Aujourd'hui, il y a une augmentation du nombre de normes étant intégré dans des appareils mobiles. Les problèmes principaux sont la durée de vie de la batterie et la taille de l'appareil. L'idée d'un Radio-Logiciel est de pousser le processus de numérisation aussi près que possible de l'antenne. Dans cette thèse, nous présentons la première mise en œuvre d'un récepteur radio-logiciel complet basé sur Sigma-Delta RF passe-bande, y compris un LNA à gain variable (VGLNA), un ADC Sigma-Delta RF sous-échantillonné, un mélangeur bas-conversion RF numérique et un filtre de décimation polyphasé multi-étage multi-taux. Le VGLNA élargit la gamme dynamique du récepteur multi-standard pour atteindre les exigences des trois normes sans fil ciblées. Aussi une architecture mixte, en utilisant à la fois Source-Coupled Logic (SCL) et des circuits CMOS, il est proposé d'optimiser la consommation des circuits RF numériques. Par ailleurs, nous proposons une architecture de filtre en peigne à plusieurs étages avec décomposition polyphase à réduire la consommation d'énergie. Le récepteur est mesuré pour trois normes différentes dans la bande de 2.4 GHz, la bande ISM. Les résultats des mesures montrent que le récepteur atteint 79 dB, 73 dB et 63 dB de plage dynamique pour les normes Bluetooth, ZigBee et WiFi respectivement. Le récepteur complet, mis en œuvre dans le procédé CMOS 130 nm, a une fréquence centrale accordable de 300 MHz et consomme 63 mW sous 1.2 V. Comparé à d'autres récepteurs, le circuit proposé consomme 30% moins d'énergie, la plage dynamique est de 21 dB supérieur, IIP3 est de 6 dB supérieur et le facteur de mérite est de 24 dB supérieur. / Nowadays there is an increase in the number of standards being integrated in mobile devices. The main issues are battery life and the size of the device. The idea of a Software Defined Radio is to push the digitization process as close as possible to the antenna. Having most of the circuit in the digital domain allows it to be reconfigurable thus requiring less area and power consumption. In this thesis, we present the first implementation of a complete SDR receiver based on RF bandpass Sigma-Delta including a Variable-Gain LNA (VGLNA), an RF subsampled Sigma-Delta ADC, an RF digital down-conversion mixer and a polyphase multi-stage multi-rate decimation filter. VGLNA enlarges the dynamic range of the multi-standard receiver to achieve the requirements of the three targeted wireless standards. Also a mixed architecture, using both Source-Coupled Logic (SCL) and CMOS circuits, is proposed to optimize the power consumption of the RF digital circuits. Moreover, we propose a multi-stage comb filter architecture with polyphase decomposition to reduce the power consumption. The receiver is measured for three different standards in the 2.4 GHz ISM-band. Measurement results show that the receiver achieves 79 dB, 73 dB and 63 dB of dynamic range for the Bluetooth, ZigBee and WiFi standards respectively. The complete receiver, implemented in 130 nm CMOS process, has a 300 MHz tunable central frequency and consumes 63 mW under 1.2 V supply. Compared to other SDR receivers, the proposed circuit consumes 30% less power, the DR is 21 dB higher, IIP3 is 6 dB higher and the overall Figure of Merit is 24 dB higher.

This bachelor thesis explores the threat of Stingrays, fake cell towers, to the mobile network. The increasing availability of open-source technology and hardware has made it easier to build Stingrays. Stingrays can threaten the privacy and security of individuals and their devices, making it critical to understand the effectiveness and practicalities of the attack. This study evaluates the feasibility and the practical danger of Stingrays using open-source software and available hardware, filling a gap in research on the subject. First, a literature study was made to understand the mobile network, security vulnerabilities and existing countermeasures to achieve this. Thereon, a Stingray was constructed, and attacks were simulated with different settings and scenarios to determine their practical and effective use. The results show the possibility of Stingray attacks with the mentioned equipment, but underline the need for a more advanced system for real-world attacks. / Denna kandidatuppsats utforskar hotet från Stingrays, falska mobiltorn, på mobilnätet. Den ökande tillgängligheten av öppen-källkod teknologi och hårdvara har gjort det lättare att bygga Stingrays. Stingrays kan hota integriteten och säkerheten av individer och deras enheter, vilket gör det avgörande att förstå effektiviteten och praktikaliteter av attacken. Studiens mål är att utvärdera möjligheten och den praktiska faran med Stingrays genom att använda programvara med öppen källkod och tillgänglig hårdvara, vilket fyller en lucka i forskning inom ämnet. Först gjordes en litteraturstudie för att förstå mobila nätverket, säkerhetssårbarheter och befintliga motåtgärder för att uppnå detta. Därefter konstruerade vi en Stingray och simulerade attacker med olika inställningar och i olika scenarier för att avgöra deras praktiska och effektiva användning. Resultaten visar möjligheten av Stingray-attacker med den nämnda utrustningen men understryker behovet av ett mer advancerat system för verkliga attacker.

No description available.

<p>This thesis explores the usage of machine learning (ML) algorithms and software-defined radio (SDR) hardware for the detection of signal jamming and message injection cyberattacks against unmanned aerial vehicle (UAV) wireless communications. In the first work presented in this thesis, a real-time ML solution for classifying four types of jamming attacks is proposed for implementation with a UAV using an onboard Raspberry Pi computer and HackRF One SDR. Also presented in this thesis is a multioutput multiclass convolutional neural network (CNN) model implemented for the purpose of identifying the direction in which a jamming sample is received from, in addition to detecting and classifying the jamming type. Such jamming types studied herein are barrage, single-tone, successive-pulse, and protocol-aware jamming. The findings of this chapter forms the basis of a reinforcement learning (RL) approach for UAV flightpath modification as the next stage of this research. The final work included in this thesis presents a ML solution for the binary classification of three different message injection attacks against ADS-B communication systems, namely path modification, velocity drift and ghost aircraft injection attacks. The collective results of these individual works demonstrate the viability of artificial-intelligence (AI) based solutions for cybersecurity applications with respect to UAV communications.</p>

This thesis presents a comparison of a GPU implementation of the Conjugate Residual method as a sequence of generic library kernels against implementations ofthe method with custom kernels to expose the performance gains of a keyoptimization strategy, kernel fusion, for memory-bound operations which is to makeefficient reuse of the processed data. For massive MIMO the iterative solver is to be employed at the linear detection stageto overcome the computational bottleneck of the matrix inversion required in theequalization process, which is 𝒪(𝑛3) for direct solvers. A detailed analysis of howone more of the Krylov subspace methods that is feasible for massive MIMO can beimplemented on a GPU as a unified kernel is given. Further, to show that kernel fusion can improve the execution performance not onlywhen the input data is large matrices-vectors as in scientific computing but also inthe case of massive MIMO and possibly similar cases where the input data is a largenumber of small matrices-vectors that must be processed in parallel.In more details, focusing on the small number of iterations required for the solver toachieve a close enough approximation of the exact solution in the case of massiveMIMO, and the case where the number of users matches the size of a warp, twodifferent approaches that allow to fully unroll the algorithm and gradually fuse allthe separate kernels into a single, until reaching a top-down hardcodedimplementation are proposed and tested. Targeting to overcome the algorithms computational burden which is the matrixvector product, further optimization techniques such as two ways to utilize the faston-chip memories, preloading the matrix in shared memory and preloading thevector in shared memory, are tested and proposed to achieve high efficiency andhigh parallelism.

<p>In this work, machine learning (ML) modeling is proposed for the detection and classification of global positioning system (GPS) spoofing in unmanned aerial vehicles (UAVs). Three testing scenarios are implemented in an outdoor yet controlled setup to investigate static and dynamic attacks. In these scenarios, authentic sets of GPS signal features are collected, followed by other sets obtained while the UAV is under spoofing attacks launched with a software-defined radio (SDR) transceiver module. All sets are standardized, analyzed for correlation, and reduced according to feature importance prior to their exploitation in training, validating, and testing different multiclass ML classifiers. Two schemes for the dataset are proposed, location-dependent and location-independent datasets. The location-dependent dataset keeps the location specific features which are latitude, longitude, and altitude. On the other hand, the location-independent dataset excludes these features. The resulting performance evaluation of these classifiers shows a detection rate (DR), misdetection rate (MDR), and false alarm rate (FAR) better than 92%, 13%, and 4%, respectively, together with a sub-millisecond detection time. Hence, the proposed modeling facilitates accurate real-time GPS spoofing detection and classification for UAV applications.</p> <p><br></p> <p>Then, a three-class ML model is implemented on a UAV with a Raspberry Pi processor for classifying the two GPS spoofing attacks (i.e., static, dynamic) in real-time. First, several models are developed and tested utilizing the prepared dataset. Models evaluation is carried out using the DR, F-score, FAR, and MDR, which all showed an acceptable performance. Then, the optimum model is loaded to the onboard processor and tested for real-time detection and classification. Location-dependent applications, such as fixed-route public transportation, are expected to benefit from the methodology presented herein as the longitude, latitude, and altitude features are characterized in the implemented model.</p>

In wireless communication systems, one of the most important resources being focused on all the researchers is spectrum. A cognitive radio (CR) system is one of the efficient ways to access the radio spectrum opportunistically, and efficiently use the available underutilized licensed spectrum. Spectrum utilization can be significantly enhanced by developing more applications with adopting CR technology. CR systems are implemented using a radio technology called software-defined radios (SDR). SDR provides a flexible and cost-effective solution to fulfil the requirements of end users. We can see a lot of innovations in Internet of Things (IoT) and increasing number of smart devices. Hence, a CR system application involving an IoT device is studied in this thesis. Opportunistic spectrum access involves two tasks of CR system: spectrum sensing and dynamic spectrum access. The functioning of the CR system is rest upon the spectrum sensing. There are different spectrum sensing techniques used to detect the spectrum holes and a few of them are discussed here in this thesis. The simplest and easiest to implement energy detection spectrum sensing technique is used here to implement the CR system. Dynamic spectrum access involves different models and strategies to access the spectrum. Amongst the available models, an interweave model is more challenging and is used in this thesis. Interweave model needs effective spectrum sensing before accessing the spectrum opportunistically. The system designed and simulated in this thesis is capable of transmitting an output from an IoT device using USRP and GNU radio through accessing the radio spectrum opportunistically.

The Internet of Things holds great promises for the future. In the smart cities of tomorrow, wireless connectivity of everyday objects is deemed essential in ensuring efficient and sustainable use of vital, yet limited resources such as water, electricity and food. However, radio communication at the required scale does not come easily. Bandwidth is yet another limited resource that must be used efficiently so that wireless infrastructure for different IoT applications can coexist. Keeping up with the digitalization of modern society is difficult for wireless researchers and developers. The Software-Defined Radio (SDR) is a technology that allows swift prototyping and development of wireless systems by moving traditional hardware-based radio building blocks into the software domain. For developers looking to be on the bleeding edge of wireless technology, and thus keep up with the rapid digitalization, the SDR is a must. Many SDR systems consist of a radio peripheral that handles tasks such as amplification, AD/DA-conversion and resampling that are common to all wireless communication systems. The application-specific work is done in software at the baseband or an intermediate frequency by a host PC connected to the peripheral. That may include PHY-related processing such as the use of a specific modulation scheme as well as higher-layer tasks such as switching. While this setup does provide great flexibility and ease-of-use, it is not without its drawbacks. Many communication protocols specify a so-called round-trip time and devices wishing to adhere to the protocol must be able to respond to any transmission within that time. The link between the host and the peripheral is a major cause of latency and limits the use of many software-defined radio systems to proof-of-concept implementations and early prototyping since it prevents the round-trip time from being fulfilled. Overcoming the latency in the link would allow the flexibility of SDRs to be brought into field applications.This thesis aims to offload the link between the host PC and the radio peripheral in a typical SDR system. Selected parts IEEE 802.15.4, a wireless standard designed for IoT applications, were implemented by using unused programmable logic aboard the peripheral as a co-processor in order to reduce the amount of data that gets sent on the link. Frame success rate and round-trip time measurements were made and compared to measurements from a reference design without any co-processing in the radio peripheral. The co-processing greatly reduced traffic on the link while achieving a similar frame success rate as the reference design. In terms of round-trip time, the co-processing actually caused the latency to increase. Furthermore, the measurements from the coprocessing system showed a counter-intuitive behavior where the round-trip time decreased as the rate of the generated test frames increased. This unusual behavior is most likely due to internal buffer mechanisms of the operating system on the host PC. Further investigation is required in order to bring down the response time to a level more suitable for field applications. / Sakernas Internet, The Internet of Things (IoT), utlovar stora saker inom en snar framtid. I morgondagens smarta städer är trådlös uppkoppling av vardagliga ting en viktig komponent för effektiv och hållbar användning av begränsade resurser såsom vatten, elektricitet och mat. Desvärre är radiokommunikation i den skala som krävs en tuff utmaning. Bandbredd är ytterligare en begränsad resurs som måste användas effektivt så att trådlös infrastruktur för olika IoTapplikationer kan samexistera. Att hänga med i takten för det moderna samhällets digitalisering är svårt för forskare och utvecklare inom trådlösa system. Den mjukvarudefinierade radion, Software-Defined Radio (SDR), är en teknik som möjliggör smidig utveckling av trådlösa system. Grunden i tekniken är att flytta traditionella hårdvarubaserade byggblock för radio in i mjukvarudomänen. För utvecklare som vill befinna sig i framkanten för trådlösa system, och på så vis hålla takt med den snabba digitaliseringen, är SDR ett måste. Många SDR system består av en extern radiomodul som hanterar sådant som är gemensamt för de flesta trådlösa system, exempelvis förstärkning, AD/DA-omvandling och omsampling. Applikationsspecifik funktionalitet sköts av mjukvara i basbandet eller på en mellanfrekvens där mjukvaran körs på en PC. Ett SDR-system bestående av en PC med en extern radiomodul ger användaren stor flexibilitet men det har sina brister. Många kommunikationsprotokoll anger en så kallad Round-Trip Time (RTT). Enheter som strävar efter att följa protokollet måste kunna svara på alla meddelanden inom den tiden som angetts som RTT. Länken mellan PC:n och radiomodulen är en stor bidragare till fördröjningar och begränsar användandet av SDR till konceptuella tester och tidiga prototyper efter som fördröjningarna oftar innebär ett brott mot protokollets RTT. Om problemet med fördröjningar kan undvikas skulle SDR kunna användas i fältapplikationer med all den flexibilitet som SDR innebär och därmed bli ett kraftfullt utvecklingsverktyg för forskare och utvecklare inom området.Det här arbetet avser att avlasta länken mellan PC:n och radiomodulen i ett typiskt SDR system. Utvalda delar av IEEE 802.15.4, en standard för trådlös kommunikation inom IoT, implementerades med hjälp av programmerbar logik på USRP:n så att de flesta samplingarna konsumeras innan länken. Antalet framgångsrikt mottagna ramar samt RTT mättes och jämfördes med en referensdesign där samtliga beräkningar hanteras av PC:n. Användandet av den programmerbara logiken ledde till mycket reducerade datamängder på länken utan nämnvärd förändring i antalet framgångsrikt mottagna ramar jämfört med referensdesignen. Dock, vart fördröjningarna i systemet större när den programmerbara logiken användes. Dessutom visade systemet ett oväntat beteende där fördröjningen minskade under när trycket från den trådlösa trafiken ökade. Detta märkliga beteende beror högst troligt på interna buffermekanismer i operativsystemet i PC:n. Fortsatt utredning krävs innan fördröjningarna kan reduceras till en nivå som passar för fältapplikationer.

In this work, the design and application of Polynomial-Based Filters (PBF) for continuously variable Sample Rate Conversion (SRC) is studied. The major contributions of this work are summarized as follows. First, an explicit formula for the Fourier Transform of both a symmetrical and nonsymmetrical PBF impulse response with variable basis function coefficients is derived. In the literature only one explicit formula is given, and that for a symmetrical even length filter with fixed basis function coefficients. The frequency domain optimization of PBFs via linear programming has been proposed in the literature, however, the algorithm was not detailed nor were explicit formulas derived. In this contribution, a minimax optimization procedure is derived for the frequency domain optimization of a PBF with time-domain constraints. Explicit formulas are given for direct input to a linear programming routine. Additionally, accompanying Matlab code implementing this optimization in terms of the derived formulas is given in the appendix. In the literature, it has been pointed out that the frequency response of the Continuous-Time (CT) filter decays as frequency goes to infinity. It has also been observed that when implemented in SRC, the CT filter is sampled resulting in CT frequency response aliasing. Thus, for example, the stopband sidelobes of the Discrete-Time (DT) implementation rise above the CT designed level. Building on these observations, it is shown how the rolloff rate of the frequency response of a PBF can be adjusted by adding continuous derivatives to the impulse response. This is of great advantage, especially when the PBF is used for decimation as the aliasing band attenuation can be made to increase with frequency. It is shown how this technique can be used to dramatically reduce the effect of alias build up in the passband. In addition, it is shown that as the number of continuous derivatives of the PBF increases the resulting DT implementation more closely matches the Continuous-Time (CT) design. When implemented for SRC, samples from a PBF impulse response are computed by evaluating the polynomials using a so-called fractional interval, µ. In the literature, the effect of quantizing µ on the frequency response of the PBF has been studied. Formulas have been derived to determine the number of bits required to keep frequency response distortion below prescribed bounds. Elsewhere, a formula has been given to compute the number of bits required to represent µ to obtain a given SRC accuracy for rational factor SRC. In this contribution, it is shown how these two apparently competing requirements are quite independent. In fact, it is shown that the wordlength required for SRC accuracy need only be kept in the µ generator which is a single accumulator. The output of the µ generator may then be truncated prior to polynomial evaluation. This results in significant computational savings, as polynomial evaluation can require several multiplications and additions. Under the heading of applications, a new Wideband Digital Downconverter (WDDC) for Synthetic Instruments (SI) is introduced. DDCs first tune to a signal's center frequency using a numerically controlled oscillator and mixer, and then zoom-in to the bandwidth of interest using SRC. The SRC is required to produce continuously variable output sample rates from a fixed input sample rate over a large range. Current implementations accomplish this using a pre-filter, an arbitrary factor resampler, and integer decimation filters. In this contribution, the SRC of the WDDC is simplified reducing the computational requirements to a factor of three or more. In addition to this, it is shown how this system can be used to develop a novel computationally efficient FFT-based spectrum analyzer with continuously variable frequency spans. Finally, after giving the theoretical foundation, a real Field Programmable Gate Array (FPGA) implementation of a novel Arbitrary Waveform Generator (AWG) is presented. The new approach uses a fixed Digital-to-Analog Converter (DAC) sample clock in combination with an arbitrary factor interpolator. Waveforms created at any sample rate are interpolated to the fixed DAC sample rate in real-time. As a result, the additional lower performance analog hardware required in current approaches, namely, multiple reconstruction filters and/or additional sample clocks, is avoided. Measured results are given confirming the performance of the system predicted by the theoretical design and simulation.

As wireless protocols become easier to implement, more products come with wireless connectivity. This latest push for wireless connectivity has left a gap in the development of the security and the reliability of some protocols. These wireless protocols can be used in the growing field of IoT where wireless sensors are used to share information throughout a network. IoT is being implemented in homes, agriculture, manufactory, and in the medical field. Disrupting a wireless device from proper communication could potentially result in production loss, security issues, and bodily harm. The 802.15.4/ZigBee protocol is used in low power, low data rate, and low cost wireless applications such as medical devices and home automation devices. This protocol uses CSMA-CA (Carrier Sense Multiple Access w/ Collision Avoidance) which allows for multiple ZigBee devices to transmit simultaneousness and allows for wireless coexistence with the existing protocols at the same frequency band. The CSMA-CA MAC layer seems to introduce an unintentional gap in the reliability of the protocol. By creating a 16-tone signal with center frequencies located in the center of the multiple access channels, all channels will appear to be in use and the ZigBee device will be unable to transmit data. The jamming device will be created using the following hardware implementation. An FPGA connected to a high-speed Digital to Analog Converter will be used to create a digital signal synthesizer device that will create the 16-tone signal. The 16-tone signal will then be mixed up to the 2.4 GHz band, amplified, and radiated using a 2.4 GHz up-converter device. The transmitted jamming signal will cause the ZigBee MAC layer to wait indefinitely for the channel to clear. Since the channel will not clear, the MAC layer will not allow any transmission and the ZigBee devices will not communicate.