Embedded electronics are widely employed in cyber-physical systems (CPSes), which tightly integrate and coordinate computational and physical elements. CPSes are extensively deployed in security-critical applications and nationwide infrastructure. Perimeter security approaches to preventing malware infiltration of CPSes are challenged by the complexity of modern embedded systems incorporating numerous heterogeneous and updatable components. Global supply chains and third-party hardware components, tools, and software limit the reach of design verification techniques and introduce security concerns about deliberate Trojan inclusions. As a consequence, skilled attacks against CPSes have demonstrated that these systems can be surreptitiously compromised. Existing run-time security approaches are not adequate to counter such threats because of either the impact on performance and cost, lack of scalability and generality, trust needed in global third parties, or significant changes required to the design flow. We present a protection scheme called Run-time Enhancement of Trusted Computing (RETC) to enhance trust in CPSes containing untrusted software and hardware. RETC is complementary to design-time verification approaches and serves as a last line of defense against the rising number of inexorable threats against CPSes. We target systems built using reconfigurable hardware to meet the flexibility and high-performance requirements of modern security protections. Security policies are derived from the system physical characteristics and component operational specifications and translated into synthesizable hardware integrated into specific interfaces on a per-module or per-function basis. The policy-based approach addresses many security challenges by decoupling policies from system-specific implementations and optimizations, and minimizes changes required to the design flow. Interface guards enable in-line monitoring and enforcement of critical system computations at run-time. Trust is only required in a small set of simple, self-contained, and verifiable guard components. Hardware trust anchors simultaneously addresses the performance, flexibility, developer productivity, and security requirements of contemporary CPSes. We apply RETC to several CPSes having common security challenges including: secure reconfiguration control in reconfigurable cognitive radio platforms, tolerating hardware Trojan threats in third-party IP cores, and preserving stability in process control systems. High-level architectures demonstrated with prototypes are presented for the selected applications. Implementation results illustrate the RETC efficiency in terms of the performance and overheads of the hardware trust anchors. Testbenches associated with the addressed threat models are generated and experimentally validated on reconfigurable platform to establish the protection scheme efficacy in thwarting the selected threats. This new approach significantly enhances trust in CPSes containing untrusted components without sacrificing cost and performance. / Ph. D.

The tremendous ongoing growth of wireless digital communications has raised spectrum shortage and security issues. In particular, the need for new spectrum is the main obstacle in continuing this growth. Recent studies on radio spectrum usage have shown that pre-allocation of spectrum bands to specific wireless communication applications leads to poor utilization of those allocated bands. Therefore, research into new techniques for efficient spectrum utilization is being aggressively pursued by academia, industry, and government. Such research efforts have given birth to two concepts: Cognitive Radio (CR) and Dynamic Spectrum Access (DSA) network. CR is believed to be the key enabling technology for DSA network implementation. CR based DSA (cDSA) networks utilizes white spectrum for its operational frequency bands. White spectrum is the set of frequency bands which are unoccupied temporarily by the users having first rights to the spectrum (called primary users). The main goal of cDSA networks is to access of white spectrum. For proper access, CR nodes must identify the right cDSA network and the absence of primary users before initiating radio transmission. To solve the cDSA network access problem, methods are proposed to design unique second-order cyclic features using Orthogonal Frequency Division Multiplexing (OFDM) pilots. By generating distinct OFDM pilot patterns and measuring spectral correlation characteristics of the cyclostationary OFDM signal, CR nodes can detect and uniquely identify cDSA networks. For this purpose, the second-order cyclic features of OFDM pilots are investigated analytically and through computer simulation. Based on analysis results, a general formula for estimating the dominant cycle frequencies is developed. This general formula is used extensively in cDSA network identification and OFDM signal detection, as well as pilot pattern estimation. CR spectrum awareness capability can be enhanced when it can classify the modulation type of incoming signals at low and varying signal-to-noise ratio. Signal classification allows CR to select a suitable demodulation process at the receiver and to establish a communication link. For this purpose, a threshold-based technique is proposed which utilizes cycle-frequency domain profile for signal detection and feature extraction. Hidden Markov Models (HMMs) are proposed for the signal classifier. The spectrum awareness capability of CR can be undermined by spoofing radio nodes. Automatic identification of malicious or malfunctioning radio signal transmitters is a major concern for CR information assurance. To minimize the threat from spoofing radio devices, radio signal fingerprinting using second-order cyclic features is proposed as an approach for Specific Emitter Identification (SEI). The feasibility of this approach is demonstrated through the identification of IEEE 802.11a/g OFDM signals from different Wireless Local Area Network (WLAN) card manufactures using HMMs. / Ph. D.

Cognitive radios (CRs) are devices that are capable of sensing the spectrum and using its free portions in an opportunistic manner. The free spectrum portions are referred to as white spaces or spectrum holes. It is widely believed that CRs are one of the key enabling technologies for realizing a new regulatory spectrum management paradigm, viz. dynamic spectrum access (DSA). CRs often employ software-defined radio (SDR) platforms that are capable of executing artificial intelligence (AI) algorithms to reconfigure their transmission/reception (TX/RX) parameters to communicate efficiently while avoiding interference with licensed (a.k.a. primary or incumbent) users and unlicensed (a.k.a. secondary or cognitive) users. When different stakeholders share a common resource, such as the case in spectrum sharing, security, privacy, and enforcement become critical considerations that affect the welfare of all stakeholders. Recent advances in radio spectrum access technologies, such as CRs, have made spectrum sharing a viable option for significantly improving spectrum utilization efficiency. However, those technologies have also contributed to exacerbating the difficult problems of security, privacy and enforcement. In this dissertation, we review some of the critical security and privacy threats that impact spectrum sharing. We also discuss ex ante (preventive) approaches which mitigate the security and privacy threats and help spectrum enforcement. / Ph. D.

Cognitive radio (CR) is seen as one of the enabling technologies for realizing a new regulatory spectrum management paradigm, viz. opportunistic spectrum sharing (OSS). In the OSS paradigm, unlicensed users (a.k.a. secondary users) opportunistically operate in fallow licensed spectrum on a non-interference basis to licensed users (a.k.a. incumbent or primary users). Incumbent users have absolute priority in licensed bands, and secondary users must vacate the channel where incumbent user signals are detected. A CR network is composed of secondary users equipped with CRs and it can coexist with incumbent users in licensed bands under the OSS paradigm. The coexistence between incumbent users and secondary users is referred to as incumbent coexistence, and the coexistence between CR networks of the same type is referred to as self-coexistence. In this dissertation, we address three coexistence-related problems at the medium access control (MAC) layer in CR networks: (1) the rendezvous (control channel) establishment problem, (2) the channel assignment problem in an ad hoc CR network, and (3) the spectrum sharing problem between infrastructure-based CR networks, i.e., the 802.22 wireless regional area networks (WRANs). Existing MAC layer protocols in conventional wireless networks fail to adequately address the key issues concerning incumbent and self coexistence that emerge in CR networks. To solve the rendezvous establishment problem, we present a systematic approach, based on quorum systems, for designing channel hopping protocols that ensure a pair of CRs to "rendezvous" within an upper-bounded time over a common channel that is free of incumbent user signals. In a single radio interface, ad hoc CR network, we propose a distributed channel assignment scheme that assigns channels at the granularity of "segments" for minimizing the channel switching overhead. By taking into account the coexistence requirements, we propose an inter-network spectrum sharing protocol that enables the sharing of vacant TV white space among coexisting WRANs. Our analytical and simulation results show that these proposed schemes can effectively address the aforementioned MAC layer coexistence problems in CR networks. / Ph. D.

Dynamic spectrum access (DSA) technique has been widely accepted as a crucial solution to mitigate the potential spectrum scarcity problem. Spectrum sharing between the government incumbents and commercial wireless broadband operators/users is one of the key forms of DSA. Two categories of spectrum management methods for shared use between incumbent users (IUs) and secondary users (SUs) have been proposed, i.e., the server-driven method and the sensing-based method. The server-driven method employs a central server to allocate spectrum resources while considering incumbent protection. The central server has access to the detailed IU operating information, and based on some accurate radio propagation model, it is able to allocate spectrum following a particular access enforcement method. Two types of access enforcement methods -- exclusion zone and protection zone -- have been adopted for server-driven DSA systems in the current literature. The sensing-based method is based on recent advances in cognitive radio (CR) technology. A CR can dynamically identify white spaces through various incumbent detection techniques and reconfigure its radio parameters in response to changes of spectrum availability. The focus of this dissertation is to address critical privacy and security issues in the existing DSA systems that may severely hinder the progress of DSA's deployment in the real world. Firstly, we identify serious threats to users' privacy in existing server-driven DSA designs and propose a privacy-preserving design named P²-SAS to address the issue. P²-SAS realizes the complex spectrum allocation process of protection-zone-based DSA in a privacy-preserving way through Homomorphic Encryption (HE), so that none of the IU or SU operation data would be exposed to any snooping party, including the central server itself. Secondly, we develop a privacy-preserving design named IP-SAS for the exclusion-zone- based server-driven DSA system. We extend the basic design that only considers semi- honest adversaries to include malicious adversaries in order to defend the more practical and complex attack scenarios that can happen in the real world. Thirdly, we redesign our privacy-preserving SAS systems entirely to remove the somewhat- trusted third party (TTP) named Key Distributor, which in essence provides a weak proxy re-encryption online service in P²-SAS and IP-SAS. Instead, in this new system, RE-SAS, we leverage a new crypto system that supports both a strong proxy re-encryption notion and MPC to realize privacy-preserving spectrum allocation. The advantages of RE-SAS are that it can prevent single point of vulnerability due to TTP and also increase SAS's service performance dramatically. Finally, we identify the potentially crucial threat of compromised CR devices to the ambient wireless infrastructures and propose a scalable and accurate zero-day malware detection system called GuardCR to enhance CR network security at the device level. GuardCR leverages a host-based anomaly detection technique driven by machine learning, which makes it autonomous in malicious behavior recognition. We boost the performance of GuardCR in terms of accuracy and efficiency by integrating proper domain knowledge of CR software. / Ph. D.

This dissertation presents an empirical approach to identifying decisions for adapting cognitive radio parameters with no a priori knowledge of the environment. Cognitively inspired radios, attempt to combine observed metrics of system performance with artificial intelligence decision-making algorithms. Current architectures trend towards hybrid combinations of heuristics, such as genetic algorithms (GA) and experiential methods, such as case-based reasoning (CBR). A weakness in the GA is its reliance on limited mathematical models for estimating bit error rate, packet error rate, throughput, and signal-to-noise ratio. The CBR approach is similarly limited by its dependency on past experiences. Both methods have potential to suffer in environments not previously encountered. In contrast, the statistical methods identify performance estimation models based on exercising defined experimental designs. This represents an experiential decision-making process formed in the present rather than the past. There are three core contributions from this empirical framework: 1) it enables a new approach to decision making based on empirical estimation models of system performance, 2) it provides a systematic method for initializing cognitive engine configuration parameters, and 3) it facilitates deeper understanding of system behavior by quantifying parameter significance, and interaction effects. Ultimately, this understanding enables simplification of system models by identifying insignificant parameters. This dissertation defines an abstract framework that enables application of statistical approaches to cognitive radio systems regardless of its platform or application space. Specifically, it assesses factorial design of experiments and response surface methodology (RSM) to an over-the-air wireless radio link. Results are compared to a benchmark GA cognitive engine. The framework is then used for identifying software-defined radio initialization settings. Taguchi designs, a related statistical method, are implemented to identify initialization settings of a GA. / Ph. D.

Dynamic spectrum access (DSA) wireless networks focus on using RF spectrum more efficiently and dynamically. Significant progress has been made during the past few years. For example, many measurements of current spectrum utilization are available. Theoretical analyses and computational simulations of DSA networks also abound. In sharp contrast, few network systems, particularly those with a decentralized structure, have been built even at a small scale to investigate the performance, behavior, and dynamics of DSA networks under different scenarios. This dissertation provides the theory, design, and implementation of a software radio-based decentralized DSA network prototype, and its enabling technologies: software radio, signal detection and classification, and distributed cooperative spectrum sensing. By moving physical layer functions into the software domain, software radio offers an unprecedented level of flexibility in radio development and operation, which can facilitate research and development of cognitive radio (CR) and DSA networks. However, state-of-the-art software radio systems still have serious performance limitations. Therefore, a performance study of software radio is needed before applying it in any development. This dissertation investigates three practical issues governing software radio performance that are critical in DSA network development: RF front end nonlinearity, dynamic computing resource allocation, and execution latency. It provides detailed explanations and quantitative results on SDR performance. Signal detection is the most popular method used in DSA networks to guarantee non-interference to primary users. Quickly and accurately detecting signals under all possible conditions is challenging. The cyclostationary feature detection method is attractive for detecting primary users because of its ability to distinguish between modulated signals, interference, and noise at a low signal-to-noise ratio (SNR). However, a key issue of cyclostationary signal analysis is the high computational cost. To tackle this challenge, parallel computing is applied to develop a cyclostationary feature based signal detection method. This dissertation presents the method's performance on multiple signal types in noisy and multi-path fading environments. Distributed cooperative spectrum sensing is widely endorsed to monitor the radio environment so as to guarantee non-interference to incumbent users even at a low SNR and under hostile conditions like shadowing, fading, interference, and multi-path. However, such networks impose strict performance requirements on data latency and reliability. Delayed or faulty data may cause secondary users to interfere with incumbent users because secondary users could not be informed quickly or reliably. To support such network performance, this dissertation presents a set of data process and management schemes in both sensors and data fusion nodes. Further, a distributed cooperative sensor network is built from multiple sensors; together, the network compiles a coherent semantic radio environment map for DSA networks to exploit available frequencies opportunistically. Finally, this dissertation presents the complete design of a decentralized and asynchronous DSA network across the PHY layer, MAC layer, network layer, and application layer. A ten-node prototype is built based on software radio technologies, signal detection and classification methods, distributed cooperative spectrum sensing systems, dynamic wireless protocols, and a multi-channel allocation algorithm. Systematic experiments are carried out to identify several performance determining factors for decentralized DSA networks. / Ph. D.

Machine-to-Machine (M2M) communications is an emerging communication paradigm that provides ubiquitous connectivity between devices along with an ability to communicate autonomously without human intervention. M2M communications acts as an enabling technology for the practical realization of Internet-of-Things (IoT). However, M2M communications differs from conventional Human-to-Human (H2H) communications due to its unique features such as massive number of connected devices, small data transmissions, little or no mobility, requirements of high energy efficiency and reliability, etc. These features create various challenges for existing communication networks which are primarily optimized for H2H communications. Therefore, novel solutions are required to meet the key requirements of M2M communications. In addition, enhancements are required at different layers of the protocol stack to support co-existence of M2M devices and H2H users. The main objective of this research is to investigate the challenges of M2M communications in two broad types of M2M networks; capillary M2M and cellular M2M networks. The primary focus is on developing novel solutions, algorithms, and protocol enhancements for successfully enabling M2M communications. Since cognitive radio technology is very promising for M2M communications, special emphasis is on capillary M2M networks with cognitive radio based Physical layer. Besides, the focus is also on exploring new frontiers in M2M communications. This thesis covers different aspects of M2M communications. Considering the motivation for cognitive M2M and service requirements of M2M devices, two cognitive MAC protocols have been proposed. The first protocol is centralized in nature and utilizes a specialized frame structure for co-existence with the primary network as well as handling different Quality-of-Service (QoS) requirements of M2M devices. The second protocol is a distributed cognitive MAC protocol, which is specially designed to provide high energy efficiency and reliability for M2M devices operating in challenging wireless environments. Both protocols explicitly account for the peculiarities of cognitive radio environments. The protocols have been evaluated using analytical modeling and simulation studies. Recently IETF has standardized a specially designed routing protocol for capillary M2M networks, known as RPL (Routing for Low Power and Lossy Networks). RPL is emerging as the de facto routing protocol for many M2M applications including the smart grid. On the other hand, the application of cognitive radio for smart grid communication is under active investigation in the research community. Hence, it is important to investigate the applicability and adaptation of RPL in cognitive radio environments. In this regard, an enhanced RPL based routing protocol has been proposed for cognitive radio enabled smart grid networks. The enhanced protocol provides novel modifications to RPL for protecting the primary users along with meeting the utility requirements of the secondary network. An important challenge in LTE-based cellular networks with M2M communications is the uplink radio resource management as available resources are shared between M2M devices and H2H users, having different and often conflicting QoS requirements. Apart from this, energy efficiency requirements become critically important. Further, the specific constraints of Single Carrier Frequency Division Multiple Access (SC-FDMA) complicate the resource allocation problem. In this respect, an energy efficient resource allocation algorithm for the uplink of LTE networks with M2M/H2H co-existence under statistical QoS guarantees has been developed, that is based on canonical duality theory. The proposed algorithm outperforms classical algorithms in terms of energy efficiency while satisfying the QoS requirements of M2M devices and H2H users. A new frontier in M2M communications is the nano-M2M communications, which is envisioned to create the Internet-of-Nano-Things (IoNT). Molecular communication (MC) is a promising communication technique for nano-M2M communications. In literature, no model for error performance of MC exists. Therefore, an error performance model has been developed that explicitly accounts for noise and interference effects. Since relaying and network coding based solutions are gaining popularity for nano-M2M networks, the error performance of a network coded molecular nano-M2M network has been evaluated as well. Finally, the thesis is concluded based on the overall picture of the research conducted. In addition, some directions for future work are included as well.

In this thesis the multi-polarized Cognitive Radios are studied. Cognitive Radios are proposed as an interesting way to more efficiently use the frequency resources. A Cognitive Radio secondary user finds the frequency bands which are not utilized by primary users and communicates on them without interfering with the primary users. In order to achieve this goal the secondary user must be able to detect reliably and quickly the presence of a primary user in a frequency band. In this thesis, the impact of polarization on the spectrum sensing performances of cognitive radio systems is studied.<p><p>First the depolarization occurring in the wireless channel is studied for two cognitive radio scenarios. This is done through an extensive measurement campaign in two outdoor-to-indoor and indoor-to-indoor scenarios where the parameters characterizing the radiowaves polarization are characterized at three different spatial scales: small-scale variation, large-scale variation and distance variation. <p><p>Second, a new approach is proposed in modeling of multi-polarized channels. The polarization of received fields is characterized from an electromagnetic point of view by modeling the polarization ellipse. Theoretical formulations are proposed in order to obtain the parameters characterizing the polarization ellipse based on the signals received on three cross-polarized antennas. A system-based statistical model of the time-dynamics of polarization is proposed based on an indoor-to-indoor measurement campaign. The analytical formulations needed in order to project the polarization ellipse onto a polarized multi-antenna system are given and it is shown how the model can be generated. <p><p>Third, the impact of polarization on the spectrum sensing performances of energy detection method is presented and its importance is highlighted. The performance of spectrum sensing with multi-polarized antennas is compared with unipolar single and multi-antenna systems. This analysis is based on an analytical formulation applied to the results obtained from the multi-polarized measurement campaign. The detection probability as a function of distance between the primary transmitter and the secondary terminal and the inter-antenna correlation effect on the spectrum sensing performance are studied. <p><p>An important limitation of energy detector is its dependence on the knowledge of the noise variance. An uncertainty on the estimation of the noise variance considerably affects the performance of energy detector. This limitation is resolved by proposing new multi-polarized spectrum sensing methods which do not require any knowledge neither on the primary signal nor on the noise variance. These methods, referred to as “Blind spectrum sensing methods”, are based on the use of three cross-polarized antennas at the secondary terminal. Based on an analytical formulation and the results obtained from the measurement campaign, the performances of the proposed methods are compared with each-other and with the energy detection method. The effect of antenna orientation on the spectrum sensing performance of the proposed methods and the energy detection method is studied using the proposed elliptical polarization model. <p> / Doctorat en Sciences de l'ingénieur / info:eu-repo/semantics/nonPublished

Cette thèse concerne le développement de futurs appareils, systèmes et réseaux prenant en charge l’internet haute vitesse, sans fil 5éme g´enération (5G). La demande de débit très élevé nécessite une bande passante suffisante, et ainsi la bande de fréquence millimetrique (mm-wave) a beaucoup d’intérêt. Un certain nombre de technologies devront converger, coexister et interagir, et surtout, coopérer, si cette vision doit être efficace et rentable. Le concept principal de cette de 5G est l’intégration de réseaux de fibre optique et Les réseaux radio grâce à la technologie Radio-sur-Fibre (RoF) aux fréquences d’onde millimetriques, pour fournir des services à large bande passante et permettre des réseaux évolutifs et gérables sans structure d’interface très complexe et multiples protocoles superposés.Dans cette thèse, les systèmes de communication RoF à ondes millimetriques sont théoriquement étudiés et démontrés expérimentalement pour étudier les altérations du système. Le travail présenté dans cette thèse est axé sur le bruit optique représenté par le bruit de phase et d’intensité induit par la source optique et la dispersion chromatique introduite par la fibre optique. Le bruit optique est analysé et mesuré pour différentes techniques de génération optique. Deux dispositifs différents de conversion, un mélangeur et un détecteur d’enveloppe sont, appliqués pour le traitement du signal et pour décorréler la phase et le bruit d’intensité. Nous souhaitons souligner que cette étude et le modèle peuvent s’appliquer à tout type de système de génération optique hétérodyne et à toute gamme de fréquences. La corrélation entre les modes optiques en peigne à fréquence optique est examinée pour montrer l’impact de la dispersion chromatique. Cette thèse présente la distribution d’énergie des ondes millimetriques et son influence sur la portée des fibres et la façon dont l’effet de dispersion chromatique sur le réseau RoF depend des paramètres de dispersion. Ensuite, cette thèse démontre comment la décorrélation de la phase optique induite par la dispersion chromatique entraîne un bruit de partition de modes dans les réseaux de communication RoF à ondes millimétriques.Lors de la transmission de certains types de données sur le système, les résultats démontrent l’impact du bruit optique et de la dispersion chromatique sur le qualité du signal. Les résultats de simulation sont présentés et sont en très bon accord avec les résultats expérimentaux. La grandeur du vecteur d’erreur evaluée par en processus en ligne montre l’impact des altèrations du système sur les performances du système. Le débit de données et l’évolution du système présentée sont en conformité avec les normes de communication comme à ondes millimétriques. / This thesis is for the development of future devices, systems and networks supporting the 5th Generation (5G) high-speed wireless internet. The demand for very high bit rate requires a sufficient large bandwidth, and therefore Millimeter-Wave (mm-wave) frequency band has a lot of interest. Several number of technologies will need to converge, co-exist and interoperate, and most importantly, cooperate, if this vision is to be efficiently and cost-effectively realized. The main concept within this next 5G is the integration of optical fiber networks and radio networks through Radio-over-Fiber (RoF) technology at mm-wave frequencies, to provide high-bandwidth front/backhaul services and enable scalable and manageable networks without a highly complex interface structure and multiple overlaid protocols.In this thesis, the mm-wave RoF communication systems are theoretically studied and experimentally demonstrated to investigate the system impairments. The work presented in this thesis is focused on optical noise represented by phase and intensity noise induced by optical source and chromatic dispersion introduced by optical fiber. The optical noise is analyzed and measured for different optical generation techniques. Two different down-conversion stages, mixer and envelope detector, are applied for signal processing and to decorrelate phase and intensity noise. We would like to highlight that this study and the model can be applicable toany kind of optical heterodyne generation system and any frequency range. The correlation among optical modes in optical frequency comb is examined to show the impact of chromatic dispersion. This thesis also exhibits the mm-wave power distribution over fiber span and how the chromatic dispersion effect on the RoF network is modified by varying dispersion parameters. Then, this thesis demonstrates how the optical phase decorrelation induced by chromatic dispersion results in mode partition noise at mm-wave RoF communication networks.When transmitting some types of data over the system, the results demonstrate the impact of optical noise and chromatic dispersion on the signal quality. The simulation results are presented and are in very good agreement with experimental results. The error vector magnitudethrough online process shows the impact of the system impairments on the system performance. The data rate and system evolution are compliance with communication standards at mm-wave.