Computational Soundness for Dalvik Bytecode

Automatically analyzing information flow within Android applications that rely on cryptographic operations with their computational security guarantees imposes formidable challenges that existing approaches for understanding an app's behavior struggle to meet. These approaches do not distinguish cryptographic and non-cryptographic operations, and hence do not account for cryptographic protections: f(m) is considered sensitive for a sensitive message m irrespective of potential secrecy properties offered by a cryptographic operation f. These approaches consequently provide a safe approximation of the app's behavior, but they mistakenly classify a large fraction of apps as potentially insecure and consequently yield overly pessimistic results. In this paper, we show how cryptographic operations can be faithfully included into existing approaches for automated app analysis. To this end, we first show how cryptographic operations can be expressed as symbolic abstractions within the comprehensive Dalvik bytecode language. These abstractions are accessible to automated analysis, and they can be conveniently added to existing app analysis tools using minor changes in their semantics. Second, we show that our abstractions are faithful by providing the first computational soundness result for Dalvik bytecode, i.e., the absence of attacks against our symbolically abstracted program entails the absence of any attacks against a suitable cryptographic program realization. We cast our computational soundness result in the CoSP framework, which makes the result modular and composable.Comment: Technical report for the ACM CCS 2016 conference pape

Direct Observation of Large Amplitude Spin Excitations Localized in a Spin-Transfer Nanocontact

We report the direct observation of large amplitude spin-excitations localized in a spin-transfer nanocontact using scanning transmission x-ray microscopy. Experiments were conducted using a nanocontact to an ultrathin ferromagnetic multilayer with perpendicular magnetic anisotropy. Element resolved x-ray magnetic circular dichroism images show an abrupt onset of spin excitations at a threshold current that are localized beneath the nanocontact, with average spin precession cone angles of 25{\deg} at the contact center. The results strongly suggest that we have observed a localized magnetic soliton.Comment: 5 pages, 3 figure

Reduction of Interpolants for Logic Synthesis

Abstract—Craig Interpolation is a state-of-the-art technique for logic synthesis and verification, based on Boolean Satisfiability (SAT). Leveraging the efficacy of SAT algorithms, Craig Interpolation produces solutions quickly to challenging problems such as synthesizing functional dependencies and performing bounded model-checking. Unfortunately, the quality of the solutions is often poor. When interpolants are used to synthesize functional dependencies, the resulting structure of the functions may be unnecessarily complex. In most applications to date, interpolants have been generated directly from the proofs of unsatisfiability that are provided by SAT solvers. In this work, we propose efficient methods based on incremental SAT solving for modifying resolution proofs in order to obtain more compact interpolants. This, in turn, reduces the cost of the logic that is generated for functional dependencies. I

Disentangling surface and bulk transport in topological-insulator pp-nn junctions

By combining $n$-type $\mathrm{Bi_2Te_3}$ and $p$-type $\mathrm{Sb_2Te_3}$ topological insulators, vertically stacked $p$-$n$ junctions can be formed, allowing to position the Fermi level into the bulk band gap and also tune between $n$- and $p$-type surface carriers. Here we use low-temperature magnetotransport measurements to probe the surface and bulk transport modes in a range of vertical $\mathrm{Bi_2Te_3/Sb_2Te_3}$ heterostructures with varying relative thicknesses of the top and bottom layers. With increasing thickness of the $\mathrm{Sb_2Te_3}$ layer we observe a change from $n$- to $p$-type behavior via a specific thickness where the Hall signal is immeasurable. Assuming that the the bulk and surface states contribute in parallel, we can calculate and reproduce the dependence of the Hall and longitudinal components of resistivity on the film thickness. This highlights the role played by the bulk conduction channels which, importantly, cannot be probed using surface sensitive spectroscopic techniques. Our calculations are then buttressed by a semi-classical Boltzmann transport theory which rigorously shows the vanishing of the Hall signal. Our results provide crucial experimental and theoretical insights into the relative roles of the surface and bulk in the vertical topological $p$-$n$ junctions.Comment: 11 pages, 5 figure

Stable magnetic droplet solitons in spin-transfer nanocontacts

Magnetic thin films with perpendicular magnetic anisotropy (PMA) have localized excitations that correspond to reversed dynamically precessing magnetic moments, known as magnetic droplet solitons. Fundamentally, these excitations are associated with an attractive interaction between elementary spin-excitations (i.e., magnons) and were predicted to occur in PMA materials in the absence of damping [1, 2]. While damping, present in all magnetic materials, suppresses these excitations, it is now possible to compensate damping by spin transfer torques through electrical current flow in nanometer scale contacts to ferromagnetic thin films [3, 4]. A theory predicts the appearance of magnetic droplet solitons at a threshold current in nanocontacts [5] and, recently, experimental signatures of droplet nucleation have been reported [6]. However, thus far, they have been observed to be nearly reversible excitations, with only partially reversed magnetization and to be subject to instabilities that cause them to drift away from the nanocontacts (i.e., drift instabilities) [6]. Here we show that magnetic droplet solitons can be stabilized in a spin transfer nanocontact. Further, they exhibit a strong hysteretic response to fields and currents and a nearly fully reversed magnetization in the contact. These observations, in addition to their fundamental interest, open up new applications for magnetic droplet solitons as multi-state high frequency current and field tunable oscillators

The JKind Model Checker

JKind is an open-source industrial model checker developed by Rockwell Collins and the University of Minnesota. JKind uses multiple parallel engines to prove or falsify safety properties of infinite state models. It is portable, easy to install, performance competitive with other state-of-the-art model checkers, and has features designed to improve the results presented to users: inductive validity cores for proofs and counterexample smoothing for test-case generation. It serves as the back-end for various industrial applications.Comment: CAV 201

X-Ray Detection of Transient Magnetic Moments Induced by a Spin Current in Cu

We have used a MHz lock-in x-ray spectro-microscopy technique to directly detect changes of magnetic moments in Cu due to spin injection from an adjacent Co layer. The elemental and chemical specificity of x-rays allows us to distinguish two spin current induced effects. We detect the creation of transient magnetic moments of $3\times 10^{-5}$ $\mu_\mathrm{B}$ on Cu atoms within the bulk of the 28 nm thick Cu film due to spin-accumulation. The moment value is compared to predictions by Mott's two current model. We also observe that the hybridization induced existing magnetic moments on Cu interface atoms are transiently increased by about 10% or $4\times 10^{-3}$ $\mu_\mathrm{B}$. This reveals the dominance of spin-torque alignment over Joule heat induced disorder of the interfacial Cu moments during current flow