# US 12,192,229 B2 · Systems and methods for distributed P25 LMR radio vulnerability management and real-time interference monitoring

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,192,229 B2
- Document ID: US12192229B2
- Status: Granted
- Kind: B2
- Application number: 18/540,473
- Filed: 2023-12-14
- Published: 2024-04-18
- Granted: 2025-01-07
- Earliest claimed: 2017-12-15
- Assignees: 802 Secure, Inc.
- Applicants: 802 Secure, Inc.
- Inventors: Garry Drummond; Konrad Grutzmacher; Clifford Fernandez; Michael Raggo
- Web page: https://patentgrep.com/patent/US12192229B2

## CPC

- H04K 3/65: {using deceptive jamming or spoofing, e.g. transmission of false signals for premature triggering of RCIED, for forced connection or disconnection to/from a network or for generation of dummy target signal}
- H04L 63/1433: {Vulnerability analysis}
- H04B 17/336: Signal-to-interference ratio [SIR] or carrier-to-interference ratio [CIR]
- H04K 3/224: {with countermeasures at transmission and/or reception of the jammed signal, e.g. stopping operation of transmitter or receiver, nulling or enhancing transmitted power in direction of or at frequency of jammer}
- H04K 3/226: {Selection of non-jammed channel for communication (spectrum sharing arrangements H04W16/14; selection of wireless resources by user or terminal H04W72/02)}
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L 43/0847: {Transmission error}
- H04L 43/16: Threshold monitoring
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
- H04W 4/90: Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]
- H04W 12/63: Location-dependent; Proximity-dependent
- H04K: SECRET COMMUNICATION; JAMMING OF COMMUNICATION
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04B: TRANSMISSION
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A threat monitoring and vulnerability management system is disclosed. The system includes one or more sensors configured to scan a frequency spectrum of a project 25 (P25) network and to collect data on the P25 network. The system further includes a server coupled to the sensors and configured to receive the collected data from the plurality of sensors, compare the collected data with previously stored historical data to determine whether an anomaly exists within data patterns of the collected data, responsive to determining that the anomaly exists, determine at least one of: whether use of a cloned radio that mimics an authorized connection occurs, whether jamming of a radio frequency (RF) communication occurs, or whether jamming of a voice communication occurs within the P25 network by comparing the collected data with preset thresholds, and send a real-time alert to a dispatch and control console unit coupled to the server and the P25 network in response to determining that some of the collected data exceeds at least one of the preset thresholds, such that the dispatch and control console unit provides one or more corrective actions to the P25 network.

## Claims

### Claim 1

A system for a project 25 (P25) network space, the system comprising:
a plurality of sensors, each sensor coupled to one or more antennas covering the P25 network space;
a plurality of processors coupled to the plurality of sensors;
a storage system to store communication data and historical data patterns within the P25 network space, wherein the storage system is coupled to the plurality of sensors and the plurality of processors;
wherein the sensors are configured to detect communication activities within the P25 network space and send communication data about the communication activities to the storage system and the plurality of processors;
wherein the plurality of processors are configured to compare the communication data with the stored historical data patterns to determine whether a security threat or a performance issue exists within the P25 network space, and provide real-time feedback of a determined security threat or a determined performance issue to a network controller, to enable the network controller to take one or more corrective actions in response to the real-time feedback.

### Claim 2 (depends on 1)

The system of claim 1, wherein the P25 network space covers an area of a digital land mobile radio (LMR) emergency communication system.

### Claim 3 (depends on 1)

The system of claim 1, wherein the storage system is configured to receive and store the communication data about the communication activities sent by the sensors.

### Claim 4 (depends on 1)

The system of claim 1, wherein the plurality of processors are further configured to update the historical data patterns based on at least one of: the communication data about the communication activities, or the determined security threat or the determined performance issue within the P25 network space.

### Claim 5 (depends on 1)

The system of claim 1, wherein the plurality of processors are further configured to determine whether data anomalies exist within the communication data based on the comparison, wherein the data anomalies exist when one or more data parameters in the communication data exceed one or more preset thresholds.

### Claim 6 (depends on 5)

The system of claim 5, wherein when the one or more data parameters exceed the one or more preset thresholds, the plurality of processors are configured to determine whether the data anomalies pose the security threat or cause the performance issue within the P25 network space, and inform the network controller of the data anomalies in response to determining that the data anomalies pose the security threat or cause the performance issue within the P25 network space.

### Claim 7 (depends on 5)

The system of claim 5, wherein the data anomalies comprise one or more of: a use of a cloned radio that mimics an authorized connection within the P25 network space, a jamming of radio frequency (RF) communication within the P25 network space, or a jamming of a voice communication within the P25 network space.

### Claim 8 (depends on 1)

The system of claim 1, wherein the plurality of processors are within a dispatch and control console sub-system (CSS) of the P25 network space or within a distributed cloud-based system associated with the P25 network space.

### Claim 9 (depends on 1)

The system of claim 1, wherein the plurality of processors are further configured to determine, from the communication data about the communication activities, a location of the security threat or a location of the performance issue within the P25 network space.

### Claim 10 (depends on 1)

The system of claim 1, wherein
the plurality of processors are further configured to extract, from the communication data, information that includes received signal strength indication (RSSI) mapping, bit error rate (BER) mapping, system degradation trends, and P25 control channel validation; and
the plurality of processors to provide the real-time feedback of the determined security threat or the determined performance issue to the network controller comprises the plurality of processors to provide the information to the network controller.

### Claim 11 (depends on 2)

The system of claim 2, wherein the plurality of processors to provide the real-time feedback of the determined security threat or the determined performance issue to the network controller comprises the plurality of processors to provide security and performance information of the area of the digital LMR emergency communication system.

### Claim 12

A method of protecting a project 25 (P25) network space, the method comprising:
receiving, by a plurality of processors, communication data about communication activities within the P25 network space, wherein the communication activities are detected by a plurality of sensors, each sensor coupled to one or more antennas covering the P25 network space, and the communication data about the communication activities is sent to a storage system for storage;
comparing, by the plurality of processors, the communication data with historical data patterns stored in the storage system, to determine whether a security threat or a performance issue exists within the P25 network space; and
providing, by the plurality of processors, real-time feedback of a determined security threat or a determined performance issue to a network controller, to enable the network controller to take one or more corrective actions in response to the real-time feedback.

### Claim 13 (depends on 12)

The method of claim 12, wherein the plurality of processors are within a dispatch and control console sub-system (CSS) of the P25 network space or within a distributed cloud-based system associated with the P25 network space.

### Claim 14 (depends on 12)

The method of claim 12, further comprising: determining, by the plurality of processors, whether the security threat or the performance issue exists within the P25 network space, wherein determining whether the security threat or the performance issue exists within the P25 network space comprises: determining whether one or more data parameters in the communication data exceed one or more preset thresholds.

### Claim 15 (depends on 12)

The method of claim 12, wherein the provided real-time feedback includes received signal strength indication (RSSI) mapping, bit error rate (BER) mapping, system degradation trends, and P25 control channel validation.

### Claim 16 (depends on 12)

The method of claim 12, further comprising: determining, by the plurality of processors, whether data anomalies exist within the communication data based on the comparison, wherein the data anomalies exist when one or more data parameters in the communication data exceed one or more preset thresholds.

### Claim 17 (depends on 16)

The method of claim 16, further comprising: when the one or more data parameters in the communication data exceed the one or more preset thresholds, determining, by the plurality of processors, whether the data anomalies pose the security threat or cause the performance issue within the P25 network space.

### Claim 18 (depends on 17)

The method of claim 17, wherein providing the real-time feedback of the determined security threat or the determined performance issue to the network controller comprises: informing the network controller of the data anomalies in response to determining that the data anomalies pose the security threat or cause the performance issue within the P25 network space.

### Claim 19 (depends on 12)

The method of claim 12, wherein providing the real-time feedback of the determined security threat or the determined performance issue to the network controller comprises: providing security and performance information of an area of a digital land mobile radio (LMR) emergency communication system.

### Claim 20 (depends on 12)

The method of claim 12, further comprising: determining, by the plurality of processors from the communication data about the communication activities, a location of the security threat or a location of the performance issue within the P25 network space;
wherein the provided real-time feedback includes the location of the security threat or the location of the performance issue within the P25 network.