# US 10,311,232 B2 · Embedded systems monitoring systems and methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,311,232 B2 - Document ID: US10311232B2 - Status: Granted - Kind: B2 - Application number: 15/354,879 - Filed: 2016-11-17 - Published: 2017-05-25 - Granted: 2019-06-04 - Earliest claimed: 2015-11-17 - Assignees: Red Balloon Security, Inc. - Applicants: Red Balloon Security, Inc. - Inventors: Ang Cui - Web page: https://patentgrep.com/patent/US10311232B2 ## CPC - G06F 21/554: {involving event detection and direct action} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and systems for detection and prevention of exploitation of embedded devices. A sensing component is configured to detect a plurality of emanated analog signals and generate one or more synchronization events. The synchronization events are used to perform one or more attestation analyzes, including execution attestation, integrity attestation, and control-flow reconstruction, the results of which may be used to generate security events. ## Claims ### Claim 1 A system, comprising: a sensing component configured to detect a plurality of analog emanations from one or more components of an embedded device, an analog emanation comprising an analog signal associated with execution of a function of the embedded device; a synchronization event generator configured to generate one or more synchronization events based on one or more analog emanations detected by the sensing component, a synchronization event identifies one or more functions of the embedded device associated with the one or more analog emanations detected; an event analysis and state estimation component configured to analyze one or more synchronization events generated by the synchronization event generator; and generate one or more attestation determinations; and a security event generator configured to generate one or more security events based on one or more attestation determinations outputted by the event analysis and state estimation component. ### Claim 2 (depends on 1) The system of claim 1, the sensing component comprising one or more of: single-mode sensor; multi-mode sensor; or a combination thereof. ### Claim 3 (depends on 2) The system of claim 2, wherein the single-mode sensor is configured to detect one of: sub-acoustic signals; acoustic signals; ultrasonic signals; electromagnetic radiation; visual signals; thermal energy; or electric power variations. ### Claim 4 (depends on 2) The system of claim 2, wherein the multi-mode sensor is configured to detect one or more of: sub-acoustic signals; acoustic signals; ultrasonic signals; electromagnetic radiation; visual signals; thermal energy; or electric power variations. ### Claim 5 (depends on 1) The system of claim 1, the event analysis and state estimation component comprising one or more analysis engines. ### Claim 6 (depends on 5) The system of claim 5, wherein the one or more analysis engines comprise an execution attestation engine, an integrity attestation engine, a control-flow reconstruction engine, or a combination thereof. ### Claim 7 (depends on 1) The system of claim 1, wherein the event analysis and state estimation component is configured to work with boosted embedded device firmware, non-boosted embedded device firmware, or a combination thereof. ### Claim 8 (depends on 7) The system of claim 7, wherein the boosted embedded device firmware comprises one or more Funtenna software structures injected into an initial firmware of an embedded device. ### Claim 9 (depends on 8) The system of claim 8, wherein Funtenna software structures are injected software code designed to generate additional analog signal associated with an instruction of a program of the embedded device, the additional analog signals emitted by one or more passive circuit components of the embedded device. ### Claim 10 A method of security protection of embedded devices, comprising: detecting, by one or more sensors of a monitoring system, one or more analog emanations of an operating embedded device, an analog emanation comprising an analog signal associated with execution of a function of the operating embedded device; generating one or more synchronization events by a synchronization event generator, a synchronization event identifies one or more functions of the operating embedded device associated with the one or more analog emanations detected; identifying one or more attestation determinations based on the one or more synchronization events; and generating one or more security events based on the one or more attestation determinations. ### Claim 11 (depends on 10) The method of claim 10, wherein the one or more sensors comprises one or more of: single-mode sensor; multi-mode sensor; or a combination thereof. ### Claim 12 (depends on 10) The method of claim 10, wherein the single-mode sensor is configured to detect one of: sub-acoustic signals; acoustic signals; ultrasonic signals; electromagnetic radiation; visual signals; thermal energy; or electric power variations. ### Claim 13 (depends on 10) The method of claim 10, wherein the multi-mode sensor is configured to detect one or more of: sub-acoustic signals; acoustic signals; ultrasonic signals; electromagnetic radiation; visual signals; thermal energy; or electric power variations. ### Claim 14 (depends on 10) The method of claim 10, wherein identifying one or more attestation determinations comprises analyzing the one or more synchronization events by one or more analysis engines. ### Claim 15 (depends on 14) The method of claim 14, wherein the one or more analysis engines comprise an execution attestation engine, an integrity attestation engine, a control-flow reconstruction engine, or a combination thereof. ### Claim 16 (depends on 10) The method of claim 10, further comprising booting the operating embedded device to increase analog emanations from the operating embedded device. ### Claim 17 (depends on 16) The method of claim 16, boosting the operating embedded device comprising injecting one or more Funtenna software structures into an initial firmware of the embedded device. ### Claim 18 (depends on 17) The method of claim 17, wherein Funtenna software structures are injected software code designed to generate additional analog signals associated with an instruction of a program of the embedded device, the additional analog signals emitted by one or more passive circuit components of the embedded device.