Global Navigation Satellite Systems (GNSS) like GPS have become part of everyday life. From navigation as was its original intent to highly accurate and relatively cheap timekeeping and making games out of walking outside.
However, tools to test GNSS-enabled systems can be expensive, especially for non-GPS systems or they bypass the actual GNSS receiver.
Therefore I made a free and open-source GNSS simulator framework and implemented five different GNSS signals on top of it (GPS L1 C/A, GLONASS L1, Galileo E1, Beidou B1I, and IRNSS L5). This thesis document will explain how the framework works and evaluate the five simulators.
Because easy access to GNSS simulators means more people can abuse it I will also cover spoofing and spoofing detection.
While spoofing can be used for nefarious purposes I show how it can potentially be used to protect from GNSS guided drones.

The demand for embedded devices, such as intelligent sensors, smartwatches, medical implants, and computing chips in cars, has been rising steadily in the past and is expected to continue for the coming decade. Their high and increasing degree of connectivity expands the attack surface for attackers, which is exaggerated by their physical accessibility. This makes them particularly vulnerable to invasive attacks. Compounding these risks is the growing reliance on third-party software. An example of such risks can be seen in the recent incident where a software solution from the company CrowdStrike, integrated into the Windows Operating System (OS), caused a major global outage that left many airports, hospitals, banks, and government departments worldwide unable to operate. The Guardian reports that this incident affected 8.5 million Windows machines and resulted in an estimated financial loss of 5.4 billion USD for companies in the US alone. Similar risks exist for OSs for embedded devices. These devices do not run general-purpose OSs like Windows, however, in their very nature they are similar. They provide a runtime abstraction for user processes and manage resources for which the OS requires higher privileges. FreeRTOS is a popular embedded OS for resource-constrained devices, also offering real-time capabilities, making it a Real-Time Operating System (RTOS). Meanwhile, RISC-V, a relatively new Instruction Set Architecture (ISA), is gaining popularity due to its open-source philosophy. However, despite the increasing popularity of RISC-V and the widespread use of FreeRTOS, there is a lack of comprehensive security support for FreeRTOS on RISC-V platforms.

This thesis addresses the lack of security for malicious third-party applications and presents a novel FreeRTOS implementation method on a RISC-V embedded system platform. The security of FreeRTOS is enhanced by leveraging the Physical Memory Protection (PMP) feature of RISC-V. The primary contribution involves the FreeRTOS kernel dynamically manage the access rights using PMP, preventing malicious tasks from causing harm. This dramatically improves the security, because the flat memory structure inherent to FreeRTOS is prone to being readily exploited and compromised by attackers. Further, an overview of known attacks on embedded systems and countermeasures is presented, a subset of which are explored in more detail. A secure platform is proposed that aims to demonstrate a holistic approach to integrate the FreeRTOS with PMP support into a System-on-Chip (SoC). Then, the FreeRTOS platform is augmented by a secure boot procedure and a memory encryption unit that ensures the integrity and confidentiality of the external memory. This encryption unit uses the Prince encryption scheme and is elegantly combined with RISC-V’s PMP functionality. Unused bits in the PMP configuration registers are used to control the encryption selectively for single PMP memory regions. Moreover, an address-based encryption mode for this unit is proposed that addresses the weakness that plaintext data is always encrypted to the same ciphertext. This is problematic because an attacker could analyze the structure of the ciphertext and copy the ciphertext of memory cells with known plaintext. The effectiveness of the PMP task isolation is demonstrated by simulating malicious tasks that try to access specific data addresses in the memory of other tasks and the kernel. This setup imitates real-life attack scenarios, assuming the addresses have been exposed to the malicious task through reverse-engineering of the application code. The secure boot is validated by implementing the design on an FPGA and manually tampering the memory, resulting in a failed boot-up. Additionally, the impact of the PMP integration on the real-time capabilities of FreeRTOS is investigated more thoroughly by evaluating real-time metrics: task switch time, access time for shared resources using a mutex (a software construct to avoid access collisions), and dynamic memory allocation. The system design incorporates a RISC-V core named CV32E40S, an open-source core from OpenHW Group. All the security enhancements were run on hardware with a varying number of active PMP regions. In the worst-case scenario, using 64 PMP regions results in a 2.1x increase in task switch time, a 2.4x increase in the time to access shared resources using a mutex, and a 1.7x increase in memory allocation time. The area of the CV32E40S, measured in Look-Up-Tables (LUTs), increases with the number of regions: a 2.2x increase for 16 regions, 3.4x for 32 regions, and 5.4x for 64 regions, compared to the core configuration without PMP. Despite these increases, it remains within an acceptable range relative to the total area of the SoC including cache memory and peripherals.

As the Moon reemerges as a renewed fronteer in space exploration, the Lunar Zebro project proposes to deploy a swarm of miniature rovers for efficient lunar surface exploration. One of their goals is to leverage recent advancements in deep learning and AI-accelerating hardware, in conjunction with Commercial Off-The-Shelf technologies and the NewSpace movement, to enhance the autonomous capabilities of these nano-rovers. This research focuses on integrating AI-accelerating hardware within the stringent Size, Weight, and Power (SWaP) constraints of these lunar rovers. It evaluates the suitability of various hardware configurations. A Convolutional Neural Network for hazard detection was trained and tested on different devices and scenarios. Finally, the operational cycle of the rover was simulated and the constrained resources were tracked for the different design options.

Over development of the past three decades, control systems in automobiles have undergone a significant transformation, shifting from mechanical devices to a multitude of interconnected computers that oversee sensors, drivers, and passengers. In today's modern vehicles, 50-80 independent computers, commonly referred to as Electronic Control Units (ECUs), form complex in-vehicle networks to facilitate communication among themselves. A widely adopted communication protocol in modern in-vehicle networks is the Controller Area Network (CAN). Security wasn't considered when the CAN protocol was designed in the mid-1980s, leaving it susceptible to cyber-attacks. In 2015, Charlie Miller and Chris Valasek successfully demonstrated a remote attack against a Jeep Cherokee, compromising critical components such as the steering wheel and braking system. This event prompted significant concern about the security of CAN networks in both academic and industrial circles.


In reaction to these challenges, researchers have formulated a variety of attacks targeting the CAN bus, encompassing Denial-of-Service (DoS) attacks, spoofing attacks, and more. Furthermore, significant efforts have been directed towards enhancing the security of CAN networks. These endeavors encompass the design of security architectures and intrusion detection systems. NXP developed the TJA115x secure CAN transceiver family, which offers protection against various types of attacks for Classical CAN and CAN FD communication without resorting to cryptography. Nonetheless, all existing researches are directed towards the Classical CAN and CAN FD protocols, leaving a notable gap in the exploration of security aspects concerning the latest CAN XL network.

This thesis focuses on enhancing the design of the TJA115x secure transceiver to support CAN XL protocol. The research comprises two main aspects: flooding detection and flooding prevention. To achieve flooding detection, a leaky buckets tree is introduced, enabling differentiation between normal frames and flooding frames, along with dynamic traffic control for each frame type. Additionally, the leaky bucket parameters are derived in formulaic form. For flooding prevention, two distinct strategies are devised to prevent flooding frames from dominating the bus. These strategies are compared in terms of throughput, latency, and availability. Finally, the proposed secure CAN XL transceiver is validated through software simulations and hardware experiments. The results demonstrate the exceptional performance of the CAN XL secure transceiver in blocking flooding attacks and safeguarding communications. These accomplishments are achieved with minimal memory overhead, and notably, without introducing any additional latency or bandwidth demands.

Demand for smart, Internet-connected devices and other electronics has increased dramatically in recent years. This increase in demand for technological devices, driven by advancements in Artificial Intelligence (AI), the Internet of Things (IoT), and autonomous systems, has exposed the digital system to potential security threats. As more devices access personal data, data protection and security have become increasingly challenging. The rise in security incidents, such as the MOVEit attack and the NeBu data breach, highlights the urgency for better security systems. Malicious attacks can manifest at different levels, ranging from the network and system to the circuit level. Power side-channel attacks, which exploit variations in power consumption to obtain sensitive information, have proven effective against modern cryptographic implementations. In response to the threats posed by such attacks, researchers have diligently focused on devising countermeasures. Current research efforts focus on developing these countermeasures, yet evaluation only happens in pre-silicon scenarios in simulation or on an FPGA. Evaluating the effectiveness of those countermeasures on real Systems on Chips (SoCs) is challenging.

The thesis introduces a novel framework to bridge the gap between pre and post-silicon power side channel assessment, allowing accurate characterization and comparison of cryptographic designs before and after manufacturing. This approach aims to provide comprehensive profiling and ensure the security of future cryptographic designs. The suggested platform was verified by employing a series of different versions of the Advanced Encryption Standard (AES) algorithm that were integrated into a full System on Chip (SoC). As a metric for determining whether or not the proposed platform is suitable, attacability is being measured via correlation power analysis (CPA). Pre-silicon enables the evaluation of each AES core in isolation from the other components of the system, hence having noise-free power traces. However, in post-silicon, in order to provide a correct analysis, the platform incorporates a wide variety of features, such as automation execution, trace alignment, and noise reduction of power traces. In order to improve the automated execution process, a Left Feedback Shift Register (LFSR) has been devised to introduce a level of randomness in the encrypted messages and keys used by the cryptographic engine. In the context of trace alignment, the platform has been specifically built to include a trigger signal that serves the purpose of identifying the start/stop of the execution. Clock-gating is used as a means of mitigating noise by freezing the operation of additional cores, hence preventing the generation of extraneous auditory disturbances. In addition, the suggested approach is specifically tailored for the manufacturing process using the 40nm TSMC technology, including a simulation evaluation. Finally, to facilitate power measurements on the platform, custom printed circuit boards(PCB's) and a software backend were designed to support real life measurements and the final correlation of the pre and post-silicon power side channel behaviour. The results of our study suggest that both Pre-silicon (i.e., standalone evaluation) and Post-silicon (i.e., system evaluation) provide similar levels of accuracy in assessing attackability.

3D NAND memory devices are intrinsically very cost sensitive, implying that their size, and hence logic area must be limited in order to acquire a chip which is able to conquer the competitive market price. Market forecasts of upcoming NAND products predict Input/Output (I/O) speed increase well beyond 2 Gb/s that is the current industry standard. I/O bandwidth strongly correlates with the device technology used for logic and the current state-of-the-art planar devices are predicted to reach their maximum capabilities in the near future. Use of FinFET transistor is expected to substantially enhance I/O area-performance of 3D NAND memory logic, alleviating area restriction severity and providing a foundation for future periphery generations to come.

In this thesis, a 3D NAND compatible I/O able to achieve 8 Gb/s throughput has been developed using simulation of thermally stable Imec in-house developed 14 nm FinFET technology equivalent. To validate throughput quality, industry defined eye diagram standards are used. To determine area savings provided by utilizing FinFET devices, FinFET active transmitter area is benchmarked against 45 nm planar device setup achieving the same 8 Gb/s data rate performance. To ensure an unbiased comparison, two signaling topologies are used - single ended signaling (SES) and differential signaling (DS). To extend analysis, sensitivity of the design against various parameters such as data rate, voltage and temperature is explored.

It is concluded, that active area of FinFET driver is several times lower than that of similar planar transmitter (same power and throughput) for both SES and DS. Additionally, suitable use cases of DS and SES have been evaluated depending on environmental conditions investigated during sensitivity analysis. All in all, this research provides a baseline for planar-to-FinFET scaling in I/O system and guidelines in choosing signaling topology appropriately, depending on system constraints.

There is an ever-increasing demand for high data transfer rates. Laser satellite communication is a promising technology which offers high data rates and more secure links than the mature radio frequency (RF) communication. To make a laser communication terminal market viable it must be low size, weight and power (SWaP). The telescope drives the volume of the terminal. Making the telescope more compact with high magnification imposes stricter tolerances. A solution to alleviate these tolerances is to use a refocusing mechanism (RFM) to align the telescope in space after launch. In this project, a refocusing system is designed. This comprises of making system level choices like where to place the mechanism, how to close the loop and how to use the onboard detectors. All these choices lead to the requirements for the RFM. Further, a mechanism is designed that fulfills the requirements. In addition, mechanical and thermal FEM simulations are carried out to show that the RFM survives launch and can work in the challenging thermal environment.

Scalable universal quantum computers require classical control hardware, physically close to the quantum devices at cryogenic temperatures. Such classical controllers need digital memory for various applications, ranging from high-speed queues to high-speed and low-speed lookup tables and working memory. The power consumption of the memories should be within the available cooling power at these temperatures. To obtain the best memory design with the lowest power consumption, cryogenic-CMOS characteristics need to be taken into account during design. This thesis aims to develop a model that can be used to find the optimal memory cell design for each application, while taking area, latency, error rate, and power constraints into account. A model is developed to estimate the error rate and power consumption of a memory core for four cell designs, namely three embedded dynamic cell designs and one static cell design, over a range of applications in terms of memory operation frequency and read/write operation ratio. The model is constructed using room temperature and 233 K simulation data of individual cells and peripherals from a TSMC 40 nm technology. To estimate the error rate and power consumption at 4.2 K, the model is extended with empirical cryogenic-CMOS characteristics, such as an increase in threshold voltage and a steeper subthreshold slope, since good device models at this temperature are not available. To verify and improve the memory model, a test chip in TSMC 40 nm technology is designed, which includes eight fully-custom memories with two threshold-variations of each of the four cell designs to mitigate the cryogenic-CMOS threshold voltage increase. These memories are connected to an on-chip programmable microcontroller through a bus which enables flexible and high-speed testing without the need for high-speed I/O. This chip design is taped out and will be measured to verify and refine the model. At room temperature, the static cell design outperforms the dynamic cells in all memory applications with less than 10⁷ operations per second. However, at cryogenic temperatures, the embedded dynamic cell designs become feasible for applications with more than 300 operations per second, due to the significantly reduced refresh rate. The best embedded dynamic cell design depends on the read/write memory operation ratio required by the application. After verification and improvement of the memory model based on the measurement results from the test chip, this model can be used to find the best cell design for a given application based on its operation frequency and read/write operation ratio. Apart from comparing the performance of a single memory design at room temperature and 4.2 K, this work also allows for direct comparison between the different memory cells designs, designed with the same technology, architecture, peripherals, and by the same design rules. Since only a single architecture is used with a single design for each of the peripherals, further optimisation is required for a cryogenic-optimised full memory design.

Absence seizures have a real-life impact on epileptic subjects, as day-to-day tasks can by suddenly interrupted making for dangerous situations. Though a lot of work has been done on seizure detection, to limit the impact on epileptic patients, the true necessity lies in timely prediction of seizures before they manifest. Various attempts have been made using conventional algorithms to accurately predict seizures however, so far, results are not that encouraging. In this work, we applied various machine-learning algorithms, in an attempt to identify complex, multi-dimensional epileptic precursors in brain recordings. Three types of neural networks are used in this feasibility study, namely Multi-Layer Perceptron (MLP) networks, Long Short-Term Memory (LSTM) networks and Gated Recurrent Unit (GRU) networks. The used input data was annotated Electrocorticography (ECoG) data, recorded in living mutant rodents, containing epileptic events at an interval of about one minute. The data was pre-processed for better learning performance by data normalisation and by generating distinctive training features. The neural networks were configured as three-class classifiers, distinguishing among inter-ictal, pre-ictal and ictal periods. A grid-search approach was applied to determine the best set of parameters for the neural networks. Despite our best efforts, the relation between the input data and output data could not be learned in a reliable way. The maximum reached Average Prediction Rate (APR) was 0.57 with a prediction time of 3.1s when using the normalised data as input and 0.65 with a prediction time of 6.1s when using the distinctive features as input. These results essentially signify good detection but virtually no prediction of upcoming seizures. The evaluation of the experimental findings has revealed that the employed ECoG recordings were ill-selected for training our various neural-network models. Also, a non-conclusive exploratory experiment is performed by applying a Weibull Time-To-Event Recurrent Neural Network (WTTE-RNN) on a sub-set of the normalised input data. The experiment has yielded some positive results, a short-notice prediction of the upcoming seizure in some cases, encouraging for further exploration of this approach. Despite the limited success of this work, however, through its extended forensics analysis, it has paved the crucial, initial steps in the direction of seizure prediction.

To get a clear picture of the earth crust the Helmholtz equation needs to be
solved and a high wave number is needed in order to provide fine grain details.
The Stabilised BiConjugate Gradient method needs to be implemented to solve
the Helmholtz equation. This is done on a Maxeler data flow machine to improve
calculation times. The algorithm is split into 3 parts and all of them use the same
calculation kernel. An improvement in calculation time of 2.4 times faster than in
the literature is achieved and a two times faster calculation is expected with more
modern hardware. Maxeler’s data flow machine shows great possibilities to decrease calculation times for high performance computing problems.