HPM Susceptibility of Electronic Systems

Transcription

1 HPM Susceptibility of Electronic Systems Directed Energy Systems 2012 Munich, 22 nd & 23 rd February 2012 Dr. Michael Suhrke Head of Business Unit Electromagnetic Effects & Threats Fraunhofer Institute for Technological Trend Analysis INT Euskirchen, Germany

2 Outline Nature of HPM threat HPM susceptibility of electronic systems Examples of test results HPM detection and protection Conclusions

3 Nature of HPM Threat IEMI / HPM What is it? IEMI [intentional electromagnetic interference] is the intentional malicious generation of electromagnetic energy introducing noise or signal into electrical or electronic systems, thus disrupting, confusing or damaging this systems. Microwaves: Electromagnetic waves with frequencies [wavelengths] between 300 MHz [1 m] and 300 GHz [1 mm] (= 3 decades) High Power Microwaves (HPM): IEC : IEC : Radiated environment with peak power density S > 26 W/m 2 (E > 100 V/m or H > 0,27 A/m). S > 663 W/m 2 (E > 500 V/m or H > 1,33 A/m). Alternatively: Radiated pulsed power > 10 MW (peak) > 10 kw (average)

4 Nature of HPM Threat High Power Microwaves versus Electronic Warfare Knowledge about target in band smart attack - traditional deception EW (interference) in band dumb attack traditional EW noise jamming (interference) out-of-band dumb attack or smart HPM (interference / upset) costs and complexity increase out-of-band repeated pulse (damage) out-of-band single pulse (damage) Power

5 Nature of HPM Threat Problematic Electromagnetic Radiation cf.: D. V. Giri and F. M. Tesche, Classification of Intentional Electromagnetic Environments, IEEE Transactions on Electromagnetic Compatibility 46, 322 (2002).

6 Nature of HPM Threat Typical Electromagnetic Compatibility (EMC) Immunity of Devices Continuous Microwave Signals (CW) Civilian devices without special requirements Civilian devices in industry Car industry, civilian aircraft General military devices and systems Military devices and systems with special requirements Pulsed Microwave Signals (e. g. Radar) Civilian devices General military devices and systems Military devices and systems with special requirements Object Field Strength 3 V/m V/m 200 V/m V/m up to 600 V/m about V/m about V/m up to V/m H. U. Schmidt et al., Interner Bericht INT 17/02 (2002)

7 Nature of HPM Threat Radiated Threat Types of Signal Waveforms Continuous Wave (CW) Pulsed narrow band e.g. High Power Microwave (HPM) Ultra Wide Band (UWB) Damped sinus

8 Nature of HPM Threat Example 1: Mobile HPM Source Frequency: 1 GHz (wavelength 33 cm) Parabolic reflector: diameter 250 cm, gain 26 db Pulse width: 1 µs Pulse packet length: s P Hf (max.) [MW]: Energy (DC) [kj]: E-Field (max.) [kv/m]: distance 10 m distance 100 m H. U. Schmidt et al., Interner Bericht INT 17/02 (2002)

9 Nature of HPM Threat Example 2: Portable HPM Source Frequency: 1 GHz (wavelength 33 cm) Parabolic reflector: diameter 60 cm, gain 14 db Pulse width: 1 µs Pulse packet length: s P Hf (max.) [kw]: Energy (DC) [J]: E-Field (max.) [V/m]: distance 1 m distance 10 m H. U. Schmidt et al., Interner Bericht INT 17/02 (2002)

10 Nature of HPM Threat Conducted Threat Coupling into Cables and Networks Objective: Disruption or damage of electronic equipment connected to cables Requirement: Readily accessible sockets or power and data lines Remote- or time-controlled short-circuiting switch for interruption of power supply at an accessible sockets Battery powered pulse or HF generators for direct injection into power lines via accessible sockets Inductive or capacitive coupling of signals into accessible data or sensor cables Coupling of high power signals into earth wires

11 Nature of HPM Threat HPM Threat Scenarios Examples Military camps: C4I systems, electronics based security and surveillance equipment (COTS electronics) Air traffic: Electronic systems of airports and aircraft at take-off and landing Critical infrastructure: Electronics of supervisory and control systems for energy, communication, transport,... (dependence of military forces) Convoys: Vehicle stopping, suppression of communication Summary Problems: Wide distribution of program controlled electronic systems, vulnerable to HPM attacks HPM components und systems freely available and easy to assemble Failure levels of electronic systems usually unknown no attribution to HPM attacks No organisational instructions for HPM attacks Covert operations and multiple attack attempts possible (usually no detection tools) Close approach to targets possible Radiated and conducted attacks possible

12 HPM Susceptibility of Electronic Systems Electromagnetic Interaction Propagation Resonances Coupling Frontdoor/ Backdoor Resonances Standing Waves T fx Transfer Function Coupling Induction (I,V) Free Space T f1 T f2 T f3 T f4 Surface Slit Aperture Structure Cables HPM Source Propagation Surface Currents Absorption/ Reflection T f5 T f5 V Disruption Ground Summary: Interference Radiation Losses Electronics Damage s EMI very complex Systematic studies required Hardware tests necessary Mission Simulation Abort Mission Abort

13 HPM Susceptibility of Electronic Systems Effect Levels Level Effect Description 0 Unknown Effect unable to determine due to effects on another component 1 No Effect 2 Interference Effect only present during illumination 3 Disturbance Effect present during illumination, self corrects over a short period of time once illumination is removed 4 Upset Effect present during illumination, requires human intervention to correct 5 Damage Effect that damages hardware to the point it must be replaced or software to the point it must be reloaded

14 Examples of Test Results HPM Tests of Complex Military Systems WTD 81 FG-EMV BMVg DIEHL Rü IV 3 INT WIS WTD 81 Fundamental studies Front- and back-door coupling mechanisms Target disruption and damage effects Since 1991 AFRL, USA FOI, SW QINETIQ UK CEG, France Effects and Susceptibility Database System Response 6-DOF Simulation Mission Aspects Hardening Measures

15 Examples of Test Results Fraunhofer INT, Electromagnetic Effects and Threats High Altitude Electromagnetic Pulse (HEMP): Origin and propagation Modelling Experimental simulation Protection measures Threat by modern nuclear weapons High Power Microwaves (HPM): Susceptibility tests of electronic circuits Coupling of electromagnetic fields into devices and systems Investigation of criminal and terrorist threat scenarios HPM detection and protection measures

16 Examples of Test Results Fraunhofer INT, Electromagnetic Effects and Threats Powerful stationary and mobile equipment for generation of pulsed microwaves up to the higher gigahertz range Development of measuring methods and instrumentation for electromagnetic compatibility, HPM and HEMP Investigation of electromagnetic properties of novel materials Modern computer equipment for numerical simulation of electromagnetic effects Analysis of new technological developments Terahertz radiation Metamaterials

17 Examples of Test Results WIS Munster

18 Examples of Test Results WTD 81 Greding

19 Examples of Test Results Diehl HPEM DS Sources DS-350 demonstrator for effect testing Performance data 1 antenna Rep rate up to 100 Hz 2 GW radiated power ns pulse width Bandwidth 20% Field strength 340 kv/m@1m Resonator 1 MV Marx generator Shielded HV charger rack > Effect tests for larger and interlinked targets > Warhead specification Isolated control rack

20 Examples of Test Results Diehl HPEM DS Sources Commercially available HPEM case system (for small scale tests) 50 kv power supply DS110 antenna Gas controls 300 kv Marx generator Potential targets: Surveillance systems (cameras, sensors) Automotive electronics Control systems (e.g. industrial controllers) Computer, IT components TVs, monitors, radios, telephones DS 110 suitcase system Compact man-portable system for short range disruption of electronic targets Suitable for effects testing, scenario development Tunable version available

21 Examples of Test Results National German HPM Tests of a Complex, Distributed Weapon System Phase I: Effects Tests in Free Field Study of disruption / destruction effects on electronics Loss of functionality, temporary or permanent Use of new, available HPEM-DS sources (DBD) Determination of critical parameters (Freq.,Pol., AoI, PRR) Determination of threshold values Phase II: Systematic Susceptibility Study System resonances (LPM-CW/Pulse, WTD81, Fraunhofer INT) Measurement of Transfer Functions (E-Field, Currents) Determination of Coupling paths Determination of Critical Parameters (threshold values) Analyses of Effects (disruption / destruction of electronics) Additional systematic HPEM-UWB/DS Irradiation Tests

22 Examples of Test Results Disruption of Operation of Air Defence System with HPEM DS Sources Target CWAR HPIR PCP Effects Disruption and damage of electronic components CWAR failure (permanent) Lock loss Disruption and damage of electronic components HPIR failure (permanent) and also destruction of un-powered components Lock loss Target failure (change of target-coordinates) Failure of radar screen (CWAR) and ADP-Computer Disruption and Damage Effects: Mission failed

23 Examples of Test Results HPM Tests of Generic Missile GIBIS by Fraunhofer INT in Anechoic Chamber Rotating IR signal source GIBIS GIBIS

24 Examples of Test Results GIBIS Tests in Reverberation Chamber (RC)

25 Examples of Test Results Effects at Analogue Sensor Electronics of GIBIS Target loss of IR sensor AoI = 20 (coupling via SK-Dom) AoI = 90 (coupling via wings)

26 Investigation of electromagnetic interference at an IT-based generic C4I system Electromagnetic irradiation of a generic operations centre Block diagram Parameter variation of electromagnetic irradiation Influence of polarisation Effect of pulse form (rise time, pulse width, amplitude, spectral energy distribution) Schutzvermerk nach DIN 34 beachten Printer 1 (unhardened) Destroyed 2 (Laptop unhardened) Destroyed 1 (PC system unhardened) Destroyed 3 Laptop hardened) KommServerBW (hardened) Network Switch 1 (unhardened) Network Switch 2 (hardened) Dr.-Ing. Michael Camp 1 Rheinmetall 2011

27 Investigation of electromagnetic interference at an IT-based generic C4I system Test setup for detection of system susceptibility Schematic view Different variants of setup possible FO transmitter / receiver Shielded room (field free) Monitoring of system functionality with fibre optic (FO) connection Fibre optic (FO) connection Schutzvermerk nach DIN 34 beachten Power supply from mains or battery possible Implementation of military communication server (KommServerBW) Axence NetTools 3.0 Anechoic chamber Destroyed 2 (Laptop unhardened) Control PC Destroyed 1 (PC system unhardened) Destroyed 3 (Laptop hardened) Network switch 1 (unhardened) Network printer 1 (unhardened) Network switch 2 (hardened) Dr.-Ing. Michael Camp Rheinmetall

28 Investigation of electromagnetic interference at an IT-based generic C4I system Test setup for detection of system susceptibility Software realisation External monitoring of target PC with UltraVNC Video monitoring with Pinnacle Studio Schutzvermerk nach DIN 34 beachten Test program Prim.exe on target PC (Prime number generation) Evaluation program Axence NetTools 3.0 on control PC (band width, data packets, etc.) Dr.-Ing. Michael Camp 3 Rheinmetall 2011

29 Investigation of electromagnetic interference at an IT-based generic C4I system Influence of polarisation on system performance Generic operations centre Irradiation with HPEM-UWB Antenna system Schutzvermerk nach DIN 34 beachten Irradiation with broadband expo horn antenna system Realisation of vertical and horizontal polarisation by antenna rotation Horizontal polarisation Generic operations centre Antenna system Vertical polarisation Dr.-Ing. Michael Camp 4 Rheinmetall 2011

30 Investigation of electromagnetic interference at an IT-based generic C4I system Influence of polarisation on interference threshold Irradiation with HPEM-UWB threshold Schutzvermerk nach DIN 34 beachten network network network stand-alone stand-alone stand-alone Level B Level C Level D horizontally polarised Dr.-Ing. Michael Camp 5 Rheinmetall 2011

31 Investigation of electromagnetic interference at an IT-based generic C4I system Improvement of HPEM immunity by use of shielded tent Complete setup of generic operations centre inside shielded tent Vivaldi antenna system Shielded tent Schutzvermerk nach DIN 34 beachten Measurement of electrical field strength in the interior with E-field sensor Irradiation of tent from four directions Monitoring of system performance of generic operations centre with fibre optic connection Generic operations centre 4 kv pulse generator Dr.-Ing. Michael Camp 6 Rheinmetall 2011

32 Examples of Test Results HPM tests in RC of Fraunhofer INT IT network equipment (military + COTS): Switches / routers Media converters WLAN devices Stand-alone devices: HPM detectors

33 Examples of Test Results NATO RTO SCI-132 Task Group High Power Microwave Threat to Infrastructure and Military Equipment Purpose: HPM susceptibility tests of a tactical C4I network in a joint test campaign Contribution of Fraunhofer INT: Definition of several configurations for susceptibility tests of the tactical C4I network Configuration of failure diagnosis of network components Transfer function investigations coupling into test objects, shielding of boxes, coupling into cables Susceptibility tests with pulses of medium power guideline for HPM tests at other participating test sites

34 Examples of Test Results NATO RTO SCI-132 Task Group High Power Microwave Threat to Infrastructure and Military Equipment 1 st generation Tactical C4I Network

35 Examples of Test Results NATO RTO SCI-132 Task Group High Power Microwave Threat to Infrastructure and Military Equipment Susceptibility tests of Fraunhofer INT: Tests in a broad frequency range Malfunctions already for intermediate field strengths Identification of vulnerable components (e. g. media converter for fibre optic data lines) Frequency

36 Examples of Test Results NATO RTO SCI-198 Task Group Protection of Military Networks Against High Power Microwave Attacks Test object: Tactical C4I network, 2 nd generation Successor of 1 st generation network Currently in use Objective of tests: Analysis of improvements of susceptibility in comparison to 1 st generation Analysis of remaining weak points Proposals for further improvements

37 Examples of Test Results NATO RTO SCI-198 Task Group Protection of Military Networks Against High Power Microwave Attacks Example configuration of the C4I network Several subsystems of the C4I network

38 Examples of Test Results NATO RTO SCI-198 Task Group Protection of Military Networks Against High Power Microwave Attacks Comparison of 1 st and 2 nd generation C4I network HPM susceptibilities: Diagnostic PC FOL Router, 1-ch MC ISDN emulator Router Notebook 1 0,9 First generation system: Interuption of file transfer at Diagnostic-PC tested frequencies D-PC: ftp 0,6 Second generation system: Packet losses during file transfer tested frequencies DPC: E-PING 0,8 0,5 E-Field (a.u.) 0,7 0,6 0,5 0,4 0,3 E-Field (a.u.) 0,4 0,3 0,2 0,2 0,1 0,1 0 Frequency (a.u.) 0, Frequency (a.u.)

39 Examples of Test Results NATO RTO SCI-198 Task Group Protection of Military Networks Against High Power Microwave Attacks Test object: Media Converters Especially vulnerable component of C4I networks Objective of tests: Analysis of different kinds of media converters (commercial, industrial, military) Selection of robust media converters

40 Examples of Test Results NATO RTO SCI-198 Task Group Protection of Military Networks Against High Power Microwave Attacks Media converter tests power cable w i t h i n w a v e g u i d e loop UTP / SFTP cable E H 750 p DC power cable (horizontal, vertical) 400 data cable loop DC power cable E O E O media converter ground plate of waveguide fibre optical cable O E f t p O E wall of shielded hall PC2 PC1 laboratory

41 HPM Detection and Protection Requirements for HPM Detection Detection of all signal types (CW, narrow band pulses, DS, UWB) and signal parameters Reaction time in ns/ps region, broad frequency range Sufficient detection dynamics (e. g. 10 V/m kv/m) HPM immunity (several 10 kv/m) All directions and polarisations Radiated and conducted interferences Discrimination of false alarms Analysis of signal form Source localisation Integration in sensor networks Increasing complexity

42 HPM Detection and Protection Detector Tests at Fraunhofer INT Different prototypes of HPM warning systems Tests in a broad frequency range Different signal forms and pulse parameters Functionality and robustness tests

43 HPM Detection and Protection Detector Development at Fraunhofer INT Housing for the high frequency components Demonstrator with spiral antenna, shielded high frequency part with detector module, oscilloscope and laptop Prototype board in milled aluminum housing

44 HPM Detection and Protection Organisational Protection Measures: Access control, access restrictions for guests and external persons Measures against insider threat Increase threat awareness for operation personnel Constructional Protection Measures: Blocking / separation of critical rooms and installations No data lines in readily accessible areas No network components in readily accessible areas Preferably no computer centres / IT rooms at outdoor walls to the street

45 HPM Detection and Protection Technical Protection Measures Room shielding (inside), screening effectiveness typically 40 db, together with wall shielding of about 20 db sufficient for most threats Shielded shelters with 60 db for special outdoor applications Demands can be met with standard EMC technologies Filters and surge protection at inlets to screened areas (EMC standard components) Filters and surge protection also recommended for unscreened IT rooms and critical facilities (cable coupling) Hardening of individual devices usually not affordable (use of COTS devices), in particular cases protection of equipment in freely accessible areas by additional shielding Use fibre optic communication technology (shielded media converters) Avoid wireless technology for mission critical applications

46 HPM Detection and Protection Operational Directives 1 st step: 2 nd step: 3 rd step: Elimination of information deficits on HPM Education and training measures Determination of actual disruption and failure levels of mission critical devices and systems Issuing organisational protection and defence measures (barriers, surveillance, emergency plans, repair instructions) Development of HPM detection methods and devices (HPM warning receiver) Technical protection and hardening measures against HPM

47 Conclusions HPM attacks are technically feasible, permanent upsets are likely, damages are less likely. The threat is local. Technical protection measures are possible and also available. Standard EMC technology is valuable, if it is implemented consequently and comprehensively. Threat awareness and training of personnel are essential. HPM vulnerability testing of hardware is an essential prerequisite to hardening and protection. One really has to do it.