Search

The prevalence of side-channel attacks exploiting hardware vulnerabilities leads to the exfil- tration of secretive data such as secret keys, which poses a significant threat to the security of modern processors. The RISC-V BOOM core is an open-source modern processor design widely utilized in research and industry. It enables experimentation with microarchitec- tures and memory hierarchies for optimized performance in various workloads. The RISC-V BOOM core finds application in the IoT and Embedded systems sector, where addressing side-channel attacks becomes crucial due to the significant emphasis on security. While prior studies on BOOM mainly focus on the side channel in the memory hierarchy such as caches or physical attacks such as power side channel. Recently, the front-end of microprocessors, which is responsible for fetching and decoding instructions, is found to be another potential source of side-channel attacks on Intel Processors. In this study, I present four timing-based side-channel attacks that leverage components in the front-end of BOOM. I tested the effectiveness of the attacks using a simulator and Xilinx VCU118 FPGA board. Finally, I provided possible mitigation techniques for these types of attacks to improve the overall security of modern processors. Our findings underscore the importance of identifying and addressing vulnerabilities in the front-end of modern pro- cessors, such as the BOOM core, to mitigate the risk of side-channel attacks and enhance system security.

A time-of-flight (TOF) detection system for a silicon photomultiplier (SiPM) is designed for the purpose of improving on existing technology for applications in positron emission tomography, with an emphasis on low power and low timing jitter. A reconstruction algorithm is implemented in Matlab to demonstrate the effect of TOF on the image quality per number of source events, as compared to systems restricted to line-of-response (LOR) data only. A case study is performed on SiPM functionality, behavioral modeling, and contemporary front-end amplification designs for a SiPM detector. A charge sensitive amplifier (CSA) circuit is modified for simultaneous collection of timing and energy information, implementing a novel hybrid current-division scheme by capacitively coupling the SiPM to the CSA so that the SiPM's fast leading edge behavior and linear energy-charge correlation is preserved, while conserving power and minimizing jitter. Simulations provide the proof of concept for this design, operating at under 600 μW of power, and injecting less than 60 ps of jitter into the timing output signal. Preliminary testing is conducted using a specialized integrated circuit with analog input CSA channels to verify operation. An energy resolution of 11.7 % was achieved for the 511 keV peak of a Na-22 source, and 10.9 % for the 662 keV peak of a Cs-137 source, using an ON Semiconductor 3mm SiPM and a LYSO scintillator. Advisors: Sina Balkir and Michael Hoffman

In today’s connected world, our lives depend heavily on information obtained from networks of sensor nodes and mobile devices. Billons of mobile devices are in communication over these networks at any given time. The trillion sensor vision calls for low-power, low-cost and small-sized wireless sensor nodes, posing ever-increasing constraints on the power consumption of wireless networks. Radio Frequency (RF) Microelectromechanical Systems (MEMS) offer one path towards nano-watt wireless communications.This dissertation presents the first demonstration of an all-mechanical wireless receiver that employs a micromechanical resonant switch (“resoswitch”) to consume zero quiescent power while listening and ~30nW while actively receiving. Here, high-Q mechanical resonance offers frequency selectivity, while mechanical impact switching provides amplification. The mechanical receiver successfully detects and demodulates (in an On-Off-Keying (OOK) fashion) Frequency-Shift-Keying (FSK)-modulated input signals down to -68dBm, a promising sensitivity for low-speed and low-power wireless applications. Because this receiver consumes no power while listening in standby, it obviates the sleep/wake cycles often used by low power sensor networks to save energy. It thus eliminates the need for continuously operating clocks that govern sleep/wake periods, thereby eliminating their power consumption.If on the other hand one prefers to use more conventional mote transceivers that consume tens of milli-watts when on, then the sleep/wake strategy is paramount to save energy, and the clock sets the power bottleneck. A commercially available real time clock (RTC) typically consumes 1µW of power, which is considerably more than the tens of nano-watts more applicable for giant sensor networks. Fortunately, even when not used as a wireless transceiver, the all-mechanical circuit herein provides a solution to the clock problem, as well.Specifically, the second part of this dissertation presents an RF powered wireless clock that feeds on a received FSK-modulated or Continuous-Wave input and generates a local clock output signal, while consuming only 13nW of battery power, which is more than 50 times lower than an off-the-shelf RTC. Calculations further predict a three-order-of-magnitude power reduction if an on-chip next stage inverter replaces the off-chip discrete component in the current demonstration. The input capacitance of the off-chip inverter is 1.5pF, which translates to nano-watts of power for kilohertz clock frequencies. Use of an on-chip inverter with a few femto-Farads of input capacitance would reduce the power consumption to pico-watts.Resoswitches as receivers or as clock generators, while very compelling, face several challenges that must be further explored before they can be commercially viable. For instance, the frequency stability of a resoswitch directly determines the error rate of a receiver or the stability of a clock. This frequency stability depends on perturbations of mechanical resonance impact dynamics that create unstable switching and instantaneous frequency jitter, a phenomena referred to as squegging. The quality factor, the contact material property, and the external excitation voltage all affect the squegging dynamics, but controlling these factors is not an easy task. On the other hand, manipulating the electrode configuration can also alter the squegging behavior, and is much easier to design and implement. This dissertation models and experimentally verifies observed squegging phenomena. The methods and models presented here provide a path to improving the stability of resoswitches towards commercial viability for use in future ultra-low power wireless networks.

Neuromodulation is the alternation of nerve activity through targeted delivery of a stimulus, such as electrical stimulation, to specific sites in the body. Deep brain stimulation (DBS) is a commonly-used neuromodulation treatment for neurological ailments when traditional methods, such as surgery, medication or psychotherapy, fail. DBS is performed by sending controlled electrical pulses into the brain to evoke the desired response. However, existing DBS systems can only administer open-loop stimulation over a limited number of channels. Future neuromodulation systems require a multi-channel closed-loop platform that can provide high spatial precision, and automatically adjust stimulation parameters based on feedback from recorded neural signals. This multi-channel, closed-loop system poses new challenges for brain-sensing circuit and system design. To enable closed-loop operation, the sensing circuit needs to work with concurrent stimulation. Therefore, it needs to provide a large input range to prevent saturation under stimulation artifacts. In addition, the sensing circuit should simultaneously meet device/patient safety constraints. Current state-of-the-art neural sensing circuits, however, do not meet these requirements. This work presents an implantable VCO-based neural-sensing front-end design intended for multi-channel, closed-loop neuromodulation applications. Specifically, it converts the input voltage into the phase domain, and performs direct digitization without any voltage-domain amplification, thus preventing saturation. The phase-domain processing allows a large input range that can comprise both stimulation artifacts and the neural signals. Four techniques have been implemented to overcome design challenges: (1) in the high-pass filter, we utilize a multi-rate duty-cycled resistor as a reliable solution to attenuate electrode-offsets; (2) inside of the VCO, chopping is applied to lower circuit noise; (3) at the analog-digital interface, we employ a new glitch-free quantizer; and (4) after digitization, circuit linearity is restored through the digital non-linearity correction. With these techniques, the design achieves 10x linear range and 2-3 bit ENOB improvement over prior-art with comparable power and noise performance. This work also presents a 32/64-channel sensing chip based on the proposed front-end design. The chip is assembled on a miniaturized PCB to achieve a fully integrated neuromodulation system. Sensing performance and function under concurrent stimulation have been verified in bench-top and in-vitro environments. This allows further development of a complete multi-channel closed-loop neuromodulation implant.

Distributed SQL Query Engines (DSQEs), like Hive, Shark, and Impala, have become the de-facto database set-up for Decision Support Systems with large database sizes. Unlike their single-threaded counterparts like MySQL, DSQEs experience inefficiencies related to the algorithm, code base, OS, and CPU micro-architecture that limit throughput despite the speedup from distributed execution. In my thesis, I present a detailed performance analysis of a DSQE called Hive, comparing it to MySQL, a single-threaded database application. Hive has difficulty converting queries into a set of MapReduce jobs for distributed execution. Hive also experiences a startup phase that is a significant overhead for short running queries. Additionally, both Hive and MySQL, like other server applications, experience high L1I miss rates due to a large code footprint. However, because MySQL is algorithmically efficient and traverses the database at a faster rate, it incurs a larger back-end bottleneck from LLC misses, which hides the front-end bottleneck. In contrast, Hive does not hide the high L1I cache miss rate with back-end stalls. Additionally, the higher context switch rates experienced by multi-process Hive setups thrash the first level caches, further inflaming the L1I cache miss rate. To address this micro-architectural inefficiency, I propose an instruction prefetch mechanism called Runahead Prefetch. It is similar to previously proposed branch prediction base prefetchers [19], but designed to easily extend modern Intel microarchitectures. Despite newer instruction prefetch mechanisms that discount branch prediction based prefching potential [8] [9] [12], I show Runahead Prefetch can eliminate 92% of L1I misses and 96% of icache stalls on average given modern branch misprediction rates and sufficient runahead.

Distributed SQL Query Engines (DSQEs), like Hive, Shark, and Impala, have become the de-facto database set-up for Decision Support Systems with large database sizes. Unlike their single-threaded counterparts like MySQL, DSQEs experience inefficiencies related to the algorithm, code base, OS, and CPU micro-architecture that limit throughput despite the speedup from distributed execution. In my thesis, I present a detailed performance analysis of a DSQE called Hive, comparing it to MySQL, a single-threaded database application. Hive has difficulty converting queries into a set of MapReduce jobs for distributed execution. Hive also experiences a startup phase that is a significant overhead for short running queries. Additionally, both Hive and MySQL, like other server applications, experience high L1I miss rates due to a large code footprint. However, because MySQL is algorithmically efficient and traverses the database at a faster rate, it incurs a larger back-end bottleneck from LLC misses, which hides the front-end bottleneck. In contrast, Hive does not hide the high L1I cache miss rate with back-end stalls. Additionally, the higher context switch rates experienced by multi-process Hive setups thrash the first level caches, further inflaming the L1I cache miss rate. To address this micro-architectural inefficiency, I propose an instruction prefetch mechanism called Runahead Prefetch. It is similar to previously proposed branch prediction base prefetchers [19], but designed to easily extend modern Intel microarchitectures. Despite newer instruction prefetch mechanisms that discount branch prediction based prefching potential [8] [9] [12], I show Runahead Prefetch can eliminate 92% of L1I misses and 96% of icache stalls on average given modern branch misprediction rates and sufficient runahead.

Abstract: Inductors are extensively used in the design of radio-frequency circuits. In the last decade, the integration of passive components, especially inductors on silicon chips, has led to the widespread development and implementation of Radio Frequency Integrated Circuits (RFICs) in CMOS technologies. However, on-chip passive inductors occupy a large silicon chip area and hardly scale down with technology scaling. Therefore, on-chip passive inductors become formidable obstacles to the realization of highly dense RFICs to be integrated with other highly dense digital circuits on a single chip using a common fabrication process. In recent years, researchers have focused on replacing passive inductors with transistor-only active circuits, namely active inductors. Active inductors can be realized with only a few transistors, which scale down with technology scaling. Therefore, they occupy a fraction of the chip area of their passive counterparts, and can be implemented densely in CMOS processes. Unlike passive inductors, bias dependent operations of active inductors allow for the tuning of their inductance and quality factor Q, and in turn, tuning the performance parameters of RFICs. This thesis focuses on the design and development of passive inductorless CMOS RFICs for ultra-wideband (UWB) receiver front-ends using active inductors. A new Q-enhanced and a new bandwidth-extended tunable active inductors are designed. Using the Q-enhanced active inductor, two tunable UWB low-noise amplifiers (LNAs) (two-stage and three-stage UWB LNAs), a UWB mixer and a wideband local-oscillator (LO) driver are designed. Active inductors are utilized to develop a novel wideband active shunt-peaking technique that decreases high-frequency losses to yield a flat gain over a wide bandwidth. A tunable multiband-UWB front-end integrating a two-stage UWB LNA, and a pair of UWB mixers driven by a pair of wideband LO drivers, is fabricated in a 90nm digital CMOS process. The passive inductorless two-stage UWB LNA, three-stage UWB LNA and UWB front-end occupy chip areas of only 0.0114mm2, 0.0227mm2, and 0.1485mm2, respectively. The active CMOS UWB front-end exhibits a measured flat gain of 22.5dB over 2.5-8.8 GHz bandwidth, and its tunability allows for varying the gain and bandwidth.

With the development of information technology, power management for telecom and computer applications become a large market for power supply industries. To meet the performance and reliability requirement, distributed power system (DPS) is widely adopted for telecom and computer systems, because of its modularity, maintainability and high reliability. Due to limited space and increasing power consumption, power supplies for telecom and server systems are required to deliver more power with smaller volume. As the key component of DPS system, front-end AC/DC converter is under the pressure of continuously increasing power density. For conventional industry practices, some limitations prevents front-end converter meeting the power density requirement. In this dissertation, different techniques have been investigated to improve power density of front-end AC/DC converters. For PFC stage, at low switching frequency, PFC inductor size is large and limits the power density. Although increasing switching frequency can dramatically reduce PFC inductor size, EMI filter size might be larger at higher switching frequency because of the change of noise spectrum. Since the relationship between EMI filter size and PFC switching frequency is unclear for industry, PFC circuits always operate with switching frequency lower than 150 kHz. Based on the EMI filter design method, together with a simple EMI noise prediction model, relationship between EMI filter corner frequency and PFC switching frequency was revealed. The analysis shows that switching frequency of PFC circuit should be higher than 400 kHz, so that both PFC inductor and EMI filter size can be reduced. Although theoretical analysis and experimental results verify the benefits of high switching frequency PFC, it is essential to find a suitable topology that allows high switching frequency operation while maintains high efficiency. Three PFC topologies, single switch PFC, three-level PFC with range switch and dual Boost PFC, were evaluated with analysis and experiments. By using advanced semiconductor devices, together with proposed control methods, these topologies could achieve high efficiency at high switching frequency. Thus, the benefits of high frequency PFC can be realized. In front-end converter, large holdup time capacitor size is another barrier for power density improvement. To meet the holdup time requirement, bulky holdup time capacitor is normally used to provide energy during holdup time. Holdup time capacitor requirement can be reduced by using wider input voltage range DC/DC converte. Because LLC resonant converter can realized with input voltage range without sacrificing its normal operation efficiency, it becomes an attractive solution for DC/DC stage of front-end converters. Moreover, its small switching loss allows it operating at MHz switching frequency and achieves smaller passive component size. However, lack of design methodology makes the topology difficult to be implemented. An optimal design methodology for LLC resonant converter has been developed based on the analysis on the circuit during normal operation condition and holdup time. The design method is verified by a 1 MHz switching frequency LLC resonant converter with 76W/in3 power density. When front-end converter operates at high switching frequency, negative effects of circuit parasitics become more pronounced. By integrating active devices together with their gate drivers, Active Integrated power electronics module (IPEM) can largely reduce circuit parasitics. Therefore, switching loss and voltage stress on switching devices can be reduced. Moreover, IPEM concept can be extended into passive integration and EMI filter integration By using this power integration technology, power density and circuit performance of front-end converter can be improved, which is verified by theoretical analysis and experimental results.

As silicon technology has advanced in the last five years, this has lead to a new area of silicon MMIC design. In this thesis, voltage controlled oscillators and sub-100 ps RF switching networks at 24 GHz as well as a 12 GHz phase shifter have been demonstrated in a SiGe bipolar process using extensive electromagnetic simulation for passive component design. The design of a differential VCO is optimized for K-band operation at 24 GHz using a novel differential circular inductor in the LC resonator. The compact differential VCO at 22.8 GHz has an average output power of 2.2 dBm, a SSB phase-noise of -104 dBc/Hz at 1 MHz offset and a FOM of -175 dB while maintaining a small footprint of only 230 x 290 mum 2. The proposed RF switching topology implements a differential absorptive SPDT at 24 GHz. An RF envelope switching time of 70 ps is achieved through the use of differential current steering. The switching time of the RF envelope is analyzed analytically and agrees well with simulated and measured results. The SPDT switch achieves 1.9 dB of gain at 24 GHz and an isolation of 35 dB. A 12 GHz phase shifter with integrated LNA is designed without the use of a FET or a quality diode as a switching element. The LNA implements a digital 180° phase shift using a switched high-pass/low-pass network where the cascode stage of the LNA implements an SPDT function. Following the LNA is an analog phase shifter that uses varactors to implement a novel constant-impedance tuning technique which tunes the phase while simultaneously compensating for mismatch introduced by the variable load capacitance. The complete phase shifter has a measured gain of 3.7 +/- 0.5 dB at 11.5 GHz with a noise figure of 4.4 dB with a constant (+/-10°) phase shift over more than 1 GHz of bandwidth.

In 1997 the Federal Communications Commission (FCC) released 300 MHz of spectrum between 5-6 GHz designated the unlicensed national information infrastructure (U-NII) band. The intention of the FCC was to provide an unlicensed band of frequencies that would enable high-speed wireless local area networks (WLANs) and facilitate wireless access to the national information infrastructure with a minimum interference to other devices. Currently, there is a lack of cost-effective technologies for developing U-NII band components. With the commercial market placing emphasis on low cost, low power, and highly integrated implementations of RF circuitry, alternatives to the large and expensive distributed element components historically used at these frequencies are needed. Silicon Germanium (SiGe) BiCMOS technology represents one possible solution to this problem. The SiGe BiCMOS process has the potential for low cost since it leverages mature Si process technologies and can use existing Si fabrication infrastructure. In addition, SiGe BiCMOS processes offer excellent high frequency performance through the use of SiGe heterojunction bipolar transistors (HBTs), while coexisting Si CMOS offers compatibility with digital circuitry for high level 'system-on-a-chip' integration. The work presented in this thesis focuses on the development of a SiGe RFIC front-end for operation in the U-NII bands. Specifically, three variants of a packaged low noise amplifier (LNA) and a packaged active x2 sub-harmonic mixer (SHM) have been designed, simulated and measured. The fabrication of the Rifts was through the IBM SiGe foundry; the packaging was performed by RF Micro devices. The mixer and LNA designs were fabricated on separate die, packaged individually, and on-chip matched to a 50 ohm system so they could be fully characterized. Measurements were facilitated in a coaxial system using standard FR4 printed circuit boards. The LNA designs use a single stage, cascoded topology. The input ports are impedance matched using inductive emitter degeneration through bondwires to ground. One version of the LNA uses an shunt inductor/series capacitor output match while the other two variation use a series inductor output match. Gain, isolation, match, linearity and noise figure (NF) were used to characterize the performance of the LNAs in the 5 - 6 GHz frequency band. The best LNA design has a maximum gain of 9 dB, an input VSWR between 1.6:1 and 2:1, an output match between 1.7:1 and 3.6:1, a NF better than 3.9 dB and an input intercept point (IIP3) greater than 5.4 dBm. The LNA operates from a 3.3 V supply voltage and consumes 4 mA of current. The SHM is an active, double-balance mixer that achieves x2 sub-harmonic mixing through two quadrature (I/Q) driven, stacked Gilbert-cell switching stages. Single-ended-to-differential conversion, buffering and I/Q phase separation of the LO signal are integrated on-chip. Measurements were performed to find the optimal operating range for the mixer, and the mixer was characterized under these sets of conditions. It was found that the optimal performance of the mixer occurs at an IF of 250-450 MHz and an LO power of -5 dBm. Under these conditions, the mixer has a measured conversion gain of 9.3 dB, a P_1-dB of -15.7 dBm and an 2LO/RF isolation greater than 35 dB at 5.25 GHz. At 5.775 GHz, the conversion gain is 7.7 dB, the P1-dB is -15.0 dBm, and the isolation is greater than 35 dB. The mixer core consumes 9.5 mA from a 5.0 V supply voltage. This work is sponsored by RF Microdevices (RFMD)through the CWT affiliate program.The author was supported under a Bradley Foundation fellowship.