IEEE Solid-States Circuits Magazine - Fall 2020 - 68

gains control over the packet that
will be received by the victim.

tors and time interleaving in the RF
Tx architecture to avoid dead zones
[6]. Further, a data-driven random
dynamic channel selection is devel-
oped to enable secure wireless com-
munications with data encryption in
the physical layer.
To overcome the vulnerabilities
of BLE communications, several chal-
lenges are addressed in this lowpower system design by leveraging
device technologies and novel hard-
ware architectures. The mitigation

Countermeasures: Cryptographically Secure, Data-Driven, Bit-Level FH
Physical-layer security is achieved
against selective jamming attacks
through an ultrafast bit-level FH
scheme with 1-ns hop periods, theo-
retically the shortest time to spend
on a 1-MHz channel. This scheme
exploits the frequency agility of
bulk acoustic wave (BAW) resona-

BLE Packet-Level FH
Attack: Selective Jamming of BLE Devices
000101...

Frequency

fc5 1 MHz
fc4

Packet-Level
Hopping
Allows
Channel and
Bit
Localization

101110...

fc3
fc2

101011...
BLE
Packet

fc1
612 µs
1 µs 2 µs 3 µs 4 µs

1,224 µs
Time

1,836 µs

Channel Information
Bit Location Leaked

FIGURE 2: The time-based vulnerability: BLE packet-level FH is slow, with a 612-ns hop
period [6].

BLE GFSK Modulation With Fixed Carrier Offset
Attack: Selective Overwrite of Packet Bits

Observed Bit Leaks
Jamming Location

-250 kHz f +250 kHz
c
Bit 0
Bit 1

(a)

(b)

FIGURE 3: The modulation-based vulnerability: BLE GFSK modulation with a fixed carrier
offset leaks the individual bit locations [6]. (a) BLE GFSK modulation and (b) selective jamming.
fc: center frequency.

FA L L 2 0 2 0

IEEE SOLID-STATE CIRCUITS MAGAZINE

techniques introduced and demon-
strated in this work [6] are described
in detail in the following.

Bit-Level FH
To provide resilience to the time-based
selective jamming attack, a BAWbased Tx sends every bit on a unique
channel by hopping at the 1-ns bit
period, as displayed in Figure 4. The
hop period is determined by the
minimum time needed to resolve a
1-MHz channel bandwidth. The ultra-
fast hopping rate prevents jammers
from accurately detecting a target
Tx's carrier frequency and initiating
interference before the target's next
hop. The BAW-based Tx spends the
minimum amount of time at one fre-
quency channel that is needed for the
target receiver to decode.
Frequency agility of BAW resonators. Among the challenges in achiev-
ing ultrafast bit-level FH with low
power is using a conventional phaselocked loop (PLL) with a crystal oscil-
lator [9] as an RF synthesizer, since
it is typically slow to change its fre-
quency. Figure 5 presents the startup time versus power performance
for several state-of-the-art examples
of PLLs [10]-[13] and crystal oscil-
lators [14]-[17], with their start-up
time on the order of 10 to 1,000 ns.
The ability to quickly change carrier
frequencies is achieved by leveraging
fast-start-up BAW resonators with a
start-up time of ≤5 ns [7], [18].
The start-up time of a frequency
source is proportional to the quality
factor (Q) and inversely proportional
to the resonance frequency (fBAW).
BAW resonators [19]-[21] inherently
offer a high Q (Q . 1, 000) and high
resonance frequency in the 2.4-GHz
band, and this leads to a low start-up
time on the order of a few ns, only
2.3 ns in [7]. However, BAW resona-
tors typically have a small continu-
ous tuning range [22] of roughly
4-5 MHz, which limits their deploy-
ment in wideband systems, as por-
trayed in Figure 6. In [23], three BAW
resonators are copackaged with the
CMOS die to cover only the 3-MHz
bandwidth at discrete frequencies

IEEE Solid-States Circuits Magazine - Fall 2020

Table of Contents for the Digital Edition of IEEE Solid-States Circuits Magazine - Fall 2020