ECE4902-­ Spring 2014

Underwater Acoustic Communications Security Spring 2014 Final Paper

Team 185

Advisor: Prof. Shengli Zhou

Alivia Grate (EE) Brandon Gilbert (EE) Kaitlyn King (EE)

Muhammad Samir (EE)

Team 185, 1

Introduction

Underwater Acoustic Networks (UANs) create numerous possibilities for communications

below the surface of a body of water. However, because these networks operate in an open environment they are vulnerable to attacks from various forms of interference and jamming. Malicious attempts to disrupt a communication channel will be the focus of this project. Using some prior research, Team 185 will attempt to identify the weaknesses in three (there were five originally, but the two remaining systems did not arrive in time to be included) different UAN systems with respect to their ability to receive a signal that is being jammed.

The initial requirements of this project were to identify the network vulnerabilities across underwater networks that use DSSS, FSK, S2C, and OFDM modulation. Frequency Shift Keying (FSK) is the oldest and best understood method, which has been secured to the degree that the military is confident using it. Direct Sequence Spread Spectrum (DSSS) is a very well developed technology but has security limitations and is not the most efficient with respect to bandwidth. Sweep Spread Carrier Technology (S2C) has promising security characteristics, that arise from the constant sweep of the signal. Lastly, Orthogonal Frequency Division Multiplexing (OFDM) offers very efficient use of bandwidth, and is currently used on most cell phone networks. Unfortunately, the S2C modems did not arrive in Storrs in time to be included in this project. Therefore, the testing was only conducted on FSK, OFDM, and DSSS modems.

The task of securing a UAN is a complicated problem due to several factors that are unique to underwater communication. Long propagation delays, narrow bandwidth, and multipath effects can degrade the performance of a UAN without the presence of a malicious attack. Additionally, security schemes cannot be directly applied from existing terrestrial networks to UANs. Modeling an aqueous environment accurately is also very difficult. Therefore, field testing in an environment that was at least similar to the intended deployment environment was required;; this was conducted in one of the pools on UCONN’s campus. These tests were first conducted in a small tank at the underwater sensor network laboratory. Several different types of jamming attacks were used in an attempt to discover the vulnerabilities of the various modulation types.

There are several specific types of electronic attacks that may be employed to disrupt one of these networks. Jamming attacks may be separated into three categories. A constant attack continuously injects noise or regular packets into a channel. A random attack, using either recorded signals or white noise, adjusts the gain of the jammer in a pseudo random fashion. Finally, a reactive attack only begins jamming when network activity is sensed. Moreover, we can classify jammers into two types that will use one of the above mentioned methods to disrupt a signal. A dummy attack jammer knows nothing about the network protocol being attacked and simply tries to corrupt packets using noise. The second type is known as a smart attack jammer. This type of jammer knows something, although not necessarily everything, about the network protocol being attacked. A smart attack jammer will pretend to be a legitimate node and attempt to control or corrupt packets.

For this project all tests were conducted with a dummy attack jammer, and either constant or specifically timed attacks. Smart jamming attacks were realized with the use of pre-­recorded signals for the respective modems. This allowed the team to explore the vulnerabilities of the physical layer of these modems. Additionally, it allowed team 185 to target specific portions of the signal to determine where the vulnerabilities were. More specifically, what

Team 185, 2

part of the signal was most vulnerable to attack.

Team Responsibilities

Brandon OFDM Modem testing Coordinated Jamming Set-­up Web page maintenance Weekly deliverables

Kaitlyn FSK Modem testing Weekly deliverables

Alivia DSSS Modem Testing Data acquisition setup Weekly deliverables

Muhammad DSSS Modem Testing Data acquisition setup Weekly deliverables

Underwater Acoustic Networks (UANs)

Fig1: Generalized Underwater network

Underwater acoustic networks allow data to be transmitted wirelessly in underwater applications.

Team 185, 3

Underwater acoustic networks allow data to be transmitted wirelessly in underwater applications. A wireless network offers more possibilities for significant cost saving in comparison to more expensive underwater cabling. It also provides an option for extending the reach of an existing cabled network. Acoustic modems are available commercially from numerous companies (such as AquaSent, Evologics, Benthos, LinkQuest and more) that provide a variety of modems with different ratings. A simple underwater network is shown in figure (1) to demonstrate communication underwater. As shown by figure (1), there is a transmitter and a receiver utilizing the same modulation scheme to communicate through acoustic waves. Modems consist of a transducer, an analog signal board, a digital signal processing board, and DC power supply (battery) all enclosed in waterproof housing. The transducer can transmit and receive signals, while the circuit boards are programmed to control the network channel and the battery is used to supply DC power. There is also a serial port on the modems that is used to interface with a computer in this case.

UAN modems are used for many purposes by government agencies, research institutions and modern industries. Examples for the deployment of UANs include the following: AUV/UUV tracking and communication, underwater construction, diver navigation and tracking, ocean monitoring (Sonar), research in marine biology, and submarine communications.

These wireless networks are placed in open water and are vulnerable to external attacks. Research in securing underwater networks is an ongoing process bringing new ideas as the technology advances.

Hardware

As previously stated, three different types of modems were tested over the course of this

project. The testing set up consisted of two laptop computers (booted into Windows), an external sampling card, a hydrophone, a signal jammer, and the modems to be tested. This testing set up will be detailed in the testing set up section of this paper. The modems themselves are the most important part of the setup and are briefly described below.

The following modems were used on this project. Two AquaSeNT modems, which use orthogonal frequency division multiplexing (OFDM) modulation and operate in the audible frequency range of 14-­20 kHz. These modems are an example of a parallel transmission system. Each sub carrier only occupies a small portion of the total bandwidth. Furthermore, OFDM has the advantage of reducing frequency selective channel fading by employing frequency diversity.

There were also two Teledyne Benthos ATM-­885 modems that the group used in the lab. These modems are in the audible range as their low and middle frequency ranges are 9-­14 kHz and 16-­21 kHz respectively. They transmit data using Phase Shift Keying (PSK) at a max bit rate of 15,360 bits/sec. PSK is a modulation process that conveys data by changing the phase of a reference signal. Its benefits include having a high bandwidth efficiency. Although ATM-­885 models can transmit using PSK, they only receive data using Multiple Frequency Shift Keying (MFSK). MFSK is a spread spectrum modulation process that transmits multiple tones simultaneously. This modulation only has a maximum bit rate of 2,400 bits/sec but it offers more reliability in a high multipath environment. ATM-­885 modems are operable in depths up to 2,000 m.

Team 185, 4

Linkquest UWM2000H is the third type of underwater acoustic modem that was tested. There were two UWM2000H modems available for testing in the lab. These were medium range (1500 m), low power modems that can be used up to 2000 meters underwater. Moreover, they can also be used for long-­range in shallow or very shallow environments with very severe multipath conditions. Linkquest modems use Direct Sequence Spread Spectrum (DSSS). This is a modulation scheme in which the bandwidth is significantly larger than the information rate. A symbol sequence is combined with spreading sequence to create a baseband waveform. These modems are usually deployed for one or more of these reasons: antijamming, multiple access and bandwidth diversity.The UWM200H operates in an inaudible frequency range of 26 kHz -­ 45kHz and provides a data transfer rate of 300 to 1200 bits/second.

To analyze the recorded signal data of Linkquest modems, we used the NI 9215 with NI USB 9171 shown in Fig2 below. This sampling card are compatible with the set up we have, and driven with a Matlab script.

Fig2: NI Sampling Card NI9125 sampling card, NI9171 USB housing

Fig 3: Tank testing setup. This was used as an initial starting point for modem testing, AquaSeNT

(OFDM) modems are shown.

Team 185, 5

Underwater Acoustic Communication Physical Layer Security

There are several challenges to UAN security at the physical layer. Among these are

factors that are intrinsic to underwater communication. Long propagation delays in UANs are the result of the speed of a radio signal in air (roughly the speed of light) as compared to an acoustic signal in water. Additionally the propagation speed of a signal is dependant on whether or not the water is fresh. An acoustic signal in fresh water will travel at 1,497 m/s. However, in seawater the pressure, temperature, and salinity can increase or decrease the speed depending on each respective value. Generally, deeper in the ocean will be faster. Another challenge to UAN communication is the narrow bandwidth available for signals. The modems used on this project range from 12kHz to 45kHz, which is a small range by radio standards. The last UAN challenge is something called multipath effects. This happens as a result of signals reflecting off of the surface of the water as well as the bottom of the body of water. When multipath occurs, signals arrive at the receiving modem at slightly different times with the same message. This causes errors on the network. For this project only fresh water was be used. This project also only focused on the physical layer and denial of service (DOS) type attacks.

There are essentially two types of attacks, a dummy (signal) jammer and smart (deceptive) attack, that effect the physical layer and are used in DOS. The dummy attack knows nothing about the protocols of the network and generates a signal to corrupt packets. More simply this is broadcasting a signal such as white noise or a signal with periodicity and hoping the gain will be enough to stop the signal on a network. The smart attack knows some information about the network protocols as this type of jammer will pretend to be a legitimate node. This can be realized by playing back recorded signals from the network being jammed. There are also three possible modes under which each of these attacks may occur. A constant attack will continually inject signals (noise or regular packets) into the communications channel. A random attack will alternate between attacking and sleeping in a pseudo-­random fashion. This could also be achieved by changing the level of the jammers gain at random. Lastly, a reactive attack occurs by attempting to jam only after some network activity is sensed. This is considered to be more advanced. In order for these attacks to be effectively used or countered, the portion of signal most affected by an attempt jamm must be discovered and understood.

Effective jamming is focused upon the disrupting of the preamble in most cases. This was shown in previous studies conducted by Michael Zuba on some of these modems. He stated that the preamble is the most effective attacking point and also covered some more basic considerations for effective jamming. In order to jam effectively the following events should occur: First, detect the legitimate network signal. Next, start the jamming transmission, making the period of transmission long enough to destroy the message. And lastly, note or calculate the signal propagation time. However, depending on the type of jamming method and the level of jamming gain, the preamble may not be comprehensively true. Test Setup

One of the goals of this project was to set up a test bed that can control two modems and a

jammer from a signal terminal. Windows based Matlab was used to drive NI hardware for the recording setup. For that reason, windows telnet was used to set up a local area network.

Team 185, 6

Additionally windows hyperterminal was used in lieu of the Linux Cutecomm program. The testing set up pictured in Fig 4 consists of two Dell Laptops, Two NI sampling cards, a power amplifier, , a hydrophone and the modems.

The two laptops were booted into windows with one set a telnet client and the other as the server.The telnet server was controlled with a batch file on the desktop that passed the settings needed for each modem to the communications port that the transmitting modem was connected to. This file also passed a transmission signal (a long string of characters that was varied for each modem). The most important thing this file did was allow, with millisecond accuracy, the beginning of a jamming signal to be predicted with respect to the transmitted signal. This allowed for the targeting of specific portions of the signal being transmitted.

Matlab was used to create a more precise recording environment. The code allows the user to specify the amount of time needed to record the test, it specifies the trigger value to start the recording in volts, and it specifies the sampling rate of each modem separately. After the signal is played and recorded, the output from the Matlab code is a new window with a chart that represents the Power Spectrum Density of the signal, the Spectrogram, and the Time Domain Plot. All three plots will be further explained below. As shown in Fig 4, there is a second sampling card that was used briefly during the testing of the above audible modem. This was to ensure the signal being sent to the jammer was in fact in the expected frequency range. However, the jammer being used would not produce above audible signals. A modification was made to the jammer in an attempt to allow above audible signals to be passed.

The circuitry for the jammer contained a preamplifier, which was intended to improve the signal to noise ratio (SNR) of the output. However, while this reduced noise on the channel it also removed part of the high frequency component. Since the signal of interest was the portion being removed, this component had to be removed. The resulting noise of the channel was mitigated by simply soldering a common ground wire into the power cable. The wire was then submerged during testing and was effective in reducing noise. However, the removal of the pre-­amplifier did not produce the desired result. This lead to the use of a signal generator for above audible jamming.

The signal generator used to create the signals that were sent to jam the Linkquest modems was a Tektronix TDS 1002 Two Channel Digital Storage Oscilloscope. The chirp and pre-­recorded signals used for the OFDM and FSK technologies were unable to be used for DSSS. This is because the jammer used for the previously mentioned technologies could not generate above audible signals. Even the removal of the pre-­filter could not help this. The signal generator was used to produce the sinusoidal wave shown in Fig (4) below and the ramp signal wave shown in Fig (4).

Fig 4: Periodic Signal examples associated with the signal generator use in DSSS testing

Team 185, 7

Fig 4: Team 185 testing setup Initial Test Results

Team 185 obtained initial test results using tank and air setups for two types of modems

during the fall semester. These tests were conducted prior to having a working coordinated jamming set up. They provided preliminary data that allowed for future testing sessions to be better focused once the testing setup was operational. Using the OFDM modems these results showed that denial of service for an acoustic modem is very easy to accomplish. Air tests were conducted first as follows. Jamming signals were sent before the preamble, just after the preamble, towards the end of the signal and in the middle of the signal. These were all white noise signals. The last test conducted was to play back an erroneous message to attempt a jamm. While sending the intended signal, message (a), between modems, message (b) which had been pre-­recorded, was also sent to the receiving modem simultaneously. While the white noise jamm was successful by increasing the gain regardless of the start time, the false message only jammed if the preamble of (b) interfered with the preamble of (a). The three plots of figure (5) show a signal without any jamming, a signal with a noise jamm at the end, and a signal with a jamm at the beginning respectively. These were all created from data obtained during air testing.

Team 185, 8

Fig 5: Air test results using AquaSeNT OFDM modems

The next series of tests were conducted using the tank set up with the same modems. The results of the tests were very similar. However, the most noticeable difference was the team’s ability to control the gain of the jamming signal to nearly match the signal being sent by the modem. In contrast to the air tests, even with the gain of the jammer slightly less than that of the modem, the signals were still easily jammed by noise throughout the signal. Shown below by figure (4) are three amplitude-­time plots taken from data obtained during tank tests that show successful noise jams, and a successful signal jam. As with the air tests, spectrograms were also taken. However, as a result of the aqueous environment they are far more noisy and difficult to read.

Fig5: Tank Test Results using AquaSeNT OFDM modems

The same setup for testing was used to test Benthos FSK modems in air and tank

environments. The spectrograms of figure (6) show the tank results of noise jamming after the preamble, noise jamming before the preamble, and noise jamming with large amplitude before the preamble. Only the last jamming attempt was successful and prevented the original signal from being transmitted.

Team 185, 9

Fig6: Tank Test Results using Benthos FSK modems

The FSK modems were found to be much harder to jam than the previously tested OFDM modems. This is because of the nature of the FSK signal. Since white noise has a zero mean, the distance between shifted sub-­carries does not change when an FSK signal is exposed to white noise. When jamming attempts utilized a white noise signal less than the greatest magnitude of the preamble, the signals failed to jam. Successful jams occurred when the noise signal was larger than the greatest magnitude of the preamble and only if the preamble was disrupted. Team 185 did not attempt a signal jam using another signal as was done for OFDM. The key factor for successful jamming, the magnitude of the preamble compared to the magnitude of the jamming signal, had already been determined and demonstrated. However, future jamming of FSK modems will include a frequency sweeping jam, which unlike white noise does not have zero mean. This should be more effective in disrupting these types of signals. Spring Semester Testing Results

Using the coordinated testing setup outlined above yielded more accurate and more detailed

results. An example of one of the charts that is produced is shown below in Fig 7. The three graphs on the chart are as follows. Power Spectrum Density is defined as (f) c(nf ) δ(f f ) Gv = Σ

| | 0

| | 2

n 0

[3] (top left), consists of impulses representing the average phasor power [3]c(nf ) | | 0

| | 2

concentrated at each harmonic frequency [3]. This is useful in determining the range forff = n 0 chirp jams. This is also useful in determining which frequencies to focus on from testing and not just spec sheets. Additionally, the signal to noise ratio can be determined. This is important given the the amplitude of the jamming signal was the determining factor in the efficacy of the jam in all but a few cases. Next is the magnitude of short-­time Fourier Transform, this chart shows the frequency against time. This is more commonly known as the spectrogram. The STFT is defined

as [4]. Where w[m] is an appropriate selected window (e , ) [n ]w[m]e X STFTjω n = ∑

R 1

m= ∞x m jωm

sequence. This is a function of two variables the integer variable time index n and the continuous frequency variable ω. This differs from a standard fourier transform which is a function of only one variable ω. Last, the time-­domain plot (center bottom) shows the voltage vs. time of a signal and is useful in determining jamming signal lengths.

Team 185, 10

Fig 7: Control signal for an OFDM signal and example of the Matlab output

While testing the AquaSeNT modems the batch file was configured such that the communication port (serial port output) would have the following settings: 38400 buad rate, 8 data bits, 1 stop bit, no parity. The jamming signals used were generated with a Matlab script. These consisted of a 0.1,0.25,0.5,1,3,5 and 10 second white noise recordings. This was accomplished with the Matlab command y = .2*randn(1,10.*Fs) where Fs is the desired sampling frequency (in this case 44,000 Hz, and 10 in the length in seconds). The second jam type that was used was the chirp signal. This signal sweeps a set frequency band at a constant amplitude. In this case, a parabolic curve was chosen for the shape of the sweep. The Matlab script for this signal was more complicated and is shown below:

fs = 44100;; %sampling freq;; T = 10;; % seconds duration;; t = 0:(1/fs):T;; %samples

some_number=14000:100:20000;; %arrary of possible freqs

for i=1:.1:length(some_number);;

y = chirp(t,10000,5,20000,'quadratic');;

end

sound(y, fs);;%play a sound (should be different everytime)

wavwrite(y,fs,'nonzeroOFDM.wav');;%generate a .wav file

In the chirp code, the second line corresponds to the OFDM modem frequency range. The for-­loop section generates the signal which is the processed into a wavfile. The spectrogram plot of the chirp is below. It should be noted that the apparent periodicity is the result of aliasing. Since the chirp is restricted to a set frequency it has to alias the signals outside that range back in. The plot below is also an example of the magnitude of short-­time fourier transform (STFT) in two dimensions.

Team 185, 11

Fig #: Chirp signal spectrogram example

OFDM Testing

The next several charts and tables summarize the testing results for the OFDM modems on this project. The jamming tests that were conducted proved that the physical layer of the OFDM modem is vulnerable to attack from several types of jamming signal. First, a brief explanation of signal itself. The wakeup signal can be seen on the time plot as the first two very narrow peaks, and the settings are contained in the first packet post-­ceding the wakeup. These two pieces of the signal are known as the preamble, and are the area most susceptible to jamming. The rest of the packets are the message being sent. Jamming signals <250ms would not effectively disrupt the wake-­up signal and settings packet. However, a signal of only 100ms was able to disrupt a message packet. Signals of <500ms did require a short delay to ensure that the correct portion of signal was targeted. Jamming signals >250ms will disrupt both the preamble and the message. Pre-­recorded signals will work effectively as a jam signal even if the settings packet of the true signal is received first. The commonality between the pre-­recorded jam and white noise is that both of these types dependant on the amplitude of the jam relative to the amplitude signal. However, the chirp signal disrupted the OFDM signal regardless of the starting point or amplitude (the lowest possible setting still destroyed the intended message).

In the charts and tables below the testing results from both tank and pool environments are outlined. The tank and the pool produced similar results that supported each other for the chirp and pre-­recorded signals which can be seen in Fig 9 -­10 and Table 2-­3 respectively. However, there were some differences between initial results and spring results. The pre-­recorded jam was found to be effective given a large enough amplitude. Additionally, the noise results between the tank and poll were not entirely consistent. These results can be seen in Fig 8 and Table 1. While testing in the pool partial jamming of the modems did not occur. Despite setting the power of the modems to 50% the environmental effect previously mentioned (particularly multipath distortion) made the signal more sensitive to jamming.

Team 185, 12

Fig 8: OFDM Noise Jamming Results. Left is a tank test and right is a pool test. Tank test was a partial jam, while the pool test was a complete jam.

Table 1: OFDM noise jam results

Team 185, 13

Fig 9: OFDM Chirp Jam results, left is a tank test and right is a pool test. Both were complete jams of the signal.

Table 2: OFDM Chirp jam results.

Team 185, 14

Fig 10: OFDM Pre-­recorded signal jam. Left side was a tank test, and the right side is a pool test. Both jams succeeded so long of the amplitude was beyond (x voltage) were successful.

Table 3: OFDM pre-­recorded signal jam results.

FSK Testing

Previously, only white signal noise jamming was attempted in a tank setting for the FSK modems. The group was able to extend testing of the Benthos modems to include two other jamming signals: a frequency sweep (chirp) and another FSK signal. The same tank setup that was previously used for tank testing was used for these tests. Initial chirp testing was started before the group had implemented a synchronized testing set-­up and is shown below by Fig 11. The initial chirp testing shown by Fig 11 was started before the group had implemented a synchronized testing set-­up. The results of this test, although basic, proved to be true with further frequency

Team 185, 15

sweep jam testing. The first two images of this figure are the results of a chirp jam implemented before the preamble, while the last two images show a jam after the preamble. The jam that disrupted the preamble was successful and the other was not.

Fig11: Initial Chirp Jam Tank Test Results using Benthos FSK modems

More extensive tank testing was completed using the synchronized set-­up utilizing all three different types of jamming signals. These results are shown below by Fig 12 as well as in Table 4 below for comparison with the pool testing results.

½ sec noise, no delay, no jam ½ sec noise, 5 ms delay, no jam

Chirp, 100 ms delay, jam Chirp, 5s delay, no jam

Large amplitude signal, no delay, jamLarge amplitude signal, 3s delay, jam

Team 185, 16

Small amplitude signal, no delay, no jam Small amplitude signal, 3s delay, no jam

Fig 12: Tank Synchronized Test Results using Benthos FSK modems Pool testing was completed in the Uconn athletic training pool and was the last set of

testing of the Benthos FSK modems. These results are shown by Figures 13-­17 and also in Table with the previous tank results.

The results from noise jamming tests in the pool setting are shown in Figure 13. The first test (left image) utilized a small amplitude, three-­second long jamming signal executed after a one-­second delay. The second test (right image) was conducted with almost the same jamming signal settings as the previous test. The only difference was an increase in volume of the jamming signal which is clear by the amplitude shown in the second figure. Both of these tests resulted in failed jamming attempts. This is because, in both cases, the amplitude of the noise signals never exceeded the greatest part of the preamble of the control signal. As proven by testing in previous environments, this is crucial in order to jam a signal with noise.

Shown by Figure 14 and Figure 15 are the results from chirp jamming tests in the pool setting. The first test of Figure 14 (left image) was a large amplitude, 10-­second long chirp jamming signal executed after a one-­second delay. The following test, shown by Figure 14, utilized the same jamming signal with instead a three-­second delay. Both trials completely jammed the signal. The tests shown by Figure 15 were conducted with the same chirp jamming signal but instead were triggered after a 5-­second and 4-­second long delay respectively. In these cases, transmission of the control signal was successful. The tests shown by Figure 14 were successful while those of Figure 15 were not because the jamming signal interrupted the preamble of the control signal. A three-­second long delay for jamming was successful, although four-­second and later delays were not, because it remained in this threshold.

Figure 16 and Figure 17 show the results from the testing completed in the pool using another pre-­recorded FSK signal for jamming. The first image of Figure 16 shows the results from a large-­amplitude FSK pre-­recorded signal jam executed after a two-­second delay. The second image was the same jamming signal as the previous test executed after a three-­second delay. Both of these tests were successful jams and no signals were received by the other modem. The first set of results shown by Figure 17 implemented the same FSK signal as the last two trials, however this time with a four-­second delay. The second image shown by Figure 17 was executed with a four-­second delay but had a smaller amplitude than the jamming signal used for the other trials.

Team 185, 17

The larger amplitude jamming signal was successful in completely jamming the control signal, however, the smaller amplitude signal was not. An FSK signal was able to jam the control signal after the preamble, however, the amplitude still had to be large enough.

Most importantly the results of pool testing supported the findings from all of the previous tank testing. Noise jamming was successful when the jamming signal disrupted the control signal with an amplitude greater than the largest part of the control signal’s preamble. Frequency sweep jamming was successful when it interfered with any part, including the very end, of the preamble. Jamming using another FSK signal was successful even with more delay than the other two jamming signals. If the amplitude of the signal jam was great enough, it was successful even without disrupting the control signal’s preamble.

Fig 13: Noise Jam Pool Test Results using Benthos FSK modems

Fig 14: Chirp Jam (at preamble) Pool Test Results using Benthos FSK modems

Team 185, 18

Fig 15: Chirp Jam (after preamble) Pool Test Results using Benthos FSK modems

Fig 16: Signal Jam (at preamble) Pool Test Results using Benthos FSK modems

Fig 17: Signal Jam (after preamble) Pool Test Results using Benthos FSK modems

Team 185, 19

Table 4: Benthos modems tank and pool testing result summaries

Team 185, 20

DSSS Testing

LinkQuest modems were tested only in the tank environment to analyze the vulnerabilities for DSSS communication. The control signal was sent from one LinkQuest modem to the other from a distance of 0.7m. A jammer modem was placed in between the modems to send noisy signals to interrupt the communication. All the data was acquired through a hydrophone in the water which was connected to the sampling card. The sampling card was also connected to the computer as shown in the setup in Fig. 4 above. There were continuous noise signals which used one constant frequency. The others were frequency sweep signals that were formed with a sweep from 20kHz (lower) frequency to 45kHz (higher) frequency within a sweep duration (time).

Due to the difficulty the group experienced with producing jamming signals that worked with above audible frequencies, there was no time remaining for successful pool testing. The following charts and tables will summarize the results obtained during the tank testing. The tests conducted prove that DSSS technology can be jammed, given the right circumstances.

Fig: Control signal for DSSS communication that will be jammed by noisy signals.

For continuous noise signals, three parameters were changed namely signal amplitude VNoise, signal frequency fNoise and signal type TypeNoise. In the figures below, we can see the successful communication vs. jammed communication after changing one parameter while keeping the others same.

Team 185, 21

Fig1: VNoise of 15 mV (left) did not affect the communication but VNoise of 40 mV jammed (right)

Fig1: fNoise of 38 kHz (left) did not affect the communication but fNoise of 32 kHz jammed (right)

Fig1: TypeNoise of sinusoidal signal (left) did not affect the communication but TypeNoise of ramp signal jammed

(right)

For frequency sweep (chirp) noise signals, three parameters were changed. The changes

Team 185, 22

were made to the signal amplitude VNoise, the frequency sweep time fsweep_timeNoise and the type of signal TypeNoise , either a sinusoidal or ramp signal.

Fig1: VNoise of 15 mV (left) did not affect the communication but VNoise of 32 mV jammed (right)

Fig1: fsweep_timeNoise of 10 ms (left) did not affect the communication but fsweep_timeNoise of 5 ms jammed (right)

Fig1: TypeNoise of ramp (left) did not affect the communication but TypeNoise of sinousoidal jammed (right)

Team 185, 23

DSSS Communication Jamming by

Continuous Noise Signals

Voltage Level

Varied Frequency Varied Type Varied

Noise Amplitude: 15 mV 40 mV 15 mV 15 mV 15 mV 15 mV

Noise Signal Frequency: 38 kHz 38 kHz 38 kHz 32 kHz 32 kHz 32 kHz

Noise Signal Type: Sin Sin Sin Sin Ramp Sin

Not Jammed Jammed Not Jammed Jammed Not Jammed Jammed

DSSS Communication Jamming by Frequency Sweep (Chirp) Noise Signals

Voltage Level

Varied Sweep Time Varied Type Varied

Noise Amplitude: 15 mV 32 mV 25 mV 25 mV 32 mV 32 mV

Noise Freq Sweep Time: 5 ms 5 ms 10 ms 5 ms 5 ms 5 ms

Noise Signal Type: Sin Sin Sin Sin Ramp Sin

Not Jammed Jammed Not Jammed Jammed Not Jammed Jammed

Table: Summary of DSSS Jammed communication by changing amplitude, frequency and the type of signal used for jamming.

DSSS underwater communication can be jammed in multiple ways. These include higher noise amplitude, lower noise signal frequency, and producing a continuous sine signal for jamming. Also, while using a chirp noise signal, jamming is successful under these same conditions. However, one has to account for all the factors that can play roles in intercepting the signal. This includes but is not limited to the signal-­to-­noise ratio (SNR), frequency of noise signal and the type of noise signal. Due to the pseudo-­random nature of the chips used to determine the transmitted signal in DSSS a constant frequency signal will not jam, because it will not disrupt the pattern. Unless of of course the amplitude of the constant signal is significantly larger than that of the transmitted signal. Using signals with periodicity, particularly non-­constant periodicity (the period changes with time), are very effective in jamming DSSS signals. These signal disrupt the pattern in the signal effectively and unevenly. Last, the SNR is a factor in jamming simply as a measure of how much noise there is in comparison to the signal. As the SNR decreases the likelihood of a jamm go up because there is more noise on the channel.

Budget

Team 185, 24

Group 185’s total provided budget was $1000. Minor expenses included $20 worth of connectors from radio shack. An ethernet cable, a network switch, 12V batteries, a microphone, and all necessary software were provided by the School of Engineering with no cost to the group members. All modems, the jammers and the laptops have been provided by Professor Zhou and the Underwater Sensor Network (UWSN) Lab. The National Instruments sampling card described in the hardware section was ~$700. Its’ adapter was ~$300. This depleted the group’s budget, which is currently $0 until more funds are allocated. Timeline of Events

References

[1] Michael Zuba, Zhijie Shi, Zheng Peng, Jun-­Hong Cui, Shengli Zhou, Vulnerabilities

of underwater acoustic networks to denial-­of-­service jaming attacks, Security and Communication Networks DOI: 10.1002/sec.507 ed. , Wiley Online Library, 2012.

[2] Borja Peleato and Milica Stojanovic, Distance Aware Collision Avoidance Protocol for

Team 185, 25

Ad-­Hoc Underwater Acoustic Sensor Networks, VOL. 11, NO. 12 ed. , IEEE COMMUNICATIONS LETTERS, 12 December 2007.

[3] A. Bruce Carlson, Communications Systems;; An Introduction to Signals and Noise in

Electrical Communication, 5th ed. , New York, NY: McGraw-­Hill, 2010.

[4] Sanjit K. Mitra, Digital Signal Processing, A Computer-­Based Approach, Fourth ed. , Los Angeles, CA: McGraw Hill, 2011.

[5] DSSS -­ Direct Sequence Spread Spectrum http://www.telecomabc.com/d/dsss.html, 2013Dec04.

[6] AquaSeNT, Product Specification Sheet,

http://www.aquasent.com/images/pdf/brochure.pdf, 2013Dec04.

Team 185, 26