This PhD thesis addresses the threat posed to society by sources that can produce high power electromagnetic pulses (HEPM) and be used maliciously to disturb or damage electronic equipment. The vulnerability from intentional electromagnetic interference (IEMI) has increased in the recent decades due to the widespread dependence of the civil society on sensitive electronic systems and proliferation of radiation sources. As the characteristics of the disturbances associated with IEMI often have very high frequency content, the existing mitigation measures and protection components may not be adequate. It was seen that for ultra wideband (UWB) transients low voltage protection components may not work as intended, due to parasitic components that arises from the packaging of the device. The large spatial distribution of many civilian facilities and critical infra-structures (e.g., power generation, communications, train system, etc.) presents many unexpected ports for an attacker as the majority of the parts of these systems are not protected or secure. As the new European Rail Traffic Management System (ERTMS) will utilize wireless communication for communication and control of the trains the vulnerability from different radiating HPEM sources was investigated. Angles of incidence and frequencies that are a threat in a given situation are identified. Due to the possibility of unexpected ports, the propagation of differential mode ultra wideband transients in low voltage power networks, when injected into a power socket of a facility, was studied. The effects on the transient propagation from cable bends, switches and junctions were studied, both in a laboratory setup and in the network of a facility. Also, as modern electronic equipment and systems may not be tested for waveforms and disturbances other than standardized EMC tests, experiments on some common commercial-off-the-shelf (COTS) equipment were performed with non-standard test situation. It was seen that these could easily be disturbed or even permanently damaged. In addition, due to the inherent difficulties with IEMI, a new method for classifying facilities from IEMI is suggested. It is based on available terminology of accessibility (A), susceptibility (S) and consequence (C), but expands these and forms the so called IEMI/ASC-cube.

With the proliferation of various electronic and electrical devices, IEMI has become a critical issue that may severely threaten the modern society. For practical protection considerations, it is crucial to comprehensively evaluate the potential damages resulted by IEMI. The major objective of this thesis is to study the impacts of IEMI on the targeted load in complex networks. More exactly, with respect to certain IEMI, the characteristics of the resulting frequency response on the targeted load are studied, and the effects of network configurations, i.e., the attribute of load impedances, lengths of lines, parameters of disturbance source, location of source and network structures, are also investigated. First, we developed a novel efficient method to solve the frequency response, which is applicable for arbitrary networks. The key idea is decomposing the whole complex network into multiple equivalent units, and performing a recursive approach to efficiently compute the frequency response without losing the precision. Subsequently, we studied the periodicity of the load response in the frequency domain. Starting with a simple network, we derived and verified the period of the frequency response. During the study, the periodicity with respect to load and media was discussed. Furthermore, with respect to five important time-domain norms, i.e., time-domain peak, total signal energy, peak signal power, peak time rate of change, and peak time integral of the pulse, we considered a parameterized ultra-wideband (UWB) transient as the disturbance source, and thoroughly studied its impacts on the targeted load regarding network configurations, which include load impedance, the lengths of lines and parameters of the UWB transient. Finally, we adopted a statistical approach to investigate the receptivity at the targeted load in a network. Via complementary cumulative distribution function, the stochastic IEMI and its effects on the targeted load were studied. Moreover, by statistical approach, we also investigated how the network structure affects the frequency response of the targeted load. The results give suggestions on how to protect the targeted load by varying network structures. / <p>QC 20170922</p>

As technology becomes more prevalent, its application to safety and security in critical systems continues to increase. This leads to an increased dependence on sensors to provide an accurate view of the environment surrounding an application. These sensors can also be exploited by a malicious individual to attack a system and compromise its safety or security. These attacks change the reported value of a sensor so that it doesn't re ect the real situation. The systems in a car can be used as an example of this. Cars can have numerous sensors that measure a variety of things, including the car's distance from an object, if the tires are locking up, or if the gas is low. The use of these sensors makes cars safer and more convenient to use. Using IEMI, an attacker could compromise some of these systems by changing the reported value so that an object appears further away than it actually is or that the tires aren't locking up when they are, possibly causing the car to crash. By doing this, a malicious individual could compromise the safety or security of a car. This work attempts to understand what would be required for a malicious individual to conduct such an attack, thereby allowing for the identification of systems that are vulnerable to such attacks. This understanding would also provide the basis for designing defenses against these attacks, thereby increasing the safety of society at large.

A cyber-physical system (CPS) is a complex integration of hardware and software components to perform well-defined tasks. Up to this point, many software-based attacks targeting the network and computation layers have been reported by the researchers. However, the physical layer attacks that utilize natural phenomena (e.g., electromagnetic waves) to manipulate safety-critic signals such as analog sensor outputs, digital data, and actuation signals have recently taken the attention. The purpose of this dissertation is to detect the weaknesses of cyber-physical systems against low-power Intentional Electromagnetic Interference (IEMI) attacks and provide hardware-level countermeasures. Actuators are irreplaceable components of electronic systems that control the physically moving sections, e.g., servo motors that control robot arms. In Chapter 2, the potential effects of IEMI attacks on actuation control are presented. Pulse Width Modulation (PWM) signal, which is the industry–standard for actuation control, is observed to be vulnerable to IEMI with specific frequency and modulated–waveforms. Additionally, an advanced attacker with limited information about the victim can prevent the actuation, e.g., stop the rotation of a DC or servo motor. For some specific actuator models, the attacker can even take the control of the actuators and consequently the motion of the CPS, e.g., the flight trajectory of a UAV. The attacks are demonstrated on a fixed-wing unmanned aerial vehicle (UAV) during varying flight scenarios, and it is observed that the attacker can block or take control of the flight surfaces (e.g., aileron) which results in a crash of the UAV or a controllable change in its trajectory, respectively. Serial communication protocols such as UART or SPI are widely employed in electronic systems to establish communication between peripherals (e.g., sensors) and controllers. It is observed that an adversary with the reported three-phase attack mechanism can replace the original victim data with the 'desired' false data. In the detection phase, the attacker listens to the EM leakage of the victim system. In the signal processing phase, the exact timing of the victim data is determined from the victim EM leakage, and in the transmission phase, the radiated attack waveform replaces the original data with the 'desired' false data. The attack waveform is a narrowband signal at the victim baud rate, and in a proof–of–concept demonstration, the attacks are observed to be over 98% effective at inducing a desired bit sequence into pseudorandom UART frames. Countermeasures such as twisted cables are discussed and experimentally validated in high-IEMI scenarios. In Chapter 4, a state-of-art electrical vehicle (EV) charger is assessed in IEMI attack scenarios, and it is observed that an attacker can use low–cost RF components to inject false current or voltage sensor readings into the system. The manipulated sensor data results in a drastic increase in the current supplied to the EV which can easily result in physical damage due to thermal runaway of the batteries. The current switches, which control the output current of the EV charger, can be controlled (i.e., turned on) by relatively high–power IEMI, which gives the attacker direct control of the current supplied to the EV. The attacks on UAVs, communication systems, and EV chargers show that additional hardware countermeasures should be added to the state-of-art system design to alleviate the effect of IEMI attacks. The fiber-optic transmission and low-frequency magnetic field shielding can be used to transmit 'significant signals' or PCB-level countermeasures can be utilized which are reported in Chapter 5. / Doctor of Philosophy / The secure operation of an electronic system depends on the integrity of the signals transmitted from/to components like sensors, actuators, and controllers. Adversaries frequently aim to block or manipulate the information carried in sensor and actuation signals to disrupt the operation of the victim system with physical phenomena, e.g., infrared light or acoustic waves. In this dissertation, it is shown that low-power electromagnetic (EM) waves, with specific frequency and form devised for the victim system, can be utilized as an attack tool to disrupt, and, in some scenarios, control the operation of the system; moreover, it is shown that these attacks can be mitigated with hardware-level countermeasures. In Chapter 2, the attacks are applied to electric motors on an unmanned aerial vehicle (UAV), and it is observed that an attacker can block (i.e., crash of the UAV) or control the UAV motion with EM waves. In Chapter 3, it is shown that digital communication systems are not resilient against intentional electromagnetic interference (IEMI), either. Low–power EM waves can be utilized by attackers to replace the data in serial communication systems with a success rate %98 or more. In Chapter 4, the attacks are applied to the sensors and actuators of electric vehicle chargers with low–cost over–the–shelf amplifiers and antennas, and it is shown that EM interference attacks can manipulate the sensor data and boosts the current supplied to the EV, which can result in overheating and fire. To ensure secure electronic system operation, hardware–level defense mechanisms are discussed and validated with analytical solutions, simulations, and experiments.

<p>As the interest in intentional electromagnetic interference (IEMI) increases, so does the need of a suitable antenna which endures those demanding conditions. The ultrawideband (UWB) technology provides an elegant way of generating high-voltage UWB pulses which can be used for IEMI. One UWB antenna, invented solely for the purpose of radiating pulses, is the impulse radiating antenna (IRA). In the course of this master thesis work, a suitable geometry of the IRA is suggested, and modelled, for the high-voltage application of 90 kV.</p>

As the interest in intentional electromagnetic interference (IEMI) increases, so does the need of a suitable antenna which endures those demanding conditions. The ultrawideband (UWB) technology provides an elegant way of generating high-voltage UWB pulses which can be used for IEMI. One UWB antenna, invented solely for the purpose of radiating pulses, is the impulse radiating antenna (IRA). In the course of this master thesis work, a suitable geometry of the IRA is suggested, and modelled, for the high-voltage application of 90 kV.