A cyber-physical system (CPS) is a complex integration of hardware and software components to perform well-defined tasks. Up to this point, many software-based attacks targeting the network and computation layers have been reported by the researchers. However, the physical layer attacks that utilize natural phenomena (e.g., electromagnetic waves) to manipulate safety-critic signals such as analog sensor outputs, digital data, and actuation signals have recently taken the attention. The purpose of this dissertation is to detect the weaknesses of cyber-physical systems against low-power Intentional Electromagnetic Interference (IEMI) attacks and provide hardware-level countermeasures. Actuators are irreplaceable components of electronic systems that control the physically moving sections, e.g., servo motors that control robot arms. In Chapter 2, the potential effects of IEMI attacks on actuation control are presented. Pulse Width Modulation (PWM) signal, which is the industry–standard for actuation control, is observed to be vulnerable to IEMI with specific frequency and modulated–waveforms. Additionally, an advanced attacker with limited information about the victim can prevent the actuation, e.g., stop the rotation of a DC or servo motor. For some specific actuator models, the attacker can even take the control of the actuators and consequently the motion of the CPS, e.g., the flight trajectory of a UAV. The attacks are demonstrated on a fixed-wing unmanned aerial vehicle (UAV) during varying flight scenarios, and it is observed that the attacker can block or take control of the flight surfaces (e.g., aileron) which results in a crash of the UAV or a controllable change in its trajectory, respectively. Serial communication protocols such as UART or SPI are widely employed in electronic systems to establish communication between peripherals (e.g., sensors) and controllers. It is observed that an adversary with the reported three-phase attack mechanism can replace the original victim data with the 'desired' false data. In the detection phase, the attacker listens to the EM leakage of the victim system. In the signal processing phase, the exact timing of the victim data is determined from the victim EM leakage, and in the transmission phase, the radiated attack waveform replaces the original data with the 'desired' false data. The attack waveform is a narrowband signal at the victim baud rate, and in a proof–of–concept demonstration, the attacks are observed to be over 98% effective at inducing a desired bit sequence into pseudorandom UART frames. Countermeasures such as twisted cables are discussed and experimentally validated in high-IEMI scenarios. In Chapter 4, a state-of-art electrical vehicle (EV) charger is assessed in IEMI attack scenarios, and it is observed that an attacker can use low–cost RF components to inject false current or voltage sensor readings into the system. The manipulated sensor data results in a drastic increase in the current supplied to the EV which can easily result in physical damage due to thermal runaway of the batteries. The current switches, which control the output current of the EV charger, can be controlled (i.e., turned on) by relatively high–power IEMI, which gives the attacker direct control of the current supplied to the EV. The attacks on UAVs, communication systems, and EV chargers show that additional hardware countermeasures should be added to the state-of-art system design to alleviate the effect of IEMI attacks. The fiber-optic transmission and low-frequency magnetic field shielding can be used to transmit 'significant signals' or PCB-level countermeasures can be utilized which are reported in Chapter 5. / Doctor of Philosophy / The secure operation of an electronic system depends on the integrity of the signals transmitted from/to components like sensors, actuators, and controllers. Adversaries frequently aim to block or manipulate the information carried in sensor and actuation signals to disrupt the operation of the victim system with physical phenomena, e.g., infrared light or acoustic waves. In this dissertation, it is shown that low-power electromagnetic (EM) waves, with specific frequency and form devised for the victim system, can be utilized as an attack tool to disrupt, and, in some scenarios, control the operation of the system; moreover, it is shown that these attacks can be mitigated with hardware-level countermeasures. In Chapter 2, the attacks are applied to electric motors on an unmanned aerial vehicle (UAV), and it is observed that an attacker can block (i.e., crash of the UAV) or control the UAV motion with EM waves. In Chapter 3, it is shown that digital communication systems are not resilient against intentional electromagnetic interference (IEMI), either. Low–power EM waves can be utilized by attackers to replace the data in serial communication systems with a success rate %98 or more. In Chapter 4, the attacks are applied to the sensors and actuators of electric vehicle chargers with low–cost over–the–shelf amplifiers and antennas, and it is shown that EM interference attacks can manipulate the sensor data and boosts the current supplied to the EV, which can result in overheating and fire. To ensure secure electronic system operation, hardware–level defense mechanisms are discussed and validated with analytical solutions, simulations, and experiments.

Three-dimensional (3-D) system integration is believed to be a promising technology and has gained tremendous momentum in the semiconductor industry recently. The Silicon interposer is the key enabler for the 3-D systems, and is expected to have high input/output counts, fine wiring lines and many TSVs. Modeling and design of the silicon interposer can be challenging and is becoming a critical task. This dissertation mainly focuses on developing an efficient modeling approach for silicon interposers in 3-D systems. The developed numerical methods can be classified as several categories. 1. The investigation of the coupling effects in large TSV arrays in silicon interposers. The importance of coupling between TSVs for low resistivity silicon substrates is quantified both in frequency and time domains. This has been compared with high resistivity silicon substrates. 2. The development of an electromagnetic modeling approach for non-uniform TSVs. To model the complex TSV structures, an approach for modeling conical TSVs is proposed first. Later a hybrid modeling method which combines the conical TSV modeling method and cylindrical modeling method is proposed to model the non-uniform TSV structures. 3. The development of a hybrid modeling approach for power delivery networks (PDN) with through-silicon vias (TSVs). The proposed approach extends multi-layer finite difference method (M-FDM) to include TSVs by extracting their parasitic behavior using an integral equation based solver. 4. The development of an efficient approach for modeling signal paths with TSVs in silicon interposers. The proposed method utilizes the 3-D finite-difference frequency-domain (FDFD) method to model the redistribution layer (RDL) transmission lines. A new formulation on incorporating multiport networks into the 3-D FDFD formulation is presented to include the parasitic effects of TSV arrays in the system matrix. 5. The development of a 3-D FDFD non-conformal domain decomposition method. The proposed method allows modeling individual domains independently using the FDFD method with non-matching meshing grids at interfaces. This non-conformal domain decomposition method is applied to model interconnections in silicon interposer.

With the trends of fast edge rates, high clock frequencies, and low voltage levels for the high-speed digital computer systems, the ground bounce noise (GBN) or simultaneously switching noise (SSN) on the power/ground planes is becoming one of the major challenges for designing the high-speed circuits. In order to analyze the impact of the GBN on signal integrity (SI) and electromagnetic interference (EMI), an accurate and efficient modeling approach that considers the active devices and passive interconnects is required. This thesis focuses on two points. One is developing modeling approaches for analyzing the GBN effects, and the other is proposing solutions to reduce it. First, based on the FDTD algorithm several efficient modeling approaches including equivalent current-source method (ECSM), Kirchoff surface integral representation (KSIR), and slot-corrected 2D-FDTD are developed. After that, a power/ground-planes design for efficiently eliminating the GBN in high-speed digital circuits is proposed by using low-period coplanar electromagnetic bandgap (LPC-EBG) structure. Its extinctive behaviors of low radiation and broadband suppression of the GBN is demonstrated numerically and experimentally. Good agreements are seen.

This thesis focuses on the modeling and solutions of the simultaneous switching noise (SSN) problems in the power delivery networks (PDN) of high-speed digital circuit packages. An efficient numerical approach based on two-dimension (2D) finite-difference time-domain (FDTD) method combined with the lumped circuit model of the interconnection is proposed to model the PDN of a package and PCB. Based on this approach, the mechanism of noise coupling between package and PCB can be analyzed. In addition, a novel photonic crystal power layer (PCPL) design for the PDN of the package or PCB is proposed to suppress the SSN. The periodic High-Dk material is embedded into the substrate layer between the power and ground planes. Both modeling and measurement demonstrate the PCPL can form a wide stopband well with excellent suppression of the SSN propagation in the substrate and the corresponding electromagnetic interference (EMI).

<p>Nowadays, mobile phones have greater functionality; a camera, color LCD screen, wireless LAN, Bluetooth, IrDA and others. In the near future wider variety of new functionalities will be added, from high quality voice, high definition video to high data rate wireless channels. As consumer electronics integrate greater functionality and high operating frequencies, their emissions will exceed the specified limits, most of these emissions will be a result of the internal interferences in the mobile phone. Moreover higher operating frequencies will be required to improve the quality of these functionalities, something that will make it more difficult to control these interferences. Internal or external sources of electromagnetic interference can degrade the performance of sensitive analog/digital circuits inside the mobile phone. Moreover the electronic device must satisfy a host of global regulations that limit it’s susceptibility to these interferences, as well as the interference emitted by the device itself.</p><p>Therefore designing a new electronic device to perform new and exciting functions will not be a pleasant task if it can not meet certain specifications and function as required to adhere to certain global regulations.</p><p>This thesis project investigates the sources of interference inside a mobile phone; mainly the electromagnetic interferences and its effect on the radio transceiver focusing on the GSM receiver sensitivity. This report is a result of intensive research, an investigation of possible sources of interference, also actual measurements were performed; RSSI, OTA and sniffing measurements; to identify the physical sources of interferences, and their effect on the receiver sensitivity. Finally solutions were recommended and implemented to suppress the interferences due to different sources, mainly through filtering, shielding or proper grounding of signals and components/subsystems in the mobile phone.</p>

Orientador: Prof. Dr. Marcelo Bender Perotoni / Dissertação (mestrado) - Universidade Federal do ABC, Programa de Pós-Graduação em Engenharia Elétrica, 2017. / Este trabalho consiste na exploração dos problemas e aplicações eletromagnéticas na área de conexão da eletrônica em altas taxas de velocidade de dados. Referências bibliográficas como as equações de Maxwell e suas derivações, técnicas de implementação de conectividades, simplificações como: linhas (striplines), microlinhas (microstrip), placas de circuito impresso empilhadas (stackup) serão abordadas. Também são encontradas bases teóricas como aterramento (grounding) e blindagem (shielding), para aplicações com cabos do tipo coaxial e pares de dados. Os efeitos estudados são reflexão e acoplamentos (crosstalk). Há uma comparação dos resultados em um sistema exemplo com cabo de rede ethernet e conectores para acoplamento e medição, entre simulações computacionais (CST ¿ Computer Simulation Technology , mais exatamente no módulo MWS ¿ Micro Wave Studio), e medições com um VNA (Vector Network Analyzer). / This study covers the electromagnetic evaluation and applications on electronic connections area at high speed data rates. References to Maxwell equations and its derivations concerning high frequency effects, connectivity implementation techniques and simplifications like: striplines, microstrip, stackup of PCBs layers are addressed. Theoretical bases are laid, to applications with coax cables and twisted pairs and their respective grounding and shielding. The effects studied are reflection and crosstalk. There are results for an example - a launcher and Ethernet cable with the connector. The results are shown in simulation (CST, module MWS ¿ Micro Wave Studio), and measurements using a VNA (Vector Network Analyzer).

Nowadays, mobile phones have greater functionality; a camera, color LCD screen, wireless LAN, Bluetooth, IrDA and others. In the near future wider variety of new functionalities will be added, from high quality voice, high definition video to high data rate wireless channels. As consumer electronics integrate greater functionality and high operating frequencies, their emissions will exceed the specified limits, most of these emissions will be a result of the internal interferences in the mobile phone. Moreover higher operating frequencies will be required to improve the quality of these functionalities, something that will make it more difficult to control these interferences. Internal or external sources of electromagnetic interference can degrade the performance of sensitive analog/digital circuits inside the mobile phone. Moreover the electronic device must satisfy a host of global regulations that limit it’s susceptibility to these interferences, as well as the interference emitted by the device itself. Therefore designing a new electronic device to perform new and exciting functions will not be a pleasant task if it can not meet certain specifications and function as required to adhere to certain global regulations. This thesis project investigates the sources of interference inside a mobile phone; mainly the electromagnetic interferences and its effect on the radio transceiver focusing on the GSM receiver sensitivity. This report is a result of intensive research, an investigation of possible sources of interference, also actual measurements were performed; RSSI, OTA and sniffing measurements; to identify the physical sources of interferences, and their effect on the receiver sensitivity. Finally solutions were recommended and implemented to suppress the interferences due to different sources, mainly through filtering, shielding or proper grounding of signals and components/subsystems in the mobile phone.

En raison de l'évolution technologique, l'analyse de l'intégrité du signal est devenue de plus en plus critique dans la conception des systèmes électroniques. Plusieurs méthodes d'analyse ont été proposées et sont utilisées. Cependant, l'hétérogénéité croissante des systèmes et la réduction du temps de mise sur le marché des applications font que les concepteurs ont besoin de nouvelles méthodes travaillant à haut niveau d'abstraction, afin qu'elles puissent être intégrées facilement à un modèle au niveau système de l'application, et ainsi analyser l'intégrité du signal au plus tôt dans le cycle de conception. Dans cette thèse, nous proposons une méthode basée sur deux types de blocs complémentaires, nommés blocs fonctionnels et blocs non-fonctionnels, décrits à l'aide d'un même langage (C/C++ et SystemC/SystemC-AMS), et donc aisément simulables dans un unique environnement. Les blocs fonctionnels servent à modéliser les comportements idéaux du système. Les comportements non-idéaux, engendrés par les problèmes d'intégrité du signal, sont modélisés dans les blocs non-fonctionnels à l'aide de réseaux de neurones. Pour valider notre méthodologie, deux applications autour des bus I2C et USB 3.0 ont été modélisées. Les résultats de simulations démontrent la faisabilité de notre méthodologie. En la comparant à des modèles de référence, notre méthode permet de réduire de façon remarquable le temps de simulation (99% par rapport à un modèle SPICE) et l'écart moyen est d'environ 3%. Notre méthode offre enfin certaines possibilités de flexibilité et de modularité. Dans le futur, cette méthode originale pourra être intégrée au flot de conception de systèmes cyber-physiques. / As a result of continuing growth of electronic technology, signal integrity analysis has now become a more and more critical challenge in the electronic systems design process. To address this issue, designers have introduced several approaches. However, due to the higher heterogeneity of modern applications, along with time-to-market constraints, a new modeling methodology is required to provide the system?s signal integrity performance at a high-level of abstraction. Moreover, it should be easily interoperable with the system?s functional model. The aim of this work is to propose a new modeling methodology for signal integrity analysis that can meet these requirements. Our method is based on the combination of two kinds of blocks, named functional blocks and non-functional blocks. They are built in C/C++ or SystemC/SystemC-AMS, in order to be easily simulated in a single environment. The functional block is used to model the ideal behavior of the system. The non-functional block is used to represent the highly nonlinear and non-ideal behaviors, caused by signal integrity issues. In the non-functional block, neural networks are used to model these non-ideal behaviors. To validate our method, we developed two applications based on I2C and USB 3.0 applications. Our method greatly increases simulation speed (99% faster than a SPICE model), while achieving a relative absolute error around 3%. Finally, our method is a flexible and modular approach since models can easily be parameterized and interoperable. In the future, this original method for high-level modeling of signal integrity could be integrated in the forthcoming design flows of cyber-physical systems.

Les contraintes économiques actuelles amènent les entreprises d'électronique non seulement à innover à un rythme très soutenu mais aussi à réduire le cycle de conception des nouveaux produits. Afin de rester compétitives, ces entreprises doivent proposer régulièrement de nouveaux produits comportant de nouvelles fonctionnalités, ou améliorant les performances des produits de la génération précédente. Les progrès réalisés peuvent être quantifiés par exemple en terme de vitesse de fonctionnement, encombrement, autonomie et consommation d'énergie. La conception des cartes électroniques incluant ces contraintes est alors délicate. En effet, l'intégration de nouvelles fonctions tout comme la miniaturisation des produits entraînent une densification du circuit imprimé. Le nombre de couches utilisé augmente, l'isolement entre les signaux diminue, l'utilisation de circuits intégrés comportant différentes fonctions comme les SOC ou les SIP entraîne une multiplication du nombre de potentiels d'alimentation. L'augmentation des performances des systèmes impliquent une élévation du taux de débits de données circulant au sein du circuit imprimé et par conséquent l'augmentation des fréquences d'horloge et des signaux. Ces contraintes entraînent l'apparition de problèmes de compatibilité électromagnétique, d'intégrité du signal et d'intégrité de puissance. Il est alors nécessaire de limiter les risques de dysfonctionnement de la carte par une maîtrise des phénomènes qui se produisent d'une part par une analyse de dimensionnement précise afin d'éliminer ou de réduire les problèmes au plus tôt dans la phase de conception et d'autre part en effectuant des simulations de validation une fois la carte terminée. Cette thèse proposée par la société Thales Communications and Security en collaboration avec le laboratoire des Systèmes et Applications des Technologies de l'Information et de l’Énergie (SATIE) de l’École Normale Supérieure de Cachan dans le cadre d'une Convention Industrielle de Formation par la REcherche (CIFRE) a pour but le développement d'une méthodologie d'analyse et de conception du réseau du distribution d'énergie de cartes numériques complexes dans le but de garantir leur fonctionnement sans, ou en réduisant le nombre d'itérations de prototypage. L'introduction au contexte, une description du système étudié et des phénomènes physiques régissant son fonctionnement ainsi qu'un état de l'art des techniques d'analyse d'intégrité de puissance constituent le premier chapitre de ce mémoire. La présentation du véhicule de test, support de tous les résultats de mesure, conçu durant la deuxième année de thèse est l'objet du second chapitre. Ce chapitre dénombre et décrit l'ensemble des scenarii et des réalisations créés pour la mesure des phénomènes propres à l'intégrité de puissance et la corrélation de résultats de simulation avec ceux obtenus en mesure. Dans une troisième partie, les techniques de modélisations de chaque élément constituant le réseau de distribution d'énergie sont décrites. Afin de démontrer la validité des modèles utilisés, les résultats de simulation obtenus pour chaque élément ont été confrontés à des résultats de mesure. Le quatrième chapitre présente la méthodologie de conception et d'analyse de la stabilité des alimentations développée suite aux résultats obtenus des différentes techniques de modélisation. Les outils utilisés sont précisément décrits et les résultats de simulation confrontés à ceux de mesure du système complet du véhicule de test. Dans le chapitre 5, l'intérêt de la modélisation des réseaux de distribution d'énergie sera étendu aux études d'intégrité du signal en démontrant comment son inclusion aux simulations permet d'obtenir, lors de la mise en œuvre de co-simulations, des résultats de simulation plus proches de la réalité. Enfin, la dernière partie de ce document synthétise les travaux de la thèse, porte un regard critique et propose quelques perspectives de travaux futurs. / Today's economical context leads electronics and high-tech corporations not only to innovate with a sustained rhythm but also to reduce the design cycle of new products. In order to remain competitive, these corporations must release regularly new products with new functionalities or enhancing performances of the last generation of this product. The enhancement from one generation of the product to the other can be quantified by the speed of execution of a task, the package size or form factor, the battery life and power consumption.The design methodology following these constraints is thus very tough. Indeed, integration of new functionalities as miniaturization of products imply a densification of the printed circuit board. The number of layer in the stack up is increased, isolation between nets is reduced, the use of integrated circuits embedding different functions as SOC or SIP implies a multiplication of the number of voltages. Moreover the increase of circuit performances implies a increasing data rate exchanged between component of the same printed circuit board and occasioning a widening of the reference clock and signal frequency spectrum. These design constraints are the root cause of the apparition of electromagnetic compatibility, signal integrity and power integrity issues. Failure risks must then be limited by fully understanding phenomenon occurring on the board by, on one side, realizing a precise dimensioning pre layout analysis aiming the elimination or reduction of the issues at the beginning of the design cycle, and on the other side, validating the layout by post layout simulation once the printed circuit board routed.This study proposed by Thales Communication and Security in collaboration with public research laboratory SATIE (System and Application of Energy and Information Technologies) of Ecole Normale Supérieure de Cachan within a industrial convention for development through research aims to develop a design methodology for power delivery network of digital printed circuit board with the goal of ensuring good behavior without or by reducing the number of prototypes.The first chapter of this manuscript include an introduction to the context of the study, a precise description of the studied system and the physical phenomenon ruling its behavior, and finally a state of the art of the power integrity technique analysis. A presentation of the test vehicle, designed during the work and support of all measurement results will constitute the focus of second chapter. This chapter presents and describes all the scenarios and implementations created for the observation and measurement of Power Integrity phenomenon and realise measurement-simulation results correlation. In a third part, modeling techniques of each element of the Power Delivery Network are described. The validity of the models is proven by correlating simulation results of each element with measurement results. The fourth chapter presents the analysis and design methodology developed from the results of the different modeling techniques presented in the previous chapter. Simulation tools and their configuration are precisely described and simulation results are compared with measurement results obtained on the test vehicle for the whole system. In the fifth chapter, the interest of power delivery network model will be extended to signal integrity analysis demonstrating how including this model allows to obtain simulation results closer from measurement results by running Signal Integrity Power aware simulation. Finally, the last part of this document synthetizes the work realized and presented in this document, takes a critical look on it and proposes future works and orientations to extend knowledges and understanding of Power Integrity Phenomenon.

The McTronX research group at the North-West University is currently researching self-sensing techniques for Active Magnetic Bearings (AMB). The research is part of an ongoing effort to expand the knowledge base on AMBs in the School of Electrical, Electronic and Computer Engineering to support industries that make use of the technology. The aim of this project is to develop an integrated co-processor based power electronic drive with the emphasis placed on the ability of the co-processor to execute AMB self-sensing algorithms. The two primary techniques for implementing self-sensing in AMBs are state estimation and modulation. This research focuses on hardware development to facilitate the implementation of the modulation method. Self-sensing algorithms require concurrent processing power and speed that are well suited to an architecture that combines a digital signal processor (DSP) and a field programmable gate array (FPGA). A comprehensive review of various power amplifier topologies shows that the pulse width modulation (PWM) switching amplifier is best suited for controlling the voltage and current required to drive the AMB coils. Combining DSPs and power electronics to form an integrated co-processor based power electronic drive requires detail attention to aspects of PCB design, including signal integrity and grounding. A conceptual design is conducted and forms part of the process of compiling a subsystem development specification for the integrated drive, in conjunction with the McTronX Research Group. Component selection criteria, trade-off studies and various circuit simulations serve as the basis for this essential phase of the project. The conceptual design and development specification determines the architecture, functionality and interfaces of the integrated drive. Conceptual designs for the power amplifier, digital controller, electronic supply and mechanical layout of the integrated drive is provided. A detail design is performed for the power amplifier, digital controller and electronic supply. Issues such as component selection, power supply requirements, thermal design, interfacing of the various circuit elements and PCB design are covered in detail. The output of the detail design is a complete set of circuit diagrams for the integrated controller. The integrated drive is interfaced with existing AMB hardware and facilitates the successful implementation of two self-sensing techniques. The hardware performance of the integrated coprocessor based power electronic drive is evaluated by means of measurements taken from this experimental self-sensing setup. The co-processor performance is evaluated in terms of resource usage and execution time and performs satisfactorily in this regard. The integrated co-processor based power electronic drive provided sufficient resources, processing speed and flexibility to accommodate a variety of self-sensing algorithms thus contributing to the research currently underway in the field of AMBs by the McTronX research group at the North-West University. / Thesis (M.Ing. (Electrical Engineering))--North-West University, Potchefstroom Campus, 2009.