The object of this work is to study the IEEE 802.11ac standard, paying attention to the issue of the physical layer standard, to study in detail the use of MIMO and implement this technology into framework of WIFI simulator.

The Internet of Things (IoT) has seen exceptional adoption in recent years, resulting in an unprecedented level of connectivity in personal and industrial domains. In parallel, software-defined radio (SDR) technology has become increasingly powerful, making it a compelling tool for wireless security research across multiple communication protocols. Specifically, SDRs are capable of manipulating the physical layer of protocols in software, which would otherwise be implemented statically in hardware. This flexibility enables research that goes beyond the boundaries of protocol specifications. This dissertation pursues four research directions that are either enabled by software-defined radio technology, or advance its utility for security research. First, we investigate the anti-tracking mechanisms defined by the Bluetooth Low Energy (BLE) wireless protocol. This protocol, present in virtually all wearable smart devices, implements address randomization in order to prevent unwanted tracking of its users. By analyzing raw advertising data from BLE devices using SDRs, we identify a vulnerability that allows an attacker to track a BLE device beyond the address randomization defined by the protocol. Second, we implement a compact, SDR-based testbed for physical layer benchmarking of wireless devices. The testbed is capable of emulating multiple data transmissions and produce intentional signal corruption in very precisely defined ways in order to investigate receiver robustness and undefined device behavior in the presence of malformed packets. We subject a range of Wi-Fi and Zigbee devices to specifically crafted packet collisions and "truncated packets" as a way to fingerprinting wireless device chipsets. Third, we introduce a middleware framework, coined "Snout", to improves accessibility and usability of SDRs. The architecture provides standardized data pipelines as well as an abstraction layer to GNU Radio flowgraphs which power SDR signal processing. This abstraction layer improves usability and maintainability by providing a declarative experiment configuration format instead of requiring constant manipulation of the signal processing code during experimentation. We show that Snout does not result in significant computational overhead, and maintains a predictable and modest memory footprint. Finally, we address the visibility problem arising from the growing number of IoT protocols across large bands of radio spectrum. We model an SDR-based IoT monitor which is capable of scanning multiple channels (including across multiple protocols), and employs channel switching policies to maximize freshness of information obtained by transmitting devices. We present multiple policies and compare their performance against an optimal Markov Decision Process (MDP) model, as well as through event-based simulation using real-world device traffic. The results of this work demonstrate the use of SDR technology in privacy and security research of IoT device communication, and open up opportunities for further low-layer protocol discoveries that require the use of software-defined radio as a research tool.

Traditionally, spread-spectrum systems have been employed to provide low probability-of-intercept (LPI) and low probability-of-detection (LPD) performances at the physical layer, but the messages transmitted over such a system are still encrypted with a powerful cipher to protect their secrecy. Our challenge is to find a solution to provide an additional level of security at the physical layer so that simple systems such as RFID tags with limited resources can be secure without using standard encryption. It has recently been suggested that the cryptographic security of the system can be enhanced by exploiting physical properties of UWB signals. With an eavesdropper observing the communications over multipath channels between two legitimate partners sharing a secret key of a limited length, we consider both coherent and reference-based UWB schemes to enhance security. The security of the legitimate nodes is achieved by signal attributes based on the secret key, conferring an advantage over the adversary. We propose UWB signaling schemes to improve physical layer security when the transmission is intended for coherent reception and TR reception. Among possible improvements, we consider removing the frame structure of the UWB coherent signaling scheme, resulting in pulses that can be located anywhere in the symbol period. Our proposed signaling schemes could potentially suggest a solution for applications relying on conventional cryptography, especially for low-data rate RFID systems.

Die wachsende Leistungsfähigkeit moderner Automatisierungssysteme hat einen prägenden Einfluss auf den geforderten Funktionsumfang sensorischer Feldgeräte. Diese müssen über moderne Kommunikationsstandards mit überlagerten Ebenen des Steuerungssystems kommunizieren. Im Kontext der Prozessindustrie ist das Industrial Ethernet Protokoll Process Field Network (PROFINET) mit dem PA-Profil auf Basis des Ethernet Advanced Physical Layer (APL) als bedeutsamer Standard zu nennen. Im Rahmen der angewandten Forschung und Entwicklung im Bereich der Prozessindustrie entwickeln die Technische Hochschule Aschaffenburg und der Feldgerätehersteller WIKA Alexander Wiegand SE & Co. KG (WIKA) gemeinsam einen Demonstrator eines zukunftsfähigen Feldgerätes, das PROFINET über APL unterstützt. Der Hauptfokus in diesem Projekt liegt darauf, das PA-Profil 4.0 auf dem Demonstrator zu implementieren. Das PA-Profil definiert über die PROFINET-Funktionalität hinaus generisch die Grundfunktionalität und das Verhalten von Geräten im Feld der Prozessindustrie wie beispielsweise Anwendungs-, Diagnose-, Wartungs- und Engineeringparameter für verschiedene definierte Einsatzgebiete. Bei der Entwicklung des Demonstrators steht insbesondere eine zukunftsfähige Systemarchitektur im Vordergrund. Die technische Grundlage ist dabei ein APLEvaluationsboard inkl. eines Mikrocontrollers sowie ein bestehendes Sensormodul der Firma WIKA. Dieser Beitrag stellt den Stand der Technik des Einsatzes von Industrial Ethernet im Kontext der Prozessindustrie mit Fokus auf PROFINET over APL dar und erläutert die konkrete Umsetzung am Beispiel eines Demonstrators. Die praktische Anwendung verdeutlicht die Zukunftsfähigkeit und den Mehrwert der vorgestellten Technologie für Feldgeräte der Prozessindustrie. Im Ausblick wird auf das Konzept der offenen Systemarchitektur der Interessengemeinschaft Automatisierungstechnik der Prozessindustrie e.V. (NAMUR) verwiesen.

No description available.

The proliferation of connected embedded devices has driven wireless communications into commercial, military, industrial, and personal systems. It is unreasonable to expect privacy and security to be inherent in these networks given the spatial density of these devices, limited spectral resources, and the broadcast nature of wireless communications systems. Communications for these systems must have sufficient information capacity and secrecy capacity while typically maintaining small size, light weight, and minimized power consumption. With increasing crowding of the electromagnetic spectrum, interference must be leveraged as an available resource. This work develops a new beamforming method for direction-dependent modulation that provides wireless communications devices with enhanced physical layer security and the ability to simultaneously communicate and harvest energy by exploiting co-channel interference. We propose a method that optimizes a set of time-varying array steering vectors to enable direction-dependent modulation, thus exploiting a new degree of freedom in the space-time-frequency paradigm. We formulate steering vector selection as a convex optimization problem for rapid computation given arbitrarily positioned array antenna elements. We show that this method allows us to spectrally separate co-channel interference from an information-bearing signal in the analog domain, enabling the energy from the interference to be diverted for harvesting during the digitization and decoding of the information-bearing signal. We also show that this method provides wireless communications devices with not only enhanced information capacity, but also enhanced secrecy capacity in a broadcast channel. By using the proposed method, we can increase the overall channel capacity in a broadcast system beyond the current state-of-the-art for wireless broadcast channels, which is based on static coding techniques. Further, we also increase the overall secrecy capacity of the system by enabling secrecy for each user in the system. In practical terms, this results in higher-rate, confidential messages delivered to multiple devices in a broadcast channel for a given power constraint. Finally, we corroborate these claims with simulation and experimental results for the proposed method. / PHD

Radio frequency fingerprinting, a type of physical layer identification, allows identifying wireless transmitters based on their unique hardware. Every wireless transmitter has slight manufacturing variations and differences due to the layout of components. These are manifested as differences in the signal emitted by the device. A variety of techniques have been proposed for identifying transmitters, at the physical layer, based on these differences. This has been successfully demonstrated on a large variety of transmitters and other devices. However, some situations still pose challenges: Some types of fingerprinting feature are very dependent on the modulated signal, especially features based on the frequency content of a signal. This means that changes in transmitter configuration such as bandwidth or modulation will prevent wireless fingerprinting. Such changes may occur frequently with cognitive radios, and in dynamic spectrum access networks. A method is proposed to transform features to be invariant with respect to changes in transmitter configuration. With the transformed features it is possible to re-identify devices with a high degree of certainty. Next, improving performance with limited data by identifying devices using observations crowdsourced from multiple receivers is examined. Combinations of three types of observations are defined. These are combinations of fingerprinter output, features extracted from multiple signals, and raw observations of multiple signals. Performance is demonstrated, although the best method is dependent on the feature set. Other considerations are considered, including processing power and the amount of data needed. Finally, drift in fingerprinting features caused by changes in temperature is examined. Drift results from gradual changes in the physical layer behavior of transmitters, and can have a substantial negative impact on fingerprinting. Even small changes in temperature are found to cause drift, with the oscillator as the primary source of this drift (and other variation) in the fingerprints used. Various methods are tested to compensate for these changes. It is shown that frequency based features not dependent on the carrier are unaffected by drift, but are not able to distinguish between devices. Several models are examined which can improve performance when drift is present. / Doctor of Philosophy / Radio frequency fingerprinting allows uniquely identifying a transmitter based on characteristics of the signal it emits. In this dissertation several extensions to current fingerprinting techniques are given. Together, these allow identification of transmitters which have changed the signal sent, identifying using different measurement types, and compensating for variation in a transmitter's behavior due to changes in temperature.

Fréquemment exploités pour venir en complément aux réseaux mobiles traditionnels, les réseaux sans-fil multi-sauts, aussi appelés réseaux ad-hoc, sont particulièrement mis à profit dans le domaine des communications d'urgence du fait de leur capacité à s'affranchir de toute infrastructure. Néanmoins, la capacité de ces réseaux étant limitée dès lors que le nombre d'utilisateurs augmente, la communauté scientifique s'efforce à en redéfinir les contours afin d'étendre leur utilisation aux communications civiles. La gestion des interférences, considérée comme l'un des principaux défis à relever pour augmenter les débits atteignables dans les réseaux sans-fil multi-sauts, a notamment connu un changement de paradigme au cours des dernières années. Alors qu'historiquement cette gestion est régie par les protocoles de la couche d'accès dont l'objectif consiste à éviter les interférences entre utilisateurs, il est désormais possible, grâce à différentes techniques avancées de communication numérique, de traiter ces interférences, et même de les exploiter. Ces techniques de transmission, dites techniques de gestion des interférences, viennent alors concurrencer les mécanismes d'ordonnancement traditionnels en autorisant plusieurs transmissions simultanées et dans la même bande de fréquence vers un même récepteur. Dans cette thèse, nous nous intéressons à l'une de ces techniques, le Physical-Layer Network Coding (PLNC), en vue de son intégration dans des réseaux ad-hoc composés de plusieurs dizaines de nœuds. Les premiers travaux se concentrant principalement sur des petites topologies, nous avons tout d'abord développé un framework permettant d'évaluer les gains en débit à large échelle du PLNC par rapport à des transmissions traditionnelles sans interférence. Motivés par les résultats obtenus, nous avons ensuite défini un nouveau cadre d'utilisation à cette technique visant à élargir sa sphère d'application. Le schéma de PLNC proposé, testé à la fois sur de vrais équipements radio et par simulation, s'est alors révélé offrir des gains significatifs en débit et en fiabilité en comparaison aux solutions existantes. / Frequently used to complement the traditional mobile networks, multi-hop wireless networks, also referred to as ad-hoc networks, are particularly useful in emergency situations due to the fact that they do not rely on any infrastructure. Nevertheless, as the capacity of such networks does not scale with the number of users, the scientific community has strived to rethink their use in order to extend their application to civil communications. For instance, long considered as one of the most formidable challenges in multi-hop wireless networks, interference management has recently undergone a paradigm shift. While interference management is traditionally carried out by the access layer protocols whose objective is to avoid interference between users, it is now possible to exploit the interference thanks to new advanced communication techniques. These transmission techniques, so-called interference management techniques, go against the communication paradigm underlying existing scheduling mechanisms by allowing multiple simultaneous transmissions to a common receiver in the same frequency band. In this thesis, we focus on one of these techniques, namely the Physical-Layer Network (PLNC), with the objective of integrating it in ad-hoc networks. Mostly studied from both the theoretical and practical perspective in small topologies, we first design a framework for quantifying the large-scale PLNC gains over the traditional interference-free transmissions. Driven by the obtained results, we introduce a solution to increase the PLNC sphere of operation in large multi-hop wireless networks. Our comprehensive evaluation methodology, including experimental testbed validations for credibility, as well as realistic simulations, show that the proposed PLNC scheme brings important gains in terms of throughput and reliability when compared to state-of-the-art approaches.

There is an ongoing evolution of technology towards network convergence and ubiquitous information society in which users have broadband access to information resources and services anywhere, anytime. To realize this vision, a communication infrastructure has to be able to support a core backbone network delivering ultra-high capacity data services, a ubiquitous broadband wireless for last-mile access, and a control/management plane providing intelligent control to the infrastructure. Desirable characteristics of the infrastructure include insertion of future technology, intelligent spectrum management, cost-efficient upgradeability, flexible scalability, and cognitive networking capabilities. Unfortunately, present electronic technology alone is incapable of meeting these requirements.This dissertation describes the initial research into the realization of such an architecture that comprises of three crucial frameworks: 1) photonic-based; 2) dynamic chain processing; 3) and physical layer awareness. Due to the superior signal transport properties of optics, an underlying photonic data layer is able to provide the architecture with much wider bandwidth, greater RF-frequency-scalability, and higher operating RF-frequency. Photonics also enables diverse technologies to be integrated into a seamless communications platform. Dynamic processing chain framework provides the flexibility and future-proof capability via reconfigurability and componentization. Physical-layer-awareness offers support for automated adaptation and intelligent configuration of the data plane in response to the dynamic conditions of the physical layer. Crucial functional blocks in this awareness are: efficient estimation of physical impairments of the components and links; an effective dynamic impairment monitoring mechanism; and proficient adaptation to either maximize or optimize performance.Though the architecture encompasses both optical transport network (OTN) and photonic radio, this dissertation focuses more on the OTN. Central themes of OTN in this dissertation include relating Q-factor with various optical impairments from the perspective of an end-to-end optical path, and extending physical layer awareness with impairment routing. One of the key findings advocates that filtering is a serious limitation to bit-rate independence, protocol independence and network scalability promised by transparent network.

Doctor of Philosophy / Department of Electrical and Computer Engineering / Balasubramaniam Natarajan / Widely recognized security vulnerabilities in current wireless radio access technologies undermine the benefits of ubiquitous mobile connectivity. Security strategies typically rely on bit-level cryptographic techniques and associated protocols at various levels of the data processing stack. These solutions have drawbacks that have slowed down the progress of new wireless services. Physical layer security approaches derived from an information theoretic framework have been recently proposed with secret key generation being the primary focus of this dissertation. Previous studies of physical layer secret key generation (PHY-SKG) indicate that a low secret key generation rate (SKGR) is the primary limitation of this approach. To overcome this drawback, we propose novel SKG schemes to increase the SKGR as well as improve the security strength of generated secret keys by exploiting multiple input and multiple output (MIMO), cooperative MIMO (co-op MIMO) networks. Both theoretical and numerical results indicate that relay-based co-op MIMO schemes, traditionally used to enhance LTE-A network throughput and coverage, can also increase SKGR. Based on the proposed SKG schemes, we introduce innovative power allocation strategies to further enhance SKGR. Results indicate that the proposed power allocation scheme can offer 15% to 30% increase in SKGR relative to MIMO/co-op MIMO networks with equal power allocation at low-power region, thereby improving network security. Although co-op MIMO architecture can offer significant improvements in both performance and security, the concept of joint transmission and reception with relay nodes introduce new vulnerabilities. For example, even if the transmitted information is secured, it is difficult but essential to monitor the behavior of relay nodes. Selfish or malicious intentions of relay nodes may manifest as non-cooperation. Therefore, we propose relay node reliability evaluation schemes to measure and monitor the misbehavior of relay nodes. Using a power-sensing based reliability evaluation scheme, we attempt to detect selfish nodes thereby measuring the level of non-cooperation. An overall node reliability evaluation, which can be used as a guide for mobile users interested in collaboration with relay nodes, is performed at the basestation. For malicious behavior, we propose a network tomography technique to arrive at node reliability metrics. We estimate the delay distribution of each internal link within a co-op MIMO framework and use this estimate as an indicator of reliability. The effectiveness of the proposed node reliability evaluations are demonstrated via both theoretical analysis and simulations results. The proposed PHY-SKG strategies used in conjunction with node reliability evaluation schemes represent a novel cross-layer approach to enhance security of cooperative networks.