\documentclass[submission]{iacrtrans}

\usepackage[T1]{fontenc}
\usepackage[
    backend=biber,
    style=numeric,
    natbib=true,
    url=false, 
    doi=true,
    eprint=false
    ]{biblatex}
\addbibresource{paper.bib}
\usepackage{amssymb,amsmath}
\usepackage{eurosym}
\usepackage{wasysym}
\usepackage[binary-units]{siunitx}
\usepackage{commath}
\usepackage{graphicx,color}
\usepackage{colortbl}
\usepackage{subcaption}
\usepackage{placeins}
\usepackage{array}
\usepackage{censor}
\usepackage{hyperref}
\usepackage{makecell}

\DeclareSIUnit{\baud}{Bd}
\DeclareSIUnit{\year}{a}
\DeclareSIUnit{\rpm}{rpm}
\renewcommand{\floatpagefraction}{.8}
\newcommand{\degree}{\ensuremath{^\circ}}
\newcolumntype{P}[1]{>{\centering\arraybackslash}p{#1}}
\newcommand{\partno}[1]{\textsf{\small#1}}
\newcommand{\price}[2]{#1 #2}
\newcommand{\todo}[1]{\textbf{TODO}\footnote{#1}}

% By default, our biblatex style will print "In: [name of proceedings]. [year] [name of event]" for every conference
% paper. Since the name of the proceedings is usually near-identical to the name of the event, this adds a lot of noise.
% Suppress the name of the proceedings when both are given.
\AtEveryBibitem{
    \ifentrytype{inproceedings}{
        \iffieldundef{booktitle}{
        }{
            \iffieldundef{eventtitle}{
            }{
                \clearfield{booktitle}
            }
        }
    }{
    }}

\begin{document}

\author{Jan Sebastian Götte\inst{1} \and Björn Scheuermann\inst{2}}
\institute{Technical University of Darmstadt, Darmstadt, Germany, \email{research@jaseg.de}\and
    Technical University of Darmstadt, Darmstadt, Germany, \email{bjoern.scheuermann@kom.tu-darmstadt.de}}
\title{High Fidelity Security Mesh Monitoring using Low-Cost, Embedded Time Domain Reflectometry}
\keywords{Tamper Sensing\and Tamper Response\and Physical Security\and Security Mesh\and Hardware Security Module
            (HSM)\and FIPS 140-2/3\and ISO/IEC 24759\and PCI PTS HSM MSR}
\maketitle

% FIXME maybe don't use HSM, maybe use active tamper sensing? envelope protection?

\begin{abstract}
    Security Meshes are patterns of sensing traces covering an area that are used in Hardware Security Modules (HSMs)
    and other systems to detect attempts to physically intrude into the device's protective shell. State-of-the-art
    solutions manufacture meshes in bespoke processes from carefully chosen materials, which is expensive and makes
    replication challenging. Additionally, state-of-the-art monitoring circuits sacrifice either monitoring precision or
    cost efficiency. In this paper, we present an embeddable security mesh monitoring circuit constructed from low-cost,
    standard components that utilizes Time Domain Reflectometry (TDR) to create a unique fingerprint of a mesh. Our
    approach is both low-cost and precise, and enables the use of inexpensive standard Printed Circuit Boards (PCBs) as
    security mesh material. We demonstrate a working prototype of our TDR circuit costing less than \price{10}{\euro} in
    components that achieves both time resolution and rise time better than \qty{200}{\pico\second}---a $25\times$
    improvement over previous work. We demonstrate our prototype's capability to detect and localize faults in several
    practical attack scenarios including probing using a high impedance oscilloscope probe and a patching attempt using
    micro soldering.
\end{abstract}

\section{Introduction}

% Bei Diss-Citations in der bib dazu schreiben, dass das ne Diss ist.
% 2.2 / 2.3 Wie related? Warum interessant? In Intro erwähnen?
% In Intro herausstellen, dass TDR-Setup neu ist.

% Storyline für Intro: Wir sind die ersten die die Auflösung hinbekommen, und deshalb geht bei uns TDR.
% Time for 256 times oversampling: 710 ms. 384 times: 1056 ms.

Security meshes continue to be the state of the art for tamper sensing in applications where sophisticated physical
attacks such as attempts at drilling or sawing through the device's enclosure to place probes must be prevented. Common
applications for such meshes include Hardware Security Modules (HSMs) used to store and process cryptographic keys
applying security standards such as
FIPS-140-2\cite{usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2002} or ISO/IEC
24759\cite{ISOIEC24759}. Other applications include card payment terminals where PCI PTS HSM
standards\cite{pcisecuritystandardscouncilPaymentCardIndustry2021} are applicable. Security meshes usually consist of
two or more conductive traces that are laid out in a meandering pattern to cover a surface. A sensing circuit
electrically monitors these traces to detect attempts at penetrating this surface.

As is often the case with security technologies, in practice a tension exists between the level of security offered by a
particular security mesh implementation and its implementation cost. Commercial designs often only coarsely monitor the
conductivity of the mesh traces and are incapable of detecting attacks that manipulate small parts of the mesh. The most
secure meshes are made in custom manufacturing processes. Materials such as polymer substrates are specifically chosen
such that the mesh is difficult to manipulate without breaking it. A drawback of this approach is that the specialized
manufacturing processes are difficult to replicate and that the resulting cost of the mesh is high. In some
lower-security applications such as card payment terminals, simpler approaches are still commonly used for their ease of
implementation. Often, standard copper/polyimide Flexible Printed Circuits (FPCs) or even standard Printed Circuit
Boards (PCBs) are used because of the wide availability of manufacturing services.

Several academic approaches exist that target low-cost\cite{
    vasileActiveTamperDetection2017,
    vasileTemperatureSensitiveActive2017,
    dupontMiniaturizedUltraLowPowerTamper2022,
    vasileProtectingSecretsAdvanced2019,
} or high-performance mesh monitoring\cite{
    immlerBTREPIDBatterylessTamperresistant2018,
    immlerSecurePhysicalEnclosures2018,
    garbTamperSensitiveDesignPUFBased,
}. Some academic works even try to replace the security mesh with entirely different tamper sensing primitives\cite{
    staatAntiTamperRadioSystemLevel2022,
    vaiSecureArchitectureEmbedded2015,}.
High-performance mesh monitoring approaches try to characterize the mesh's physical properties with high accuracy, but
often come at the cost of specialized, expensive circuitry. Low-cost approaches utilize advanced analog techniques in
their circuitry to extract precise measurements using few components. They trade off measurement precision for lower
component cost. Besides simple monitoring, detecting tamper attempts by replacing the mesh with a macro-scale Physically
Unclonable Function (PUF) has also been researched\cite{
    immlerBTREPIDBatterylessTamperresistant2018,
    staatAntiTamperRadioSystemLevel2022,
    vaiSecureArchitectureEmbedded2015,}, albeit this comes with complex monitoring circuits that utilize expensive,
specialty components.

\begin{figure}
    \centering
    \includegraphics[width=0.6\textwidth]{pic_board_setup_2_small_censored.jpg}
    \caption{Measurement setup. Shown are the test specimen board on the left, and the frontend board with one of the
    four pulse amplifiers in the center. The frontend board is powered through a USB-C connection, and data is sent to a
    computer through a Single-Wire Debug (SWD) interface. The grid in the background has \qty{10}{\milli\meter} pitch.
    Note: Author names and institutional affiliation were removed from this picture for peer review.}
    \label{fig_pic_board}
\end{figure}

To enable the use of less expensive, commodity materials such as Printed Circuit Boards (PCBs) without compromising
security, mesh integrity must be monitored with high fidelity. In this paper, we present a low-cost monitoring circuit
for security meshes that combines Time Domain Reflectometry (TDR) with equivalent time sampling. Our approach provides
high measurement fidelity and enables the use of meshes made from less expensive materials in high-security
applications.

Our circuit generates a very fast pulse with a rise time lower than \qty{200}{\pico\second} that is broadcast into the
mesh. While the pulse traverses the mesh, parts of its energy are reflected on imperfections inside the mesh, including
those caused by tampering attempts. Our circuit uses a fast, low-cost equivalent time sampling frontend to receive,
amplify and record these reflections to create a \emph{fingerprint} of the mesh that is highly sensitive to changes
caused by tampering.

We demonstrate a working prototype of our design and present practical measurements of its electrical parameters as well
as its performance under several practical attack scenarios. A photo of our prototype setup including a security mesh
specimen is shown in Figure\ \ref{fig_pic_board}.

Compared to previous academic designs, our approach can be implemented at a lower cost using exclusively inexpensive,
commercially available mass-market components. Our TDR frontend improves upon previous, delay-based approaches in
monitoring fidelity\cite{vasileActiveTamperDetection2017,vasileTemperatureSensitiveActive2017}. Our design achieves
sufficient sensitivity to detect high-impedance oscilloscope probes despite such probes being specifically designed to
conduct measurements without disturbing the circuit under test. Unlike previous, capacitance-based approaches, our
design is compatible with inexpensive signal switch ICs, enabling the protection of arbitrarily large meshes at minimal
cost without compromising sensitivity.

The contributions of our work are as follows:

\begin{itemize}
    \item To our knowledge, our design is the first to apply a low-cost embedded differential Time Domain Reflectometry
        (TDR) frontend to security mesh monitoring. Our design achieves pulse rise times below \qty{200}{\pico\second},
        a $25\times$ improvement over the closest previous
        work\cite{vasileActiveTamperDetection2017,vasileTemperatureSensitiveActive2017}.
    \item Our approach provides higher fidelity compared to state-of-the-art security mesh conductivity monitoring or
        previous low-cost approaches. It enables the use of meshes manufactured using less advanced technologies such as
        standard FPC or PCB processes. Our TDR frontend produces 70 data points for each meter of mesh length, resulting
        in a measurement density per mesh area of \qty{200}{\bit\per\centi\meter^2} when using a
        $\qty{200}{\micro\meter}$ pitch mesh manufactured in a standard low-cost PCB process.
    \item We present a working prototype along with extensive experimental results, including laboratory performance
        measurements. We practically demonstrate that our design is able to not only detect but distinguish and even
        localize attacks in several realistic attack scenarios.
    \item Our design is based entirely on commercially available, inexpensive mass-market components. It can be
        replicated and improved without access to bespoke production equipment or semiconductor manufacturing
        capabilities. To facilitate further research and practical applications, we publish our prototype under an Open
        Source license and chose not to patent our approach.
\end{itemize}        

\section{Related Work}

Tamper sensing meshes are used in numerous applications from Hardware Security Modules (HSMs) to card payment
terminals\cite{andersonCryptographicProcessorsASurvey2006,tehranipoorHardwareSecurityPrimitives2023}. Despite their
widespread use, security mesh design and monitoring is covered by a sparse research corpus. Commercially,
security-by-obscurity is often considered a good idea and little detail is published on physical security
implementations\cite{andersonSecurityEngineeringGuide2020}.

Patent literature gives a partial view of commercial developments in this area. Even in recent patents such as\cite{
    brodskyTamperRespondentAssemblyFlexible2019, % IBM. ok, mentions conductivity monitoring but mostly on mesh
    nortonTamperDetectingCases2019, % HP. ok, mentions continuity monitoring only but mostly on mesh
    razaghiTamperDetectionSystem2020, % Square. ok. mentions what is effectively conductivity monitoring
    wesselhoffTamperResponsiveSensor2020, % Cryptera. ok. Very basic, only uses the mesh in the power supply.
    leekTamperDetection2021, % Texas Instruments. ok. Monitors capacitance.
    chockPointSaleTerminal2009, % Zilog. ok. Monitors conductivity and tries to detect emulation.
}
from HSM manufacturers IBM and HP, ATM component manufacturer Cryptera, payment terminal manufacturer Stripe, and chip
manufacturers Texas Instruments and Zilog, cited monitoring methods are basic and do not go beyond a simple measurement
of resistance or capacitance.

Academic research in the area is more advanced and spans both improvements to security meshes and their monitoring
circuits\cite{
    immlerBTREPIDBatterylessTamperresistant2018,
    dupontMiniaturizedUltraLowPowerTamper2022,
    vasileProtectingSecretsAdvanced2019},
as well as approaches that entirely replace the security mesh with other primitives based on e.g.\ radio frequency or
optical measurements that aim to sense tampering
with a device\cite{staatAntiTamperRadioSystemLevel2022,vaiSecureArchitectureEmbedded2015}. A drawback of techniques
aiming to replace security meshes with other sensor types is that it is difficult to prove such sensors do not have
blind spots.

\subsection{Security Mesh Monitoring and Design}

\paragraph{Meshes as capacitive PUFs.}
\textcite{
    immlerBTREPIDBatterylessTamperresistant2018,
    obermaierMeasurementSystemCapacitive2018,
    garbTamperSensitiveDesignPUFBased}
propose one of the most advanced security mesh designs in the current academic state of the art. They use a specialized
security mesh as a Physically Unclonable Function (PUF), combining tamper sensing with cryptographic key storage. In
their design, the mesh consists of a cross-hatch pattern made from several dozen individually addressable capacitive
electrodes. They manufacture their meshes in a specialized process that results in unpredictable, random variations in
capacitance between electrodes. They propose an analog frontend that measures the precise mutual capacitance of each
pair of electrodes\cite{obermaierMeasurementSystemCapacitive2018} using an approach similar to
\textcite{satoToucheEnhancingTouch2012}, and they use the resulting capacitance matrix as the basis of their PUF. In
further work, they demonstrate a custom IC integrating the monitoring
circuit\cite{garbFORTRESSFORtifiedTamperResistant2021}.

Advantages of their system include high sensitivity to modifications, as well as that as a PUF, the system does not
require a continuous power supply. Disadvantages include the limited mesh size a single circuit can support due to
dynamic range constraints, the specialized manufacturing process needed for the mesh as well as the high cost of the
monitoring circuit. Common physical security standards require systems to actively destroy all key material when
tampering is detected\cite{
    usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2002,
    ISOIEC24759,
    pcisecuritystandardscouncilPaymentCardIndustry2021}.
Like other PUF-based systems, their system naturally lacks this capability.

% FIXME go more into multiplexing larger meshes in our system below
Key differences of our system include:
\begin{itemize}
    \item Our system can cover larger meshes without loss of precision using a single TDR frontend through multiplexing.

    \item Our system supports meshes manufactured using standard, low-cost PCB processes.

    \item Our design requires only widely available, low-cost commodity components, for each of which alternatives
        from other manufacturers are available.

    \item Our approach has improved resiliency to electromagnetic interference and works with unshielded meshes.
\end{itemize}

\paragraph{Bridge measurement of capacitive interdigital meshes.} \textcite{dupontMiniaturizedUltraLowPowerTamper2022}
introduce a simple analog circuit approach for monitoring meshes laid out as a set of capacitive interdigital structures
not unlike the combs found in Micro-Electromechanical System (MEMS) accelerometers and gyroscopes. They subdivide the
mesh into four equal-size quadrants, each containing two equal-size interdigital electrodes. They connect the resulting
eight electrodes in a capacitive bridge configuration and measure the bridge's balance using a simple analog monitoring
circuit based on homodyne detection. Advantages of their system include the simple, low-power monitoring circuit made
from basic, cheap components and the capability to work with single-layer meshes such as those produced using Laser
Direct Structuring (LDS). From a security point of view, a drawback of their approach is that to achieve its low-power
usage, measurement resolution is sacrificed and all information on the mesh's state is collapsed into a single, scalar
measurement.

\paragraph{Frequency-domain mesh characterization.}
\textcite{vasileProtectingSecretsAdvanced2019} introduce a monitoring method where they feed a variable-frequency signal
into one end of a continuous mesh trace, and measure the power of the signal coming out of the other end. In essence,
their setup measures $S_{12}$ magnitude in a similar way to a network analyzer.

Advantages of their design include the simple implementation and the potentially robust nature of frequency-domain
measurements. Disadvantages include a nonstandard three-layer mesh stackup, as well as the susceptibility of the system
to attack by emulation given that the log power sensor they are using at the mesh output is designed to be insensitive
to any signal characteristics apart from total signal power.

\paragraph{Time domain mesh monitoring.}
Time-Domain Reflectometry has been proposed for tamper sensing in nuclear arms control
applications\cite{parsonsTamperRadiationResistant1977}. However, compared to our design, the systems proposed in this
field are usually much larger, using standard benchtop measurement equipment to perform TDR. Additionally, they target
lower time resolution since they are designed to monitor spans of cable up to several hundred meters in length.

Closest to our proposal in the academic corpus is the work of
\textcite{vasileActiveTamperDetection2017,vasileTemperatureSensitiveActive2017}, where they propose monitoring the time
domain response of a mesh using a circuit made from a pulse generator and a fast Analog-to-Digital Converter (ADC). To
avoid an expensive, high-speed digital processing pipeline, their design is centered around a specialized high-speed ADC
that has a built-in sample memory. Using this part, they capture a pulse at high speed after it traverses the mesh.
Subsequently, they slowly process the captured data from memory.

Advantages of their design include better sensitivity to changes in total mesh trace length compared to simple
continuity monitoring and the low complexity of their analog frontend. Disadvantages include the reliance on a specialty
ADC that cannot easily be replaced with any other commercially available component and the coarse time resolution.

Key differences between their design and our proposal include:
\begin{itemize}
    \item Their design is sensitive to total length, but not to the location of faults. Their design measures the mesh's
        \emph{transmission} characteristic, which collapses detail about faults along the mesh into a small number of
        ADC samples at the pulse edge. Using such a measurement, it is not possible to localize faults. In contrast, our
        approach measures the signal's \emph{reflected} component, which spreads information over time and enables us to
        localize faults.
        
    \item Our design uses only inexpensive, widely available parts. All parts in our design can easily be substituted
        for other, similar parts from different manufacturers.

    \item Our approach provides $25\times$ higher time resolution through Equivalent Time Sampling. This is a
        fundamental limitation of their design, as the cost of ADCs and their associated circuitry increases steeply
        with speed\footnote{ For reference, the least expensive ADC available at distributor DigiKey that would match
        the \qty{200}{\pico\second} time resolution of our approach would cost \price{320}{\euro} at quantity 100 and
        require national security clearance for export from its manufacturer in the USA.}.
\end{itemize}

\subsection{Equivalent Time Sampling}

Today, systems that digitize high-speed signals usually use a fast ADC, sometimes preceded by one or several
downconverting mixers. This development was enabled by both the increasing availability of ADCs capable of digitizing
hundreds of megasamples per second at a reasonable resolution, and by the increase in speed of CPUs,
FPGAs, and other components of the digital processing chain. However, this is largely a development of this
millennium--meanwhile, signals far into the gigahertz range have been studied since the advent of radar technology in
the Second World War\cite{kahrs50YearsRF2003}. Enabled by the progress from vacuum tubes to semiconductor devices,
equivalent time sampling became the technology of choice for the latter half of the twentieth century until around the
turn of the millennium the introduction of high-speed digital processing and fast ADCs enabled real-time conversion up
into higher microwave frequencies, today reaching beyond the \qty{100}{\giga\hertz} boundary.

\textcite{kahrs50YearsRF2003} trace back the style of four-diode balanced bridge sampling gate that we use to a vacuum
tube implementation presented in \textcite{chanceWaveforms1949}. This style of sampling gate found application in a
number of sampling oscilloscopes throughout the twentieth century in several oscilloscope sampling frontends such as
HP's 187B\cite{HP187BDualTrace1962}. 

While initially equivalent time sampling was used to circumvent technological limitations, more recently it has also
been used to achieve cost-optimized designs\cite{houtman1GHzSamplingOscilloscope2000}. Going along similar principles,
\textcite{polasekReflektometrCasoveOblasti2020} presents a design for a minimal sampling TDR circuit that uses a CMOS
clock generator IC along with a CML fanout buffer for pulse generation. The circuit improves upon the double sampling
design first presented by \textcite{houtman1GHzSamplingOscilloscope2000} to reconstruct a downsampled copy of the input
signal in the analog domain before digitization.

\subsection{Low-Cost Time Domain Reflectometry}

\textcite{bencivenniTimeDomainReflectometer2013} present an FPGA-based embedded reflectometer design. Since their design
is based on an early FPGA family dating back to 2003 that lacked the speed and the adjustable I/O delay features of more
modern FPGA families, their design uses the FPGA's logic resources to achieve adjustable delays.
\textcite{negreaSequentialSamplingTime2009} show an equivalent time sampling TDR that uses specialized adjustable delay
line ICs for pulse generation. \textcite{lee16psresolutionRandomEquivalent2003} achieve very high time resolution in an
equivalent time sampling TDR system by using a vernier approach to pulse generation, such that their system is limited
by analog bandwidth, not time resolution. \textcite{trebbelsMiniaturizedFPGABasedHighResolution2013} show another
FPGA-based TDR. Their system also uses a part from the same early FPGA family as
\textcite{bencivenniTimeDomainReflectometer2013}, and they work around its lack of precise timing primitives by
generating a low-frequency sine wave through DDS, which they filter, and then sample using a comparator - a similar
approach to the timing generation in \textcite{houtman1GHzSamplingOscilloscope2000}. Additionally, they avoid the need
for a discrete ADC by implementing a $\Delta\Sigma$ loop around a fast comparator, trading off slower acquisition time
for lower hardware complexity. They use a \qty{5.5}{\volt\per\nano\second} slew rate wideband amplifier IC to generate
their stimulus pulse, achieving a rise time of \qty{2}{\nano\second}. As a result, similar to
\textcite{lee16psresolutionRandomEquivalent2003}, their design is limited by analog bandwidth--here resulting from the
nanosecond-scale stimulus rise time--not by frontend time resolution. Compared with this and other previous approaches,
our proposed system is not only faster, but presents a more balanced trade-off between time resolution and analog
bandwidth.

\section{Monitoring a Security Mesh using Time Domain Reflectometry}

Time Domain Reflectometry (TDR) is a well-known technique that is used to locate faults along a signal channel such as a
copper cable, or an optical fiber. In TDR, a pulse is sent into the beginning of the channel. While the pulse traverses
the channel, any fault such as a discontinuity in electrical impedance or optical density causes part of the pulse to
travel back in a partial reflection. TDR monitors these reflections returning to the beginning of the channel by
recording the signal measured at it after the pulse has been sent. When the pulse reaches the end of the channel,
depending on termination it can be reflected to travel back to the beginning, which allows measurement of the channel's
length. 

\subsection{Attacks on a Security Mesh Viewed Using TDR}

In this paper, we apply TDR to monitor a security mesh for changes caused by an attack. Our prototype setup consists of
a custom circuit board containing a low-cost embedded TDR frontend that can be connected to a security mesh specimen to
measure its response, creating a fingerprint of the mesh. In a standard PCB manufacturing process, we construct a
security mesh with a ground plane underneath that works similarly to previous work\cite{
    immlerBTREPIDBatterylessTamperresistant2018,
    obermaierMeasurementSystemCapacitive2018,
    garbTamperSensitiveDesignPUFBased}.
When viewed in the microwave domain, such meshes constitute what is essentially a delay line. Security meshes commonly
use a pair of two traces to capture short circuit conditions between adjacent traces, which we treat as a differential
pair for improved resiliency against electromagnetic interference. We constructed our frontend such that it excites the
two traces differentially, but allows for both single-ended and differential measurements.

In an intact mesh, we expect our frontend to record no significant reflections until the stimulus pulse has traversed
the mesh's traces both ways, at which point we expect a large response whose polarity and amplitude depend on the
termination on the far end of the mesh. In our prototype circuit, we made this termination configurable to expand the
range of possible measurement configurations and to enable self-calibration of the circuit.

Tampering with the mesh is likely to cause an impedance discontinuity. Cuts of one or both traces or a short circuit
between both traces will result in a total reflection of the incident pulse at the location of the fault, which our
circuit will easily detect as the delay of the response changes. However, beyond these simple cases, our approach can
also detect more subtle changes. For instance, a short circuit between two points along the same mesh trace will result
in a change in delay along this trace. Furthermore, even just probing a mesh trace with an oscilloscope probe will add
the probe's input capacitance, resulting in an impedance step. The TDR approach is thus able to not only detect but
distinguish and even localize several types of faults or attacks in a mesh.

\subsection{Signal Routing}

The stimulus pulse in a TDR-based design is a high-speed signal not unlike any other high-speed data or radio signal.
This enables the use of signal switch and multiplexer ICs marketed for RF or high-speed data bus applications. Due to
their mass-market applications, such devices are inexpensive. Using a tree-shaped topology of multiplexers, several mesh
segments can be monitored by a single frontend, enabling the monitoring of arbitrarily large volumes. As a proof of
concept, in our prototype we implemented software-controllable flipping of the mesh using \partno{TMUXHS4212} bus
multiplexers.

\section{Circuit Design and Driving Approach}

\begin{figure}
    \centering
    \hspace*{-7mm}
    \includegraphics[height=80mm]{block_diagram.pdf}
    \caption{Block diagram of our prototype sampling TDR security mesh monitoring circuit.}
    \label{fig_block_diagram}
\end{figure}

A TDR can be broken down into three basic components. First, we need a source of fast pulses (or fast edges!) to
stimulate the mesh. Second, we need a coupler that allows us to couple the stimulus pulses into the mesh, and their
reflections out of it. Finally, we need a fast ADC to capture the reflections.

Figure\ \ref{fig_block_diagram} shows a block diagram of our design\footnote{Full schematics are available in this
paper's supplementary material.}. At the core of our design lies an equivalent time sampling setup, where two
diode bridge sampling gates alternately sample the two traces of the mesh. 
Since physical attacks happen on a time scale of minutes or hours, we do not need a fast acquisition rate. Equivalent
time sampling uses fast sampling gates to sample a high-frequency signal at a low frequency that is suitable for direct
conversion through an ADC. This reduces the requirements of our data acquisition and signal processing fronted from
gigasamples per second to mere megasamples, well within the range that a commodity microcontroller can handle.

A challenge in equivalent time sampling is precisely phase-synchronizing the sampling pulse to the fundamental frequency
of the input signal, which is usually implemented by using a high-speed comparator. In a TDR-style frontend like ours,
this expensive component can be avoided because the stimulus signal is generated in the frontend, simplifying the
challenge of generating a synchronized sampling pulse at an adjustable phase to the stimulus pulse.

Since an intact mesh has low insertion loss, the amplitude of the response of an intact mesh is large. Thus, we do not
need a high dynamic range in either the frontend amplifiers or in the ADC, enabling the use of commodity operational
amplifiers (opamps) and the built-in ADC of a commodity microcontroller. Further, the strong signal allows us to use a
comparatively lossy \qty{-6}{\deci\bel} resistive tee instead of a directional coupler. A resistive tee does not provide
directionality, but in our case, the incident pulse can never interfere with reflections at the sampling output of the
divider because of causality.

To implement our sub-nanosecond sampler, we chose a simple four-diode bridge sampling gate made from commodity
\partno{BAT17-04W} RF Schottky diodes, which offer turn-on times better than \qty{100}{\pico\second} at
\price{0.13}{\euro} per device at quantity 1000. The four-diode configuration requires only two dual diode packages. In
contrast to \textcite{polasekReflektometrCasoveOblasti2020,houtman1GHzSamplingOscilloscope2000}, in our system, double
sampling is not necessary - instead, we follow the sampling gate directly with an amplifier feeding into the internal
ADC of our microcontroller. We use an internal timer peripheral of the same microcontroller to generate both stimulus
and sample pulses such that we can easily phase-lock the internal ADC to the same timer.

We base our circuit around an \partno{STM32G474RB} microcontroller, a \price{5}{\euro}-class commodity ARM
microcontroller. Besides adequate processing speed for its price class, this microcontroller offers two features that
are critical to our design. First, its internal ADCs are both higher resolution and faster than those of older parts.
Second, it is one of a few parts in its series that include a \emph{high-resolution timer} (\partno{HRTIM}) peripheral
that provides several outputs that can be controlled with better than \qty{200}{\pico\second} resolution through
per-output, self-calibrating delay line circuitry. We use this peripheral to produce both the stimulus pulse and the
phase-adjustable sampling pulse.

While the HRTIM peripheral allows us to finely adjust the phase of its output waveform, the digital output structures of
the \partno{STM32G4} series are still limited to nanosecond-scale rise and fall times with the datasheet quoting
$t_r=t_f=\qty{1.7}{\nano\second}$ into a \qty{10}{\pico\farad} load when using the fastest GPIO output drive strength
setting and a \qty{3.3}{\volt} supply\cite{stmicroelectronicsSTM32G474xBDatasheet2021}. We work around this issue by
applying two circuit tricks. First, we send its output through a fast amplifier to square up the edges to a rise time
better than \qty{500}{\pico\second}. The remaining challenge is that while we now have pulses with crisp edges, due to
constraints of the HRTIM peripheral, at more than \qty{10}{\nano\second}, these pulses are still too wide to be useful.
We solve this issue by applying a clip line\cite{tektronixinc.TektronixS6Sampling1982} pulse forming network at the
output of the amplifier--i.e.\ we connect the amplifier's output to the load in parallel with a short, terminated
transmission line stub. The length of this stub determines the pulse width.

\subsection{Driver Selection}

Several types of amplifiers can be used in our pulse shaping application. Common to all options, we require differential
outputs. In practice, for most parts, this means we are looking for a part with Current Mode Logic (CML) outputs. CML is
a differential signaling standard that is widely used in high-speed logic. In CML, a current source feeds a pair of
transistors that steer current between the two outputs of the differential pair. By steering current between the two
outputs, common-mode currents are minimized which both reduces the effect of power supply impedance at the transmitter
and reduces electromagnetic emissions from the differential pair's PCB traces. In our experiments, we considered several
parts and settled on four parts for evaluation in this paper: A \partno{74LVC2G157} standard logic IC, two display
protocol redrivers, \partno{PI3HDX12211} and \partno{TDP0604}, as well as \partno{MAX3748}, a limiting amplifier for
optical networking applications. We implemented four variants of our prototype using a steady hand under a microscope as
shown in Figure\ \ref{fig_pic_amps}.

One notable omission from our tests was the series of CML-output comparators made by Analog Devices due to the cost of
these devices.

\begin{figure}
    \centering
    \begin{subfigure}{0.23\textwidth}
        \centering
        \includegraphics[width=0.9\textwidth]{pic_74lvc_small.jpg}
        \caption{74LVC2G157}
    \end{subfigure}
    \begin{subfigure}{0.23\textwidth}
        \centering
        \includegraphics[width=0.9\textwidth]{pic_max3748_small.jpg}
        \caption{MAX3748}
    \end{subfigure}
    \begin{subfigure}{0.23\textwidth}
        \centering
        \includegraphics[width=0.9\textwidth]{pic_tdp0604_small.jpg}
        \caption{TDP0604}
    \end{subfigure}
    \begin{subfigure}{0.23\textwidth}
        \centering
        \includegraphics[width=0.9\textwidth]{pic_pi3hdx_small.jpg}
        \caption{PI3HDX12211}
    \end{subfigure}
    \caption{Circuit-board implementation of the four pulse amplifier variants of the design. Amplifiers were mounted
    dead bug style on a piece of copper tape connected to one of the supply rails and hooked up with
    \qty{120}{\micro\meter} diameter wire according to their respective datasheets. Supply rails were hooked up using
    copper tape where possible to reduce series impedance. Additional \qty{10}{\micro\farad} MLCC power supply
    decoupling capacitors were placed close to the ICs on the copper tape to reduce loop area.}
    \label{fig_pic_amps}
\end{figure}

\paragraph{Standard logic ICs.}
As a baseline, we evaluated the \partno{74LVC2G157} standard logic IC. This IC contains a single multiplexer, however,
we are not interested in the multiplexer functionality. The interesting trivia about this chip is that it also is one of
the only \partno{74} series standard logic parts that have complimentary outputs. According to manufacturer
specifications, at a comparable \qty{20}{\pico\farad} load, \partno{74LVC} series parts have slightly faster rise and
fall times compared to our \partno{STM32} microcontroller's digital IO
pins\cite{renesaselectronicscorporationApplicationNoteAN2242019}.

\paragraph{Optical Networking Chipsets.}
A category of CML-output drivers suitable for our application is a class of optical networking chipset ICs. While
today, the construction of optical transmitters has moved to direct bonding of optical components and driver ICs to
minimize parasitics, discrete driver ICs for some chipsets from the mid-2000s era are still available at reasonable
cost. Both the laser driver used to drive the transmitter laser diode, and the limiting amplifier used to amplify the
receiver photodiode's output can be used in our application, with the limiting amplifier part requiring less additional
circuitry in our application due to its lack of output bias control. In our evaluation below, we include the
\partno{MAX3748} limiting amplifier as a representative part from this category that is still commercially available. A
drawback of relying on a part like this is that its future availability is uncertain given the evolution of the
industry.

\paragraph{Bus Redrivers.}
The final category of amplifiers suitable for our pulse shaping needs is redrivers intended for high-speed data
interfaces such as USB 3, PCI Express, HDMI, or DisplayPort. All of these interfaces use CML drivers, with differential
voltage levels usually in the order of \qtyrange{600}{1000}{\milli\volt}. \emph{Redriver} ICs are intended to be used to
amplify the sensitive high-speed bus signal at the edge of a PCBA, either before it leaves the board through a connector
to ensure adequate signal levels at the connector, or after it enters through a connector to compensate for loss in the
PCB traces between the connector and the signal's destination. For our application, redrivers intended for HDMI and
DisplayPort applications are most suitable, as they can usually be configured to act as simple amplifiers without
processing any protocol logic on the signals that are amplified. In contrast, both USB 3 and PCIe redrivers often
implement power saving features that try to parse parts of the actual signal transmitted through them, which are hard to
bypass in our application.

Redrivers can be classified according to their way of operation. \emph{Retimers} include a full
serialization/deserialization (SerDes) setup and parse the low-level protocol of the bus to reconstruct bit-level
timing. We focus only on simpler redrivers that only contain amplifiers and (analog) equalizers here.

Amplifying redrivers can be separated into two classes: Limiting and linear redrivers. A limiting redriver is configured
to have a high gain such that a small input signal will be amplified to the full output voltage swing. Limiting
redrivers are well-suited for our application, but they have come out of fashion since they interfere with link training
and with power saving features of protocols like USB 3.

Linear redrivers are constructed with a low gain instead. Sufficient to compensate for wiring losses, their gain is low
enough to leave them transparent to bus protocol features such as link training or power saving features. To compensate
for their reduced gain, linear redrivers usually contain configurable equalizers that can be used to apply targeted
enhancements for particular signal defects, such as boosting high-frequency gain or providing a set amount of overshoot.
Where available, in  our prototype variants we set these equalization features to provide maximum gain.

In our evaluation below, we include \partno{PI3HDX12211} as a linear redriver intended for DisplayPort and HDMI
applications, as well as \partno{TPD0604} as a ``hybrid'' linear or limiting redriver for HDMI applications, configured
for limiting mode in our experiments. An attractive feature of both of these chips as well as comparable devices is that
they usually include at least four independent channels, so only one chip is needed for both pulse paths. Additionally,
they are consumer mass market parts, resulting in a low price. For instance, \partno{PI3HDX12211} is available at
\price{2.11}{\euro} in single quantity and less than \price{1.30}{\euro} at a quantity of several hundred at distributor
LCSC, and \partno{TPD0604} is available at \price{4.72}{\euro} and \price{3.44}{\euro}, respectively, at distributor
Mouser.

\subsection{Cost Breakdown}

Table\ \ref{tab_bom} shows a breakdown of the cost of the main components of our prototype, resulting in a total
component cost of less than \price{10}{\euro}. We did not include power supply components in this breakdown as our
circuit is meant to be embedded into a payload circuit that will already have sufficient power supplies.

Due to its \partno{HRTIM} peripheral, the \partno{STM32G4} microcontroller is the component of our design that is
hardest to replace. However, this part can still be replaced with a wide range of FPGAs, which commonly include
digitally configurable delay lines on their IO pins for signal de-skewing. For instance, the \partno{ODELAY} primitive
of Xilinx 7 Series FPGAs provides the same $\frac{1}{32}$ clock cycle resolution that the \partno{STM32G4}
\partno{HRTIM} peripheral provides while supporting higher input clock frequencies.

\begin{table}
    \centering
    \begin{tabular}{c|c|c|l}
        \textbf{Part number}&\textbf{Amount}&\textbf{Cost in \euro}&\textbf{Description}\\\hline
        PI3HDX12211&1&1.37&Pulse amplifier\\
        STM32G474RB&1&3.51&Main microcontroller\\
        OPA1656&1&1.25&Sampling post-amplifier\\
        TMUXHS4212&2&0.64&Signal routing switch\\
        SKYA21003&2&0.49&Termination switch\\
        74LVC2G157&2&0.15&Pulse pre-conditioning\\
        BAT17-04W&4&0.12&Sampling gates\\
        &25&0.01&Various MLCC capacitors\\
        &25&0.01&Various resistors\\\hline
        \multicolumn{2}{r}{}&\textbf{9.67}&\textbf{Total}
    \end{tabular}
    \caption{A cost breakdown of the major components of our design. Listed prices are for 1000 pieces order quantity to
    make prices more comparable between distributors. The number of switches necessary for signal routing and
    termination depends on the specific mesh signal routing of the application. Numbers shown here are for our
    prototype, which can measure a mesh from both ends and supports short, open and matched termination.}
    \label{tab_bom}
\end{table}

\subsection{Measurement Principle and Scan Scheduling}
\label{sec_scan_schedule}

The goal of a time domain reflectometer is to send a pulse into the Device Under Test (DUT)--i.e.\ in our application,
the mesh--and to record all reflections returning from the DUT afterwards. In something like a security mesh whose
traces might only be a few meters long in total, the time span between the pulse being sent and the last reflections
from the very end of the mesh arriving is in the order of several tens of nanoseconds. Directly recording a response at
this timescale would be infeasible using a commodity microcontroller, so we utilize an equivalent time sampling
approach.

As shown in Figure\ \ref{fig_block_diagram}, our analog frontend contains amplifiers that produce the stimulus pulse, a
sampling gate with amplifiers, and a coupler that couples the pulse into the mesh and couples the reflections back into
the sampling gate. A microcontroller controls this frontend with two primary signals: A stimulus pulse, and a sampling
pulse. By adjusting the timing between these two pulses every time a stimulus pulse is sent, the microcontroller can
select a particular point in time after the stimulus pulse to record using the sampling gate. By slowly sweeping across
the whole time span, the microcontroller can reconstruct the waveform of the reflected signal at the sampling gate
across one period of the stimulus pulse. The recording rate of this waveform is limited by the repetition rate of the
stimulus pulse as well as the time step size.

The attainable repetition rate of our stimulus and sampling circuits is limited by two main components. First, the
sampling post-amplifier's bandwidth limits the maximum sample rate. In our design, we chose an \partno{OPA1656}
\qty{50}{\mega\hertz} Gain-Bandwidth Product (GBP) FET input low noise operational amplifier. We need a FET input part
to avoid loading the sampling gate. The comparatively high GBP and the low noise input stage of this device allow us to
amplify small signals that could result from weak reflections in small impedance discontinuities inside the mesh.

The second major factor limiting repetition rate is the microcontroller's ADC speed, as well as the speed of the
software processing the ADC's output. At full \qty{12}{b} resolution, this corresponds to a sampling rate of
approximately \qty{4}{MSps}. The microcontroller contains five ADCs, which can be interleaved to achieve higher rates.

Combining these factors, we conservatively decided on a sampling rate of \qty{1}{MSps} across both channels of the
differential pair. At this sampling rate, it is feasible to control the sample timing on a sample-by-sample basis. For
all measurements in this paper, we use a sequential sampling approach where the microcontroller takes a series of
measurements for oversampling at a particular delay, and then increases the delay by one \partno{HRTIM} output clock
interval.

In our prototype, one sweep of a \qty{188}{\nano\second} time span consisting of $1024$ data points took
\qty{710}{\milli\second} at $256\times$ oversampling and \qty{1.1}{\second} at $384\times$ oversampling. The time span
corresponds to \qty{28}{\meter} of mesh length, which at a \qty{200}{\micro\meter} pitch corresponds to a mesh area of
\qty{113}{\centi\meter\squared} and at a \qty{1}{\milli\meter} pitch corresponds to
\qty{565}{\centi\meter\squared}. Using the same microcontroller, by optimizing timing, moving oversampling processing
out of the interrupt handler, and by interleaving four of the microcontroller's five ADC peripherals, the lower limit of
acquisition time of a $1024$-point scan is \qty{33}{\milli\second} for $256\times$ oversampling and
\qty{49}{\milli\second} for $384\times$ oversampling.

While for our development, sequential scanning is adequate, in a future practical application, two simple optimizations
would decrease the time to detection for an attack. First, in a practical application, the range of scanned delays
should be adjusted to the length of the particular security mesh in use. For this paper, we always
scanned a time range of $1024$ points at \qty{184}{\pico\second} spacing starting before one stimulus pulse and ending
shortly before the next stimulus pulse so that any waveform artifacts will be visible. In a practical application, there
would be little information gained by sampling much beyond the edges of the expected mesh response, so the scan window
should be kept small to increase scan rate.

Secondly, in a practical application, the feature that is most relevant to detect tamper attempts is the trailing edge
of the mesh's response. This trailing edge corresponds to the return of the stimulus pulse's reflection at the far end
of the mesh. Any attack that affects the impedance even only of part of the mesh has a high chance of affecting its
delay, and thus this trailing edge is likely to move. In a practical application, it would thus be efficient to use a
heuristic scan schedule instead of the sequential scan we are using in our research prototype. Such a heuristic schedule
would sample delays near the expected trailing edge of the particular mesh in use more frequently compared to delays
that lie somewhere else, such as in the middle of the mesh's return window.

\section{Experimental Evaluation}

To validate our design, we performed a two-fold evaluation. First, we measured the performance of our sampling circuit
as a time-domain reflectometer. The most relevant figure to our mesh monitoring application is the pulse generators'
rise time, which determines the frontend's bandwidth and consequently the level of detail that we are able to extract
from a connected mesh during one scan. Since we aim at fingerprinting a connected mesh, not at performing absolute
measurements, we do not need to characterize or de-embed the transfer function of our TDR frontend.

Second, we characterized the end-to-end performance of our design on a mesh test specimen, and we evaluated its
performance on several realistic tamper attempts. As a baseline characterization, in Section\ \ref{sec_attack_short} we
will show measurements of both short and open mesh traces, allowing us to evaluate our designs' capacity to spatially
localize faults. Building upon this baseline, in Section\ \ref{sec_attack_probe} we will then demonstrate a probing
attack, in which we measured our design's response to a standard \qty{100}{\mega\hertz} bandwidth
$\qty{10}{\mega\ohm}||\qty{10}{\pico\farad}$ oscilloscope probe. Compared to the baseline open/short test, this provides
a greater challenge due to the probe's intentionally high impedance and minimal capacitive loading. Concluding our
attack tests, in Section\ \ref{sec_attack_bridge} we demonstrate a bridging attack that attempts to repair a break
created in the mesh through drilling.

\subsection{Rise Time Measurement}

We measured two figures of merit to characterize frontend speed. First, as shown in Section\ \ref{sec_spec_risetime}
below, we measured pulse rise time at the mesh interface to evaluate the raw rise time of our pulse generator. Second,
we used our circuit to perform a TDR measurement of a mesh test specimen and measured the rise time of the sampling
pulse as seen by the circuit itself. This figure indicates the actual measurement performance of our circuit. Both rise
times differ because of the non-linear characteristic of the sampling Schottky pairs. Depending on the IC, our pulse
generator produces output waveforms with \qtyrange{470}{3200}{\milli\volt} differential voltage swing. Since the
sampling diode pairs start to conduct at a combined forward voltage of approximately \qty{300}{\milli\volt}, they will
transition from high impedance to low impedance during a corresponding \qty{300}{\milli\volt} window at the middle of
the strobe pulse's edge. Thus, even if the strobe pulse shows a low-pass response with rounding at both ends, as long as
its slew rate $\frac{\mathrm{d}V}{\mathrm{d}t}$ during the zero crossing is fast enough, the pulse will still result in
a sharp turn-on knee of the sampling diodes.

\subsubsection{Stimulus Pulse Rise Time at the Mesh}
\label{sec_spec_risetime}

\begin{figure}
    \begin{center}
        \begin{subfigure}{0.45\textwidth}
            \centering
            \includegraphics[width=\textwidth]{fig_spec_risetime_74lvc.pdf}
            \vspace*{-5mm}
            \caption{74LVC2G157}
            \label{fig_spec_risetime_74lvc}
        \end{subfigure}
        \unskip\begin{subfigure}{0.45\textwidth}
            \centering
            \includegraphics[width=\textwidth]{fig_spec_risetime_max3748.pdf}
            \vspace*{-5mm}
            \caption{MAX3748}
            \label{fig_spec_risetime_max3748}
        \end{subfigure}

        \begin{subfigure}{0.45\textwidth}
            \centering
            \includegraphics[width=\textwidth]{fig_spec_risetime_tdp0604.pdf}
            \vspace*{-5mm}
            \caption{TDP0604}
            \label{fig_spec_risetime_tdp0604}
        \end{subfigure}
        \unskip\begin{subfigure}{0.45\textwidth}
            \centering
            \includegraphics[width=\textwidth]{fig_spec_risetime_pi3hdx.pdf}
            \vspace*{-5mm}
            \caption{PI3HDX12211}
            \label{fig_spec_risetime_pi3hdx}
        \end{subfigure}
    \end{center}
    \vspace*{-5mm}
    \caption{Spectrum measurements and re-constructed time domain pulse edge shape of the stimulus pulse measured at the
    mesh interface for each of the four driver ICs. Amplitudes were normalized for rise time plots. The $\frac{1}{f}$
    curve in the spectrum plots shows the peak amplitude of the frequency components of an ideal infinite-bandwidth
    square wave. The horizontal gray lines in the time domain plots show thresholds used for rise time calculation.}
    \label{fig_spec_risetime}
\end{figure}

To determine the rise time of our frontend's pulse generator, we measured the stimulus output at the mesh interface
using a Keysight N9020A MXA \qty{26.5}{\giga\hertz} signal analyzer\footnote{The spectrum analyzer used significantly
exceeded the capabilities of the fastest oscilloscopes we had access to, so it was the more appropriate choice of
measurement instrument.}. All measurements were taken with the prototype's mesh interface connected to the spectrum
analyzer through a bias tee configured for DC blocking followed by a \qty{20}{\deci\bel} attenuator for protection.
Since both stimulus and sampling pulses are generated using identical circuits, we can transfer those results to the
sampling pulse modulo amplifier output loading effects.

Figure\ \ref{fig_spec_risetime} and Table\ \ref{tab_edge_risetime} show the resulting measurements. For ease of
interpretation, we projected the measurements from the frequency domain (upper traces) back into the time domain (lower
traces), and extracted rise time measurements from those traces. Our measurements show that, as expected, the bare
\partno{74LVC}-series logic gate has the slowest rise time at approximately \qty{500}{\pico\second}. All three amplifier
variants we implemented showed significantly improved rise time, with the \partno{PI4HDX12211} achieving below
\qty{200}{\pico\second}, and the other two showing around \qty{120}{\pico\second}. A noteworthy detail is that
\partno{MAX3748} and \partno{TDP0604} only achieved a low output signal amplitude, which stems from a combination of
them having low output amplitude by design and of our circuit loading their outputs heavily. Since their amplitude is
only marginally within the knee region of the RF Schottky diodes used in the sampling bridges, in these variants,
the sampling gates end up slower than the raw pulse rise time value alone would suggest.

\subsubsection{Self-Characterization}

\begin{figure}
    \begin{center}
        \includegraphics[width=\textwidth]{fig_edge_risetime.pdf}\vspace*{-7mm}
    \end{center}
    \caption{One edge of the stimulus pulse with no mesh connected measured by the board itself, using different
    amplifier ICs. For each IC, ten traces are shown. The vertical scale is in Volts at the sampling amplifier output.}
    \label{fig_edge_risetime}
\end{figure}

\begin{table}
    \begin{center}
        \begin{tabular}{r|cccc}
            \textbf{IC}
            &\partno{74LVC2G157}
            &\partno{MAX3748}
            &\partno{TDP0604}
            &\partno{PI3HDX12211}\\\hline

            \textbf{$t_r$ (Self-Characterization)}&
            \qty{916}{\pico\second}&
            \qty{743}{\pico\second}&
            \qty{333}{\pico\second}&
            \qty{264}{\pico\second}\\

            \textbf{$t_r$ (Stimulus at Mesh)}&
            \qty{573}{\pico\second}&
            \qty{125}{\pico\second}&
            \qty{119}{\pico\second}&
            \qty{191}{\pico\second}\\

            \textbf{Stimulus Pulse $V_{pp}$}&
            \qty{1600}{\milli\volt}&
            \qty{236}{\milli\volt}&
            \qty{254}{\milli\volt}&
            \qty{430}{\milli\volt}\\

            \textbf{Effective Slew Rate}&
            \qty{2.79}{\volt\per\nano\second}&
            \qty{1.89}{\volt\per\nano\second}&
            \qty{2.13}{\volt\per\nano\second}&
            \qty{2.25}{\volt\per\nano\second}
        \end{tabular}
    \end{center}
    \caption{Single-ended stimulus edge rise times for different amplifier ICs. The single-ended rise times of both
    positive and negative half of the differential pair have been averaged. External measurements are from Figure\
    \ref{fig_spec_risetime}, measuring the stimulus pulse at the mesh interface. $V_{pp}$ measurements are taken at the
    mesh interface. Effective slew rates are calculated from the external measurements and pulse $V{pp}$.}
    \label{tab_edge_risetime}
\end{table}

Figure\ \ref{fig_edge_risetime} shows the result of our self-characterization experiments, where we used the frontend to
measure its own pulse shape. These results correspond to the actual rise time we can expect in practical measurements.
In these experiments, we ran a measurement using $256\times$ oversampling at \qty{12}{b} ADC resolution. The plots show
voltage at the amplifier output voltage against time in \unit{\nano\second}. The absolute value of the amplifier output
voltage is not relevant here - only the rise time is. Since we use some of these amplifiers--particularly the redriver
ICs--well outside of their intended application, the actual voltage they develop across the nonlinear load that our
sampling gate's diode bridge presents depends on implementation details of the amplifier's CML output stage. To maximize
ADC resolution and minimize ringing, we tuned gain and bandwidth of each post-sampling amplifier for each IC. Ringing in
the amplifier output leads to jitter in the ADC's sampling period to directly feeding through to the ADC output value.
Since in \partno{STM32} MCUs, the ADC is clocked independently of the rest of the system, its sampling timing is poorly
controlled and this jitter causes a significant error unless the amplifier is well-compensated. The key figure for us is
how fast our sampling gate turns on, not how hard, so we can largely ignore the units on the graph's vertical scale.

Table\ \ref{tab_edge_risetime} shows rise times calculated from each trace, averaged across both traces of the
differential pair. From these results and from the graphs in Figure\ \ref{fig_edge_risetime} we can see that in the
optical networking limiting amplifier produces slower edges than the measurements from Figure\ \ref{fig_spec_risetime}
would suggest. We suspect that this is caused by its low output amplitude resulting in part from its specifications and
in part from a poor match between its CML output structure and the nonlinear impedance presented by the sampling diode
bridges. Surprisingly, even the \partno{74LVC2G157} baseline unit has a rise time of less than \qty{1}{\nano\second}. We
estimate that this is caused by the large output voltage swing of this part, going from ground to its $V_{CC}$ at
\qty{3.3}{\volt}. Due to the construction of our sampling gate, its switching happens in the short period between its
input differential voltage crossing zero and it rising above the combined forward voltage of the Schottky diodes. Thus,
while the \partno{74LVC} might produce slow edges overall, its large output swing results in a high slew rate in the
critical region around the zero crossing that mostly determines the speed of the sampling gates.

We observed the best result overall with the \partno{PI3HDX12211} redriver, resulting in a rise time of
\qty{264}{\pico\second}. In this test specimen, we fed the pulse through the amplifier twice since we had two unused
channels, and we used \qty{200}{\pico\second} clip lines on the amplifier's output for pulse shaping. We could only use
the clip lines in this specimen as in all other specimens, the amplifiers' output did not contain sufficient harmonic
content such that it was still able to turn on the sampling gate's diode bridge when used with the clip line.

\subsection{Mesh Specimen Characterization}

\begin{table}
    \begin{center}
        \begin{tabular}{r|cccc}
            \textbf{Specimen}
            &1
            &2
            &3
            &4\\\hline

            \textbf{Size}&
            $35\times\qty{70}{\milli\meter}$&
            $35\times\qty{70}{\milli\meter}$&
            $35\times\qty{70}{\milli\meter}$&
            $35\times\qty{70}{\milli\meter}$\\

            \textbf{Area}&
            $\qty{24.5}{\centi\meter^2}$&
            $\qty{24.5}{\centi\meter^2}$&
            $\qty{24.5}{\centi\meter^2}$&
            $\qty{24.5}{\centi\meter^2}$\\\hline

            \textbf{Trace width}&
            \qty{150}{\micro\meter}&
            \qty{200}{\micro\meter}&
            \qty{300}{\micro\meter}&
            \qty{500}{\micro\meter}\\

            \textbf{Trace spacing}&
            \qty{150}{\micro\meter}&
            \qty{200}{\micro\meter}&
            \qty{300}{\micro\meter}&
            \qty{500}{\micro\meter}\\

            \textbf{Trace pitch}&
            \qty{300}{\micro\meter}&
            \qty{400}{\micro\meter}&
            \qty{600}{\micro\meter}&
            \qty{1.00}{\milli\meter}\\\hline

            \textbf{Trace length}&
            \qty{1.07}{\meter}&
            \qty{1.93}{\meter}&
            \qty{2.86}{\meter}&
            \qty{3.86}{\meter}\\

            \textbf{Approximate Delay}&
            \qty{7.1}{\nano\second}&
            \qty{13}{\nano\second}&
            \qty{19}{\nano\second}&
            \qty{26}{\nano\second}\\
        \end{tabular}
    \end{center}
    \caption{Specifications of mesh test specimens used in the experiments in this paper. All four specimens were placed
        on a single, four-layer, \qty{1.0}{\milli\meter} thickness PCB. The meshes were placed two per side on the outer
        layers, and the inner layers were used as ground. Approximate signal delays were calculated using wave velocity
        $v=\frac{c}{\sqrt{\epsilon_r}}\approx\frac{c}{2}$\cite{wheelerTransmissionLinePropertiesParallel1965} assuming
        $\epsilon_r\approx 4$\cite{mumbyDielectricPropertiesFR41989} for the test specimens' \partno{FR-4} substrate.}
    \label{tab_mesh_spec}
\end{table}

To measure the practical performance of our prototype, we created a set of security mesh test specimens. Four specimens
each cover the same area using four different mesh pitches using two, looped mesh traces according to the design
specifications listed in Table\ \ref{tab_mesh_spec}. The four specimens have a trace length ratio of approximately
$1:2:3:4$. As a baseline validation of our prototype as well as the mesh design, we performed TDR measurements of each
mesh specimen using each amplifier variant of our prototype. Figure\ \ref{fig_mesh_length} shows the results of these
measurements. The graphs show the step response resulting from an edge entering the mesh, and its reflection arriving
back at the start after traversing the mesh back and forth.

We validated the results from Figure\ \ref{fig_mesh_length} by calculating speed of light in our mesh specimen's
substrate based on them. The resulting measurements are shown in Table\ \ref{tab_speed_of_light}. All amplifier
configurations yield comparable measurements of approximately \qty{1.6}{\meter\per\second}, which corresponds well with
the expected signal propagation velocity in \partno{FR-4} PCB material of
\qty{1.5d8}{\meter\per\second}\cite{wheelerTransmissionLinePropertiesParallel1965,mumbyDielectricPropertiesFR41989}.

An interesting aspect of the graphs in Figure\ \ref{fig_mesh_length} is that all except the \partno{74LVC} graph show a
dispersion effect increasingly rounding out the trailing edge of the response with longer mesh lengths. We suspect this
effect stems from higher-frequency components coupling into adjacent trace segments further up or down the mesh more
easily, spreading high-frequency components of the response signal out throughout time and effectively creating a
low-pass response. We suspect the poor visibility of this effect in the \partno{74LVC} measurements is a result of this
variant's pulse amplifier output amplitude being very large, allowing reflected response components to forward-bias the
sampling gate's diode bridges, resulting in amplitude clipping. 

From this dispersion effect follows a key point for the design of practical security meshes: To increase the temporal
resolution of TDR mesh monitoring, meshes should be broken up into relatively short segments that are multiplexed
through signal switching. Where this is not desirable, the mesh can be treated as a microwave circuit design that can be
optimized through the electronic CAD/electromagnetic simulation co-design approach used for such circuits.

\begin{figure}
    \begin{center}
        \includegraphics[width=\textwidth]{fig_mesh_length.pdf}
        \vspace*{-10mm}
    \end{center}
    \caption{TDR responses captured using our design with each of four candidate pulse amplifier ICs and four mesh test
        specimens. The shown time range covers the primary reflection of the stimulus pulse's falling edge. The vertical
        scale of all four graphs is in Volts at the ADC. For clarity, only one channel of the response is shown.}
    \label{fig_mesh_length}
\end{figure}

\begin{table}
    \begin{center}
        \begin{tabular}{r|cccc|c}
            &\multicolumn{4}{c|}{Specimen}&\\
            Pulse amplifier IC&
            1&
            2&
            3&
            4&
            Calculated speed of light $c$
            \\\hline

            \partno{PI3HDX12211}&
            \qty{16.9}{\nano\second}&
            \qty{26.0}{\nano\second}&
            \qty{36.4}{\nano\second}&
            \qty{46.1}{\nano\second}&
            $\qty{1.59d8}{\meter\per\second}$\\

            \partno{74LVC2G157}&
            \qty{17.1}{\nano\second}&
            \qty{26.4}{\nano\second}&
            \qty{36.6}{\nano\second}&
            \qty{48.2}{\nano\second}&
            $\qty{1.55d8}{\meter\per\second}$\\

            \partno{MAX3748}&
            \qty{17.2}{\nano\second}&
            \qty{26.4}{\nano\second}&
            \qty{36.6}{\nano\second}&
            \qty{45.6}{\nano\second}&
            $\qty{1.59d8}{\meter\per\second}$\\

            \partno{TDP0604}&
            \qty{17.0}{\nano\second}&
            \qty{26.2}{\nano\second}&
            \qty{36.5}{\nano\second}&
            \qty{45.8}{\nano\second}&
            $\qty{1.59d8}{\meter\per\second}$\\
        \end{tabular}
    \end{center}
    \caption{Speed of light and time offset calculated from delays read from the graphs in Figure\
    \ref{fig_mesh_length}. $c$ is the speed of light determined by linear fit.}
    \label{tab_speed_of_light}
\end{table}

\subsection{Tamper tests}

After validating our prototype's electrical performance as well as our mesh specimen designs in the previous sections,
we performed a series of experiments where we performed tampering attempts on a mesh specimen while monitoring it using
our TDR prototype, capturing responses both before and after tampering. We performed two sets of experiments.

\subsubsection{Short and Open Circuits}
\label{sec_attack_short}

\begin{figure}
    \begin{center}
        \includegraphics[width=\textwidth]{fig_manip_shape.pdf}
    \end{center}
    \caption{TDR responses captured using our design under three short- and one open-circuit scenario. The distance from
    mesh start to Location 1, 2, and 3  is \qty{558}{\milli\meter}, \qty{125}{\milli\meter} and \qty{850}{\milli\meter},
    respectively. The cut is approximately halfway through the mesh. Left and right plots show the positive and negative
    trace of the differential pair, respectively. Black traces show baseline measurements in between attacks. The
    baselines show vertical offsets due to temperature drift, which causes a small DC offset in our design. The vertical
    scale is in Volts at the ADC.}
    \label{fig_manip_shape}
\end{figure}

In our first experiment, we tested both short and open-circuit conditions. We tested a short circuit between the two
mesh traces in three locations as well as a cut trace halfway through the mesh. Figure\ \ref{fig_pic_specimens} in
Appendix\ \ref{appendix_photos} shows photos of our test specimens. Figure\ \ref{fig_manip_shape} shows the result of
our experiment. The graphs show a clear response of our monitoring circuit to all four tampering scenarios. Short and
open circuit conditions can clearly be distinguished from each other, and in all cases, the fault location can be
determined with sub-nanosecond precision, corresponding to several centimeters in distance along the mesh.

\subsubsection{Probing by Oscilloscope Probe}
\label{sec_attack_probe}

\begin{figure}
    \begin{center}
        \includegraphics[width=\textwidth]{fig_probe_shape.pdf}
        \vspace*{-7mm}
    \end{center}
    \caption{The circuit's TDR response under a probing attack using an oscilloscope probe. Black traces are a series of
    un-probed baseline measurements taken between attacks. All traces are plotted relative to a separate baseline trace
    taken at the beginning of the experiment. The top and bottom plots show the two halves of the differential pair.}
    \label{fig_probe_shape}
\end{figure}

In our second experiment, we probed each of the three locations from the test specimen shown in Figure\
\ref{fig_pic_specimens} in the Appendix once at each trace of the trace pair using a Rigol \partno{PVP3150} $\times
1/\times 10$ oscilloscope probe set to $\times 10$ mode. We grounded the probe's ground clip to the mesh ground and used
the probe without tip attachment.

Using the \partno{PI3HDX12211} variant of our prototype, we measured the mesh's TDR response while probing. Figure\
\ref{fig_manip_shape} shows the resulting TDR traces. Oscilloscope probes are specifically designed to disturb the
circuit under test as little as possible, with this one being specified as presenting as a \qty{10}{\mega\ohm} resistive
load in parallel with a \qty{10}{\pico\farad} capacitance when used in $\times 10$ mode as we did here. Since the
resulting disturbance to the TDR traces is smaller than those in Figure\ \ref{fig_manip_shape}, we post-processed the
traces by subtracting a baseline trace taken before the measurements. To highlight drift in the baseline trace, we
include additional baseline traces taken in between and after measurements using the same post-processing.

In each trace, the mesh was probed in one of three locations as in Figure\ \ref{fig_manip_shape}, and on one of the two
mesh traces. The time range shown in the graph covers the primary reflection of the stimulus pulse's rising edge. We can
clearly see a distinct response to each of the three probing attempts with the only caveat being that the response of
the two mesh traces is asymmetrical due to asymmetry in our sampling frontend when measuring such low signal levels.
Interestingly, this asymmetry is fully compensated by the fact that we excite the mesh differentially, and as a result
probing either trace distorts their shared electromagnetic field, and impacts measurements on \emph{both} traces.
Particularly on the first trace, we can distinguish which trace was probed, as well as where it was probed, in a single
measurement.

\subsubsection{Circumvention Through Micro-Soldering}
\label{sec_attack_bridge}

\begin{figure}
    \centering
    \begin{subfigure}{0.78\textwidth}
        \centering
        \includegraphics[width=\textwidth]{fig_drill_mod_shape.pdf}
        \label{fig_drill_mod_shape_plot}
    \end{subfigure}
    \begin{subfigure}{0.2\textwidth}
        \centering
        \includegraphics[width=\textwidth]{pic_manip_microsoldering_small.jpg}
        \vspace*{2mm}
        \label{fig_drill_mod_shape_pic}
    \end{subfigure}
    \caption{The circuit's TDR response under a manipulation attack bridging part of a trace to allow a
        \qty{300}{\micro\meter} drill to penetrate. The mesh pitch is \qty{240}{\micro\meter}. Red traces show
        measurements with a looped wire patch comparable to \textcite{immlerSecurePhysicalEnclosures2018}, black traces
        show the same gap bridged with a minimally short straight piece of wire. The left and right plots show the two
        halves of the differential pair. The photo shows the looped wire patch with a \qty{1}{\milli\meter} pitch ruler
        for reference. Traces are normalized as in Figure\ \ref{fig_probe_shape}.}
    \label{fig_drill_mod_shape}
\end{figure}

While our proposed measurement setup significantly increases the level of effort required from an attacker, as long as
standard PCBs are used as meshes, the attacker can apply PCB rework techniques like they are widely used in the industry
for PCB repair. If we assume a standard PCB process with \qty{100}{\micro\meter} trace/space design rules, a drilling
attack targeting a \qty{300}{\micro\meter} hole size as proposed by \textcite{immlerSecurePhysicalEnclosures2018} will
break at least one trace. Patching the resulting break using a wire is possible, but with increasing wire length, the
TDR response of the mesh is increasingly distorted. We experimentally performed an attack comparable to the one shown by
\textcite{immlerSecurePhysicalEnclosures2018} on a \qty{240}{\micro\meter} pitch mesh specimen. Figure\
\ref{fig_drill_mod_shape} shows our modification and the resulting change in TDR response. As we can see, adding even
just a few millimeters of wire will measurably and consistently distort the TDR response.

\subsection{Countermeasures}

As shown above, PCB security meshes can be manipulated using industry-standard micro-soldering techniques. Keeping the
length of any patch wires as short as possible, it is conceivable that the impact on TDR response could be kept below
detection thresholds. Our setup provides increased resistance against such attacks since the entire attack would have to
be carried out without electrically contacting either mesh trace. In particular, soldering would have to be done using a
minimal amount of solder as well as a bespoke, insulated soldering iron tip. While manufacturing such a tool out of a
material like sintered ceramic is conceivable, to our knowledge, no such tool exists on the market.

Furthermore, the actual drilling would have to happen with a dielectric drill bit, placing special attention on
evacuating conductive copper chips before they can create shorts to nearby traces. Again, it is conceivable that such a
tool could be manufactured, but to our knowledge, such a tool is not currently available as a standard component on the
market.

Finally, any probes penetrating the mesh would have to be placed such that their presence in the vicinity of the mesh
traces does not disturb the TDR response. In particular, we have observed that even touching the mesh will distort the
response, so modifications would have to be carried out with great care, likely using micromanipulators or similar
specialized equipment.

The PCI PTS HSM DTR standard\cite{pcisecuritystandardscouncilPaymentCardIndustry2021a} contains a useful framework for
thinking about attacker capabilities. Applying their taxonomy, our monitoring system raises the skill level required for
a patching attack from a \emph{skilled} attacker to an \emph{expert} attacker, and the equipment requirement from
\emph{standard} equipment to \emph{bespoke} equipment such as dielectric drill bits and ceramic soldering tips.

\section{Future Work}

\paragraph{Design variants.} The \partno{STM32G4}'s \partno{HRTIM} peripheral is limited by to the comparatively slow
maximum system clock speed of \qty{168}{\mega\hertz} to a timing resolution of \qty{184}{\pico\second}. While we have
demonstrated that this is sufficient to detect and localize several attack variants, it would be interesting to increase
time resolution since in our measurements, we observed that the end-to-end jitter of our frontend is low enough that our
circuit would benefit from finer delay control. In our prototype, we implemented a--so far unused--adjustable power
supply for the \partno{74LVC} series buffer in between the \partno{HRTIM} outputs and the pulse amplifier. By adjusting
this buffer's power supply through one of the microcontroller's digital-to-analog converter (DAC) channels, we expect
that it should be possible to exploit the supply voltage dependency of the propagation delay of \partno{74LVC} series
CMOS logic to create a digitally controllable delay with picosecond resolution. The internal DLL of the \partno{HRTIM}
peripheral is likely implemented similarly.

% FIXME reword for publication
\paragraph{System design.} The work we presented in this paper is complementary to the work previously presented by
\textcite{gotteCantTouchThis2022}, where the authors improved security of a simple security mesh made from standard PCBs
through mechanical motion. We are currently working on a prototype combining both approaches and incorporating heuristic
scan scheduling as mentioned in Section\ \ref{sec_scan_schedule}.

\paragraph{Auxiliary applications.} In this work, we have presented a design for a low-cost, embedded TDR frontend.
Besides security mesh monitoring, through multiplexing this TDR frontend could be used for other system monitoring
tasks from tamper sensing to system health monitoring. For instance, \textcite{vaiSecureArchitectureEmbedded2015}
propose an approach for checking the integrity of a PCBA using an external Vector Network Analyzer (VNA) attached to
test points on the PCBA's Power Distribution Network (PDN). TDR can produce fingerprints similar to a VNA and it would
be interesting to measure parts of the secure subsystem other than its security mesh using our TDR frontend.

\section{Conclusion}

In this paper, we presented a design for a low-cost frontend for integrity monitoring of security meshes in applications
such as HSMs based on the principles of sub-nanosecond Time Domain Reflectometry. Our design repurposes an inexpensive
HDMI redriver IC to produce sharp edges for the TDR stimulus, and applies a microwave clip line to form fast pulses for
TDR sampling. Our design creates a detailed fingerprint of the intact mesh's condition that not only captures the length
of the mesh's traces but also reflects the impedance at every point along the mesh.

Beyond simply detecting faults or manipulations that disturb the mesh without causing breaks, we have demonstrated our
prototype circuit's capability to distinguish and physically localize faults inside the mesh in several practical attack
scenarios with even careful attacks causing strong disturbances in the generated fingerprint.

Compared to the state of the art, our approach enables the monitoring of larger meshes, at higher sensitivity and lower
cost. Our is easy to replicate, does not require any specialized or custom components, and unlocks high-security
applications for security meshes made using low-cost, standard PCB manufacturing processes.

\section*{Availability}
This is version \texttt{\input{version.tex}\unskip} of this paper, generated on \today. The git repository with the
LaTeX source for this paper, all hardware design files, and firmware and analysis source code can be found at:

\center{Note: URL elided for peer review}
% \center{\url{https://git.jaseg.de/ihsm-sampling-mesh-monitor-hw.git}}
\FloatBarrier

\printbibliography[heading=bibintoc]

\appendix
\section{Additional photos}
\label{appendix_photos}

\begin{figure}[h!]
    \centering
    \begin{subfigure}{0.45\textwidth}
        \centering
        \includegraphics[width=0.8\textwidth]{pic_short_2_small.jpg}
        \label{fig_pic_specimens_short}
        \caption{Short circuit test specimen}
    \end{subfigure}
    \begin{subfigure}{0.45\textwidth}
        \centering
        \includegraphics[width=0.8\textwidth]{pic_cut_1_small.jpg}
        \label{fig_pic_specimens_open}
        \caption{Cut trace test specimen}
    \end{subfigure}
    \caption{Photos of the short circuit and cut trace test specimens. In the specimen shown on the left, in each of the
        three marked locations, both traces of the mesh were exposed. To measure short circuit response, the traces were
        shorted in one of the locations using a soldering iron. In the specimen shown on the right, one trace was
        exposed and cut in the marked location. To measure baseline values, the test specimen shown on the right was
        used with the trace temporarily repaired.}
    \label{fig_pic_specimens}
\end{figure}

\end{document}
