Question: AutoLock: Exploring the reasons why cache attacks on ARM processors are more challenging than anticipated.

This paper introduces Cache Template Attacks, a novel and automated technique for exploiting information leakage through inclusive last-level CPU caches. Unlike previous cache attacks that necessitate manual identification of vulnerabilities, such as data accesses or instruction execution influenced by secret data, Cache Template Attacks can systematically profile and leverage cache-based leakage from any program autonomously, without the need for detailed knowledge of software versions or system specifics. This method can be executed online on a remote system without any prior offline computations or measurements, making it highly versatile and efficient.

Cache Template Attacks consist of two primary stages: profiling and exploitation. During the profiling phase, the technique identifies the correlation between the processing of secret information, such as specific key inputs or private keys of cryptographic algorithms, and particular cache accesses. This phase maps out the cache behavior under various conditions, allowing for the creation of a cache access template that reflects the secret data's influence. In the exploitation phase, the secret values are deduced based on observed cache accesses, using the templates developed during profiling.

To demonstrate the effectiveness of Cache Template Attacks, the paper showcases several attacks, as well as a beneficial application for developers. Notably, the technique is applied to infer keystrokes and, more critically, to identify specific keys on Linux and Windows user interfaces. For passwords consisting of lowercase letters only, the method can significantly reduce the entropy per character from log2(26) = 4.7 bits to just 1.4 bits on Linux systems, making it easier to guess passwords. Additionally, an automated attack is performed on the T-table-based AES implementation of OpenSSL, achieving the same level of efficiency as state-of-the-art manual cache attacks. These results highlight the power and potential impact of Cache Template Attacks in both offensive and defensive contexts.

In this paper, we present SwiPIN, a novel authentication system that allows input of traditional PINs using simple touch gestures like up or down and makes it secure against human observers. We present two user studies which evaluated different designs of SwiPIN and compared it against traditional PIN. The results show that SwiPIN performs adequately fast (3.7 s) to serve as an alternative input method for risky situations. Furthermore, SwiPIN is easy to use, significantly more secure against shoulder surfing attacks and switching between PIN and SwiPIN feels natural.

Sensitive data such as text messages, contact lists, and personal information are stored on mobile devices. This makes authentication of paramount importance. More security is needed on mobile devices since, after point-of-entry authentication, the user can perform almost all tasks without having to re-authenticate. For this reason, many authentication methods have been suggested to improve the security of mobile devices in a transparent and continuous manner, providing a basis for convenient and secure user re-authentication. This paper presents a comprehensive analysis and literature review on transparent authentication systems for mobile device security. This review indicates a need to investigate when to authenticate the mobile user by focusing on the sensitivity level of the application, and understanding whether a certain application may require a protection or not.

The threat that attacks cyberspace is known as malware. In order to infect the technologic devices that are attacked, malware needs to evade the different antivirus systems. To avoid detection, an obfuscation technique must be applied so malware is updated and ready to be performed. No obstant, the technique implementation presents difficulties in terms of its required ability, evasion tests and infection functionality that turn outs to be a problem to keep malware updated. Therefore, a procedure is proposed that allows applying AVFUCKER or DSPLIT techniques. The purpose is to optimize the required technical means, reduce the antivirus analysis and malware functionality check times.

The Simon and Speck families of block ciphers were designed specifically to offer security on constrained devices, where simplicity of design is crucial. However, the intended use cases are diverse and demand flexibility in implementation. Simplicity, security, and flexibility are ever-present yet conflicting goals in cryptographic design. This paper outlines how these goals were balanced in the design of Simon and Speck.

A growing number of devices of daily use are equipped with computing capabilities. Today, already more than 98 % of all manufactured microprocessors are employed in embedded applications , leaving less than 2 % to traditional computers. Many of these embedded devices are enabled to communicate amongst each other and form networks. A side effect of the rising interconnectedness is a possible vulnerability of these embedded systems. Attacks that have formerly been restricted to PCs can suddenly be launched against cars, tickets, ID cards or even pacemakers. At the same time the security awareness of users and manufacturers of such systems is much lower than in classical PC environments. This renders security one key aspect of embedded systems design and for most pervasive computing applications. As embedded systems are usually deployed in large numbers, costs are a main concern of system developers. Hence embedded security solutions have to be cheap and efficient. Many security services such as digital signatures can only be realized by public key cryptography. Yet, public key schemes are in terms of computation orders of magnitude more expensive than private key cryptosystems. At the same time the prevailing schemes rely on very similar security assumptions. If one scheme gets broken, almost all cryptosystems employing asymmetric cryptography become useless. The first part of this work explores alternatives to the prevailing public key cryptosystems. Two alternative signature schemes and one public key encryption scheme from the family of post quantum cryptosystems are explored. Their security relies on different assumptions so that a break of one of the prevailing schemes does not affect the security of the studied alternatives. The main focus lies on the implementational aspects of these schemes for embedded systems. One actual outcome is that, contrary to common belief, the presented schemes provide similar and in some cases even better performance than the prevailing schemes. The presented solutions include a highly scalable software implementation of the Merkle signature scheme aimed at low-cost microprocessors. For signatures in hardware an FPGA framework for implementing a family of signature schemes based on multivariate quadratic equations is presented. Depending on the chosen scheme, multivariate quadratic signatures show better performance than elliptic curves in terms of area consumption and performance. The McEliece cryptosystem is an alternative public key encryption scheme which was believed to be infeasible on embedded platforms due to its large key size. This work shows that by applying certain …

We examine the security of home smart locks: cyber-physical devices that replace traditional door locks with deadbolts that can be electronically controlled by mobile devices or the lock manufacturer's remote servers. We present two categories of attacks against smart locks and analyze the security of five commercially-available locks with respect to these attacks. Our security analysis reveals that flaws in the design, implementation, and interaction models of existing locks can be exploited by several classes of adversaries, allowing them to learn private information about users and gain unauthorized home access. To guide future development of smart locks and similar Internet of Things devices, we propose several defenses that mitigate the attacks we present. One of these defenses is a novel approach to securely and usably communicate a user's intended actions to smart locks, which we prototype and evaluate. Ultimately, our work takes a first step towards illuminating security challenges in the system design and novel functionality introduced by emerging IoT systems.

Recently, malware has increasingly become a critical threat to embedded systems, while the conventional software solutions, such as antivirus and patches, have not been so successful in defending the ever-evolving and advanced malicious programs. In this paper, we propose a hardware-enhanced architecture, GuardOL, to perform online malware detection. GuardOL is a combined approach using processor and field-programmable gate array (FPGA). Our approach aims to capture the malicious behavior (i.e., high-level semantics) of malware. To this end, we first propose the frequency-centric model for feature construction using system call patterns of known malware and benign samples. We then develop a machine learning approach (using multilayer perceptron) in FPGA to train classifier using these features. At runtime, the trained classifier is used to classify the unknown samples as malware or benign, with early prediction. The experimental results show that our solution can achieve high classification accuracy, fast detection, low power consumption, and flexibility for easy functionality upgrade to adapt to new malware samples. One of the main advantages of our design is the support of early prediction-detecting 46% of malware within first 30% of their execution, while 97% of the samples at 100% of their execution, with <;3% false positives.

EROS is a capability-based operating system for commodity processors which uses a single level storage model. The single level store's persistence is transparent to applications. The performance consequences of support for transparent persistence and capability-based architectures are generally believed to be negative. Surprisingly, the basic operations of EROS (such as IPC) are generally comparable in cost to similar operations in conventional systems. This is demonstrated with a set of microbenchmark measurements of semantically similar operations in Linux.The EROS system achieves its performance by coupling well-chosen abstract objects with caching techniques for those objects. The objects (processes, nodes, and pages) are well-supported by conventional hardware, reducing the overhead of capabilities. Software-managed caching techniques for these objects reduce the cost of persistence. The resulting performance suggests that composing protected subsystems may be less costly than commonly believed.

Applications for mobile platforms are being developed at a tremendous rate, but often without proper security implementation. Insecure mobile applications can cause serious information security and data privacy issues and can have severe repercussions on users and organizations alike.

ION is a unified memory management interface for Android that is widely used on virtually all ARM based Android devices. ION attempts to achieve several ambitious goals that have not been simultaneously achieved before (not even on Linux). Different from managing regular memory in the system, ION is designed to share and manage memory with special constraints, e.g., physically contiguous memory. Despite the great flexibility and performance benefits offered, such a critical subsystem, as we discover, unfortunately has flawed security assumptions and designs. In this paper, we systematically analyze ION related vulnerabilities from conceptual root causes to detailed implementation decisions. Since ION is often customized heavily for different Android devices, the specific vulnerabilities often manifest themselves differently. By conducting a range of runtime testing as well as static analysis, we are able to uncover a large number of serious vulnerabilities on the latest Android devices (e.g., Nexus 6P running Android 6.0 and 7.0 preview) such as denial-of-service and dumping memory from the system and arbitrary applications (e.g., email content, passwords). Finally, we offer suggestions on how to redesign the ION subsystem to eliminate these flaws. We believe that the lessons learned can help guide the future design of similar memory management subsystems.


Question: AutoLock: Investigating the reasons cache attacks on ARM processors are more challenging than anticipated.

This paper introduces TrueSpy, an investigation into cache side-channel information leakage on ARM devices with TrustZone technology. With the growing integration of smart, embedded devices in our daily lives, ensuring their security has become paramount. ARM processors, which dominate the embedded device market, have implemented TrustZone to provide a secure execution environment known as the secure world. This secure environment is crucial for safeguarding sensitive data and processes. However, the cache design in TrustZone-enabled processors, which includes a nonsecure (NS) bit to distinguish cache lines used by the secure and normal worlds, can inadvertently facilitate cache contention. This contention opens the door to cache side-channel attacks.

TrueSpy is the pioneering study that explores timing-based cache side-channel information leakage in TrustZone. The attack exploits cache contention to recover secret information from the secure world. Two distinct attack scenarios are proposed: the normal world OS attack and the normal world Android app attack. In the OS-based attack, the attacker has access to virtual-to-physical address translation and high precision timers, enabling more sophisticated attacks. Conversely, in the Android app-based attack, these tools are unavailable to the attacker. To overcome this limitation, the researchers developed a novel method that leverages expected channel statistics for cache probing memory allocation. Additionally, they demonstrate how an attacker can use a less precise performance event interface as a timer.

Using the T-table based AES implementation in OpenSSL 1.0.1f as a case study, the researchers show that a normal world attacker can successfully steal fine-grained secrets from the secure world using a timing-based cache side-channel. Both the OS-based attack and the Android app-based attack can recover the full AES encryption key, underscoring the severity of the threat posed by TrueSpy. Due to the reliance on the cache design in TrustZone-enabled ARM processors, the TrueSpy attack represents a significant risk to a broad spectrum of devices. To address this threat, the paper also outlines application-based and system-oriented countermeasures to enhance security and mitigate potential vulnerabilities.

Protecting kernel control data (e.g., function pointers and return addresses) has been a serious issue plaguing rootkit defenders. In particular, rootkit authors only need to compromise one piece of control data to launch their attacks, while defenders need to protect thousands of such values widely scattered across kernel memory space. Worse, some of this data (e.g., return addresses) is volatile and can be dynamically generated at run time. Existing solutions, however, offer either incomplete protection or excessive performance overhead. To overcome these limitations, we present indexed hooks, a scheme that greatly facilitates kernel control-flow enforcement by thoroughly transforming and restricting kernel control data to take only legal jump targets (allowed by the kernel's control-flow graph). By doing so, we can severely limit the attackers' possibility of exploiting them as an infection vector to launch rootkit attacks. To validate our approach, we have developed a compiler-based prototype that implements this technique in the FreeBSD 8.0 kernel, transforming 49 025 control transfer instructions (~7.25% of the code base) to use indexed hooks instead of direct pointers. Our evaluation results indicate that our approach is generic, effective, and can be implemented on commodity hardware with a low performance overhead (<;5% based on benchmarks).

We hypothesizethat a form of kernel-residentaccesscontrol-based integrity protection can gain widespread acceptancein Commer cial Off-The-Shelf(COTS)environmentsprovidedthat it couplessomeusefulprotectionwith a high degreeof compatibilitywith existing software, configurations,andpractices.To testthis hypothesis, wehave developeda highly-compatiblefreeopen-sour ceprototype calledLOMAC, andreleasedit on theInternet.LOMAC is a dynamicallyloadableextensionfor COTSLinux kernels thatprovidesintegrity protectionbasedonLowWater-Mark accesscontrol. We presenta classificationof existing accesscontrol modelswith regard tocompatibility, concluding thatmodelssimilar to LowWater-Mark areespeciallywellsuitedto high-compatibilitysolutions.Wealsodescribeour practical strategiesfor dealingwith thepathological cases in the Low Water-Mark model’s behavior , which includea smallextensionof themodel,andanunusualapplicationof

The shift from single to multiple core architectures means that programmers must write concurrent, multithreaded programs in order to increase application performance. Unfortunately, multithreaded applications are susceptible to numerous errors, including deadlocks, race conditions, atomicity violations, and order violations. These errors are notoriously difficult for programmers to debug.
 This paper presents Grace, a software-only runtime system that eliminates concurrency errors for a class of multithreaded programs: those based on fork-join parallelism. By turning threads into processes, leveraging virtual memory protection, and imposing a sequential commit protocol, Grace provides programmers with the appearance of deterministic, sequential execution, while taking advantage of available processing cores to run code concurrently and efficiently. Experimental results demonstrate Grace's effectiveness: with modest code changes across a suite of computationally-intensive benchmarks (1-16 lines), Grace can achieve high scalability and performance while preventing concurrency errors.

“Security Keys” are second-factor devices that protect users against phishing and man-in-the-middle attacks. Users carry a single device and can self-register it with any online service that supports the protocol. The devices are simple to implement and deploy, simple to use, privacy preserving, and secure against strong attackers. We have shipped support for Security Keys in the Chrome web browser and in Google’s online services. We show that Security Keys lead to both an increased level of security and user satisfaction by analyzing a two year deployment which began within Google and has extended to our consumer-facing web applications. The Security Key design has been standardized by the FIDO Alliance, an organization with more than 250 member companies spanning the industry. Currently, Security Keys have been deployed by Google, Dropbox, and GitHub. An updated and extended tech report is available at https://github.com/google/u2fref-code/docs/SecurityKeys_TechReport.pdf.

We introduce a formal modeling in ASLan++ of the twofactor authentication protocol used by the Electrum Bitcoin wallet. This allows us to perform an automatic analysis of the wallet and show that it is secure for standard scenarios in Dolev Yao model [Dolev 1981]. The result could be derived thanks to some advanced features of the protocol analyzer such as the possibility to specify i) new intruder deduction rules with clauses and ii) non-deducibility constraints.

The results of implementations of all five AES finalists using Xilinx Field Programmable Gate Arrays are presented and analyzed. Performance of four alternative hardware architectures is discussed and compared. The AES candidates are divided into three classes depending on their hardware performance characteristics. Recommendation regarding the optimum choice of the algorithms for AES is provided.

The Roofline model graphically represents the attainable upper bound performance of a computer architecture. This paper analyzes the original Roofline model and proposes a novel approach to provide a more insightful performance modeling of modern architectures by introducing cache-awareness, thus significantly improving the guidelines for application optimization. The proposed model was experimentally verified for different architectures by taking advantage of built-in hardware counters with a curve fitness above 90%.

We present a general scheme for virtualizing main memory error-correction mechanisms, which map redundant information needed to correct errors into the memory namespace itself. We rely on this basic idea, which increases flexibility to increase error protection capabilities, improve power efficiency, and reduce system cost; with only small performance overheads. We augment the virtual memory system architecture to detach the physical mapping of data from the physical mapping of its associated ECC information. We then use this mechanism to develop two-tiered error protection techniques that separate the process of detecting errors from the rare need to also correct errors, and thus save energy. We describe how to provide strong chipkill and double-chip kill protection using existing DRAM and packaging technology. We show how to maintain access granularity and redundancy overheads, even when using ×8 DRAM chips. We also evaluate error correction for systems that do not use ECC DIMMs. Overall, analysis of demanding SPEC CPU 2006 and PARSEC benchmarks indicates that performance overhead is only 1% with ECC DIMMs and less than 10% using standard Non-ECC DIMM configurations, that DRAM power savings can be as high as 27%, and that the system energy-delay product is improved by 12% on average.

In this paper we present a fully pipelined high speed hardware architecture for Galois/Counter Mode of Operation (GCM) by analyzing the data dependencies in the GCM algorithm at the architecture level. We show that GCM encryption circuit and GCM authentication circuit have similar critical path delays resulting in an efficient pipeline structure. The proposed GCM architecture yields a throughput of 34 Gbps running at 271 MHz using a 0.18 μm CMOS standard cell library.

Computing platforms deployed in many critical infrastructures, such as smart grid, financial systems, governmental organizations etc., are subjected to security attacks and potentially devastating consequences. Computing platforms often get attacked 'physically' by an intruder accessing stored information, studying the internal structure of the hardware or injecting a fault. Even if the attackers fail to gain sensitive information stored in hardware, they may be able to disrupt the hardware or deny service leading to other kinds of security failures in the system. Hardware attacks could be covert or overt, based on the awareness of the intended system. This work classifies existing hardware attacks. Focusing mainly on covert attacks, they are quantified using a proposed schema. Different countermeasure techniques are proposed to prevent such attacks.


Question: AutoLock: Explaining why cache attacks on ARM processors are more challenging than anticipated.

This research paper delves into the intricacies of cache side-channel attacks on ARM processors, a topic that has received significantly less attention compared to its x86 counterpart. The inherent difficulties in executing such attacks on ARM architectures can be attributed to the scarcity of comprehensive documentation regarding ARM cache implementations, including cache coherence protocols and flush operations, as well as a limited understanding of how these nuances impact the feasibility of side-channel attacks. Here, we conduct an exhaustive investigation into the mechanisms for flush-reload attacks on ARM processors, a technique that has gained notoriety on x86 platforms for its ability to leak sensitive information with remarkable accuracy. Our study introduces a groundbreaking methodology for constructing flush-reload side channels on ARM's last-level caches, leveraging return-oriented programming (ROP) to reload instructions. To underscore the implications of these attacks on Android devices, we showcase several practical demonstrations, including the detection of hardware events and the tracing of software execution paths, thereby illuminating the potential security vulnerabilities that ARM-based Android devices might face.

In this article, a methodology to extract Flash EEPROM memory contents is presented. Samples are first backside prepared to expose the tunnel oxide of floating gate transistors. Then, a Scanning Electron Microscope (SEM) in the so called Passive Voltage Contrast (PVC) mode allows distinguishing ‘0’ and ‘1’ bit values stored in individual memory cell. Using SEM operator-free acquisition and standard image processing technique we demonstrate the possible automating of such technique over a full memory. The presented fast, efficient and low cost technique is successfully implemented on 0.35μm technology node microcontrollers and on a 0.21μm smart card type integrated circuit. The technique is at least two orders of magnitude faster than state-of-the-art Scanning Probe Microscopy (SPM) methods. Without adequate protection an adversary could obtain the full memory array content within minutes. The technique is a first step for reverse engineering secure embedded systems.

Radio-frequency identification (RFID) technology is the enabler for applications like the future internet of things (IoT), where security plays an important role. When integrating security to RFID tags, not only the cryptographic algorithms need to be secure but also their implementation. In this work we present differential power analysis (DPA) and differential electromagnetic analysis (DEMA) attacks on a securityenabled RFID tag. The attacks are conducted on both an ASIC-chip version and on an FPGA-prototype version of the tag. The design of the ASIC version equals that of commercial RFID tags and has analog and digital part integrated on a single chip. Target of the attacks is an implementation of the Advanced Encryption Standard (AES) with 128-bit key length and DPA countermeasures. The countermeasures are shuffling of operations and insertion of dummy rounds. Our results illustrate that the effort for successfully attacking the ASIC chip in a real-world scenario is only 4.5 times higher than for the FPGA prototype in a laboratory environment. This let us come to the conclusion that the effort for attacking contactless devices like RFID tags is only slightly higher than that for contact-based devices. The results further underline that the design of countermeasures like the insertion of dummy rounds has to be done with great care, since the detection of patterns in power or electromagnetic traces can be used to significantly lower the attacking effort.

To effectively design a computer system for the worst case power consumption scenario, system architects often use hand-crafted maximum power consuming benchmarks at the assembly language level. These stressmarks, also called power viruses, are very tedious to generate and require significant domain knowledge. In this paper, we propose SYMPO, an automatic SYstem level Max POwer virus generation framework, which maximizes the power consumption of the CPU and the memory system using genetic algorithm and an abstract workload generation framework. For a set of three ISAs, we show the efficacy of the power viruses generated using SYMPO by comparing the power consumption with that of MPrime torture test, which is widely used by industry to test system stability. Our results show that the usage of SYMPO results in the generation of power viruses that consume 14-41% more power compared to MPrime on SPARC ISA. The genetic algorithm achieved this result in about 70 to 90 generations in 11 to 15 hours when using a full system simulator. We also show that the power viruses generated in the Alpha ISA consume 9-24% more power compared to the previous approach of stressmark generation. We measure and provide the power consumption of these benchmarks on hardware by instrumenting a quad-core AMD Phenom II X4 system. The SYMPO power virus consumes more power compared to various industry grade power viruses on x86 hardware. We also provide a microarchitecture independent characterization of various industry standard power viruses.

Android has a dominating share in the mobile market and there is a significant rise of mobile malware targeting Android devices. Android malware accounted for 97% of all mobile threats in 2013 [26]. To protect smartphones and prevent privacy leakage, companies have implemented various host-based intrusion prevention systems (HIPS) on their Android devices. In this paper, we first analyze the implementations, strengths and weaknesses of three popular HIPS architectures. We demonstrate a severe loophole and weakness of an existing popular HIPS product in which hackers can readily exploit. Then we present a design and implementation of a secure and extensible HIPS platform---"Patronus." Patronus not only provides intrusion prevention without the need to modify the Android system, it can also dynamically detect existing malware based on runtime information. We propose a two-phase dynamic detection algorithm for detecting running malware. Our experiments show that Patronus can prevent the intrusive behaviors efficiently and detect malware accurately with a very low performance overhead and power consumption.

We present a general scheme for virtualizing main memory error-correction mechanisms, which map redundant information needed to correct errors into the memory namespace itself. We rely on this basic idea, which increases flexibility to increase error protection capabilities, improve power efficiency, and reduce system cost; with only small performance overheads. We augment the virtual memory system architecture to detach the physical mapping of data from the physical mapping of its associated ECC information. We then use this mechanism to develop two-tiered error protection techniques that separate the process of detecting errors from the rare need to also correct errors, and thus save energy. We describe how to provide strong chipkill and double-chip kill protection using existing DRAM and packaging technology. We show how to maintain access granularity and redundancy overheads, even when using ×8 DRAM chips. We also evaluate error correction for systems that do not use ECC DIMMs. Overall, analysis of demanding SPEC CPU 2006 and PARSEC benchmarks indicates that performance overhead is only 1% with ECC DIMMs and less than 10% using standard Non-ECC DIMM configurations, that DRAM power savings can be as high as 27%, and that the system energy-delay product is improved by 12% on average.

The consideration of targeted security attacks is not yet common in the automotive domain where primarily safety requirements are considered. Hence this survey addresses the relatively new field of IT-security in automotive technology in order to motivate further research. With the emergence of automotive technologies like car-to-car (c2c) communication, the challenges increase. In order to show the necessity for such research we describe how in theory, a potential attack on the Electronic Throttle Control (ETC) could succeed, if no countermeasures are taken, with potentially drastic consequences on the safety of the vehicle, its occupants and its environment as a result. Also an attack on the power window system is shown using the implementation techniques already employed in the design of automotive components. Our goal is to show, that such exploited security vulnerabilities are likely to have serious consequences with respect to the vehicles safety. Therefore such attacks need to be considered and suitable countermeasures have to be identified. In order to achieve this, the connection of the two disciplines Safety and Security for automotive IT components needs to be discussed. We introduce two exemplary attacks, the Trojan Horse targeting at the Electronic Throttle Control System (ETC) and a replay attack on the electric window lift. The first attack is mainly discussed in theory, the second is elaborated in a practical simulation scenario. Finally we introduce a general investigation of potential ways of intrusion and present some first practical results from tests with current automotive hardware.

Intel Software Guard extensions (SGX) enable secure and trusted execution of user code in an isolated enclave to protect against a powerful adversary. Unfortunately, running I/O-intensive, memory-demanding server applications in enclaves leads to significant performance degradation. Such applications put a substantial load on the in-enclave system call and secure paging mechanisms, which turn out to be the main reason for the application slowdown. In addition to the high direct cost of thousands-of-cycles long SGX management instructions, these mechanisms incur the high indirect cost of enclave exits due to associated TLB flushes and processor state pollution.
 We tackle these performance issues in Eleos by enabling exit-less system calls and exit-less paging in enclaves. Eleos introduces a novel Secure User-managed Virtual Memory (SUVM) abstraction that implements application-level paging inside the enclave. SUVM eliminates the overheads of enclave exits due to paging, and enables new optimizations such as sub-page granularity of accesses.
 We thoroughly evaluate Eleos on a range of microbenchmarks and two real server applications, achieving notable system performance gains. memcached and a face verification server running in-enclave with Eleos, achieves up to 2.2× and 2.3× higher throughput respectively while working on datasets up to 5× larger than the enclave's secure physical memory.

We propose a new memory-safe interpretation of the C abstract machine that provides stronger protection to benefit security and debugging. Despite ambiguities in the specification intended to provide implementation flexibility, contemporary implementations of C have converged on a memory model similar to the PDP-11, the original target for C. This model lacks support for memory safety despite well-documented impacts on security and reliability.
 Attempts to change this model are often hampered by assumptions embedded in a large body of existing C code, dating back to the memory model exposed by the original C compiler for the PDP-11. Our experience with attempting to implement a memory-safe variant of C on the CHERI experimental microprocessor led us to identify a number of problematic idioms. We describe these as well as their interaction with existing memory safety schemes and the assumptions that they make beyond the requirements of the C specification. Finally, we refine the CHERI ISA and abstract model for C, by combining elements of the CHERI capability model and fat pointers, and present a softcore CPU that implements a C abstract machine that can run legacy C code with strong memory protection guarantees.

We present a new block cipher LED. While dedicated to compact hardware implementation, and offering the smallest silicon footprint among comparable block ciphers, the cipher has been designed to simultaneously tackle three additional goals. First, we explore the role of an ultra-light (in fact non-existent) key schedule. Second, we consider the resistance of ciphers, and LED in particular, to related-key attacks: we are able to derive simple yet interesting AES-like security proofs for LED regarding relatedor single-key attacks. And third, while we provide a block cipher that is very compact in hardware, we aim to maintain a reasonable performance profile for software implementation.

Recently, malware has increasingly become a critical threat to embedded systems, while the conventional software solutions, such as antivirus and patches, have not been so successful in defending the ever-evolving and advanced malicious programs. In this paper, we propose a hardware-enhanced architecture, GuardOL, to perform online malware detection. GuardOL is a combined approach using processor and field-programmable gate array (FPGA). Our approach aims to capture the malicious behavior (i.e., high-level semantics) of malware. To this end, we first propose the frequency-centric model for feature construction using system call patterns of known malware and benign samples. We then develop a machine learning approach (using multilayer perceptron) in FPGA to train classifier using these features. At runtime, the trained classifier is used to classify the unknown samples as malware or benign, with early prediction. The experimental results show that our solution can achieve high classification accuracy, fast detection, low power consumption, and flexibility for easy functionality upgrade to adapt to new malware samples. One of the main advantages of our design is the support of early prediction-detecting 46% of malware within first 30% of their execution, while 97% of the samples at 100% of their execution, with <;3% false positives.


Question: AutoLock: Exploring the reasons why cache attacks on ARM processors are more challenging than anticipated.

This paper delves into cache-based side channel attacks, specifically targeting the AES block cipher, and demonstrates a novel method capable of swiftly recovering the full secret key for AES-128, a feat achieved with minimal observed encryptions and without any prior knowledge of the plaintext's nature. Contrary to existing approaches, the presented attack not only retrieves the secret key but also deciphers the plaintext, a first for cache attacks on AES implementations utilizing compressed tables. A critical obstacle in such attacks has been the inability to pinpoint the onset of AES rounds without efficient techniques, an issue that previous methods have relied upon. The authors' innovative attack, however, overcomes this hurdle and has been successfully implemented, recovering AES keys with just 100 observed encryptions. This attack is validated against the OpenS SL 0.9.8n AES implementation on Linux, requiring no special privileges beyond those of a typical Linux user. A noteworthy byproduct of this research is a denial of service attack against the current Linux task scheduler (CFS), enabling the observation of virtually every memory access by a targeted process, a capability that significantly enhances the effectiveness of cache attacks.

Finding and exploiting vulnerabilities in binary code is a challenging task. The lack of high-level, semantically rich information about data structures and control constructs makes the analysis of program properties harder to scale. However, the importance of binary analysis is on the rise. In many situations binary analysis is the only possible way to prove (or disprove) properties about the code that is actually executed. In this paper, we present a binary analysis framework that implements a number of analysis techniques that have been proposed in the past. We present a systematized implementation of these techniques, which allows other researchers to compose them and develop new approaches. In addition, the implementation of these techniques in a unifying framework allows for the direct comparison of these apporaches and the identification of their advantages and disadvantages. The evaluation included in this paper is performed using a recent dataset created by DARPA for evaluating the effectiveness of binary vulnerability analysis techniques. Our framework has been open-sourced and is available to the security community.

Many modern computer systems and most multicore chips (chip multiprocessors) support shared memory in hardware. In a shared memory system, each of the processor cores may read and write to a single shared address space. For a shared memory machine, the memory consistency model defines the architecturally visible behavior of its memory system. Consistency definitions provide rules about loads and stores (or memory reads and writes) and how they act upon memory. As part of supporting a memory consistency model, many machines also provide cache coherence protocols that ensure that multiple cached copies of data are kept up-to-date. The goal of this primer is to provide readers with a basic understanding of consistency and coherence. This understanding includes both the issues that must be solved as well as a variety of solutions. We present both highlevel concepts as well as specific, concrete examples from real-world systems. vi

The Simon and Speck families of block ciphers were designed specifically to offer security on constrained devices, where simplicity of design is crucial. However, the intended use cases are diverse and demand flexibility in implementation. Simplicity, security, and flexibility are ever-present yet conflicting goals in cryptographic design. This paper outlines how these goals were balanced in the design of Simon and Speck.

The well-known stream cipher Grain-128 is a variant version of Grain v1 with 128-bit secret key. Grain v1 is a stream cipher which has successfully been chosen as one of seven finalists by European eSTREAM project. Yet Grain-128 is vulnerable against some recently introduced attacks. A new version of Grain-128 with authentication, named Grain-128a, is proposed by Ågren, Hell, Johansson, and Meier. The designers claimed that Grain-128a is strengthened against all known attacks and observations on the original Grain-128. So far there exists no attack on Grain-128a except a differential fault attack by Banik, Maitra, and Sarkar. In this paper, we give some observations on Grain-128a, and then propose a related key chosen IV attack on Grain-128a based on these observations. Our attack can recover the 128-bit secret key of Grain-128a with a computational complexity of <formula formulatype="inline"> <tex Notation="TeX">$2^{96.322} $</tex></formula>, requiring <formula formulatype="inline"> <tex Notation="TeX">$2^{96} $</tex></formula> chosen IVs and <formula formulatype="inline"><tex Notation="TeX">$2^{103.613} $</tex> </formula> keystream bits. The success probability of our attack is 0.632. This related key attack is “minimal” in the sense that it only requires two related keys. The result shows that our attack is much better than an exhaustive key search in the related key setting.

Since 1998, StackGuard patches to GCC have been used to protect entire distributions from stack smashing buffer overflows. Performance overhead and software compatibility issues have been minimal. In its history, the parts of GCC that StackGuard has operated in have twice changed enough to require complete overhauls of the StackGuard patch. Since StackGuard is a mature technology, even seeing re-implementations in other compilers, we propose that GCC adopt StackGuard as a standard feature. This paper describes our recent work to bring StackGuard fully up to date with current GCC, introduce architecture independence, and extend the protection of stack data structures, while keeping the StackGuard patch as small, simple, and modular as possible.

The shared last-level caches in CMPs play an important role in improving application performance and reducing off-chip memory bandwidth requirements. In order to use LLCs more efficiently, recent research has shown that changing the re-reference prediction on cache insertions and cache hits can significantly improve cache performance. A fundamental challenge, however, is how to best predict the re-reference pattern of an incoming cache line.
 This paper shows that cache performance can be improved by correlating the re-reference behavior of a cache line with a unique signature. We investigate the use of memory region, program counter, and instruction sequence history based signatures. We also propose a novel Signature-based Hit Predictor (SHiP) to learn the re-reference behavior of cache lines belonging to each signature. Overall, we find that SHiP offers substantial improvements over the baseline LRU replacement and state-of-the-art replacement policy proposals. On average, SHiP improves sequential and multiprogrammed application performance by roughly 10% and 12% over LRU replacement, respectively. Compared to recent replacement policy proposals such as Seg-LRU and SDBP, SHiP nearly doubles the performance gains while requiring less hardware overhead.

Accelerating program performance via SIMD vector units is very common in modern processors, as evidenced by the use of SSE, MMX, VSE, and VSX SIMD instructions in multimedia, scientific, and embedded applications. To take full advantage of the vector capabilities, a compiler needs to generate efficient vector code automatically. However, most commercial and open-source compilers fall short of using the full potential of vector units, and only generate vector code for simple innermost loops. In this paper, we present the design and implementation of anauto-vectorization framework in the back-end of a dynamic compiler that not only generates optimized vector code but is also well integrated with the instruction scheduler and register allocator. The framework includes a novel{\em compile-time efficient dynamic programming-based} vector instruction selection algorithm for straight-line code that expands opportunities for vectorization in the following ways: (1) {\em scalar packing} explores opportunities of packing multiple scalar variables into short vectors, (2)judicious use of {\em shuffle} and {\em horizontal} vector operations, when possible, and (3) {\em algebraic reassociation} expands opportunities for vectorization by algebraic simplification. We report performance results on the impact of auto-vectorization on a set of standard numerical benchmarks using the Jikes RVM dynamic compilation environment. Our results show performance improvement of up to 57.71\% on an Intel Xeon processor, compared tonon-vectorized execution, with a modest increase in compile-time in the range from 0.87\% to 9.992\%. An investigation of the SIMD parallelization performed by v11.1 of the Intel Fortran Compiler (IFC) on three benchmarks shows that our system achieves speedup with vectorization in all three cases and IFC does not. Finally, a comparison of our approach with an implementation of the Super word Level Parallelization (SLP) algorithm from~\cite{larsen00}, shows that our approach yields a performance improvement of up to 13.78\% relative to SLP.

Today cache size and hierarchy level of caches play an important role in improving computer performance. By using full system simulations of gem5, the variation in memory bandwidth, system bus throughput, L1 and L2 cache size misses are measured by running SPLASH-2 Benchmarks on ARM and ALPHA Processors. In this work we calculate cache misses, memory bandwidth and system bus throughput by running SPLASH2 benchmarks on gem5 Full System Mode. Our results show that L1 cache misses decrease as L1 cache size is varied from 16KB to 64KB. L1 cache misses are independent of L2 cache size after the program data resides in L2 cache. The memory bandwidth and system bus throughput decreases as L1 and L2 cache size increases.

Many binary tools, such as disassemblers, dynamic code generation systems, and executable code rewriters, need to understand how machine instructions are encoded. Unfortunately, specifying such encodings is tedious and error-prone. Users must typically specify thousands of details of instruction layout, such as opcode and field locations values, legal operands, and jump offset encodings. We have built a tool called DERIVE that extracts these details from existing software: the system assembler. Users need only provide the assembly syntax for the instructions for which they want encodings. DERIVE automatically reverse-engineers instruction encoding knowledge from the assembler by feeding it permutations of instructions and doing equation solving on the output.
DERIVE is robust and general. It derives instruction encodings for SPARC, MIPS, Alpha, PowerPC, ARM, and x86. In the last case, it handles variable-sized instructions, large instructions, instruction encodings determined by operand size, and other CISC features. DERIVE is also remarkably simple: it is a factor of 6 smaller than equivalent, more traditional systems. Finally, its declarative specifications eliminate the mis-specification errors that plague previous approaches, such as illegal registers used as operands or incorrect field offsets and sizes. This paper discusses our current DERIVE prototype, explains how it computes instruction encodings, and also discusses the more general implications of the ability to extract functionality from installed software.

Current control flow integrity (CFI) enforcement approaches either require instrumenting application executables and even shared libraries, or are unable to defend against sophisticated attacks due to relaxed security policies, or both, many of them also incur high runtime overhead. This paper observes that the main obstacle of providing transparent and strong defense against sophisticated adversaries is the lack of sufficient runtime control flow information. To this end, this paper describes FlowGuard, a lightweight, transparent CFI enforcement approach by a novel reuse of Intel Processor Trace (IPT), a recent hardware feature that efficiently captures the entire runtime control flow. The main challenge is that IPT is designed for offline performance analysis and software debugging such that decoding collected control flow traces is prohibitively slow on the fly. FlowGuard addresses this challenge by reconstructing applications' conservative control flow graphs (CFG) to be compatible with the compressed encoding format of IPT, and labeling the CFG edges with credits in the help of fuzzing-like dynamic training. At runtime, FlowGuard separates fast and slow paths such that the fast path compares the labeled CFGs with the IPT traces for fast filtering, while the slow path decodes necessary IPT traces for strong security. We have implemented and evaluated FlowGuard on a commodity Intel Skylake machine with IPT support. Evaluation results show that FlowGuard is effective in enforcing CFI for several applications, while introducing only small performance overhead. We also show that, with minor hardware extensions, the performance overhead can be further reduced.


Question: Intelligent antenna systems for enhancing satellite communications on the move.

This paper outlines the latest advancements and future prospects for Ku and Ka band antennas designed for satellite communications on the move, specifically focusing on their deployment in high-speed trains and ground vehicles. It delves into the current state of the art for TeS Ku band antennas, highlighting the strides made in enhancing their performance and the transition towards Ka band terminals. The discussion centers on the evolution of these antennas, detailing the enhancements in Ku band antenna capabilities and the strategic upgrades to accommodate Ka band technology, all aimed at optimizing mobile satellite communications for dynamic environments.

A low-profile substrate-integrated waveguide cavity-backed E-shaped patch antenna is proposed for the Q-LINKPAN application in this paper. In order to expand the operating bandwidth, a co-planar waveguide (CPW) is used to feed the proposed antenna with a metallized via for generating one more resonant mode. In addition, a substrate-integrated cavity is employed to suppress the surface wave and improve the radiation efficiency. A differential feeding network is used in the design to improve the symmetry of the E-plane radiation pattern and the H-plane cross polarization. A  $2 \times 2$  prototype is designed, fabricated, and measured for a demonstration. The measured results show that the prototype has a 10 dB impedance bandwidth of 34.4%, a gain of around 12.5 dBi with a narrow E-plane radiation beam within 37.5–46 GHz for long distance applications, and a gain of around 8 dBi with a broad E-plane radiation beam within 47–53 GHz for short distance applications. The proposed technique can be used to develop compact planar antenna for meeting both the short- and long-rang communication requirements of the emerging Q-LINKPAN wireless system.

A dual-band textile antenna for multiple-input-multiple-output (MIMO) applications, based on substrate-integrated waveguide (SIW) technology, is designed. The fundamental SIW cavity mode is designed to resonate at 2.4 GHz. Meanwhile, the second and third modes are modified and combined by careful placement of a via within the cavity to enable wideband coverage in the 5-GHz WLAN band. The simple antenna topology can be fabricated fully using textiles in a planar form, ensuring reliability and comfort. Numerical and experimental results indicate satisfactory antenna performance when worn on body in terms of impedance bandwidth, radiation efficiency, and specific absorption ratio (SAR). In order to validate its potential for MIMO applications, two elements of the proposed SIW antenna are arranged in six configurations to study the performance in terms of mutual coupling and envelope correlation. It is observed that the placement of the shorted edges of the two elements adjacent to each other produces the lowest mutual coupling and consequently the best envelope correlation.

Massive multiple input and multiple output (MIMO) has attracted significant interests in both academia and industry. It has been considered as one of most promising technologies for 5G wireless systems. The large-scale antenna array for base stations naturally becomes the key to deploy the Massive MIMO technologies. In this communication, we present a dual-polarized antenna array with 144 ports for Massive MIMO operating at 3.7 GHz. The proposed array consists of 18 low profile subarrays. Each subarray consists of four single units. Each single antenna unit consists of one vertically polarized port and one horizontally polarized port connected to power splitters, which serve as a feeding network. A stacked patch design is used to construct the single unit with the feeding network, which gives higher gain and lower mutual coupling within the size of a conversional dual-port patch antenna. Simulation results of the proposed single antenna unit, sub-array, and Massive MIMO array are verified by measurement.

Wireless channels often include multipath propagation, in which the signal has more than one path from the transmitter to the receiver. Atmospheric reflection or refraction, as well as reflection from the ground or from objects such as buildings may cause this phenomena. The aim of this research is to study the effects of multipath environment on the performance of a proposed chaotic chirp spread spectrum system (CCSSS). The benchmark performance of the proposed system is investigated in term of bit error rate (BER) under multipath environment. A Quadrature Phase Shift Keying (QPSK) modulation scheme and a matched filter based on adaptive threshold decision were used in this work. To assess the performance of this system, simulations were performed to compare the proposed system with the traditional frequency modulation differential chaotic shift keying (DCSK) spread spectrum system. The proposed system may be considered as a well qualified communication system in multipath environment.

It has been shown that a complex orthogonal design that provides full diversity and full transmission rate for a space–time block code is not possible for more than two antennas. Previous attempts have been concentrated in generalizing orthogonal designs which provide space–time block codes with full diversity and a high transmission rate. In this work, we design rate one codes which are quasi-orthogonal and provide partial diversity. The decoder of the proposed codes works with pairs of transmitted symbols instead of single symbols.

The Vivaldi Aerial is a new member of the class of aperiodic continuously scaled antenna structures and, as such, it has theoretically unlimited instantaneous frequency bandwidth. This aerial has significant gain and linear polarisation and can be made to conform to a constant gain vs. frequency performance. One such design has been made with approximately 10 dBI gain and ¿20 dB sidelobe level over an instantaneous frequency bandwidth extending from below 2 GHz to above 40 GHz.

Vehicle position estimation for intelligent vehicles requires not only highly accurate position information but reliable and continuous information provision as well. A low-cost Global Positioning System (GPS) receiver has widely been used for conventional automotive applications, but it does not guarantee accuracy, reliability, or continuity of position data when GPS errors occur. To mitigate GPS errors, numerous Bayesian filters based on sensor fusion algorithms have been studied. The estimation performance of Bayesian filters primarily relies on the choice of process model. For this reason, the change in vehicle dynamics with driving conditions should be addressed in the process model of the Bayesian filters. This paper presents a positioning algorithm based on an interacting multiple model (IMM) filter that integrates low-cost GPS and in-vehicle sensors to adapt the vehicle model to various driving conditions. The model set of the IMM filter is composed of a kinematic vehicle model and a dynamic vehicle model. The algorithm developed in this paper is verified via intensive simulation and evaluated through experimentation with a real-time embedded system. Experimental results show that the performance of the positioning system is accurate and reliable under a wide range of driving conditions.

This letter presents a miniature conformal array that provides continuous coverage and good axial ratio from 1100-1600 MHz. Concurrently, it maintains greater than 1.5 dBic RHCP gain and return loss less than -10 dB. The four element array is comprised of two-arm slot spirals with lightweight polymer substrate dielectric loading and a novel termination resistor topology. Multiple elements provide the capability to suppress interfering signals common in GNSS applications. The array, including feeding network, is 3.5" times 3.5" times 0.8" in size and fits into the FRPA-3 footprint and radome.

A novel substrate integrated waveguide (SIW) multibeam antenna based on the parabolic reflector principle is proposed and implemented at 37.5 GHz, which takes the advantages of low loss, low profile, high gain, and mass producible. A prototype of the proposed antenna with seven input ports generating a corresponding number of output beams is fabricated in a standard PCB process. The measurements are in good agreement with the simulations, and the results demonstrate that this type of printed multibeam antenna is a good choice for communications applications where mobility and high gain are simultaneously required.

In automotive radar applications, a realistic road surface can cause multipath reflection, degrade the received power, and reduce detection probability. This paper proposes a one-transmitter–two-receiver (1T2R) 24-GHz frequency-modulation continuous-wave (FMCW) radar architecture with spatial diversity and ground effect compensation for automotive applications. A ray-tracing technique was developed to evaluate the multipath effect of the road surface. In the proposed design, suitable spacing between the two receiving antennas compensated for the multipath effect of the road surface and improved the signal-to-ground clutter ratio of the receivers by a minimum of 20 dB at certain distances. The measurement and calculation results of the proposed radar are in close agreement.


Question: Intelligent antennas for satellite communications during movement.

Design of a Ka-Band Phased Array Antenna for High-Speed Satellite Communications

This paper addresses the development of a phased array antenna tailored for high-speed satellite communications (SATCOM) in the Ka-band frequency range. The ultimate goal is to equip an unmanned aerial vehicle (UAV) with this advanced antenna to facilitate seamless communication with a satellite. The project encompasses three critical stages: the design and fabrication of a compact, reflection-type phase shifter; the detailed conceptualization of a phased array antenna prototype; and the implementation of an innovative calibration technique. The calibration method is pivotal as it determines the bias voltage required for each phase shifter, enabling the antenna to steer its beam accurately in the intended direction. This comprehensive approach ensures that the phased array antenna is not only compact and efficient but also capable of achieving high-data-rate communications in dynamic SATCOM environments.

A complete radar transceiver for 77 GHz with two integrated antenna elements is presented. Based on a previously published design [1], two of the transmit and receive channels of the transceiver are supplemented with integrated antenna elements. The antennas exhibit a well defined antenna pattern with an efficiency of better than 50%.

Planar antennas are common components in sensing applications due to their low cost, low profile and simple integration with systems. They can be used commonly at frequencies as high as 77 GHz and above, for example in automotive sensing. Also, new ultra-wideband communication systems operating around 60 GHz will heavily rely on planar antennas due to their unique properties. One special advantage of planar elements is that they can easily form array structures combining very simple elements, like microstrip patches. Also phased and conformal arrays can be built. Due to all these characteristics, planar antennas are very good candidates for building front ends for mm-wave applications in radar, sensing or communications. For some applications, which are either established today or which will become commercial in a few years, general requirements can be given. In addition to automotive radar, this mainly applies to 60 GHz ultra-broadband wireless indoor communications. Microwave imaging at 94 GHz and above is still much under research, as well as other sensing applications in the millimeter-wave region above 100 GHz. Prominent frequency bands are in the 122 and 140 GHz range1. Typical antenna requirements are multi-beam or scanning capability, high gain up to 30..36 dBi and moderate to low sidelobes. In monopulse radar systems, the sidelobes may be included in the angle determination scheme, then the sidelobe level requirements are rather relaxed. Loss is generally an important issue. Comparing a planar approach to a commercially available dielectric lens, the planar antenna exhibits significantly higher losses, especially if the beamforming device is included. The antenna efficiency of 77 GHz planar array columns is roughly 50%. These losses are caused by dielectric losses and conductor losses. To attain reliable predictions of the losses in full-wave simulations, care has to be taken in the

Microstrip antennas have been one of the niost innovative topics in antenna theory and design in recent years, and are increasingly finding application in a wide range of modern microwave systems. This paper begins with a brief overview of the basic characteristics of microstrip antennas, and then concentrates on the most significant developments in microstrip antenna technology that have been made in the last several years. Emphasis is on new antenna configurations for improved electrical performance and manufacturability, and advances in the analytical modeling of microstrip antennas and arrays.

In this paper we describe the design, manufacturing and measurement of an antenna with an isoflux type radiation pattern used in the space segment TT&C subsystem. In particular, the antenna corresponds to the flight model of mission SAC-D/AQUARIUS, which is a LEO earth observation satellite. The chosen solution is a loaded bifilar helical antenna, which presents a higher gain than a typical hemispherical antenna but which doesn't require the use of a beam forming network like the classical quadrifilar Kilgus type antenna. This reduces the number of required parts, and due to its loading, smaller dimension and higher structural stiffness are achieved.

This paper reviews advanced radar architectures that employ multiple transmit and multiple receive antennas to improve the performance of future synthetic aperture radar (SAR) systems. These advanced architectures have been dubbed multiple-input multiple-output SAR (MIMO-SAR) in analogy to MIMO communication systems. Considerable confusion arose, however, with regard to the selection of suitable waveforms for the simultaneous transmission via multiple channels. It is shown that the mere use of orthogonal waveforms is insufficient for the desired performance improvement in view of most SAR applications. As a solution to this fundamental MIMO-SAR challenge, a new class of short-term shift-orthogonal waveforms is introduced. The short-term shift orthogonality avoids mutual interferences from the radar echoes of closely spaced scatterers, while interferences from more distant scatterers are suppressed by digital beamforming on receive in elevation. Further insights can be gained by considering the data acquisition of a side-looking imaging radar in a 3-D information cube. It becomes evident that the suggested waveforms fill different subspaces that can be individually accessed by a multichannel receiver. For completeness, the new class of short-term shift-orthogonal waveforms is also compared to a recently proposed pair of orthogonal frequency-division multiplexing waveforms. It is shown that both sets of waveforms require essentially the same principle of range time to elevation angle conversion via a multichannel receiver in order to be applicable for MIMO-SAR imaging without interference.

In this paper, a planar, compact, single-substrate, multiband 2 sets of 2-elements each multiple-input-multiple-output (MIMO) antenna system is presented. The MIMO antenna system consists of a tunable 2-element meandered and folded MIMO antenna to cover the LTE Band (698 MHz–813 MHz) and a compact 2-element modified truncated cube wideband antenna to cover 754 MHz–971 MHz, 1.65–1.83 GHz and 2–3.66 GHz, respectively. The ground plane of this antenna behaves as a sensing antenna operating in 0.76–1.92 GHz, and 3.0–5.2 GHz. The upper band antennas operate in 0.728–1.08 GHz, 1.64–1.84 GHz, 2.1–3.69 GHz, and 5.01–5.55 GHz range to develop a complete antenna platform for cognitive radios (CR) and Internet of Things (IoT) applications. The antenna is fabricated on a low cost FR-4 substrate (ε<inf>r</inf>=4.4 tanδ=0.02) of dimensions 65 ×120 ×1.56 mm3.

Several algorithms have recently been proposed for multiplexing multiple users in multiple input multiple output (MIMO) downlinks. The ability of a transmitter to accomplish this using spatial methods is generally dependent on whether the users’ channels are correlated. Up to this point, most of the multiplexing algorithms have been tested on uncorrelated Gaussian channels, a best-case scenario. In this paper, we examine the performance of multiplexing multiple users under more realistic channel conditions by using indoor channel measurements and a statistical model for test cases. We use a block zero-forcing algorithm to test performance at various user separation distances, optimizing for both maximum throughput under a power constraint and minimum power under a rate constraint. The results show that for the measured indoor environment (rich scattering, non-line-of-sight), a separation of five wavelengths is enough to achieve close to the maximum available performance for two users. Since many spatial multiplexing algorithms require channel state information (CSI) at the transmitter, we also examine the performance loss due to CSI error. The results show that a user can move up to one-half wavelength before the original channel measurement becomes unusable. Copyright # 2004 John Wiley & Sons, Ltd.

A reduced-size wideband single-feed circularly polarized patch antenna is introduced for telemetry applications in S-band around 2300 MHz. The proposed structure consists of a slot-loaded patch antenna printed over an optimized metamaterial-inspired reactive impedance substrate (RIS). We demonstrate, step by step, the main role of each antenna element by comparing numerically and experimentally the performance of various antenna configurations: antenna over a single- or dual-layer substrate, standard patch or slot-loaded patch, antenna with or without RIS. The final optimized structure exhibits an axial-ratio bandwidth of about 15% and an impedance bandwidth better than 11%, which is much wider than the conventional printed antenna on the same materials.

Multi-user MIMO (MU-MIMO) networks reveal the unique opportunities arising from a joint optimization of antenna combining techniques with resource allocation protocols. Furthermore, it brings robustness with respect to multipath richness, allowing for compact antenna spacing at the BS and, crucially, yielding the diversity and multiplexing gains without the need for multiple antenna user terminals. To realize these gains, however, the BS should be informed with the user's channel coefficients, which may limit practical application to TDD or low-mobility settings. To circumvent this problem and reduce feedback load, combining MU-MIMO with opportunistic scheduling seems a promising direction. The success for this type of scheduler is strongly traffic and QoS-dependent, however.

A novel frequency-reconfigurable antenna is presented based on a circular monopolar patch antenna. The antenna comprises of a center-fed circular patch surrounded by four sector-shaped patches. Eight varactor diodes are introduced to bridge the gaps between the circular patch and the sector-shaped patches. By changing the reverse bias voltage of the varactor diodes, the antenna can be switched in the operating frequency. A fully functional prototype is developed and tested, which exhibits a continuously tunable frequency band from 1.64 GHz to 2.12 GHz. The measured efficiency rises from about 45% to about 85% as the operating frequency increases from 1.64 GHz to 2.12 GHz. Stable monopole like radiation patterns are achieved at all operating frequencies. In addition, the antenna owns a low-profile structure (0.04 free-space wavelengths at 1.9 GHz). The frequency selective feature and stable radiation patterns make the antenna potentially suitable for future wireless communication systems, such as cognitive radio.


Question: Intelligent antennas for enhancing satellite communications while in motion.

This paper presents the design of innovative reconfigurable reflectarray antennas for Ku-band satellite communications, focusing on single-bit phase resolution to enhance adaptability. Initially, a unique multilayer unit-cell is introduced, leveraging the polarization turning principle to attain the requisite single-bit phase shift essential for reconfigurable reflectarrays. The theoretical underpinnings of the unit-cell are explained through a current model and space match condition, supported by simulations that validate the design and confirm its performance parameters. Subsequently, an offset-fed configuration is explored to evaluate the unit-cell's performance in practical antenna scenarios, with a particular emphasis on its polarization transformation capabilities. As a practical demonstration, an offset-fed reflectarray comprising 10 × 10 elements is designed and manufactured. The dual-polarized antenna demonstrates wide-angle beam scanning through the use of control code matrices. Comprehensive analysis through full-wave simulation is performed on the reflectarray, with detailed results discussed to highlight its performance. The electronically steerable reflectarray antenna showcases its suitability for satellite applications, characterized by a broad operating band, ease of control, and robust beam scanning functionality, making it a promising solution for satellite communications on the move.

Microstrip antennas have been one of the niost innovative topics in antenna theory and design in recent years, and are increasingly finding application in a wide range of modern microwave systems. This paper begins with a brief overview of the basic characteristics of microstrip antennas, and then concentrates on the most significant developments in microstrip antenna technology that have been made in the last several years. Emphasis is on new antenna configurations for improved electrical performance and manufacturability, and advances in the analytical modeling of microstrip antennas and arrays.

In this paper, a UHF-band 2 times 2 microstrip phased-array antenna is designed and implemented to extend the coverage of an RFID reader system. The phased-array antenna has four microstrip-patch antennas, three Wilkinson power dividers, and a transmission-line phase shifter. These are printed on a dielectric substrate with a dielectric constant of 4.5. The array has dimensions of 34 cm times 45 cm, operating at a frequency of 867 MHz, as specified in RFID Gen2 protocol European standards. The phased-array antenna has a measured directivity of 12.1 dB, and the main-beam direction can be steered to angles of plusmn 40deg, with a HPBW of 90deg. The phased-array antenna is used as the receiving antenna in a commercial reader system. Experimental results indicate that the coverage of the RFID system with the phased-array antenna is superior to the coverage with a conventional broader-beamwidth microstrip-patch antenna. The proposed system can also be used for a wireless positioning system.

In this paper a triangular fractal patch antenna with slit is designed for IRNSS and GAGAN applications using ADS software. India is intended to develop a satellite based navigation systems known as Indian Regional Navigational Satellite System (IRNSS) for positioning applications. Design of IRNSS antenna at user sector is indispensable. GPS Aided and Geo Augmented Navigation (GAGAN), a satellite based augmentation system for India, erect over the GPS system is anticipated to provide the flawless navigation support over the Asia-Pacific regions. The desired antenna has been deliberate on dielectric constant εr = 4.8 and substrate thickness h = 3.05 mm. The feed location of the antenna has been selected to produce the circular polarization. The self-similar property in antenna exhibits multi-band resonant frequencies. These specifications should be satisfied at the frequency L5 (1175 MHz), L1 (1575.42 MHz) and S (2492.08 MHz).

ISAR imaging is described for general motion of a radar target. ISAR imaging may be seen as a 3D to 2D projection, and the importance of the ISAR image projection plane is stated. For general motion, ISAR images are often smeared when using FFT processing. Time frequency methods are used to analyze such images, and to form sharp images. A given smeared image is shown to be the result of changes both in scale and in the projection plane orientation.

A first-of-the-kind 28 GHz antenna solution for the upcoming 5th generation cellular communication is presented in detail. Extensive measurements and simulations ascertain the proposed 28 GHz antenna solution to be highly effective for cellular handsets operating in realistic propagating environments.

DVB-NGH (Digital Video Broadcasting - Next Generation Handheld) is the next generation technology for mobile TV broadcasting, which has been developed by the DVB project with the most advanced transmission technologies. DVB-NGH is the first broadcasting standard to incorporate multiple-input multiple-output (MIMO) as the key technology to overcome the Shannon limit of single antenna communications. MIMO techniques can be used to improve the robustness of the transmitted signal by exploiting the spatial diversity of the MIMO channel, but also to achieve increased data rates through spatial multiplexing. This article describes the benefits of MIMO that motivated its incorporation in DVB-NGH, reviews the MIMO schemes adopted, and discusses some aspects related to the deployment of MIMO networks in DVB-NGH. The article also provides a feature comparison with the multi-antenna techniques for 3GGP's LTE/LTE-Advanced for cellular networks. Finally, physical layer simulation results calibrated within the DVB-NGH standardization process are provided to illustrate the gain of MIMO for the next generation of mobile TV broadcasting.

The design of a massive multiple-input-multiple-output (mMIMO) antenna system based on patch antennas is presented in this paper. The array consists of 16 ports, each port consists of a 2×2 patch antenna array with different phase excitation at each element to tilt the beam toward different directions to provide lower correlation coefficient values. A fixed progressive phase feed network is designed to provide the beam tilts. The proposed antenna system is designed using a 3-layer FR4 substrate with total size of 33.33×33.33×0.16 cm3.

MIMO (multiple-input multiple-output) radar refers to an architecture that employs multiple, spatially distributed transmitters and receivers. While, in a general sense, MIMO radar can be viewed as a type of multistatic radar, the separate nomenclature suggests unique features that set MIMO radar apart from the multistatic radar literature and that have a close relation to MIMO communications. This article reviews some recent work on MIMO radar with widely separated antennas. Widely separated transmit/receive antennas capture the spatial diversity of the target's radar cross section (RCS). Unique features of MIMO radar are explained and illustrated by examples. It is shown that with noncoherent processing, a target's RCS spatial variations can be exploited to obtain a diversity gain for target detection and for estimation of various parameters, such as angle of arrival and Doppler. For target location, it is shown that coherent processing can provide a resolution far exceeding that supported by the radar's waveform.

Nowadays, the utilization of mobile phones has increased rapidly. Due to this evolution schools, mosques, prisons, etc., require silence and security. This is achieved by using the mobile phone jammers. An intelligent mobile jammer is designed for allowing only the emergency calls by utilizing the microcontroller. Here, the jammer utilizes the successive approximation for reducing the transmission power. However, it requires few modifications. Therefore in this paper, an improved successive approximation based on divide and conquer algorithm is proposed in order to design the improved intelligent mobile jammer and reduce transmission power. Subsequently, the proposed jammer is analysed based on the different scenarios and frequency bands to illustrate their performance effectiveness. Furthermore, the normal activities are distinguished from jamming by using machine learning-based detection system according to the various parameters. Finally, the proposed algorithm is compared with conventional algorithms to demonstrate its performance efficiency in terms of detection accuracy.

The escalating teletraffic growth imposed by the proliferation of smartphones and tablet computers outstrips the capacity increase of wireless communications networks. Furthermore, it results in substantially increased carbon dioxide emissions. As a powerful countermeasure, in the case of full-rank channel matrices, MIMO techniques are potentially capable of linearly increasing the capacity or decreasing the transmit power upon commensurately increasing the number of antennas. Hence, the recent concept of large-scale MIMO (LS-MIMO) systems has attracted substantial research attention and been regarded as a promising technique for next-generation wireless communications networks. Therefore, this paper surveys the state of the art of LS-MIMO systems. First, we discuss the measurement and modeling of LS-MIMO channels. Then, some typical application scenarios are classified and analyzed. Key techniques of both the physical and network layers are also detailed. Finally, we conclude with a range of challenges and future research topics.


Question: Intelligent antenna systems for enhancing satellite communications on the move.

A dual-band leaky-wave antenna, engineered with a dual-layer frequency selective surface, is introduced for bi-directional satellite communications on the move (satcom-on-the-move) in the Ka-band. This antenna, designed for ground-based user terminals, functions efficiently at both the 20 GHz downlink and the 30 GHz uplink bands, maintaining circular polarization at each frequency, all while sharing a common radiation aperture and phase center. The antenna's dual-band capability is realized through the strategic design of a stacked, dual-layer frequency selective surface, where one layer is optimized for operation at 20 GHz and transparent at 30 GHz, while the other layer operates in reverse. The paper delves into the design process of the circularly polarized primary feed, the dual-layer structures, and the integrated compact leaky-wave antenna panel. Performance metrics, as evidenced by measurements, indicate realized gains in excess of 22 dBi and efficiencies over 60%. Moreover, the antenna's cross-polarization discrimination and sidelobe level are within the acceptable range to satisfy the stringent power spectral requirements for satellite communications in the Ka-band, showcasing its suitability for satcom-on-the-move applications.

To improve national security, government agencies have long been committed to enforcing powerful surveillance measures on suspicious individuals or communications. In this paper, we consider a wireless legitimate surveillance system, where a full-duplex multi-antenna legitimate monitor aims to eavesdrop on a dubious communication link between a suspicious pair via proactive jamming. Assuming that the legitimate monitor can successfully overhear the suspicious information only when its achievable data rate is no smaller than that of the suspicious receiver, the key objective is to maximize the eavesdropping non-outage probability by joint design of the jamming power, receive and transmit beamformers at the legitimate monitor. Depending on the number of receive/transmit antennas implemented, i.e., single-input single-output, single-input multiple-output, multiple-input single-output, and multiple-input multiple-output (MIMO), four different scenarios are investigated. For each scenario, the optimal jamming power is derived in a closed form and efficient algorithms are obtained for the optimal transmit/receive beamforming vectors. Moreover, low-complexity suboptimal beamforming schemes are proposed for the MIMO case. Our analytical findings demonstrate that by exploiting multiple antennas at the legitimate monitor, the eavesdropping non-outage probability can be significantly improved compared with the single-antenna case. In addition, the proposed suboptimal transmit zero-forcing scheme yields similar performance as the optimal scheme.

In this paper we present methods for the design of planar frequency-modulated continuous-wave (FMCW) multiple-input multiple-output (MIMO) arrays with an emphasis on the problem of moving targets in time-division multiple-access (TDMA) systems. We discuss the influence of target motion and boundaries of operation and present a method to compensate for its effects, which requires special attention in the array design and in signal processing. Array design techniques, examples including an implementation, and measurement results are also covered in this article.

A dual circularly polarized (CP) waveguide array antenna is presented for Ka-band wireless communication. A novel triple-resonant cavity is proposed to implement mode conversion and impedance matching in the <inline-formula> <tex-math notation="LaTeX">$2 \times 2$ </tex-math></inline-formula>-element subarray. A ridge waveguide polarizer is integrated to form the left-hand circular polarization (LHCP) and the right-hand circular polarization (RHCP). A flyover-shaped full-corporate feeding network is designed to accommodate the dual polarizations and keep the wideband characteristic for a large-scale array. Subarray spacing is used to optimize the port-to-port isolation and decrease the sidelobe level at some definite angles. Computer numerically controlled machining technology is applied to fabricating a <inline-formula> <tex-math notation="LaTeX">$16 \times 16$ </tex-math></inline-formula>-element prototype. Measured results demonstrate a bandwidth of 16% from 27.6 to 32.4 GHz for the dual polarizations, in terms of good reflection coefficient and axial ratio. A maximum gain of 32.8 dBic is achieved at 28.8 GHz. A total efficiency over 60% is obtained throughout the above band for both LHCP and RHCP ports.

We introduce space–time block coding , a new paradigm for communication over Rayleigh fading channels using multiple transmit antennas. Data is encoded using a space–time block code and the encoded data is split inton streams which are simultaneously transmitted usingn transmit antennas. The received signal at each receive antenna is a linear superposition of the n transmitted signals perturbed by noise. Maximumlikelihood decoding is achieved in a simple way through decoupling of the signals transmitted from different antennas rather than joint detection. This uses the orthogonal structure of the space–time block code and gives a maximum-likelihood decoding algorithm which is based only on linear processing at the receiver. Space–time block codes are designed to achieve the maximum diversity order for a given number of transmit and receive antennas subject to the constraint of having a simple decoding algorithm. The classical mathematical framework of orthogonal designs is applied to construct space–time block codes. It is shown that space–time block codes constructed in this way only exist for few sporadic values ofn. Subsequently, a generalization of orthogonal designs is shown to provide space–time block codes for both real and complex constellations for any number of transmit antennas. These codes achieve the maximum possible transmission rate for any number of transmit antennas using any arbitrary real constellation such as PAM. For an arbitrary complex constellation such as PSK and QAM, space–time block codes are designed that achieve1=2 of the maximum possible transmission rate for any number of transmit antennas. For the specific cases of two, three, and four transmit antennas, space–time block codes are designed that achieve, respectively, all, 3=4, and 3=4 of maximum possible transmission rate using arbitrary complex constellations. The best tradeoff between the decoding delay and the number of transmit antennas is also computed and it is shown that many of the codes presented here are optimal in this sense as well.

The millimeter wave (mmWave) frequencies offer the potential of orders of magnitude increases in capacity for next-generation cellular wireless systems. However, links in mmWave networks are highly susceptible to blocking and may suffer from rapid variations in quality. Connectivity to multiple cells - both in the mmWave and in the traditional lower frequencies - is thus considered essential for robust connectivity. However, one of the challenges in supporting multi-connectivity in the mmWave space is the requirement for the network to track the direction of each link in addition to its power and timing. With highly directional beams and fast varying channels, this directional tracking may be the main bottleneck in realizing robust mmWave networks. To address this challenge, this paper proposes a novel measurement system based on (i) the UE transmitting sounding signals in directions that sweep the angular space, (ii) the mmWave cells measuring the instantaneous received signal strength along with its variance to better capture the dynamics and, consequently, the reliability of a channel/direction and, finally, (iii) a centralized controller making handover and scheduling decisions based on the mmWave cell reports and transmitting the decisions either via a mmWave cell or conventional microwave cell (when control signaling paths are not available). We argue that the proposed scheme enables efficient and highly adaptive cell selection in the presence of the channel variability expected at mmWave frequencies.

This paper provides an overview of the optional multiple-input multiple-output (MIMO) antenna scheme adopted in ATSC 3.0 to improve robustness or increase capacity via additional spatial diversity and multiplexing by sending two data streams in a single radio frequency channel. Although it is not directly specified, it is expected in practice to use cross-polarized 2×2 MIMO (i.e., horizontal and vertical polarization) to retain multiplexing capabilities in line-of-sight conditions. MIMO allows overcoming the channel capacity limit of single antenna wireless communications in a given channel bandwidth without any increase in the total transmission power. But in the U.S. MIMO can actually provide a larger comparative gain because it would be allowed to increase the total transmit power, by transmitting the nominal transmit power in each polarization. Hence, in addition to the MIMO gains (array, diversity, and spatial multiplexing), MIMO could exploit an additional 3 dB power gain. The MIMO scheme adopted in ATSC 3.0 re-uses the single-input single-output antenna baseline constellations, and hence it introduces the use of MIMO with non-uniform constellations.

It is widely acknowledged that the development of traditional terrestrial communication technologies cannot provide all users with fair and high quality services due to the scarce network resource and limited coverage areas. To complement the terrestrial connection, especially for users in rural, disasterstricken, or other difficult-to-serve areas, satellites, unmanned aerial vehicles (UAVs), and balloons have been utilized to relay the communication signals. On the basis, Space-Air-Ground Integrated Networks (SAGINs) have been proposed to improve the users’ Quality of Experience (QoE). However, compared with existing networks such as ad hoc networks and cellular networks, the SAGINs are much more complex due to the various characteristics of three network segments. To improve the performance of SAGINs, researchers are facing many unprecedented challenges. In this paper, we propose the Artificial Intelligence (AI) technique to optimize the SAGINs, as the AI technique has shown its predominant advantages in many applications. We first analyze several main challenges of SAGINs and explain how these problems can be solved by AI. Then, we consider the satellite traffic balance as an example and propose a deep learning based method to improve the traffic control performance. Simulation results evaluate that the deep learning technique can be an efficient tool to improve the performance of SAGINs.

Many types of GNSS antennas have been developed in recent years to make them suitable for different applications. Since their designs and performance requirements vary depending on their application, they have been grouped into six different categories in this book: 1. The design and performance of each type of antenna will be described here and throughout the rest of the book. This chapter discusses the design of the first two varieties: FRPAs and high-gain directional antennas. Figure 2.1 shows a representative sample of these antennas. FRPAs are the most popular and widely used of all GNSS antennas. There are many different types of these antennas; hence they will need two chapters—this chapter and Chapter 3—to fully cover all the important types. This chapter will discuss the following FRPA designs: microstrip patch antennas, which are the most ubiquitous of all GNSS antennas, and quadrifilar helix antennas (QHAs), which are also popular for handheld receivers and crossed " drooping " bow-type dipoles, which provide relatively wider bandwidths and good circular polarization. Spiral antennas such as the Archimedean spiral antenna will be discussed in Chapter 3 under multiband antennas since they are ultrawideband and can cover the entire GNSS band from 1.1 to 1.6 GHz. The conical spiral antenna is also a high-gain di

A polarization-agile antenna is a type of antenna the polarization state of which can be changed dynamically, i.e., it can have either linear (vertical or horizontal) or circular polarization (left hand or right hand), depending on the requirements of its specific application. This special characteristic offers great flexibility for antenna systems, because a single antenna could be used to satisfy the different requirements of several systems. This paper gives a comprehensive review of polarization-agile antennas. The basics of polarization in antennas and polarization-agile antennas are explained. Various examples of recent developments are then provided, and the antenna configurations and design principles are illustrated and discussed. Finally, the future development of polarization-agile antennas for wireless systems is discussed

The design of a massive multiple-input-multiple-output (mMIMO) antenna system based on patch antennas is presented in this paper. The array consists of 16 ports, each port consists of a 2×2 patch antenna array with different phase excitation at each element to tilt the beam toward different directions to provide lower correlation coefficient values. A fixed progressive phase feed network is designed to provide the beam tilts. The proposed antenna system is designed using a 3-layer FR4 substrate with total size of 33.33×33.33×0.16 cm3.