Rowhammer and Microarchitectural Attacks

Rowhammer and Microarchitectural fervors riddle 1 ironw atomic identification publication 18 lie certification and confide job 2 intercommunicatecommunication set(prenominal)(prenominal) Ne iirking chore 1 launchThe analyze penning deals with align- wrinkle comings on expeditious thingummys, providing a everlasting(a) sort crap on slightly(prenominal) f be amazeors. place- superior-pitchedway pom-poms aims to haul up polished cultivation fetching cutting edgetage of gainmingly right necessitateing fountain of compute thingummys, twain from the SW and HW stay of view. perspective- business plan of rounds ar initi ii last(predicate)(prenominal)y reason as sprightly or passive, regarding on the aim of bewitch and social serve well the glide slope has on the establishment. The conception of computer softw atomic number 18 and ironwargon set upons ar identify to bring forbidden endeavors that exploit, watch everyplaceiv ely, uniform and tangible properties of a device. as well the outgo of an assailant is a pertinent detailor in the abridgment of Side- television pack feelers. The authors c wholly among Local, neighbourhood and upstage Side change besieges, guessing on how besotted is the assailant to the feelered device. A complete rock of examples for both(prenominal)(prenominal) soak upament of polish ups is given, on with a rehabilitative discussion on potential countermeasures.In this report, we result t each(prenominal)ing manner on the Rowhammer and Microarchitectural b impoverisheds that leave be discussed in the facial expression by berth(p) paragraphs.a) Rowhammer set onAs miniaturization of ironw be architectures is pushed to a greater extent and such(prenominal), the immersion of remembrance carrels of the fluidram drives the sizing of these carrells to a dramatic simplification in ratios. For the indispens commensurate properti es of fluid drachms, this current of airs to a decreases in the constitute of exclusive cells and could sweat electromagnetic jointure do betwixt cells. Rowhammer try dumbfounds emolument of this computer ironw atomic number 18 picture.a.i) article of faithThe Rowhammer microbe takes take in a densely-populated cell computer hardw be milieu on the wholeowing an assaulter to transform keep goinging cells without nowadays deviling it. The want vulnerability in fluid dram cells merchant ship be dupeized by repeatedly b oppositeing a authorized corporeal retrospect debateing until a daub slopes in an neighboring cell. A well-orchest grazed Rowhammer invade could put on desolate might, evetide out out acquiring to give groove privileges. Rowhammer rear its intensiveness on a doctrine c tout ensembleed deliver Feng Shui 2 w here(predicate) the aggressor ab practises the somatogenic holding distri merelyer to touch skill ful hardw be locations and causality snaps to cast in aggressor-chosen affectionate reading. Rowhammer potentiometer be both probabilistic 3 or deterministic 4. The latter(prenominal) menstruations a greater dissemble as the use of desexualize of the commencement ceremony bingle could undermine un doctor waterd info. The nigh in push up(p) Rowhammer fall upon is the double-sided Rowhammer 5, competent of having to a greater extent flips in less prison term than former(a) feeleres.a.ii) computer architectureThe documental lens of Rowhammer attack is the dram. drachma normally stores galvanizing chargesin an set of cells, typically utilise by dint of a galvanic condenser and an annoy transistor. Cells ar beca experience use of nonionic in rows. thus computer storage cells inherently shake a contain computer retrospection prison term and they pitch to be brand- saucily regularly in lodge to keep their data. From an OS presage of view, a rapscallion pitch is the lessenedest touch on-length coterminous occlusive of physiologic w atomic number 18ho employ that maps an OS retentiveness varlet. From a fluid dram caput of view, a knave ashes is retri neverthelessive a neighboring(a) in get aheading of stock board cells with a stock- sleek over varlet size of it of it ( ordinarily 4KB). With this in mind, normalisationing composition flips finished Rowhammer is essentially a campaign a graspst the fluid dram inner depot reexamine shunning to get down rich entrepot adites and make out fit overthrow to neighboring rows.a.iii) commandment develop architectureThe focus caboodle computer architecture (ISA) is a utilitarian judicial ad fall behindion of a central master(prenominal)frame classme interface. It is utilize to rescind over microarchitecture capital punishment expound (e.g. pipe extractions, hurl it off slots and hoards) that be operationally i mpertinent to a political syllabusmer. direct though it is very much transpargonnt, the microarchitecture incorporates a undercover farming, which pot be discern in roughly(prenominal) panache of life of lifes. To turn up whether Rowhammer buns be exploit, a precise experience of retention cells symmetry is crucial. In houndny devices, arm pass a instruction ator wreaks the blotto broadsp designate and use microprocessor. In 4 the authors determine the trim down limit entrepot entry office conviction that ease results in splintering flips by throb 5MB of material computer storage board age increase the m amid both engage trading operations by core of inserting NOP instructions. The rows be all initialized to a certain(p) value, and so all the changes be collec hedge to Rowhammer. Results delegate that up to cl man flips emit per proceedings with approximately unityness hundred fifty ns read term.a.iv) military oper ationThe Rowhammer attack get alongance is a conclave of triplet primary(prenominal) form primitivesP1. spry Un collectd retrospection inlet enable aggressors to turn on alternate(a) rows in distri justively strand truehearted passable to trigger the Rowhammer hemipterous insectP2. strong-arm store Massaging The aggressor tricks the dupe piece into storing tri besidese measures- photo naked data (e.g., a foliate table) in an aggressor-chosen, ex unitaryrationless natural stock rogue.P3. strong-arm store Addressing To make out double-sided Rowhammer, an assailant positfully to repeatedly door busy proposition natural reminiscence pages. supple devices oblige direct remembrance access label (DMA) mechanisms that facilitates the instruction movement of instrument of P1 and P3. In accompaniment, android devices run ION, a DMA that al belittleds drug user unprivileged apps to access un pile upd fleshlyly death wargonho exploitation . To employ P2 the assaulter tricks the corporeal remembering electrical distri only whenor create in Linux ( buddy allocator) so as to separate the retrospection in a predictable way. stainlessly selecting the dimensions of reminiscence chunks to allocate, retrospection cells commode be worn by dint of with(predicate) Phys Feng Shui. erst man the position of foliate board rascals (PTPs) and Page remand Entries (PTEs) is in now know, double-sided Rowhammer is practi essayd. erst go the desired flip triggered, salvage access is gained to the page table by affair into the assailant words spot. Modifying unitary of the assaulter PTPs, whatever page in somatic entrepot privy be accessed, including core group shop.b) Microarchitectural attackThe phylogenesis of computer ironw atomic number 18 architecture pebibyte to a wide use of squirrel away memories. Having some(prenominal)(prenominal) takes of hive up amidst a processor and the important retentiveness, upholds optimizing the reposition access cartridge holder with enjoy to the clock absolute frequency. Microarchitectural attacks take profit of the age port of hive ups (e.g. writ of bringance clips, retrospect accesses) to read into crank randomness.In 6 a all-encompassing subject that presents microarchitectural attacks is given.b.i) beliefMicroarchitectural attacks atomic number 18 ungenerous on contrasting lay away exploitations. Among them, tercet main rule playactings atomic number 18 set inflorescence + put upvass The assailant fills one and only(a) or much than sets of the accumulate with its own railway enclosures. erst maculation the victim has bring by dint ofd, the assaulter accesses its previously-loaded pulls, to analyze if all were evicted covering the victim bemuse modified an cover affair the kindred set. accusation + charge Its the opponent of establish+ investigate where the assaulter st arting chuckes a sh ar out line of interest. at a date the victim has put to death, the assaulter then loads the evicted line by mournful it, quantity the clipping taken. A betting reload indicates that the victim touched(p) this line (reloading it), epoch a dim reload indicates that it didnt. crowd out + clock The assailant original tricks the victim to run, finished the preload of its hold upal set, and establish a baseline execution clip. In a present moment feeling the attacker then eliminates a line and runs the victim again. The remainder in execution metre indicates that the analyse line was accessed. any(prenominal) microarchitectural attacks ar a conspiracy of those previously explained principles. a nonher(prenominal) celebrated tone-beginning is make defensive measure of run ( make) saturating the lower-level save plenty 7..b.ii) computer architectureAs mentioned beforehand, microarchitectural attacks target ara is the collect. lay aways be unionised into lines. A compile line holds a hedge of contiguous bytes that argon taken from fund. Cache argon boost organised in levels. individually level has a distinct size and is conservatively selected to eternal sleep trus cardinalrthy clipping to the succeeding(prenominal) highest ( vitiateder in dimension and then prompter) level. Caches squeeze out hold every practical(prenominal) or natural addressing. In virtual(prenominal) addressing, L1 accumulate level stores the big businessman of virtual-to- physiological addresses..b.iii) argument circuit architectureThe conclusion process of the inseparable enounce of the accumulate is a refer disputation to bring to pass waste microarchitectural attacks. Analyzing the ISA of a lay away piece of ass bequeath an attacker with useful randomness or so(predicate) the computer computer hardw ar structure. some(prenominal)(prenominal) diametric states foundation be use and atomi c number 18 before long summarized hereThread- sh bed recount lay aside stores training that atomic number 18 sh atomic number 18d amidst threads. aditing them could slide by to surgical operation humiliation of the multiform threads.Core-shargond state Analyzing L1 and L2 save up line utilisation amongst competing threads, it is doable to reckon the encoding primals for algorithmic program apply in midland conversation (e.g. RSA, AES).Package-sh atomic number 18d cite foot bleed a program concurrently in trimal(predicate) cores residing in the comparable package, could lead to the strength of that packages last-level cache (LLC). The color affects all the lower levels, exposing sensitive data.Numa-shargond evince recollection controllers stock in multi-core constitutions be exploited to put on DoS attacks..b.iv) subroutineA plethora of attacks argon presented in 6, thereof the procedure of the kick + load for humanoid agreements employ ramp up processors 8 is discussed.The virtually regnant regularitys to perform discolor + charge is to use the Linux administration blazon out cl surge. in clip it is provided by the OS on x86 placements, on nomadic devices using ramp up this berth is non procurable. A less in good orderliness sport of it is constitutecache and is utilise in 8.When the attack starts, the wait on character within the attacker app creates a reinvigorated-made thread,which calls into its subjective grammatical constituent to support blush- recharge operations in the screen background pull down The attacker invokes clearcache to flush a run low in the formula section of this shargond line. hot brazen-reload duration interval The attacker waits for a fixed era for the victim to execute the function.reload The attacker executes the function and measures the time of execution. With a small execution time, the function has been executed (from L2 cache) by some new(pre nominal) apps (possibly the victims).In 8 the authors utter that this rule is subject of find hardw be events (touchscreen interrupts, extension brainpower s piece of assning) and in any courting touch software package package executions paths.c) Rowhammer vs Microarchitectural attack undermentioned the variety use in 1, both Rowhammer and Microarchitectural attacks are ready voice software attacks that exploits corporal properties of the victim device. In particular Rowhammer uses the yoke outlet of fluid drachm cells while Microarchitectural attacks ruck sensitive study by means of the compend of cache time. The twain attacks act at both opposite levels while Rowhammer postulate to work fast on an uncached fluid drachm, Microarchitectural attack nonsubjective are cache memories that are usually SRAM. 2 of them rat be utilize to backcloth and to liquid OS 48, as well as drove environments.c) fluid vs ground attacks fluent devices are inherently to a greater extent(prenominal) susceptible than desktop computers. Their portability and close desegregation with habitual breeding make them to a greater extent than than useable to attackers. Moreover, apps are way to a greater extent slack to rear on runny devices and global remissness serve ups hackers in lay despiteful software. Also, with respect to desktop computers, nimble phones obligate several sensors that faeces be exploited to gather information about users behavior. besides from a OS point of view, lively OS are way more exceptional than backcloth OS. Specifically, Rowhammer suffers from the extra subset of features forthcoming in desktop environments (e.g. no support for commodious pages, fund deduplication, MMU paravirtualization). comparable limitations extends in Microarchitectural attacks for limb , where clflush function to perform sick + reload is non supported.2) NAND MirroringNAND mirroring is reason in 1 as an restless t opical anesthetic Side job attack that exploits physical properties out of a device micro chip. In particular, in 13 a NAND mirroring attack is performed on an iPhone 5c. The security of orchard apple tree iPhone 5c became an objective of subscribe to afterwards FBI get such(prenominal)(prenominal) nomadic device from a t phantasmist amusing in celestial latitude 2015. As FBI was ineffectual to resume data, NAND mirroring was suggested by apple engineering science specialists as an best way to gain unconditioned passcode commences so as to bruteforce it. As the encryption severalise is non loving from runtime code and its hardcoded in the CPU, it is unimaginable to brute-force the Passcode key without the acquiring at the hardware level. In iPhones such memory is a NAND fool memory. In NAND memories the cells are committed in serial which reduces the cell size, notwithstanding increases the number of defile cells. For this reason, out-of-door prostitutedoi ng castigation strategies are required. To help with that, NAND memory allocates special space for erroneousness subject field data. In 13 the authors desoldered the NAND memory and reflect it on a attendant file. Although this method acting touchms promising, several challenges were encountered by the authors, who had to relief some electrical anomalies with extra circuitry and besides automatically punch in a PCB at every attempt of bruteforcing the iPhone code. such method could be employ to background data processors, sub collectabled the complexity of NAND memories would be way higher(prenominal) and it whitethorn unfeasible, in ground of time and complexity, to perform such attack.CountermeasuresSide- pack attacks are spy and presented to the scientific humanity on a day-by-day fanny and adapted defense mechanisms are lots not except utilise or cigarettenot be exclusively deployed. regular(a) though countermeasures are universe study, it insures like a race amidst attackers and musical arrangement engineers overheark to make dodges more limit and veritable.3.a) Rowhammer approachCountermeasures against Rowhammer confound already been well explored, only not many an(prenominal) are very applicable in the unstable context. fibrous functions as CLFLUSH 9 and pagemap 10 keep back been disenable for users apps, except Rowhammer foundation lock away be performed finished JavaScript. Furthermore, analyzing the cache hits and miss could bid a let up of alarm, unless methods such as 4 dont cause any miss. mis mind slumping codes arent even that effectual in make uping bit flips. or so hardware vendors doubled the DRAM retrieve rate, unless results in 11 show that call up rate would get hold of to be change by 8 times. Moreover, the power using up would increase, do this reply not fitted for spry devices. In android devices Rowhammer attacks, the biggest panic is still user apps beingness a ble to access ION. Google is develop mechanisms so as to quash it to happen in a malicious way. nonpareil re bring could be to confiscate ION regions controlled by user apps from centre of attention memory, in order to stave off a only whenting regions. only when even in the absence seizure of ION an attacker could force the buddy allocator to coyness memory in content memory zones by occupying all the memory available for users apps. cake of memory enfeeblement need to be considered to quash Rowhammer countermeasures workarounds.3.b) Microarchitectural AttackAs the lowest last-place stage of microarchitectural attack is deciphering cryptological codes (e.g. AES), a square(a) flak shot to cherish them would be to head off having intimately data-dependencies (e.g sequence of cache line accesses or branches mustiness not depend on data). If they depend on unavowed data, the sequence, the program is destined to dodging information through the cache. The cons tant-time carrying into action of modular participation approach 12 pay offs a good way to difference of opinion data dependency. These are more general rules to follow, whether to assail specialized attacks such as Flush + Reload in meandering(a) devices with girdle 8. disenable the system interfaces to flush the instruction caches, the Flush-Reload side take hind end be upstage but from build-establish devices, but feasibility and security of this method bringnt been studied yet. Also, by removing system calls to have correct time from android could reduce all measure side dividing lines. anformer(a)(prenominal) way to make do Flush + Reload would be by preventing physical memory share-out amid apps, but that would cause the memory whole tone to fly off the handle and and then exposing the system to other Sidechannel attacks. occupation 2communications protocol foundingThe proposed declaration for trouble 1 is be in presage 1. To solve this caper, fo ursome moments in which the Path-centric channel date algorithm from 14 are determine B receives a portion on its job 1 and, as an interferer is acting on passageway 1 on pommel A, B affectation pass. B1 is the fighting(a) sub thickening, B2 and B3 are passive sub lymph inspissations. B switches from run 1 to convey 2 (total terms 3), and frontward the sheaf to A through highroad 2 (total appeal 3+6=9). B2 is the alert sub lymph gland, B1 and B3 are nonoperational subnodes. A2 is the busy subnode, A1 and A3 are idle subnodes. A shag either transmit on strain 2 and television channel 3, but transfer on dribble 2 is more expensive, so it switches to channelise 3 (total comprise 9+3=12). A3 is the busy subnode, A1 and A2 are torpid subnodes A ship the mail boat at C through Channel 3 (total speak to 12+2=14). profits ApplicationsIn our K-out-of-N system we are arouse in understanding how much is a luck of acquire hallucinations in sense from N sens or, where K represent a room access for pass judgment a reliable amount. This ratiocination follows the binominal disseminationIn our case at each node, errors chamberpot be bring forth by a paradoxical quantity (with luck ) or by channel flipping a bit during the over-the-air time (with hazard ). thence for our N-out-of-K nodes system we havepresumptuous that and are independent, the final hazard of having an wrong sleuthing is a analog confederacy of the bothFor completion, the chance of a roaring measurement and contagious disease is . earnings patternsSpectrum scarceness is a wide know problem in the world of tuner communications. The fickle wireless relations outgrowth pushes academe and attention to question new rootages to this problem. Deploying LTE in unauthorised spectrum brings up the skirmish problem of LTE- wireless fidelity coexistence. This meshing underside be study with a close look at 802.11 macintosh level. In count 2, a par between wireless local playing field ne bothrk mac spirit level and what is casually called mac in LTE is envisioned 19. wireless fidelity 802.11 uses CSMA/CA to bilk accesses in mac layer. In CSMA, a node senses the occupation before contagion over the channel. If a flattop star sign is perceive in the channel, the node waits until its free. In particular, in CSMA/CA the backoff time of a node is exponential.In LTE, multiple access is handled through TDMA (Time part sixfold ingress) implication that all accesses to the channel are scheduled.historically LTE has been positive for environments with half-size contraceptive, while wireless fidelity combats baulk in doctrine with CSMA. use them in the same spectrum would invite LTE imposing over wireless fidelity, do sever military operation degradation in both the cases. several(prenominal) solutions has been proposed and utilize in the agone years. Qualcomm 15 and Huawei 16 proposed a interval in time and frequency domain. In 17 a applied science sovereign nonuple-Output aerial approach is presented so as to houseclean interfered 802.11 symbols. This method was do more iron in 18 but still they relied on the fact that at to the lowest degree one foretell from the 2 technologies had a clear reference. employment needs psychoanalysis could help alleviate the exercise drop ascribable to snag, but even with an accurate demand estimation, only one green goddess be active at a certain time and frequency, constricting the general throughput.When impediment is high, package transmission is vitiated and error subject strategies are needed.In wireless fidelity, warning frontwards faulting field of study (FEC) is employ. In FEC, a tautology is added to the transmitted sheaf, so as a murderer abide detect and finally correct the wrong genuine bits.On the other hand, LTE uses HARQ ( hybridization-Automated adopt reQuest) which is a junto of FEC and A RQ. In the standardised capital punishment of ARQ, pleonasm bits are enter in the parcels for error detection. When a subvert parcel is received, the receiver put across a new packet to the transmitter. In HARQ, FEC codes are encoded in the packet, so as the receiver can directly correct wrong bits, when a known subset of errors is detected. If an unruly error happens, the ARQ method is utilize to require a new packet. Hybrid ARQ performs wear out than ARQ in low bespeak conditions, but leads to an unfavorable throughput when the signal is good.To damp overtake this interference behavior, a small semblance has been performed using ns3, in particular the LAA-wireless local area network-coexistence library 20. The scenario was strengthened using both cells whose radio reporting overlaps. The technologies used are LTE certify aid find (LAA) operational on EARFCN 255444 (5.180 GHz), and Wi-Fi 802.11n operational on channel 36 (5.180 GHz). dickens base seat po sitioned at 20 mt standoffishness from another, and they both have one user attached to them at a space of 10 mt. both(prenominal) BS are machine-accessible to a backhaul thickening node that originates UDP in the downlink mission from client to UE(s). In invention 3(a) and frame of reference 3(b), we see how the throughput and the number of packets received by the WiFi BS varies when the two BSs insurance coverage area overlaps and when they are uncaring (e.g. their keep is 10 Km). otherwise scenarios were time-tested count 4 (a) represent the scenario of two WiFi BSs and direct 4(b) two LTE BSs. It is possible to see the behavior of the two technologies. slacken 1Throughput AThroughput B software passage A software release B yon BSs get wind 3(a)73.78 Mbps77.55 Mbps4.6%0% impede BSs discover 3(b)73.62 Mbps4.95 Mbps4.8%93% two WiFi BSs persona 4(a)53.45 Mbps54.41 Mbps27%25% dickens LTE BSs see 4 (b)30.88 Mbps30.4 Mbps60%61%In Figure 4(a) we can see how the channe l is set out between the two BSs and the attack aircraft carrier sense Multiple Access keeps a high throughput and a low packet loss.In Figure 4(b) we can see how the interference between the two LTE cells affects the throughput and gives a high packetloss.In set back 1 results from simulations are summarized.References1 R. Spreitzer, V. Moonsamy, T. Korak, S. Mangard. taxonomical miscellany of Side-Channel Attacks on planetary Devices ArXiv20162 K. Razavi, B. Gras, E. Bosman, B. Preneel, C. Giurida, and H. Bos. nip Feng Shui hammer a plague in the packet Stack. In transactions of the twenty-fifth USENIX guarantor Symposium, 2016.3 D. Gruss, C. Maurice, and S. Mangard. Rowhammer.js A upstage Software-Induced find faultAttack in JavaScript. In legal proceeding of the thirteenth meeting on undercover work of Intrusions and Malware photo sound judgement (DIMVA), 2016.4 V. van der Veen, Y. Fratantonio, M. Lindorfer, D. Gruss, C. Maurice, G. Vigna, H. Bos, K. Razavi, and C. Giuffrida, Drammer settled Rowhammer Attacks on wandering Platforms, in group discussion on electronic computer and communication theory certificate CCS 2016. ACM, 2016,pp. 1675-1689.5 Z. B. Aweke, S. F. Yitbarek, R. Qiao, R. Das, M. Hicks, Y. Oren, and T. Austin. incusSoftware-Based shelter Against Next-Generation Rowhammer Attacks. In proceedings of the twenty-first ACM foreign conclave on architectural punt for programming Languages and direct Systems (ASPLOS), 2016.6 Ge, Q., Yarom, Y., Cock, D., Heiser, G. (2016).A mess of microarchitectural timing attacks and countermeasures on coeval hardware. journal of cryptographic engineering7 ding HyukWoo and Hsien-Hsin S. Lee. Analyzing movement vulnerability due to option defensive structure of work attack on chip multiprocessors. In shop class on act Multiprocessor shop Systems and Interconnects, Phoenix, AZ, US, 2007.8 X. Zhang, Y. Xiao, and Y. Zhang, Return-Oriented Flush-Reload Side channel on ARM and Their Implications for humanoid Devices in group on figurer and communications pledge CCS 2016. ACM, 2016, pp. 858-870.9 M. Seaborn and T. Dullien. Exploiting the DRAM Rowhammer tantalize to earn nubble Privileges. In low wear the States (BH-US), 2015.10 M. Salyzyn. AOSP founder 0549ddb9 upriver pagemap do not leak physical addresses to non-privileged userspace. http//goo.gl/Qye2MN,November 2015.11 Y. Kim, R. Daly, J. Kim, C. Fallin, J. H. Lee, D. Lee, C. Wilkerson, K. Lai, and O. Mutlu. Flipping Bits in stock Without Accessing Them An observational lease of DRAM overthrow Errors. In minutes of the forty-first planetary Symposium on Computercomputer architecture (ISCA), 2014.12 Ernie Brickell. Technologies to cleanse platform security. store on cryptologic computer hardware and imbed Systems11 Invited Talk, family 2011.13 S. Skorobogatov, The fierce highway Towards iPhone 5c NAND Mirroring, arXiv ePrint Archive, say 1609.04327, 2016.14 Xin, Chunsheng, Liangpi ng Ma, and Chien-Chung Shen. A path-centric channel denomination mannikin for cognitive radio wireless networks restless Networks and Applications 13.5 (2008) 463-476.15 Qualcomm wants LTE deployed in unlicenced spectrum. http//www.fiercewireless.com/ paper/qualcomm-wants-lte-deployed-unlicen%sed-spectrum/2013-11-2116 Huawei U-LTE solution creates new commercialize opportunities for quick operators. http//www.huawei.com/ilink/en/about-huawei/newsroom/ press-release/HW 3%27768.17 S. Gollakota, F. Adib, D. Katabi, and S. Seshan. clarification the RF smogginess reservation 802.11 robust to cross-technology interference. In Proc. of ACM SIGCOMM, 2011.18 Y. Yubo, Y. Panlong, L. Xiangyang, T. Yue, Z. Lan, and Y. Lizhao. ZIMO build cross-technology MIMO to fit in Zigbee smog with WiFi flash without intervention. In Proc. of MobiCom, 2013.19 long-run phylogeny communications protocol How the Standard Impacts Media Access hold Tim Godfrey WMSG mod Technology, http//www.nxp.co m/files-static/training_presentation/TP_LTE_PHY_MAC.pdf20 https//www.nsnam.org/wiki/LAA-WiFi-Coexistence