From 69daf158fe83e49d420e97fc5bbf91f32798585a Mon Sep 17 00:00:00 2001 From: jaseg Date: Mon, 15 Mar 2021 11:25:49 +0100 Subject: Repo re-org: rename paper dir --- doc/paper/.gitignore | 10 + doc/paper/Makefile | 35 + doc/paper/circuits.ipynb | 1115 ++++++++ doc/paper/concept_vis_one_axis.pdf | Bin 0 -> 6623 bytes doc/paper/concept_vis_one_axis.svg | 344 +++ doc/paper/goette_inertial_hsms_v1_5_eprint.pdf | Bin 0 -> 112344 bytes doc/paper/ir_tx_schema.pdf | Bin 0 -> 4112 bytes doc/paper/ir_tx_schema.svg | 340 +++ doc/paper/mesh_gen_viz.pdf | Bin 0 -> 6880 bytes doc/paper/mesh_gen_viz.svg | 1547 +++++++++++ doc/paper/mesh_scan_crop.jpg | Bin 0 -> 400578 bytes doc/paper/photolink_schematic.pdf | Bin 0 -> 15968 bytes doc/paper/photolink_schematic.pro | 43 + doc/paper/photolink_schematic.sch | 486 ++++ doc/paper/photolink_schematic.svg | 3246 ++++++++++++++++++++++++ doc/paper/proto_3d_design.jpg | Bin 0 -> 63447 bytes doc/paper/prototype_early_comms_small.jpg | Bin 0 -> 518517 bytes doc/paper/rotohsm.bib | 200 ++ doc/paper/rotohsm_paper.pdf | Bin 0 -> 1190616 bytes doc/paper/rotohsm_paper.tex | 609 +++++ doc/paper/rotohsm_tech_report.pdf | Bin 0 -> 111459 bytes doc/paper/rotohsm_tech_report.tex | 300 +++ 22 files changed, 8275 insertions(+) create mode 100644 doc/paper/.gitignore create mode 100644 doc/paper/Makefile create mode 100644 doc/paper/circuits.ipynb create mode 100644 doc/paper/concept_vis_one_axis.pdf create mode 100644 doc/paper/concept_vis_one_axis.svg create mode 100755 doc/paper/goette_inertial_hsms_v1_5_eprint.pdf create mode 100644 doc/paper/ir_tx_schema.pdf create mode 100644 doc/paper/ir_tx_schema.svg create mode 100644 doc/paper/mesh_gen_viz.pdf create mode 100644 doc/paper/mesh_gen_viz.svg create mode 100644 doc/paper/mesh_scan_crop.jpg create mode 100644 doc/paper/photolink_schematic.pdf create mode 100644 doc/paper/photolink_schematic.pro create mode 100644 doc/paper/photolink_schematic.sch create mode 100644 doc/paper/photolink_schematic.svg create mode 100644 doc/paper/proto_3d_design.jpg create mode 100644 doc/paper/prototype_early_comms_small.jpg create mode 100644 doc/paper/rotohsm.bib create mode 100644 doc/paper/rotohsm_paper.pdf create mode 100644 doc/paper/rotohsm_paper.tex create mode 100644 doc/paper/rotohsm_tech_report.pdf create mode 100644 doc/paper/rotohsm_tech_report.tex (limited to 'doc/paper') diff --git a/doc/paper/.gitignore b/doc/paper/.gitignore new file mode 100644 index 0000000..c49262e --- /dev/null +++ b/doc/paper/.gitignore @@ -0,0 +1,10 @@ +*.out +*.bbl +*.aux +*.toc +*.blg +*.bcf +*.log +*.run.xml + +version.tex diff --git a/doc/paper/Makefile b/doc/paper/Makefile new file mode 100644 index 0000000..8a4bc75 --- /dev/null +++ b/doc/paper/Makefile @@ -0,0 +1,35 @@ + +LAB_PATH ?= ../lab-windows + +SHELL := bash +.ONESHELL: +.SHELLFLAGS := -eu -o pipefail -c +.DELETE_ON_ERROR: +MAKEFLAGS += --warn-undefined-variables +MAKEFLAGS += --no-builtin-rules + +main_tex ?= rotohsm_paper +brief_tex ?= rotohsm_tech_report + +VERSION_STRING := $(shell git describe --tags --long --dirty) + +all: ${main_tex}.pdf ${brief_tex}.pdf + +%.pdf: %.tex rotohsm.bib version.tex + pdflatex -shell-escape $< + biber $* + pdflatex -shell-escape $< + +version.tex: ${main_tex}.tex ${brief_tex}.tex rotohsm.bib + echo "${VERSION_STRING}" > $@ + +resources/%.pdf: $(LAB_PATH)/%.ipynb + jupyter-nbconvert --to=pdf --output-dir=resources --output=$* --LatexExporter.template_file=resources/nbexport.tplx $^ + +.PHONY: clean +clean: + rm -f ${main_tex}.aux ${main_tex}.bbl ${main_tex}.bcf ${main_tex}.log ${main_tex}.blg + rm -f ${main_tex}.out ${main_tex}.run.xml texput.log + rm -f ${brief_tex}.aux ${brief_tex}.bbl ${brief_tex}.bcf ${brief_tex}.log ${brief_tex}.blg + rm -f ${brief_tex}.out ${brief_tex}.run.xml texput.log + diff --git a/doc/paper/circuits.ipynb b/doc/paper/circuits.ipynb new file mode 100644 index 0000000..2e78b30 --- /dev/null +++ b/doc/paper/circuits.ipynb @@ -0,0 +1,1115 @@ +{ + "cells": [ + { + "cell_type": "code", + "execution_count": 1, + "metadata": {}, + "outputs": [], + "source": [ + "import schemdraw\n", + "from schemdraw import elements as elm" + ] + }, + { + "cell_type": "code", + "execution_count": 123, + "metadata": {}, + "outputs": [ + { + "data": { + "image/png": "iVBORw0KGgoAAAANSUhEUgAAAHEAAABVCAYAAAB+QwvwAAAAOXRFWHRTb2Z0d2FyZQBNYXRwbG90bGliIHZlcnNpb24zLjMuMywgaHR0cHM6Ly9tYXRwbG90bGliLm9yZy/Il7ecAAAACXBIWXMAAAsTAAALEwEAmpwYAAAFWklEQVR4nO2dbYgVVRjHf8+uu1KJqbW0ltYWIbGUkVgE9cHFsDKzD0F9aYkg+qAg9EGCCqN33Iwg8kP0whKSSAWBuBhFBhJBUtGuayClwi66roa9mW2+PH2Y57LjZe/dcebOvXdOzw8Os3PmmfM8Z/73zJk5Z2ZWVBWn2LQ0OgAnOy5iALiIAeAiBoCLGAAuYgC4iAHgItYAEekXEbV0WkTGRWSXiKwVkTazaRORjSIyKCInReSIiHwoIldn9e8i1o4vgPlAF7AC2A48D+wWkUuAi4ElwMu2fABYCOwUkRlZHIuP2GRHRPqBy1V1VVn+jcD3wKuq+twU+3UDw8BiVR1K699bYo6o6l5gJ/BgBZPZtjyRxY+LmD/7gOvKM0WkHXgd2K6qo1kcZDoXO4kQ4Lw+y/rALcAcYHVWBy5i/nQDB0orJuBW4CZgmar+mtWBn05zxC5s7gE+tvU2YBuwGOhR1bFa+PGWWDtmikgnUcPoAJYDTwPfAZusBX4E3ArcD6jZA/yuqqfSOvZbjBpgtxiP2upZ4DdgL/AJ8Laq/isiXcDBCkU8pqr9qf27iMXH+8QAcBEDwEUMABcxAFzEAHARA8BFDAAXMQBcxABIJKKI7Ig9Q5ImjeddkWbGnrlJc9x2JCm/Xi2xo05+mpVc65/72KmIKICqSq6Ompi8j4H3iQHgIgaAixgALmIAuIgB4CIGgIsYAC5iALiIAeAiBoCLGACFegJcRNYCtwODwJClw/o/f3i2UCIC1wCPlOWdEJG4qIPAXlX9q97BNYpCzWKIyABwb0Lzg0yKOqCq32T1n5a8ZzEyiygivcDSKibrbPlmFZtBVX0vga+0wY6oauYPHFTCJm9XZixmQFXvS7Njthf+ozd93gXaE5ivq7LtnIhsVdW/pyljApiZNL4Yf6TYpzBkElFVz4jIG8BTlvUKkPRRjHnABvt7cwIBIWrN6ytsG2fy9FnqH/clLDcTlVqQiPQQfVWjdBfwE3BbzftrVc2UiH4Iu4leaf4caE2wTwvRJ0IU+BZoT+irDzgF7AHeB54E7gKuyFqPWiegExizOm4i+kqGAh9g3VjNfNUo4KuAYxbkhgT26832BNB1AX4uTfIjaXQCWoFdVscvbb0bOGl5jzediBb4CuCcpeVV7O4AzlhlVjf6gOck4otWvzGgM5bfa/n/ADc3nYgW5AsW5FFg/hTbO4BRs3mt0Qc7JwHvth/yWaL38su3v2P13w/MbkYRW+30ocBXwIzYthaiD/Mo8DXQ1ugDnoOAC2LdyrMVbC4CfjSbbbXoH/OoSLxDfymW/4zlHQcWNPqA51DvttgF3mdASxXbRcCfZrum6US0IHvsdKJEnwBZFl/PUO5K4Ami8dNZjRauLLaNVr9RoCOB/cNmPwEsbToRLch4yztS3jJTltln5ZTSAeBTu5B4CLghfgqvo4CrLJ4zwJ0XsN9bsXrMSeu/FsNudRtyEpHNwJppzCaI7sniA+I/qOrxjDFWimke8DMw13yPTGF2pS0Pl+W3A6XhwC2q2psmhqLNYkwnIETDcksslRhh8mDVmrnArJjv66vYVtu2MG0ARZvFSBvsIVW9Nqv/SlhrvKyKyX5bLqpic0hVT6fyXzAR+6g8dgrRTfQw54+fDqnq0ay+s5D3VFTRTqclShcD8QHvQeAXVT3byMAaQdFa4i1EFwPDWqCZ+6afFJ7Wgb+f6O8nOtPjIgaAixgALmIAuIgB4CIGgIsYAC5iALiIAeAiBoCLGAC5f2Ux7woUiaJ/ZfFYnfw0K7nW3/9DTQB4nxgALmIAuIgB4CIGgIsYAC5iALiIAeAiBsB/Lc+Etv85bQ8AAAAASUVORK5CYII=\n", + "image/svg+xml": [ + "\n", + "\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " 2020-12-01T15:29:56.159415\n", + " image/svg+xml\n", + " \n", + " \n", + " Matplotlib v3.3.3, https://matplotlib.org/\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "\n" + ], + "text/plain": [ + "<__main__.DiodeOptocoupler at 0x7ff215993c70>" + ] + }, + "execution_count": 123, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "class DiodeOptocoupler(schemdraw.elements.compound.ElementCompound):\n", + " def __init__(self, *args, **kwargs):\n", + " unit = 1.5\n", + " super().__init__(*args, unit=unit, **kwargs)\n", + "\n", + " box = kwargs.get('box', True)\n", + " boxfill = kwargs.get('boxfill', False)\n", + " bpad = kwargs.get('boxpad', .2)\n", + " label1, label2 = kwargs.get('label1'), kwargs.get('label2')\n", + " rev1, rev2 = kwargs.get('reverse1', False), kwargs.get('reverse2', False)\n", + "\n", + " D1 = self.add(elm.Diode(d='down', reverse=rev1))\n", + " D2 = self.add(elm.Diode(d='down', reverse=rev2, at=[2, 0]))\n", + " if label1:\n", + " self.segments.append(schemdraw.segments.SegmentText(D1.start + (0, 0.5), label1))\n", + " if label2:\n", + " self.segments.append(schemdraw.segments.SegmentText(D2.start + (0, 0.5), label2))\n", + " \n", + " self.add(elm.Arrow('r', at=[.6, -unit/2 + .2], l=.4, headwidth=.15, headlength=.4))\n", + " self.add(elm.Arrow('r', at=[.6, -unit/2 - .2], l=.4, headwidth=.15, headlength=.4))\n", + "\n", + " bbox = self.get_bbox()\n", + " if box:\n", + " self.add(elm.Rect(\n", + " 'r', at=[0, 0],\n", + " corner1=[bbox.xmin-bpad, bbox.ymin-bpad],\n", + " corner2=[bbox.xmax+bpad, bbox.ymax+bpad],\n", + " fill=boxfill, zorder=0))\n", + "\n", + " A = self.add(elm.Line('r', at=D2.start, l=bpad*2))\n", + " B = self.add(elm.Line('r', at=D2.end, l=bpad*2))\n", + " C = self.add(elm.Line('l', at=D1.start, tox=bbox.xmin-bpad))\n", + " D = self.add(elm.Line('l', at=D1.end, tox=bbox.xmin-bpad))\n", + " self.anchors['anode1'] = C.end\n", + " self.anchors['cathode1'] = D.end\n", + " self.anchors['anode2'] = B.end\n", + " self.anchors['cathode2'] = A.end\n", + "DiodeOptocoupler(box=False, reverse2=True, label2='D2')" + ] + }, + { + "cell_type": "code", + "execution_count": 177, + "metadata": {}, + "outputs": [ + { + "data": { + "image/png": "iVBORw0KGgoAAAANSUhEUgAAA4oAAAEgCAYAAADylY1ZAAAAOXRFWHRTb2Z0d2FyZQBNYXRwbG90bGliIHZlcnNpb24zLjMuMywgaHR0cHM6Ly9tYXRwbG90bGliLm9yZy/Il7ecAAAACXBIWXMAAAsTAAALEwEAmpwYAAAvmklEQVR4nO3dd7xsVXn/8c8XEI2ggkpTg2BBwYb+sMSoWFARFHsBNcGIJtEEIyr2HgtiN3aNJEZUsEW9iIhgTSyoCFiwYgWliERA6vP7Y+3xzhzPvffce8+ZPeXzfr3mdc7svWb2M/fumTPPXms9K1WFJEmSJEkDm/QdgCRJkiRpspgoSpIkSZJGmChKkiRJkkaYKEqSJEmSRpgoSpIkSZJGmChKkiRJkkaYKEqSJEmSRpgoSpIkSZJGbNZ3AJI0DZL8Ftim7zgkSdKfHFNV+/YdxKyyR1GSlsYkUZIkzQ17FCVpPVRV+o5BkiRppdmjKEmSJEkaYaIoSZIkSRphoihJkiRJGmGiKEmSJEkaYaIoSZIkSRphoihJkiRJGmGiKEmSJEkaYaIoSZIkSRphoihJkiRJGmGiKEmSJEkaYaIoSZIkSRphoihJkiRJGmGiKEmSJEkaYaIoSZIkSRphoihJkiRJGmGiKEmSJEkaYaIoSZIkSRphoihJkiRJGmGiKEmSJEkaYaIoSZIkSRphoihJmjhJtkvyhiQ/TnJJkl8l+VSSfbr9T0xyYpLzk1SSnXoOWZKkmbJZ3wFIkjSsS/q+DPwf8Gzg27QLm/cC3gbsCFwdOA74b+B1vQQqSdIMS1X1HYMkTbwkBVBV6TuWWZfkGGB3YJeq+sOCfVtX1e+G7u8BfB3YuarOGGeckiTNMoeeSpImRpJrA3sD/7YwSQQYThIlSdLKMVGUJE2SmwABvtd3IJIkzTMTRUnSJHForyRJE8BEUZI0SX4IFLBr34FIkjTPTBQlSROjqs4DPg38U5ItF+5PstXYg5IkaQ6ZKEqSJs2TaENQT0ry8CQ3S3LzJP8InAKQZPskuwO7dI/ZLcnuXTEcSZK0kVweQ5KWwOUxxivJDsBzgH2B6wPn0tZTfGNVfSrJi4AXLvLQx1XVEeOKU5KkWWWiKElLYKIoSZLmiUNPJUmSJEkjTBQlSZIkSSNMFCVJkiRJI0wUJUmSJEkjTBQlSRMryaokq5a6XZIkLQ+rnkrSElj1tB9r+nf3/0OSpJVlj6IkSZIkaYSJoiRJkiRphImiJEmSJGmEiaIkSZIkaYSJoiRJkiRphImiNKWSXK3vGCRJkjSbNus7gPWV5LfANn3HIU2CJCdX1W37jkOTb1Y/OwfLZGiszq6qbfsOQpK0sqaxR3HmvuhIG+GafQegqeFnp5aL55IkzYGp61EccJFlzbMkhwKHAR/uOxZNl2n77FxXj+G0vZ5pZw+uJM2PaexRlCRJkiStIBNFSZIkSdIIE0VJkiRJ0ggTRUmSJEnSCBNFSZIkSdIIE0VJkiRJ0oipXR5DkjQXjlnP7ZIkaRmYKEqSJlZV7bs+2yVJ0vJw6KkkSZIkaYSJoiRJkiRphImiJEmSJGmEiaIkSZIkaYSJoiRJkiRphImiJEmSJGmEiaIkSZIkaYSJoiRJkiRphImiJEmSJGmEiaIkSZIkaYSJoiRJkiRphImiJEmSJGmEiaIkaWIkOSJJdbfLk/w8yVuTbD3U5p1Jfpzk4iRnJ/nvJLv2GbckSbPGRFGSNGmOB3YAdgIOAh4AvGVo/0nAgcCuwH2BAMcnucpYo5QkaYZt1ncAkiQtcElVndX9/sskH6QlhgBU1duH2p6R5HnAt4EbAaePLUpJkmaYPYqSpImV5EbA3sBla9i/BfA44OfAGeOLTJKk2WaPoiRp0uyd5A/ApsDVum2HDDdI8iTgVcAWtF7Ee1XVJWONUpKkGWaPoiRp0nwB2B24A/Am4BjgjQvavA+4LbAn8APg6CRXH2OMkiTNNBNFSdKkuaiqflRVp1bVwcDVgecPN6iq31fVD6vqC8DDgF2Ah/YQqyRJM2kqhp4m2YF2dXm3oW3PAn4CnAz8qKqu7CU4qV/bJNmsqi7vOxBpBb0Y+FSSd1TVrxfZn+521fGGJUnS7JrYRDHJ7Whl0R8MbL9Ik1cM/X5hkhOAdwHH+KVZc+DC7ueBwH5JPgl8FDiuqi7qLSppBVTV55J8B3hektfSeg6PB84GbgA8C7gE+GR/UUqSNFtSVX3HMCLJ/YCX0eaeDFxA6zk8FfgdcCWtgMHNunbXH2p7JvBa4A1VtWiVPGnaJbkG8EzakLubDe26GPg08DHgk1V17vijm01JCqCq0ncsG2Ja4k9yBHDdqrr/gu0HAO+hDTF9G/D/gK2A39DmNL60qr4/1mDn0LScR5KkjTcxiWKS7YHXA4/sNp0H/Cfti8GptZZAu6Gpj6b1QA6+NH8beGJVfW2lYpYmQZKbAw+i9b7fYWjXFcBjquoDfcQ1a6b9C/K0x6/J4HkkSfNjIorZJLkr8B1akngR8Azg+lX11Ko6ZW1JIkBVnVlVrwZ2BfYFfgrcBvhKkqcl8Q+aZtnvgHO723Av+qa0IiCSJEnSeum9RzHJPsBHaEUIjgeeUFVnrKX9KoCq2nctba5OK37w9G7Tq4BnrSvhlKZFtwj5g7vbnWmFPAAK+BJt6OnHquonvQQ4g6a9J2Xa49dk8DySpPnRa6LY9SQeD2wOvB34p3UVolmfP1JJ9qcNX90MeH5V/etGBy31oOsV353VQ0xvNbT7UuAztOTw41X12zGHNxem/QvytMevyeB5JEnzo7dEMclWtHmEOwJvBZ68lB6/9f0jleShwNG0npa7VtX/bGjM0jgl2RS4Cy05fBCw09DuC4BVtOTwU1X1f+ONbv5M+xfkaY9fk8HzSJLmR59zFN9MSxK/DjxlHcVqViWpwR+oblt1t1VrO0hVfZg29HQT4L+SXHN5wpdWTpK/Bn4NfA74F1qSeBat5/1+wLZVdUBVHWWSqGmTZJckX0xyzyW0vV+SzyfZaQltn5rko930A0mStBF6SRST3AU4gFa45jFjWMbiBcC3gJ1phXKkSbczsO3Q/SuAz9KWvvhiVV3SS1TS8jiU1lv+kiW0fTlwN+Cpa2vULRnzMlrv+0M3Mj5JkuZeL0NPk3wYeAjwr1X1/PV87AYNe+nmQ34BOAfYsaouXp/HS+OWZA9WF6zZdWjXxcBxtGGnn3CtxPGY9iF3kxJ/kqvResev1W3aeU0FzJLsRquIDfBbWjXsReexJ3ksbU46wKerau9lC1p/MinnkSRp5a2zRzHJi4aGeQ5uZ3X7TknyrjU8bp+u7S4Ltu9Mu+J7GfCWjX8JS/Yl4BvAdWlrLkrLKskRQ++Ry5P8PMlbk2w91OaJSU5Mcn7Xbqc1PV9VnVRVz62q3YCbA88Cvgr8BfBA2hqjv0lyQpKDk+y4sq9QWhb3Y3WSCLD/WtoeMPT7tsDahqoOt90ryXYbEJskSeosdejp6cAOQ7dBxcV3A49MssUij/k72hC5HyzY/uDuuB+uqjPXP2SO6W7rpZsD+abu7sM34LjSUhxPe4/sBBwEPIDRCyJXp/UGvmh9nrSqTq+qw6rqTsD1gSfRKp0WcA/gDcDPknwjyfOS3NL1QzWhBgndiQvuj+jO36W23Ra4N3A58GXaGqJ+zkuStBGWmiheXlVnDd3O7ra/F7gK8Ijhxkm2AfYDFuttvEP387MbEnBV7bu2NRTX4YTu5+39Eq0Vckn3HvllVR0HfBC4z2BnVb2+ql5B6+HeIFX166p6a1XdB9gGeAzwIeBC4HbAS4FTgR90RXE054Yv5iU5sBv+2Ucc16JdPCng8cB5wC2T3HqR5neizdX9Fe3CCMBDkvzFIm0fQUsOjwX+rdvmyJFlluR6Q78/2L+jkjTblpoo3ijJr5L8NMkHusW+qarzaPOk/m5B+8fS5lF9aJHnGiSKX92AeDfWL2lzY7YGbtzD8TVHuvfJ3rRh1iuiqs4HjgReQVtm5tKh3Teh9TZqjiXZAThpaNN7gK8muW4P4TwYuCrw+ar6KW3pIli8p3Cw7QNV9X3aa7gGcP+1tD0S+ATtosmdBn+rtPGS3BE4ZWjTR4APJ9msp5AkSStsKR/wXwUOBL5PmyPyPOB/ktyiK6LxLuAzSXYZGmb6d8CRVXXR8BMluQrtCvGVwPeW5yUsXVVVklOA7YGbAT8adwyaeXsn+QOtd2PQa3PIch+k+3J2F9oX7wfRlpoZGKyx+FHalznNt3fS5rgOuzXwgSTPGXMsg4uKRw79/Htg/yTPqaor4U/n9yMXabsHLSkcJJiDCzJ/RUsOP15VFyb5GK1HcX9aJdRB281pUyc2XfZXtnSXAd8evNZp0K3p+hHgOgt2PZj2+faqsQclSVpx60wUq+pTw/eTfAX4CfC3wGtpQ0h/SvsC8KzuquMtuv0LDYYMXbymynVj8IcFsUjL6QvAE2nn1xNoPddvXI4n7obc3Zv25ewBjH5pO4vWu/8x4MSqunTh4zW37riG7fein5EdlwEf7n7/EvAL2oWOvwa+2G3fizas+vu0pY0APgC8BtgnydZV9btu+6AYzseq6sLu9/fREsVHJ3n50Dq9/86EDEmdoVGbd1h3E0nSNFrvISNV9Yck3wFu2t2vJO8B/jHJc2nzTr5dVd9Y5OGD5LDPq7mDY/eVqGq2XVRVg57qg5OcCDyf9SxeM9BVTN2XlhzuTSuGM/BDWq/hR4GvTVMPhcbqAlq154UuBk4bcywAH+ymLVBVVyZ5P21dxQNYnSj+aSjpIMmrqjOTnEBLcB8KvKubIzdI/AY9j9CKSp1DW1bmNsDJ3Xvp4bT5kcNDccftJrTpD7Pigr4DkCStjPVOFLsiCDdndRU6aHNeXkT7I/woYE3Dmf4IXAJcLclW3fyqcduh+9nHsTV/Xgx8Ksk7qurXS31QkhvTqqXek9H36Um0XsOPAt8b6imR1uStwOGLbH9aVb113MEs4n20RPERSZ5CO98f3O07cpG296Ilh++iJYG70pLCzwwaVdVlST4IPLlrezJt7d7Ngc9W1V4r9WJmVZfQP2rB5sto1c8lSTNoKesovjrJnkl27oaVfgjYAviPQZuq+iXwadoX26vQ/pj/ma7HYzCMaI+NjH29dfNTdu/unjzu42v+VNXnaAuGPw8gyfZJdgcG64vulmT3JNde8NAH0KqlDpLEK2jD7h5WVS+rqu+aJGqJXkNLxAYuBA4G3tZPOH/mVNp75Nq0c/4BwJbAV6vqxwvafoR2sXHPJDdgdc/jUVW1sGjUIMncP8kmLN7zqKX7O9p814Ezgf2q6ss9xSNJWmFLqXp6A+D9tLUUB3+k71RVP1vQ7l204TQfGZo7spivdT/XNG9mJd2adkX59J56MzWfXgs8PskNgX+gXSwZXExZ1d3fb8Fj3ty1PY42THpT4GnAGUm+meT5SW5leXqtSzXDPYrXqKo3TcqFhi6OQfJ2AKMVTBe2/T3tPRPa3MT919QW+F/gDNq6o48C7k6rCmyBpw1QVRdX1ROH7l+vqo7tMyZJ0srKuL8rJHk4cBStzPbu4/yykuRw4OnAu6vqoHEdV9oYSbYC9qFVN92H1qM/8GPaMNSPAV+pqivGHN7cSDKYKzeVyfkkx59kZ1qRtItpveibAterqt8s0vYhtGI45wNb0ZLBGy32tyTJy2hTIQZtP1JVD12BlzA3Jvk8kiQtrz4SxasCPwO2A+5ZVSeu4yHLddwtaesoXgu4fVX1WcxA2iDdHOG9aHO49mO0SMlvgI/TEscTquqS8Uc4u6b9C/Kkx5/ky8Cdu7vHVdV919DuarRz/ZrdpldU1aLz4pPcgtGCPQ+rqg8v1lZLM+nnkSRp+Sxl6Omy6r68vqW7++ylDJ1LsipJreG2aomH/gdakvhlk0RNq6r6Y1V9sqoeT1sPdE/gdbRele1oS3IcA5yd5APdcFdpGhy5ht9HVNUfWb28xrrafofVi8QP1heVJElLMPZEsfM24Pe0NeGesNIHS7Ib8NLu7itX+njSOFTVFVX1hao6hLZ26Qtpc7AArkFbsPzJfcUnraejaHPg/0DrFV+b/+x+fquq1rXEx6Dw2lFdkilJkpZg7ENP/3TgZH/aleCLgNtV1ekrdJyrAl+hVTs9oqoetxLHkcatWxfu/rRhqPdldI3FH9C+bB+2juJSWqJpH3I3DfEnuQNweVV9cwlt9wa+X1VnrKPdZrR1Fz9VVa75t5Gm4TySJC2P3hJFgCT/RStZ/jNgz0UqqW7s829OW87jAbRCCbtX1f8t5zGkceqWBHggLTm8O63ox8DXWb3G4vcnparlrJj2L8jTHr8mg+eRJM2PvhPFa9LK/98R+DWwb1WdvEzPvRVtHss9gfNohXO+vRzPLY1Tkl1pieGDgNsP7boC+BwtMfx4Vf1i7MHNkWn/gjzt8WsyeB5J0vzoNVEESHItWqXGuwGXAa+gVbHboLkkXXGchwJvBHYAzgLut1wJqDQOSa4BPBt4CHCzoV0XA8fSksNVVXVeD+HNpWn/gjzt8WsyeB5J0vzoPVGEP5U7fwMwWMz3dFrRmaOr6sIlPscmtN7DQ4D7dZv/FzhgXXNYpEmT5JmMFl66Angt8JKq+kM/Uc23af+CPO3xazJ4HknS/JiIRHEgyV2BdwA37zZdAHwQ+CJwMm3e1WVd2wA70orU3B44ANh56HHPBN5RVVeOKXxp2SS5LvBy2nDTbYZ2/Rb4b9pcxM+6VuL4TPsX5GmPX5PB80iS5sdEJYrwpyqljwEeD/zVgt2Xdz+L1sNytQX7fw68m5YgnrWScUrjkGRT2vvgwd1t56HdFwAPrqoT+oht3kz7F+Rpj1+TwfNIkubHxCWKw5LcgvblePfuduMFTc4GvkXrbfwsrYflivFFKI1P14t+K9p74rG098PhVXVor4HNiWn/gjzt8WsyeB5J0vzYrO8A1qaqvgN8Z3C/m8t4cXd3S+AilwDQvOjO9VOAU5JcDBzWc0iSJEmaUROdKC5UVX9snSqw1CI3kiRJkqT1s0nfAUiSJEmSJouJoiRJkiRphImiJEmSJGmEiaIkSZIkaYSJoiRJkiRphImiJEmSJGmEiaIkSZIkaYSJojSDkhyRpLrbZUl+m+TEJE9OcpWhdg9J8ukkZ3dt795f1MtnKa8/yVWSHJbklCQXJjkzyZFJduw7fkmSpL6ZKEqz63hgB2An4D7AJ4AXA19MskXXZgvgf4BD+ghwha3r9V8duB3wsu7nA4G/BI5NslkfAUuSJE0KvwxJs+uSqjqr+/1XwMlJjgO+CRwKvLCq3guQ5Lo9xbiS1vr6q+qFwL2HH5Dk74HvALsCp44zWEmSpElij6I0R6rqNOBY4KF9x9KHJbz+a3Y/fzeeiCRJkiaTiaI0f74L3KjvIHq06OtPsjnwGuATVfXLsUclSZI0QRx6Ks2fANV3ED36s9ffzUn8L2ArYL8eYpIkSZooJorS/NkN+EnfQfRo5PV3SeL7gVsBd6+qc/sKTJIkaVI49FSaI0luCewNfKjvWPqw8PV3S2V8ELg1cI+h4jeSJElzzR5FaXZdNcn2tAtC2wD3Ap4DfAN4NUCSawM70oZcAtwkyfnAWTOQNK319Xc9iUcDtwceAFTXHuD3VXVxDzFLkiRNBBNFaXbtBZwJXAGcD5xGW0fw7VV1addmP+A9Q495Z/fzxcCLxhLlylnr60+yE23tRGjJ47DHAUeMJUpJkqQJlKrpqmmRpACqKn3HIvUlyaHAYcDhVXVo3/HMg2n/7Jn2+DUZPI8kaX44R1GSJEmSNMJEUZIkSZI0wkRRkiRJkjTCRFGSJEmSNMJEUZIkSZI0wkRRkiRJkjTCRFGSJEmSNMJEUZIkSZI0wkRRkiRJkjTCRFGaTpd3P5+RpDbg9tteo+9Zkt+u779Z3zFLkiSNk4miNJ2OAn6+EY/fZrkCmVIb+vrPXtYoJEmSJlSqputC+eDKflWl71ikaeR7aD7/DebxNWv5eR5J0vywR1GSJEmSNMJEUZIkSZI0wkRRkiRJkjTCRFGSJEmSNMJEUZIkSZI0wkRRkiRJkjTCRFGSJEmSNMJEUZIkSZI0wkRRkiRJkjTCRFGSJEmSNMJEUZIkSZI0YrO+A5A0n5J8GbgIOBU4pfv53aq6uNfAJEmSRKqq7xjWS5ICqKr0HYs0jSblPZTkR8CNF2y+EvghLWkcTiB/WlVXLuOxJ+LfYJzm8TVr+XkeSdL8MFGU5sykvIcGcSzRhcBptKTxlVX14+U4dt//BuM0j69Zy8/zSJLmh4miNGOSPAXYey1NBvuOXUubM4B/rqrLl3C8VcA+Sw5w4923qo5bW4NliumYqtp3I59jYvjZqeXgeSRJ88M5itLseSpwwyW0W1syCfAK4OcbH86yuAz4Ht0w1J5jkSRJmnn2KEozJslDgA93d18CfGWJD70O8G5gc+B1VXXICoT3J2uYowgtOV04R/H0qrpsGY65F3AcMPj8+D9gj6r6wcY+96Tzs1PLwfNIkuaHiaI0g5K8DvgXWtJ1u6o6dx3tNwE+QRuu+RVgz6q6dIVj/AZwMaMJ4WlVdf4KHe96wMnANsCLgZsDj+yOfadZr7bqZ6eWg+eRJM0PE0VpBiXZHPgicAdgFbDf2qqGJnkWbajpecBtq2rFh5wmSY3pAyjJZsAJwF2BzwL3BbYATgJuCryrqp4wjlj64menloPnkSTNj036DkDS8ut6Ax8B/A7YF3j6mtomuRvwr93dvxlHkggwriSx8xJakngW8OiquqKqLgAeDvwROCjJY8cYjyRJ0kQzUZRmVFX9DPib7u7Lk9x1YZsk2wIfADalLTuxaowhjkWSfYBn09ZofFRV/Wawr6q+Dfxzd/dtSXbrIURJkqSJY6IozbCq+iTwKloi+IEuMQQgyabA+4AdaMNUn99LkCsoyV8C7+3uPq+qPr9Is3d3ba4OHJ1ki3HFJ0mSNKlMFKXZ9zzgS8D1gPd2CSLAc4G9gLOB/ZeyZuI06eZpHgVcG/gUcNhi7bohsP9IW35jN+CtSZx/JUmS5prFbKQ5kOT6tIqf1wVeAPwP8Jlu932r6jNreOhKxvR64FxWL4Xx07UV3NmA538NcAjwS1qBnnPW0X434Ou0nsWDqurdyxXLJJiFz84k9wJ2At5XVX/sOZy5NAvnkSRpaUwUpTmR5D7AsUABvwe2Bl5SVS/sKZ6F6yheCJzG6HIZp65raY81PPcDgY8BVwB70hLjpfgb4AhagZs7VtUp63vsSTULn51JfgHcAPgZrUf8/ct5cUHrNgvnkSRpaUwUpRmTZBVtPcSNcUxV7bsc8azJ4L28BGcylDgCn6yq89byvFvQehG32sgQv11Vu2/kc0yMWfjsTHIOcJ2hTd8CDq2q43sKae7MwnkkSVoa5yhK2ihJViWp9b2txyF2oK17+HTgP4A91hUSbd7lxjrHuYoT6+nAr4DbAp9J8ukkt+k5JkmSZoo9itKcWe730DL1YC7VL4CHVdXXNuZJ5vFzZBZe81CP4jbARcDBtKVPrkkbUv1e4PnjWgt0Hs3CeSRJWhoTRWnOTMp7aJE5isMuYPVQ08GcxdOq6vxlOvZE/BuM0yy85uFEcVCcKMl1afMVnwxcBbgEeCPwiqr6XV+xzqpZOI8kSUtjoijNmUl5D3WJ4g2B01lQwAb4ea3gh9Ok/BuM0yy85sUSxaF9NwL+Fdi/2/Q74GXAm62Qunxm4TySJC2NiaI0ZyblPZRkF+BnVXVJD8eeiH+DcZqF17y2RHGozR7Aq4B7dJt+TutxPNIKqRtvFs4jSdLSWMxGUi+q6gd9JImabVV1EnAv2rzZ04AdaXMXT0py7z5jkyRpmpgoSpJmSjWfAnYHHsfqCqnHdRVSd+8xPEmSpoKJoiRpJlXVFVV1BHBTWnXUC4D7AN9M8p9JbthnfJIkTTITRUnSTKuqi6vqlbQqu68HLgceC5ye5PAkW/cZnyRJk8hEUZI0F6rqnKp6KnBz4P3AVYGnAz9O8vQkV+s1QEmSJoiJoiRprlTVT6rqAGAP4ERga+BwWg/jY5L4t1GSNPf8YyhJmktV9Q1WV0g9ldUVUr9hhVRJ0rwzUZQkza2hCqm3pVVI/SWtWupxSY6zQqokaV6ZKEqS5t5QhdRdgGcBvwfuTauQ+l4rpEqS5o2JoiTNuCQ3Hvr9TUl27DOeSdZVSD2MViH1dbQKqY8BfmCFVEnSPDFRVG+SHJGkutvlSX6e5K2DL2JJrt19qf1+kouT/KLbf52+Y5emRZLbAt8a2vRPwMlJdusppKlQVedW1SHAzYAjgc1pFVJ/YoVUSdI8MFFU344HdgB2Ag4CHgC8pdt3PeD6wKHArWhX9e9GK2s/15JcLckDk2zZdyyaeG8FrrFg29bAv/UQy9Spqp9W1aNpFVJPALZidYXUx1ohVZI0q1JVfcewXpIUQFWl71i0cZIcAVy3qu4/tO01wIFVtWivYZJ9gE8CW1XVBWMJdAIlOQh458Y8xzy/hwafI5pa21TVOYM7SVbRKpcu5piq2nc5DpokwH2BV9EuXgGcDDyzqo5bjmNMOv8GS9L88EqoJkaSGwF7A5etpdk1gUuAi8YS1OS69kY+/uxliWJ6zfvr1wboKqQeS6uQeiCrK6R+uquQetsew5MkaVlt1ncAmnt7J/kDsCkwmPNzyGINk2wFvBR4Z1VdPp7wJt7hVXVo30FMm6ratu8YxiXJfsDHgOEeoCuB+1bV8b0EtYGSnAP82WiD5eoxXKqqugL4jyRHAQcDz6ZVSL13kv8CnldVPxtnTJIkLTd7FNW3L9CuyN8BeBNwDPDGhY2SbAF8AvgVbc6ipCWoqo8D9wG+BPyE9p67+7QliZNokQqpl7K6Quqrk2xsz78kSb0xUVTfLqqqH1XVqVV1MHB14PnDDbqCLZ/q7t6/qv447iClaVZVx1fVXavqxlW1Z1V9se+YZslQhdSbs7pC6tOAHyd5hhVSJUnTyERRk+bFwDOTXA8gyTWAY2lDU/epqj/0GdwEWVjFUlLP1lAh9VVYIVWSNIX8o6WJUlWfA74DPK9LEo+jlfI/ENgiyfbdbfP+ouxPmqcCz+k2nd5nPJL+XFV9A9gLuB9wCrAj8J/AN5Pcp8/YJElaKhNFTaLXAo8HHgLcCdgN+AFw5tDtzr1F15MkfwEcQfv32QR4GfCePmOStLihCqm3o13o+gVwG1qF1M9YIVWSNOlcR1GaAkluAHyUNqTtItpak0f3G5U0XkNVT0fWUZwG3YWef6aNBrhWt/l9tAqpZ/QV1/ryb7AkzQ97FKUJl+TOwEm0JPEM4M4midJ06SqkvopWIfW1tAqpj6bNX7RCqiRp4pgoShMgyaokqxbZ/gTgc8B2tOIYt6+qb485PEnLpKuQ+jTgZrQeRSukSpImkkNPpQmw8LzuivW8DnhS1+QNwNOr6vJ+IpT6N81DT9ckye1olVHv1W36BfA84H1VdUVvga2Bf4MlaX7YoyhNmCTbAp+hJYmXAo+rqn8xSZRmT1V9E7g3sDetQupfAv8BfCPJfZOYkEmSemGiqBWV5B+TvGxdX3aSbJLksCQHLeE5r5Xk35Pcc/kinQxd78JJwN1o1V3vVlVH9BqUpBXVVUj9NK1C6t+yukLqscBxVkiVJPXBoadaMUm2oSU7mwJ3qaovr6XtXrRetEuB7arq/LW0fSbwSuC7wC1r2k7iRQzOa+Bi4C+ArwAPqaoz+4tKmiyzOPR0MV2F1H8CnsuEVUj1b7AkzQ97FCdQkjOSPL3vOJbBw2lJIsAB62g72L85bf3EpbTdDbj1hoU2sf4CeDdwd5NEaT51FVIPB24EvIbRCqmvsUKqJGkcTBQ3QJJax+2IJLdM8sckD13w2L2SXN4tebAmtwfesrKvYiyGk8NHJLnKYo26Kn/D/05rTCqT3JLR5HBdCei0+WfgCVV1Sd+BSOpXVZ1XVU9ntELqIbQKqYd2PY9jk+SmQ78flGSzcR5fkjReJoobZoeh2xMW2faUqjoNeCHwtiTbQZtbB7wHeHVV/c+anryqzq6qi1Yw/hWXZCfgr2mLw/8IuC6tYMNi9gWuCXyfduX8nkmut4a2g8Tw5O7n/klm5jyuqn9bjqG0Sa6f5B1Jfpnk0iS/SvLOJDcYanO3JB/v9lWSAzf2uJKWX1WdUVWPAf4f8FlgK+AwWg/j3ybZdG2PXw5J7gV8a2jTO2nzJ6+60seWJPVjZr5gj1NVnTW4Aecv3FZVv++aHg78AHhHd/9NwO+AF6zt+RcOPe2+xD8xydFJLkzykySPWcNjd0ryiCQPT7Ljxr3SjbJ/9/O/gSO639fU+zfY/i5gFRDgkQsbdQVxBm0PAX5GqxB4l40Pd3Yk2ZlWEOeWtMIYNwEeA9wC+HqXxANsCZwGPIU2N1KadNfpO4A+LaiQ+m3a598RwDe7ed4rous5PArYYsGuewDPXKnjSpL6ZaK4gqrqStoX9b2SvA94FPA3VXXpBjzdC2hJ122ADwL/nuSGww2SPJJW4OWDtD/q302yrvl+y65L6B7d3X0fcGT3+4OSbLGg7Va0HsUCPtC1h8WTyr8Cbgj8Cvj80PPO2vDTjfVm4Epgr6r6bFX9vKpOBPbqtr8ZoKqOqarnVNWHuu3StJjbIY8LKqT+I+2z89bAZ5YwLWKDbsBlwJrmRd5mPK9ckjRuc/vHdlyq6kdJDqcNQ31pVZ28gU/13qr6L4Akz6f1At2V1qtGkt2A/wQ233PPPbniiiv40pe+tAVwZJJ7AD/dyJeyPnah9V6dCxxXVZcl+V9aorcf8P6htg8BrgqcWFW/SnIMcAGwR5JdquoHQ20Hyef7q+rKJEcCzwYenuTg4QS8m7tzLfp1flX9cZwH7Ipc7E2rjjgyfLmqLkryFuClSbauqt+NMzZpGc31mqJdD9/jaBcQ+64+el7Px5ckrRATxRXWJSz70+bq3SVJNnAO2imDX6rq8iRnA9sO7f9rYPN99tmHVatWUVXstddenHDCCVcF1jgfcoUdXVWXdb8fSUsUD2A0UTxgaD9VdXGSjwAHdvteBNAVwnnEgranJTkVuBVwX+ATXdsdgVNp8x57lfGvlX1T2hfH761h/3e7/TcFvjauoKRlci5zPPy0G63xANryQLt2m08CnlFVn1vhY78deOKCzRczG4XXJEmLMFFceYfR/p3vAPwvbW2sN23A81y24H4xOnT4UoBzzjmHSy+9lKrivPP+dKH398BYe7a6Yw6/zqOA1wN7J7lOVZ2bZAfgnrTYPzzU9n10iWKSF3eJ9V60gjjfY3Uhm0HbV9KSyk902/6GliReCPxhWV/V0m1F6ynty5ouRgwy1w0Z/iypJ0nuSJv3ftdu009pIyqO7qY5rLR/oiXqT6B9vn0P+Puq+tbaHiRJml4miiuoG/L5JOAeVfWdJE8DXp/kmKr68TIf7rPAuV/72teuc4Mb3ICq4pxzzgH4DbB7V3inN1X12ySfoQ2LfDjwNtqczQDHLBgGeSIt7psCewBfZ/Ww0yMX9Mh+gJYoPjDJNWiJ4aDtw6rq2BV6Scuqmwe0HH5ISxJvAXxskf270obtjXMosqQN1C1J8XLgYd2mc4GXAG/bwPnuG6QbHfIc4DkbMTJGkjRFLGazQrqk5T3AG6rqiwBV9U7gC8ARy72kQ1X9Ergf8LOzzz57kCT+GLhf30nikIXFZw5YsB2AqrqClgBC61XcAnhQd//9C9r+DPgSbaH6BwK7AzcHzgaOX77Qp0NVnQccCzwpydWH93X3nwx8dKgyr6QJlGTbJP9GGy7+MNqokJcDN66qN44zSVzIJFGS5oOJ4sp5PW1e4nMXbD+ItmzBU5b7gFX1ddrCzDenFZTZbcKGBX2MNqflrl0p9z2A/wM+uUjbQfXTR9GSxC2Ar6yhJ3a4Uuog+fxgVc1rwYsnA5sCxye5Z5K/THJ34DO0IcwHAyTZMsnuSXanfRbs2N3vc1kVaa4l2aIrWPZj2nt5E+DfgZtW1XO9yCNJGpdM24XBwRC9quq70ps2QJIP0NZI/BVwfeA/qurARdqFtgblTYbaHlxVfza/M8l1gTNpw1jPpRX5uXNV/e8KvYxlNzT0dJPluFqf5Aa0Srv7ANvTvmx+CdhvMMy3Sx5PXOThi/6fSH1Lcg6tmM02VXVO3/Esp66S6d/RCnjt0G1eBTyrqk7rKy5J0vyyR1HjNhhmev0F90d0ydJw2ytoBXEWa3sO8GlaL9q2tPl3X1mmeFdckpsN3b2yS3w3SlX9sqqeUFXXr6pNab2IdwTuNtTmc1WVRW4HbuzxJS1Nmv1olZrfTksSv06b235/k0RJUl9MFDVuxwKDwjW/AU5YS9vhJPL4qvrNWtq+b+j3hQVvJlpVnb5g09lJ7rPMx3gT8Bhgt27JFkk9S3In2rz1/6ZNGfgJbcTFHVd6uQtJktbFRFFj1RVgGPQMrnUeYZdAndTdXbTnccjHWb0UxrraToNPJzl84cYk10+y9YY8YVUdVVWvqKqLNz48SRsqyU2THE1bMukuwDm0eeu7du/TqbnQJUmaXc5R1NgluTZt4ea3rqswQ5JdaWsovqWrhrq2tvekzV364LIFOyZDcxT3BD4/tOt7VbVb12ZrWu/De6vqVWMOUerdtM9RTLIt8ALg72nLU10MvA54lUVqJEmTxkRRmgDD53WSrVg9PHdgG1rV2L+mFffZuVvXTJob05oodkv8HAIcCmwJXElbPumFVfWrPmOTJGlNHHoqTZiqOp/23jxjaPPZtCQRWnGfh483KknrK8lmSZ4I/Ah4CS1J/CRw66o6yCRRkjTJTBSlyXBMdwNa1deq2hl46xraP61bQkTShOkqmT6Q1ZVMt6dVMr17VT2gqr7Ta4CSJC3BZn0HIAmqat817Fo4BHXgdrSlLj6/hv2SetBVMj2cVqQGWiXTZwNHW6RGkjRN7FGUJlSSg4HnrKXJIeOKRZoWSVYlWdXDcXdJ8iFGK5kejJVMJUlTyh5FaQIl2R7Yj1YVcU3rHu6XZPeqOnlsgUmTb59xHizJdrRKpk9kdSXT19IqmV4wzlgkSVpO9ihKE6iqzqqqvYCtgDsBz6Atyn3ugqYHjjcySQBJtkzyAlqhmifR/p6+G7hpVT3PJFGSNO1MFKUJVlWXVtVXq+rVVfUgYFtgN+CjXZNLewtOWoIkv01Sy3GjLY2x2DFWDbUZbBs8blmHoXaVTP8e+CHwYqxkKkmaUSaK0hSpqiur6nvAV/qORVqibfoOYDksqGT6NqxkKkmacc5RlCStuKra6OVckpzDIr2Kw1WDB72Ky3G8oef8K1ol08Fapj+mVTL9kEVqJEmzykRRkqRFJNkFeAXwkG7TOcBLgLdXlcO+JUkzzaGn0nR7aN8BSBPmmO62wZJsl+TNwHdpSeLFwMuAG1fVm0wSJUnzwB5FaTqd0f28UZ9BSJNmeBjq+kqyJW190mfQitRcCbwLeJFFaiRJ8ybTNr1iJeafSNPI94KmwXKep0NzFLepqnM29vmGnncz4PG0KqbbdZs/ATyrqr67XMeRJGma2KMoSZpLSQI8EHglcLNu89eBZ1TV53sLTJKkCWCiKEmaO1YylSRp7UwUJUlzYw2VTF8MvMMiNZIkrWaiKEmaeUm2A14IPBHYlFbJ9LXAq6rqgj5jkyRpEpkoSpJmVlfJ9Gm0SqZbsLqS6Qur6td9xiZJ0iQzUZQkzZwkV6FVMn0RVjKVJGm9mShKkmbGGiqZfo1WyfQLvQUmSdKUMVGUJM2EJHemVTK9c7fpR8BzsJKpJEnrzURRkjTVktyMVsn0wd2ms4GXYCVTSZI2mImiJGkqJdmeVsn0CbRKphfRKpkebiVTSZI2jomiJGnabJnkyYxWMn0n8CIrmUqStDxMFCVJ0+abwNbd7x8Hnm0lU0mSlpeJoiRp2myNlUwlSVpRm/QdgCRJS/QJ4BTg4cCdTBIlSVo5mbaK4UkKoKrSdyxSn3wvaBp4nkqSNJ3sUZQkSZIkjTBRlCRJkiSNMFGUJEmSJI0wUZQkSZIkjTBRlCRJkiSNmNp1FAeV9CRJkiRJy2saexTP7jsAaYL4fpAkSdKym7p1FCVJ08N1FCVJmk7T2KMoSZIkSVpBJoqSJEmSpBEmipIkSZKkESaKkiRJkqQRJoqSJEmSpBEmipIkSZKkESaKkiRJkqQRJoqSJEmSpBEmipIkSZKkESaKkiRJkqQRJoqSJEmSpBEmipIkSZKkESaKkiRJkqQRJoqSJEmSpBEmipIkSZKkESaKkiRJkqQRm/UdgCRp9iWpvmOQJEkAHFNV+66rkT2KkqSVdHbfAUiSpPWXKi/ySpIkSZJWs0dRkiRJkjTCRFGSJEmSNMJEUZIkSZI0wkRRkiRJkjTCRFGSJEmSNMJEUZIkSZI0wkRRkiRJkjTCRFGSJEmSNOL/A0vfn4Tk5U+7AAAAAElFTkSuQmCC\n", + "image/svg+xml": [ + "\n", + "\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " 2020-12-01T15:40:27.785440\n", + " image/svg+xml\n", + " \n", + " \n", + " Matplotlib v3.3.3, https://matplotlib.org/\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "\n" + ], + "text/plain": [ + "" + ] + }, + "execution_count": 177, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "d = schemdraw.Drawing()\n", + "V1 = d.add(elm.SourceV(label='5V'))\n", + "d.add(elm.Line(d='right', l=d.unit*2))\n", + "d.add(elm.Resistor(d='down', label='R1'))\n", + "coupler = d.add(DiodeOptocoupler(d='right', box=False, label1='D1', label2='D2', anchor='anode1', reverse2=True))\n", + "d.here = coupler.cathode1\n", + "Q1 = d.add(elm.BjtNpn(d='right', anchor='collector', label='Q1'))\n", + "d.add(elm.Line(xy=Q1.emitter, d='down', l=d.unit*0.25))\n", + "d.add(elm.Line(d='left', tox=V1.start))\n", + "d.add(elm.Line(d='up', toy=V1.start))\n", + "d.add(elm.Resistor(xy=Q1.base, d='left', label='R2'))\n", + "d.add(elm.Dot(open=True, lftlabel='TX in'))\n", + "\n", + "d.add(elm.Line(xy=coupler.cathode2, d='up', toy=V1.end + d.unit*0.5))\n", + "vbus = d.add(elm.Line(d='right', l=d.unit*5))\n", + "\n", + "d.add(elm.Line(xy=coupler.anode2, d='right', l=d.unit*0.5))\n", + "j1 = d.add(elm.Dot())\n", + "d.add(elm.Line(l=d.unit*0.5))\n", + "amp1 = d.add(elm.Opamp(d='right', anchor='in1'))\n", + "\n", + "d.add(elm.Line(xy=j1.xy, d='up', l=d.unit))\n", + "j2 = d.add(elm.Dot())\n", + "\n", + "d.add(elm.Resistor(label='R3', d='right'))\n", + "d.add(elm.Line(l=d.unit*0.5))\n", + "j3 = d.add(elm.Dot())\n", + "d.add(elm.Line(d='down', toy=amp1.out))\n", + "j4 = d.add(elm.Dot())\n", + "d.add(elm.Line('left', tox=amp1.out))\n", + "\n", + "d.add(elm.Line('up', xy=j2.xy, l=d.unit*0.5))\n", + "d.add(elm.Capacitor(label='C1', d='right'))\n", + "d.add(elm.Line(tox=j3.xy))\n", + "d.add(elm.Line(d='down', toy=j3.xy))\n", + "\n", + "d.add(elm.Line(d='left', xy=amp1.in2, l=d.unit*0.2))\n", + "d.add(elm.Line(d='down', l=d.unit*0.5))\n", + "vgnd_bus = d.add(elm.Line(d='right', l=d.unit*5))\n", + "\n", + "d.draw()" + ] + } + ], + "metadata": { + "kernelspec": { + "display_name": "Python 3", + "language": "python", + "name": "python3" + }, + "language_info": { + "codemirror_mode": { + "name": "ipython", + "version": 3 + }, + "file_extension": ".py", + "mimetype": "text/x-python", + "name": "python", + "nbconvert_exporter": "python", + "pygments_lexer": "ipython3", + "version": "3.8.6" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +} diff --git a/doc/paper/concept_vis_one_axis.pdf b/doc/paper/concept_vis_one_axis.pdf new file mode 100644 index 0000000..ea37280 Binary files /dev/null and b/doc/paper/concept_vis_one_axis.pdf differ diff --git a/doc/paper/concept_vis_one_axis.svg b/doc/paper/concept_vis_one_axis.svg new file mode 100644 index 0000000..f3e909b --- /dev/null +++ b/doc/paper/concept_vis_one_axis.svg @@ -0,0 +1,344 @@ + + + + + + + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 5 1 + 3 + 2 + + + + + + + + + + + + 4 + diff --git a/doc/paper/goette_inertial_hsms_v1_5_eprint.pdf b/doc/paper/goette_inertial_hsms_v1_5_eprint.pdf new file mode 100755 index 0000000..8fdb2b9 Binary files /dev/null and b/doc/paper/goette_inertial_hsms_v1_5_eprint.pdf differ diff --git a/doc/paper/ir_tx_schema.pdf b/doc/paper/ir_tx_schema.pdf new file mode 100644 index 0000000..0e44ca5 Binary files /dev/null and b/doc/paper/ir_tx_schema.pdf differ diff --git a/doc/paper/ir_tx_schema.svg b/doc/paper/ir_tx_schema.svg new file mode 100644 index 0000000..5d54c2b --- /dev/null +++ b/doc/paper/ir_tx_schema.svg @@ -0,0 +1,340 @@ + + + + + + + + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + 1 + + + 5 + + 3 + + 2 + + 4 + + diff --git a/doc/paper/mesh_gen_viz.pdf b/doc/paper/mesh_gen_viz.pdf new file mode 100644 index 0000000..7ded2fc Binary files /dev/null and b/doc/paper/mesh_gen_viz.pdf differ diff --git a/doc/paper/mesh_gen_viz.svg b/doc/paper/mesh_gen_viz.svg new file mode 100644 index 0000000..59a31b9 --- /dev/null +++ b/doc/paper/mesh_gen_viz.svg @@ -0,0 +1,1547 @@ + + + + + + + + + + + + + + + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 1 + 2 + 3 + 4 + 5 + 6 + + + diff --git a/doc/paper/mesh_scan_crop.jpg b/doc/paper/mesh_scan_crop.jpg new file mode 100644 index 0000000..baa8e6c Binary files /dev/null and b/doc/paper/mesh_scan_crop.jpg differ diff --git a/doc/paper/photolink_schematic.pdf b/doc/paper/photolink_schematic.pdf new file mode 100644 index 0000000..3284427 Binary files /dev/null and b/doc/paper/photolink_schematic.pdf differ diff --git a/doc/paper/photolink_schematic.pro b/doc/paper/photolink_schematic.pro new file mode 100644 index 0000000..02a2ddf --- /dev/null +++ b/doc/paper/photolink_schematic.pro @@ -0,0 +1,43 @@ +update=Tue Dec 1 17:26:36 2020 +version=1 +last_client=eeschema +[general] +version=1 +RootSch= +BoardNm= +[pcbnew] +version=1 +LastNetListRead= +UseCmpFile=1 +PadDrill=0.600000000000 +PadDrillOvalY=0.600000000000 +PadSizeH=1.500000000000 +PadSizeV=1.500000000000 +PcbTextSizeV=1.500000000000 +PcbTextSizeH=1.500000000000 +PcbTextThickness=0.300000000000 +ModuleTextSizeV=1.000000000000 +ModuleTextSizeH=1.000000000000 +ModuleTextSizeThickness=0.150000000000 +SolderMaskClearance=0.000000000000 +SolderMaskMinWidth=0.000000000000 +DrawSegmentWidth=0.200000000000 +BoardOutlineThickness=0.100000000000 +ModuleOutlineThickness=0.150000000000 +[cvpcb] +version=1 +NetIExt=net +[eeschema] +version=1 +LibDir= +[eeschema/libraries] +[schematic_editor] +version=1 +PageLayoutDescrFile= +PlotDirectoryName= +SubpartIdSeparator=0 +SubpartFirstId=65 +NetFmtName= +SpiceAjustPassiveValues=0 +LabSize=50 +ERC_TestSimilarLabels=1 diff --git a/doc/paper/photolink_schematic.sch b/doc/paper/photolink_schematic.sch new file mode 100644 index 0000000..b5c6a64 --- /dev/null +++ b/doc/paper/photolink_schematic.sch @@ -0,0 +1,486 @@ +EESchema Schematic File Version 4 +EELAYER 30 0 +EELAYER END +$Descr A4 11693 8268 +encoding utf-8 +Sheet 1 1 +Title "" +Date "" +Rev "" +Comp "" +Comment1 "" +Comment2 "" +Comment3 "" +Comment4 "" +$EndDescr +$Comp +L Transistor_BJT:BC847 Q1 +U 1 1 5FC67B72 +P 3450 3300 +F 0 "Q1" H 3641 3300 50 0000 L CNN +F 1 "BC847" H 3641 3255 50 0001 L CNN +F 2 "Package_TO_SOT_SMD:SOT-23" H 3650 3225 50 0001 L CIN +F 3 "http://www.infineon.com/dgdl/Infineon-BC847SERIES_BC848SERIES_BC849SERIES_BC850SERIES-DS-v01_01-en.pdf?fileId=db3a304314dca389011541d4630a1657" H 3450 3300 50 0001 L CNN + 1 3450 3300 + 1 0 0 -1 +$EndComp +$Comp +L Device:R_Small R1 +U 1 1 5FC6861A +P 3050 3300 +F 0 "R1" V 3246 3300 50 0000 C CNN +F 1 "R_Small" V 3155 3300 50 0000 C CNN +F 2 "" H 3050 3300 50 0001 C CNN +F 3 "~" H 3050 3300 50 0001 C CNN + 1 3050 3300 + 0 -1 -1 0 +$EndComp +Wire Wire Line + 4750 3050 4600 3050 +Wire Wire Line + 3550 2950 3550 3100 +Wire Wire Line + 3150 3300 3250 3300 +$Comp +L power:GND1 #PWR02 +U 1 1 5FC74679 +P 3550 3500 +F 0 "#PWR02" H 3550 3250 50 0001 C CNN +F 1 "GND1" H 3555 3327 50 0000 C CNN +F 2 "" H 3550 3500 50 0001 C CNN +F 3 "" H 3550 3500 50 0001 C CNN + 1 3550 3500 + 1 0 0 -1 +$EndComp +Wire Wire Line + 4750 3250 4650 3250 +Wire Wire Line + 4600 3050 4600 2650 +Wire Wire Line + 4600 2650 4900 2650 +Connection ~ 4600 3050 +Wire Wire Line + 4900 2300 4600 2300 +Wire Wire Line + 4600 2300 4600 2650 +Connection ~ 4600 2650 +Text GLabel 9150 3350 2 50 Input ~ 0 +RX_OUT +Text GLabel 2850 3300 0 50 Input ~ 0 +TX_IN +Wire Wire Line + 2850 3300 2950 3300 +$Comp +L power:+3V3 #PWR01 +U 1 1 5FC80852 +P 3550 2150 +F 0 "#PWR01" H 3550 2000 50 0001 C CNN +F 1 "+3V3" H 3565 2323 50 0000 C CNN +F 2 "" H 3550 2150 50 0001 C CNN +F 3 "" H 3550 2150 50 0001 C CNN + 1 3550 2150 + 1 0 0 -1 +$EndComp +$Comp +L Device:Opamp_Quad_Generic U1 +U 4 1 5FC81BCB +P 5250 4650 +F 0 "U1" H 5250 4375 50 0000 C CNN +F 1 "MCP6494" H 5250 4374 50 0001 C CNN +F 2 "" H 5250 4650 50 0001 C CNN +F 3 "~" H 5250 4650 50 0001 C CNN + 4 5250 4650 + 1 0 0 1 +$EndComp +$Comp +L Device:R R2 +U 1 1 5FC87551 +P 3550 2400 +F 0 "R2" H 3620 2400 50 0000 L CNN +F 1 "R" H 3620 2355 50 0001 L CNN +F 2 "" V 3480 2400 50 0001 C CNN +F 3 "~" H 3550 2400 50 0001 C CNN + 1 3550 2400 + 1 0 0 -1 +$EndComp +$Comp +L Device:Opamp_Quad_Generic U1 +U 2 1 5FC77130 +P 7200 3250 +F 0 "U1" H 7200 2975 50 0000 C CNN +F 1 "MCP6494" H 7200 2974 50 0001 C CNN +F 2 "" H 7200 3250 50 0001 C CNN +F 3 "~" H 7200 3250 50 0001 C CNN + 2 7200 3250 + 1 0 0 1 +$EndComp +$Comp +L Device:Opamp_Quad_Generic U1 +U 1 1 5FC6A2B7 +P 5050 3150 +F 0 "U1" H 5050 2783 50 0000 C CNN +F 1 "MCP6494" H 5050 2874 50 0000 C CNN +F 2 "" H 5050 3150 50 0001 C CNN +F 3 "~" H 5050 3150 50 0001 C CNN + 1 5050 3150 + 1 0 0 1 +$EndComp +Wire Wire Line + 7500 3250 7600 3250 +Wire Wire Line + 3550 2250 3550 2150 +$Comp +L Device:D_ALT LED1 +U 1 1 5FC90B25 +P 3550 2800 +F 0 "LED1" V 3550 3100 50 0000 R CNN +F 1 "D_ALT" V 3505 2720 50 0001 R CNN +F 2 "" H 3550 2800 50 0001 C CNN +F 3 "~" H 3550 2800 50 0001 C CNN + 1 3550 2800 + 0 -1 -1 0 +$EndComp +Wire Wire Line + 3550 2550 3550 2650 +$Comp +L Device:D_ALT PD1 +U 1 1 5FC93B60 +P 4150 2800 +F 0 "PD1" V 4150 2880 50 0000 L CNN +F 1 "D_ALT" V 4105 2720 50 0001 R CNN +F 2 "" H 4150 2800 50 0001 C CNN +F 3 "~" H 4150 2800 50 0001 C CNN + 1 4150 2800 + 0 1 1 0 +$EndComp +Wire Wire Line + 4150 3050 4150 2950 +Wire Wire Line + 4150 3050 4600 3050 +$Comp +L Device:R R3 +U 1 1 5FC9B279 +P 4350 4500 +F 0 "R3" H 4420 4500 50 0000 L CNN +F 1 "R" H 4420 4455 50 0001 L CNN +F 2 "" V 4280 4500 50 0001 C CNN +F 3 "~" H 4350 4500 50 0001 C CNN + 1 4350 4500 + 1 0 0 -1 +$EndComp +$Comp +L Device:R R4 +U 1 1 5FC9B8DC +P 4350 5000 +F 0 "R4" H 4420 5000 50 0000 L CNN +F 1 "R" H 4420 4955 50 0001 L CNN +F 2 "" V 4280 5000 50 0001 C CNN +F 3 "~" H 4350 5000 50 0001 C CNN + 1 4350 5000 + 1 0 0 -1 +$EndComp +$Comp +L Device:C C1 +U 1 1 5FC9BF27 +P 4650 5000 +F 0 "C1" H 4765 5000 50 0000 L CNN +F 1 "C" H 4765 4955 50 0001 L CNN +F 2 "" H 4688 4850 50 0001 C CNN +F 3 "~" H 4650 5000 50 0001 C CNN + 1 4650 5000 + 1 0 0 -1 +$EndComp +Wire Wire Line + 4350 4650 4350 4750 +Wire Wire Line + 4350 4750 4650 4750 +Wire Wire Line + 4650 4750 4650 4850 +Connection ~ 4350 4750 +Wire Wire Line + 4350 4750 4350 4850 +$Comp +L power:GND2 #PWR05 +U 1 1 5FC9F5E3 +P 4350 5300 +F 0 "#PWR05" H 4350 5050 50 0001 C CNN +F 1 "GND2" H 4355 5127 50 0000 C CNN +F 2 "" H 4350 5300 50 0001 C CNN +F 3 "" H 4350 5300 50 0001 C CNN + 1 4350 5300 + 1 0 0 -1 +$EndComp +Wire Wire Line + 4350 5300 4350 5250 +Wire Wire Line + 4650 5150 4650 5250 +Wire Wire Line + 4650 5250 4350 5250 +Connection ~ 4350 5250 +Wire Wire Line + 4350 5250 4350 5150 +$Comp +L power:+3V0 #PWR04 +U 1 1 5FCA206B +P 4350 4250 +F 0 "#PWR04" H 4350 4100 50 0001 C CNN +F 1 "+3V0" H 4365 4423 50 0000 C CNN +F 2 "" H 4350 4250 50 0001 C CNN +F 3 "" H 4350 4250 50 0001 C CNN + 1 4350 4250 + 1 0 0 -1 +$EndComp +Wire Wire Line + 4350 4250 4350 4350 +Wire Wire Line + 4950 4750 4650 4750 +Connection ~ 4650 4750 +Wire Wire Line + 4950 4550 4800 4550 +Wire Wire Line + 4800 4550 4800 4150 +Wire Wire Line + 4800 4150 5700 4150 +Wire Wire Line + 5700 4150 5700 4650 +Wire Wire Line + 5700 4650 5550 4650 +Connection ~ 5700 4650 +$Comp +L Device:R R5 +U 1 1 5FCB3FD4 +P 5050 2650 +F 0 "R5" V 4843 2650 50 0000 C CNN +F 1 "100k" V 4934 2650 50 0000 C CNN +F 2 "" V 4980 2650 50 0001 C CNN +F 3 "~" H 5050 2650 50 0001 C CNN + 1 5050 2650 + 0 1 1 0 +$EndComp +$Comp +L Device:C C2 +U 1 1 5FCB45E4 +P 5050 2300 +F 0 "C2" V 5302 2300 50 0000 C CNN +F 1 "7p" V 5211 2300 50 0000 C CNN +F 2 "" H 5088 2150 50 0001 C CNN +F 3 "~" H 5050 2300 50 0001 C CNN + 1 5050 2300 + 0 -1 -1 0 +$EndComp +Wire Wire Line + 5200 2300 5500 2300 +Wire Wire Line + 5500 2300 5500 2650 +Wire Wire Line + 5500 3150 5350 3150 +$Comp +L Device:R R6 +U 1 1 5FCB92E2 +P 6150 3150 +F 0 "R6" V 5943 3150 50 0000 C CNN +F 1 "1k" V 6034 3150 50 0000 C CNN +F 2 "" V 6080 3150 50 0001 C CNN +F 3 "~" H 6150 3150 50 0001 C CNN + 1 6150 3150 + 0 1 1 0 +$EndComp +$Comp +L Device:R R7 +U 1 1 5FCB995A +P 7200 2700 +F 0 "R7" V 6993 2700 50 0000 C CNN +F 1 "100k" V 7084 2700 50 0000 C CNN +F 2 "" V 7130 2700 50 0001 C CNN +F 3 "~" H 7200 2700 50 0001 C CNN + 1 7200 2700 + 0 1 1 0 +$EndComp +Wire Wire Line + 5600 3150 5500 3150 +Connection ~ 5500 3150 +Wire Wire Line + 7350 2700 7600 2700 +Wire Wire Line + 7600 2700 7600 3250 +Wire Wire Line + 9150 3350 9050 3350 +Wire Wire Line + 5200 2650 5500 2650 +Connection ~ 5500 2650 +Wire Wire Line + 5500 2650 5500 3150 +$Comp +L power:+3V0 #PWR03 +U 1 1 5FCC0528 +P 4150 2150 +F 0 "#PWR03" H 4150 2000 50 0001 C CNN +F 1 "+3V0" H 4165 2323 50 0000 C CNN +F 2 "" H 4150 2150 50 0001 C CNN +F 3 "" H 4150 2150 50 0001 C CNN + 1 4150 2150 + 1 0 0 -1 +$EndComp +Wire Wire Line + 4150 2150 4150 2650 +$Comp +L Graphic:SYM_Arrow_Normal #SYM1 +U 1 1 5FCC452D +P 3850 2775 +F 0 "#SYM1" H 3850 2835 50 0001 C CNN +F 1 "SYM_Arrow_Normal" H 3860 2725 50 0001 C CNN +F 2 "" H 3850 2775 50 0001 C CNN +F 3 "~" H 3850 2775 50 0001 C CNN + 1 3850 2775 + 1 0 0 -1 +$EndComp +$Comp +L Graphic:SYM_Arrow_Normal #SYM2 +U 1 1 5FCC5099 +P 3850 2850 +F 0 "#SYM2" H 3850 2910 50 0001 C CNN +F 1 "SYM_Arrow_Normal" H 3860 2800 50 0001 C CNN +F 2 "" H 3850 2850 50 0001 C CNN +F 3 "~" H 3850 2850 50 0001 C CNN + 1 3850 2850 + 1 0 0 -1 +$EndComp +Wire Notes Line + 3200 3000 4450 3000 +Wire Notes Line + 4450 3000 4450 2600 +Wire Notes Line + 4450 2600 3200 2600 +Wire Notes Line + 3200 2600 3200 3000 +Text Notes 2900 2700 0 50 ~ 0 +IR link +Wire Wire Line + 4650 3750 5950 3750 +Wire Wire Line + 5950 4650 5950 3750 +Wire Wire Line + 5700 4650 5950 4650 +Wire Notes Line + 3850 1550 3850 5700 +Text Notes 3750 1750 2 100 ~ 0 +Stator +Text Notes 3950 1750 0 100 ~ 0 +Rotor +Text Label 5650 3750 2 50 ~ 0 +VGND +Text Notes 5300 1950 2 50 ~ 0 +TIA G=100kΩ +Text Notes 7500 2350 2 50 ~ 0 +Amplifier G=100 +Text Notes 8950 2900 2 50 ~ 0 +Comparator +Text Notes 5650 4000 2 50 ~ 0 +Virtual Ground Buffer +$Comp +L Device:C C3 +U 1 1 5FC76733 +P 5750 3150 +F 0 "C3" V 5900 3150 50 0000 C CNN +F 1 "7p" V 5911 3150 50 0001 C CNN +F 2 "" H 5788 3000 50 0001 C CNN +F 3 "~" H 5750 3150 50 0001 C CNN + 1 5750 3150 + 0 1 1 0 +$EndComp +Wire Wire Line + 6650 3350 6650 3750 +Wire Wire Line + 6650 3350 6900 3350 +Connection ~ 6650 3750 +$Comp +L Device:Opamp_Quad_Generic U1 +U 3 1 5FC7A609 +P 8750 3350 +F 0 "U1" H 8750 3075 50 0000 C CNN +F 1 "MCP6494" H 8750 3074 50 0001 C CNN +F 2 "" H 8750 3350 50 0001 C CNN +F 3 "~" H 8750 3350 50 0001 C CNN + 3 8750 3350 + 1 0 0 1 +$EndComp +$Comp +L Device:C C4 +U 1 1 5FC8AF8D +P 7850 3250 +F 0 "C4" V 8102 3250 50 0000 C CNN +F 1 "7p" V 8011 3250 50 0001 C CNN +F 2 "" H 7888 3100 50 0001 C CNN +F 3 "~" H 7850 3250 50 0001 C CNN + 1 7850 3250 + 0 1 1 0 +$EndComp +$Comp +L Device:R R8 +U 1 1 5FC9BACD +P 6400 3400 +F 0 "R8" V 6300 3400 50 0000 C CNN +F 1 "1k" V 6284 3400 50 0001 C CNN +F 2 "" V 6330 3400 50 0001 C CNN +F 3 "~" H 6400 3400 50 0001 C CNN + 1 6400 3400 + -1 0 0 1 +$EndComp +Wire Wire Line + 5950 3750 6400 3750 +Connection ~ 5950 3750 +Wire Wire Line + 6400 3550 6400 3750 +Connection ~ 6400 3750 +Wire Wire Line + 6400 3750 6650 3750 +Wire Wire Line + 6300 3150 6400 3150 +Wire Wire Line + 6400 3250 6400 3150 +Wire Wire Line + 6400 2700 7050 2700 +Connection ~ 6400 3150 +Wire Wire Line + 6400 3150 6900 3150 +Wire Wire Line + 6400 3150 6400 2700 +Wire Wire Line + 6000 3150 5900 3150 +$Comp +L Device:R R9 +U 1 1 5FCAEC24 +P 8100 3500 +F 0 "R9" V 8000 3500 50 0000 C CNN +F 1 "100k" V 7984 3500 50 0001 C CNN +F 2 "" V 8030 3500 50 0001 C CNN +F 3 "~" H 8100 3500 50 0001 C CNN + 1 8100 3500 + -1 0 0 1 +$EndComp +Wire Wire Line + 7600 3250 7700 3250 +Connection ~ 7600 3250 +Wire Wire Line + 8450 3450 8350 3450 +Wire Wire Line + 8000 3250 8100 3250 +Wire Wire Line + 6650 3750 8100 3750 +Wire Wire Line + 8350 3450 8350 3750 +Wire Wire Line + 8100 3350 8100 3250 +Connection ~ 8100 3250 +Wire Wire Line + 8100 3250 8450 3250 +Connection ~ 8100 3750 +Wire Wire Line + 8100 3750 8350 3750 +Wire Wire Line + 8100 3650 8100 3750 +Wire Wire Line + 4650 3250 4650 3750 +Text Notes 5700 3750 0 50 ~ 0 +1/2 VCC = 1.5V +$EndSCHEMATC diff --git a/doc/paper/photolink_schematic.svg b/doc/paper/photolink_schematic.svg new file mode 100644 index 0000000..a24a7ec --- /dev/null +++ b/doc/paper/photolink_schematic.svg @@ -0,0 +1,3246 @@ + + + + + + image/svg+xml + + SVG Picture created as photolink_schematic.svg date 2020/12/01 17:27:56 + + + + + + SVG Picture created as photolink_schematic.svg date 2020/12/01 17:27:56 + Picture generated by Eeschema-SVG + + + + + + + + + GND2 + + + + + + + + + + + + + + + + + + R2 + + + + + + + + + + + + + + + + + + + + + + + + + + + + 5 + + + + + - + + + + 6 + + + 7 + + + + U1B + + + + + + + + + + + + + + + + + + + + + 1 + + + + + + - + + + + 2 + + + + + + + + + + + 3 + + + + U1A + + + + + + MCP6494 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + LED1 + + + + + + + + + + + + + + + + + + + + + R9 + + + + + + + + + + + + + + + + + + + + + + + + + PD1 + + + + + + + + + + + + + + + + + + R3 + + + + + + + + + + + + + + + + + + C1 + + + + + + + + + + + + + + + + + R4 + + + + + + + + + + + + + + + + + + + + + + + + + +3V0 + + + + + + + + + + + + + + + + + + + + + + + + + + +3V0 + + + + + + + + + + + + + + + + + + + R5 + + + + 100k + + + + + + + + + + + + + + + + + + + + + + C2 + + + 7p + + + + + + + + + + + + + + + + + R7 + + + + 100k + + + + + + + + + + + + + + + + + + + + + R6 + + + + 1k + + + + + + + + + + + + + + + + + +3V3 + + + + + + + + + + + + + + + + + + + R1 + + + + + R_Small + + + + + + + + + + + + + + + + + + + + + GND1 + + + + + + + + + + + + + + + + + + + + R8 + + + + + + + + + + + + + + + + + + + C4 + + + + + + + + + + + + + + + + + + + + + + + + 1 + + + + + 2 + + + + + 3 + + + + + Q1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 10 + + + + + 8 + + + + + - + + + + 9 + + + + U1C + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 12 + + + + + + + - + + + + 13 + + + + + 14 + + + + + + + U1D + + + + + + + + + + + + + + + + + + + C3 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + RX_OUT + + + + + + + + + + + + + + + TX_IN + + + + + + + + + + + + + + VGND + + + + + + + 1/2 VCC = 1.5V + + + + + + + + + + + + + + + Virtual Ground Buffer + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Comparator + + + + + + + + + + + + + + + + + + + Amplifier G=100 + + + + + + + + + + + + + + + + + + + + + + + + + TIA G=100kΩ + + + + + + + + + + + + + + + + + Rotor + + + + + + + + + Stator + + + + + + + + + + + IR link + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/doc/paper/proto_3d_design.jpg b/doc/paper/proto_3d_design.jpg new file mode 100644 index 0000000..f527828 Binary files /dev/null and b/doc/paper/proto_3d_design.jpg differ diff --git a/doc/paper/prototype_early_comms_small.jpg b/doc/paper/prototype_early_comms_small.jpg new file mode 100644 index 0000000..506da48 Binary files /dev/null and b/doc/paper/prototype_early_comms_small.jpg differ diff --git a/doc/paper/rotohsm.bib b/doc/paper/rotohsm.bib new file mode 100644 index 0000000..1092c3a --- /dev/null +++ b/doc/paper/rotohsm.bib @@ -0,0 +1,200 @@ +% Encoding: UTF-8 +@comment{x-kbibtex-encoding=utf-8} + +@Book{anderson2020, + author = {Ross Anderson}, + date = {2020-09-16}, + title = {Security Engineering}, + isbn = {978-1-119-64281-7}, +} + +@techreport{smith1998, + author = {Sean Smith and Steve Weingart}, + date = {1998-02-19}, + institution = {IBM T.J. Watson Research Center}, + title = {Building a High-Performance, Programmable Secure Coprocessor}, + url = {ftp://www6.software.ibm.com/software/cryptocards/rc21102.pdf}, + urldate = {2020-09-16} +} + +@article{immler2019, + author = {Vincent Immler and Johannes Obermaier and Kuan Kuan Ng and Fei Xiang Ke and Jin Yu Lee and Yak Peng Lim and Wei Koon Oh and Keng Hoong Wee and Georg Sigl}, + date = {2019}, + doi = {10.13154/tches.v2019.i1.51-96}, + issn = {2569-2925}, + journal = {IACR transactions on cryptographic hardware and embedded systems.}, + journaltitle = {IACR Transactions on Cryptographic Hardware and Embedded Systems}, + publisher = {IACR}, + title = {Secure Physical Enclosures from Covers with Tamper-Resistance}, + url = {https://tches.iacr.org/index.php/TCHES/article/view/7334/6506}, + urldate = {2020-09-16} +} + +@article{obermaier2018, + author = {Johannes Obermaier and Vincent Immler}, + date = {2018}, + doi = {10.1007/s41635-018-0045-2}, + issn = {2509-3428}, + journaltitle = {Journal of Hardware and Systems Security}, + pages = {289–296}, + title = {The Past, Present, and Future of Physical Security Enclosures: From Battery-Backed Monitoring to PUF-Based Inherent Security and Beyond}, + volume = {2}, + year = {2018} +} + +@article{tobisch2020, + author = {Johannes Tobisch and Christian Zenger and Christof Paar}, + date = {2020-03-13}, + journaltitle = {TRUDEVICE 2020: 9th Workshop on Trustworthy Manufacturing and Utilization of Secure Devices}, + title = {Electromagnetic Enclosure PUF for Tamper Proofing Commodity Hardware and otherApplications}, + url = {https://www.emsec.ruhr-uni-bochum.de/media/crypto/veroeffentlichungen/2020/05/13/trudevice_submission_enclosure_puf.pdf}, + urldate = {2020-09-17} +} + +@article{kreft2012, + author = {Heinz Kreft and Wael Adi}, + date = {2012}, + doi = {10.1109/ahs.2012.6268655}, + journaltitle = {2012 NASA/ESA Conference on Adaptive Hardware and Systems (AHS)}, + title = {Cocoon-PUF, a novel mechatronic secure element technology}, + year = {2012} +} + +@Patent{rahman1988, + author = {Mujib Rahman}, + date = {1988-03-10}, + number = {US Patent US4859024A}, + title = {Optical fiber cable with tampering detecting means}, +} + +@www{haines2006, + author = {Lester Haines}, + date = {2006-09-25}, + editor = {The Register}, + title = {US outfit patents 'invisible' UAV: Stealth through persistence of vision}, + url = {https://www.theregister.com/2006/09/25/phantom_sentinel/}, + urldate = {2020-09-17} +} + +@article{frazelle2019, + author = {Jessie Frazelle}, + date = {2019-12-01}, + doi = {10.1145/3380774.3382016}, + journaltitle = {ACM Queue}, + title = {Securing the Boot Process: The hardware root of trust}, + url = {https://dl.acm.org/doi/fullHtml/10.1145/3380774.3382016}, + urldate = {2020-10-22} +} + +@Article{albartus2020, + author = {Nils Albartus and Max Hoffmann and Sebastian Temme and Leonid Azriel and Christof Paar}, + date = {2020}, + title = {{DANA} Universal Dataflow Analysis for Gate-Level Netlist Reverse Engineering}, + doi = {10.13154/tches.v2020.i4.309-336}, + number = {4}, + pages = {309–336}, + volume = {2020}, + bibsource = {dblp computer science bibliography, https://dblp.org}, + biburl = {https://dblp.org/rec/journals/tches/AlbartusHTAP20.bib}, + journal = {{IACR} Transactions on Cryptographic Hardware and Embedded Systems}, + year = {2020}, +} + +@InProceedings{trippel2017, + author = {Timothy Trippel and Ofir Weisse and Wenyuan Xu and Peter Honeyman and Kevin Fu}, + booktitle = {2017 IEEE European symposium on security and privacy}, + title = {WALNUT: Waging doubt on the integrity of MEMS accelerometers with acoustic injection attacks}, + organization = {IEEE}, + pages = {3–18}, + x-fetchedfrom = {Google Scholar}, + year = {2017}, +} + +@WWW{heise2020t2jailbreak, + author = {Leo Becker}, + date = {2020-03-11}, + title = {Jailbreaker nehmen T2-Sicherheitschip von Macs ins Visier}, + url = {https://www.heise.de/mac-and-i/meldung/Jailbreaker-nehmen-T2-Sicherheitschip-von-Macs-ins-Visier-4681131.html}, + organization = {Heise Online}, + publisher = {Heise Online}, +} + +@article{kim2018, + author = {Seung Hyun Kim and Su Chang Lim and others}, + journal = {Annals of Nuclear Energy}, + pages = {845–855}, + publisher = {Elsevier}, + title = {Intelligent intrusion detection system featuring a virtual fence, active intruder detection, classification, tracking, and action recognition}, + volume = {112}, + x-fetchedfrom = {Google Scholar}, + year = {2018} +} + +@Conference{johnson2018, + author = {Scott Johnson and Dominic Rizzo and Parthasarathy Ranganathan and Jon McCune and Richard Ho}, + booktitle = {Hot Chips: A Symposium on High Performance Chips}, + date = {2018}, + title = {Titan: enabling a transparent silicon root of trust for Cloud}, + url = {https://www.hotchips.org/hc30/1conf/1.14_Google_Titan_GoogleFinalTitanHotChips2018.pdf}, + x-fetchedfrom = {Google Scholar}, + year = {2018}, +} + +@TechReport{isaacs2013, + author = {Phil Isaacs and Thomas {Morris Jr} and Michael J Fisher and Keith Cuthbert}, + date = {2013}, + institution = {Surface Mount Technology Association}, + title = {Tamper proof, tamper evident encryption technology}, + booktitle = {Pan Pacific Microelectronics Symposium}, + organization = {Surface Mount Technology Association}, + x-fetchedfrom = {Google Scholar}, + year = {2013}, +} + +@inproceedings{drimer2008, + author = {Saar Drimer and Steven J Murdoch and Ross Anderson}, + booktitle = {2008 IEEE Symposium on Security and Privacy (sp 2008)}, + organization = {IEEE}, + pages = {281–295}, + title = {Thinking inside the box: system-level failures of tamper proofing}, + x-fetchedfrom = {Google Scholar}, + year = {2008} +} + +@WWW{terdiman2013, + author = {Daniel Terdiman}, + date = {2013-07-23}, + title = {Aboard America's Doomsday command and control plane}, + url = {https://www.cnet.com/news/aboard-americas-doomsday-command-and-control-plane}, + organization = {cnet.com}, + month = jul, + publisher = {CNET}, + year = {2013}, +} + +@Thesis{vrijaldenhoven2004, + author = {Serge Vrijaldenhoven}, + date = {2004-10-01}, + institution = {Technische Universiteit Eindhoven}, + title = {Acoustical Physical Uncloneable Functions}, + type = {mathesis}, + url = {https://pure.tue.nl/ws/files/46971492/600055-1.pdf}, +} + +@WWW{dexter2015, + author = {Karsten Nohl and Fabian Bräunlein and dexter}, + date = {2015-12-27}, + title = {Shopshifting: The potential for payment system abuse}, + url = {https://media.ccc.de/v/32c3-7368-shopshifting#t=2452}, + organization = {32C3 Chaos Communication Congress}, +} + +@WWW{newman2020, + author = {Lily Hay Newman}, + date = {2020-10-06}, + title = {Apple's T2 Security Chip Has an Unfixable Flaw}, + url = {https://www.wired.com/story/apple-t2-chip-unfixable-flaw-jailbreak-mac/}, + organization = {Wired Magazine}, +} + +@Comment{jabref-meta: databaseType:biblatex;} diff --git a/doc/paper/rotohsm_paper.pdf b/doc/paper/rotohsm_paper.pdf new file mode 100644 index 0000000..f0ad0b6 Binary files /dev/null and b/doc/paper/rotohsm_paper.pdf differ diff --git a/doc/paper/rotohsm_paper.tex b/doc/paper/rotohsm_paper.tex new file mode 100644 index 0000000..e2f3928 --- /dev/null +++ b/doc/paper/rotohsm_paper.tex @@ -0,0 +1,609 @@ +\documentclass[10pt,journal,a4paper]{IEEEtran} +\usepackage[english]{babel} +\usepackage[utf8]{inputenc} +\usepackage[T1]{fontenc} +\usepackage[ + backend=biber, + style=numeric, + natbib=true, + url=false, + doi=true, + eprint=false + ]{biblatex} +\addbibresource{rotohsm.bib} +\usepackage{amssymb,amsmath} +\usepackage{listings} +\usepackage{eurosym} +\usepackage{wasysym} +\usepackage{amsthm} +\usepackage{tabularx} +\usepackage{multirow} +\usepackage{multicol} +\usepackage{tikz} +\usepackage{mathtools} +\DeclarePairedDelimiter{\ceil}{\lceil}{\rceil} +\DeclarePairedDelimiter{\paren}{(}{)} + +\usetikzlibrary{arrows} +\usetikzlibrary{chains} +\usetikzlibrary{backgrounds} +\usetikzlibrary{calc} +\usetikzlibrary{decorations.markings} +\usetikzlibrary{decorations.pathreplacing} +\usetikzlibrary{fit} +\usetikzlibrary{patterns} +\usetikzlibrary{positioning} +\usetikzlibrary{shapes} + +\usepackage[binary-units]{siunitx} +\DeclareSIUnit{\baud}{Bd} +\DeclareSIUnit{\year}{a} +\usepackage{hyperref} +\usepackage{tabularx} +\usepackage{commath} +\usepackage{graphicx,color} +\usepackage{ccicons} +\usepackage{subcaption} +\usepackage{float} +\usepackage{footmisc} +\usepackage{array} +\usepackage[underline=false]{pgf-umlsd} +\usetikzlibrary{calc} +%\usepackage[pdftex]{graphicx,color} +\usepackage{epstopdf} +\usepackage{pdfpages} +\usepackage{minted} % pygmentized source code + +\renewcommand{\floatpagefraction}{.8} +\newcommand{\degree}{\ensuremath{^\circ}} +\newcolumntype{P}[1]{>{\centering\arraybackslash}p{#1}} + +\usepackage{fancyhdr} +\fancyhf{} +\fancyfoot[C]{\thepage} +\newcommand{\includenotebook}[2]{ + \fancyhead[C]{Included Jupyter notebook: #1} + \includepdf[pages=1, + pagecommand={\thispagestyle{fancy}\section{#1}\label{#2_notebook}} + ]{resources/#2.pdf} + \includepdf[pages=2-, + pagecommand={\thispagestyle{fancy}} + ]{resources/#2.pdf} +} + +\begin{document} + +\title{Can't Touch This: Inerial HSMs Thwart Advanced Physical Attacks} +\author{Jan Götte} +\date{2020-12-20} +\maketitle + +\section*{Abstract} + +In this paper, we introduce a novel countermeasure against physical attacks: Inertial hardware security modules (iHSMs). +Conventional systems have in common that they try to detect attacks by crafting sensors responding to increasingly +minute manipulations of the monitored security boundary or volume. Our approach is novel in that we reduce the +sensitivity requirement of security meshes and other sensors and increase the complexity of any manipulations by +rotating the security mesh or sensor at high speed---thereby presenting a moving target to an attacker. Attempts to stop +the rotation are easily monitored with commercial MEMS accelerometers and gyroscopes. Our approach leads to a HSM that +can easily be built from off-the-shelf parts by any university electronics lab, yet offers a level of security that is +comparable to commercial HSMs. By building prototype hardware we have demonstrated solutions to the concept's +engineering challenges. + +\section{Introduction} + +While information security technology has matured a great deal in the last half century, physical security has barely +changed. Given the right skills, physical access to a computer still often means full compromise. The physical +security of modern server hardware hinges on what lock you put on the room it is in. + +Currently, servers and other computers are rarely physically secured as a whole. Servers sometimes have a simple lid +switch and are put in locked ``cages'' inside guarded facilities. This usually provides a good compromise between +physical security and ease of maintenance. To handle highly sensitive data in applications such as banking or public key +infrastructure, general-purpose and low-security servers are augmented with dedicated, physically secure cryptographic +co-processors such as trusted platform modules (TPMs) or hardware security modules (HSMs). Using a limited amount of +trust in components such as the CPU, the larger system's security can then be reduced to that of its physically secured +TPM~\cite{newman2020,frazelle2019,johnson2018}. + +Like smartcards, TPMs rely on a modern IC being hard to tamper with. Shrinking things to the nanoscopic level to secure +them against tampering is a good engineering solution for some years to come. However, in essence this is a type of +security by obscurity: Obscurity here referring to the rarity of the equipment necessary to attack modern +ICs~\cite{albartus2020,anderson2020}. + +HSMs rely on a fragile foil with much larger-scale conductive traces being hard to remove intact. While we are certain +that there still are many insights to be gained in both technologies, we wish to introduce a novel approach to sidestep +the manufacturing issues of both and provide radically better security against physical attacks. Our core observation +is that any cheap but coarse HSM technology can be made much more difficult to attack by moving it very quickly. + +For example, consider an HSM as it is used in online credit card payment processing. Its physical security level is set +by the structure size of its security mesh. An attack on its mesh might involve fine drill bits, needles, wires, glue, +solder and lasers~\cite{drimer2008}. Now consider the same HSM mounted on a large flywheel. In addition to its usual +defenses the HSM is now equipped with an accelerometer that it uses to verify that it is spinning at high speed. How +would an attacker approach this HSM? They would have to either slow down the rotation---which triggers the +accelerometer---or they would have to attack the HSM in motion. The HSM literally becomes a moving target. At slow +speeds, rotating the entire attack workbench might be possible but rotating frames of reference quickly become +inhospitable to human life (see Appendix~\ref{sec_minimum_angular_velocity}). Since non-contact electromagnetic or +optical attacks are more limited in the first place and can be shielded, we have effectively forced the attacker to use +an attack robot. + +This work contains the following contributions: +\begin{enumerate} + \item We present the \emph{Inertial HSM} concept. Inertial HSMs enable cost-effective small-scale production of + highly secure HSMs. + \item We discuss possible boundary sensing modes for inertial HSMs. + \item We explore the design space of our inertial HSM concept. + \item We present our work on a prototype inertial HSM. + % FIXME \item Measurement of the prototype HSM's susceptibility to various types of attack. +\end{enumerate} + +In Section~\ref{sec_related_work}, we will give an overview of the state of the art in the physical security of HSMs. On +this basis, in Section~\ref{sec_ihsm_construction} we will elaborate the principles of our inertial HSM approach. We +will analyze its weaknesses in Section~\ref{sec_attacks}. Based on these results we have built a prototype system that +we will illustrate in Section~\ref{sec_proto}. We conclude this paper with a general evaluation of our design in +Section~\ref{sec_conclusion}. + +\section{Related work} +\label{sec_related_work} +% summaries of research papers on HSMs. I have not found any actual prior art on anything involving mechanical motion +% beyond ultrasound. + +In this section, we will briefly explore the history of HSMs and the state of academic research on active tamper +detection. + +HSMs are an old technology tracing back decades in their electronic realization. Today's common approach of monitoring +meandering electrical traces on a fragile foil that is wrapped around the HSM essentially transforms the security +problem into the challenge to manufacture very fine electrical traces on a flexible foil~\cite{isaacs2013, immler2019, +anderson2020}. There has been some research on monitoring the HSM's inside using e.g.\ electromagnetic +radiation~\cite{tobisch2020, kreft2012} or ultrasound~\cite{vrijaldenhoven2004} but none of this research +has found widespread adoption yet. + +In~\cite{anderson2020}, Anderson gives a comprehensive overview on physical security. An example they cite is the IBM +4758 HSM whose details are laid out in depth in~\cite{smith1998}. This HSM is an example of an industry-standard +construction. Although its turn of the century design is now a bit dated, the construction techniques of the physical +security mechanisms have not evolved much in the last two decades. Besides some auxiliary temperature and radiation +sensors to guard against attacks on the built-in SRAM memory, the module's main security barrier uses the traditional +construction of a flexible mesh wrapped around the module's core. In~\cite{smith1998}, the authors state the module +monitors this mesh for short circuits, open circuits and conductivity. The fundamental approach to tamper detection and +construction is similar to other commercial offerings~\cite{obermaier2018,drimer2008,anderson2020,isaacs2013}. + +In~\cite{immler2019}, Immler et al. describe a HSM based on precise capacitance measurements of a mesh. In contrast to +traditional meshes, the mesh they use consists of a large number of individual traces (more than 30 in their example). +Their concept promises a very high degree of protection. The main disadvantages of their concept are a limitation in +covered area and component height, as well as the high cost of the advanced analog circuitry required for monitoring. A +core component of their design is that they propose its use as a PUF to allow for protection even when powered off, +similar to a smart card---but the design is not limited to this use. + +In~\cite{tobisch2020}, Tobisch et al.\ describe a construction technique for a hardware security module that is based +around commodity Wifi hardware inside a conductive enclosure. In their design, an RF transmitter transmits a reference +signal into the RF cavity formed by the conductive enclosure. One or more receivers listen for the signal's reflections +and use them to characterize the RF cavity w.r.t.\ phase and frequency response. Their fundamental assumption is that +the RF behavior of the cavity is inscrutable from the outside, and that even a small disturbance anywhere within the +volume of the cavity will cause a significant change in its RF response. The core idea in~\cite{tobisch2020} is to use +commodity Wifi hardware to reduce the cost of the HSM's sensing circuitry. The resulting system is likely both much +cheaper and capable of protecting a much larger security envelope than e.g. the design from~\cite{immler2019}, at the +cost of worse and less predictable security guarantees. Where~\cite{tobisch2020} use electromagnetic radiation, +Vrijaldenhoven in~\cite{vrijaldenhoven2004} uses ultrasound waves travelling on a surface acoustic wave (SAW) device to +a similar end. + +While~\cite{tobisch2020} approach the sensing frontend cost as their only optimization target, the prior work of Kreft +and Adi~\cite{kreft2012} considers sensing quality. Their target is an HSM that envelopes a volume barely larger than a +single chip. They theorize how an array of distributed RF transceivers can measure the physical properties of a potting +compound that has been loaded with RF-reflective grains. In their concept, the RF response characterized by these +transceivers is shaped by the precise three-dimensional distribution of RF-reflective grains within the potting +compound. + +To the best of our knowledge, we are the the first to propose a mechanically moving HSM security barrier as part of a +hardware security module. Most academic research concentrates on the issue of creating new, more sensitive security +barriers for HSMs~\cite{immler2019} while commercial vendors concentrate on means to certify and cheaply manufacture +these security barriers~\cite{drimer2008}. Our concept instead focuses on the issue of taking any existing, cheap +low-performance security barrier and transforming it into a marginally more expensive but high-performance one. The +closest to a mechanical HSM that we were able to find during our research is an 1988 patent~\cite{rahman1988} that +describes a mechanism to detect tampering along a communication cable by enclosing the cable inside a conduit filled +with pressurized gas. + +\section{Inertial HSM construction and operation} +\label{sec_ihsm_construction} + +Mechanical motion has been proposed as a means of making things harder to see with the human eye~\cite{haines2006} and is +routinely used in military applications to make things harder to hit~\cite{terdiman2013} but we seem to be the first to +use it in tamper detection. If we consider different ways of moving an HSM to make it harder to tamper with, we find +that making it spin has several advantages. + +First, the HSM has to move fairly fast. If any point of the HSM's tamper sensing mesh moves slow enough for a human to +follow, it becomes a weak spot. E.g.\ in a linear pendulum motion, the pendulum becomes stationary at its apex. Second, +a spinning HSM is compact compared to alternatives like an HSM on wheels. Finally, rotation leads to easily predictable +accelerometer measurements. A beneficial side-effect of spinning the HSM is that if the axis of rotation is within the +HSM itself, an attacker trying to follow the motion would have to rotate around the same axis. Their tangential linear +velocity would rise linearly with the radius from the axis of rotation, which allows us to limit the approximate maximum +size and mass of an attacker using an assumption on tolerable centrifugal force (see Appendix +\ref{sec_minimum_angular_velocity}). In this consideration the axis of rotation is a weak spot, but that can be +mitigated using multiple nested layers of protection. + +\begin{figure} + \center + \includegraphics{concept_vis_one_axis.pdf} + \caption{Concept of a simple spinning inertial HSM. 1 - Shaft. 2 - Security mesh. 3 - Payload. 4 - + Accelerometer. 5 - Shaft penetrating security mesh.} + \label{fig_schema_one_axis} +\end{figure} + +In a rotating reference frame, centrifugal force is proportional to the square of angular velocity and proportional to +distance from the axis of rotation. We can exploit this fact to create a sensor that detects any disturbance of the +rotation by placing a linear accelerometer at some distance from the axis of rotation. During constant rotation, after +subtracting gravity both acceleration tangential to the rotation and along the axis of rotation will be zero. +Centrifugal acceleration will be constant. + +Large centrifugal acceleration at high speeds poses the engineering challenge of preventing the whole thing from flying +apart, but it also creates an obstacle to any attacker trying to manipulate the sensor. We do not need to move the +entire contents of the HSM. It suffices if we move the tamper detection barrier around a stationary payload. This +reduces the moment of inertia of the moving part and it means we can use cables for payload power and data. + +From our back-of-the-envelope calculation in Appendix \ref{sec_minimum_angular_velocity} we conclude that even at +moderate speeds above $\SI{500}{rpm}$, an attack would have to be carried out using a robot. + +In Appendix \ref{sec_degrees_of_freedom} we consider sensor configurations and we conclude that one three-axis +accelerometer each in the rotor and in the stator are a good baseline configuration. In general, the system will be more +sensitive to attacks if we over-determine the system of equations describing its motion by using more sensors than +necessary. + +\subsection{Mechanical layout} + +Thinking about the concrete construction of our mechanical HSM, the first challenge is mounting both mesh and payload on +a single shaft. The simplest way we found to mount a stationary payload inside of a spinning security mesh is a hollow +shaft. The payload can be mounted on a fixed rod threaded through this hollow shaft along with wires for power and +data. The shaft is a weak spot of the system, but this weak spot can be alleviated through either careful construction +or a second layer of rotating meshes with a different axis of rotation. Configurations that do not use a hollow-shaft +motor are possible, but may require additional bearings to keep the stator from vibrating. + +The next design choice we have to make is the physical structure of the security mesh. The spinning mesh must be +designed to cover the entire surface of the payload, but compared to a traditional HSM it suffices if it sweeps over +every part of the payload once per rotation. This means we can design longitudinal gaps into the mesh that allow outside +air to flow through to the payload. In traditional boundary-sensing HSMs, cooling of the payload processor is a serious +issue since any air duct or heat pipe would have to penetrate the HSM's security boundary. This problem can only be +solved with complex and costly siphon-style constructions, so in commercial systems heat conduction is used +exclusively~\cite{isaacs2013}. This limits the maximum power dissipation of the payload and thus its processing power. +Our setup allows direct air cooling of regular heatsinks. This greatly increases the maximum possible power dissipation +of the payload and unlocks much more powerful processing capabilities. In an evolution of our design, the spinning mesh +could even be designed to \emph{be} a cooling fan. + +\subsection{Spinning mesh power and data transmission} + +On the electrical side, the idea of a security mesh spinning at more than $\SI{500}{rpm}$ leaves us with a few +implementation challenges. Since the spinning mesh must be monitored for breaks or short circuits continuously, we need +both a power supply for the spinning monitoring circuit and a data link to the stator. + +We found that a bright lamp shining at a rotating solar panel is a good starting point. In contrast to e.g.\ slip +rings, this setup is mechanically durable at high speeds and it also provides reasonable output power (see Appendix +\ref{sec_energy_calculations} for an estimation of power consumption). A battery may not provide a useful lifetime +without power-optimization. Likewise, an energy harvesting setup may not provide enough current to supply peak demand. + +Since the monitoring circuit uses little current, power transfer efficiency is not important. On the other hand, cost +may be a concern in a production device. Here it may prove worthwhile to replace the solar cell setup with an extra +winding on the rotor of the BLDC motor driving the spinning mesh. This motor is likely to be a custom part, so adding +an extra winding is unlikely to increase cost significantly. More traditional inductive power transfer may also be an +option if it can be integrated into the mechanical design. + +Besides power, the data link between spinning mesh and payload is critical to the HSM's design. This link is used to +transmit the occassional status report along with a low-latency alarm trigger (``heartbeat'') signal from mesh to payload. +As we will elaborate in Section~\ref{sec_proto} a simple infrared optical link turned out to be a good solution for this +purpose. + +\section{Attacks} +\label{sec_attacks} + +After outlining the basic mechanical design of an inertial HSM above, in this section we will detail possible ways to +attack it. Fundamentally, attacks on an inertial HSM are the same as those on a traditional HSM since the tamper +detection mesh is the same. Only, in the inertial HSM any attack on the mesh has to be carried out while the mesh is +rotating, which for most types of attack will require some kind of CNC attack robot moving in sync with it. + +\subsection{Attacks on the mesh} + +There are two locations where one can attack a tamper-detection mesh. On one hand, the mesh itself can be tampered with. +This includes bridging its traces to allow for a hole to be cut. The other option is to tamper with the monitoring +circuit itself to prevent a damaged mesh from triggering an alarm and causing the HSM to erase its +contents~\cite{dexter2015}. Attacks in both locations are electronic attacks, i.e. they require electrical contact to +parts of the circuit. Traditionally, this contact is made by soldering or by placing a probe such as a thin needle. We +consider this contact infeasible to be performed on an object spinning at high speed without a complex setup that +rotates along with the object or that involves ion beams, electron beams or liquids. Thus, we consider them to be +practically infeasible outside of a well-funded, special-purpose laboratory. + +\subsection{Attacks on the rotation sensor} + +Instead of attacking the mesh in motion, an attacker may also try to first stop the rotor. To succeed, they would need +to fool the rotor's MEMS accelerometer. An electronic attack on the sensor or the monitoring microcontroller would be no +easier than directly bridging the mesh traces. + +MEMS accelerometers usually use a cantilever design, where a proof mass moves a cantilever whose precise position can be +measured electronically. A topic of recent academic interest have been acoustic attacks tampering with these +mechanics~\cite{trippel2017}. In the authors' estimate these attacks are too hard to control to be practically useful +against an inertial HSM. + +A possible way to attack the accelerometer inside an inertial HSM may be to first decapsulate it using laser ablation +synchronized with the device's rotation. Then, a fast-setting glue such as a cyanoacrylate could be deposited on the +moving MEMS parts, locking them in place. To mitigate this type of attack the accelerometer should be mounted in a +shielded place inside the security envelope. Further, this attack can only work if the rate of rotation and thus the +expected accelerometer readings are constant. If the rate of rotation is set to vary over time this type of attack is +quickly detected. In Appendix \ref{sec_degrees_of_freedom} we outline the constraints on sensor placement. + +\subsection{Attacks on the alarm circuitry} + +Besides trying to deactivate the tamper detection mesh, an electronic attack could also target the alarm circuitry +inside the stationary payload, or the communication link between rotor and payload. The link can be secured using a +cryptographically secured protocol like one would use for wireless radio links along with a high-frequency heartbeat +message. The alarm circuitry has to be designed such that it is entirely contained within the HSM's security envelope. +Like in conventional HSMs it has to be built to either tolerate or detect environmental attacks such as ones using +temperature, ionizing radiation, lasers, supply voltage variations, ultrasound or other vibration and gases or liquids. +Conventionally, incoming power rails are filtered thoroughly to prevent electrical attacks and other types of attacks +are prevented by sensors that thrigger an alarm. + +In an inertial HSM, the mesh monitoring circuit's tamper alarm is transmitted from rotor to stator through a wireless +link. Since an attacker may wirelessly spoof this link, it must be cryptographically secured. It also must be +bidirectional to allow the alarm signal receiver to verify link latency: If it were unidirectional, an attacker could +act as a Man-in-the-Middle and replay the mesh's authenticated ``no alarm'' signal at slightly below real-time speed +(say at $\SI{99}{\percent}$ speed). The receiver would not be able to distinguish between this attack and ordinary +deviations in the transmitter's local clock frequency. Thus, after some time the attacker can simply stop the rotor and +break the mesh while replaying the leftover recorded ``no alarm'' signal. Given the frequency stability of commercial +crystals, this would yield the attacker several seconds of undisturbed attack time per hour of recording time. + +\subsection{Fast and violent attacks} + +A variation of the above attacks on the alarm circuitry is to simply destroy the part of the HSM that erases data in +response to tampering before it can finish its job. This attack could use a tool such as a large hammer or a gun. +Mitigations for this type of attack include potting the payload inside a mechanically robust enclosure. Additionally, +the integrity of the entire alarm signalling chain can be checked continuously using a cryptographic heartbeat protocol. +A simple active-high or active-low alarm signal as it is used in traditional HSMs cannot be considered fail-safe in this +scenario as such an attack may well short-circuit or break PCB traces. + +\section{Prototype implementation} +\label{sec_proto} + +After elaborating the design principles of inertial HSMs and researching potential attack vectors we have validated +these theoretical studies by implementing a prototype rotary HSM. The main engineering challenges we solved in our +prototype are: + +\begin{enumerate} + \item Fundamental mechanical design suitable for rapid prototyping that can withstand a rotation of $\SI{500}{rpm}$. + \item Automatic generation of security mesh PCB layouts for quick adaption to new form factors. + \item Non-contact power transmission from stator to rotor. + \item Non-contact bidirectional data communication between stator and rotor. +\end{enumerate} + +\subsection{Mechanical design} + +We sized our prototype to have space for up to two full-size Raspberry Pi boards. Each one of these boards is already +more powerful than an ordinary HSM, but they are small enough to simplify our prototype's design. For low-cost +prototyping we designed our prototype to use printed circuit boards as its main structural material. The interlocking +parts were designed in FreeCAD as shown in Figure \ref{proto_3d_design}. The mechanical designs were exported to KiCAD +for electrical design before being sent to a commercial PCB manufacturer. Rotor and stator are built from interlocking, +soldered PCBs. The components are mounted to a $\SI{6}{\milli\meter}$ brass tube using FDM 3D printed flanges. The rotor +is driven by a small hobby quadcopter motor. + +Security is provided by a PCB security mesh enveloping the entire system and extending to within a few millimeters of +the shaft. For security it is not necessary to cover the entire circumference of the module with mesh, so we opted to +use only three narrow longitudinal struts to save weight. + +To mount the entire HSM, we chose to use ``2020'' modular aluminium profile. + +\begin{figure} + \center + \includegraphics[height=7cm]{proto_3d_design.jpg} + \caption{The 3D CAD design of the prototype.} + \label{proto_3d_design} +\end{figure} + +\subsection{PCB security mesh generation} + +The security mesh covers a total of five interlocking PCBs. A sixth PCB contains the monitoring circuit and connects to +these mesh PCBs. To allow us to quickly iterate our design without manually re-routing several large security meshes +for every mechanical chage we wrote a plugin for the KiCAD EDA suite that automatically generates parametrized security +meshes. When KiCAD is used in conjunction with FreeCAD through FreeCAD's KiCAD StepUp plugin, this ends up in an +efficient toolchain from mechanical CAD design to security mesh PCB gerber files. The mesh generation plugin can be +found at its website\footnote{\url{https://blog.jaseg.de/posts/kicad-mesh-plugin/}}. The meshes it produces have a +practical level of security in our application. + +The mesh generation process starts by overlaying a grid on the target area. It then produces a randomized tree covering +this grid. The individual mesh traces are then traced along a depth-first search through this tree. A visualization of +the steps is shown in Figure \ref{mesh_gen_viz}. A sample of the production results from our prototype is shown in +Figure \ref{mesh_gen_sample}. + +\begin{figure} + \center + \includegraphics[width=9cm]{mesh_gen_viz.pdf} + \caption{Overview of the automatic security mesh generation process. 1 - the blob is the example target area. 2 - A + grid is overlayed. 3 - Grid cells outside of the target area are removed. 4 - A random tree covering the remaining + cells is generated. 5 - The mesh traces are traced along a depth-first walk of the tree. 6 - Result.} + \label{mesh_gen_viz} +\end{figure} + +\begin{figure} + \center + \includegraphics[width=6cm]{mesh_scan_crop.jpg} + \caption{A section of the security mesh PCB we produced with our toolchain for the prototype HSM.} + \label{mesh_gen_sample} +\end{figure} + +\subsection{Data transmission through rotating joint} + +With the mesh done, the next engineering challenge was the mesh monitoring data link between rotor and stator. As a +baseline solution, we settled on a $\SI{115}{\kilo\baud}$ UART signal sent through a simple bidirectional infrared link. +In the transmitter, the UART TX line on-off modulates a $\SI{920}{\nano\meter}$ IR LED through a common-emitter driver +transistor. In the receiver, an IR PIN photodiode reverse-biased to $\frac{1}{2}V_\text{CC}$ is connected to a +reasonably wideband transimpedance amplifier (TIA) with a $\SI{100}{\kilo\ohm}$ transimpedance. As shown in Figure +\ref{photolink_schematic}, the output of this TIA is fed through another $G=100$ amplifier whose output is then squared +up by a comparator. We used an \texttt{MCP6494} quad CMOS op-amp. At a specified $\SI{2}{\milli\ampere}$ current +consumption it is within our rotor's power budget, and its Gain Bandwidth Product of $\SI{7.5}{\mega\hertz}$ yields a +useful transimpedance in the photodiode-facing TIA stage. + +To reduce the requirements on power transmission to the rotor, we have tried to reduce power consumption of the +rotor-side receiver/transmitter pair trading off stator-side power consumption. One part of this is that we use +a wide-angle photodiode and IR LED on the stator, but use narrow-angle components on the rotor. The two rx/tx pairs are +arranged next to the motor on opposite sides. By placing the narrow-angle rotor rx/tx components on the outside as +shown in Figure \ref{ir_tx_schema}, the motor shields both IR links from crosstalk. The rotor transmitter LED is +driven at $\SI{1}{\milli\ampere}$ while the stator transmitter LED is driven at $\SI{20}{\milli\ampere}$. + +\begin{figure} + \center + \includegraphics{ir_tx_schema.pdf} + \caption{Schema of our bidirectional IR communication link between rotor and stator, view along axis of rotation. 1 + - Rotor base PCB. 2 - Stator IR link PCB. 3 - Motor. 4 - receiver PIN photodiode. 5 - transmitter IR LED.} + \label{ir_tx_schema} +\end{figure} + +\begin{figure} + \center + \includegraphics[width=9cm]{photolink_schematic.pdf} + \caption{Schematic of the IR communication link. Component values are only examples. In particular C2 depends highly + on the photodiode used and stray capacitances due to the component layout.} + \label{photolink_schematic} +\end{figure} + +\subsection{Power transmission through rotating joint} +Besides the data link, the other electrical interface we need between rotor and stator is for power transmission. We +power Since this prototype serves only demonstration purposes, we chose to use the simplest possible method of power +transmission: solar cells. We mounted six series-connected solar cells in three commercially available modules on the +circular PCB at the end of our cylindrical rotor. The solar cells direclty feed the rotor's logic supply with buffering +by a large $\SI{33}{\micro\farad}$ ceramic capacitor. With six cells in series, they provide around $\SI{3.0}{\volt}$ at +several tens of $\si{\milli\ampere}$ given sufficient illumination. + +For simplicity and weight reduction, at this point we chose to forego large buffer capacitors on the rotor. This means +variations in solar cell illumination directly couple into the microcontroller's supply rail. Initially, we experimented +with regular residential LED light bulbs, but those turned out to have too much flicker and lead to our microcontroller +frequently rebooting. Trials using an incandecent light produced a stable supply, but the large amount of infrared light +emitted by the incandecent light bulb severely disturbed our near-infrared communication link. As a consequence of +this, we settled on a small LED light intended for use as a studio light that provdided us with almost flicker-free +light at lower frequencies, leading to a sufficiently stable microcontroller VCC rail without any disturbance to the IR +link. + +\subsection{Evaluation} + +After building our prototype inertial HSM according to the design decisions we outlined above, we performed a series of +experiments to validate the critical components of the design. + +During these experiments, our prototype performed as intended. Both power and data transmission through the rotating +joint were working reliably. Figure \ref{prototype_early_comms} shows our prototype performing reliably at maximum speed +for the first time. Our improvised IR link is open in both directions for about $\SI{60}{\degree}$ of the rotation, +which allows us to reliably transfer several tens of bytes in each direction during the receivers' fly-by even at high +speed of rotation. As a result of our prototype experiments, we consider a larger-scale implementation of the inertial +HSM concept practical. + +\begin{figure} + \center + \includegraphics[width=8cm]{prototype_early_comms_small.jpg} + \caption{The protoype when we first achieved reliable power transfer and bidirectional communication between stator + and rotor. In the picture, the prototype was communicating reliably up to the maximum $\approx\SI{1500}{rpm}$ that + we could get out of its hobby quadcopter parts.} + \label{prototype_early_comms} +\end{figure} + +\section{Conclusion} + +\label{sec_conclusion} To conclude, in this paper we introduced inertial hardware security modules (iHSMs), a +novel concept for the construction of highly secure hardware security modules from inexpensive, commonly available +parts. We elaborated the engineering considerations underlying a practical implementation of this concept. We +implemented a prototype demonstrating practical solutions to the significant engineering challenges of this concept. We +analyzed the concept for its security properties and highlighted its ability to significantly strengthen otherwise weak +tamper detection barriers. + +Inertial HSMs offer a high level of security beyond what traditional techniques can offer. They allow the construction +of devices secure against a wide range of practical attacks at prototype quantities and without specialized tools. We +hope that this simple construction will stimulate academic research into secure hardware. + +\printbibliography[heading=bibintoc] +\appendix +\subsection{Spinning mesh energy calculations} +\label{sec_energy_calculations} +Assume that the spinning mesh sensor should send its tamper status to the static monitoring circuit at least once every +$T_\text{tx} = \SI{10}{\milli\second}$. At $\SI{100}{\kilo\baud}$ a transmission of a one-byte message in standard UART +framing would take $\SI{100}{\micro\second}$ and yield an $\SI{1}{\percent}$ duty cycle. If we assume an optical or RF +transmitter that requires $\SI{10}{\milli\ampere}$ of active current, this yields an average operating current of +$\SI{100}{\micro\ampere}$. Reserving another $\SI{100}{\micro\ampere}$ for the monitoring circuit itself we arrive at an +energy consumption of $\SI{1.7}{\ampere\hour\per\year}$. + +\subsubsection{Battery power} +\label{sec_energy_calculations_battery} +The annual energy consumption we calculated above is about equivalent to the capacity of a single CR123A +lithium primary cell. Using several such cells or optimizing power consumption would thus easily yield several years of +battery life. + +\subsubsection{LED and solar cell} +\label{sec_energy_calculations_led} +Let us assume an LED with a light output of $\SI{1}{W}$ illuminating a small solar cell. Let us pessimistically assume a +$\SI{5}{\percent}$ conversion efficiency in the solar cell. Let us assume that when the rotor is at its optimal +rotational angle, $\SI{20}{\percent}$ of the LED's light output couple into the solar cell. Let us assume that we loose +another $\SI{90}{\percent}$ of light output on average during one rotation when the rotor is in motion. This results in +an energy output from the solar cell of $\SI{1}{\milli\watt}$. Assuming a $\SI{3.3}{\volt}$ supply this yields +$\SI{300}{\micro\ampere}$ for our monitoring circuit. This is enough even with some conversion losses in the step-up +converter boosing the solar cell's $\SI{0.6}{\volt}$ working voltage to the monitoring circuit's supply voltage. + +\subsection{Minimum angular velocity: Rotating human attacker} +\label{sec_minimum_angular_velocity} + +An attacker might try to rotate along with the HSM to attack the security mesh without triggering the accelerometer. Let +us pessimistically assume that the attacker has the axis of rotation running through their center of mass. The +attacker's body is probably at least $\SI{200}{\milli\meter}$ wide along its shortest axis, resulting in a minimum +radius from axis of rotation to surface of about $\SI{100}{\milli\meter}$. We choose $\SI{250}{\meter\per\second^2}$ as +an arbitrary acceleration well past the range tolerable by humans according to Wikipedia. Centrifugal acceleration is +$a=\omega^2 r$. In our example this results in a minimum angular velocity of $\omega_\text{min} = \sqrt{\frac{a}{r}} = +\sqrt{\frac{\SI{250}{\meter\per\second^2}}{\SI{100}{\milli\meter}}} \approx 8\cdot 2\pi\frac{1}{\si{\second}} \approx 500 +\text{rpm}$. + +\subsection{Fooling the accelerometer} +\label{sec_degrees_of_freedom} + +Let us consider a general inertial HSM with one or more sensors that is attacked by an attacker. In this scenario, it is +reasonable to assume that the rotating parts of the HSM are rigidly coupled to one another and will stay that way: For +the attacker to decouple parts of the HSM (e.g. to remove one of its accelerometers from the PCB), the attacker would +already have to circumvent the rotor's security mesh. + +Assuming the HSM is stationary, a sensor on the rotating part will experience two significant accelerations: +\begin{enumerate} + \item Gravity $g = 9.8\frac{m}{s^2}$ + \item Centrifugal force $a_C=\omega^2 r$, in the order of $\SI{1000}{\meter\per\second^2}$ or $100 g$ at + $r=\SI{100}{\milli\meter}$ and $\SI{1000}{rpm}$ +\end{enumerate} + +Due to the vast differences in both radius and angular velocity, we can neglegt any influence of the earth's rotation on +our system. + +In normal operation, the HSM is stationary ($\mathbf v=0$) and the HSM's motor is tuned to exactly counter-balance +friction so the rotor's angular velocity remains constant. As a rigid body, the rotor's motion is fully defined by its +rotation and translation. In total, this makes for six degrees of freedom. The three degrees of freedom of linear +translation we can measure directly with an accelerometer in the stationary part on the inside of the HSM. This +accelerometer could detect any rapid acceleration of the HSM's rotor. To measure rotation, we could mount a +gyroscope on the rotor to detect deceleration. The issue with this is that like other MEMS acceleration sensors, +commercial MEMS gyroscopes are vulnerable to drift and an attacker could slowly decelerate the rotor without being +detected. + +A linear accelerometer mounted on the rotor however is able to catch even this attack. Subtracting gravity, it could +determine both magnitude and direction of the centrifugal force, which is proportional to the square of angular velocity +and not its derivative. + +In summary, a single three-axis accelerometer on the rotor combined with a three-axis accelerometer in the stator would +be a good baseline configuration. + +\subsection{Patents and licensing} +During development, we performed several hours of research on prior art for the inertial HSM concept. Yet, we could not +find any mentions of similar concepts either in academic literature or in patents. Thus, we are likely the inventors of +this idea and we are fairly sure it is not covered by any patents or other restrictions at this point in time. + +Since the concept is primarily attractive for small-scale production and since cheaper mass-production alternatives are +already commercially available, we have decided against applying for a patent and we wish to make it available to the +general public without any restrictions on its use. This paper itself is licensed CC-BY-SA (see below). As for the +inertial HSM concept, we invite you to use it as you wish and to base your own work on our publications without any fees +or commercial restrictions. Where possible, we ask you to cite this paper and attribute the inertial HSM concept to its +authors. + +\center{ + \center{\ccbysa} + + \center{This work is licensed under a Creative-Commons ``Attribution-ShareAlike 4.0 International'' license. The + full text of the license can be found at:} + + \center{\url{https://creativecommons.org/licenses/by-sa/4.0/}} + + \center{For alternative licensing options, source files, questions or comments please contact the authors.} + + \center{This is version \texttt{\input{version.tex}\unskip} generated on \today. The git repository can be found at:} + + \center{\url{https://git.jaseg.de/rotohsm.git}} +} +\end{document} diff --git a/doc/paper/rotohsm_tech_report.pdf b/doc/paper/rotohsm_tech_report.pdf new file mode 100644 index 0000000..d87bc8e Binary files /dev/null and b/doc/paper/rotohsm_tech_report.pdf differ diff --git a/doc/paper/rotohsm_tech_report.tex b/doc/paper/rotohsm_tech_report.tex new file mode 100644 index 0000000..e9d571f --- /dev/null +++ b/doc/paper/rotohsm_tech_report.tex @@ -0,0 +1,300 @@ +\documentclass[10pt,journal,a4paper]{IEEEtran} +\usepackage[english]{babel} +\usepackage[utf8]{inputenc} +\usepackage[T1]{fontenc} +\usepackage[ + backend=biber, + style=numeric, + natbib=true, + url=false, + doi=true, + eprint=false + ]{biblatex} +\addbibresource{rotohsm.bib} +\usepackage{amssymb,amsmath} +\usepackage{listings} +\usepackage{eurosym} +\usepackage{wasysym} +\usepackage{amsthm} +\usepackage{tabularx} +\usepackage{multirow} +\usepackage{multicol} +\usepackage{tikz} +\usepackage{mathtools} +\DeclarePairedDelimiter{\ceil}{\lceil}{\rceil} +\DeclarePairedDelimiter{\paren}{(}{)} + +\usetikzlibrary{arrows} +\usetikzlibrary{chains} +\usetikzlibrary{backgrounds} +\usetikzlibrary{calc} +\usetikzlibrary{decorations.markings} +\usetikzlibrary{decorations.pathreplacing} +\usetikzlibrary{fit} +\usetikzlibrary{patterns} +\usetikzlibrary{positioning} +\usetikzlibrary{shapes} + +\usepackage[binary-units]{siunitx} +\DeclareSIUnit{\baud}{Bd} +\DeclareSIUnit{\year}{a} +\usepackage{hyperref} +\usepackage{tabularx} +\usepackage{commath} +\usepackage{graphicx,color} +\usepackage{ccicons} +\usepackage{subcaption} +\usepackage{float} +\usepackage{footmisc} +\usepackage{array} +\usepackage[underline=false]{pgf-umlsd} +\usetikzlibrary{calc} +%\usepackage[pdftex]{graphicx,color} +\usepackage{epstopdf} +\usepackage{pdfpages} +\usepackage{minted} % pygmentized source code + +\renewcommand{\floatpagefraction}{.8} +\newcommand{\degree}{\ensuremath{^\circ}} +\newcolumntype{P}[1]{>{\centering\arraybackslash}p{#1}} + +\usepackage{fancyhdr} +\fancyhf{} +\fancyfoot[C]{\thepage} +\newcommand{\includenotebook}[2]{ + \fancyhead[C]{Included Jupyter notebook: #1} + \includepdf[pages=1, + pagecommand={\thispagestyle{fancy}\section{#1}\label{#2_notebook}} + ]{resources/#2.pdf} + \includepdf[pages=2-, + pagecommand={\thispagestyle{fancy}} + ]{resources/#2.pdf} +} + +\begin{document} + +\title{Tech Report: Inerial HSMs Thwart Advanced Physical Attacks} +\author{\IEEEauthorblockN{ + Jan Sebastian Götte\IEEEauthorrefmark{1}\IEEEauthorrefmark{2} \and + Björn Scheuermann\IEEEauthorrefmark{1}\IEEEauthorrefmark{2} + }\\ + \IEEEauthorblockA{ + \IEEEauthorrefmark{1}Alexander von Humboldt Institut für Internet und Gesellschaft (HIIG)\\ + \IEEEauthorrefmark{2}Humboldt-Universität zu Berlin\\ + \texttt{\textbf{\small goette@jaseg.de}}, \texttt{\textbf{\small scheuermann@informatik.hu-berlin.de}} + } +} +\date{2021-01-05} +\maketitle + +\section*{Abstract} + +In this tech report, we introduce a novel countermeasure against physical attacks: Inertial hardware security modules +(iHSMs). Conventional systems have in common that they try to detect attacks by crafting sensors responding to +increasingly minute manipulations of the monitored security boundary or volume. Our approach is novel in that we reduce +the sensitivity requirement of security meshes and other sensors and increase the complexity of any manipulations by +rotating the security mesh or sensor at high speed---thereby presenting a moving target to an attacker. Attempts to stop +the rotation are easily monitored with commercial MEMS accelerometers and gyroscopes. Our approach leads to a HSM that +can easily be built from off-the-shelf parts by any university electronics lab, yet offers a level of security that is +comparable to commercial HSMs. + +This tech report is the abridged version of our forthcoming paper. + +\section{Introduction} + +While information security technology has matured a great deal in the last half century, physical security has barely +changed. Given the right skills, physical access to a computer still often means full compromise. The physical +security of modern server hardware hinges on what lock you put on the room it is in. + +Currently, servers and other computers are rarely physically secured as a whole. Servers sometimes have a simple lid +switch and are put in locked ``cages'' inside guarded facilities. This usually provides a good compromise between +physical security and ease of maintenance. To handle highly sensitive data in applications such as banking or public key +infrastructure, general-purpose and low-security servers are augmented with dedicated, physically secure cryptographic +co-processors such as trusted platform modules (TPMs) or hardware security modules (HSMs). Using a limited amount of +trust in components such as the CPU, the larger system's security can then be reduced to that of its physically secured +TPM~\cite{newman2020,frazelle2019,johnson2018}. + +Like smartcards, TPMs rely on a modern IC being hard to tamper with. Shrinking things to the nanoscopic level to secure +them against tampering is a good engineering solution for some years to come. However, in essence this is a type of +security by obscurity: Obscurity here referring to the rarity of the equipment necessary to attack modern +ICs~\cite{albartus2020,anderson2020}. + +HSMs rely on a fragile foil with much larger-scale conductive traces being hard to remove intact. While we are certain +that there still are many insights to be gained in both technologies, we wish to introduce a novel approach to sidestep +the manufacturing issues of both and provide radically better security against physical attacks. Our core observation +is that any cheap but coarse HSM technology can be made much more difficult to attack by moving it very quickly. + +For example, consider an HSM as it is used in online credit card payment processing. Its physical security level is set +by the structure size of its security mesh. An attack on its mesh might involve fine drill bits, needles, wires, glue, +solder and lasers~\cite{drimer2008}. Now consider the same HSM mounted on a large flywheel. In addition to its usual +defenses the HSM is now equipped with an accelerometer that it uses to verify that it is spinning at high speed. How +would an attacker approach this HSM? They would have to either slow down the rotation---which triggers the +accelerometer---or they would have to attack the HSM in motion. The HSM literally becomes a moving target. At slow +speeds, rotating the entire attack workbench might be possible but rotating frames of reference quickly become +inhospitable to human life. Since non-contact electromagnetic or optical attacks are more limited in the first place and +can be shielded, we have effectively forced the attacker to use an attack robot. + +In Section~\ref{sec_related_work}, we will give an overview of the state of the art in the physical security of HSMs. On +this basis, in Section~\ref{sec_ihsm_construction} we will elaborate the principles of our inertial HSM approach. We +conclude this paper with a general evaluation of our concept in Section~\ref{sec_conclusion}. + +\section{Related work} +\label{sec_related_work} +% summaries of research papers on HSMs. I have not found any actual prior art on anything involving mechanical motion +% beyond ultrasound. + +In this section, we will briefly explore the history of HSMs and the state of academic research on active tamper +detection. + +HSMs are an old technology tracing back decades in their electronic realization. Today's common approach of monitoring +meandering electrical traces on a fragile foil that is wrapped around the HSM essentially transforms the security +problem into the challenge to manufacture very fine electrical traces on a flexible foil~\cite{isaacs2013, immler2019, +anderson2020}. There has been some research on monitoring the HSM's inside using e.g.\ electromagnetic +radiation~\cite{tobisch2020, kreft2012} or ultrasound~\cite{vrijaldenhoven2004} but none of this research +has found widespread adoption yet. + +In~\cite{anderson2020}, Anderson gives a comprehensive overview on physical security. An example they cite is the IBM +4758 HSM whose details are laid out in depth in~\cite{smith1998}. This HSM is an example of an industry-standard +construction. Although its turn of the century design is now a bit dated, the construction techniques of the physical +security mechanisms have not evolved much in the last two decades. Besides auxiliary temperature and radiation sensors +to guard against attacks on the built-in SRAM memory, the module's main security barrier uses the traditional +construction of a flexible mesh wrapped around the module's core. In~\cite{smith1998}, the authors state the module +monitors this mesh for short circuits, open circuits and conductivity. The fundamental approach to tamper detection and +construction is similar to other commercial offerings~\cite{obermaier2018,drimer2008,anderson2020,isaacs2013}. + +To the best of our knowledge, we are the the first to propose a mechanically moving HSM security barrier as part of a +hardware security module. Most academic research concentrates on the issue of creating new, more sensitive security +barriers for HSMs~\cite{immler2019} while commercial vendors concentrate on means to certify and cheaply manufacture +these security barriers~\cite{drimer2008}. Our concept instead focuses on the issue of taking any existing, cheap +low-performance security barrier and transforming it into a marginally more expensive but high-performance one. The +closest to a mechanical HSM that we were able to find during our research is an 1988 patent~\cite{rahman1988} that +describes a mechanism to detect tampering along a communication cable by enclosing the cable inside a conduit filled +with pressurized gas. + +\section{Inertial HSM construction and operation} +\label{sec_ihsm_construction} + +Mechanical motion has been proposed as a means of making things harder to see with the human eye~\cite{haines2006} and is +routinely used in military applications to make things harder to hit~\cite{terdiman2013} but we seem to be the first to +use it in tamper detection. If we consider different ways of moving an HSM to make it harder to tamper with, we find +that making it spin has several advantages. + +First, the HSM has to move fairly fast. If any point of the HSM's tamper sensing mesh moves slow enough for a human to +follow, it becomes a weak spot. E.g.\ in a linear pendulum motion, the pendulum becomes stationary at its apex. Second, +a spinning HSM is compact compared to alternatives like an HSM on wheels. Finally, rotation leads to easily predictable +accelerometer measurements. A beneficial side-effect of spinning the HSM is that if the axis of rotation is within the +HSM itself, an attacker trying to follow the motion would have to rotate around the same axis. Their tangential linear +velocity would rise linearly with the radius from the axis of rotation, which allows us to limit the approximate maximum +size and mass of an attacker using an assumption on tolerable centrifugal force. In this consideration the axis of +rotation is a weak spot, but that can be mitigated using multiple nested layers of protection. + +\begin{figure} + \center + \includegraphics{concept_vis_one_axis.pdf} + \caption{Concept of a simple spinning inertial HSM. 1 - Shaft. 2 - Security mesh. 3 - Payload. 4 - + Accelerometer. 5 - Shaft penetrating security mesh.} + \label{fig_schema_one_axis} +\end{figure} + +In a rotating reference frame, centrifugal force is proportional to the square of angular velocity and proportional to +distance from the axis of rotation. We can exploit this fact to create a sensor that detects any disturbance of the +rotation by placing a linear accelerometer at some distance from the axis of rotation. During constant rotation, after +subtracting gravity both acceleration tangential to the rotation and along the axis of rotation will be zero. +Centrifugal acceleration will be constant. + +Large centrifugal acceleration at high speeds poses the engineering challenge of preventing the whole thing from flying +apart, but it also creates an obstacle to any attacker trying to manipulate the sensor. We do not need to move the +entire contents of the HSM. It suffices if we move the tamper detection barrier around a stationary payload. This +reduces the moment of inertia of the moving part and it means we can use cables for payload power and data. Even at +moderate speeds above $\SI{500}{rpm}$, an attack would have to be carried out using a robot. + +\subsection{Mechanical layout} + +Thinking about the concrete construction of our mechanical HSM, the first challenge is mounting both mesh and payload on +a single shaft. The simplest way we found to mount a stationary payload inside of a spinning security mesh is a hollow +shaft. The payload can be mounted on a fixed rod threaded through this hollow shaft along with wires for power and +data. The shaft is a weak spot of the system, but this weak spot can be alleviated through either careful construction +or a second layer of rotating meshes with a different axis of rotation. Configurations that do not use a hollow-shaft +motor are possible, but may require additional bearings to keep the stator from vibrating. + +The next design choice we have to make is the physical structure of the security mesh. The spinning mesh must be +designed to cover the entire surface of the payload, but compared to a traditional HSM it suffices if it sweeps over +every part of the payload once per rotation. This means we can design longitudinal gaps into the mesh that allow outside +air to flow through to the payload. In traditional boundary-sensing HSMs, cooling of the payload processor is a serious +issue since any air duct or heat pipe would have to penetrate the HSM's security boundary. This problem can only be +solved with complex and costly siphon-style constructions, so in commercial systems heat conduction is used +exclusively~\cite{isaacs2013}. This limits the maximum power dissipation of the payload and thus its processing power. +Our setup allows direct air cooling of regular heatsinks. This greatly increases the maximum possible power dissipation +of the payload and unlocks much more powerful processing capabilities. In an evolution of our design, the spinning mesh +could even be designed to \emph{be} a cooling fan. + +\subsection{Spinning mesh power and data transmission} + +On the electrical side, the idea of a security mesh spinning at more than $\SI{500}{rpm}$ leaves us with a few +implementation challenges. Since the spinning mesh must be monitored for breaks or short circuits continuously, we need +both a power supply for the spinning monitoring circuit and a data link to the stator. + +We think that a bright lamp shining at a rotating solar panel is a good starting point. In contrast to e.g.\ slip +rings, this setup is mechanically durable at high speeds and it also provides reasonable output power. A battery may not +provide a useful lifetime without power-optimization. Likewise, an energy harvesting setup may not provide enough +current to supply peak demand. + +Since the monitoring circuit uses little current, power transfer efficiency is not important. On the other hand, cost +may be a concern in a production device. Here it may prove worthwhile to replace the solar cell setup with an extra +winding on the rotor of the BLDC motor driving the spinning mesh. This motor is likely to be a custom part, so adding +an extra winding is unlikely to increase cost significantly. More traditional inductive power transfer may also be an +option if it can be integrated into the mechanical design. + +\begin{figure} + \center + \includegraphics{ir_tx_schema.pdf} + \caption{Example of a bidirectional IR communication link between rotor and stator, view along axis of rotation. 1 + - Rotor base plate. 2 - Stator base plate. 3 - Motor. 4 - receiver PIN photodiode. 5 - transmitter IR LED.} + \label{ir_tx_schema} +\end{figure} + +Besides power, the data link between spinning mesh and payload is critical to the HSM's design. This link is used to +transmit the occassional status report along with a low-latency alarm trigger (``heartbeat'') signal from mesh to payload. +A simple infrared optical link as shown in Figure~\ref{ir_tx_schema} may be a good solution for this purpose. + +\section{Conclusion} + +\label{sec_conclusion} To conclude, in this tech report we introduced inertial hardware security modules (iHSMs), a +novel concept for the construction of highly secure hardware security modules from inexpensive, commonly available +parts. We elaborated the engineering considerations underlying a practical implementation of this concept. + +Inertial HSMs offer a high level of security beyond what traditional techniques can offer. They allow the construction +of devices secure against a wide range of practical attacks at prototype quantities and without specialized tools. We +hope that this simple construction will stimulate academic research into secure hardware. + +\printbibliography[heading=bibintoc] +\appendix + +\subsection{Patents and licensing} +During development, we performed several hours of research on prior art for the inertial HSM concept. Yet, we could not +find any mentions of similar concepts either in academic literature or in patents. Thus, we are likely the inventors of +this idea and we are fairly sure it is not covered by any patents or other restrictions at this point in time. + +Since the concept is primarily attractive for small-scale production and since cheaper mass-production alternatives are +already commercially available, we have decided against applying for a patent and we wish to make it available to the +general public without any restrictions on its use. This paper itself is licensed CC-BY-SA (see below). As for the +inertial HSM concept, we invite you to use it as you wish and to base your own work on our publications without any fees +or commercial restrictions. Where possible, we ask you to cite this paper and attribute the inertial HSM concept to its +authors. + +\center{ + \center{\ccbysa} + + \center{This work is licensed under a Creative-Commons ``Attribution-ShareAlike 4.0 International'' license. The + full text of the license can be found at:} + + \center{\url{https://creativecommons.org/licenses/by-sa/4.0/}} + + \center{For alternative licensing options, source files, questions or comments please contact the authors.} + + \center{This is version \texttt{\input{version.tex}\unskip} generated on \today. Once the full paper has been + published, this project's git repository will be available at:} + + \center{\url{https://git.jaseg.de/rotohsm.git}} +} +\end{document} -- cgit