††thanks: These authors contributed equally to this work††thanks: These
authors contributed equally to this work

# High-sensitivity multichannel zero-to-ultralow field NMR with atomic
magnetometer arrays

Blake Andrews  Department of Chemistry, University of California, Berkeley,
Berkeley, CA 94720, USA.  Matthew Lai  Department of Chemistry, University of
California, Berkeley, Berkeley, CA 94720, USA.  Zhen Wang  Department of
Chemistry, University of California, Berkeley, Berkeley, CA 94720, USA.
Norihisa Kato  Hamamatsu Photonics, Sunayama-cho, Chuo-ku, Hamamatsu City,
Shizuoka Pref., 430-8587, Japan.  Michael Tayler  ICFO– Institut de Ciències
Fotòniques, The Barcelona Institute of Science and Technology, 08860
Castelldefels (Barcelona), Spain  Emanuel Druga  Department of Chemistry,
University of California, Berkeley, Berkeley, CA 94720, USA.  Ashok Ajoy
<EMAIL_ADDRESS>Department of Chemistry, University of California,
Berkeley, Berkeley, CA 94720, USA.  Chemical Sciences Division, Lawrence
Berkeley National Laboratory, Berkeley, CA 94720, USA.  CIFAR Azrieli Global
Scholars Program, 661 University Ave, Toronto, ON M5G 1M1, Canada.

###### Abstract

Despite its versatility and high chemical specificity, conventional NMR
spectroscopy is limited in measurement throughput due to the need for high-
homogeneity magnetic fields, necessitating sequential sample analysis, and
bulky devices. Here, we propose a multichannel NMR device that overcomes these
limitations that leverages the zero-to-ultralow field (ZULF) regime, where
simultaneous detection of multiple samples is carried out via an array of
compact optically pumped magnetometers (OPMs). A magnetic field is used only
for pre-polarization, permitting the use of large-bore, high-field,
inhomogeneous magnets that can accommodate many samples concurrently. Through
systematic advances, we demonstrate high-sensitivity, high-resolution ZULF NMR
spectroscopy with sensitivity comparable to benchtop NMR systems. The
spectroscopy remains robust without the need for field shimming for periods on
the order of weeks. We show the detection of ZULF NMR signals from organic
molecules without isotopic enrichment, and demonstrate the parallelized
detection of three distinct samples simultaneously as a proof-of-concept, with
the potential to scale further to over 100 channels at a cost comparable to
high-resolution liquid state NMR systems. This work sets the stage for using
multichannel “NMR camera” devices for inline reaction monitoring, robotic
chemistry, quality control, and high-throughput assays.

##  I Introduction

Nuclear Magnetic Resonance (NMR) spectroscopy is a key tool in chemical
analysis due to its ability to examine chemical kinetics and molecular bonding
non-invasively, and with high specificity [1, 2]. However, conventional NMR
spectroscopy is expensive and limited in chemical throughput, primarily due to
the need for highly homogeneous superconducting magnets. The stringent
requirements for magnetic field homogeneity (typically at <10ppb level [3])
engender small “sweet spots” (${<}$5cm3) where samples must be placed
sequentially for analysis. Additionally, the need for spatiotemporal
homogeneity makes the magnets bulky, and necessitates involved strategies for
shimming and deuterium field lock [4]. These limitations are particularly
problematic in emerging fields like robotic chemical synthesis and
combinatorial screening [5, 6, 7], where there is a critical need for in-line
monitoring tools to support continuous AI-driven reaction optimization, but
for which NMR is currently less well-suited.

In this work, we aim to break the throughput limit by proposing an alternative
strategy for parallelized NMR spectroscopy that exploits the zero-to-ultra-low
field (ZULF) regime. Here, NMR detection is carried out in a magnetically
shielded environment, while a magnet is solely used for pre-polarization. As a
result, the magnetic field homogeneity requirements are completely relaxed.
The ZULF NMR spectra are dominated by scalar J-couplings, and for one-
dimensional spectra of small molecular systems, the spectra can be as
informative and chemically specific as traditional high-field (HF) NMR [8, 9].
Detection is carried out by compact, commercially available optically pumped
magnetometer (OPM) devices [10], and the lifting of homogeneity requirements
means that one can arrange for an array of detectors to discern NMR spectra
from multiple samples simultaneously. Additionally, the magnets used for
sample pre-polarization can be inhomogeneous, and accommodate a large number
of samples concurrently. We demonstrate the first proof of concept of this
vision (Fig. 1).

A significant barrier for ZULF NMR has been its relatively low
sensitivity—often at least two orders of magnitude worse than benchtop NMR
spectroscopy — diminishing its appeal despite its advantages. Here, through a
series of technical improvements, we demonstrate the ability to address this
challenge, for the first time, showing high signal-to-noise ratio (SNR)
spectroscopy matching the ${}^{13}\textrm{C}$ NMR sensitivity of a commerical
1.9T system. Our approach exploits pre-polarization with a large-bore
(inhomogeneous) superconducting magnet, while implementing several methods to
combat experimental noise. Notably, our approach supports high-resolution
spectroscopy with the complete absence of shimming or OPM re-calibration for
extended periods on the order of weeks.

Leveraging these advances, we report the first ZULF NMR spectra of organic
molecules at natural ${}^{13}\textrm{C}$ isotopic abundance without
hyperpolarization. We demonstrate parallelized detection of three distinct
samples simultaneously as a proof-of-concept; however, we estimate the ability
to scale to ${>}$100 channels with comparable cost to a high-resolution liquid
state NMR system (see SI Sec. II [11]).

Fig. 1: High-sensitivity, multichannel, ZULF NMR system. (A) Concept.
Instrument consists of a high-field, inhomogeneous, pre-polarization magnet
here at $B_{0}{=}9.4$T, along $\hat{\textbf{x}}$. The magnet is shielded,
horizontally oriented, and hosts a large bore (11cm diameter). ZF NMR
detection is carried out with an array of OPMs in a mu-metal shielded region.
Samples are mechanically shuttled between HF prepolarization and ZF detection
centers, separated by a ${\approx}$1.55m travel distance, in ${<}$1s. (B)
Schematic of sample placement in (i) HF center for prepolarization, where
magnet inhomogenity plays insignificant role; and (ii) ZF center, where
samples are probed non-invasively by an array of OPMs. We estimate ${>}$100
samples can be accommodated at the HF and ZF regions (see SI Sec. II [11]).
(C) OPM operation for ZF NMR detection is schematically represented (see Ref
[12]). OPMs are compact (dimensions marked), allowing for arrayed operation
(see Fig. 5). (D) Photograph of assembled instrument. See SI Sec. I [11] for
discussion on device construction and additional photographs. Coordinate axes
(marked) highlight connection between the different panels.

##  II Experimental Design

Fig. 1A shows a conceptual depiction of the multichannel NMR device, employing
an inexpensive, inhomogeneous, $B_{0}{=}9.4$T horizontal-bore magnet for pre-
polarization, positioned adjacent to a mu-metal magnetic shield for NMR
measurements in the ZULF regime, or alternately, the zero-field (ZF) regime.
The superconducting magnet enables higher pre-polarization fields compared to
previous experiments in the literature, enhancing ZF NMR signal strength.
Inner shielding in the magnet allows a small separation between the HF and ZF
centers (${\sim}$1.55m center-to-center) despite heightened fringe fields in
the horizontal configuration. In operation, the samples are “shuttled” between
both centers by a high-speed motor driven belt actuator in <1s; in practice, a
solenoid “guiding field” (GF1) provides a switchable weak field over the path
adjoining the centers (see Fig. 2A, SI Sec. I [11]). Since detection occurs at
the ZF center, magnet inhomogeneity manifests as negligible variations in
overall ZF NMR signal intensity without affecting spectral resolution,
effectively subverting the otherwise usual line-broadening effects stemming
from inhomogeneity. Hence, the apparatus can tolerate magnets with
inhomogeneities as large as a few percent. This permits using cost-effective
high-field magnets that host large-bores. In our device, for instance, the
magnet can accommodate a rack of >100 sample NMR tubes simultaneously; this
concept is schematically depicted in Fig. 1B (i).

Since homogeneity considerations are comparably trivial to handle at zero-
field, the ZF chamber can be made spacious enough to accommodate a similarly
large number of samples at low cost (Fig. 1A). Tunable low fields can can be
created within it; allowing us to access both the ZF and ultra-low-field (ULF)
regimes [13]. Key to multichannel operation in our work is conducting NMR
measurements through an array of commercially available OPMs (QuSpin [14]),
schematically shown in Fig. 1B (ii) as a concept, placed in proximity to the
intially prepolarized NMR tube rack. Such arrayed detection exploits the
compact form factor of the OPMs (Fig. 1C(i)), which can detect NMR signals at
a relatively high standoff (${>}$5mm).

For clarity, Fig. 1C shows a schematic operation of one of the OPMs from the
array [15]. An integrated laser optically polarizes Rb atoms in a vapor cell
within the unit as seen in Fig. 1C (i). Transmission of the light through the
vapor cell is measured in the presence of a weak, localized oscillating
transverse magnetic field (<100 nT, ${\sim}$1kHz). The quadrature demodulation
signal is proportional to the background field component along the modulation
axis, allowing sensitive measurement of fields from the ensemble of analyte
nuclei in the sample container. Alternatively, one can envision configurations
using a single cell excited by an array of laser beams instead of discrete OPM
units [16].

Fig. 1D shows a photograph of the assembled device implementing a proof-of-
concept of the vision in Fig. 1A. Pictured is the horizontal magnet and ZF
center (see also Fig. 5B). More details of device construction and photographs
are provided in SI Sec. I [11].

Fig. 2: Robust, high SNR, ZF NMR via inhomogenous field polarization. (A)
Experiment schematic. Sample is prepolarized in the inhomogenous
$B_{0}{=}9.4$T field for $t_{\textrm{pol}}$ (19s for formic acid) before
moving through the first guiding field (GF1) solenoid (80$\upmu$T) along the
shuttling path for the duration of travel in (${\approx}0.9$s). Before GF1 is
adiabatically turned off over 30ms, a 1$\upmu$T second guiding field (GF2) is
preemptively turned on uniformly throughout the shield. When the sample
arrives, GF2 is suddenly turned off immediately before acquisition, which
proceeds for $t_{\textrm{acq}}{\sim}T_{2}^{*}$. (B) High SNR spectroscopy.
Panel shows ZF-NMR spectrum of enriched formic acid over 20 scans with
$t_{\textrm{acq}}{=}11$s in (i) linear and (ii) logarithmic scales.
Characteristic peak at $J_{\textrm{CH}}{=}222.1$Hz is visible. Single shot
SNR${=}1250$, calculated from the spectral wing (shaded). (C) High-resolution
ZF NMR of enriched benzaldehyde with $t_{\textrm{acq}}{=}30$s shown over 200
scans. Phase correction and baseline subtraction is applied. Inset (i): Zoom
in shows sub-hertz, $T_{2}^{*}$ limited linewidths. (D) Long-time robust ZF
NMR. Spectral FWHM of enriched formic acid (inset) is used as a reporter of
temporal stability over 256hrs (${\approx}10.67$days). No shimming,
calibration, or field compensation is applied during the entire period.
Linewidths ($T_{2}^{*}$ limited) remain stable at 0.144Hz to within error, and
are reported as an average of 128 scans (dashed line). Error bar: linewidth
standard deviation over 128 scans. (E) Ultra-low-field NMR here conducted on
water at (i) 12nT and (ii) 244nT. Panel shows single-shot free induction
decays with (iii) high one-shot SNR value ${=}4200$ at 244nT. All samples were
prepared and measured under ambient atmospheric conditions (no deoxygenation)
in a standard 5mm NMR tubes.  Fig. 3: ZF NMR at natural ${}^{13}\textrm{C}$
abundance in organic molecules. (A) SNR comparison. Spectra corresponding to
${}^{13}\textrm{C}$ enriched and natural abundance (NA)
(1.1%${}^{13}\textrm{C}$) (turquoise, blue respectively) of formic acid
plotted on a logarithmic scale (10 scans each). NA signal is 100 times weaker,
but discernible. (B) ZF spectrum of NA methanol (497 scans) in a neat solution
shown in two windows centered at 140Hz and 280Hz. Lorentzian fits for formic
acid and methanol are in purple. (C) ZF spectrum of NA benzene in a neat
solution, taken over 1436 scans. (i) Experimental in orange with (ii)
simulated data below in dark blue. (D) (i) NA formic acid ZF spectra taken
with varying number of scans $N$ and (ii) SNR plotted against $\sqrt{N}$. SNR
${=}175$ after 169 scans. Fig. 4: SNR comparison with benchtop HF NMR. (A) ZF
and HF NMR spectrum of NA formic acid, showing complementary features of
J-couplings and chemical shifts. (B) SNR comparison between our apparatus and
various 13C NMR experiments done on a Spinsolve 80 Carbon (${\sim}1.9$T
detection field). Top to bottom: ZF-NMR via our apparatus, 13C NMR, 13C NMR
with NOE enhancement, 13C NMR with proton decoupling, and 13C with NOE
enhancement and proton decoupling. SNR is reported over 8 scans, while error
bars are calculated over 30 repetitions of such experiments. Fig. 5:
Multichannel ZF NMR via inhomogenous field prepolarization. (A) Simultaneous
ZF NMR spectra taken from three separate OPM channels, showing measurement of
three distinct 13C enriched chemical samples: (i) methanol (dark blue), (ii)
formic acid (purple), and (iii) benzaldehyde (orange). (B) Inset (i):
Photograph of multichannel setup showing sideview of OPM arrangement. Main
panel: Schematic of top-view of OPM arrangement, arranged in a linear fashion,
separated by 5.4mm. Three samples are color-coded. Coordinate axes,
corresponding to Fig. 1 shown for clarity. (C) Simultaneously acquired FIDs of
the three samples. Digital bandpass filters employed (top to bottom):
120-300Hz, 221-225Hz, 150-200Hz. (D) Measurement of OPM crosstalk. (i-ii)
Pictorial representation of OPM separation $d$ defining the edge-to-edge
distance between sensors. Sample of 13C enriched formic acid is placed in
front of one OPM; cross-talk quantifies extent of signal sensed by the
adjacent OPM. (E) OPM crosstalk calculated as ratio of baseline corrected peak
heights expressed as a percentage plotted against separation for two adjacent
OPMs. Inset (i): example spectra measured by the OPM directly front of sample
(left) and the one adjacent to it (right). Here $d{=}20.4$mm.

Fig. 2A displays a schematic of the experimental sequence. Coordinate axes
show orientations of the applied fields, OPM and sample for clarity (see also
Fig. 1). Samples are initially polarized using the $B_{0}{=}9.4$T magnet for
$t_{\textrm{pol}}$=3-5 times $T_{1}$ (${\sim}$19s for formic acid), followed
by transfer through the magnet fringe field along the GF1 solenoid energized
at 80$\upmu$T, collinear with $B_{0}$ (here $\hat{\textbf{x}}$). Adiabatic
turn-off of this field then transitions the sample to a secondary guiding
field (GF2) within the ZF center at 1$\upmu$T, that is preemptively activated
to reorient nuclear spins along the OPM sensitive axis (here
-$\hat{\textbf{y}}$). GF2 is subsequently rapidly turned off, prompting a
nonadiabatic transition to ZF and initiating spin dynamics that generate the
ZF NMR signal, captured by the OPM. Inset in Fig. 2A details the orientations
GF1,2 relative to the OPM and sample. The entire field-switching protocol is
driven using a low-cost, compact, controller (NMRduino [17]), equipped with
high-current driver chips (DRV8838 and TB6612FNG for analog and digital
channels respectively) and a LTC1859 chip for signal acquisition.

While the sequence in Fig. 2A itself follows prior work [18, 19], we include
several innovations in the device to enable high-SNR multichannel operation
(see SI Sec. I, III [11]). The shuttling stage and motor are placed at the
opposite end of the $B_{0}{=}9.4$T magnet, distancing them from the ZF center
to mitigate electronic noise and vibration. GF1,2 coils, OPMs, and all control
electronics operate on battery power to further reduce interference. Vibration
is minimized by mounting the ZF center on Sorbothane vibration-dampening feet
and using a flexible carbon fiber rod to support the samples during shuttling
(see SI Sec. I [11]). Finally, we adopt a “pulse-free” technique that does not
require a DC pulse to initiate the free induction decay (FID). This removes
the need for pulsing coils within the ZF center, simplifying multichannel
operations (see Fig. 5) by applying GFs uniformly throughout the shuttling
path and shield, effectively manipulating all chemical samples in an identical
manner. This additionally decreases the risk of magnetizing the shield through
strong pulses, ultimately leading to highly robust operation on the order of
weeks (Fig. 2D). We found the removal of these pulsing coils also reduced
background noise close to the sensor, contributing to the high SNR.

Fig. 2B illustrates the outcomes of these instrumentation advances, initially
focusing on a single channel. Using 13C enriched formic acid, a common
benchmark used for J-spectroscopy at ZF, we achieve a single-shot SNR of
${\sim}$1250, presented on both linear (Fig. 2B (i)) and logarthmic scales
(Fig. 2B(ii)). The sole visible peak is at the
${}^{13}\textrm{C}{\text{-}}{}^{1}\textrm{H}$ J-coupling value of 222.1Hz. To
our knowledge, this SNR is the highest reported in the literature and is
achieved here for an off-the-shelf sample without sample deoxygenation [8, 10,
9]. Fig. 2B(i) also shows the spectrum is also notably free from spectral
contamination, including line and motor noise. Fig. 2C displays the spectrum
from a more complex sample, singly labeled 13C benzaldehyde. The main panel
displays a broad frequency range, once again emphasizing high SNR and spectral
purity, which matches previous reports but with minimal scans and sample
preparation. Inset Fig. 2C(i)) zooms into the relavant window near 175Hz,
showing distinct J-spectral features [9], with a $T_{2}^{*}$ limited linewidth
<0.2Hz.

A feature of our instrument is its robust temporal stability, highlighted in
Fig. 2D. Here continuous ZF NMR measurements on enriched 13C-formic acid
reveal a stable, $T_{2}^{*}$ limited, spectral linewidth of ${\sim}$145mHz,
calculated as the FWHM (inset shows representative spectrum). Importantly,
this linewidth remains stable for ${>}$10 days without any shimming or
degaussing of the mu-metal shield [20], nor OPM re-calibration during the
entire period, suggesting the linewidth will remain stable for several weeks.
This stability contrasts with typical benchtop NMR systems where field
instability is around 0.0014ppm/hr (0.083Hz at 60MHz) assuming <1∘C change in
temperature, often necessitating frequent shimming or active field
compensation. From our experience, the stability observed in Fig. 2D is also
considerably better than ZF NMR apparatuses constructed with permanent
(Halbach) magnets and pulsing coils. We attribute this to the low spatial
gradient of the fringe field of the superconducting $B_{0}{=}9.4$T magnet,
which is effectively shielded by the mu-metal in the ZF center, as well as
reliable shield integrity in the absence of strong pulses.

Stable shield conditions also enable high-SNR ultralow field (ULF) NMR
measurements. Fig. 2E(i-ii) demonstrates this with water at bias fields of
12nT and 244nT respectively, applied along the GF1 coil. Here the FID is
sampled every $\sim$165$\upmu$s, and the spins exhibit a slow Larmor
precession of 0.51Hz and 10.39Hz that can be clearly discerned. The ULF
measurement here is of similarly high SNR (Fig. 2E (iii)); we estimate a one-
shot SNR ${\approx}$4200 for the 244nT bias field. Fig. 2E suggests
applications towards ULF NMR with reintroducing controlled Zeeman fields to
gain in chemical resolution [21] or in exploiting enhanced relaxation-
dispersion at ultralow fields [13].

##  III ZULF NMR at natural abundance

The high sensitivity of our apparatus enables ZF NMR signal measurements at
natural isotopic abundance (NA) with no deoxygenation, previously unfeasible
due to low sensitivity. Historically, ZF NMR required 13C enriched molecules
[22, 23] or those containing specific spin-1/2 heteronuclei like 19F or 31P
[24, 25]. Here we present, to our knowledge, the first direct ZULF detection
of organic molecules at natural abundance of 13C nuclei. This is demonstrated
in Fig. 3A with formic acid, comparing ZF NMR signals from fully enriched and
NA samples on a logarithmic scale, showing the expected 100-fold SNR
reduction. Dark solid lines here are Lorentzian fits. NA methanol and benzene
are similarly analyzed in Fig. 3B and Fig. 3C(i) respectively. The benzene
spectrum corresponds well with simulations (Fig. 3C(ii)) despite being taken
from a previously opened stock solution where degradation has likely occurred,
faithfully reproducing chemistry laboratory conditions.

Given the stability of our detection apparatus, SNR can be enhanced through
averaging. Fig. 3D (i) displays individual spectral traces with increasing
averages $N$, demonstrating an expected SNR scaling ${\propto}\sqrt{N}$. For
$N{=}169$, we achieve an SNR of 175 for NA formic acid, with an average
single-shot SNR of 13.

We emphasize that significant further SNR improvements are achievable. Our
experiments utilize standard 5mm NMR tubes that are not optimal and under-
utilize the OPM detection volume. Additionally, for the current shielding
conditions, the commercial OPMs we employ have a sensitivity
${\approx}$40fT/$\sqrt{\textrm{Hz}}$ [14]. Emerging prototype OPMs, however,
have reported sensitivities closer to 1fT/$\sqrt{\textrm{Hz}}$ [26]. By using
these more sensitive OPMs and optimizing the sample tube to aid detection, the
signal could be improved by over an order of magnitude. In addition, noise
could be reduced further (up to 4-fold) by using a ferrite core in the
innermost layer of the magnetic shield. In parallel, we anticipate even
further signal gains from recent advances in high temperature superconducting
(HTS) magnet technology [27, 28, 29] which can enable higher, albeit
inhomogeneous, polarizing fields.

Even at current sensitivity, however, our apparatus compares well with
benchtop high-field NMR technology. Traditionally, ZULF NMR sensitivity has
been significantly lower—often by more than two orders of magnitude—compared
to benchtop NMR; however, we demonstrate here a promising step towards
bridging this gap. In particular, we compare our system to 13C NMR conducted
on a Magritek Spinsolve 80 Carbon (detection field ${\sim}$1.9T), using
identical samples of neat NA formic acid solutions in conventional 5 mm NMR
tubes.

Fig. 4A(i-ii) first compares the resulting NMR spectra at ZF and HF (1.9T),
displaying J-resolved and chemical-shift-resolved spectra respectively, and
demonstrating that ZF NMR spectra offers comparable chemical information for
small organic molecules. The bar chart in Fig. 4B analyzes the signals over 8
averages. From the upper two bars in Fig. 4B, corresponding to the data in
Fig. 4A, it is evident that the that SNR of ZF NMR in our apparatus is
comparable to that of a standard, 13C benchtop NMR measurement, although
furthur improvement is necessary to match the sensitivity of a 1H NMR
experiment. Notably, our ZF apparatus does not require shimming or re-
calibration between experiments (see Fig. 2D), nor deuterium locking, unlike
the benchtop HF instrumentation where repeated adjustments are necessary.
Importantly, while the HF NMR device can accomodate only single samples, which
have to be measured serially, our ZF NMR device can allow multichannel
operation (see Fig. 5).

The other bars in Fig. 4B depict enhancements to HF signals via employing the
nuclear Overhauser effect (NOE), proton decoupling (1H DCP), and their
combinations. The ZF-NMR signal remains within an order of magnitude of these
enhanced cases. We anticipate that applying variants of these enhancement
schemes in our setup, such as INEPT at HF prior to shuttling, could yield
similar signal gains.

##  IV Simultaneously acquired Multichannel ZULF NMR

Leveraging pre-polarization with the inhomogeneous magnet, we now move to
multichannel operation, presented in Fig. 5 as a proof-of-concept of the
vision outlined in Fig. 1. As a representative building block of larger
arrayed detection, we constructed a 3x1 OPM array at the ZF center capable of
simultaneously acquiring ZF-NMR spectra from three distinct samples – here,
enriched methanol, formic acid, and benzaldehyde. Fig. 5A shows a zoomed view
into the J-resolved spectra of these samples. Fig. 5B details the setup within
the ZF shield. For simplicity, the samples are arranged linearly, separated by
$d{=}5.4$mm, corresponding to OPMs placed side-by-side. Inset Fig. 5B(i) shows
a side-view photograph of the OPM arrangement, while the main panel presents a
schematic top view with axes marked, corresponding to same coordinate system
in Fig. 1 and Fig. 2A, although the OPMs are placed beside the sample instead
of below for ease of access and adjustments. Here, samples are contained in
short 5mm tubes (length ${\sim}$15mm) and subjected to the sequence in Fig. 2A
simultaneously. Fig. 5C displays the FID signals from the three samples,
highlighting the simultaneous measurement capacity.

An important metric for feasibility of arrayed detection is “crosstalk”, where
spectra may bleed into adjacent channels due to correlations at short OPM
separations $d$, caused by sensor interference or spurious detection of a
sample’s magnetization by neighboring sensors. In Fig. 5D-E, we use a pair of
OPMs to quantify crosstalk between adjacent channels. The setup is depicted in
Fig. 5D (i-ii), with coordinate axes marked for reference, and crosstalk is
measured as a function of $d$ (Fig. 5E). We use a 13C-enriched formic acid
sample placed in front of one OPM, measure the ZF-NMR signal from both OPMs
simultaneously, and quantify crosstalk as the ratio of spectral magnitudes.
Inset Fig. 5E(i) illustrates this for OPMs separated by $d{=}20.4$mm.

The bar chart in Fig. 5D, derived from 10 consecutive shots, show that even at
the closest side-by-side distance ($d{=}5.4$mm, the closest distance enabled
in our custom 3D printed OPM holder in Fig. 5B(i)), the crosstalk is
${<}10\%$. It declines sharply thereafter with increasing $d$, and stabilizes
at ${\sim}2\%$ at $d{=}15.4$mm. The saturation value likely reflects inherent
crosstalk within the data acquisition unit itself, since this steady-state
crosstalk value was observed in the channels even when the empty (adjacent)
channel was completely turned off.

While these results serve as a proof-of-concept, prospects for scaling to
arrayed OPM detection at a larger scale appear promising. Even with the
current shield and magnet arrangement, and separating the OPMs by $d{=}5.4$mm,
we estimate the capacity to accommodate ${>}$100 samples simultaneously (See
SI Sec. II [11]). The low GF values ($\upmu$T) employed further facilitate
this, as homogeneous low field solenoids can be easily fabricated to
accommodate large sample arrays.

Finally, let us contrast our approach to alternate methods for high throughput
NMR. One strategy involves parallel NMR detection employing numerous microcoil
receivers and small sample volumes at HF [30, 31]. However, the magnet “sweet
spot” remains constant, setting an upper bound on the number of samples that
can be accommodated simultaneously. Smaller coils might increase capacity, but
they complicate the design and reduce efficiency. Alternately, approaches for
simultaneous multi-nuclear detection enhance the richness of spectral
information [32, 33], but they do not expand the total sample throughput. An
emerging strategy involves magnetic resonance spectroscopy imaging (MRSI)
[34]. However, this method faces challenges in the expense of imaging-grade
magnets, a low per-sample filling factor, and slower measurements due to the
indirect dimension of spectroscopy.

In contrast, arrayed OPM-based ZULF detection is designed for direct
spectroscopy, can be optimized for filling factor per sample, and is
inherently extensible since the mu-metal shield can be made large enough to
accommodate an arbitrarily large number of samples while also offering relaxed
requirements for shimming and calibration.

##  V Outlook

In certain contexts, multichannel ZULF NMR may already offer advantages over
HF NMR, particularly for high throughput applications. SI Sec. II [11]
presents a thorough cost analysis of an arrayed ZULF NMR system. Using
conservative per-channel estimates based on commercial list prices and
factoring in economies of scale, our findings reveal a benign cost scaling,
suggesting the feasibility of constructing a ZULF NMR device with ${>}$100
channels for a cost comparable to that of a conventional liquid-state HF NMR
system operating at 400-500MHz (see Fig. 2 in SI [11]). We note that similar
arrayed OPM devices are already attracting interest in magnetoencephalography
(MEG) applications [35].

We emphasize, however, that HF NMR systems have broader capabilities,
including the ability to analyze a wide range of samples and perform multi-
dimensional NMR, and currently exhibit higher sensitivity. However, we argue
that for high-throughput 1D spectroscopy applications like in robotic
chemistry [36, 37], where there is an unmet need for an in-line, non-invasive,
analysis tool for kinetic measurements, ZULF NMR could offer distinct
advantages. The horizontal bore configuration of our system (Fig. 1D) is
particularly beneficial, allowing ZF NMR analysis to be performed
diametrically opposite the chemical synthesis region where samples can be
loaded and shuttled.

Furthermore, we anticipate straightforward improvements to our apparatus that
could enhance sensitivity by more than an order of magnitude without
compromising multichannel capacity. This includes optimizing the filling-
factor and integrating next-generation OPMs [38]. Additionally, HTS magnets,
free from cryoshim requirements, could be optimized to house numerous samples
in a compact form-factor. The capacity of multichannel ZF NMR systems to
operate for extended periods without shimming or temporal field-lock (Fig. 2D)
presents strong advantages for certain applications. It also portends new
strategies to exploit cross-correlations between neighboring channels to
suppress measurement noise [39, 40, 41].

Ultimately, this work suggests the potential for an “NMR camera” capable of
observing multiple samples simultaneously with a benign cost scaling. This
development could lead to novel assays for quality control [42, 43], and
disease detection [44, 45, 46], as well as applications that exploit the ZF
regime’s ability to enhance relaxation dispersion [13], eliminate
susceptibility broadening artifacts, and penetrate metal containers [47, 48],
potentially enabling in-operando battery diagnostics [49] at scale.

### Acknowledgements

We thank Prof. Evan Williams for access to the magnet used in this work, and
acknowledge early contributions from Ruhee Nirodi, Nicolas Matthey and
Chongwei Zhang and technical support of Sven Bodenstedt. We gratefully
acknowledge discussions with Christian Bengs, Raffi Budakian, Michael
Semmlinger and Kathyrn Pritchard, and funding from NSF PFI (2141083), NSF
EAGER (2231634), NSF MRI (2320520), Hamamatsu Photonics (20201452), and the
CIFAR Azrieli Foundation (GS23-013).

## References

  * Slichter [1990] C. P. Slichter,  _Principles of Magnetic Resonance_, edited by M. Cardona, P. Fulde, K. Von Klitzing, H.-J. Queisser, and H. K. V. Lotsch, Springer Series in Solid-State Sciences, Vol. 1 (Springer Berlin Heidelberg, Berlin, Heidelberg, 1990).
  * Ernst  _et al._ [1990] R. R. Ernst, G. Bodenhausen, and A. Wokaun,  _Principles of Nuclear Magnetic Resonance in One and Two Dimensions_ (Oxford University PressOxford, 1990).
  * Shapira and Frydman [2004] B. Shapira and L. Frydman, Journal of the American Chemical Society 126, 7184 (2004).
  * Van Zijl [1987] P. C. Van Zijl, Journal of Magnetic Resonance (1969) 75, 335 (1987).
  * MacLeod  _et al._ [2020] B. P. MacLeod, F. G. L. Parlane, T. D. Morrissey, F. Häse, L. M. Roch, K. E. Dettelbach, R. Moreira, L. P. E. Yunker, M. B. Rooney, J. R. Deeth, V. Lai, G. J. Ng, H. Situ, R. H. Zhang, M. S. Elliott, T. H. Haley, D. J. Dvorak, A. Aspuru-Guzik, J. E. Hein, and C. P. Berlinguette, Science Advances 6, eaaz8867 (2020).
  * Burger  _et al._ [2020] B. Burger, P. M. Maffettone, V. V. Gusev, C. M. Aitchison, Y. Bai, X. Wang, X. Li, B. M. Alston, B. Li, R. Clowes, N. Rankin, B. Harris, R. S. Sprick, and A. I. Cooper, Nature 583, 237 (2020).
  * Häse  _et al._ [2019] F. Häse, L. M. Roch, and A. Aspuru-Guzik, Trends in Chemistry 1, 282 (2019).
  * Put  _et al._ [2021] P. Put, S. Pustelny, D. Budker, E. Druga, T. F. Sjolander, A. Pines, and D. A. Barskiy, Analytical Chemistry 93, 3226 (2021).
  * Blanchard  _et al._ [2013] J. W. Blanchard, M. P. Ledbetter, T. Theis, M. C. Butler, D. Budker, and A. Pines, Journal of the American Chemical Society 135, 3607 (2013).
  * Blanchard  _et al._ [2020] J. W. Blanchard, T. Wu, J. Eills, Y. Hu, and D. Budker, Journal of Magnetic Resonance 314, 106723 (2020).
  * [11] “Supporting Information,” .
  * Budker and Romalis [2007] D. Budker and M. Romalis, Nature Physics 3, 227 (2007).
  * Bodenstedt  _et al._ [2021] S. Bodenstedt, M. W. Mitchell, and M. C. D. Tayler, Nature Communications 12, 4041 (2021).
  * Shah [2021] V. Shah, “QZFM Gen-3,” https://quspin.com/qzfm-gen-3/ (2062021).
  * Tierney  _et al._ [2019] T. M. Tierney, N. Holmes, S. Mellor, J. D. López, G. Roberts, R. M. Hill, E. Boto, J. Leggett, V. Shah, M. J. Brookes, R. Bowtell, and G. R. Barnes, NeuroImage 199, 598 (2019).
  * Kim and Savukov [2020] Y. J. Kim and I. Savukov, Journal of Applied Physics 128, 154503 (2020).
  * Tayler and Bodenstedt [2024] M. C. Tayler and S. Bodenstedt, Journal of Magnetic Resonance 362, 107665 (2024).
  * Blanchard and Budker [2016] J. W. Blanchard and D. Budker, in  _eMagRes_, edited by R. K. Harris and R. L. Wasylishen (John Wiley & Sons, Ltd, Chichester, UK, 2016) pp. 1395–1410.
  * Tayler  _et al._ [2017] M. C. D. Tayler, T. Theis, T. F. Sjolander, J. W. Blanchard, A. Kentner, S. Pustelny, A. Pines, and D. Budker, Review of Scientific Instruments 88, 091101 (2017).
  * [20] “Degaussing Magnetic Shields,” https://twinleaf.com/shield/DG/guide/.
  * Appelt  _et al._ [2010] S. Appelt, F. W. Häsing, U. Sieling, A. Gordji-Nejad, S. Glöggler, and B. Blümich, Physical Review A 81, 023420 (2010).
  * Theis  _et al._ [2013] T. Theis, J. W. Blanchard, M. C. Butler, M. P. Ledbetter, D. Budker, and A. Pines, Chemical Physics Letters 580, 160 (2013).
  * Wilzewski  _et al._ [2017] A. Wilzewski, S. Afach, J. Blanchard, and D. Budker, Journal of Magnetic Resonance 284, 66 (2017).
  * Alcicek  _et al._ [2021] S. Alcicek, P. Put, V. Kontul, and S. Pustelny, The Journal of Physical Chemistry Letters 12, 787 (2021).
  * Trahms and Burghoff [2010] L. Trahms and M. Burghoff, Magnetic Resonance Imaging 28, 1244 (2010).
  * Kominis  _et al._ [2003] I. K. Kominis, T. W. Kornack, J. C. Allred, and M. V. Romalis, Nature 422, 596 (2003).
  * Chen  _et al._ [2023] P.-H. Chen, C. Gao, N. Alaniva, S. Björgvinsdóttir, I. G. Pagonakis, M. A. Urban, A. Däpp, R. Gunzenhauser, and A. B. Barnes, Journal of Magnetic Resonance 357, 107588 (2023).
  * Lee  _et al._ [2022] W. Lee, D. Park, J. Bascuñán, and Y. Iwasa, Superconductor Science and Technology 35, 105007 (2022).
  * Park  _et al._ [2021] D. Park, J. Bascunan, Y. Li, W. Lee, Y. Choi, and Y. Iwasa, IEEE Transactions on Applied Superconductivity 31, 1 (2021).
  * Trumbull  _et al._ [2000] J. Trumbull, I. Glasgow, D. Beebe, and R. Magin, IEEE Transactions on Biomedical Engineering 47, 3 (Jan./2000).
  * Fratila and Velders [2011] R. M. Fratila and A. H. Velders, Annual Review of Analytical Chemistry 4, 227 (2011).
  * Kupče  _et al._ [2019] Ē. Kupče, K. R. Mote, and P. K. Madhu, Journal of Magnetic Resonance 304, 16 (2019).
  * Kupče and Freeman [2011] Ē. Kupče and R. Freeman, Journal of Magnetic Resonance 213, 1 (2011).
  * Faderl  _et al._ [2024] D. Faderl, A. Chenakkara, M. Jouda, N. MacKinnon, A. D. Gossert, and J. G. Korvink, Analytical Chemistry 96, 9859 (2024).
  * Brookes  _et al._ [2022] M. J. Brookes, J. Leggett, M. Rea, R. M. Hill, N. Holmes, E. Boto, and R. Bowtell, Trends in Neurosciences 45, 621 (2022).
  * Bornemann-Pfeiffer  _et al._ [2021] M. Bornemann-Pfeiffer, J. Wolf, K. Meyer, S. Kern, D. Angelone, A. Leonov, L. Cronin, and F. Emmerling, Angewandte Chemie International Edition 60, 23202 (2021).
  * Sans  _et al._ [2015] V. Sans, L. Porwol, V. Dragone, and L. Cronin, Chemical Science 6, 1258 (2015).
  * Hong  _et al._ [2024] T. Hong, Y. Wang, Z. Shao, Q. Li, M. Jiang, and X. Peng, “Femtotesla Atomic Magnetometer for Zero- and Ultralow-field Nuclear Magnetic Resonance,”  (2024).
  * Zhou  _et al._ [2020] Z. Zhou, P. Li, M. Sheng, Q. Zhou, and P. Hu, IEEE Transactions on Electromagnetic Compatibility 62, 1055 (2020).
  * Srinivas [2020] J. Srinivas, “Reducing the Noise Floor and Improving the SNR with Cross-Correlation Techniques,” https://www.zhinst.com/americas/en/blogs/how-reduce-noise-floor-and-improve-snr-employing-cross-correlation-techniques (2020).
  * Sampietro  _et al._ [1999] M. Sampietro, L. Fasoli, and G. Ferrari, Review of Scientific Instruments 70, 2520 (1999).
  * Rodrigues and Gil [2011] J. E. Rodrigues and A. M. Gil, Magnetic Resonance in Chemistry 49 (2011), 10.1002/mrc.2844.
  * Heyman and Meyer [2012] H. Heyman and J. Meyer, South African Journal of Botany 82, 21 (2012).
  * Ouyang  _et al._ [2011] X. Ouyang, Y. Dai, J. Wen, and L. Wang, Lupus 20, 1411 (2011).
  * Hernandez-Baixauli  _et al._ [2020] J. Hernandez-Baixauli, S. Quesada-Vázquez, R. Mariné-Casadó, K. Gil Cardoso, A. Caimari, J. M. Del Bas, X. Escoté, and L. Baselga-Escudero, Nutrients 12, 806 (2020).
  * Vignoli  _et al._ [2019] A. Vignoli, V. Ghini, G. Meoni, C. Licari, P. G. Takis, L. Tenori, P. Turano, and C. Luchinat, Angewandte Chemie International Edition 58, 968 (2019).
  * Burueva  _et al._ [2020] D. B. Burueva, J. Eills, J. W. Blanchard, A. Garcon, R. Picazo-Frutos, K. V. Kovtunov, I. V. Koptyug, and D. Budker, Angewandte Chemie International Edition 59, 17026 (2020).
  * Tayler  _et al._ [2019] M. C. D. Tayler, J. Ward-Williams, and L. F. Gladden, Applied Physics Letters 115, 072409 (2019).
  * Hu  _et al._ [2020] Y. Hu, G. Z. Iwata, M. Mohammadi, E. V. Silletta, A. Wickenbrock, J. W. Blanchard, D. Budker, and A. Jerschow, Proceedings of the National Academy of Sciences 117, 10667 (2020).


licensedothergov 978-1-4503-4486-9/17/04$15.00
http://dx.doi.org/10.1145/3019612.3019795

# Security and Privacy Preserving Data Aggregation in Cloud Computing

Leandro Ventura Silva  Rodolfo Marinho  Jose Luis Vivas  Andrey Brito

Universidade Federal de Campina Grande  {leandrojose, rodolfoams, jlvivas,
<EMAIL_ADDRESS>
(2017)

###### Abstract

Smart metering is an essential feature of smart grids, allowing residential
customers to monitor and reduce electricity costs. Devices called smart meters
allows residential customers to monitor and reduce electricity costs,
promoting energy saving, demand management, and energy efficiency. However,
monitoring a households’ energy consumption through smart meters poses serious
privacy threats, and have thus become a major privacy issue. Hence, a
significant amount of research has appeared recently with the purpose of
providing methods and mechanisms to reconcile smart metering technologies and
privacy requirements. However, most current approaches fall short in meeting
one of several of the requirements for privacy preserving smart metering
systems. In this paper we show how Intel SGX technology can be used to provide
a simple and general solution for the smart metering privacy problem that
meets all these requirements in a satisfactory way. Moreover, we present also
an implementation of the proposed architecture as well as a series of
experiments that have been carried out in order to assess how the proposed
solution performs in comparison to a second implementation of the architecture
that completely disregards privacy issues.

###### keywords:

smart grid; smart metering; secure cloud computing; privacy

††conference: SAC 2017, April 03 - 07, 2017, Marrakech, Morocco

<ccs2012> <concept> <concept_id>10002978.10002991.10002995</concept_id>
<concept_desc>Security and privacy Privacy-preserving protocols</concept_desc>
<concept_significance>500</concept_significance> </concept> <concept>
<concept_id>10002978.10003001.10003599</concept_id> <concept_desc>Security and
privacy Hardware security implementation</concept_desc>
<concept_significance>500</concept_significance> </concept> <concept>
<concept_id>10002978.10003014.10003015</concept_id> <concept_desc>Security and
privacy Security protocols</concept_desc>
<concept_significance>500</concept_significance> </concept> <concept>
<concept_id>10002978.10003018.10003019</concept_id> <concept_desc>Security and
privacy Data anonymization and sanitization</concept_desc>
<concept_significance>500</concept_significance> </concept> <concept>
<concept_id>10002978.10003018.10003021</concept_id> <concept_desc>Security and
privacy Information accountability and usage control</concept_desc>
<concept_significance>500</concept_significance> </concept> <concept>
<concept_id>10002978.10003029.10011150</concept_id> <concept_desc>Security and
privacy Privacy protections</concept_desc>
<concept_significance>500</concept_significance> </concept> </ccs2012>

[500]Security and privacy Privacy-preserving protocols [500]Security and
privacy Hardware security implementation [500]Security and privacy Security
protocols [500]Security and privacy Data anonymization and sanitization
[500]Security and privacy Information accountability and usage control
[500]Security and privacy Privacy protections

##  1 Introduction

Electricity is today the most important single source of carbon dioxide
emission, and hence it is considered one of the main contributors to climate
change. Growing energy needs are therefore forcing governments to find more
efficient and economic ways to manage the energy grid and improve load
balancing. To this end, the current electrical power system is undergoing
significant modernization with the introduction of information technologies,
turning into what is commonly called “smart grid”. Smart grids are basically
power networks enhanced with information technology and an intelligent
metering infrastructure. The purpose is to integrate the behavior and actions
of all involved actors and components in order to ensure an economically
efficient, robust, secure and reliable power system with minimal power loss.
Among its benefits is a quicker response for changes in electricity demand,
made possible by the use of intelligent electronic devices such as load
controllers, sensors, and smart meters.

Smart metering is an essential feature of smart grids, allowing residential
customers to monitor and thereby reduce electricity costs. The key component
of a smart metering system is an electronic device called smart meter (SM),
which is intended to substitute ordinary electromechanical meters that provide
only energy measurement data. Unlike the latter, a smart meter can record
energy consumption at determined time intervals and report it to the utility
supplier for purposes of monitoring and billing. This is done by means of a
two-way communication link between the SM and other components of the metering
system. In theory, SMs could be capable of communicating with any other
devices, including other SMs, and of executing both local and remote command
signals.

The ability to remotely read fine-grained measurements or energy consumption
is the most important feature of smart metering. This feature would enable
grid operators to perform efficient load balancing and to offer customers
time-dependent tariffs. In this way, SMs may be used to promote energy saving,
demand management, and energy efficiency. However, monitoring a households’
energy consumption through SMs poses serious privacy threats, and have thus
become a major privacy issue. Fine-grained consumption data could reveal what
citizens do within their own homes, how they spend their free time, whether
they are away on holiday or at work, when they watch TV or run a washing
machine, or even the use of some specific medical device. There is also a
potential for extensive data mining by combining fine-grained metering with
data from other sources. Notwithstanding, the benefits of smart metering are
so significant that it has given rise a significant amount of research with
the purpose of providing methods and mechanisms to reconcile smart metering
technologies and privacy requirements.

The two most important smart metering privacy requirements are: (i) fine-
grained individual consumption data must be accessible only to the
corresponding individual; and (ii) the consumption data of a customer for a
billing period (monthly or other) must be accessible to the contracted utility
supplier for billing purposes. hence, fine-grained data metering, also called
operational metering, should not be attributable, whereas long-term
consumption data, also called accountable metering, should be attributable.

On the other hand, among the most important requirements for smart metering
privacy preserving systems are: (i) scalability; (ii) fault tolerance; (iii)
reduced computational and storage capabilities in smart meters; (iv) low
communication overhead; and (v) rapid response. As we shall see, most current
privacy preserving proposals fall short in meeting one of several of these
requirements.

In the paper we show that Intel SGX technology can be used to provide a simple
and general solution for the smart metering privacy problem detailed above.

##  2 Intel SGX

Intel SGX can be described as a set of new instructions and changes in memory
access mechanisms added to the Intel Architecture that allows an application
to instantiate a protected area in the application’s address space, dubbed an
enclave [23]. An enclave is intended to ensure confidentiality and integrity
of owned data even in the presence of privileged malware. Inside the enclave,
code, data and stack are protected by hardware enforced access control
policies which prevent attacks against the enclave’s content even when these
originate from privileged software such as virtual machine monitors, BIOS, or
operating systems.

Another critical feature of Intel SGX is a set of instructions for remote
attestation of a running enclave [2]. SGX provides means to generate a
hardware based attestation that an enclave has been successfully established
on an SGX enabled platform and that a specific piece of software, and nothing
else, has been loaded within the enclave. Both features, i.e., attestation and
isolation, are essential to the solution we propose in this paper.

Possible applications of Intel SGX have been discussed in [18], where examples
of applications that make use of the capabilities of Intel SGX were presented,
as well as an application architecture including an application split between
components requiring security protection which should run within enclaves, and
components that do not require protection and can therefore be executed
outside enclaves.

In [4] a set of tools is presented for specifying protocols that extend the
guarantees provided by isolated execution environments, such as the Intel SGX,
by means of its ability to perform remote attestation. In this way, it becomes
possible to establish secure key exchange protocols between a remote
participant and an isolated execution environment. These protocols are defined
by the combination of a passively secure key exchange protocol and an
arbitrary attestation protocol.

##  3 Privacy-preserving solutions for operational metering

Basically, privacy preserving proposals for smart metering have adopted one of
the two following approaches: anonymization and data aggregation. Next, we
present each one of them.

###  3.1 Anonymization approaches

Anonymization approaches have been based on trusted third parties (TTP), zero
knowledge proofs, and group keys/IDs.

#### Trusted third party solutions

TTP solutions include the following proposals: (i) using a trusted
neighborhood gateway to which SMs send their data at each time slot, and which
thereafter forwards to the utility supplier only the metering data without the
corresponding identity information [24]; (ii) using a Public Key
Infrastructure (PKI) for the identification of smart meters to the TTP, in
which a SM may send to the TTP its private data encrypted with both the public
key of the supplier and a pseudonym private key shared with the TTP, which may
thus authenticate the data but not read it before sending it to the utility
supplier encrypted with the latter’s public key, without any identification
details [22]; (iii) anonymization of operational metering data through
pseudonymous certified by a TTP escrow service [12]; and (iv) letting a
trusted proxy, either the gateway or a TTP, play the role of an anonymizer
hiding the static IP address of SMs [17].

Apart from vulnerabilities such as timing attacks, the main drawback of these
anonymization approaches is related to the trust model issues: in each case a
TTP must be trusted. We need solutions that minimize the required trusted
base.

#### Zero Knowledge proofs

Instead of relying on TTPs, other schemes have been proposed that are based on
the SM sending metering data in plaintext to authorized data recipients using
zero-knowledge methods to anonymously prove that it is a legitimate SM, but
without revealing any other information, such as the identity of the SM [25,
19]. The main drawbacks of these approaches are the high computational costs
and communication overheads induced by zero-knowledge proof methods and the
use of anonymous credentials.

#### Group keys and IDs

An anonymization approach was proposed using a virtual ring architecture in
which SMs are organized, based on their location, into groups, each group with
a group ID and a pair of public/private ring keys used by each SM to sign its
operational metering data before sending it to the utility supplier, which
would thus be able to verify the authenticity of the SM but not its ID [3]. A
limitation of this approach is lack of scalability, since the message
signature size increases linearly with the increasing group size.

Another proposed scheme is based on group keys, HMAC signatures, PKI, trusted
substations, and the inclusion of a trusted entity called control center (the
power generator system) [8]. The control center generates a system key and
distributes it to the SMs of a region and its corresponding substation, which
may then request more electricity by sending to the control center a fresh
pseudonym in the shape of a random number concatenated with their real ID
encrypted with the control center’s public key. The main drawback of this
scheme is that the SMs protect their identities from the substations, but not
from the control center, and hence from the utility itself. This was later
improved in order to guarantee that the real identities of the SMs remain
hidden also to the control center, but in this case introducing high a
communication overhead [7], a drawback which was eliminated later [9]. An
improvement was also proposed by replacing the blind signature with a ring
signature [27], reducing computational costs and communication overheads, but
at the price of enabling the control center to link electricity requests via a
static pseudonym, and ultimately to a real ID.

Another proposal [26] makes use of a non-trusted transportation layer
$k$-anonymity service (the Gateway Operator) using pseudonyms, each one used
by at least $k$ SMs for sending encrypted metering data to the utility
provider and signed for the Gateway Operator, who verifies the signature,
removes it, and sends the encrypted message to the utility provider. However,
over a long period of time it has been shown that long term aggregation of
partial information can break the anonymity of the users.

Finally, a proposal relying on a pseudonymous smart metering protocol without
a TTP was put forward in which each SM generates its own blinded pseudonym,
gets a signature of it from the service supplier, and thereafter unblinds the
received signature [14]. In this way, a SM gets a pseudonym that is signed by
the utility supplier but that the latter cannot associate with a specific SM.
A drawback here is that new SMs joining the system could have their new
pseudonyms easily linked to themselves.

#### Conclusions on anonymization approaches

As we may see from the presented proposals, there is usually a trade-off
between the extent of the trusted base and the complexity of the solution,
either in terms of computation or communication overheads. Apart from the
higher computational and communication overheads associated with
pseudomization schemes, those schemes are vulnerable to de-anomization attacks
based on statistical analysis, correlation of account and operational data,
and side-channel attacks.

###  3.2 Data aggregation approaches

For operational purposes the value of the aggregate consumption metering data
of all the customers in a given region would be enough to guarantee the
benefits of smart metering. It is assumed that it would be difficult for the
utility supplier to decompose the individual users’ metering data from the
aggregated data, thus ensuring their privacy.

Three types of data aggregation approaches may be distinguished, based on (i)
trusted third parties, (ii) data perturbation, and (iii) cryptography.

#### Trusted third parties (TTPs)

In these approaches, TTPs may collect the raw metering data of all the users,
aggregate these data and deliver only the aggregated metering data to the
utility supplier or other authorized data recipients, ensuring users’ privacy
against the utility supplier, but not the TTP, which receives all the metering
data of the individual users [5]. The use of pseudonyms known only to the
supplier has been suggested to prevent it, as shown in the previous section.
However, the use of pseudonyms leads to the drawbacks of the anonymization
approaches discussed above. Another scheme uses the Diffie-Hellman key
exchange protocol for establishing a secret key shared between an SM and
network Gateways [15].

The obvious flaw in these types of schemes is that solutions must rely on a
TTP.

#### Data perturbation

The approach here is that each SM adds random noise to its metering data so
that the aggregator is not be able to find out the original metering data but
may still calculate the aggregated value with a small or negligible expected
error [5]. Several types of random error distributions have been proposed in
the extensive literature on the subject. The major drawback of these
approaches is the difference between the perturbed and real data and lack of
fault tolerance, since the failure of a single SM to deliver its data may
prevent obtaining a good estimation of the real value.

#### Cryptography

The use of cryptographic primitives has been proposed to overcome the
drawbacks of the previous methods. Two approaches are common here, one based
on secret sharing schemes, and other on homomorphic encryption.

In the case of secret sharing schemes, measurements are completely hidden from
the aggregator since it receives only encrypted measurements that it cannot
decrypt and random shares of the total consumption [16]. In this scheme, each
SM splits its measurements into $k$ random shares, where $k$ is the number of
SMs in a given set, including itself, keeps its own share and sends to the
aggregator the remaining shares encrypted with the public keys of the
corresponding SMs. The aggregator will then add the shares encrypted with one
single key, using the homomorphic property of the encryption scheme, and sends
the encrypted aggregated value to the corresponding SM that may then decrypt
it with its secret key, add its own share, and send the result to the
aggregator, which upon receiving the sums from each SM may obtain the total
consumption value. The drawbacks with this scheme are mainly that it is not
scalable, since it relies on secret sharing, and that the communication
overhead is significant.

Other approaches use masking in such a way that when the masked inputs from
all parties are summed, the masking values cancel each other out and the
aggregator may thus obtain the total consumption value, maybe using simple
brute force methods [21]. The communication and computation overhead of this
protocol is nevertheless significant. Other approaches are based on computing
the aggregated consumption using a version of the Paillier cryptosystem [13].
This scheme requires SMs to be able to perform operations such as Paillier
encryption, hash functions, random number generation, and to communicate with
each other. Finally, a solution relying on an additive homomorphic encryption
scheme that avoids the need for secret sharing or public cryptosystems has
also been presented [1]. Encryption here is simple, consisting only of a
modular addition operation. The aggregator can be any SM, and the utility
supplier cannot observe the actual measurements because each one is masked by
a set of random numbers that cancel each other out when they are added
together. This scheme requires, however, that each smart meter shares keys
with the utility supplier and exchange pseudo-random numbers among themselves.
Moreover, the aggregator must be trusted.

##  4 The Intel SGX solution to privacy preserving smart metering

Models for privacy in smart metering typically include the following
components: (i) consumers, the end-users receiving the power supply, whose
privacy must be protected; (ii) the Aggregator, which receives the consumers’
metered consumption from SMs, aggregates them and sends the resulting
aggregated values to the utility supplier; (iii) Smart Metering Devices
installed at the customer side of the network that periodically sense the
consumed energy and send the measurements to the consumer and/or the
aggregator; (iv) the Utility Supplier, which is the company responsible for
electricity distribution and transportation infrastructure, and whose
operators may employ smart metering data in order optimize the provision of
electricity and load balancing; and (v) the communication network enabling
two-way communication among the parties in a smart grid.

Borrowing from the notation introduced in Bohli et al. [5], our model includes
a set $S=\\{SM_{1},...,SM_{n}\\}$ of smart metering devices (SMs). We let
$e_{i,j}$ denote the value of the electricity consumption of the smart meter
$SM_{i}$ in the period $j$ for $j\in\\{1,...,t\\}$, where $t$ denotes the
total number of time slots in one billing period. The metering values in a
smart metering period can thus be described by the matrix $(e_{i,j})$. The
model assumes that each value $e_{i,j}$ is unknown to the utility supplier,
whereas the aggregated values $\sum_{j=1}^{t}e_{i,j}$ for all
$j\in\\{1,...,t\\}$ (the sum of electricity consumption values of an
individual customer over a given time period) and $\sum_{i=1}^{|S|}e_{i,j}$
for all $i\in\\{1,...,|S|\\}$ (the sum of the current electricity consumption
of all customers) may be considered as public and the only values that the
utility supplier needs to know.

In the trust model of our solution, the only trusted component will be the SM
devices. The aggregator will include an SGX enclave component for performing
aggregation which, rather than trusted, is assumed to be secure.

The architecture of our solution is depicted in Figure 1. This figure shows
one round in the aggregation of metering values for a given period of time
$j$. Each smart meter $SM_{i}$ sends the current metering value along a secure
communication channel that has been previously established between the
aggregator and each smart meter. The aggregator collects these values,
aggregates them, and sends the aggregated value to the utility provider. The
aggregator will not reveal the individual values because the aggregation
happens in a protected enclave that has been attested by each SM individually.
The verification of the attestation may happen with the aid of a trusted
component, the Attestation Service, which can be the Intel Attestation
Service111https://software.intel.com/en-us/blogs/2016/03/09/intel-sgx-epid-
provisioning-and-attestation-services or any other trusted agency. The smart
meters could also carry out this verification themselves. It is assumed that
the SMs themselves are trusted by the customers, and have been previously
verified. At the end of a billing period, the aggregator could also provide
the aggregated consumption value of each smart meter to the utility provider.
The code for this operation should also be contained within the attested
enclave.

Figure 1: Simplified scheme of the proposed SM architecture

Details about the sequence of events in the main smart metering are shown in
Figure 2. In this scenario we include the the actors appearing in Figure 1,
but only a single smart metering device (SM). It is assumed that the SM can
identify itself, maybe by means of a PKI key pair configured by the Utility
Provider (UP) at deployment time. The sequence starts with the SM identifying
itself to the Aggregator by means of some predefined identification
credentials. The Aggregator sends the credentials to the UP for verification.
If the action succeeds, the Aggregator reports OK to the SM, which will then
proceed to attest the Aggregator to see if it’s a legitimate Intel SGX
platform and that it is running an enclave with the desired code. After the
attestation challenge has been sent, the Aggregator responds by sending back a
QUOTE structure signed with an Intel Enhanced Privacy ID (EPID) key used to
sign enclave attestations [6]. The QUOTE structure contains the information
required for the attestation of an enclave. Several other communication events
may happen between the Aggregator and the SM at this juncture, e.g., actions
to exchange symmetric keys in order to establish a secure channel between the
SM and the Aggregator, but for the sake of simplicity these are not shown in
the figure. If the verification of the attestation succeeds, the SM may report
it to the Aggregator, upon which it can start sending periodically the fine-
grained values of electric consumption along a secure channel which has been
established during the attestation process. The Aggregator is supposed to
collect the received metering values from each SM in the system, and return
the aggregated value to the UP. At the end of a billing period it may also
return the aggregated consumption value of each SM, and start over for a new
period.

Figure 2: Sequence diagram of the main scenario

###  4.1 Evaluation of the proposed model

As we have seen in Section 3, most current solutions to the smart metering
privacy problem fall short in some of the most important requirements for
privacy and performance. Our solution meets all those requirements in a simple
way and with a minimum trusted base. We consider these requirements here one
by one.

#### Scalability

The system is clearly scalable, since only simple communication operations on
unencrypted values are carried out by involved parties.

#### Fault tolerance

The Aggregator does not need to wait for the consumption values of all smart
meters. If one or more of the SMs fails temporarily, the aggregation may be
performed with, for instance, some average value for the latest received
consumption values from the corresponding SM. A threshold on the maximum
fraction of failed instances at any given time slot may be defined.

#### Limited computational and storage capabilities

Only common cryptographic operations need to be carried out by the smart
metering devices, basically the ones required for establishing secure
channels.

#### Low communication overhead

Only some few simple procedures need be performed by the smart metering
devices for establishing attestation. Smart metering values are communicated
at once, probably encrypted with the symmetric key exchanged during the
attestation process. The smart meters do not need to know or communicate with
each other, and no further procedures are required.

#### Rapid response

No time consuming operations or procedures are required. Aggregation is done
on data in the clear and only a simple summation operation is required.

For these reasons, we consider the presented solution as the most appropriate
one presented so far for preserving privacy in smart metering systems. We
assume only that Intel SGX technology is secure. The attacks that can be
carried out against the proposed protocol are basically those that can be
directed against Intel SGX (for a detailed account of possible threats and
vulnerabilities in Intel SGX, see [10]).

Being a novel technology, the security of Intel SGX itself is still an open
issue.

##  5 Performance Assessment

For assessing the performance of the proposed architecture, two different
implementations were made in C++, the first one a simple non-secure
implementation without any privacy guarantees or other overhead, and the
second one an implementation of the privacy preserving Intel SGX based
architecture presented above. For comparison purposes, in both implementations
the same test case was used, i.e. household energy consumption aggregated by
region.

In the first implementation, all the measured data is sent by the
corresponding smart meters in plain text to the aggregator, which thereafter
aggregates all measurements and sends it to the utility supplier. In the
second one, based on the Intel SGX technology, each smart meter, before
sending its consumption measurement data, will first identify itself and
thereafter attest remotely the aggregator.

For communication between smart meters and aggregators, a bus service solution
provided by Apache Kafka222http://kafka.apache.org was used, which ensures
scalability, fault tolerance, and performance.

In order to allow communication between the C++ applications and Apache Kafka,
the library librdkafka333https://github.com/edenhill/librdkafka was used.
Additionally, the remote attestation process is carried out by means of a
sequence of RESTful calls using the Restbed
framework444https://github.com/Corvusoft/restbed. Every attestation message is
represented by a JSON555http://www.json.org/, a data-interchange format.

The tests were conducted in a private cloud using OpenStack for the
orchestration of the cloud application with Docker containers (using the
OpenStack driver nova-docker). The containers executed Ubuntu Linux 14.04 and
the Intel SGX drivers666https://01.org/intel-softwareguard-eXtensions (since
June 24, 2016).. These containers were run on computers with one Intel i7-6700
SGX capable processor and 8 GB of RAM.

###  5.1 The Experiments

The experiments consisted of two parts. The first part aimed to compare the
execution time for the aggregation of daily consumption data for regions with
$50$, $100$, $200$, $300$, $400$ and $500$, $600$, $700$ and $750$ households,
sending measurements every 60 seconds. For every group size, $10$ runs were
executed. Also, Figure 3 shows the run times with a $95\%$ confidence
interval. This experiment is important in order to find out the overhead
caused by security measures.

Figure 3: Comparison between aggregating within SGX enclave and within regular
code

The second part had the objective of showing the relation between the memory
access cost and the amount of memory allocated to an SGX enclave. The results
can be seen in Figure 4 and show a considerable increase in access cost when
the memory exceeds the size of the enclave page cache. This effect is a
consequence of cache lines being paged out to main memory, requiring
(hardware-based) encryption as data leaves the processor.

Figure 4: Comparison between reading from SGX enclave and from unencrypted
memory

###  5.2 Discussion

As can be seen in Figure 3, the overhead of SGX is in the order of $40$ to
$60$ times. Despite the increased execution time, the benefits are significant
because the privacy of the households are protected by the fact that the
electricity consumption values are passed to the enclave within the aggregator
along a secure channel established during the attestation process, and only
the aggregated values will ever leave the enclave (as the code can be verified
with the attestation).

On the other hand, it is important to keep in mind that the memory space that
can be allocated to an enclave is currently limited to $128$ MB for all the
enclaves within an Intel SGX platform, and, access times can increase
significantly when this limit is reached, causing a different kind of
pagination, where memory will be allocated outside the enclave in an encrypted
way. This kind of pagination, as of September 2016, only works on Linux
platforms.

Nevertheless, for applications that require a small memory footprint as is our
case, approximately $256$ bytes are needed to store accumulated data and
cryptographic keys. Therefore, one single enclave can be used to aggregate
data from up to 500,000 smart meters without exceeding the enclave memory.
Additional load distribution is also possible by balancing the SMs accross
multiple SGX-capable machines.

##  6 Conclusions

In this paper we have shown how Intel SGX technology can be used to provide a
simple and general solution for the smart metering privacy problem. We
provided a short introduction to a variety of previous solutions, as well as
an account of the proposed Intel SGX based architecture providing a general
and efficient solution to the problem. Finally, we presented also a set of
experiments for assessing the performance of the proposed solution.

As future work we aim to assess other strategies for aggregation such as
garbled circuits [20] and multi-party secure computing [11]. Moreover, with
regard to Intel SGX we intend to integrate our implementation into cloud
environments by, e.g., introducing mechanisms such as smooth remote
attestation [4]. We also want to test how our architecture will perform using
other secure hardware processing strategies, such as AMD Secure Memory
Encryption (SME) and Secure Encrypted Virtualization (SEV).

## Acknowledgements

This research was partially funded by EU-BRA SecureCloud project (MCTI/RNP 3rd
Coordinated Call) and by CNPq, Brazil.

## References

  * [1] G. Ács and C. Castelluccia.  I have a dream!: Differentially private smart metering.  In Proceedings of the 13th International Conference on Information Hiding, IH’11, pages 118–132, Berlin, Heidelberg, 2011. Springer-Verlag.
  * [2] I. Anati, S. Gueron, S. Johnson, and V. Scarlata.  Innovative technology for cpu based attestation and sealing.  In HASP ’13: Proceedings of the 2Nd International Workshop on Hardware and Architectural Support for Security and Privacy, volume 13. ACM, 2013\.
  * [3] M. Badra and S. Zeadally.  Design and performance analysis of a virtual ring architecture for smart grid privacy.  IEEE Transactions on Information Forensics and Security, 9(2):321–329, Feb 2014.
  * [4] M. Barbosa, B. Portela, G. Scerri, and B. Warinschi.  Foundations of hardware-based attested computation and application to sgx.  In 2016 IEEE European Symposium on Security and Privacy (EuroS&P), pages 245–260. IEEE, 2016.
  * [5] J.-M. Bohli, C. Sorge, and O. Ugus.  A Privacy Model for Smart Metering.  In Proceedings of the First IEEE International Workshop on Smart Grid Communications (in conjunction with IEEE ICC 2010), 2010.
  * [6] E. Brickell and J. Li.  Enhanced privacy id from bilinear pairing for hardware authentication and attestation.  International Journal of Information Privacy, Security and Integrity 2, 1(1):3–33, 2011.
  * [7] J. C. L. Cheung, T. W. Chim, S. Yiu, V. O. K. Li, and L. C. K. Hui.  Credential-based privacy-preserving power request scheme for smart grid network.  In Proceedings of the Global Communications Conference, GLOBECOM 2011, 5-9 December 2011, Houston, Texas, USA, pages 1–5, 2011.
  * [8] T. W. Chim, S.-M. Yiu, L. C. K. Hui, and V. O. K. Li.  Pass: Privacy-preserving authentication scheme for smart grid network.  In SmartGridComm, pages 196–201. IEEE, 2011.
  * [9] T. W. Chim, S.-M. Yiu, L. C. K. Hui, and V. O. K. Li.  Privacy-preserving advance power reservation.  IEEE Communications Magazine, 50(8):18–23, 2012.
  * [10] V. Costan and S. Devadas.  Intel sgx explained.  Cryptology ePrint Archive, Report 2016/086, 2016.  http://eprint.iacr.org/2016/086.
  * [11] R. Cramer, I. Damgård, and U. Maurer.  General secure multi-party computation from any linear secret-sharing scheme.  In International Conference on the Theory and Applications of Cryptographic Techniques, pages 316–334. Springer, 2000.
  * [12] C. Efthymiou and G. Kalogridis.  Smart Grid Privacy via Anonymization of Smart Metering Data.  Smart Grid Communications (SmartGridComm), 2010 First IEEE International Conference on, 2010.
  * [13] Z. Erkin and G. Tsudik.  Private Computation of Spatial and Temporal Power Consumption with Smart Meters, pages 561–577.  Springer Berlin Heidelberg, Berlin, Heidelberg, 2012.
  * [14] S. Finster and I. Baumgart.  Pseudonymous smart metering without a trusted third party.  In TrustCom/ISPA/IUCC, pages 1723–1728. IEEE Computer Society, 2013\.
  * [15] M. Fouda, Z. M. Fadlullah, N. Kato, R. Lu, and X. Shen.  A lightweight message authentication scheme for smart grid communications.  IEEE Trans. Smart Grid, 2(4):675–685, 2011.
  * [16] F. D. Garcia and B. Jacobs.  Privacy-friendly energy-metering via homomorphic encryption.  In J. Cuéllar, J. Lopez, G. Barthe, and A. Pretschner, editors, STM, volume 6710 of Lecture Notes in Computer Science, pages 226–238. Springer, 2010.
  * [17] Y. Gong, Y. Cai, Y. Guo, and Y. Fang.  A privacy-preserving scheme for incentive-based demand response in the smart grid.  IEEE Trans. Smart Grid, 7(3):1304–1313, 2016.
  * [18] M. Hoekstra, R. Lal, P. Pappachan, V. Phegade, and J. Del Cuvillo.  Using innovative instructions to create trustworthy software solutions.  In HASP@ ISCA, page 11, 2013.
  * [19] T. Jeske.  Privacy-preserving smart metering without a trusted-third party.  In Proceedings of the International Conference on Security and Cryptography (ICETE 2011), pages 114–123, 2011.
  * [20] V. Kolesnikov and T. Schneider.  Improved garbled circuit: Free xor gates and applications.  In International Colloquium on Automata, Languages, and Programming, pages 486–498. Springer, 2008.
  * [21] K. Kursawe, G. Danezis, and M. Kohlweiss.  Privacy-friendly aggregation for the smart-grid.  In Proceedings of the 11th International Conference on Privacy Enhancing Technologies, PETS’11, pages 175–191, Berlin, Heidelberg, 2011. Springer-Verlag.
  * [22] R. Lu, X. Liang, X. Li, X. Lin, and X. Shen.  Eppa: An efficient and privacy-preserving aggregation scheme for secure smart grid communications.  IEEE Transactions on Parallel and Distributed Systems, 23(9):1621–1631, Sept 2012.
  * [23] F. McKeen, I. Alexandrovich, A. Berenzon, C. V. Rozas, H. Shafi, V. Shanbhogue, and U. R. Savagaonkar.  Innovative instructions and software model for isolated execution.  In HASP@ ISCA, page 10, 2013.
  * [24] A. Molina-Markham, P. Shenoy, K. Fu, E. Cecchet, and D. Irwin.  Private memoirs of a smart meter.  In Proceedings of the 2nd ACM Workshop on Embedded Sensing Systems for Energy-Efficiency in Building, pages 61–66, New York, NY, USA, 2010\. ACM.
  * [25] H. Qu, P. Shang, X. J. Lin, and L. Sun.  Cryptanalysis of a privacy-preserving smart metering scheme using linkable anonymous credential.  IACR Cryptology ePrint Archive, 2015:1066, 2015.
  * [26] M. Stegelmann and D. Kesdogan.  Gridpriv: A smart metering architecture offering k-anonymity.  In G. Min, Y. Wu, L. C. Liu, X. Jin, S. A. Jarvis, and A. Y. Al-Dubai, editors, TrustCom, pages 419–426. IEEE Computer Society, 2012\.
  * [27] C.-M. Yu, C.-Y. Chen, S.-Y. Kuo, and H.-C. Chao.  Privacy-preserving power request in smart grid networks.  IEEE Systems Journal, 8:441–449, 2014.