A1260248492YDHCA

1
ECE445 Project 8 Wireless Detection of
Keystrokes
Vasile Bora Ian Cottle
2
Introduction

• Project proposed by SAIC
• Specifications
• Detection must be performed wirelessly
• Keyboard must be USB
• Previous work Vuagnoux, M. and Pasini, S.
  Compromising Electromagnetic Emanations of Wired
  and Wireless Keyboards

3
Design Goals

• Main goal
• Detect when a key has been pressed with an
  antenna system
• Detection must work in a noisy environment
• Create counter to record how many keys have been
  pressed
• High accuracy

4
Design Goals (cont.)

• Secondary Goals
• Determine which key has been pressed
• Design/implement countermeasures to detection
• Develop recommendations for further research

5
Ethical Concerns

• While working on this project, we must obviously
  consider ethical ramifications
• We believe full disclosure is the only ethical
  approach
• Clear interests for military, government, and
  industrial applications
• Security through obscurity is not a valid option

6
(No Transcript)
7
Project Outline

• Initial Testing
• Keyboard Disassembly
• Filter design and construction
• Antenna Research and Construction
• Balun research and construction
• Labview Work

8
Initial Testing

• Several keyboards used
• Tested in Faraday cage and EL251 lab
• Used both spectrum analyzer and oscilloscope

9
Initial Testing
No key pressed 50Ohms probe
Key Pressed 50Ohms probe
10
Initial Testing
Key Pressed 50Ohms probe
Key Pressed 1MOhms probe
11
Keyboard Disassembly

• Took apart one keyboard to see internals
• Allowed for direct probing of the controller pins
• Used logic analyzer

12
Keyboard Disassembly Pictures
13
Filter Design and Testing

• Filter is 3rd order Chebychev
• Simulated in PUFF
• Filters were simulated in LabVIEW with saved data
  to speed up prototyping

14
(No Transcript)
15
(No Transcript)
16
Antenna Research and Construction

• Most of the literature deals with tuned HF
  antennas
• Constructed several different antenna
  configurations with varying levels of success
• Prof. Bernhard suggested using a balun to
  increase performance

17
Antenna Research and Construction
18
Antenna Research and Construction
Z - measurements
First built antenna with reduced distributed
capacitance
First built antenna
19
Antenna Research and Construction
Z - measurements
Second built antenna with balun mounted
BNC antenna
20
Antenna Research and Construction

• Balun research and construction
• Basic purpose is to connect an unbalanced load to
  a balanced antenna
• Two baluns were constructed, one for each antenna

21
Antenna Research and Construction

• Balun research and construction

http//www.eznec.com/Amateur/Articles/Baluns.pdf
22
LabVIEW Work

• LabVIEW Work
• Built a LV .vi to test different filter
  configurations
• Built a LV .vi to do peak detection on the
  time-domain signal from the oscilloscope
• Built a LV .vi to perform cross-correlation on
  the signal to detect key presses on saved scope
  traces
• Built a LV .vi to squelch the noise from the
  incoming signal

23
LabVIEW Work Cross Correlation
24
LabVIEW Work- Squelching
25
IF-RIO Specifications

• NI PCI-5640R Software Defined Radio IF
  Transceiver
• PCI-bus board installs into a desktop PC and is
  fully programmable with LabVIEW, saving thus
  developing time
• on-board Xilinx Virtex-II Pro FPGA for in-line
  or host-based processing by streaming signals to
  and from the host PC

26
IF-RIO Work

• IF-RIO work
• Data acquisition
• Loading templates
• Cross-correlation and squelching
• Output text
• Count errors, keys and determine accuracy

27
IF-RIO Work

• Saving templates

28
IF-RIO work

• Key detector block diagram (left side)

29
IF-RIO work

• Key detector block diagram (right side)

30
IF-RIO work
31
Successes and Failures

• Able to detect when a key has been pressed
• Able to reliably decode subset of keys
• Processing is too slow when trying to use all 26
  letter templates
• Many key templates are too similar to distinguish

32
Recommendations for Future Work

• Explore different approaches
• Refine current approach
• Process on GPU
• Use more than one channel

33
Thanks to
Eric Dunn and SAIC Professor Schmitz Kieran
Levin Professor Carney and all ECE445
staff Professor Bernhard You
34
Questions?