ITC/USA 2008 Conference Proceedings / The Forty-Fourth Annual International Telemetering Conference and Technical Exhibition / October 27-30, 2008 / Town and Country Resort & Convention Center, San Diego, California / Unlike communications protocols that are bus-based or multi-drop (e.g., CAIS Bus, Fibre Channel, RS-485), Ethernet relies on a point-to-point connection topology. One reason for this approach is to allow network nodes to negotiate their individual mode of communication with the network, i.e., link speed and duplexity. The goals of this paper are twofold. The first goal is to describe the process of link negotiation between nodes. This will include some of the details of how two physical layer devices establish communication. The second goal is to show how networked data acquisition nodes are physically connected within the overall system.

Wireless network analysis and simulations rely on accurate physical layer models. The increased interest in wireless network design and cross-layer design require an accurate and efficient physical layer model especially when a large number of nodes are to be studied and building the real network is not possible. For analysis of upper layer characteristics, a simplified physical layer model has to be chosen to model the physical layer. In this dissertation, the widely used two-state Markov model is examined and shown to be deficient for low to moderate signal-to-noise ratios. The physical layer statistics are investigated, and the run length distributions of the good and bad frames are demonstrated to be the key statistics for accurate physical layer modeling. A four-state Markov model is proposed for the flat Rayleigh fading channel by approximating the run length distributions with a mixture of exponential distributions. The transition probabilities in the four-state Markov model can be established analytically without having to run extensive physical layer simulations, which are required for the two-state Markov model. Physical layer good and bad run length distributions are compared and it is shown that the four-state Markov model reasonably approximates the run length distributions. Ns2 simulations are performed and the four-state Markov model provides a much more realistic approximation compared to the popular two-state Markov model. Achieving good results with the flat Rayleigh fading channel, the proposed four-state Markov model is applied to a few diversity channels. A coded orthogonal fre- quency division multiplexing (OFDM) system with a frequency selective channel and the Alamouti multiple-input multiple-output system are chosen to verify the accuracy of the four-state Markov model. The network simulation results show that the four-state Markov model approximates the physical layer with diversity channel well whereas the traditional two-state Markov model estimates the network throughput poorly. The success of adapting the four-state Markov model to the diversity channel also shows the flexibility of adapting the four-state Markov model to various channel conditions.

In recent times, there has been an increased focus on the problem of information exchange between two nodes using a relay node. The introduction of physical layer network coding has improved the throughput efficiency of such an exchange. In practice, the reliability of information exchange using this scheme is reduced due to synchronization issues at the relay node. In this thesis, we deal with timing synchronization of the signals received at the relay node. The timing offsets of the signals received at the relay node are computed based on the propagation delays in the transmitted signals. However, due to the random attenuation of signals in a fading channel, the near far problem is inherent in this situation. Hence, we aim to design near far resistant delay estimators for this system. We put forth four algorithms in this regard. In all the algorithms, propagation delay of each signal is estimated using a known preamble sent by the respective node at the beginning of the data packet. In the first algorithm, we carefully construct the preamble of each data packet and apply the MUSIC algorithm to overcome the near far problem. The eigenstructure of the correlation matrix is exploited to estimate propagation delay. Secondly, the idea of interference cancellation is implemented to remove the near far problem and delay is estimated using a correlator. Thirdly, a modified decorrelating technique is presented to negate the near far problem. Using this technique we aim to obtain an estimate of the weak user's delay that is more robust to errors in the strong user's delay estimate. In the last algorithm, pilot signals with desired autocorrelation and cross correlation functions are designed and a sliding correlator is used to estimate delay. Even though this approach is not near far resistant, performance results demonstrate that for the length's of preamble considered, this algorithm performs similar to the other algorithms.

Recent years have been marked by an enormous growth of wireless communication networks and an extensive use of wireless applications. In return, this phenomenal expansion induced more concerns about the privacy and the security of the users. Physical layer security is one of the most promising solutions that were proposed to enhance the security of next generation wireless systems. The fundamental idea behind this technique is to exploit the randomness and the fluctuations of the wireless channel to achieve security without conditional assumptions on the computational capabilities of the eavesdropper. In fact, while these elements have traditionally been associated with signal deterioration, physical layer security uses them to ensure the confidentiality of the users. Nevertheless, these technical virtues rely heavily on perhaps idealistic channel state information assumptions. In that regard, the aim of this thesis is to look at the physical layer security paradigm from the channel uncertainty perspective. In particular, we discuss the ergodic secrecy capacity of different wiretap channels when the transmitter is hampered by the imperfect knowledge of the channel state information (CSI). We consider two prevalent causes of uncertainty for the CSI at transmitter (CSIT); either an error of estimation occurs at the transmitter and he can only base his coding and the transmission strategies on a noisy version of the CSI, or the CSI feedback link has a limited capacity and the legitimate receivers can only inform the transmitter about the quantized CSI. We investigate both the single-user multiple-input multiple-output (MIMO) wiretap channel and the multi-user broadcast wiretap channel. In the latter scenario, we distinguish between two situations: multiple messages transmission and common message transmission. We also discuss the broadcast channel with confidential messages (BCCM) where the transmitter has one common message to be transmitted to two users and one secret message intended to only one of them. In all cases, we show that by appropriately designing the coding and the transmission schemes, a secure communication can still be achieved even with an imperfect knowledge of the CSIT.

This work addresses the problem of detecting devices which are stealthily attached to the computer for logging keystrokes from keyboards. These devices are known as hardware keyloggers (HKL). When an HKL is attached to the keyboard, certain electrical characteristics of the keyboard signal are altered. Based on these characteristics (features), differences have been identified in an accurate assertion was made about the presence of HKL. The characteristics from which the differences were obtained were used to make distributions and compared with distance-measuring methods. An experiment was done to collect data from a number of keyboards and form two distributions (training and test) to perform the comparison. It was possible to detect the presence of HKL in the keyboard with a minimum of 4 to 100 keystrokes. For justifying the stability of the features, the temperature of the surroundings was obtained and the dependence of the features on temperature was obtained. Also, an experiment was done to see whether the keyboards were uniquely affected by the HKLs. This was done without using any training data, i.e., the distribution of features which was used did not come from a known state of the system (either with HKL or not with HKL).

The cognitive radio network (CRN) concept has been proposed as a solution to the growing demand and underutilization of the radio spectrum. To improve the radio spectrum utilization, CRN technology allows the coexistence of licensed and unlicensed systems over the same spectrum. In an underlay spectrum sharing system, secondary users (SUs) transmit simultaneously with the primary users (PUs) in the same frequency band given that the interference caused by the SU to the PU remains below a tolerable interference limit. Besides the transmission power limitation, a secondary network is subject to distinct channel impairments such as fading and interference from the primary transmissions. Also, CRNs face new security threats and challenges due to their unique cognitive characteristics.This thesis analyzes the performance of underlay CRNs and underlay cognitive relay networks under spectrum sharing constraints and security constraints. Distinct SU transmit power policies are obtained considering various interference constraints such as PU outage constraint or PU peak interference power constraint. The thesis is divided into an introduction and two research parts based on peer-reviewed publications. The introduction provides an overview of radio spectrum management, basic concepts of CRNs, and physical layer security. In the first research part, we study the performance of underlay CRNs with emphasis on a multiuser environment.In Part I-A, we consider a secondary network with delay-tolerant applications and analyze the ergodic capacity. Part I-B analyzes the secondary outage capacity which characterises the maximum data rate that can be achieved over a channel for a given outage probability. In Part I-C, we consider a secondary network with delay constrained applications, and derive expressions of the outage probability and delay-limited throughput. Part I-D presents a queueing model that provides an analytical tool to evaluate the secondary packet-level performance with multiple classes of traffic considering general interarrival and service time distributions. Analytical expressions of the SU average packet transmission time, waiting time in the queue, andtime spent in the system are provided.In the second research part, we analyze the physical layer security for underlay CRNs and underlay cognitive relay networks. Analytical expressions of the probability of non-zero secrecy capacity and secrecy outage probability are derived.Part II-A considers a single hop underlay CRN in the presence of multiple eavesdroppers (EAVs) and multiple SU-Rxs. In Part II-B, an underlay cognitive relay network in the presence of multiple secondary relays and multiple EAVs is studied.Numerical examples illustrate that it is possible to exploit the physical layer characteristics to achieve both security and quality of service in CRNs while satisfying spectrum sharing constraints.

<p>This thesis examines the possibility of designing a fully integrated and switched testing environment for a test laboratory which conducts automated testing. Execution of tests in this environment will make it possible to manage all test objects without requiring any manual intervention resulting in efficient utilization of machine hours and test objects. The thesis explores the concepts and requirements for designing such an environment. It also describes the methods to implement the environment. The result of the thesis work shows that it is possible to design and implement a fully integrated and switched testing environment which can reduce the lead time for delivery by a substantial amount along with a more efficient utilization of machine hours and resources. The exact information related to the instruments, devices under testing and tools are removed by the author according to NDA.</p>

The use of wireless networks has grown significantly in contemporary times, and continues to develop further. The broadcast nature of wireless communications, however, makes them particularly vulnerable to eavesdropping. Unlike traditional solutions, which usually handle security at the application layer, the primary concern of this dissertation is to analyze and develop solutions based on coding techniques at the physical-layer. First, in chapter $2$, we consider a scenario where a source node wishes to broadcast two confidential messages to two receivers, while a wire-tapper also receives the transmitted signal. This model is motivated by wireless communications, where individual secure messages are broadcast over open media and can be received by any illegitimate receiver. The secrecy level is measured by the equivocation rate at the eavesdropper. We first study the general (non-degraded) broadcast channel with an eavesdropper, and present an inner bound on the secrecy capacity region for this model. This inner bound is based on a combination of random binning, and the Gelfand-Pinsker binning. We further study the situation in which the channels are degraded. For the degraded broadcast channel with an eavesdropper, we present the secrecy capacity region. Our achievable coding scheme is based on Cover's superposition scheme and random binning. We refer to this scheme as the Secret Superposition Scheme. Our converse proof is based on a combination of the converse proof of the conventional degraded broadcast channel and Csiszar Lemma. We then assume that the channels are Additive White Gaussian Noise and show that the Secret Superposition Scheme with Gaussian codebook is optimal. The converse proof is based on Costa's entropy power inequality. Finally, we use a broadcast strategy for the slowly fading wire-tap channel when only the eavesdropper's channel is fixed and known at the transmitter. We derive the optimum power allocation for the coding layers, which maximizes the total average rate. Second, in chapter $3$ , we consider the Multiple-Input-Multiple-Output (MIMO) scenario of a broadcast channel where a wiretapper also receives the transmitted signal via another MIMO channel. First, we assume that the channels are degraded and the wiretapper has the worst channel. We establish the capacity region of this scenario. Our achievability scheme is the Secret Superposition Coding. For the outerbound, we use notion of the enhanced channels to show that the secret superposition of Gaussian codes is optimal. We show that we only need to enhance the channels of the legitimate receivers, and the channel of the eavesdropper remains unchanged. We then extend the result of the degraded case to a non-degraded case. We show that the secret superposition of Gaussian codes, along with successive decoding, cannot work when the channels are not degraded. We develop a Secret Dirty Paper Coding scheme and show that it is optimal for this channel. We then present a corollary generalizing the capacity region of the two receivers case to the case of multiple receivers. Finally, we investigate a scenario which frequently occurs in the practice of wireless networks. In this scenario, the transmitter and the eavesdropper have multiple antennae, while both intended receivers have a single antenna (representing resource limited mobile units). We characterize the secrecy capacity region in terms of generalized eigenvalues of the receivers' channels and the eavesdropper's channel. We refer to this configuration as the MISOME case. We then present a corollary generalizing the results of the two receivers case to multiple receivers. In the high SNR regime, we show that the capacity region is a convex closure of rectangular regions. Finally, in chapter $4$, we consider a $K$-user secure Gaussian Multiple-Access-Channel with an external eavesdropper. We establish an achievable rate region for the secure discrete memoryless MAC. Thereafter, we prove the secrecy sum capacity of the degraded Gaussian MIMO MAC using Gaussian codebooks. For the non-degraded Gaussian MIMO MAC, we propose an algorithm inspired by the interference alignment technique to achieve the largest possible total Secure-Degrees-of-Freedom . When all the terminals are equipped with a single antenna, Gaussian codebooks have shown to be inefficient in providing a positive S-DoF. Instead, we propose a novel secure coding scheme to achieve a positive S-DoF in the single antenna MAC. This scheme converts the single-antenna system into a multiple-dimension system with fractional dimensions. The achievability scheme is based on the alignment of signals into a small sub-space at the eavesdropper, and the simultaneous separation of the signals at the intended receiver. We use tools from the field of Diophantine Approximation in number theory to analyze the probability of error in the coding scheme. We prove that the total S-DoF of $\frac{K-1}{K}$ can be achieved for almost all channel gains. For the other channel gains, we propose a multi-layer coding scheme to achieve a positive S-DoF. As a function of channel gains, therefore, the achievable S-DoF is discontinued.

With the remarkable progress in microelectronics and low-power semiconductor technologies, Radio Frequency IDentification technology (RFID) has moved from obscurity into mainstream applications, which essentially provides an indispensable foundation to realize ubiquitous computing and machine perception. However, the catching and exclusive characteristics of RFID systems introduce growing security and privacy concerns. To address these issues are particularly challenging for low-cost RFID systems, where tags are extremely constrained in resources, power and cost. The primary reasons are: (1) the security requirements of low-cost RFID systems are even more rigorous due to large operation range and mass deployment; and (2) the passive tags' modest capabilities and the necessity to keep their prices low present a novel problem that goes beyond the well-studied problems of traditional cryptography. This thesis presents our research results on the design and the analysis of security schemes for low-cost RFID systems. Motivated by the recent attention on exploiting physical layer resources in the design of security schemes, we investigate how to solve the eavesdropping, modification and one particular type of relay attacks toward the tag-to-reader communication in passive RFID systems without requiring lightweight ciphers. To this end, we propose a novel physical layer scheme, called Backscatter modulation- and Uncoordinated frequency hopping-assisted Physical Layer Enhancement (BUPLE). The idea behind it is to use the amplitude of the carrier to transmit messages as normal, while to utilize its periodically varied frequency to hide the transmission from the eavesdropper/relayer and to exploit a random sequence modulated to the carrier's phase to defeat malicious modifications. We further improve its eavesdropping resistance through the coding in the physical layer, since BUPLE ensures that the tag-to-eavesdropper channel is strictly noisier than the tag-to-reader channel. Three practical Wiretap Channel Codes (WCCs) for passive tags are then proposed: two of them are constructed from linear error correcting codes, and the other one is constructed from a resilient vector Boolean function. The security and usability of BUPLE in conjunction with WCCs are further confirmed by our proof-of-concept implementation and testing. Eavesdropping the communication between a legitimate reader and a victim tag to obtain raw data is a basic tool for the adversary. However, given the fundamentality of eavesdropping attacks, there are limited prior work investigating its intension and extension for passive RFID systems. To this end, we firstly identified a brand-new attack, working at physical layer, against backscattered RFID communications, called unidirectional active eavesdropping, which defeats the customary impression that eavesdropping is a ``passive" attack. To launch this attack, the adversary transmits an un-modulated carrier (called blank carrier) at a certain frequency while a valid reader and a tag interacts at another frequency channel. Once the tag modulates the amplitude of reader's signal, it causes fluctuations on the blank carrier as well. By carefully examining the amplitude of the backscattered versions of the blank carrier and the reader's carrier, the adversary could intercept the ongoing reader-tag communication with either significantly lower bit error rate or from a significantly greater distance away. Our concept is demonstrated and empirically analyzed towards a popular low-cost RFID system, i.e., EPC Gen2. Although active eavesdropping in general is not trivial to be prohibited, for a particular type of active eavesdropper, namely a greedy proactive eavesdropper, we propose a simple countermeasure without introducing extra cost to current RFID systems. The needs of cryptographic primitives on constraint devices keep increasing with the growing pervasiveness of these devices. One recent design of the lightweight block cipher is Hummingbird-2. We study its cryptographic strength under a novel technique we developed, called Differential Sequence Attack (DSA), and present the first cryptanalytic result on this cipher. In particular, our full attack can be divided into two phases: preparation phase and key recovery phase. During the key recovery phase, we exploit the fact that the differential sequence for the last round of Hummingbird-2 can be retrieved by querying the full cipher, due to which, the search space of the secret key can be significantly reduced. Thus, by attacking the encryption (decryption resp.) of Hummingbird-2, our algorithm recovers 36-bit (another 28-bit resp.) out of 128-bit key with $2^{68}$ ($2^{60}$ resp.) time complexity if particular differential conditions of the internal states and of the keys at one round can be imposed. Additionally, the rest 64-bit of the key can be exhaustively searched and the overall time complexity is dominated by $2^{68}$. During the preparation phase, by investing $2^{81}$ effort in time, the adversary is able to create the differential conditions required in the key recovery phase with at least 0.5 probability. As an additional effort, we examine the cryptanalytic strength of another lightweight candidate known as A2U2, which is the most lightweight cryptographic primitive proposed so far for low-cost tags. Our chosen-plaintext-attack fully breaks this cipher by recovering its secret key with only querying the encryption twice on the victim tag and solving 32 sparse systems of linear equations (where each system has 56 unknowns and around 28 unknowns can be directly obtained without computation) in the worst case, which takes around 0.16 second on a Thinkpad T410 laptop.

In this dissertation, we propose a circuit design and implementation of physical layer for FlexRay-based automotive communication systems which are expected to be widely used in car electronics for the years to come. To reduce the volume of electrical lines in a car and ensure safe connections, the automotive communication systems are more important than ever. FlexRay systems have been deemed as better than other existing solutions for the complicated in-vehicle networks. A low-voltage differential-signaling-like transmitter is proposed to drive the twisted pair of the FlexRay bus. Furthermore, a three-comparator scheme is used to carry out bit slicing and state recognition at the receiver end. A prototype system as well as a chip implemented by using a typical 0.18 £gm single-poly six-metal CMOS process is reported in this dissertation. Furthermore, an accurate clock signal is required in any control system, especially in the vehicle applications, where the ¡§safety¡¨ is the top priority. Because of the TDMA strategy (Time Division Multiple Access) was chosen for the FlexRay communication protocol, the system clock should not be drifting too much. A robust 20 MHz clock generator with process, supply voltage, and temperature compensation and a low-jitter 80 MHz phase-lock loop are proposed in this dissertation to reduce hostile environment effects. Finally, because the ¡§safety¡¨ and ¡§reliability¡¨ are top design requirements in the automobile electronics, we should also focus on the power supply design in the in-car communication networks. Therefore, a high tolerant and high efficiency voltage converter is proposed in this dissertation. By utilizing stacked power MOSFETs, a voltage level converter, a detector and a controller, this design is realized by a typical CMOS process without any thick-oxide device to tolerate input voltage range up to 3 times of the VDD voltage.