency channelization scheme, the start frequency is the same as the stop frequency and is equal to the fixed transmit frequency, and the frequency step is zero.
The frequency analysis algorithm can be used either by itself or used in the pulse grouping algorithm described above in connection with
Many devices that use an unlicensed frequency band use temperature compensated crystal oscillators that have a guaranteed frequency accuracy of +/−20 ppm over time and temperature. According to a well-known manufacturer of such crystal oscillators, a good way to model these crystals after they are about 1 year old is to assume their frequency error obeys a Gaussian distribution w/a 7.5 ppm standard deviation. For a 2.4 GHz device, this corresponds to a carrier frequency error standard deviation of 7.5 ppm*2.4 GHz=18 kHz.
Suppose a sensor device with a scanning receiver captures and fingerprints pulses from one or more wireless devices. Given a sequence of measured pulse center frequencies for each received pulse at the sensor, it is desirable to identify: the number of wireless transmitters; which transmitters use a fixed transmit frequency and which are frequency-hopped; the frequency hopset (i.e., hop channel frequencies) for each of the frequency-hopped devices and estimate carrier frequency for fixed-frequency devices (with carrier frequency estimates accuracy of within +/−1 ppm); and which pulses belong to which device.
With reference to
Thus, for pulses determined to be associated with fixed frequency signals, sources of pulses are distinguished from each other based on their carrier frequency represented by relatively large stand-alone peaks in the histogram. Sources of fixed frequency pulses having similar carrier frequencies are distinguished from each other based on carrier frequency offset (caused by oscillator errors) represented by relatively small stand-alone peaks in the histogram.
For pulses determined to be associated with frequency hopping sources, pulses from different sources are distinguished based on their distinctive “comb” parameters in the histogram comprising one or more of start frequencies, stop frequencies and step frequencies. Sources of pulses having similar “comb” parameters are distinguished from each other based on small frequency shifts in the “combs” associated with those pulses.
Once the pulses are divided into groups based on their “coarse channelization”, i.e., pulses from fixed-frequency devices are separated from FHSS pulses, pulses from FHSS devices with different hopsets are separated from one another, the pulses are further subdivided based on their carrier frequency error i.e., the difference between their measured and nominal carrier frequencies. At this point, each of the pulse groups are tested to see if they are atomic (i.e., contain pulses from only one device). If not, they are either subdivided further using another technique described earlier (e.g., based on time period and phase) or discarded.
Consider an example in which the following devices are assumed to be active: 2 FHSS RFID readers from the same manufacturer that transmit at hop frequencies 903, 904, . . . ,908 MHz, 1 unknown FHSS device that transmits at hop frequencies 904, 904.3, 904.6, . . . , 909.7 MHz, 1 fixed-frequency TDD cordless handset and base station that transmit at 905.0 MHz. It is assumed that all devices have small frequency offsets due to oscillator inaccuracies.
The following sets forth a pseudo-code description of the algorithm 600. The input is a group of pulse carrier frequency measurements and the outputs are an estimate of the number of wireless devices; a determination of whether each device is FF or FH, and a grouping of pulses for each device.
The carrier frequency analysis algorithm outlined by the foregoing pseudo-code (as well as depicted in
In order to subdivide the groups of pulses, differences between carrier frequencies for a group pulses and a nearest transmit frequency of the corresponding channelization scheme for that group of pulses are computed. In the case of a frequency hopping channelization scheme, the nearest transmission frequency is the transmit frequency that is closest (in absolute difference—either in higher or lower) to a carrier frequency of a pulse in the group. The group is thus subdivided into subgroups based on those differences in order to distinguish (based on the carrier frequency error concept described above) between different source devices using the same type of channelization scheme. The intent is to form subgroups comprised of pulses that appear to be from different source devices (using the same type of channelization scheme) as displayed by relatively small frequency offsets with respect to a so-called nominal transmit frequency of a corresponding channelization scheme. In the case of a fixed frequency channelization scheme, the nearest transmit frequency is simply the fixed frequency of that channelization scheme.
A histogram may be computed on the carrier frequencies and the histogram is analyzed to determine zero or more (candidate) frequency spacings. For each candidate frequency spacing, it is determined whether there is a peak in the histogram at an integer multiple of the candidate frequency spacing in order to identify frequency hops associated with a frequency hopping channelization scheme. When partitioning the pulses into groups, a pulse is assigned to a group associated with a frequency hopping channelization scheme when it is determined from the histogram that the carrier frequency of that pulse is at an integer multiple of a candidate frequency spacing. In partitioning the pulses into groups, it should be understood that zero or more groups of pulses associated with a fixed frequency channelization scheme may be formed and zero or more groups of pulses associated with a frequency hopping channelization scheme may be formed. Subdividing the groups of pulses into subgroups allows for distinguishing different source devices using a fixed frequency channelization scheme and different source devices using a frequency hopping channelization scheme.
The pulse sequence analysis module 230 may perform the frequency analysis algorithm described herein.
The following is a description of how candidate frequency spacings are found for FHSS hop channels based on the carrier frequency estimates. This is the computation performed at 620 in
The following definition is made:
where B is the bin spacing for S(k), and M is an appropriate upper limit constant. H(f) is computed for ΔfMin, ΔfMin+Δfstep, . . . , ΔfMax. The candidate frequency spacings F1<F2< . . . <FM can be found by simply identifying the peaks in H(.). This is very similar to the way candidate timing periods are identified from the Q(.) function defined earlier.
The accuracy of the carrier frequency estimate depends on the observation interval, SNR of the sensor, modulation type of the transmitting device, and frequency estimation algorithm used. For most real-world digitally modulated burst signals (e.g., BT, WiFi™, DECT), one can estimate carrier frequency to within +/−500 Hz fairly easily. In many cases, especially when a pure continuous wave carrier is transmitted for periods of time (such as with an RFID reader), it can be estimated to within +/−100 Hz or less.
As the number of devices increases in a frequency band and region of interest, there is a chance that two or more signals may be confused as being from the same device.
where f(x) is the PDF of a zero mean Gaussian
RV w/sdev 7.5·2400 Hz
“Learn” Mode
Reference is now made to
At 710, protocol-specific and device-specific pulse metric data is generated from received RF energy, as described in detail above. At 720, the pulses are partitioned into two groups, a first group for named pulses and a second group for unnamed pulses. The group of named pulses can be further subdivided using the pulse grouping techniques described above. The group of unnamed pulses is subdivided and analyzed as set forth in 730-790.
At 730, the group of unnamed pulses is subdivided into individual subgroups based on protocol-specific pulse data. Examples of the protocol-specific pulse data are at least one of: pulse type and protocol type, wherein the protocol type is indicated by one or more of a synchronization pattern, modulation type, data rate, frequency bandwidth, pulse duration, carrier frequency, peak-to-average power ratio and frequency deviation. Once the partitioning or subdividing reaches a point where each subgroup comprises pulses from one or more source devices using a unique transmission protocol, then at 740 a protocol identifier (ID) is assigned to each resulting subgroup that contains pulses for a corresponding unknown transmission protocol.
Next, at 750, each subgroup is further iteratively subdivided based on device-specific pulse data until the resulting subgroups contain pulses from a single source device, i.e., the subgroups are atomic subgroups. Then, at 760, a device identifier is assigned to each atomic group corresponding to a particular source device that operates using what was previously an unknown transmission protocol (but which now a protocol identifier has been assigned).
There are two types of device identifiers that may be assigned at 760. The first is referred to as a persistent device identifier. A persistent device identifier is used to identify a specific source device at any time, i.e., even after the device turns off and is no longer transmitting, but then turns on again at a later time. Examples of persistent device identifiers are a MAC address or a pseudo-MAC address (described below), modulation start/stop times, and modulation signature. This identifier is called “persistent” because it does not change between communication (turn-on) sessions of a device. By contrast, non-persistent device-specific pulse characteristics remain constant during a particular communication session in which a device is turned on, but generally not across communication (turn-on) sessions. Non-persistent device-specific pulse characteristics are used to separate pulses transmitted by a first device from pulses transmitted other device having the same protocol identifier (and both devices are transmitting generally at the same time). The non-persistent device-specific pulse characteristics can only be used, however, while the device is turned on. Examples of non-persistent device-specific pulse characteristics are pulse timing period and timing phase, pulse center/carrier frequency, and pulse power. Thus, a device identifier assigned to an atomic group may be a persistent device-identifier or a non-persistent device identifier depending on the type of device-specific pulse metric for which the atomic group is formed. A persistent device identifier is assigned to a subgroup for a single device that is formed on the basis of device-specific pulse data that is substantially the same each time the corresponding device turns on and the non-persistent device identifier is assigned to a subgroup for a single device that is formed on the basis of device-specific pulse data that changes each time the corresponding device turns on.
At 770, a storing operation is made whereby protocol-specific data for each protocol identifier corresponding to an unknown transmission protocol is stored along with device-specific pulse data for each device identifier corresponding to a source device. This stored data may be referred to as so-called learned signatures of transmission protocols and devices.
Thereafter, at 780, protocol-specific pulse data and device-specific pulse data are generated for RF energy received in the future. At 790, a comparison is made between the protocol-specific pulse data and device-specific pulse data corresponding to newly received RF energy to determine when there is a match with the learned signatures of protocols and devices. The next time pulses are detected that match what had been an unknown transmission protocol, those pulses are labeled with the corresponding protocol identifier. Similarly, the next time pulses are detected that match what had been an unknown device, those pulses are labeled with the corresponding device identifier.
When a match is made to a protocol identifier or a device identifier in the process 700, an alert may be generated containing the corresponding protocol identifier and/or device identifier. This alert may comprise an audio and/or visual indication.
According to a further aspect of the invention, there is a special type of protocol-specific pulse data and a special type of device-specific pulse data that may be generated and used with the learning process 700 for unnamed devices. Pulses that are grouped as unnamed are grouped as such because their transmission protocol is not known, thus the pattern for a synchronization word and the format for a medium access control (MAC) address or identifier are not a priori known for devices operating with unnamed protocols. However, a technique is provided to analyze patterns in the demodulated data for multiple instances of pulses from different source devices using the same unknown protocol, and from multiple instances of pulses from the same device using an unknown protocol. This special protocol-specific pulse data is referred to herein as a pseudo-synchronization pattern and the special device-specific pulse data is referred to herein as a pseudo-MAC address.
Reference is now made to
At 850, the bit positions for the synchronization pattern are marked as being “used” within the packet. In other words, those bit positions could not be used for a pseudo-MAC address. At 860, other bit positions that contain constant data across multiple packets from all atomic groups (using the same protocol, e.g., protocol X) are also marked as being “used”; those bit positions also could not be used for a pseudo-MAC address if they are constant across devices.
Thus, at 870, the range or ranges of bit positions that satisfy criteria (i-iii) contain the pseudo-MAC address for a corresponding device. That is, the range or ranges of bit positions that: (i) are not already marked as being part or the pseudo-sync pattern or other constant data (from 840 and 85); (ii) are approximately constant across all packets from an atomic group having the same protocol (protocol ID=X); and (iii) contain unique (different) data for each atomic group having the same protocol (protocol ID=X). That is, the pseudo-MAC address for a device is the data contained in the bit positions that are constant across all packets for a particular atomic group for a particular protocol, but which is different or unique across atomic subgroups for that same protocol. At 880, the unique data at that/those range(s) of bit positions that satisfy these conditions is stored as a pseudo-MAC address for a corresponding atomic group. This pseudo-MAC address is stored and used in the future as device-specific pulse data to identify pulses of RF energy that are from that particular device using that transmission protocol (e.g., protocol X).
In order to determine whether data at bit positions are constant across multiple packets, the bits in received packets to be compared may need to be time-shifted (advanced or delayed) slightly to remove any time shifts between received packets that may be present during burst acquisition before the bit-for-bit comparison. A bitwise AND function may be used to identify fields that stay the same across multiple received packets. This bitwise ANDing function is repeated over multiple received packets to identify those bit fields that do not change from one packet to the next. One of these fields is determined to be the pseudo-sync pattern or the pseudo-MAC address as the case may be. As describe above in conjunction with
While the foregoing description has been made with respect to various methods, it should be understood that the present invention may also be embodied in a device (sensor) that receives radio frequency energy and identifies sources of wireless signals in the RF energy. Such a device would comprise a receiver that receives RF energy, an analog-to-digital converter and a processor coupled to the analog-to-digital converter that generates pulse metric data from the digital data, the pulse metric data representing characteristics associated with pulses of RF energy, partitions the pulse metric data for individual pulses into groups based on their characteristics, and identifies sources of wireless signals contained in the RF energy based on the groups. The processor may execute instructions stored in memory (as shown in
The system and methods described herein may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The foregoing embodiments are therefore to be considered in all respects illustrative and not meant to be limiting.
This application claim priority to the following U.S. provisional applications, each of which is incorporated herein by reference: U.S. Provisional Application No. 60/798,715, filed May 9, 2006; U.S. Provisional Application No. 60/798,714, filed May 9, 2006; U.S. Provisional Application No. 60/798,716, filed May 9, 2006; and U.S. Provisional Application No. 60/800,442, filed May 16, 2006.
| Number | Date | Country | |
|---|---|---|---|
| 60798715 | May 2006 | US | |
| 60798714 | May 2006 | US | |
| 60798716 | May 2006 | US | |
| 60800442 | May 2006 | US |
