EP3522130A1

EP3522130A1 - A method and a system for early detecting jamming of intruder alarm systems

Info

Publication number: EP3522130A1
Application number: EP18154863.7A
Authority: EP
Inventors: Filip Skarp
Original assignee: Verisure SARL
Current assignee: Verisure SARL
Priority date: 2018-02-02
Filing date: 2018-02-02
Publication date: 2019-08-07
Anticipated expiration: 2038-02-02
Also published as: WO2019149415A1; EP3522130B1; PT3522130T; ES2853474T3

Abstract

A method of detecting a moving jamming device issuing a jamming signal, and closing in on an alarm installation, the method comprising the following steps
- providing a first signal representative of instantaneous received radio energy;
- creating a second signal representative of the average of the first signal taken over a predetermined window;
- creating a third signal representative of the time derivative of the second signal;
- indicating whether a jammer is closing in based on the third signal

Description

TECHNICAL FIELD

The invention relates to a method and a system for detecting jamming of home alarm systems.
Alarm systems comprising detectors and gateways are commonly used in private houses and office premises. Detectors are more and more frequently connected through wireless communication means to a base unit or gateway which in turn is connected to a central monitoring station such as a remote alarm receiving centre. In case of an alarm situation one or more detector(s) transmits an alarm signal to the gateway and the gateway transmits an alarm signal to the central monitoring station, should the alarm system be in an armed state.
A burglar or other intruder may use electronic jamming devices to jam wireless signals between the detector(s) and the gateway or between the gateway and the central monitoring station with the deliberate purpose of rendering the alarm system useless. The present invention relates to a method and means for early detection of jamming signals from such jamming devices.

PRIOR ART

Typical alarm systems comprise a number of units installed at a site to be protected, e.g. at the home of a customer. The units are usually detectors sensors and a central unit also known as a gateway, with which the sensors and detectors normally communicate via radio links or by other wireless means of communication. Radio signals also can be used by the gateway to communicate with a remote alarm receiving centre, usually using another frequency band. Alternatively, or additionally, the central unit may communicate with the remote alarm receiving centre by non-wireless communication such as wire, or by optical fibre. As in all applications radio signals are vulnerable to disturbances and of course to deliberate jamming attempts.
Prior art jamming detection exist in different forms. GB2457102 discloses an alarm comprising a repeater which is arranged to detect a jamming signal and to transmit a jamming alert signal at a frequency other than a jammed frequency in the event that a jamming signal is detected.
Another way of handling jamming problems is to supply different channels, radio frequencies or wireless methods that can be used when a regular route is disturbed or jammed. Such a system is disclosed in RU2399095 . The system in RU2399095 comprises a plurality of microcells in a multilevel hierarchical structure. A plurality of relay nodes is used to ensure that alarm messages are transmitted even if one microcell is jammed.
One problem with the prior art is that jamming of a system is not detected until the system is completely jammed. When a system is jammed no wireless communication is possible on the jammed frequency.

SUMMARY OF THE INVENTION

The present application discloses a method to detect a moving jammer in the vicinity of an alarm installation. The main advantage of the present invention is that malicious RF jamming can be detected at an early stage, for instance already when a potential burglar is approaching or closing in on a building with the jammer activated. An object of the present invention is to avoid drawbacks of prior art systems and to provide an improved method of detecting jamming of intruder alarm systems or jamming of other wireless systems wherein such a system comprises a plurality of components such as alarm sensors, also known as "nodes" or "peripherals, and at least one gateway or central unit communicating with a remote alarm receiving centre, wherein at least one sensor unit communicates via a first radio link with said gateway. If nothing else is explicitly stated, it is the communication between the central unit and its associated detectors and sensors that is supposed to be subject to jamming.
One feature of most current jamming detection algorithms is that they are set to detect and take action at a set threshold level of disturbance. This may cause concerns if the threshold level is set too low, because too many false alarms will be generated, and if the threshold level is set too high the system may already be un-usable when the jamming is detected. Thus, detecting jamming in the above described manner, relies on the ability to set the threshold level of when to issue a jamming alarm to a value within an interval wherein it is fairly sure that a jammer is employed, but wherein the jamming signal is still not so strong as to have completely jammed out the alarm system.
The present invention provides a way to detect a moving jamming device before it closes in and completely jams out the alarm system, without issuing a disturbing amount of false alarms.
In accordance with the invention, close monitoring of the change in noise floor over time is used to detect a moving jammer. The average noise floor is monitored over a time window and if the change is outside of configurable limits on change (dB/s) within a configurable time, an alarm could be generated indicating that a jammer is closing in. A device may comprise a noise floor calculator unit, and a noise floor monitoring unit operatively connected to the noise floor calculator unit. The monitoring unit is configured to monitor the noise floor over a time window and if the change is outside of present limits on change (dB/s) within a configurable time, the monitoring unit will issue an alarm, and the gateway may relay the alarm to a remote monitoring station.
According to a first aspect there is provided a method of detecting a moving jamming device issuing a jamming signal, and closing in on a wireless system, the method comprising the following steps

providing a first signal representative of instantaneous received radio energy;
creating a second signal representative of the average of the first signal taken over a predetermined window;
creating a third signal representative of the time derivative of the second signal;
determining, based on the third signal, whether a jammer is closing in on the wireless system. The determining may be based on the event that the level of the third signal rises over a predetermined threshold level

According to a second aspect there is provided a wireless system capable of detecting a moving jamming device issuing a jamming signal, and closing in on the wireless system, the wireless system comprising:

a radio transceiver unit;
a processor;

BRIEF DESCRIPTION OF THE DRAWINGS

In order that the manner in which the above recited and other advantages and objects of the invention are obtained will be readily understood, a more particular description of the invention briefly described above will be rendered by reference to specific embodiments thereof which are illustrated in the appended drawings.
Understanding that these drawings depict only typical embodiments of the invention and are not therefore to be considered to be limiting of its scope, the invention will be described and explained with additional specificity and detail through the use of the accompanying drawings in which:

Fig. 1a: is a schematic diagram shoving a received noise signal as power as a function of time with no jammer present
Fig. 1b: is a schematic diagram showing a signal representing a moving average of a noise signal such as the one in Fig. 1a
Fig. 1c: is a schematic diagram showing a signal representative of a moving time derivative of a signal such as the one in Fig. 1b
Fig. 1d: is a schematic diagram shoving the received noise as power as a function of time when a jammer is closing in on a transceiver
Fig. 1e: is a schematic diagram showing a signal representing a moving average of a noise signal such as the one in Fig. 1d.
Fig. 1f: is a schematic diagram showing a signal representative of a moving time derivative of a signal such as the one in Fig. 1e
Fig. 1g: is a block diagram of prior art radio frequency receiving circuitry of a wireless system capable of generating received signal strength indicator (RSSI)
Fig. 2: is a flowchart of a method for detecting a moving jammer
Fig. 3: is a block diagram of a wireless system according to EXAMPLE 1
Fig. 4: is a flowchart of a method of predicting when a moving jammer will cause complete jamming of the system being jammed.
Fig. 5: is a flowchart of a method of predicting the remaining time until a moving jammer will cause complete jamming of the system being jammed.

DETAILED DESCRIPTION

Definitions

In the following description the following terms are used with the following meanings.

Jamming; with the term "jamming" is meant the deliberate act of emitting radio frequency energy in order to, block, prevent or interfere with authorized wireless communications.
Jammer; with the term "jammer" or "jamming device" is meant a device capable of emitting jamming energy.
Interference; with the term "interference" is meant any radio frequency energy, irrespective of origin and purpose, that may disturb a radio frequency transmission.

Alarm, with the term "alarm" or "alarm system" is in this context meant a system used to detect an unwanted condition and being capable of communicating an alert to a remote location, usually by wirelessly transmitting and receiving signals.
Wireless system, with the term "wireless system" is meant any system wirelessly transmitting and receiving signals.
Completely jammed, with the term "completely jammed" is meant a status of a wireless system that is totally prevented from communicating wirelessly, i.e., being unable to receive any understandable information, wirelessly transmitted, due to jamming activity.
The present application discloses a way to detect a moving jamming device before it closes in and completely jams out the alarm system, without issuing a disturbing amount of false alarms.
In accordance with the present disclosure, close monitoring of the change in noise floor over time is used to detect a moving jammer. By continuously averaging a measure of received signal strength of the frequency band used, such as e.g. received signal strength indicator (RSSI) and calculating the time derivative of the average, this derivative of the RSSI average could be used to detect a jammer closing in on a system. A zero derivative of the RSSI average indicates either that there is no jammer present or that a jammer is present but it is stationary in position and in emitted power. A positive derivative of the RSSI average indicates that there is a jammer present and it is moving towards the receiver, assuming the jammer is emitting noise at constant power. A more positive value indicates a faster speed of movement towards the receiver. A negative derivative of the RSSI average indicates that there is a jammer present and it is moving away from the receiver. A more negative value indicates a faster speed of movement away from the receiver
Further, there is disclosed to set limits on the duration and speed of change to make it possible to quickly and accurately detect jammers.
Fig. 1a is a schematic diagram showing a received noise signal as power as a function of time with no jammer present. The received noise signal is in a frequency range that corresponds to the frequency used for communication between the peripheral and the central unit. Fig. 1b is a schematic diagram showing a signal representing a moving average of a noise signal such as the one in figure 1a. Fig. 1c is a schematic diagram showing a signal representative of a moving time derivative of a signal such as the one in figure b.
Fig. 1d to 1f shows corresponding schematic diagrams relating to a case where a jammer is active and closing in towards an alarm system. It can be seen that diagrams are quite different and one difference is that the time derivative of average noise in Fig. 1f is clearly different from zero. The time derivative of Fig. 1f is principally positive for a distinct period of time, meaning that the average received power is increasing, corresponding to a situation where a jammer is closing in on a system.
Placing a moving configurable mask that will trigger the alarm on certain behaviours of the noise change would make it possible to do accurate detection of moving jammers.
In one embodiment the receiving circuitry of the wireless system is configured to provide RSSI data. A microcontroller is connected to the receiving circuitry and configured to sample RSSI data from the receiving circuitry and to provide a stream of sampled RSSI data that is continuously summed up and averaged over a plurality of sample points. Said embodiment could further comprise a detection mask that is tuned to detect a jammer traveling at walking speed towards the system. Such a detection mask may preferably be configured to detect jammers traveling at speeds between 1.4m/s and 2.5m/s. The detection mask may preferably use the time derivate of the averaged measurements.
Detection of the mentioned jammers above could be done e.g. by setting a time derivative threshold level to a value corresponding to a time derivative of averaged RSSI data, resulting from moving a known jammer at a known distance from a test receiver at slightly below 1.4 m/s in a direction towards the receiver. The known distance being larger than the distance known to result in complete jamming of the system.
Further embodiments could comprise a system that includes a stream of sampled RSSI data that is continuously summed up and averaged over a plurality of measurement points. Said embodiment could be configured to use the time derivative of the averaged RSSI samples to estimate the time until the system is completely jammed. Said embodiment could be configured to issue an alarm when the margin to complete jamming is below a specified limit. Said limit could be configured to the same, or a factor lower, level as the corresponding time it would take to complete a full alarm transmission dialogue.
The system may be considered fully jammed when the signal to noise ratio is below the minimum signal to noise ratio for successful demodulation, the minimum signal to noise ratio for successful demodulation may be determined from the receiver type and modulation used by the wanted signal.
Fig. 1g is a block diagram showing prior art radio frequency receiving circuitry belonging to a wireless system capable of generating received signal strength indicator (RSSI). A receiving antenna 101 is connected to an input of a low noise amplifier 105 for amplification of the antenna signal. An output of the low noise amplifier 105 is connected to a mixer 110 that is mixing the amplified antenna signal with that of a local oscillator 115. The mixed signal from the mixer 115 is filtered by the filter 120 and the filtered signal is further amplified in an intermediate frequency amplifier 125. The signal is then further processed in a channel filter 130, a detector 135 and in a demodulator 140 as is known in the art. An RSSI signal 145 can be read from a demodulator output.
Other prior art documents describe radio frequency receiving circuitry where an RSSI signal is read from the detector 135, the channel filter 130 or the amplifier 125.
Fig. 2 shows a flowchart of a method of detecting an increasing jamming signal, caused by a moving jamming device emitting a jamming signal, and approaching or closing in on a receiver of an alarm installation, the method comprising the following steps:

Setting 202 a time derivative threshold value; resetting 202 an exceed counter
Providing 203 a first signal representative of instantaneous received signal strength, preferably RSSI;
Creating 205 a second signal representative of the average of the first signal taken over a first predetermined number of samples;
Creating 210 a third signal representative of the time derivative of the second signal taken over a second predetermined number of samples;
Setting a threshold counter value or a time- limit threshold value on the number of times or the time that the third signal must exceed the first threshold value;
Comparing 215, 220, the time derivative of averaged received signal strength (RSSI) with the time derivative threshold value;
Increasing 220 the exceed counter, or advancing a timer based on result of comparison being that the time derivative of averaged received signal strength (RSSI) being higher than time derivative threshold value;
Increasing the exceed counter or advancing the timer 230 as long as the time derivative of averaged received signal strength (RSSI)being higher than the time derivative threshold value;
Resetting 230 the exceed counter or the timer based on the time derivative of averaged received signal strength (RSSI)is below the time derivative threshold value;
Deciding 240, 245 that a jammer is closing in based on the exceed counter exceeding an exceed threshold value, or the timer exceeding a time limit threshold value.

A jamming device is normally of fixed power.

EXAMPLE 1

Fig. 3 shows a block diagram of a device for detecting a moving jammer closing in on the device. A radio transceiver unit TXU 305, such as e.g. Ti 1121 from Texas Instruments, is connected to a microcontroller unit MCU 310. The microcontroller unit MCU is configured to instruct the transceiver unit TXU to provide a first stream of instantaneous values of received signal strength indicator (RSSI) to the microcontroller unit.
Further, the microcontroller 310 is configured to provide a second stream of values, each value calculated as an average of a predetermined number of the last values of the first stream. The microcontroller is further configured to provide a third stream of values, each value calculated as a value corresponding to or being the time derivative of the second stream.
The microcontroller 310 is further configured to decide, based on the third stream of values, if a jamming device is present and closing in on the receiver. Preferably, the decision is based on the level of the values of the stream and the duration of the level.
Preferably, the microcontroller is configured to have a duration limit corresponding to a move of an intruder carrying a jamming device and travelling on foot, i.e., a preferably a duration limit of about 2 to 4 seconds.
The microcontroller may be configured to have a limit of rate of increase in the interval of X to Y dB/s, for detecting intruders carrying a jamming device and traveling on foot and may further comprise a second interval above Y dB/s detecting intruders traveling faster than walking speed.
The microcontroller is preferably configured to issue an alert upon detection of a moving jamming device.

Prediction of time to complete jamming

The wireless system is preferably also configured to predict the time to when a complete jamming occurs. Now turning to Fig. 4, the system is preferably configured to take the time derivative of the averaged RSSI signal 405 and predict the time it will take until the RSSI signal reaches the predetermined RSSI value 410, 415. The time t for this event to occur can be estimated using the formula: $t = ({RSSI}_{1} - {RSSI}_{0}) / k$
Wherein

t: is the estimated time to total jamming
RSSI₁: is a predetermined received signal strength indicator level that is set to correspond to a maximum tolerable level
RSSI₀: is the received signal strength indicator at time of estimate
k: is the time derivative of the averaged noise at time of estimate

The RSSI₁ may, as a first alternative, be set to the so called ETSI LBT-level. The RSSI₁ may, as a second alternative, be set to a level based on the minimum signal-to-noise ratio (SNR) acceptable for the wireless system. The minimum signal-to-noise ratio (SNR) acceptable for the wireless system is the SNR acceptable for the communication link between the gateway and the detector/sensor needing the highest signal-to-noise ratio (SNR) among the communication links between the gateway and the different detectors/sensors of the alarm system. Thus, this second alternative may use the RSSI of the weakest device in the alarm system to adaptively determine the level of the minimum signal-to-noise ratio.

Alternative estimation of time to total jamming

The system may alternatively or additionally be configured to estimate the time to total jamming using a non-linear estimation, preferably of the second degree, using historical data, see Fig. 5. In this case, a portion of the averaged noise signal (RSSI), 505, is adapted, 510, to a mathematical function of the second degree: $N (t) = {At}^{2} + Bt + C$
Wherein

N: is the averaged noise level (RSSI) as explained above
A, B and C: are constants
t: is time

Time to total jamming is calculated by first adapting, 510, the noise function ( II) to historical data, 505 by determining the values of the constants A, B, and C, and then, as a second step, using the constants A, B, and C and a set level of N being equal to RSSI₁., to calculate, 515, a time t_tot being the time of total jamming. The time to total jamming is then calculated, 515, as t_tot-current time (within some time reference system)

Claims

A method of detecting an increasing jamming signal, the method comprising the following steps
- providing (203) a first signal representative of instantaneous received radio energy;

- creating (205) a second signal representative of the average of the first signal taken over a predetermined window;

- creating (210) a third signal representative of the time derivative of the second signal;

- determining (215-245), based on the third signal whether a jamming signal is present and increasing, making it possible to infer that a jammer is closing in on the wireless system.
The method according to claim 1, wherein the indication that a jammer is closing in is based on that the value of the third signal exceeds (220) a predetermined threshold level.
The method according to claim 1 or 2 wherein the first signal is an RSSI signal.
The method according to claim 2 or 3 wherein the determining is also based on the time duration (240) of the third signal exceeding the predetermined signal threshold level.
The method according to claim 4 wherein the predetermined signal level is determined from the minimum signal to noise ratio (SNR) of the system.
The method according to claim 5 wherein the predetermined signal level is set to a value proportional to the minimum signal to noise ratio (SNR) of the system.
A wireless system capable of detecting a moving jamming device issuing a jamming signal, and closing in on the wireless system, the wireless system comprising:
- a radio transceiver unit (TXU, 305) ;

- a micro controller unit (MCU, 310);
wherein the radio transceiver unit (TXU, 305) is configured to provide a received signal strength indicator (RSSI) signal, and wherein the microcontroller unit (MCU, 310) is configured to
- instruct the transceiver unit TXU to provide a first stream of instantaneous values of received signal strength indicator (RSSI) to the microcontroller unit, and to

- provide a second stream of values, each value calculated as an average of a predetermined number of the last values of the first stream, and to

- provide a third stream of values, each value calculated as a value corresponding to or being the time derivative of the second stream, and to

- decide, based on the third stream of values, if a jamming device is present and closing in on the radio transceiver unit (TXU);
The system according to claim 7 wherein the decision regarding the presence of a jammer closing in is based on characteristics of the third stream of values, such as e.g. the level, the duration of an increase and/or the rate of change of the third stream of values.
The system according to claim 8 wherein the decision is also based on the time duration of the third stream of values are staying over a predetermined value.
The system according to claim 8 or 9 wherein the predetermined value is determined from the minimum signal to noise ratio (SNR) of the system.
The system according to claim 10 where the microcontroller is configured to issue an alert upon detection of a moving jamming device.
The system according to any of claims 7 to 11 wherein the system is configured to estimate the time remaining to total jamming.
The system according to claim 12 wherein the system is configured to estimate the time to total jamming by using a linear estimate.
The system according to claim 12 wherein the system is configured to estimate the time to total jamming by using a non-linear estimate.