# Hacktivism Goes Orbital: Investigating NB65’s Breach of ROSCOSMOS

Rajiv Thummala111PhD Student, Deptartment of Mech. and Aerospace Engineering,
124 Hoy Rd., Ithaca, NY, 14853 and Gregory Falco.222Assistant Professor,
Department of Mech. and Aerospace Engineering, 124 Hoy Rd., Ithaca, NY, 14853
Sibley School of Mech. and Aerospace Engineering, Cornell University, Ithaca,
14850, USA

###### Abstract

In March of 2022, Network battalion 65 (NB65), a hacktivist affiliate of
Anonymous, publicly asserted its successful breach of ROSCOSMOS’s satellite
imaging capabilities in response to Russia’s invasion of Ukraine. NB65
disseminated a series of primary sources as substantiation, proclaiming the
incapacitation of ROSCOSMOS’s space-based vehicle monitoring system and doxing
of related proprietary documentation. Despite the profound implications of
hacktivist incursions into the space sector, the event has garnered limited
attention due to the obscurity of technical attack vectors and ROCOSMOS’s
denial of NB65’s allegations. Through analysis of NB65’s released primary
sources of evidence, this paper uncovers the probable vulnerabilities and
exploits that enabled the alleged breach into ROSCOSMOS’s ground and space
segment. Additionally, we highlight lessons learned and the consequences this
event has for the global aerospace community.

##  1 Nomenclature

NB65 = | Network Battalion 65
---|---
CIDR = | Classless Inter-Domain Routing
ASN = | Autonomous System Number
OSINT = | Open-Source Intelligence
RCE = | Remote Code Execution
HTTP = | Hypertext Transfer Protocol
SSL = | Secure Sockets Layer
TLS = | Transport Layer Security
XSS = | Cross-Site Scripting
DDoS = | Distributed Denial of Service
GNSS = | Global Navigation Satellite System
LOG4J2 = | Apache Log4j2 Logging Framework
DNS = | Domain Name System
VMS = | Vehicle Monitoring System
API = | Application Programming Interface
CDHS = | Command and Data Handling Subsystem
SWaP = | Size, Weight, and Power
CISA = | Cybersecurity and Infrastructure Security Agency
GIS = | Geographical Information System

##  2 Introduction

Hacktivism, a portmanteau of "hack" and "activism", refers to the use of
cyberattacks to advance a political or social agenda. Hacktivists–entities
that engage in hacktivism–operate independently or in groups outside the scope
of traditional government and military structures, often portraying themselves
as populists. This form of activism has gained prominence in the digital age,
with hacktivists breaching the security of adversary systems to draw attention
and raise awareness to a cause. The anticipated escalation in the frequency of
cyberattacks attributable to hacktivism is predicated on the diminishing
technical barrier, largely driven through advents such as Cybercrime-as-a-
Service (CaaS) and the democratization of penetration testing tools. This
trend is further compounded by a growing reliance on digital infrastructure.
Such a trajectory poses a significant threat to public and private sectors as
the digital domain transforms into the primary stage for ideological
expression and conflict.

Various hacktivist groups have gained notoriety in recent times as a result of
global conflicts. As recent as October 2023, reports emerged that hacktivists
from the group "AnonGhost", who are seemingly conducting pro-Palestinian
campaigns, have been launching DDoS attacks against Israel and are attempting
to target infrastructure and APIs. The group went as far as to claim the
alleged attack on the Israeli Red Alert missile warning platform [1].
Hacktivism activity experienced a significant surge succeeding Russia’s
invasion of Ukraine in February of 2022 [2]. Legacy hacktivist collective
Anonymous was revitalized, but new groups were also formed. For instance.
Ukraine’s unprecedented IT Army, a volunteer group of hackers from around the
world, has continuously launched DDoS attacks against Russian targets. Other
hacktivist-linked groups have run doxing operations against Russian entities,
leaking hundreds of gigabytes of proprietary data [2].

In hacktivism, target selection is primarily driven by the potential for
generating maximum public attention. In preceding decades, highly visited
websites were a primary target. An early example is a website defacement
attack against the U.S. Department of Justice (DOJ) web server that dates back
to 1996. Protests were directed against the Communications Deceny Act (CDA),
in regards to its provisions for screening offensive material online.
Hacktivists reacted in a rebellious and provocative manner, adding obscene
content to the homepage of the DOJ [3]. As hacktivism evolved, however,
critical infrastructure emerged as the optimal target. For instance, in 2012,
the hacktivist group "Cutting Sword of Justice" carried out cyberattacks
against critical systems of Saudi Aramco, the world’s largest energy supplier
and national oil company of Saudi Arabia, to protest Saudi Arabia’s human
rights record [4]. Per a Waterfall Security report, in nearly every hacktivist
incident in 2022, the sole motive was to disrupt critical infrastructure or
services. Of the six total hacktivist attacks that occurred during the ongoing
conflict between Iran and Israel or the Russo-Ukraine conflict, four incidents
disrupted transportation operations and one targeted a steel mill which
resulted in a fire and equipment damage. The last hacktivist attack targeted
electric vehicle charging stations belonging to a power utility [5].

The target shift to critical infrastructure is logical, given that disrupting
these systems are likely to cause widespread panic and economic repercussions,
drawing substantial attention to the hacktivist’s cause. The symbolic
significance of critical infrastructure enables hacktivists to underscore
their contempt or political messages on a grand scale, enhancing their ability
to convey their message and ultimately provoke change. Additionally, critical
infrastructure is becoming increasingly interdependent, enabling hacktivists
to cause cascading failures across multiple systems by exploiting a single
attack vector.

CISA identifies critical infrastructure as systems and assets, both physical
and virtual, so vital to the United States that their incapacity or
destruction would have a debilitating impact on national security, economic
security, public health, or safety [6]. This designation spans a broad
spectrum, including sectors such as energy, transportation, water, healthcare,
and communication. While the National Cybersecurity Standard and the Cyber
Incident Reporting for Critical Infrastructure Act of 2022 mandate security
practices and protocols for designated critical infrastructure by CISA, there
exists a vulnerability in the realm of uncodified or undesignated critical
infrastructure, which leave certain integral sectors or systems outside the
prescribed security requirements. These systems, though not designated as
critical infrastructure by CISA, could still possess the capability to cause
catastrophic damage if breached. Space systems serve as a notable example of
this phenomenon. While not officially designated as critical infrastructure by
CISA, it is undeniable that various critical functionalities such as SATCOM,
space-based nuclear radiation detection, and weather forecasting are dependent
on space systems. Hacktivists may view space vehicles as potent symbols of
technological reliance, making them attractive targets to amplify their
messages or create widespread disruptions. The space domain, relatively
uncharted territory for cyber-defense and unregulated by CISA, provides
hacktivists with an environment where vulnerabilities may be more exploitable,
and attacks may have a higher likelihood of success and attention.

In this work, we analyze and document the first potential instance of
hacktivism against satellites in history. On March 1st, 2022, hacktivist
collective Network Battalion-65 claimed to have successfully executed a
cyberattack against The State Corporation for Space Activities (ROSCOSMOS),
the Russian equivalent of NASA, in response to the Russia’s invasion of
Ukraine. NB65 proceeded to release various screen-captures as evidence, but
did not reveal attack vectors nor substantive technical details. Media outlets
such as Newsweek reported that "it is unclear exactly how NB65 carried out the
attacks" and that they could not verify them [7].

Through open-source analysis of NB65’s released screen captures, we identified
a vulnerability within ROSCOSMOS’s ground segment and the corresponding
exploit that likely facilitated NB65’s execution of the alleged attack.
Leveraging this information, we present an estimated cyber kill chain that
unveils the sequential steps taken by NB65 to breach ROSCOSMOS’s space-based
vehicle monitoring system. Our findings address the previously limited
technical details published by media outlets and security advisories following
this event, contributing valuable insight into the rapidly evolving threat
landscape of cyberattacks in the space domain.

###  2.1 Network Battalion-65

Network Battalion 65, also recognized as NB65, operates as a hacktivist group
affiliated with the decentralized Anonymous collective. The organization has
garnered recent attention for its activities directed at Russian state-owned
and affiliated institutions, in response to the Russian invasion of Ukraine.
Some of their operations include breaches into IP cameras and several SCADA
systems. Beyond attacks on critical infrastructure, NB65 has become notorious
for targeting Russian organizations with data leak operations and ransomware
attacks [8]. In late March of 2022, NB65 allegedly attacked the All-Russia
State Television and Radio Broadcasting Company (VGTRK), resulting in the
encryption of 786.2 GB of data, comprising 900,000 emails and 4,000 files [9].
Other Russian organizations NB65 has attacked include the document management
operator Tensor, gas pipeline construction company SSK Gazregion LLC, and
payment processor Qiwi [10].

##  3 Primary Source Analysis

On March 1st, 2022, NB65 asserted on X (formerly known as Twitter) that they
had compromised ROSCOSMOS’s satellite imaging capabilities, including a
vehicle monitoring system. As featured in figure 1, NB65 claimed to have
"deleted the WS02, rotated credentials, and shut down a server".

"WSO2" in this context likely refers to the open-source integration platform
that provide solutions for API management, identity and access management
(IAM), and other middleware functionalities [11]. The utility of a WSO2 in the
context of controlling a satellite would likely be for integrating various IT
and software services in the ground segment. While further context is not
provided (i.e.: redundancy measures, configuration, use-case, etc.), it can be
conjectured that deleting the WSO2 would likely disrupt the satellite’s
ability to manage APIs, identities, or other integration services. The
inability to manage APIs is likely to result in the disabling of IPC within
the satellite. Embedded systems such as space vehicle’s are especially
dependent on IPC in contrast to conventional systems due to need for
integrating heterogeneous components. Ensuring communication between these
components is needed to remediate SWaP constraints and enable multi-agent
coordination for a specific task. Breaching the WSO2 would therefore likely
result in the compartmentalization of software and disable various critical
functions for the satellite. Furthermore, configuration settings, security
policies, and other elements related to API management would be lost.

In the context of a ground station, IAM would involve controlling and managing
user access to various resources within the satellite’s network, CDHS,
payloads, and/or computing environment. If IAM was breached as a result of
deleting the WSO2, the satellite would likely lose its ability to verify the
identities of users or other systems, leading to potential security
vulnerabilities and cyberattacks. Additionally, access controls and
permissions might be compromised, allowing unauthorized entities to gain
access to sensitive information or functions. In the context of a VMS, this
could range from gleaning sensitive payload information to performing
unauthorized tasking.

The rotation of credentials refers to a security practice where passwords, API
keys, or other access credentials are changed regularly to reduce the risk of
unauthorized access. In this context, rotating credentials infers that NB65
changed the access credentials associated with the VMS, exacerbating the
ability for ROSCOSMOS to regain control. Consequences of "shutting down the
server" vary depending on its configuration. In general, servers utilized in
ground segments perform and facilitate the storage, processing, and
dissemination of data gleaned by the satellite. Considering NB65’s claims that
they "deleted various files across the server" this would likely refer to
stored and processed VMS data which would have been prepared to disseminate to
customers.

This approach is reminiscent of the February 2022 cyberattack on Viasat, which
only occurred one month prior to the purported NB65 attack on ROSCOSMOS. Black
hat actors targeting Viasat initially gained access to a management server and
then a network operations server. Succeeding reconnaissance efforts, they
gained accessed to Viasat’s FTP server (used for delivering software updates
to modems) and deployed a wiper binary to purge flash memory across modems
[12]. The significance of this synchronicity is discussed in section VI.

Figure 1: NB65’s Manifesto (March 1st, 2022) [13]

Fig. 2 WSO2 Identity Server Registry Browser [14]

Fig. 3 WSO2 Enterprise Integrator Home [15]

Fig. 4 WSO2 Identity Server Management Console - Shutdown/Restart [16]

The screen-captures featured in figure’s 2, 3, 4, 5, and 6 were released
shortly after figure 1. Based on each of the user interfaces, it can be
asserted that Roscosmos was employing WSO2’s identity server management
software and enterprise integrator. Figure 2, which appears to exhibit access
to the interface of the WSO2 registry browser, could lead to severe
consequences considering NB65 had write access. The registry browser is a
critical component of the WSO2 Identity Server, as it provides the ability to
view contents of the registry and perform various operations such as creating,
editing, and deleting resources. Various attacks that NB65 could have executed
include stealing user credentials, modifying access permissions and
configuration settings, malware deployment, and installation of backdoors to
enable persistence. In regards to the space segment, if the registry browser
is configured to store predefined instructions for commands, NB65 could
manipulate these instructions to perform malicious uplinks.

Figure 3 initially appears to be either the home screen of the WSO2 identity
server or enterprise integrator as they share the same user interface. Based
on the repository location, however, it can be asserted that this is an
enterprise integrator due to the presence of "wso2ei" in the ’/opt’ directory.
The WSO2 enterprise integrator is an integration platform that helps
enterprises connect disparate systems, applications, and data sources. Utility
for this software in the ground segment would likely be for linking satellite
telemetry systems (real-time data collection and routing), command and control
systems, and enterprise resource planning systems. The enterprise integrator
could also have been used to transform data into a format that can be easily
interpreted and analyzed by other applications. The 6.1.1 version provides key
insight into the vulnerability that likely enabled this attack. According to
the WSO2 support matrix, WSO2 Enterprise Integrator 6.1.1 was released on May
04, 2017. The latest version of WSO2 Enterprise Integrator, 7.1.0, was
released on August 12, 2020, more than a year and a half before the NB65
attack. Failure to update to the latest version of WSO2 would have exposed
ROSCOSMOS to vulnerabilities, which is discussed at the end of this section.
The operating system user section is assumed to be the main data NB65 sought
to parade with this screen-capture. Both the home directory and user account
appear to have root access privileges, indicating that NB65 had administrator-
level control over the WSO2. Thus, this suggests that NB65 possessed the
potential to execute a range of unauthorized operations within the functional
scope of the WSO2 platform.

Figure 4 illustrates the server management console’s shutdown/restart page,
suggesting NB65’s intention to convey their ability to initiate server
shutdown or restart operations. The ramifications of shutting down or
restarting the server include denial of service to the satellite, disruptions
of processing capabilities, enabling malicious software updates, and disabling
dependent 3rd-party assets and services. Figure 5 features a screen-capture of
a supposed login screen for the Vehicle Monitoring System, which if
authenticated could potentially enable tasking. Translations into English are
denoted by double asterisks (**) and were provided by the authors of this
paper, not NB65. The implications of this capability would be menacing,
ranging from the capability to induce kinetic effects (collisions,
conjunctions, etc.), initiating re-entry, and installing malware (backdoors,
rootkits, ransomware [17], spyware, etc.). It is also possible that this
application is merely GIS software with no tasking capabilities, but could be
exploited by altering image classification algorithms and gleaning tasking
history as well as planned passes. The precise extent of damage potential is
dependent on the capabilities of the VMS application.

Fig. 5 Vehicle Monitoring System [18]

Fig. 6 Internet Routing Registry [19]

Figure 6 features metadata from an internet routing registry (IRR). The
notation 185.156.0.0/22AS202594 denotes a specific IP address range using the
CIDR format which appears to be associated with "Russian Space Systems Main".
The IP address range begins at "185.156.0.0" and the "/22" indicates a subnet
mask of 22 bits, defining the network portion of the address. This implies
that the range spans from "185.156.0.0" to "185.156.3.255", encompassing
various host addresses. Additionally, the notation includes the Autonomous
System Number (ASN) "AS202594", signifying that these IP addresses are part of
a collection of IP networks and routers operated by a single organization. The
source is stated as "RIPE", which stands for Réseaux IP Européens and
translates to "European IP Networks" in English. RIPE is one of the Regional
Internet Registries (RIRs) worldwide [20]. These organizations are responsible
for the allocation and registration of IP address space, the administration of
ASNs, and other internet-related resources within their respective regions.
This indicates that the information about the IP address has been sourced from
RIPE NCC, and RIPE is the authoritative entity for managing that particular
resource. Utilizing the IP address provided in the CIDR format, we performed
an IP lookup to see if we could validate the authenticity of this information
and glean more relevant material. Data from this lookup is depicted in figures
7 and 8. The listed domains were interpreted to be supplementary applications
that ROSCOSMOS engages for various functionalities. We pinged these domains
and they appeared to be reachable. 2 peers and upstream providers were found
for the featured ASNs (not pictured) which were JSC Mastertel (AS29226) and
LLC Nauka-Svyaz (AS8641), indicating that ROSCOSMOS was engaging these
providers for internet connectivity or telecom. 2 specific uplinks were
listed, which were Mastertel and RT-Comm (radiotelephone communication).

Customers were found in the WHOIS report, which are other networks or entities
that are connected to and receive services from the autonomous system. In this
case, the sole customer was GTNT, a Russian telecommunications company that
provides mobile satellite services in Russia. It is the official partner of
Thuraya Telecommunications Company, a leading international mobile satellite
operator. We discovered details regarding the domain owner, however, we
deliberately excluded it from this paper for privacy concerns. NB65 is certain
to have had further insight into the network and domain configurations of the
ROSCOSMOS enterprise, indicating vulnerability to active and passive network
reconnaissance.

Fig. 7 IP Lookup Part 1

Fig. 8 IP Lookup part 2

On March 2nd, 2022, one day after NB65’s claimed attack, Dmitry
Rogozin–director general of Roscosmos (ret. July 2022)–took to X to refute
NB65’s claims. Rogozin claimed, "The information of these scammers and petty
swindlers is not true. All our space activity control centers are operating
normally [21]." He followed up the post with an image of the Ukrainian actor
Mikhail Vodyanoy in the 1967 film "Wedding in Malinovka" with the caption
"Typical Ukrainian Hacker". Figures 9, 10, and 11 were published by NB65 on
March 18th, 2022, 17 days after their initial publications, in response to
Rogozin’s claims on March 2nd. As seen in figure 9, NB65 retaliated to
Rogozin’s claims by doxing proprietary manuals, internal processes, and
administration work. They also claimed to have leaked unreleased data from the
Solar Observatory at ITSP SB RAS". The Solar Observatory ISTP SB RAS is a
research facility of the Institute of Solar-Terrestrial Physics of Siberian
Branch of Russian Academy of Sciences (ISTP SB RAS) located near the
settlement of Mondy in Buryatia, Russia. It is one of the world’s leading
observatories for studying solar activity and its effects on the Earth’s
atmosphere and magnetosphere. The link under "targets" led to the main page of
the ISTP SB RAS.

Analyzing the target site, we found it to exhibit inadequate security
measures, making it susceptible to various attacks. Despite prompting users to
authenticate themselves, the site relied on HTTP without an SSL/TLS
certificate, posing a potential risk to the confidentiality of user
credentials. Additionally, the website’s software was outdated, running on PHP
version 7.4.6, and the PHP version was inadvertently disclosed through HTTP
headers. Furthermore, the absence of an application firewall left the site
vulnerable to DDoS and XSS attacks. It also lacked a security header to
protect against clickjacking and content-type sniffing, and there was no
content-security-policy directive in place. Our analysis of the site was
passive and is therefore limited in scope. Based on the lack of rudimentary
security protocols, the site is likely to be vulnerable to various OWASP Top
10 security risks. Given that these vulnerabilities were identified more than
a year after NB65’s publication of figure 9, we have high confidence that NB65
would have been able to breach this site.

The loot mentioned in figure 9, supposedly of proprietary materials, could not
be verified nor analyzed as the link is no longer valid. The notice states
that either "the folder link has been removed as it violated our terms of
service" or "the folder link has been disabled by the user". Whether NB65 took
down the link or mega.nz identified genuine doxing and proceeded to take down
the folder could not be determined. Figure 10 features what is interpreted to
be the alleged loot. In addition to a folder of solar observatory data, there
are installations and manuals for the VMS client which was also referenced in
figure 5. This indicates that the solar observatory data may have been
utilized by the vehicle monitoring system in some capacity. It is also
possible that "VMS" in VMS client stands for another acronym such as Vendor
Management System.

Figure 11 features what is interpreted to be a breached Linux desktop. The
file VMS-client.jar is a Java Archive (JAR) file and is likely a shortcut to
the VMS client application pictured in figure 5. JAR files are used to store
Java programs and libraries in a single file. Further substantiating this
prediction is the _start.bat file to the left of the VMS-Client.jar shortcut.
The file "startup.bat" is typically a batch file utilized on Windows systems
to execute a series of commands or operations during the startup of a program
or system. In the context of Java applications, it is common to find
"startup.bat" files associated with server applications, such as those based
on Java EE (Enterprise Edition) or Java Servlet technology. This file may have
been used to initiate the VMS-client server. Splash.jpg, based on standard
naming convention, was employed for a splash page–also known colloquially as a
loading screen. After extracting this logo from figure 11, we performed a
reverse image search to identify its source. We were led to multiple sources,
most of which when translated were titled “Russian Space Systems JSC”. The
Department of State’s comments regarding this entity is highlighted as
follows: “Joint Stock Company Rossiyskiye Kosmicheskiye Sistemy (Russian Space
Systems JSC), a Russian space instrument building corporation, carries out
activities to implement Russia’s state defense order. Russian Space Systems
JSC is involved in Russia’s import substitution program in the context of
Russia’s state defense order as well as associated space engineering
activities. Russian Space Systems JSC has also been involved with Russian
missile-related activities. As additional information, Russian Space Systems
JSC has supported Russian government space systems that the Russian military
uses to perpetrate its war against Ukraine” [22]. It can therefore be assumed
that Russian Space Systems JSC partnered with ROSCOSMOS on the VMS.
Main_icon.png features the logo of the Research Institute of Precision
Instruments (RI PI), a Russian company that manufactures antennas,
transmitters, receivers and computing facilities. RI PI provides various
services for spacecraft radio control and docking, data acquisition, satellite
data processing, transmission of satellite data, radar monitoring of the
Earth, and low-orbit satellite communications systems. We can assume that the
VMS was also engaging RI PI’s services for certain functionalities. Header.jpg
features a logo with text that translates to "monitoring". The exact
organization this image corresponds to could not be readily identified,
however, the text on the left image translates to "KAYA" which may aid future
investigations. It is possible that KAYA could be referencing KAYA Instruments
[23], which develops industrial vision and traffic inspection solutions.

The most important information in this screen-capture is the log4j.properties
file. The log4j.properties file is a configuration file for the Log4j2 logging
framework and is utilized to define the behavior of Java-based applications.
In this context, we assume the Java-based application to be the VMS
application featured in figure 5. While the file is not inherently malicious,
it can be used by attackers to exploit the Log4j2 RCE vulnerability and
execute arbitrary code on vulnerable systems. The remaining information in the
screen capture is mostly trivial and/or covered in other screen captures
provided by NB65. This suggests that the log4j.properties file may have been
the key element NB65 wanted to convey. The Log4j2 RCE vulnerability arose in
December of 2021, only 3 months preceding NB65’s claimed attack. In fact,
according to WSO2’s security and compliance documentation [24], a Log4j2 zero-
day vulnerability notice (CVE-2021-44228 / CVE-2021-45046 / CVE-2021-45105)
was published on December 13, 2021, stating that WSO2 had been impacted and
that customer actions were required. Impacted WSO2 Products and Deployments
included WSO2 Identity Server 5.9.0 and above and WSO2 Enterprise Integrator
6.1.0 and above. While the version of the Identity Server was not provided by
NB65, the Enterprise Integrator version was listed in figure 3 as 6.1.1. This
indicates that the Enterprise Integrator version ROSCOSMOS was utilizing was
freshly vulnerable to the Log4j2 RCE vulnerability at the height of its
exploitation. A temporary patch for the vulnerability was provided in the
security and compliance documentation for affected versions in the December
13th notice. ROSCOSMOS likely failed to actively persist with patches for
their WSO2 software, given that they were multiple versions behind (6.1.1 vs
7.1.0). Utilizing the Log4j2 RCE exploit, NB65 would have been able to gain
root access, delete the WSO2, rotate credentials, and gain the ability to shut
down the server. It is also possible that NB65 deployed their flagship
variation of the Conti ransomware, which was utilized in various attacks
succeeding the attack on ROSCOSMOS, to delete the WSO2 [10].

Fig. 9 NB65 Response to Rogozin (March 18th, 2022) [13]

Fig. 10 Purported Leaked ROSCOSMOS Materials [25]

Fig. 11 Breached ROSCOSMOS Desktop [26]

##  4 Cyber Kill Chain

Based on the preceding analysis, an estimated cyber kill chain for NB65’s
breach of ROSCOSMOS is enumerated as follows:

###  4.1 Reconnaissance

First, NB65 utilizes OSINT methods to glean information regarding ROSCOSMOS’s
network infrastructure, domain names, IP addresses, and subdomains. This
information is obtained through DNS queries, WHOIS lookups, and other
footprinting techniques to build a profile of ROSCOSMOS’s online presence and
ground segment.

NB65 subsequently identifies open ports on a target system in the ground
segment. Active and passive scans indicate that ROSCOSMOS is operating a VMS,
is utilizing outdated WSO2 services, and is leveraging Apache Log4j2. This
analysis is compounded with network mapping to architect ROSCOSMOS’s IT
environment, identify active devices, configurations, and providers.

###  4.2 Weaponization

NB65 explores the potential deployment of the Log4j2 Remote Code Execution
(RCE) exploit against the outdated WSO2 Enterprise Integrator. This effort is
informed by the contemporary notoriety of the Log4j2 RCE exploit and NB65’s
awareness of the log4j.properties file used for logging within WSO2.
Furthermore, security reports concerning WSO2’s vulnerabilities and the
imperative to patch the service had been circulating for 3.5 months prior to
NB65’s actions. Recognizing that the WSO2 Enterprise Integrator in use by
ROSCOSMOS is susceptible to the Log4j2 RCE vulnerability, NB65 formulates a
method to interact with the Log4j2 logging system and develops a payload to
exploit the gained RCE capability.

###  4.3 Delivery

NB65 engages the Log4j2 logging system, exploiting its vulnerability to the
Log4j2 RCE exploit to gain unauthorized access to ROSCOSMOS’s WSO2
environment.

###  4.4 Detonation

NB65 performs unauthorized RCE to purge the WSO2, rotate credentials, shutdown
the server, and escalate access for control over the VMS.

###  4.5 Installation

Malware is installed to enable persistence, such as backdoors, rootkits, and
spyware.

###  4.6 Command and Control

NB65 disrupts access to the space-based Vehicle Monitoring System (VMS),
achieving this by compromising either the VMS client or application.
Subsequently, they perform unauthorized data exfiltration, retrieving
proprietary information such as manuals related to the VMS and solar
observatory data.

###  4.7 Act on Objectives

NB65 publicizes the alleged success of their attack and provides various
screen captures of the breach as evidence.

##  5 Validity of Claims

We acknowledge that there is a considerable lack of validity and reliability
in NB65’s claims and released evidence. It is possible that NB65 doctored the
published screenshots to draw attention. This is especially true of items such
as figure 4 which feature no personalized or proprietary information that can
be related back to ROSCOSMOS. It is also important to reiterate that ROSCOSMOS
denied the claims of NB65, stating that their systems were functioning as
intended. According to Interfax news agency, Roscosmos head Dmitry Rogozin
denied media reports that Russian satellite control centres had already been
hacked amid Moscow’s invasion of Ukraine, while warning against any attempts
to do so. He further stated that "offlining the satellites of any country is
actually a casus belli, a cause for war" [27]. However, we also note that
Qiwi, an organization that NB65 had been proven to attack successfully, had
also denied NB65’s claims of attack [28]. Other points of contention are that
NB65 claimed to have leaked Kasepersky’s source code, but the so-called leak
contained only information about Kaspersky that is or at some point was
already publicly available [29]. Despite the assurance of damage NB65 may or
may not have inflicted, the consequences of this event for global space
security are significant and are discussed in the following section.

##  6 Consequences of this Event for Global Space Security

NB65’s attack on ROSCOSMOS is momentous, given that it is one of the first
potential documented instances of hacktivism against satellites. Following
this attack, various other hacktivist organizations have also sought to attack
space-based assets such as the pro-Ukranian group OneFist, who claimed to have
penetrated Gonets, a Russian low Earth orbit (LEO) satellite communications
network, deleting a database that is crucial to its functioning [30]. In April
of 2023, a pro-Palestinian hacktivist group known as GhostSec claimed to have
targeted Israel’s satellite GNSS receivers [31].

These incidents highlight a concerning trend as hacktivism expands its reach
into the space sector, posing significant challenges to the integrity and
security of satellite systems. As the world becomes increasingly dependent on
space-based technologies for critical functions, the space sector has become a
prime target for malicious actors. The purported breach orchestrated by NB65
serves as a significant warning to aerospace organizations that they are not
immune to the rising threat of hacktivism. While this incident raises concerns
about fortifying ground-based infrastructure critical to space vehicles, it
also introduces the potential for malicious actors to execute harmful uplinks
with the capability to cause physical damage. While the validity of NB65’s
attack remains unconfirmed, performing the Log4j2 RCE exploit on a command and
control system for a space vehicle could have catastrophic consequences
unprecedented in the space sector.

This breach emphasizes the importance of securing all components of the space
ecosystem from cyberattacks through active software updates, patch management,
and comprehensive vulnerability assessments to identify and mitigate potential
threats promptly. The compromise of third-party software, exemplified in this
case with the WSO2 Enterprise Integrator and Identity Server, highlights the
need for vigilance in managing dependencies in external software components
and timely patching of vulnerabilities—a persisting issue in the space
cybersecurity domain, as evidenced by the February 2022 attack on Viasat [12].

Redundancy measures must be implemented to ensure that critical functions
offered by space vehicles can persist in the event of a cyberattack. This
includes the integration of backup systems, alternative links, and air-gapped
ground segments. As the world’s reliance on space technologies continues to
grow, it is essential for the space industry, governments, and cybersecurity
experts to work collaboratively to fortify the security of space assets. This
includes investing in research and development to create resilient and secure
satellite systems [32], establishing international standards for space
cybersecurity [33], and promoting best practices for mitigating cyber threats
in the space domain.

## References

  * Newman [2023] Newman, L. H., “Activist Hackers Are Racing Into the Israel-Hamas War—for Both Sides,” _Wired_ , 2023.  URL https://www.wired.com/story/israel-hamas-war-hacktivism/.
  * Burgess [2022] Burgess, M., “Hacktivism Is Back and Messier Than Ever,” _Wired_ , 2022.  URL https://www.wired.com/story/hacktivism-russia-ukraine-ddos/.
  * noa [2023a] “Virus Bulletin :: VB2017 preview: Hacktivism and website defacement: motivations, capabilities and potential threats,” , 2023a.  URL https://www.virusbulletin.com/blog/2017/09/vb2017-preview-hacktivism-and-website-defacement-motivations-capabilities-and-potential-threats/.
  * Sadjadpour [2018] Sadjadpour, C. A., Karim, “Iran’s Cyber Threat: Espionage, Sabotage, and Revenge,” , 2018.  URL https://carnegieendowment.org/2018/01/04/iran-s-cyber-threat-espionage-sabotage-and-revenge-pub-75134.
  * noa [2023b] “High-Impact Attacks On Critical Infrastructure Climb 140%,” , 2023b.  URL https://securityintelligence.com/news/high-impact-attacks-on-critical-infrastructure-climb-140/.
  * Content [2023] Content, C., “critical infrastructure - Glossary | CSRC,” , 2023.  URL https://csrc.nist.gov/glossary/term/critical_infrastructure.
  * Reporter [2022] Reporter, E. B., “Roscosmos Head Rejects Anonymous Claim That Russian Satellites Were Hacked,” , Mar. 2022.  URL https://www.newsweek.com/roscosmos-head-dmitry-rogozin-anonymous-russian-satellite-hack-1684033.
  * Labs [2022] Labs, F. V., “Hacktivist Attacks: Who They Target, What They Target and How,” , Dec. 2022.  URL https://www.forescout.com/blog/the-increasing-threat-posed-by-hacktivist-attacks-an-analysis-of-targeted-organizations-devices-and-ttps/.
  * Horne [2022] Horne, L. B., “Release: VGTRK (786.2 GB),” , Apr. 2022.  URL https://ddosecrets.substack.com/p/release-vgtrk-7862-gb.
  * noa [2022a] “Hackers use Conti’s leaked ransomware to attack Russian companies,” , 2022a.  URL https://www.bleepingcomputer.com/news/security/hackers-use-contis-leaked-ransomware-to-attack-russian-companies/.
  * noa [2023c] “What is WSO2?” , 2023c.  URL https://www.techtarget.com/searchapparchitecture/definition/WSO2.
  * Boschetti et al. [2022] Boschetti, N., Gordon, N. G., and Falco, G., “Space Cybersecurity Lessons Learned from the ViaSat Cyberattack,” _ASCEND 2022_ , American Institute of Aeronautics and Astronautics, Las Vegas, Nevada & Online, 2022.  10.2514/6.2022-4380, URL https://arc.aiaa.org/doi/10.2514/6.2022-4380.
  * noa [2022b] “https://twitter.com/xxNB65/status/1498563301525102594,” , 2022b.
  * noa [2022c] “X,” , 2022c.  URL https://twitter.com/xxnb65/status/1498563590873300993/photo/1.
  * noa [2022d] “X,” , 2022d.  URL https://twitter.com/xxnb65/status/1498563590873300993/photo/2.
  * noa [2022e] “X,” , 2022e.  URL https://twitter.com/xxnb65/status/1498563590873300993/photo/3.
  * Falco et al. [2023] Falco, G., Thummala, R., and Kubadia, A., “WannaFly: An Approach to Satellite Ransomware,” _2023 IEEE 9th International Conference on Space Mission Challenges for Information Technology (SMC-IT)_ , 2023, pp. 84–93.  10.1109/SMC-IT56444.2023.00018, URL https://ieeexplore.ieee.org/document/10207354, iSSN: 2836-4171.
  * noa [2022f] “X,” , 2022f.  URL https://twitter.com/xxnb65/status/1498563590873300993/photo/4.
  * noa [2022g] “X,” , 2022g.  URL https://twitter.com/xxnb65/status/1498563748226809861/photo/1.
  * feb [2023] “The Internet Registry System,” , 2023.  URL https://www.ripe.net/participate/internet-governance/internet-technical-community/the-rir-system/the-regional-internet-registry-system.
  * noa [2022h] “https://twitter.com/Rogozin/status/1498903566135832577,” , 2022h.
  * noa [2023d] “Targeting Russia’s Senior Officials, Defense Industrial Base, and Human Rights Abusers,” , 2023d.  URL https://www.state.gov/targeting-russias-senior-officials-defense-industrial-base-and-human-rights-abusers/.
  * noa [2023e] “KAYA Instruments - Everything You Need for Your Vision System,” , 2023e.  URL https://kayainstruments.com/.
  * noa [2021] “Log4j2 zero-day vulnerability (CVE-2021-44228 / CVE-2021-45046 / CVE-2021-45105),” , 2021.  URL https://security.docs.wso2.com/en/latest/security-announcements/incident-clarifications/2021/log4j2-zero-day-vulnerability_CVE-2021-44228_CVE-2021-45046_CVE-2021-45105/#impact-on-wso2-products-and-deployments.
  * noa [2022i] “X,” , 2022i.  URL https://twitter.com/xxNB65/status/1504937871882563584/photo/1.
  * noa [2022j] “X,” , 2022j.  URL https://twitter.com/xxnb65/status/1504937871882563584/photo/2.
  * noa [2022k] “Russia space agency head says satellite hacking would justify war -report,” _Reuters_ , 2022k.  URL https://www.reuters.com/world/russia-space-agency-head-says-satellite-hacking-would-justify-war-report-2022-03-02/.
  * Arsdale [2023] Arsdale, C. v., “From the Labs: YARA Rule for Detecting NB65,” , 2023.  URL https://www.reversinglabs.com/from-the-labs/from-the-labs-yara-rule-for-detecting-nb65.
  * Lapienytė [2023] Lapienytė, “Long-awaited Kaspersky leak doesn’t seem to be a leak at all,” , 2023.  URL https://cybernews.com/cyber-war/long-awaited-kaspersky-leak-doesnt-seem-to-be-a-leak-at-all/.
  * Petkauskas [2023] Petkauskas, “We breached Russian satellite network, say pro-Ukraine partisans,” , 2023.  URL https://cybernews.com/cyber-war/we-breached-russian-satellite-network-say-pro-ukraine-partisans/.
  * Ghost [2023] Ghost, “Israel Satellite and water pumps HACKED ~GhostSec,” , Apr. 2023.  URL https://telegra.ph/Israel-Satellite-and-water-pumps-HACKED-GhostSec-04-06.
  * Finke et al. [2023] Finke, J., Thummala, R., Elbasheer, R., Hansen, P., Henry, W., Mamula, D., Noor, A. M., York, T., Zheng, K., and Falco, G., “Satellite Cybersecurity Testbed to Improve Commercial Space Security,” _ASCEND 2023_ , American Institute of Aeronautics and Astronautics, Las Vegas, Nevada, 2023.  10.2514/6.2023-4768, URL https://arc.aiaa.org/doi/10.2514/6.2023-4768.
  * noa [2023f] “IEEE Standards Association,” , 2023f.  URL https://standards.ieee.org.


# A 50–spin surface acoustic wave Ising machine

Artem Litvinenko1∗, Roman Khymyn1, Roman Ovcharov1 and Johan Åkerman1,2,3∗
1Department of Physics, University of Gothenburg, Fysikgränd 3, 412 96
Gothenburg, Sweden
2Center for Science and Innovation in Spintronics, Tohoku University, 2-1-1
Katahira,
Aoba-ku, Sendai, 980-8577, Japan
3Research Institute of Electrical Communication, Tohoku University, 2-1-1
Katahira,
Aoba-ku, Sendai 980-8577 Japan

∗To whom correspondence should be addressed; E-mails:
<EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

Time-multiplexed Spinwave Ising Machines (SWIMs) have unveiled a route towards
miniaturized, low-cost, and low-power solvers of combinatorial optimization
problems. While the number of supported spins is limited by the nonlinearity
of the spinwave dispersion, other collective excitations, such as surface
acoustic waves (SAWs), offer a linear dispersion. Here, we demonstrate an all-
to-all, fully FPGA reprogrammable, 50-spin surface acoustic wave-based Ising
machine (SAWIM), using a 50-mm-long Lithium Niobate SAW delay line, off-the-
shelf microwave components, and a low-cost FPGA. The SAWIM can solve any
50-spin MAX-CUT problem, with arbitrary coupling matrices, in less than 340
$\mu$s consuming only 0.62 mJ, corresponding to close to 3000 solutions per
second and a figure of merit of 1610 solutions/W/s. We compare the SAWIM
computational results with those of a 100-spin optical Coherent Ising machine
and find a higher probability of solution. Moreover, we demonstrate that there
is an optimum overall coupling strength between spins at which the probability
of the exact solution reaches 100%. The SAWIM illustrates the general merits
of solid state wave-based time-multiplexed Ising machines in the microwave
domain as versatile platforms for commercially feasible high-performance
solvers of combinatorial optimization problems.

## Introduction

Rapid and energy-efficient solvers of combinatorial optimization problems are
essential for numerous application within finance [1], circuit design [2],
drug discovery [3], operations [4], and scheduling [5]. Many combinatorial
problems are nondeterministic polynomial time (NP)–hard, or NP-complete,
problems [6] with a time-to-solution parameter that scales exponentially with
problem size ($N$) when solved with classical von Neumann architectures.
Although approximations and heuristic methods [7] allow for significant
acceleration, the exponential scaling represents a monumental challenge from
both hardware and algorithm perspectives. Fortunately, solving these problems
can be effectively accelerated by mapping them onto analog Ising machines
whose time-to-solution scales as $\sqrt{N}$ [8].

Analog Ising machines (IM) have experienced dramatic progress in the recent
decade, with a large number of successful novel implementations [8] that can
be separated into two main architectures: _i_) physical arrays of Ising spins
[9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19], and _ii_) time-multiplexed Ising
machines [20, 21, 22, 23, 24, 25, 26, 27, 28, 29] based on propagating phase-
binarized pulses. While IMs based on the physical array architecture provide
the fastest time-to-solution parameter in simulations [9, 10, 13], their
computational capacity is strongly hampered by their limited connectivity due
to interconnection problems. The connectivity bottle-neck was removed by the
optical Coherent Ising machine that pioneered a time-multiplexed architecture
where Ising spins are represented by propagating light pulses. Time-
multiplexing allows for all-to-all connections between spins via external
analog or digital schemes and allowed CIMs to successfully demonstrate
continuous growth in the number of supported spins from 4 to a record 100,000
spins [27, 22, 21, 20]. Nevertheless, despite this impressive scalability,
CIMs remain limited to laboratory demonstrations due to their large physical
size, high power consumption, poor temperature stability, and cost.

These issues were recently addressed in the design of a Spinwave Ising Machine
(SWIM) [30, 31] where the Ising spins were represented by spinwave radio-
pulses propagating at orders of magnitude slower speeds of km/s. Their reduced
speed and low central frequency allowed for a dramatic miniaturization to mm
dimensions and a much improved frequency stability. Here, we further push the
concept of IMs based on solid-state collective excitations by demonstrating a
time-multiplexed surface acoustic wave-based Ising Machine (SAWIM). The main
limitation of the number of spins in SWIM was the nonlinearity of the spinwave
dispersion [32] that leads to a non-constant delay time within the spinwave
generation bandwidth, and significant pulse broadening towards the end of the
delay line. In contrast, the SAW dispersion is intrinsically linear over a
wide range of frequencies and amplitudes, which removes any significant
broadening of the propagating SAW pulses. Altogether, the use of SAWs opens a
path for miniature, low-power, and low-cost time-multiplexed Ising machines
with all-to-all connectivity solving large-scale arbitrary combinatorial
problems.

## Surface Acoustic Waves

Surface acoustic waves (SAWs), first described by Lord Rayleigh [33], are a
family of well-studied mechanical waves [34] propagating along the surface of
a solid material and confined to a depth of about one wavelength. SAW devices
typically employ piezoelectric materials, such as lithium niobate (LiNbO3), as
this allows for straightforward electrical transduction. The propagation of
SAWs along a delay line can be described using a simple wave equation:

$\frac{\partial^{2}u(x,t)}{\partial
t^{2}}=v^{2}\frac{\partial^{2}u(x,t)}{\partial x^{2}}+S(x,t)$ (1)

where $v$ is the phase velocity of the surface wave, $u(x,t)$ the
displacement, and $S(x,t)$ a source term representing _e.g._ an interdigital
transducer (IDT) [35, 36, 37]. The very simple and linear SAW dispersion,
$v=2\pi f/\lambda$, where $f$ is the frequency and $\lambda$ the wavelength,
ensures that microwave SAW pulses propagate without broadening. Their minimum
duration is hence directly defined by the SAW bandwidth.

## The Surface Acoustic Wave Ising Machine

Figure 1a shows a schematic of the SAWIM. The core is a SAW delay line with a
12 $\mu$s delay time, a total deviation of $\Delta\tau_{delay}=$ 45 ns, and a
3-dB bandwidth of 100 MHz. Altogether, this allows for excitation and
detection of microwave pulses of 45 ns duration without dispersion-related
distortions. However, the resonance mechanism of phase-sensitive amplification
requires at least 10–20 periods per pulse, which imposes a stronger limitation
of 30–60 ns on the minimum pulse duration. Thus, the maximum number of
artificial Ising spins supported by the main ring circuit is 100–200, assuming
a 50% duty cycle. To simplify the measurement and the feedback circuit, we use
a radio-frequency to intermediate frequency (RF/IF) Gain and Phase Detector
AD8302, which has a phase output response time of 50-70 ns. For unambiguous
readings from the phase detector, we allowed a pulse duration of 100 ns, which
further reduces the number of spins to 58, where 50 spins are fully
interconnected Ising spins, and the remaining eight propagating SAW pulses are
used for an additional delay needed for the measurement and feedback system.

Figure 1: The surface acoustic wave Ising machine (SAWIM). (a) SAWIM
schematic: LiNbO3 is a substrate of the SAW delay line. Coupler 1 is used to
deflect -15 dB of the propagating RF pulses to a Phase Detector. PSA is a
parametric phase sensitive amplifier. LA is a microwave linear amplifier.
Attenuator 2 is used to control the overamplification in the loop. Switch is
forming 58 RF propagating pulses within 12$\mu s$ round trip time in the loop
and has a control square signal with a frequency of 4.829 MHz and 50% duty
cycle. $\omega_{ref}$ is a reference signal of 320.118 MHz that is used by
PSA, phase detector and phase shifter. FPGA is a digital measurement and
feedback block that performs matrix multiplication between vector of spin
values $s_{j}$ and coupling matrix $J_{ij}$ and controls coupling pulses with
$c_{i}$ vector. Phase shifter has two states 0 and 180 degrees and controls
the phase shift of the coupling pulses according to the sign of $c_{i}$
vector. Attenuator 1 controls the amplitude of the coupling pulses according
to the magnitude of $c_{i}$ vector. Coupler 2 injects the coupling pulses to
the propagating RF pulses with -15 dB of attenuation. (b) Measurement of
$S_{21}$ of the LiNbO3 delay line. $\Delta f=$ 100 MHz is the acoustic wave
spectral bandwidth measured at –3 dB. (c) The frequency-dependent delay time
of the SAW delay line. $\tau_{delay}=$ 12$\mu s$ s is the average delay time
over $\Delta f$ with a total deviation of $\Delta\tau_{delay}=$ 45 ns. (d)
Amplification of the parametric phase-sensitive amplifier as a function of the
relative phase between the propagating RF pulses and the reference signal
$\omega_{ref}=$ 6.25 GHz, with a phase sensitivity of $\mathit{A_{PSA}}=$ 6.1
dB.

The first step consists of establishing stable circulating SAW microwave
pulses in the multi-physics ring circuit consisting of the delay line and the
peripheral electronics. The SAW delay line has 30 dB of attenuation, which is
easily compensated for by linear and phase-sensitive amplifiers. According to
the Barkhausen stability criterion, the total phase accumulation in the ring
circuit has to be an integer multiple of $2\pi$, which is ensured by a proper
choice of the reference frequency $\omega_{ref}$. To realize bi-stable Ising
spins, the propagating SAW pulses are phase-binarized using a phase-sensitive
amplifier (PSA). We note that the phase sensitive amplification can
potentially be implemented directly in the delay line using traveling wave
excitation sources [38, 39, 40], which could further miniaturize the system.

Once stable circulating SAW pulses have been established, they have to be
interconnected to realize an Ising machine with a particular Ising
Hamiltonian. We have designed a measurement and feedback FPGA-based block
(MFB) similar to the one used in a 100-spin CIM [22]. The system includes a
–15dB coupler (Coupler 1) to siphon off a –15dB portion of the circulating
signal, which is then fed to an RF/IF Gain and Phase Detector AD8302, an 8-bit
Analog-to-Digital converter AD9280, a Xilinx Spartan-6 XC6SLX9 FPGA with a
matrix multiplication block, a phase shifter block, and an attenuator HMC472
(Attenuator 1). Finally, another –15-dB coupler (Coupler 2) injects the
feedback coupling pulses ($c_{i}$) back into the main ring.

The energy of an arbitrary coupled array of $N$ phase-binarized SAW pulses is
proportional to the corresponding Ising Hamiltonian [41],

$H(s_{1},...,s_{N})=-\sum_{i<j}J_{ij}s_{i}s_{j}-\sum_{i=1}h_{i}s_{i},$ (2)

where $s_{i}=\pm 1$ corresponds to in-phase/out-of-phase states of the phase-
binarized pulses, $J_{ij}$ is an arbitrary interconnection/coupling matrix,
and $h_{i}$ is an individual local bias field. $J_{ij}$ controls the ratio
between the amplitude of the coupling pulse from a single spins to the
amplitude of the saturated propagating pulses. The same spin configuration
$s_{i}$ represents a maximum number of cuts in MAX-CUT problem:

$C(\\{s_{i}\\})=-\frac{1}{2}\sum_{1\leq i<j\leq
N}J_{ij}-\frac{1}{2}H(\\{s_{i}\\}).$ (3)

A specific MAX-CUT problem can be mapped onto the SAWIM by adjusting the
pairwise coupling terms $J_{ij}$. Since the SAWIM is based on time-multiplexed
oscillators with feedback, the value of the total coupling pulse combined from
all the interconnected pulses to a single pulse should not exceed 20-30% of
the saturated amplitude of the circulating pulses as it would lead to over-
coupling between RF SAW pulses and potentially chaotization of the oscillatory
circuit. On the other hand, in the case when it is less than 2-3%, and has a
negative phase, the necessary switching of the targeting pulse will not happen
due to a constant over-amplification of the circulating pulses in the ring
circuit. This limitation can be avoided while solving MAX-CUT problems by
keeping the smallest amplitude above the switching threshold of 2% and
chopping off the maximum amplitude below the top threshold of 30%. We note
that for more complex problems, such as the Travelling Salesman Problem [42]
and the Channel Assignment Problem [43], where the couplings between Ising
spins should have a higher resolution, special mapping protocols might need to
be established.

The MFB calculates the necessary amplitudes and phases for the feedback
coupling pulses ($c_{i}$) proportional to $J_{ij}$ and the instantaneous spin
state via:

$c_{i}=-r\sum_{j=1}^{n}J_{ij}s_{j}$ (4)

where $r$ is the ratio between the amplitude of saturated pulses and the
amplitude of the feedback from a single artificial Ising spin.

We note that implementing a time-multiplexed Ising machine with circulating
SAW microwave pulses leads to several improvements as compared to both the CIM
and the SWIM. Compared to the CIM, the central frequency of the SAWIM is
$6\times 10^{5}$ times lower, leading to improved thermal stability due to a
much smaller phase accumulation in the ring. While it is sufficient to have a
few periods of oscillation for a microwave pulse to define an Ising spin, the
first CIM spins had about $1\times 10^{6}$ periods, and the latest
100,000-spin CIM, with 30 ps light pulses, have about 6000 periods. Any
further decrease in the number of periods for CIM spins is likely unfeasible
because of the FPGA bottleneck. However, using solid-state delay lines based
on spinwaves or acoustic waves with much lower oscillation frequency, is more
efficient and leads to a much improved thermal stability by a factor of
$1.6854\times 10^{5}$. Consequently, while the 100,000-spin CIM requires an
external cryogenic thermostat system, the SAWIM can operate at room
temperature without any temperature control and phase-locking systems.
Moreover, the total power consumption of the demonstrated SAWIM active blocks
adds up to just 1.82 W and can potentially be further reduced to less than 0.5
W. Its low power consumption and benchtop design make SAWIM a commercially
feasible contender for combinatorial solvers.

## Results

We have evaluated our Ising machine with different MAX-CUT Ising problems with
$J_{ij}={-1,0}$ and no Zeeman term, $h_{i}=0$. In Fig. 2a, b, we show two
random graphs, A and B, for two MAX-CUT problems with the corresponding
chessboard representation of the $J_{ij}$ matrices, where black pixels
correspond to $J_{ij}=-1$. Matrix A has $N$ = 50 vertices, $\lvert
E\rvert=301$ edges, and a density $d$ = 0.2457, whereas matrix B has 50
vertices, 262 edges, and a density of 0.2139. The time traces for the phase
detector signal and the microwave pulse amplitude taken from the phase
detector and are shown in Fig. 2c,e for matrix A and in Fig. 2d,f for matrix
B. For consecutive computations, we turn the amplification in the SAWIM loop
on and off (see Fig. 2i) by an additional digital attenuator (attenuator 2)
with a square signal having a 10-ms period and a 95% duty cycle to ensure that
between computation cycles the SAW echo pulses completely decay (see Fig. 2j).

We can see from Fig. 2j that most changes in the spin states happen already
when the amplitude of the pulses is relatively small. Since the amplitude of
the coupling pulses only depends on the spin configuration when the
circulating spins have small amplitudes, the effective coupling is strong.
Consequently, as the amplitude of the circulating pulses gradually increases,
the effective coupling decreases, or, alternatively, the equivalent
temperature of the system decreases, and, hence, the spin state freezes.
Figure Fig. 2k shows the corresponding temporal evolution of the Hamiltonian.
The solution probabilities for matrices A and B are shown in Fig. 2g,h. In
both cases, the state with the highest probability corresponds to the optimum
Hamiltonian, 34% of H = –218 for matrix A and 85% of H = –228 for matrix B.

It takes 28 circulations, or around 340 $\mu s$, to achieve the absolute
minimum of the Hamiltonian of –228 (see Fig. 2k) for the system with the
corresponding coupling matrix B. Taking into account the SAWIM power
consumption of 1.82 W, the required energy to find a solution for a 50-spin
MAX-CUT problems is hence just 0.62 mJ.

Figure 2: Experimental demonstration of the 50-spin SAWIM solving two
different MAX-CUT problems. a,b Graph and chessboard representation of the
solved MAX-CUT problems (a) Graph A (b) Graph B. c,d Time traces of the phase
detector output for Graph A and Graph B. e,f Time traces of the signal of RF
pulse amplitude obtained from coupler 1. The time traces are colored according
to the phase detector signal. The inset arrows demonstrate the corresponding
up/down orientation of each quasi-spin. The data in a,b,c,d,e,f corresponds to
an optimum solution of the MAX-CUT problems. e,f The solution probabilities as
a function of Ising Energy. i Time traces of the SAW pulse amplitudes in the
beginning of the computation process. During the first 200 $\mu s$, the
overall loop gain is below -20 dB and there are only thermal fluctuations. At
200 $\mu s$ the additional attenuation is switched off, the system becomes
active as the overall amplification in the small signal regime becomes 2 dB. j
Temporal evolution of the individual discrete phase values of all 50 spins. j
Temporal evolution of the Ising Energy of the Hamiltonian. The data in i,j, k
correspond to the random matrix B.

To benchmark our system against the 100-spin CIM, we also characterize the
probability to find the ground state for Möbius ladder graphs of different
sizes (8–50). We use 5000 system runs of 10 ms each to accumulate the
statistics. Similarly to the CIM, the ground state probability starts to decay
from 100% at a graph size of 12. The distributions of the solutions by the
Hamiltonian states for 8-spin, 16-spin, 32-spin, and 50-spin MAX-CUT problems
are shown in Fig. 3b,c,d,e. Compared to the 100-spin CIM, the ground state
probabilities for graph sizes from 28 to 50 are significantly higher, which we
attribute to a better phase stability in the system as well as differences in
the strength of the coupling between artificial Ising spins.

Figure 3: Statistics for the MAX-CUT problem with Möbius ladder graphs of
various sizes. a Ground state probability for Möbius ladder graphs of size $N$
obtained from 5000 consecutive runs. b,c,d,e Distributions of the solutions by
Ising Energy of the system Hamiltonian for 8-spin (b), 16-spin (c), 32-spin
(d) and 50-spin (e) Möbius ladder graphs. The insets show the corresponding
graph configuration. f Distribution of the solutions by the states with the
Ising Energy of –40 for a 16-spin (e) Möbius ladder graph. The inset shows the
corresponding graph configuration and all 16 possible spin states.

An important property of the Ising machine is the identity of the artificial
spins, their coupling strengths, and the absence of any preferred direction
for any spin, potentially arising from parasitic global or local Zeeman terms.
To confirm that the SAWIM has no such bias, we performed 5000 runs with a
16-spin Möbius ladder graph coupling scheme. Due to the symmetry of the Möbius
ladder graph, there are 16 states with the same ground state energy –40 (see
the insets of Fig. 3c,f). It can be seen from Fig. 3f that the distribution of
all the solutions by 16 possible states is mostly uniform. It confirms that
the SAW Triple Transit Echo (TTE) level is low, and that there are no
unintended couplings between the nearby circulating SAW pulses.

### Optimal Coupling

As suggested in [44], there exists an optical coupling strength for oscillator
based IMs: if the coupling is too weak, the system does not reach a stable
solution; if the coupling is too strong, non-optimal, local minima, might
hinder the IM from reaching its ground state. Since the SAWIM is constructed
with electronic microwave amplifiers, which are intrinsically nonlinear, there
is an optimum level of coupling between spins when the probability of the
optimum solution is maximal. To verify the applicability of this theoretical
prediction to time-multiplexed Ising machines, and particularly to our SAWIM,
we introduced a numerical toy model, where each time-multiplexed Ising spin
can be considered as a separate weakly nonlinear oscillator with a delay in a
feedback loop. The evolution of the complex amplitude $a_{j}$ of the
$j^{\text{th}}$ spin, can be described by the following equation [45], which
have been demonstrated to be applicable to time-multiplexed IMs [30]:

$\frac{da_{j}}{dt}+(i\omega_{0}+\Gamma_{0})a_{j}-K\left(1-\beta_{r}\delta
p_{j,\tau}\right)\exp\left(-i\beta_{i}\delta
p_{j,\tau}\right)a_{j}(t-\tau)=\xi(t)$ (5)

where $\delta p_{j,\tau}=(p_{j}(t-\tau)-p_{s})/p_{s}$, $\tau=\tau_{delay}$ is
a delay time along the loop, $\Gamma_{0}$ describes losses, $\omega_{0}$ is
the resonance frequency, $K$ the gain, $\beta_{r}$ the positive coefficient of
the gain compression, $\beta_{i}$ the nonlinear frequency shift, and
$p(t)=\lvert a(t)\rvert^{2}$ the power of oscillations with an operating point
at $p_{s}$. The right hand side of Eq. (5),
$\xi(t)=K_{e}\exp^{i\omega_{e}t}a_{j}^{*}+\kappa\sum_{i}J_{ij}a_{i}/\lvert
a_{i}\rvert$, contains signals from the outer loops, _i.e._ the
synchronization signal at the double frequency $\omega_{e}\simeq 2\omega_{0}$
and couplings from other spins, where $\kappa$ is a coupling coefficient. For
the simplicity of calculations, we chose the following parameters:
$\omega_{0}/2\pi=1.0$, $\omega_{e}/2\pi=2.002$, $\tau=10.0$,
$\Gamma_{0}/2\pi=4.0\times 10^{-2}$, $\beta_{r}=2\times 10^{-2}$,
$\beta_{i}=1.0\times 10^{-4}$, $K/2\pi=4.0\times 10^{-2}$,
$K_{e}/2\pi=6.0\times 10^{-3}$.

The results of the calculations are shown in Fig. 4a. As expected, low values
of the coupling strength makes the probability to reach the ground state
negligibly small, while for strong coupling the IM exhibits an elevated risk
of getting stuck in local minima, which also reduces the probability of
finding the optimal solution. Thus, our calculations emphasize the need to
find optimal coupling strengths, in agreement with [44].

Figure 4: Characterization of the optimal strength of the coupling for the
matrix B. Distribution of the solutions at the states with different Ising
energy: a) for the numerical model, b) produced by the hardware SAWIM. The
additional attenuation of coupling strength is indicated with the labels on
the left side. The inset on top shows the graph and chessboard representation
of $J_{ij}$ coefficients of the matrix B. The results are presented for 1000
runs per each coupling attenuation.

To corroborate these results with experiments, we performed a series of SAWIM
runs with different global attenuation of the coupling strengths. Fig. 4b
shows how the distribution of the Ising energy of the solutions of the MAX-CUT
problem defined by matrix B changes with coupling strength. The top
distribution corresponds to zero coupling, resulting in random spin
configurations with a wide Gaussian distribution of the Ising energies. As the
coupling strength increases, the distribution width narrows sharply and the
mean rapidly moves to lower energies. At –5 dB of attenuation, 100% of the
solutions are optimal at –228. However, when the coupling strength is instead
amplified by 5 dB, the distribution of the solutions again spreads to higher
Ising energies, but now with a more scattered, non-Gaussian, distribution,
reflecting how the system gets stuck in a few local minima. Our experiment
hence confirms that the time-multiplexed SAWIM has an optimum global coupling
strength at which the stability of the ground state is maximized, reaching a
100% probability.

## Scalability

We demonstrated our 50-spin SAWIM using a 50 mm long SAW delay line with a
12-$\mu$s delay, which could theoretically accommodate up to 200 spins. To
further scale up the number of spins, one could explore different directions,
such as increasing the delay time, increasing the central frequency ($f$), and
reducing the SAW pulse width. As the acoustic losses exhibit a $f^{2}$
dependence, lower central frequencies can result in 1 ms and even 10 ms delay
time [46, 47]; operating at 100MHz with a delay time of 1–10 ms could hence
make the number of spins approach $10^{4}-10^{5}$. On the other hand, low
frequencies and long delay times lead to a corresponding increase in the time-
to-solution and, therefore, the use of SAW delay lines operating at GHz range
is equally interesting. SAWs can be excited and propagate efficiently with
acceptable losses at frequencies up to 4-6 GHz [48, 49], which would allow for
2-3 ns SAW pulses, and with $\mu$s-delay times could also reach thousands of
equivalent Ising spins.

Once the maximum number of spins per delay line has been reached, one may
explore the use of multiple delay lines, either in series or as parallel loops
with individual linear and phase-sensitive amplifiers. In the case of series
interconnection, the use of intermediate electronic or integrated SAW PSAs
[38, 39, 40] would keep the SNR of the propagating SAW RF pulses similar to
the present study, and the temperature stability would also remain the same as
the intermediate PSAs correct the phase of the circulating RF pulses. The
advantage of series interconnection is the possibility of using a single MFB
system. However, the time-to-solution parameter will rise in proportion to the
circulation time. In contrast to the series interconnection scheme, the system
of parallel loops would keep the time-to-solution mostly proportional to the
circulation time of a single loop, at the cost of multiple MFBs. Using a
combination of these approaches, the SAWIM hence has the potential for
scalability up to $10^{4}-10^{6}$ spins, while retaining its advantageous
high-level temperature stability and high dynamic range.

Finally, the SAWIM has the same architecture as the latest CIMs and can
operate under the minimum gain principle [23]. The amplification in the loop
can be gradually increased with voltage-controlled analog or digital
attenuators giving enough time for the system to start up at the lowest energy
state corresponding to the Ising Hamiltonian’s minimum state.

## Performance comparison with other Ising machines

Figure 5: Comparison of the SAWIM and the current state-of-the-art annealing
accelerators and Ising machines. a Oscillation frequency of phase-transition
oscillators. b Projected number of artificial spins according to the potential
in scalability c In ref. [50]. d Several delay lines with different delay bits
allows to map onto optoelectronic CIM a limited number of MAX-CUT problems.
However, a large-scale OE-CIM allows all-to-all connection with an FPGA system
similar to 100000-spin CIM, OE-CIM and SAWIM. e Mostly limited by the data
acquisition interface and potentially can be reduce by 3-5 orders of
magnitude. f 500 $\mu s$ is the time to reach saturation in propagating SAW RF
pulses. Since the amplitude of the coupling pulses only depends on $J_{ij}$
and the phases of the propagating SAW RF pulses $s_{i}$, the settling time of
500 $\mu s$ is identical to the annealing time. g 30 $\mu s$ is simulation
while in experiment only 3.7 ms was achieved. h Power consumption and energy
efficient were simulated. i Power consumption and energy efficient were
calculated for simulated PTNO IM with 100 spins without taking into account
the power consumption of the control PC. j Coherence times for the spins in
the steady state k,l Despite $e^{-N}$ scaling of success probability for small
problems, the interconnection issues at large number of equivalents Ising
spins may require the use of Chimera or sparse interconnection schemes that
affects scaling of success probability.

In order to evaluate the SAWIM position within a wide class of physical Ising
machines, we benchmarked our SAWIM with other state-of-the-art implementations
of Ising machines (Fig. 5). We have picked relevant metrics that affects the
throughput of the system (connectivity, time-to-solution), the energy
efficiency (system power consumption and energy required to reach solution),
system stability (the requirement of cryogenic systems and thermostats,
coherence times for spins), system size and potential for scalability
(connectivity, scalability of the success probability and projected number of
spins). For a wide-scale comparison, we included in the benchmarking the
state-of-the-art commercially available solution D-Wave 2000Q quantum
annealer, containing 2,048 qubits [13, 51], and a noisy mean-field annealing
algorithm running on an NVIDIA GeForce GTX 1080 Ti GPU [52]. For highlighting
solutions based on different physical principles but having a high potential
for CMOS integration we considered a discrete-time memristor-based hybrid
analogue–digital accelerator implementing a Hopfield neural network (mem-HNN)
[12] and an Ising Hamiltonian solver based on coupled stochastic phase-
transition nano-oscillators [14]. The last five IMs are from the same class of
time-multiplexed Ising machines: a 2000-node Coherent Ising Machine [21], a
state-of-the-art 100,000 spin Coherent Ising Machine [20], and alternative
simplified optoelectronic CIM [29], and large-scale multi-wavelength
optoelectronic CIM [28], SWIM [30] and, finally, SAWIM. The SAWIM has a
comparable or even better time-to-solution parameter relative to the first
four candidates with the potential of sufficient increase in the number of
spins inherent for time-multiplexed systems.

The absence of physical delay systems in seemingly simplified optoelectronic
CIMs [29] in fact requires a more complex FPGA control system [29] than in
classical CIMs [21, 20] and which has to store the spins amplitude and phases
with high precision that significantly limits the maximum number of Ising
spins. In the case of large-scale optoelectronic CIM [28], the absence of a
physical delay system is compensated by the use of constant delay-time delay
lines that dramatically limit the variety of possible encoded problems,
essentially limiting the large-scale optoelectronic CIM to laboratory
demonstrations without the possibility of solving arbitrary problems.

As compared with classical CIMs [21, 20], the use of a solid-state SAW delay
line operating at a central frequency of 320 MHz results in a high thermal
stability that is by a factor of $1.6854\times 10^{5}$ better than in CIMs
[21, 20]. In contrasts to CIM, this allowed for operation without a phase
locked loop (PLL). However, for even higher stability in larger and commercial
SAWIM systems, we anticipate using simple PLL circuits.

We note that our SAWIM has a power consumption of just 1.82 W and an energy
efficiency of $1.61\times 10^{3}$ solutions per second per watt, which is
comparable with optoelectronic CIMs and several orders of magnitude better
than in other candidates such as D-Wave and CIM while still having all-to-all
connectivity and the scalability potential of CIM. Moreover, with dedicated
CMOS circuits, the power consumption of microwave blocks can be reduced to
$\mu$W level. Finally, SAWIM is smaller than most systems, and has a good
prospect for CMOS integration.

## Conclusion

We have demonstrated the design of a time-multiplexed surface acoustic wave
Ising machine (SAWIM). The SAWIM has a circulation time of 12 $\mu$s and a
time-to-solution of about 340 $\mu$s for 50-spin MAX-CUT problems, consuming
only 0.62 mJ to compute a single solution. We have benchmarked our SAWIM using
different size Möbius ladder graphs and demonstrated its advantages as
compared with a corresponding 100-spin CIM in the literature. We have also
demonstrated the importance of an optimized coupling strength at which the
ground state probability can reach 100% for 50-spin MAX-CUT problems. The
SAWIM consumes just 1.82 W of power and has significant potential for further
power reduction. Our work presents a versatile, low-power, fast, and cheap
microwave-based time-multiplexed Ising machine platform, with potential for
dramatic miniaturization compared to optical solutions. The high SNR and
dynamic range of coupling strength will allow for the implementation of high-
resolution coupling matrices, enabling mapping of more complex problems, such
as the travelling salesman problem, the nurse scheduling problem, and channel
allocation problems. The demonstrated concept offers a clear path for
scalability to thousands and potentially hundreds of thousands of spins.
Finally, the operation at room temperature and the use of off-the-shelf low-
power electronic components promises a high potential for commercialization.

## Methods

### Sample

The lateral dimension of the SAW waveguide is 50 x 10 mm2. The microwave-to-
acoustic wave transducers are silver IDTs. The substrate is Lithium Niobate.

### Electrical measurements

The group delay presented in Fig. 1c was obtained from phase-delay measurement
of the S-parameters using a vector network analyzer. The S-parameters were
measured across a wide range of frequencies starting from 100 MHz to 500 MHz
with a resolution of 10 kHz and 40000 points. The group delay is calculated as
the negative derivative of the phase shift with respect to the frequency. This
calculation was performed using a built-in function of a vector network
analyzer Rohde & Schwarz ZNB 40. The time delay plot was smoothed with an FFT
filter with 10-points integration.

The phase-sensitive amplification curve was extracted from the envelope of an
amplified signal with constant amplitude and frequency detuned from the
reference signal frequency by 10 MHz. The frequency detuning introduced a
continuous phase drift with a period of 1 $\mu$s, which allowed a smooth
phase-sensitive amplification curve to be extracted.

## Author contributions

A.L. conceived the concept and designed the circuit; A.L. performed the
measurements and analyzed the data; R.K., R.O., performed theoretical
calculations; J.Å. managed the project; all co-authors contributed to the
manuscript, the discussion, and analysis of the results.

## Acknowledgements

This work was supported by a Knut and Alice Wallenberg Foundation WALP grant,
KAW 253129326, a Horizon 2020 research and innovation programme ERC Advanced
Grant No. 835068 "TOPSPIN", an ERC Proof of Concept Grant No. 101069424
"SPINTOP", and the Marie Skłodowska-Curie grant agreement No. 101111429
"SWIM".

## References

  * Ibarra and Kim [1975] O. Ibarra and C. Kim.  Fast approximation algorithms for the knapsack and sum of subset problems.  _Journal of the Association for Computing Machinery_ , 22:463–468, 1975.  doi: 10.1145/321906.321909.
  * Barahona et al. [1988] Francisco Barahona, Martin Grötschel, Michael Jünger, and Gerhard Reinelt.  An application of combinatorial optimization to statistical physics and circuit layout design.  _Operations Research_ , 36(3):493–513, 1988.  ISSN 0030364X, 15265463.  doi: 10.1287/opre.36.3.493.
  * Earl and Deem [2005] David J. Earl and Michael W. Deem.  Parallel tempering: Theory, applications, and new perspectives.  _Phys. Chem. Chem. Phys._ , 7:3910–3916, 2005.  doi: 10.1039/B509983H.
  * Černý [1985] V Černý.  Thermodynamical approach to the traveling salesman problem: An efficient simulation algorithm.  _J. Optim. Theory. Appl._ , 45:41–51, 1985.  doi: 10.1007/BF00940812.
  * Burke et al. [2004] Edmund K Burke, Patrick De Causmaecker, Greet Vanden Berghe, and Hendrik Van Landeghem.  The state of the art of nurse rostering.  _Journal of scheduling_ , 7:441–499, 2004.  doi: 10.1023/B:JOSH.0000046076.75950.0b.
  * Barahona [1982] F Barahona.  On the computational complexity of Ising spin glass models.  _Journal of Physics A: Mathematical and General_ , 15(10):3241–3253, oct 1982.  doi: 10.1088/0305-4470/15/10/028.
  * Du and Pardalos [1998] Dingzhu Du and Panos M Pardalos.  _Handbook of combinatorial optimization_ , volume 4.  Springer Science & Business Media, New York, NY, 1998.  doi: 10.1007/978-1-4613-0303-9.
  * Mohseni et al. [2022] Naeimeh Mohseni, Peter L McMahon, and Tim Byrnes.  Ising machines as hardware solvers of combinatorial optimization problems.  _Nature Reviews Physics_ , 4(6):363–379, 2022\.  doi: 10.1038/s42254-022-00440-8.
  * Albertsson et al. [2021] Dagur Ingi Albertsson, Mohammad Zahedinejad, Afshin Houshang, Roman Khymyn, Johan Åkerman, and Ana Rusu.  Ultrafast Ising machines using spin torque nano-oscillators.  _Applied Physics Letters_ , 118(11):112404, 2021\.  doi: 10.1063/5.0041575.
  * Houshang et al. [2022] Afshin Houshang, Mohammad Zahedinejad, Shreyas Muralidhar, Roman Khymyn, Mona Rajabali, Himanshu Fulara, Ahmad A Awad, Johan Åkerman, Jakub Chęciński, and Mykola Dvornik.  Phase-binarized spin hall nano-oscillator arrays: Towards spin hall Ising machines.  _Physical Review Applied_ , 17(1):014003, 2022\.  doi: 10.1103/PhysRevApplied.17.014003.
  * Sutton et al. [2017] Brian Sutton, Kerem Yunus Camsari, Behtash Behin-Aein, and Supriyo Datta.  Intrinsic optimization using stochastic nanomagnets.  _Scientific Reports_ , 7(1):44370, Mar 2017.  ISSN 2045-2322.  doi: 10.1038/srep44370.
  * Cai et al. [2020] Fuxi Cai, Suhas Kumar, Thomas Van Vaerenbergh, Xia Sheng, Rui Liu, Can Li, Zhan Liu, Martin Foltin, Shimeng Yu, Qiangfei Xia, J. Joshua Yang, Raymond Beausoleil, Wei D. Lu, and John Paul Strachan.  Power-efficient combinatorial optimization using intrinsic noise in memristor hopfield neural networks.  _Nature Electronics_ , 3(7):409–418, Jul 2020\.  ISSN 2520-1131.  doi: 10.1038/s41928-020-0436-6.
  * Johnson et al. [2011] Mark W Johnson, Mohammad HS Amin, Suzanne Gildert, Trevor Lanting, Firas Hamze, Neil Dickson, Richard Harris, Andrew J Berkley, Jan Johansson, Paul Bunyk, et al.  Quantum annealing with manufactured spins.  _Nature_ , 473(7346):194–198, 2011.  doi: 10.1038/nature10012.
  * Dutta et al. [2021] Suryendy Dutta, Abhishek Khanna, AS Assoa, Hanjong Paik, Darrell G Schlom, Zoltán Toroczkai, Arijit Raychowdhury, and Suman Datta.  An Ising hamiltonian solver based on coupled stochastic phase-transition nano-oscillators.  _Nature Electronics_ , 4(7):502–512, 2021.  doi: 10.1038/s41928-021-00616-7.
  * Wang et al. [2019] Tianshi Wang, Leon Wu, and Jaijeet Roychowdhury.  New computational results and hardware prototypes for oscillator-based Ising machines.  In _Proceedings of the 56th Annual Design Automation Conference 2019_ , DAC ’19, New York, NY, USA, 2019. Association for Computing Machinery.  ISBN 9781450367257.  doi: 10.1145/3316781.3322473.
  * Moy et al. [2022] William Moy, Ibrahim Ahmed, Po-wei Chiu, John Moy, Sachin S Sapatnekar, and Chris H Kim.  A 1,968-node coupled ring oscillator circuit for combinatorial optimization problem solving.  _Nature Electronics_ , 5(5):310–317, 2022.  doi: 10.1038/s41928-022-00749-3.
  * Si et al. [2023] Jia Si, Shuhan Yang, Yunuo Cen, Jiaer Chen, Zhaoyang Yao, Dong-Jun Kim, Kaiming Cai, Jerald Yoo, Xuanyao Fong, and Hyunsoo Yang.  Energy-efficient superparamagnetic Ising machine and its application to traveling salesman problems.  _arXiv preprint arXiv:2306.11572_ , 2023.  doi: 10.48550/arXiv.2306.11572.
  * Aadit et al. [2022] Navid Anjum Aadit, Andrea Grimaldi, Mario Carpentieri, Luke Theogarajan, John M Martinis, Giovanni Finocchio, and Kerem Y Camsari.  Massively parallel probabilistic computing with sparse Ising machines.  _Nature Electronics_ , 5(7):460–468, 2022.  doi: 10.1038/s41928-022-00774-2.
  * Grimaldi et al. [2023] Andrea Grimaldi, Luciano Mazza, Eleonora Raimondo, Pietro Tullo, Davi Rodrigues, Kerem Y. Camsari, Vincenza Crupi, Mario Carpentieri, Vito Puliafito, and Giovanni Finocchio.  Evaluating spintronics-compatible implementations of Ising machines.  _Phys. Rev. Appl._ , 20:024005, Aug 2023.  doi: 10.1103/PhysRevApplied.20.024005.
  * Honjo et al. [2021] Toshimori Honjo, Tomohiro Sonobe, Kensuke Inaba, Takahiro Inagaki, Takuya Ikuta, Yasuhiro Yamada, Takushi Kazama, Koji Enbutsu, Takeshi Umeki, Ryoichi Kasahara, Ken ichi Kawarabayashi, and Hiroki Takesue.  100,000-spin coherent Ising machine.  _Science Advances_ , 7(40):eabh0952, 2021.  doi: 10.1126/sciadv.abh0952.
  * Inagaki et al. [2016] Takahiro Inagaki, Yoshitaka Haribara, Koji Igarashi, Tomohiro Sonobe, Shuhei Tamate, Toshimori Honjo, Alireza Marandi, Peter L. McMahon, Takeshi Umeki, Koji Enbutsu, Osamu Tadanaga, Hirokazu Takenouchi, Kazuyuki Aihara, Ken ichi Kawarabayashi, Kyo Inoue, Shoko Utsunomiya, and Hiroki Takesue.  A coherent Ising machine for 2000-node optimization problems.  _Science_ , 354(6312):603–606, 2016.  doi: 10.1126/science.aah4243.
  * McMahon et al. [2016] Peter L. McMahon, Alireza Marandi, Yoshitaka Haribara, Ryan Hamerly, Carsten Langrock, Shuhei Tamate, Takahiro Inagaki, Hiroki Takesue, Shoko Utsunomiya, Kazuyuki Aihara, Robert L. Byer, M. M. Fejer, Hideo Mabuchi, and Yoshihisa Yamamoto.  A fully programmable 100-spin coherent Ising machine with all-to-all connections.  _Science_ , 354(6312):614–617, 2016.  doi: 10.1126/science.aah5178.
  * Yamamoto et al. [2017] Yoshihisa Yamamoto, Kazuyuki Aihara, Timothee Leleu, Ken-ichi Kawarabayashi, Satoshi Kako, Martin Fejer, Kyo Inoue, and Hiroki Takesue.  Coherent Ising machines—optical neural networks operating at the quantum limit.  _npj Quantum Information_ , 3(1):1–15, 2017.  doi: 10.1038/s41534-017-0048-9.
  * Kako et al. [2020] Satoshi Kako, Timothée Leleu, Yoshitaka Inui, Farad Khoyratee, Sam Reifenstein, and Yoshihisa Yamamoto.  Coherent Ising machines with error correction feedback.  _Advanced Quantum Technologies_ , 3(11):2000045, 2020.  doi: https://doi.org/10.1002/qute.202000045.
  * Takata et al. [2016] Kenta Takata, Alireza Marandi, Ryan Hamerly, Yoshitaka Haribara, Daiki Maruo, Shuhei Tamate, Hiromasa Sakaguchi, Shoko Utsunomiya, and Yoshihisa Yamamoto.  A 16-bit coherent Ising machine for one-dimensional ring and cubic graph problems.  _Scientific reports_ , 6(1):1–7, 2016.  doi: 10.1038/srep34089.
  * Haribara et al. [2016a] Yoshitaka Haribara, Shoko Utsunomiya, and Yoshihisa Yamamoto.  _A Coherent Ising Machine for MAX-CUT Problems: Performance Evaluation against Semidefinite Programming and Simulated Annealing_ , pages 251–262.  Springer Japan, Tokyo, 2016a.
  * Marandi et al. [2014] Alireza Marandi, Zhe Wang, Kenta Takata, Robert L Byer, and Yoshihisa Yamamoto.  Network of time-multiplexed optical parametric oscillators as a coherent Ising machine.  _Nature Photonics_ , 8(12):937–942, 2014.  doi: 10.1038/nphoton.2014.249.
  * Cen et al. [2022] Qizhuang Cen, Hao Ding, Tengfei Hao, Shanhong Guan, Zhiqiang Qin, Jiaming Lyu, Wei Li, Ninghua Zhu, Kun Xu, Yitang Dai, et al.  Large-scale coherent Ising machine based on optoelectronic parametric oscillator.  _Light: Science & Applications_, 11(1):333, 2022\.  doi: 10.1038/s41377-022-01013-1.
  * Böhm et al. [2019] Fabian Böhm, Guy Verschaffelt, and Guy Van der Sande.  A poor man’s coherent Ising machine based on opto-electronic feedback systems for solving optimization problems.  _Nature communications_ , 10(1):3538, 2019.  doi: 10.1038/s41467-019-11484-3.
  * Litvinenko et al. [2023] Artem Litvinenko, Roman Khymyn, Victor H González, Roman Ovcharov, Ahmad A Awad, Vasyl Tyberkevych, Andrei Slavin, and Johan Åkerman.  A spinwave Ising machine.  _Communications Physics_ , 6(1):227, 2023.  doi: 10.1038/s42005-023-01348-0.
  * González et al. [2023] Victor H. González, Artem Litvinenko, Roman Khymyn, and Johan Åkerman.  Global biasing using a hardware-based artificial zeeman term in spinwave ising machines.  _arXiv:2308.07718 [cond-mat.mes-hall_ , 2023.  doi: 10.48550/arXiv.2308.07718.
  * Serga et al. [2010] AA Serga, AV Chumak, and B Hillebrands.  Yig magnonics.  _Journal of Physics D: Applied Physics_ , 43(26):264002, 2010.  doi: 10.1088/0022-3727/43/26/264002.
  * Rayleigh [1885] Lord Rayleigh.  On waves propagated along the plane surface of an elastic solid.  _Proceedings of the London Mathematical Society_ , s1-17(1):4–11, 1885.  doi: https://doi.org/10.1112/plms/s1-17.1.4.
  * Biryukov et al. [1995] Sergey V Biryukov, Yuri V Gulyaev, Victor V Krylov, and Victor P Plessky.  _Surface acoustic waves in inhomogeneous media_ , volume 20.  Springer, Berlin, Heidelberg, 1995.  ISBN 978-3-642-63348-5 978-3-642-57767-3.  doi: 10.1007/978-3-642-57767-3.
  * Malocha [2004] Donald C Malocha.  Evolution of the SAW transducer for communication systems.  In _IEEE Ultrasonics Symposium, 2004_ , volume 1, pages 302–310. IEEE, 2004.  doi: 10.1109/ULTSYM.2004.1417726.
  * Meltaus et al. [2005] Johanna Meltaus, Victor P Plessky, S Harma, and Martti M Salomaa.  Low-loss, multimode 5-IDT SAW filter.  _IEEE Transactions on Ultrasonics, Ferroelectrics, and Frequency Control_ , 52(6):1013–1019, 2005.  doi: 10.1109/TUFFC.2005.1504023.
  * Iriarte et al. [2012] GF Iriarte, JG Rodriguez-Madrid, and F Calle.  Fabrication of sub-100nm IDT SAW devices on insulating, semiconducting and conductive substrates.  _Journal of Materials Processing Technology_ , 212(3):707–712, 2012.  doi: 10.1016/j.jmatprotec.2011.08.007.
  * Li et al. [2019a] Xinyi Li, Jingfu Bao, Yulin Huang, Benfeng Zhang, Tatsuya Omori, and Ken-ya Hashimoto.  Traveling wave excitation sources for FEM analysis of scattering in acoustic waveguide.  _Microsystem Technologies_ , 25:2783–2792, 2019a.  doi: 10.1007/s00542-018-4169-7.
  * Li et al. [2019b] Xinyi Li, Jingfu Bao, Yulin Huang, Benfeng Zhang, Tatsuya Omori, and Ken-ya Hashimoto.  Use of hierarchical cascading technique for FEM analysis of transverse-mode behaviors in surface acoustic-wave devices.  _IEEE Transactions on Ultrasonics, Ferroelectrics, and Frequency Control_ , 66(12):1920–1926, 2019b.  doi: 10.1109/TUFFC.2019.2932105.
  * Hagelauer et al. [2022] Amelie Hagelauer, Rich Ruby, Shogo Inoue, Victor Plessky, Ken-Ya Hashimoto, Ryo Nakagawa, Jordi Verdu, Pedro de Paco, Amir Mortazawi, Gianluca Piazza, et al.  From microwave acoustic filters to millimeter-wave operation and new applications.  _IEEE Journal of Microwaves_ , 2022.  doi: 10.1109/JMW.2022.3226415.
  * Lucas [2014] Andrew Lucas.  Ising formulations of many np problems.  _Frontiers in physics_ , 2:5, 2014.  doi: 10.3389/fphy.2014.00005.
  * Hasegawa et al. [2021] Mikio Hasegawa, Hirotake Ito, Hiroki Takesue, and Kazuyuki Aihara.  Optimization by neural networks in the coherent Ising machine and its application to wireless communication systems.  _IEICE Transactions on Communications_ , 104(3):210–216, 2021.  doi: 10.1587/transcom.2020NVI0002.
  * Ito et al. [2020] Hirotake Ito, Yuchang Jiang, Hiroyuki Yasuda, Hiroki Takesue, Kazuyuki Aihara, and Mikio Hasegawa.  High-speed optimization method for resource allocation in wireless communication systems by coherent Ising machine.  In _2020 International Conference on Artificial Intelligence in Information and Communication (ICAIIC)_ , pages 093–097, 2020.  doi: 10.1109/ICAIIC48513.2020.9065239.
  * Bashar et al. [2023] Mohammad Khairul Bashar, Zongli Lin, and Nikhil Shukla.  Stability of oscillator Ising machines: Not all solutions are created equal.  _Journal of Applied Physics_ , 134(14):144901, 10 2023.  ISSN 0021-8979.  doi: 10.1063/5.0157107.
  * Tiberkevich et al. [2014] Vasil S Tiberkevich, Roman S Khymyn, Hong X Tang, and Andrei N Slavin.  Sensitivity to external signals and synchronization properties of a non-isochronous auto-oscillator with delayed feedback.  _Scientific reports_ , 4(1):3873, 2014.  doi: 10.1038/srep03873.
  * Fortunko et al. [1974] C.M. Fortunko, S.L. Quilici, and H.J. Shaw.  Saw delay lines of large time-delay-bandwidth products.  In _1974 Ultrasonics Symposium_ , pages 181–184, 1974.  doi: 10.1109/ULTSYM.1974.196313.
  * Coldren and Shaw [1976] L.A. Coldren and H.J. Shaw.  Surface-wave long delay lines.  _Proceedings of the IEEE_ , 64(5):598–609, 1976\.  doi: 10.1109/PROC.1976.10182.
  * Makkonen et al. [2003] T Makkonen, VP Plessky, W Steichen, and MM Salomaa.  Surface-acoustic-wave devices for the 2.5–5 GHz frequency range based on longitudinal leaky waves.  _Applied Physics Letters_ , 82(19):3351–3353, 2003.  doi: 10.1063/1.1573361.
  * Plessky et al. [2014] Victor P Plessky, Marc Lamothe, Zachary J Davis, and Sergey G Suchkov.  SAW tags for the 6-GHz range.  _IEEE Transactions on Ultrasonics, Ferroelectrics, and Frequency Control_ , 61(12):2149–2152, 2014.  doi: 10.1109/TUFFC.2014.006423.
  * Haribara et al. [2016b] Yoshitaka Haribara, Shoko Utsunomiya, and Yoshihisa Yamamoto.  Computational principle and performance evaluation of coherent Ising machine based on degenerate optical parametric oscillator network.  _Entropy_ , 18(4):151, 2016b.  doi: 10.3390/e18040151.
  * Hamerly et al. [2019] Ryan Hamerly, Takahiro Inagaki, Peter L McMahon, Davide Venturelli, Alireza Marandi, Tatsuhiro Onodera, Edwin Ng, Carsten Langrock, Kensuke Inaba, Toshimori Honjo, et al.  Experimental investigation of performance differences between coherent Ising machines and a quantum annealer.  _Science advances_ , 5(5):eaau0823, 2019.  doi: 10.1126/sciadv.aau0823.
  * King et al. [2018] Andrew D King, William Bernoudy, James King, Andrew J Berkley, and Trevor Lanting.  Emulating the coherent Ising machine with a mean-field algorithm.  _arXiv preprint arXiv:1806.08422_ , 2018.  doi: 10.48550/arXiv.1806.08422.