Wang Shuo

Wireless charging is becoming an increasingly popular charging solution in portable electronic products for a more convenient and safer charging experience than conventional wired charging. However, our research identified new vulnerabilities in wireless charging systems, making them susceptible to intentional electromagnetic interference. These vulnerabilities facilitate a set of novel attack vectors, enabling adversaries to manipulate the charger and perform a series of attacks. In this paper, we propose VoltSchemer, a set of innovative attacks that grant attackers control over commercial-off-the-shelf wireless chargers merely by modulating the voltage from the power supply. These attacks represent the first of its kind, exploiting voltage noises from the power supply to manipulate wireless chargers without necessitating any malicious modifications to the chargers themselves. The significant threats imposed by VoltSchemer are substantiated by three practical attacks, where a charger can be manipulated to: control voice assistants via inaudible voice commands, damage devices being charged through overcharging or overheating, and bypass Qi-standard specified foreign-object-detection mechanism to damage valuable items exposed to intense magnetic fields. We demonstrate the effectiveness and practicality of the VoltSchemer attacks with successful attacks on 9 top-selling COTS wireless chargers. Furthermore, we discuss the security implications of our findings and suggest possible countermeasures to mitigate potential threats.

Side-channel analysis has been proven effective at detecting hardware Trojans in integrated circuits (ICs). However, most detection techniques rely on large external probes and antennas for data collection and require a long measurement time to detect Trojans. Such limitations make these techniques impractical for run-time deployment and ineffective in detecting small Trojans with subtle side-channel signatures. To overcome these challenges, we propose a Programmable Sensor Array (PSA) for run-time hardware Trojan detection, localization, and identification. PSA is a tampering-resilient integrated on-chip magnetic field sensor array that can be re-programmed to change the sensors' shape, size, and location. Using PSA, EM side-channel measurement results collected from sensors at different locations on an IC can be analyzed to localize and identify the Trojan. The PSA has better performance than conventional external magnetic probes and state-of-the-art on-chip single-coil magnetic field sensors. We fabricated an AES-128 test chip with four AES Hardware Trojans. They were successfully detected, located, and identified with the proposed on-chip PSA within 10 milliseconds using our proposed cross-domain analysis.

PCB inductors can enhance the integration of power electronics systems, and hence are of high demand. Nevertheless, PCB inductors encounter challenges such as the severe skin effect and significant inductance reduction in both ac and dc condition as trace widths increase. This paper identifies the cause of this inductance reduction and proposes an innovative PCB inductor structure to mitigate these issues. The new design also utilizes split wires to effectively suppress the skin effect. Comprehensive simulations and experiments demonstrate that the proposed ESPI can achieve both high energy density and low near-field magnetic radiation. The design files, simulations, and experiment data are included in the multimedia folder

In portable electronics applications, although near-field communication (NFC) works at 13.56MHz and wireless charging (WLC) works at from 87kHz-205kHz, the efficient integration of NFC antenna coil and WLC receiver coil can reduce the volume and cost of portable electronic equipment. In this paper, a novel NFC and WLC coil integration technology is proposed based on the wide-band impedance models of the coil. The circuit model of the proposed integrated coil is developed. Based on the developed model, the technique to improve NFC inductance’s effective frequency range is investigated. Furthermore, the physical meaning of the NFC inductance and its magnetic field distribution is analyzed. Finally, the proposed integrated coil is experimentally validated.

In the realm of modern power electronics, motors find extensive application across various domains. To enhance energy density and facilitate miniaturization while achieving faster switching speeds, power electronic devices with such characteristics are widely employed for motor control. However, the adoption of these high-speed switching devices introduces a new set of challenges related to Electromagnetic Interference (EMI). Previous research has regarded radiated EMI (RE) from motors to be non-dominant in the presence of grounded motor casings. However, in certain circumstances, radiation generated by motors cannot be overlooked. In this paper, the radiation model is proposed to develop the LF radiated emissions for the motor. The mechanism of radiated emissions generated from the motor is analyzed in detail based on electrostatic theory. The developed model is validated via experiments. The …

Radiated electromagnetic interference (EMI) is a very important research topic in power electronics systems in recent years as the switching frequencies of power electronics converters increase significantly with the adoption of wide-bandgap (WBG) devices. In this survey article, the radiation mechanisms of both near-field and far-field radiation in power electronics systems are first reviewed. Second, for noise sources, the switching characteristics of switching devices and their impacts on radiated EMI were discussed. Third, high frequency radiated EMI modeling and prediction techniques are summarized for both isolated and non-isolated power converters. Low frequency radiated EMI modeling and prediction techniques were also reviewed. Fourth, techniques developed for the mitigation of noise sources, the reduction of noise on its propagation paths and the optimization of critical PCB traces were fully reviewed …

Radiated electromagnetic interference (EMI) is a very important research topic in power electronics systems in recent years as the switching frequency of power electronics converters increases significantly. In this article, the mechanism of radiated EMI generation and propagation in power electronics systems was disclosed, a generalized radiated EMI model was developed at first. Then, switching characteristics and its impact on radiated EMI was compared between wide bandgap (WBG) devices and Si MOSFETs. Third, the radiated EMI modeling and mitigation techniques including component improvement, PCB layout improvement, high-frequency EMI filters, and shielding, etc. were reviewed and summarized. Both the radiated EMI research above 30MHz and below 30MHz are surveyed. Future challenges and research topics for the radiated EMI are systematically summarized in the end.

Hardware Trojans (HTs) are malicious circuits planted in Integrated Circuits (ICs). Multiple techniques using Side-Channel signals to detect HTs have been developed over the past decade. However, most of this research focuses on HT detection. Few of them explore the possibility of either identifying different Hardware Trojans implemented inside ICs or detecting inactive HTs. We propose a runtime EM side-channel analysis workflow (HT-EMIS) that uses a convolutional neural network to address the shortcomings above. By analyzing EM side-channel leakage from an FPGA, our tool can identify known types of HTs implemented inside a design and reports whether they are inactive or active with 100% accuracy. Additionally, we are able to successfully detect new unseen HTs with this model in 98.7% of test cases, due to the fact that HTs inserted at the Register Transfer Level with similar triggers and payloads …

Qi standard, widely used in consumer electronics wireless charging, requires an information exchange between the charger and the charged device. The Amplitude Shift Keying (ASK) technique employed for data transmission from the charged device to the charger is susceptible to disturbances due to load variations or noises. The conventional approach to addressing this issue involves introducing extra modulation circuits to dynamically adjust the modulation depth in response to interference conditions. This paper introduces an innovative control strategy for the synchronous rectifier in the charged device, which doubles the ASK modulation depth. With this technology, the ASK communication can achieve more flexibility in modulating depth, potentially leading to the removal of redundant modulation circuits, reduction of overall system costs, size, complexity, and enhancement of system reliability.

Trusted Execution Environments (TEEs) are deployed in many CPU designs because of the confidentiality and integrity guarantees they provide. ARM TrustZone is a TEE extensively deployed on smart phones, IoT devices, and notebooks. Specifically, TrustZone is used to separate code execution and data into two worlds, normal world and secure world. However, this separation inherently prevents traditional fuzzing approaches which rely upon coverage-guided feedback and existing fuzzing research is, therefore, extremely limited. In this paper, we present a native and generic method to perform efficient and scalable feedback-driven fuzzing on Trusted Applications (TAs) using ARM CoreSight. We propose LightEMU, a novel fuzzing framework that allows us to fuzz TAs by decoupling them from relied TEE. We argue that LightEMU is a promising first-stage approach for rapidly discovering TA vulnerabilities prior to investing effort in whole system TEE evaluation precisely because the majority of publicly disclosed TrustZone bugs reside in the TA code itself. We implement LightEMU and adapt it to Teegris, Trusty, OP-TEE and QSEE and evaluate 8 real-world TAs while triggering 3 unique crashes and achieving x10 time speedup when fuzzing TAs using the state-of-the-art TrustZone fuzzing framework.

The proliferation of power electronics has brought great challenges to electromagnetic susceptibility (EMS) problems. This paper summarized all related substandards in two major requirements, DO-160G and MIL-STD-461G, and comprehensively compared test contents, levels, procedures, and setups between them. The critical difference in similar tests is reviewed and some confusing descriptions are discussed. Therefore, a refined and complete overview to help quickly understand these complicated requirements is provided for both researchers and engineers. A guideline to choose applicable substandards is developed to reduce the developing and testing time for new equipment. Improvement suggestions on these standards are proposed based on analysis.

Symmetric switching angle modulation has been widely applied to multilevel inverters in the last decade. Most of the published techniques on this topic are to eliminate harmonics and generate sinusoidal voltages. This paper presents a new asymmetric switching angle modulation (ASAM) technique to utilize the harmonics of the staircase voltage waveforms generated by multilevel inverters for various grid support and energy storage charging. This technique can efficiently compensate reactive power and individual harmonics, balance unbalanced load and control bidirectional power flow between the grid and the energy storage. Simulations and experiments are conducted to validate the proposed technique.

The near magnetic field produced by magnetic components may compromise the performance of nearby devices. This paper analyzed the near magnetic field distribution around toroidal inductors. The mechanism of the field’s origination was studied in this article and modeled with the combination of magnetic dipoles and quadrupoles with clear physical meaning. Intuitive conclusions were drawn from the model and verified by simulation and experiments.

Planar transformers are promising solutions for the integration of power electronic systems due to unique advantages including lower profile and better thermal performance. In low voltage and high current applications, copper loss is a main factor affecting transformer performance. This paper focuses on optimizing the width of turns within each PCB winding to reduce the copper loss with no additional costs. An efficient model is introduced for low frequency applications, including effects of the gaps and the radial current distribution, and a more accurate high-frequency model is also provided. The design method for the optimized winding width of each turn is proposed. 3D finite element analysis (FEA) simulation showed the superiority of the proposed method to existing ones, including two improved designs. The proposed method is applicable to various shapes of magnetic cores and also demonstrates significant …

This article first reviewed the modeling and prediction techniques for the radiated electromagnetic interference (EMI) in active-clamp flyback (ACF) power converters. An improved radiated EMI model was then developed including the PCB ground impedance based on the ACF converter under investigation. Next, the improved radiated EMI model was quantified and experimentally verified. Two mitigation techniques were developed for the radiated EMI based on the improved model. Experiments were conducted to verify the developed analysis and mitigation techniques for the radiated EMI. The proposed modeling and mitigation techniques were finally extended to other isolated power converter topologies.

Electromagnetic interference (EMI) has become an increasingly important issue in high-speed and high-power density power electronics applications. At low frequencies below 30 MHz, conducted emission and radiated emission are regulated by international standards such as CISPR 25. However, EMI tests usually require specified experiment setups, and it is time-consuming. It is desired for device manufacturers to develop prediction techniques that can simplify the prediction process and provide accurate prediction results based on analysis and simulation basis. This paper develops the LF EMI prediction models for conducted and radiated EMI. The prediction results are validated by experiments.

The issue of electromagnetic interference (EMI) is a critical and complex matter in power electronics. In the current landscape of rapidly evolving power electronics applications, high switching frequencies are widely adopted to reduce the size of devices and components, increase power density, and improve overall efficiency. Magnetic components, such as inductors, play vital roles in power converters and EMI filters. Consequently, many researchers have focused on studying inductors in EMI filters to enhance equipment performance. Building upon existing research, this paper will begin by presenting the fundamental inductor model and various methods for optimizing inductor design. Subsequently, the impact of inductors on conducted EMI in converters will be discussed. Lastly, this paper will introduce the radiation model of inductors, including near magnetic field and near electric field radiation.

The capacitance balance technique to reduce CM EMI noise in isolated converters will fail due to the resonance of the CM impedance of the transformer. This paper identifies the unbalanced CM impedances of the transformer will lead to spikes in the CM EMI spectrum. Two RLC branches are used to represent the CM impedances of the transformer. An RLC balance technique is proposed to achieve impedance balance at the capacitive region, the resonant point, and the inductive region. Then, the proposed method is extended to several isolated converters. Finally, the effectiveness of the proposed method and the correctness of the parameters design are verified by experiment results.

SiC MOSFETS have become the most promising alternative to Si insulated gate bipolar transistors (IGBTs). However, the high switching speed and high switching frequency of SiC power modules raise concerns about radiated electromagnetic interference (EMI), particularly at frequencies below 30 MHz in electric vehicles, more electric aircraft, military and renewable energy conversion applications. This article proposes an analytical model to predict the radiated EMI for three-phase motor drive systems. The EMI noise source model is developed for SiC MOSFETS in the time domain under different voltage and current conditions. The radiated EMI model is further developed based on the circuit parameters and the cable voltages instead of cable currents used in conventional approaches. The developed model is validated via experiments in an inverter system with an RL load and a motor load. The impacts of …

The article first investigated and characterized the high-frequency impedance of the wireless charging (WLC) coils. Formulas were then derived to quantify the high-frequency impedance characteristics of the WLC coils deployed in cellphones. Based on the analysis and derived formulas, a WLC and near-field communication (NFC) antenna integration technique was proposed, which utilizes the second inductive region of the WLC coil for NFC antenna operation. Both the WLC load effect and NFC IC load effect was considered, analyzed, and experimentally validated. Furthermore, two techniques to expand the bandwidth of the second inductive region were developed and verified by either simulations or experiments. All the derived formulas and analysis in the article were supported by simulations and experiments.