RF Integrated Circuits for Energy Autonomous Sensor Nodes.

The exponential growth in the semiconductor industry has enabled computers to pervade our everyday lives, and as we move forward many of these computers will have form factors much smaller than a typical laptop or smartphone. Sensor nodes will soon be deployed ubiquitously, capable of capturing information of their surrounding environment. The next step is to connect all these different nodes together into an entire interconnected system. This “Internet of Things” (IoT) vision has incredible potential to change our lives commercially, societally, and personally. The backbone of IoT is the wireless sensor node, many of which will operate under very rigorous energy constraints with small batteries or no batteries at all. It has been shown that in sensor nodes, radio communication is one of the biggest bottlenecks to ultra-low power design. This research explores ways to reduce energy consumption in radios for wireless sensor networks, allowing them to run off harvested energy, while maintaining qualities that will allow them to function in a real world, multi-user environment. Three different prototypes have been designed demonstrating these techniques. The first is a sensitivity-reduced nanowatt wake-up radio which allows a sensor node to actively listen for packets even when the rest of the node is asleep. CDMA codes and interference rejection reduce the potential for energy-costly false wake-ups. The second prototype is a full transceiver for a body-worn EKG sensor node. This transceiver is designed to have low instantaneous power and is able to receive 802.15.6 Wireless Body Area Network compliant packets. It uses asymmetric communication including a wake-up receiver based on the previous design, UWB transmitter and a communication receiver. The communication receiver has 10 physical channels to avoid interference and demodulates coherent packets which is uncommon for low power radios, but dictated by the 802.15.6 standard. The third prototype is a long range transceiver capable of >1km communication range in the 433MHz band and able to interface with an existing commercial radio. A digitally assisted baseband demodulator was designed which enables the ability to perform bit-level as well as packet-level duty cycling which increases the radio's energy efficiency.PhDElectrical EngineeringUniversity of Michigan, Horace H. Rackham School of Graduate Studieshttp://deepblue.lib.umich.edu/bitstream/2027.42/110432/1/nerobert_1.pd

Facilitating Flexible Link Layer Protocols for Future Wireless Communication Systems

This dissertation addresses the problem of designing link layer protocols which are flexible enough to accommodate the demands offuture wireless communication systems (FWCS).We show that entire link layer protocols with diverse requirements and responsibilities can be composed out of reconfigurable and reusable components.We demonstrate this by designing and implementinga novel concept termed Flexible Link Layer (FLL) architecture.Through extensive simulations and practical experiments, we evaluate a prototype of the suggested architecture in both fixed-spectrumand dynamic spectrum access (DSA) networks. FWCS are expected to overcome diverse challenges including the continual growthin traffic volume and number of connected devices.Furthermore, they are envisioned to support a widerange of new application requirements and operating conditions.Technology trends, including smart homes, communicating machines, and vehicularnetworks, will not only grow on a scale that once was unimaginable, they will also become the predominant communication paradigm, eventually surpassing today's human-produced network traffic. In order for this to become reality, today's systems have to evolve in many ways.They have to exploit allocated resources in a more efficient and energy-conscious manner.In addition to that, new methods for spectrum access and resource sharingneed to be deployed.Having the diversification of applications and network conditions in mind, flexibility at all layers of a communication system is of paramount importance in order to meet the desired goals. However, traditional communication systems are often designed with specific and distinct applications in mind. Therefore, system designers can tailor communication systems according to fixedrequirements and operating conditions, often resulting in highly optimized but inflexible systems.Among the core problems of such design is the mix of data transfer and management aspects.Such a combination of concerns clearly hinders the reuse and extension of existing protocols. To overcome this problem, the key idea explored in this dissertation is a component-based design to facilitate the development of more flexible and versatile link layer protocols.Specifically, the FLL architecture, suggested in this dissertation, employs a generic, reconfigurable data transfer protocol around which one or more complementary protocols, called link layer applications, are responsible for management-related aspects of the layer. To demonstrate the feasibility of the proposed approach, we have designed andimplemented a prototype of the FLL architecture on the basis ofa reconfigurable software defined radio (SDR) testbed.Employing the SDR prototype as well as computer simulations, thisdissertation describes various experiments used to examine a range of link layerprotocols for both fixed-spectrum and DSA networks. This dissertation firstly outlines the challenges faced by FWCSand describes DSA as a possible technology component for their construction.It then specifies the requirements for future DSA systemsthat provide the basis for our further considerations.We then review the background on link layer protocols, surveyrelated work on the construction of flexible protocol frameworks,and compare a range of actual link layer protocols and algorithms.Based on the results of this analysis, we design, implement, and evaluatethe FLL architecture and a selection of actual link layer protocols. We believe the findings of this dissertation add substantively to the existing literature on link layer protocol design and are valuable for theoreticians and experimentalists alike

Doctor of Philosophy

dissertationThe wireless radio channel is typically thought of as a means to move information from transmitter to receiver, but the radio channel can also be used to detect changes in the environment of the radio link. This dissertation is focused on the measurements we can make at the physical layer of wireless networks, and how we can use those measurements to obtain information about the locations of transceivers and people. The first contribution of this work is the development and testing of an open source, 802.11b sounder and receiver, which is capable of decoding packets and using them to estimate the channel impulse response (CIR) of a radio link at a fraction of the cost of traditional channel sounders. This receiver improves on previous implementations by performing optimized matched filtering on the field-programmable gate array (FPGA) of the Universal Software Radio Peripheral (USRP), allowing it to operate at full bandwidth. The second contribution of this work is an extensive experimental evaluation of a technology called location distinction, i.e., the ability to identify changes in radio transceiver position, via CIR measurements. Previous location distinction work has focused on single-input single-output (SISO) radio links. We extend this work to the context of multiple-input multiple-output (MIMO) radio links, and study system design trade-offs which affect the performance of MIMO location distinction. The third contribution of this work introduces the "exploiting radio windows" (ERW) attack, in which an attacker outside of a building surreptitiously uses the transmissions of an otherwise secure wireless network inside of the building to infer location information about people inside the building. This is possible because of the relative transparency of external walls to radio transmissions. The final contribution of this dissertation is a feasibility study for building a rapidly deployable radio tomographic (RTI) imaging system for special operations forces (SOF). We show that it is possible to obtain valuable tracking information using as few as 10 radios over a single floor of a typical suburban home, even without precise radio location measurements

TPMS Receiver Hacking

In 2005 the Department of Transportation made it mandatory for all new cars to be installed with a tire pressure monitoring system (TPMS). The TPMS system typically consists of transmitters in the tires and a receiver within the car. This project was the first in a series of projects designed to investigate the security vulnerabilities between a tire pressure monitoring sensor and the receiver within the car. Through controlled, distance, and roadside testing a generic receiver was designed using the universal software defined radio (USRP) and MATLAB for all TPMS variants

SDR-LoRa, an open-source, full-fledged implementation of LoRa on Software-Defined-Radios: Design and potential exploitation

In this paper, we present SDR-LoRa, an open-source, full-fledged Software Defined Radio (SDR) implementation of a LoRa transceiver. First, we conduct a thorough analysis of the LoRa physical layer (PHY) functionalities, encompassing processes such as packet modulation, demodulation, and preamble detection. Then, we leverage on this analysis to create a pioneering SDR-based LoRa PHY implementation. Accordingly, we thoroughly describe all the implementation details. Moreover, we illustrate how SDR-LoRa can help boost research on the LoRa protocol by presenting three exemplary key applications that can be built on top of our implementation, namely fine-grained localization, interference cancellation, and enhanced link reliability. To validate SDR-LoRa and its applications, we test it on two different platforms: (i) a physical setup involving USRP radios and off-the-shelf commercial devices, and (ii) the Colosseum wireless channel emulator. Our experimental findings reveal that (i) SDR-LoRa performs comparably to conventional commercial LoRa systems, and (ii) all the aforementioned applications can be successfully implemented on top of SDR-LoRa with remarkable results. The complete details of the SDR-LoRa implementation code have been publicly shared online, together with a plug-and-play Colosseum container

Learning and identification of wireless network internode dynamics using software defined radio

The recently developed paradigm of cognitive radio wireless devices has been developed with the goal of achieving more customizable and efficient spectrum utilization of commonly used wireless frequency bands. The primary focus of such spectrum utilization approaches has been to discern occupancies and vacancies over portions of the wireless spectrum without necessarily identifying how specific radio frequency (RF) devices contribute to the temporal dynamics of these occupancy patterns within the spectrum. The aim of this thesis is to utilize a hidden semi-Markov model (HSMM) statistical analysis to infer the individual occupancy patterns of specific users from wireless RF observation traces. It is proposed that the HSMM approach for RF device characterization over time may act as a first step towards performing a more complete characterization of the RF spectrum in which the inferred traffic patterns may demonstrate the coexistence of multiple networks, the specific devices comprising each distinct network, and the level of mutual interference between the component networks resultant from such coexistence. The first main portion of this thesis is the development of a Bayesian learning framework for HSMM characterization of the wireless RF observations, with occupancy periods and each individual RF device being classified as distinct states in the HSMM. The traditional HSMM approach is supplemented with the concept of the hierarchical Dirichlet random process to achieve a minimal number of states needed to effectively capture each distinct device, without the need for strong a priori assumptions regarding the number of devices seen in the RF trace prior to computational analysis. The second portion of the thesis utilizes user-programmed cognitive radios to construct a real-time software-defined RF network environment emulation testbed to assess the accuracy of the HSMM characterization. Finally, the HSMM algorithm is tested on wireless devices operating under an actual implementation of the ubiquitous IEEE 802.11 wireless standard