In 2016, Apple Health (Medicaid) was exposed for data breach. This attack
revealed 370,000 records for clients in Apple Health (Washington state) [141].

  * •

In 2017, an unauthorised individual penetrated EHR the New Jersey Diamond
Institute for Fertility and Menopause. The hacker revealed PHI to 14633 record
containing patients’ information such as names, birth dates, social security
numbers, and sonograms [142].

According to the Vormetic report on data security 2016, healthcare is one of
the sectors that is most vulnerable to hackers’ attacks and thus requires
increased efforts to secure health data by 64%. This report stated on 21
January 2016 that 91% of enterprises suffer from vulnerability threatening
data security (internal and external attacks). The study of security data
included several countries such as Australia, USA and Germany [143].
Therefore, many systems such as national e-health transition authority (NEHTA)
in Australia and health insurance portability and accountability act (HIPAA)
in the USA recommended applying security and privacy in e-health applications
correctly and accurately to prevent security threats [144].
In addition, the accuracy of medical data is critical in diagnosing diseases
and determining the condition of patients during their online or wireless
transmission from patient to a healthcare provider. Also, penetration of the
medical data with diseases such as addiction, HIV infection, sexual and
dermatological conditions can lead to harassment, discrimination, even death
of the patient if data reports change during the transfer from client to
server [145]. These penetrations show that medical records in e-health require
a high level of security and privacy. Many modern projects implement the ECDSA
algorithm for high security and efficient performance. ECDSA signatures
(Koblitz with the key of 163-bit) and energy-harvesting techniques were
proposed to monitor patients’ conditions by WSN in e-health [146]. The authors
applied the patient’s health surveillance scenario during the deployment of a
set of sensor nodes such as TelosB, Micaz, and MagoNode ++. They generated a
signature with a time of 300ms and an energy consumption of 7mj. They
concluded that these results reduce time and energy in WSN to serve e-health
applications that deal with massive data. Masud and Hossain [99] proposed
using ECC/ECDSA to protect patients’ information in collaborating clouds
healthcare based on pairing based cryptography. Also, Ibrahim and Dalkılıç
[96] designed a scheme to support the privacy and security of patients’ data
in e-health. This scheme applied the ECDSA’s signatures in the RFID tag to
provide mutual authentication in the protection of medical records. They
pointed out that their scheme is capable of preventing man-in-the-middle
attacks, tracking, eavesdropping, impersonation, replay, and cloning. They
used the Shamir scheme to reduce the cost of PM in signature verification
(ECDSA) as well as security support. Their scheme provided fewer calculations
and more security in the process of authentication of medical records in
e-health.

### 6.2 Electronic-Banking

E-banks have used the personal information of their customers to authorise
access to their bank accounts. Many systems have applied for dealing with bank
accounts such as online banking (OB), mobile banking (MB), credit card (CC)
[147] and automated teller machines (ATM) which require signature algorithms
to protect confidential information for customers. E-banking implements a set
of security measures to prevent hackers and Internet thieves. Hackers are
trying to create a gap in these systems to hack users’ accounts. They have
applied high-tech to penetrate customers’ credits. Therefore, the process of
authentication for legitimate users in e-banking applications is extremely
important. Many examples of security refer to threats implemented against
e-banking applications:

  * •

In 2012, millions of clients blocked access to their accounts at the Royal
Bank of Scotland [148].

  * •

In 2015, the website www.000webhost.com was hacked by a malicious attack. The
result was the attacker’s access to 13 million user accounts; the hacked data
contained personal information for customers (such as name and plaintext
password) [95].

  * •

In 2016, DDOS attacks were perpetrated against HSBC bank, which is one of the
biggest banking names in the world; these attacks led to the suspension of
service for two days and prevented customers from accessing their accounts
[148].

In the current era, authentication systems based on username/password are no
longer safe in protecting user accounts [95]. We have investigated the
adoption of ECDSA signatures in modern e-banking applications and their
ability to prevent hacking threats. In 2017, Alhothaily et al. [95] proposed a
scheme to protect e-banking applications. They designed a protocol to
authenticate customers in e-banking applications. Also, they pointed out that
their scheme prevents e-banking attacks such as phishing, shoulder surfing,
keyloggers, data break accidents and password-related attacks. Their scheme
relied on the ECDSA (256-bit) algorithm with SHA-256 to sign the ticket. This
ticket implements security mechanisms to protect users’ accounts such as one-
time username, session key, ticket validity period, timestamp and add account
permission for each login operation. They pointed out that their scheme
provides protection against previous attacks as it prevents reuse of credits.
Moreover, Bojjagani and Sastry [97] discussed that short message service (SMS)
is not reliable in e-banking applications. These applications exchange these
messages with their customers in a dense and daily way over the Internet or
wireless network. They proposed a model for protecting bank messages by using
ECDSA (p-224) and the elliptic curve integrated encryption scheme (ECIES).
They integrated the ECIES algorithm with signature verification in ECDSA to
support the authentication process in e-banking applications. Their model
achieves three stages (authentication, transaction, and notification) to
complete the authorisation process between sender and receiver. They pointed
out that their scheme is efficient and reliable for real-time banking
applications, against the attacks of wifi sniffing, reflection, replay, man-
in-the-middle, phishing, and impersonation, and provides end-to-end
communication security between the client and server. They demonstrated that
the ECC/ECDSA algorithm provides high performance in e-banking applications
because these algorithms use small keys and an appropriate computation cost
for these applications compared to other public key algorithms (such as RSA,
DSA, and DH).

### 6.3 Electronic-Commerce

The Internet is important medium for providing services, sharing information,
buying and selling electronic products, applications, business transactions on
an internal or external e-commerce level. Business and e-commerce transactions
information have been shared between several parties, such as governments,
companies, and customers (consumers) via websites. The Internet has brought a
tremendous amount of positives but it has also made some negatives. The most
important drawback is hacking threats to personal and sensitive information to
get gains and benefits [83]. The progress of the huge development of this
technology has brought with it security risks that threaten the personal
information of users and attempt to detect private keys in signing and
encrypting data. Due to a high demand for consumers and companies to market
products online, e-commerce requires secure signature algorithms and is
efficient to deal with tens of thousands of requests per second. Many examples
of security refer to threats implemented against e-commerce:

  * •

In 2016, the report in [149] pointed out that many popular websites have been
hacked by credential replay attacks (password reuse) for more than three
billion user accounts. Fraud attacks on e-commerce in the united states are
expected to hit $7 billion by 2020.

  * •

In 2016, phishing attacks target e-commerce where 44% of threaten customers
and 11% of public activity [150].

  * •

In 2017, the study of IP converge data services (IPC) stated that more than
16,600 DDoS attacks were revealed on e-commerce deals particularly on
Valentine’s Day and Chinese New Year [151].

Many currency signing systems have used in e-commerce applications such as
Bitcoin, Litecoin, Freicoin and Peercoin [152]. Most of these systems
implement ECDSA signatures to support security features (authentication,
integrity, and non-repudiation). A scheme to secure e-commerce and online
transactions was proposed in [83]. The authors developed a graphic processing
unit-universal elliptic curve signature server (Guess) with the adoption of
the ECDSA signature mechanism (key of 256-bit binary) to provide signatures
with high-performance computations. They applied signature as a service
(SIGaaS) on an enterprise private cloud (EPC) to secure e-payment over the
Internet. They pointed out that the Internet is an insecure medium because of
the variety of attacks that try to hack private keys. Also, they described
SIGaaS as impervious to private key attacks such as heartbleed and stealthy
newly emerged. Their scheme described the authentication issues between
tenants and Guess. Therefore, they have demonstrated that e-commerce
applications require robust authentication. For instance, Chinese Alipay
website fulfills huge requests and exchanges personal information for users.
This website performs more than 85,900 transactions per second. Therefore,
this website requires an efficient signature algorithm in terms of speed, time
and security requirements to protect these transactions online. The authors
stated that the graphics processing unit (GPU) with ECDSA showed high
performance and security in dealing with e-commerce websites such as the games
market. Furthermore, Mann and Loebenberger [101] used ECDSA to implement two-
factor authentication with e-commerce applications (Bitcoin wallet). They
implemented a mutual signature protocol with signature verification over a
separate communication channel. Their scheme applied a threshold to support a
set of signatures, instead of one signature as well as using the hash value in
checking the payer and payee. They argued that ECDSA and threshold signatures
solved Bitcoin security problems such as monitoring transaction details (block
chain public) and transaction size. They also pointed out that randomization
is significantly important in preventing malicious attackers from discovering
the secret key in ECDSA.

### 6.4 Electronic-Vehicular

Vehicular ad hoc network (VANET) applications are important modern
applications to secure people’s lives on the road. These applications are a
collection of network cars that share information such as police, emergency,
and smart taxi cars. These applications regulate network traffic to ensure
safety for users while enforcing road laws. Several features for VANET
applications have used such as self-regulation, distributed communications
environment, and dynamic topology. These applications have been designed to
avoid traffic congestion, prevent accidents, and prevent violations of road
rules. The primary objective is to protect passengers on the road. This type
of network operates with two categories: vehicle to vehicle (V2V), and vehicle
to infrastructure (V2I). VANET is a class of mobile ad hoc network (MANET)
network but it works regularly and not randomly. The critical issue and great
challenge for this type of application is security due to the VANET network
sharing nodes information in the open medium [153]. To protect users in a
VANET network, encryption and signature mechanisms should be used to prevent
the risks of modifying messages between nodes. Many attacks threat the VANET
application such as impersonation, Sybil, modification, DDoS and reply. To
prevent these attacks the confidentiality, integrity, and availability (CIA)
security requirements should be applied. Many examples of security refer to
threats implemented against e-vehicular:

  * •

In 2015, a hacker successfully carried out a cyber attack to hijack and
control a Jeep car over the Internet. This attack prevented the driver from
taking control of his car [154].

  * •

In 2017, the report in [155] stated that a hacker penetrated board messages
for highways in California. This hacker targeted to distract drivers and
endanger them. The report reported that 58.85% of attacks such as DDoS, cyber
and brute forcing were rated as high risk for VANET applications.

The ECDSA algorithm was used to authenticate messages with VANET [156]. Though
the results, the authors noted delay generation key, signature, and
verification increase with an increase in curve size. This scheme provides
integrity, authentication, and non-repudiation, as it is convenient for
constrained-source networks. Also, Franeková et al. [20] have provided a
security analysis of the ECDSA algorithm (key lengths of 160, 192, 224, 256,
384 and 521) with VANET (V2V) applications. They applied many curves to the
ECDSA (OpenSSL library) such as prime, pseudorandom binary, Koblitz binary.
They also focused on data transfer scenarios and used the Riverbed Modeler
tool to analyze data transferred between vehicles. Their scheme discussed
whether VANET can be exposed to many attacks such as fake entity, position
counterfeit, and Sybil. To generate sufficient security in these applications,
at least the NIST p-224 and NIST p-256 keys should be used in ECDSA. They
noted that the important parameters that affect the efficiency of signatures
in an e-vehicular environment are the size and time of signature generation
and verification. They concluded that ECDSA p-224 or p-256 provides efficiency
(time and size of data) and adequate security to secure e-vehicular (V2V)
applications. In addition, Rajput et al. [98] argued that the privacy of
location information and identity should be safe in e-vehicular applications
because changing this data could lead to fatal accidents. They applied a
method of authentication based mainly on the signatures of ECDSA with a
pseudonym to provide anonymity to the vehicular applications. Also, they
pointed out that their scheme is capable of preventing malicious attacks such
as location tracking, modification, impersonation, bogus information, Sybil,
replay, and DOS. Their scheme supports standard security requirements as well
as traceability and low overheads. In their scheme, the pseudonym consists of
signing ECDSA, timestamp and a random number. They pointed out that a
lightweight pseudonym is sufficient to support security in e-vehicular
applications against malicious attacks.

### 6.5 Electronic-Governance

E-governance is an application that provides services to stakeholders through
various communication technologies such as Internet, SMS, and email to
simplify the procedures of services for citizens, business, and government
agencies. This application consists of four types of transactions involving
government to citizens (G2C), government to business (G2B), government to
employee (G2E), and government to government (G2G) [157] to deal with various
data types of stakeholders. The adoption of these applications in society
should meet a high level of citizen confidence through a range of requirements
such as flexibility, transparency, accountability, manageability, good
governance, as well as trustworthy (security and privacy) services [158].
According to a United Nations report, a significant increase is in the
development of e-governance applications in some countries of the world, but
the issue that restricts their use is the security of data and the privacy of
the stakeholders (citizen, government, business, employees, intermediaries and
service providers) against hacking attacks [159]. These applications are a
large pool of databases of diverse sources; therefore, these applications are
exposed many risks such as legitimate users, e-government employees, foreign
intelligence agencies, business enterprises, terrorist organizations, software
providers, and natural disasters. Sharma and Kalra [157] referred to several
attacks against e-governance such as DOS, insider, impersonation, replay, and
offline password guessing. Many examples of security refer to threats
implemented against e-governance:

  * •

In 2012, 112 Indian government websites such as the Planning Commission and
the Finance Ministry were hacked. The hacker stopped these websites from
working for weeks [160].

  * •

In 2017, a cyber attack was carried out against Australian government websites
such as the Finance Department and Australian Electoral Commission. This
attack revealed online sensitive information of more than 50,000 records
[161].

To secure citizen’s data in e-governance applications, security requirements
should be applied. Several procedures have used to secure the privacy of users
such as server security, network security, data security, workstation security
as well as physical and environmental security [159]. Most developed countries
such as USA, UK, and some other NATO member countries use ECC/ECDSA to secure
the privacy of citizens’ data, as well as to protect interoperability between
governments [162] and internal communications to prevent data fraud attacks.
Jain et al. [136] have demonstrated the importance of applying public
signatures to e-governance that authenticate stakeholders in the system. The
availability of efficient digital signatures will provide a powerful
e-authentication mechanism that will allow citizens to safely handle
government documents (such as property tax, income tax, license, visa,
passport, and identity card services). These applications invest technologies
such as cloud computing and Big Data in dealing with large amounts of citizen
data, but also provide significant challenges for developers of these
technologies in terms of security and privacy. Moreover, Singh et al. [102]
argued that e-governance applications store large amounts of citizens’ data in
various technologies such as cloud computing. They proposed applying ECDSA
signatures to protect cloud computing data from change with recommendations
for using ECDSA with accurate parameters. In addition, Lo’ai et al. [100],
Zefferer et al. [137] have noted that ECC/ECDSA is the best algorithm for
signing and encrypting sensitive data transmitted through e-governance
applications. They also discussed that several SCA attacks try to penetrate
the private key in ECDSA. Furthermore, they explained that there is no
countermeasure to block all hacker attacks, but a set of countermeasures
should be used to secure data sharing.

##  7 Conclusion and Future Work

In this paper, we made a detailed study of the security and efficiency of the
ECDSA algorithm. This study enabled us to see the recent improvements for
ECDSA in terms of security, efficiency, and application. This updated
improvement may possibly inspire some ideas to improve some of the methods in
the security and efficiency of the ECDSA. We hope that this study will be
useful for researchers to locate research ideas in securing and improving the
efficiency of the ECDSA algorithm, especially when used in the constrained
source devices. Several future works that we intend to accomplish:

  * •

We intend to implement the ECDSA algorithm in e-health applications to apply
the integrity and authentication properties to protect patients’ data by the
design of the authentication and authorisation protocols for users in the
network.

  * •

We intend to implement lightweight curves such as Edward curve, the Montgomery
SM method, and $\lambda$-Projective in [78] that are critical procedures to
increase the efficiency of implementing ECDSA signatures in accessing a
massive database of e-health.

  * •

We intend to use lightweight hash algorithms to generate random ephemeral $k$
and personal information for healthcare users. These algorithms provide high
performance in computations operations.

  * •

We intend to investigate the application of the ECDSA algorithm with
homomorphic and anonymity mechanisms to secure source-constrained devices data
such as WSN. These devices require efficient and secure mechanisms to protect
patients’ data when transferred from WSN to e-health.

##### Acknowledgements

We would like to acknowledge and thank the efforts of Dr. Barbara Harmes, and
Hawa Bahedh as well as the valuable feedback of the reviewers.

## References

  * Bos et al. [2014] J. W. Bos, J. A. Halderman, N. Heninger, J. Moore, M. Naehrig, and E. Wustrow, “Elliptic curve cryptography in practice,” in _International Conference on Financial Cryptography and Data Security_. Springer, 2014, pp. 157–175.
  * Aydos et al. [2001] M. Aydos, T. Yanik, and C. Koc, “High-speed implementation of an ecc-based wireless authentication protocol on an arm microprocessor,” _IEE Proceedings-Communications_ , vol. 148, no. 5, pp. 273–279, 2001.
  * Cohen et al. [1998] H. Cohen, A. Miyaji, and T. Ono, “Efficient elliptic curve exponentiation using mixed coordinates,” in _International Conference on the Theory and Application of Cryptology and Information Security_. Springer, 1998, pp. 51–65.
  * Varchola et al. [2015] M. Varchola, M. Drutarovsky, M. Repka, and P. Zajac, “Side channel attack on multiprecision multiplier used in protected ecdsa implementation,” in _2015 International Conference on ReConFigurable Computing and FPGAs (ReConFig)_. IEEE, 2015, pp. 1–6.
  * Barker and Dang [2016] E. Barker and Q. Dang, “Nist special publication 800–57 part 1, revision 4,” 2016\.
  * Harkanson and Kim [2017] R. Harkanson and Y. Kim, “Applications of elliptic curve cryptography: a light introduction to elliptic curves and a survey of their applications,” in _Proceedings of the 12th Annual Conference on Cyber and Information Security Research_. ACM, 2017, p. 6.
  * Johnson et al. [2001] D. Johnson, A. Menezes, and S. Vanstone, “The elliptic curve digital signature algorithm (ecdsa),” _International Journal of Information Security_ , vol. 1, no. 1, pp. 36–63, 2001.
  * Izu et al. [2002] T. Izu, B. Möller, and T. Takagi, “Improved elliptic curve multiplication methods resistant against side channel attacks,” in _International Conference on Cryptology in India_. Springer, 2002, pp. 296–313.
  * Joye [2008] M. Joye, “Fast point multiplication on elliptic curves without precomputation,” in _International Workshop on the Arithmetic of Finite Fields_. Springer, 2008, pp. 36–46.
  * Danger et al. [2013] J.-L. Danger, S. Guilley, P. Hoogvorst, C. Murdica, and D. Naccache, “A synthesis of side-channel attacks on elliptic curve cryptography in smart-cards,” _Journal of Cryptographic Engineering_ , vol. 3, no. 4, pp. 241–265, 2013.
  * Smart and Westwood [2003] N. P. Smart and E. Westwood, “Point multiplication on ordinary elliptic curves over fields of characteristic three,” _Applicable Algebra in Engineering, Communication and Computing_ , vol. 13, no. 6, pp. 485–497, 2003\.
  * Han et al. [2002] J.-H. Han, Y.-J. Kim, S.-I. Jun, K.-I. Chung, and C.-H. Seo, “Implementation of ecc/ecdsa cryptography algorithms based on java card,” in _Distributed Computing Systems Workshops, 2002. Proceedings. 22nd International Conference on_. IEEE, 2002, pp. 272–276.
  * Rafik and Mohammed [2013] M. B. O. Rafik and F. Mohammed, “The impact of ecc’s scalar multiplication on wireless sensor networks,” in _Programming and Systems (ISPS), 2013 11th International Symposium on_. IEEE, 2013, pp. 17–23.
  * Nabil et al. [2012] G. Nabil, K. Naziha, F. Lamia, and K. Lotfi, “Hardware implementation of elliptic curve digital signature algorithm (ecdsa) on koblitz curves,” in _Communication Systems, Networks & Digital Signal Processing (CSNDSP), 2012 8th International Symposium on_. IEEE, 2012, pp. 1–6.
  * Eisenträger et al. [2003] K. Eisenträger, K. Lauter, and P. L. Montgomery, “Fast elliptic curve arithmetic and improved weil pairing evaluation,” in _Cryptographers’ Track at the RSA Conference_. Springer, 2003, pp. 343–354.
  * Zhong et al. [2016] H. Zhong, R. Zhao, J. Cui, X. Jiang, and J. Gao, “An improved ecdsa scheme for wireless sensor network,” _International Journal of Future Generation Communication and Networking_ , vol. 9, no. 2, pp. 73–82, 2016.
  * Driessen et al. [2008] B. Driessen, A. Poschmann, and C. Paar, “Comparison of innovative signature algorithms for wsns,” in _Proceedings of the first ACM conference on Wireless network security_. ACM, 2008, pp. 30–35.
  * Cheneau et al. [2010] T. Cheneau, A. Boudguiga, and M. Laurent, “Significantly improved performances of the cryptographically generated addresses thanks to ecc and gpgpu,” _computers & security_, vol. 29, no. 4, pp. 419–431, 2010.
  * Xu et al. [2012] S. Xu, C. Li, F. Li, and S. Zhang, “An improved sliding window algorithm for ecc multiplication,” in _World Automation Congress (WAC), 2012_. IEEE, 2012, pp. 335–338.
  * Franeková et al. [2017] M. Franeková, P. Holečko, E. Bubeníková, and A. Kanáliková, “Transport scenarios analysis within c2c communications focusing on security aspects,” in _Applied Machine Intelligence and Informatics (SAMI), 2017 IEEE 15th International Symposium on_. IEEE, 2017, pp. 000 461–000 466.
  * Vaudenay [2003] S. Vaudenay, “The security of dsa and ecdsa,” in _International Workshop on Public Key Cryptography_. Springer, 2003, pp. 309–323.
  * Osamy and Khedr [2018] W. Osamy and A. M. Khedr, “An algorithm for enhancing coverage and network lifetime in cluster-based wireless sensor networks,” _International Journal of Communication Networks and Information Security (IJCNIS)_ , vol. 10, no. 1, 2018.
  * Wander et al. [2005] A. S. Wander, N. Gura, H. Eberle, V. Gupta, and S. C. Shantz, “Energy analysis of public-key cryptography for wireless sensor networks,” in _Third IEEE international conference on pervasive computing and communications_. IEEE, 2005, pp. 324–328.
  * Wang and Li [2006] H. Wang and Q. Li, “Efficient implementation of public key cryptosystems on mote sensors (short paper),” in _International Conference on Information and Communications Security_. Springer, 2006, pp. 519–528.
  * Trakadas et al. [2008] P. Trakadas, T. Zahariadis, H. Leligou, S. Voliotis, and K. Papadopoulos, “Analyzing energy and time overhead of security mechanisms in wireless sensor networks,” in _2008 15th International Conference on Systems, Signals and Image Processing_. IEEE, 2008, pp. 137–140.
  * De Meulenaer et al. [2008] G. De Meulenaer, F. Gosset, F.-X. Standaert, and O. Pereira, “On the energy cost of communication and cryptography in wireless sensor networks,” in _2008 IEEE International Conference on Wireless and Mobile Computing, Networking and Communications_. IEEE, 2008, pp. 580–585.
  * Fan and Gong [2012] X. Fan and G. Gong, “Accelerating signature-based broadcast authentication for wireless sensor networks,” _Ad Hoc Networks_ , vol. 10, no. 4, pp. 723–736, 2012.
  * Kodali [2013] R. K. Kodali, “Implementation of ecdsa in wsn,” in _Control Communication and Computing (ICCC), 2013 International Conference on_. IEEE, 2013, pp. 310–314.
  * Lavanya and Natarajan [2017] M. Lavanya and V. Natarajan, “Lightweight key agreement protocol for iot based on ikev2,” _Computers & Electrical Engineering_, 2017.
  * LAVANYA and NATARAJAN [2017] M. LAVANYA and V. NATARAJAN, “Lwdsa: light-weight digital signature algorithm for wireless sensor networks,” _Sādhanā_ , pp. 1–15, 2017.
  * Kern and Feldhofer [2010] T. Kern and M. Feldhofer, “Low-resource ecdsa implementation for passive rfid tags,” in _Electronics, Circuits, and Systems (ICECS), 2010 17th IEEE International Conference on_. IEEE, 2010, pp. 1236–1239.
  * Hutter et al. [2010] M. Hutter, M. Feldhofer, and T. Plos, “An ecdsa processor for rfid authentication,” in _International Workshop on Radio Frequency Identification: Security and Privacy Issues_. Springer, 2010, pp. 189–202.
  * Pessl and Hutter [2014] P. Pessl and M. Hutter, “Curved tags–a low-resource ecdsa implementation tailored for rfid,” in _International Workshop on Radio Frequency Identification: Security and Privacy Issues_. Springer, 2014, pp. 156–172.
  * Younis and Abdulkareem [2017] M. I. Younis and M. H. Abdulkareem, “Itpmap: An improved three-pass mutual authentication protocol for secure rfid systems,” _Wireless Personal Communications_ , vol. 96, no. 1, pp. 65–101, 2017.
  * Ibrahim and Dalkılıç [2017a] A. Ibrahim and G. Dalkılıç, “An advanced encryption standard powered mutual authentication protocol based on elliptic curve cryptography for rfid, proven on wisp,” _Journal of Sensors_ , vol. 2017, 2017.
  * Li et al. [2017] R. Li, T. Song, N. Capurso, J. Yu, J. Couture, and X. Cheng, “Iot applications on secure smart shopping system,” _IEEE Internet of Things Journal_ , 2017\.
  * Batina et al. [2010] L. Batina, J.-H. Hoepman, B. Jacobs, W. Mostowski, and P. Vullers, “Developing efficient blinded attribute certificates on smart cards via pairings,” in _International Conference on Smart Card Research and Advanced Applications_. Springer, 2010, pp. 209–222.
  * Savari and Montazerolzohour [2012] M. Savari and M. Montazerolzohour, “All about encryption in smart card,” in _Cyber Security, Cyber Warfare and Digital Forensic (CyberSec), 2012 International Conference on_. IEEE, 2012, pp. 54–59.
  * Dubeuf et al. [2017] J. Dubeuf, D. Hely, and V. Beroulle, “Enhanced elliptic curve scalar multiplication secure against side channel attacks and safe errors,” in _International Workshop on Constructive Side-Channel Analysis and Secure Design_. Springer, 2017, pp. 65–82.
  * de Dormale and Quisquater [2007] G. M. de Dormale and J.-J. Quisquater, “High-speed hardware implementations of elliptic curve cryptography: A survey,” _Journal of systems architecture_ , vol. 53, no. 2, pp. 72–84, 2007.
  * Fan et al. [2010] J. Fan, X. Guo, E. De Mulder, P. Schaumont, B. Preneel, and I. Verbauwhede, “State-of-the-art of secure ecc implementations: a survey on known side-channel attacks and countermeasures,” in _Hardware-Oriented Security and Trust (HOST), 2010 IEEE International Symposium on_. IEEE, 2010, pp. 76–87.
  * Abdouli et al. [2011] A. S. Abdouli, J. Baek, and C. Y. Yeun, “Survey on computationally hard problems and their applications to cryptography,” in _Internet Technology and Secured Transactions (ICITST), 2011 International Conference for_. IEEE, 2011, pp. 46–52.
  * Fan and Verbauwhede [2012] J. Fan and I. Verbauwhede, “An updated survey on secure ecc implementations: Attacks, countermeasures and cost,” in _Cryptography and Security: From Theory to Applications_. Springer, 2012, pp. 265–282.
  * Yang et al. [2015] Q. Yang, X. Zhu, H. Fu, and X. Che, “Survey of security technologies on wireless sensor networks,” _Journal of Sensors_ , vol. 2015, 2015.
  * Mayer [2016] H. Mayer, “Ecdsa security in bitcoin and ethereum: a research survey,” 2016.
  * Li et al. [2013] H. Li, R. Zhang, J. Yi, and H. Lv, “A novel algorithm for scalar multiplication in ecdsa,” in _Computational and Information Sciences (ICCIS), 2013 Fifth International Conference on_. IEEE, 2013, pp. 943–946.
  * Hutter et al. [2011] M. Hutter, M. Feldhofer, and J. Wolkerstorfer, “A cryptographic processor for low-resource devices: Canning ecdsa and aes like sardines,” in _IFIP International Workshop on Information Security Theory and Practices_. Springer, 2011, pp. 144–159.
  * Ismail et al. [2010] A. M. Ismail, M. R. M. Said, K. M. Atan, and I. S. Rakhimov, “An algorithm to enhance elliptic curves scalar multiplication combinig mbnr with point halving,” _Applied Mathematical sciences_ , vol. 4, no. 1, pp. 259–1, 2010\.
  * Morain and Olivos [1990] F. Morain and J. Olivos, “Speeding up the computations on an elliptic curve using addition-subtraction chains,” _Information Theory Applications_ , vol. 24, no. 6, pp. 531–543, 1990.
  * Purohit and Rawat [2011] G. Purohit and A. S. Rawat, “Fast scalar multiplication in ecc using the multi base number system,” _International Journal of Computer Science Issues_ , vol. 8, no. 1, pp. 131–137, 2011.
  * Purohit et al. [2012] G. Purohit, A. S. Rawat, and M. Kumar, “Elliptic curve point multiplication using mbnr and point halving,” _Int. J. Advanced Networking and Applications_ , vol. 3, no. 2, pp. 1329–1337, 2012.
  * Wong et al. [2006] K.-W. Wong, E. C. Lee, L. Cheng, and X. Liao, “Fast elliptic scalar multiplication using new double-base chain and point halving,” _Applied mathematics and computation_ , vol. 183, no. 2, pp. 1000–1007, 2006.
  * Knudsen [1999] E. W. Knudsen, “Elliptic scalar multiplication using point halving,” in _International Conference on the Theory and Application of Cryptology and Information Security_. Springer, 1999, pp. 135–149.
  * Ciet et al. [2006] M. Ciet, M. Joye, K. Lauter, and P. L. Montgomery, “Trading inversions for multiplications in elliptic curve cryptography,” _Designs, codes and cryptography_ , vol. 39, no. 2, pp. 189–206, 2006.
  * Ciet and Sica [2005] M. Ciet and F. Sica, “An analysis of double base number systems and a sublinear scalar multiplication algorithm,” in _International Conference on Cryptology in Malaysia_. Springer, 2005, pp. 171–182.
  * Dimitrov et al. [2005] V. Dimitrov, L. Imbert, and P. K. Mishra, “Efficient and secure elliptic curve point multiplication using double-base chains,” in _International Conference on the Theory and Application of Cryptology and Information Security_. Springer, 2005, pp. 59–78.
  * Mishra and Dimitrov [2007] P. K. Mishra and V. Dimitrov, “Efficient quintuple formulas for elliptic curves and efficient scalar multiplication using multibase number representation,” in _International Conference on Information Security_. Springer, 2007, pp. 390–406.
  * Longa and Miri [2008] P. Longa and A. Miri, “New composite operations and precomputation scheme for elliptic curve cryptosystems over prime fields (full version).” _IACR Cryptology ePrint Archive_ , vol. 2008, p. 51, 2008.
  * Chabrier and Tisserand [2013] T. Chabrier and A. Tisserand, “On-the-fly multi-base recoding for ecc scalar multiplication without pre-computations,” in _Computer Arithmetic (ARITH), 2013 21st IEEE Symposium on_. IEEE, 2013, pp. 219–228.
  * Schroeppel [2000] R. Schroeppel, “Elliptic curve point ambiguity resolution apparatus and method,” Apr. 3 2000, uS Patent 7,200,225.
  * Fong et al. [2004] K. Fong, D. Hankerson, J. López, and A. Menezes, “Field inversion and point halving revisited,” _IEEE Transactions on Computers_ , vol. 53, no. 8, pp. 1047–1059, 2004.
  * Avanzi et al. [2004] R. M. Avanzi, M. Ciet, and F. Sica, “Faster scalar multiplication on koblitz curves combining point halving with the frobenius endomorphism,” in _International Workshop on Public Key Cryptography_. Springer, 2004, pp. 28–40.
  * Hankerson et al. [2006] D. Hankerson, A. J. Menezes, and S. Vanstone, _Guide to elliptic curve cryptography_. Springer Science & Business Media, 2006.
  * Miyaji et al. [1997] A. Miyaji, T. Ono, and H. Cohen, “Efficient elliptic curve exponentiation,” _Information and Communications Security_ , pp. 282–290, 1997.
  * Gallant et al. [2001] R. P. Gallant, R. J. Lambert, and S. A. Vanstone, “Faster point multiplication on elliptic curves with efficient endomorphisms,” in _Annual International Cryptology Conference_. Springer, 2001, pp. 190–200.
  * Park et al. [2005] T. J. Park, M.-K. Lee, K. Park, and K. I. Chung, “Speeding up scalar multiplication in genus 2 hyperelliptic curves with efficient endomorphisms,” _ETRI journal_ , vol. 27, no. 5, pp. 617–627, 2005.
  * Liu et al. [2017a] Z. Liu, J. Großschädl, Z. Hu, K. Järvinen, H. Wang, and I. Verbauwhede, “Elliptic curve cryptography with efficiently computable endomorphisms and its hardware implementations for the internet of things,” _IEEE Transactions on Computers_ , vol. 66, no. 5, pp. 773–785, 2017.
  * Cohen et al. [2005] H. Cohen, G. Frey, R. Avanzi, C. Doche, T. Lange, K. Nguyen, and F. Vercauteren, _Handbook of elliptic and hyperelliptic curve cryptography_. CRC press, 2005.
  * Mohamed et al. [2012] N. A. Mohamed, M. H. Hashim, and M. Hutter, “Improved fixed-base comb method for fast scalar multiplication,” in _International Conference on Cryptology in Africa_. Springer, 2012, pp. 342–359.
  * Saqib et al. [2004] N. A. Saqib, F. Rodriguez-Henriquez, and A. Diaz-Perez, “A parallel architecture for fast computation of elliptic curve scalar multiplication over $gf(2^{m})$,” in _Parallel and Distributed Processing Symposium, 2004\. Proceedings. 18th International_. IEEE, 2004, p. 144.
  * Petit [2009] J. Petit, “Analysis of ecdsa authentication processing in vanets,” in _2009 3rd International Conference on New Technologies, Mobility and Security_. IEEE, 2009, pp. 1–5.
  * Liu et al. [2017b] Z. Liu, X. Huang, Z. Hu, M. K. Khan, H. Seo, and L. Zhou, “On emerging family of elliptic curves to secure internet of things: Ecc comes of age,” _IEEE Transactions on Dependable and Secure Computing_ , vol. 14, no. 3, pp. 237–248, 2017.
  * Hankerson et al. [2000] D. Hankerson, J. L. Hernandez, and A. Menezes, “Software implementation of elliptic curve cryptography over binary fields,” in _International Workshop on Cryptographic Hardware and Embedded Systems_. Springer, 2000, pp. 1–24.
  * Antipa et al. [2005] A. Antipa, D. Brown, R. Gallant, R. Lambert, R. Struik, and S. Vanstone, “Accelerated verification of ecdsa signatures,” in _International Workshop on Selected Areas in Cryptography_. Springer, 2005, pp. 307–318.
  * Meloni [2007] N. Meloni, “New point addition formulae for ecc applications,” in _International Workshop on the Arithmetic of Finite Fields_. Springer, 2007, pp. 189–201.
  * Sakthivel and Nedunchezhian [2013] A. Sakthivel and R. Nedunchezhian, “Improved the execution speed of ecdsa over gf $(2^{n})$ algorithm for concurrent computation.” _Journal of Theoretical & Applied Information Technology_, vol. 50, no. 1, 2013.
  * Guerrini et al. [2017] E. Guerrini, L. Imbert, and T. Winterhalter, “Randomized mixed-radix scalar multiplication,” _IEEE Transactions on Computers_ , 2017.
  * Oliveira et al. [2014] T. Oliveira, J. López, D. F. Aranha, and F. Rodríguez-Henríquez, “Two is the fastest prime: lambda coordinates for binary elliptic curves,” _Journal of Cryptographic Engineering_ , vol. 4, no. 1, pp. 3–17, 2014.
  * Brown et al. [2001] M. Brown, D. Hankerson, J. López, and A. Menezes, “Software implementation of the nist elliptic curves over prime fields,” in _Cryptographers’ Track at the RSA Conference_. Springer, 2001, pp. 250–265.
  * López and Dahab [1998] J. López and R. Dahab, “Improved algorithms for elliptic curve arithmetic in gf $(2^{n})$,” in _International Workshop on Selected Areas in Cryptography_. Springer, 1998, pp. 201–212.
  * Al-Somani [2017] T. F. Al-Somani, “High-performance generic-point parallel scalar multiplication,” _Arabian Journal for Science and Engineering_ , vol. 42, no. 2, pp. 507–512, 2017.
  * Chudnovsky and Chudnovsky [1986] D. V. Chudnovsky and G. V. Chudnovsky, “Sequences of numbers generated by addition in formal groups and new primality and factorization tests,” _Advances in Applied Mathematics_ , vol. 7, no. 4, pp. 385–434, 1986.
  * Pan et al. [2017] W. Pan, F. Zheng, Y. Zhao, W.-T. Zhu, and J. Jing, “An efficient elliptic curve cryptography signature server with gpu acceleration,” _IEEE Transactions on Information Forensics and Security_ , vol. 12, no. 1, pp. 111–122, 2017.
  * Wang et al. [2006] H. Wang, Z. Wu, and X. Tan, “A new secure authentication scheme based threshold ecdsa for wireless sensor network.” in _Security and Management_ , 2006, pp. 129–133.
  * Othman et al. [2013] S. B. Othman, H. Alzaid, A. Trad, and H. Youssef, “An efficient secure data aggregation scheme for wireless sensor networks,” in _Information, Intelligence, Systems and Applications (IISA), 2013 Fourth International Conference on_. IEEE, 2013, pp. 1–4.
  * Jariwala and Jinwala [2012] V. Jariwala and D. Jinwala, “A novel approach for secure data aggregation in wireless sensor networks,” _arXiv preprint arXiv:1203.4698_ , 2012.
  * Singh et al. [2016] A. Singh, A. K. Awasthi, and K. Singh, “A key agreement algorithm based on ecdsa for wireless sensor network,” in _Proceedings of 3rd International Conference on Advanced Computing, Networking and Informatics_. Springer, 2016, pp. 143–149.
  * Lamba and Sharma [2013] S. Lamba and M. Sharma, “An efficient elliptic curve digital signature algorithm (ecdsa),” in _Machine Intelligence and Research Advancement (ICMIRA), 2013 International Conference on_. IEEE, 2013, pp. 179–183.
  * Giraud and Thiebeauld [2004] C. Giraud and H. Thiebeauld, “A survey on fault attacks,” in _Smart Card Research and Advanced Applications VI_. Springer, 2004, pp. 159–176.
  * Oh and Kim [2017] S.-R. Oh and Y.-G. Kim, “Security requirements analysis for the iot,” in _Platform Technology and Service (PlatCon), 2017 International Conference on_. IEEE, 2017, pp. 1–6.
  * Elghazel et al. [2015] W. Elghazel, J. Bahi, C. Guyeux, M. Hakem, K. Medjaher, and N. Zerhouni, “Dependability of wireless sensor networks for industrial prognostics and health management,” _Computers in Industry_ , vol. 68, pp. 1–15, 2015.
  * Tiburski et al. [2017] R. T. Tiburski, L. A. Amaral, E. de Matos, D. F. de Azevedo, and F. Hessel, “Evaluating the use of tls and dtls protocols in iot middleware systems applied to e-health,” in _Consumer Communications & Networking Conference (CCNC), 2017 14th IEEE Annual_. IEEE, 2017, pp. 480–485.
  * Nadeem and Howarth [2013] A. Nadeem and M. P. Howarth, “A survey of manet intrusion detection & prevention approaches for network layer attacks,” _IEEE communications surveys & tutorials_, vol. 15, no. 4, pp. 2027–2045, 2013.
  * Ometov et al. [2017] A. Ometov, A. Levina, P. Borisenko, R. Mostovoy, A. Orsino, and S. Andreev, “Mobile social networking under side-channel attacks: Practical security challenges,” _IEEE Access_ , vol. 5, pp. 2591–2601, 2017.
  * Alhothaily et al. [2017] A. Alhothaily, C. Hu, A. Alrawais, T. Song, X. Cheng, and D. Chen, “A secure and practical authentication scheme using personal devices,” _IEEE Access_ , vol. 5, pp. 11 677–11 687, 2017.
  * Ibrahim and Dalkılıç [2017b] A. Ibrahim and G. Dalkılıç, “An advanced encryption standard powered mutual authentication protocol based on elliptic curve cryptography for rfid, proven on wisp,” _Journal of Sensors_ , vol. 2017, 2017.
  * Bojjagani and Sastry [2017] S. Bojjagani and V. Sastry, “A secure end-to-end sms-based mobile banking protocol,” _International Journal of Communication Systems_ , 2017.
  * Rajput et al. [2017] U. Rajput, F. Abbas, H. Eun, and H. Oh, “A hybrid approach for efficient privacy-preserving authentication in vanet,” _IEEE Access_ , vol. 5, pp. 12 014–12 030, 2017.
  * Masud and Hossain [2017] M. Masud and M. S. Hossain, “Secure data-exchange protocol in a cloud-based collaborative health care environment,” _Multimedia Tools and Applications_ , pp. 1–15, 2017.
  * Lo’ai et al. [2016] A. T. Lo’ai, T. F. Somani, and H. Houssain, “Towards secure communications: Review of side channel attacks and countermeasures on ecc,” in _Internet Technology and Secured Transactions (ICITST), 2016 11th International Conference for_. IEEE, 2016, pp. 87–91.
  * Mann and Loebenberger [2017] C. Mann and D. Loebenberger, “Two-factor authentication for the bitcoin protocol,” _International Journal of Information Security_ , vol. 16, no. 2, pp. 213–226, 2017.
  * Singh et al. [2015] J. P. Singh, S. Kumar _et al._ , “Authentication and encryption in cloud computing,” in _Smart Technologies and Management for Computing, Communication, Controls, Energy and Materials (ICSTM), 2015 International Conference on_. IEEE, 2015, pp. 216–219.
  * Blake et al. [2005] I. F. Blake, G. Seroussi, and N. P. Smart, _Advances in elliptic curve cryptography_. Cambridge University Press, 2005, vol. 317.
  * Medwed and Oswald [2008] M. Medwed and E. Oswald, “Template attacks on ecdsa,” in _International Workshop on Information Security Applications_. Springer, 2008, pp. 14–27.
  * Wang et al. [2015] L. Wang, Q. Li, G. Zhang, J. Yu, Z. Zhang, L. Guo, and D. W. Zhang, “A new spa attack on ecc with regular point multiplication,” in _Computational Intelligence and Security (CIS), 2015 11th International Conference on_. IEEE, 2015, pp. 322–325.
  * Liardet and Smart [2001] P.-Y. Liardet and N. P. Smart, “Preventing spa/dpa in ecc systems using the jacobi form,” in _International Workshop on Cryptographic Hardware and Embedded Systems_. Springer, 2001, pp. 391–401.
  * Dou et al. [2017] Y. Dou, J. Weng, C. Ma, and F. Wei, “Secure and efficient ecc speeding up algorithms for wireless sensor networks,” _Soft Computing_ , vol. 21, no. 19, pp. 5665–5673, 2017.
  * Aranha et al. [2014] D. F. Aranha, P.-A. Fouque, B. Gérard, J.-G. Kammerer, M. Tibouchi, and J.-C. Zapalowicz, “Glv/gls decomposition, power analysis, and attacks on ecdsa signatures with single-bit nonce bias,” in _International Conference on the Theory and Application of Cryptology and Information Security_. Springer, 2014, pp. 262–281.
  * Liu et al. [2017c] Z. Liu, D. Liu, and X. Zou, “An efficient and flexible hardware implementation of the dual-field elliptic curve cryptographic processor,” _IEEE Transactions on Industrial Electronics_ , vol. 64, no. 3, pp. 2353–2362, 2017\.
  * Fouque et al. [2016] P.-A. Fouque, S. Guilley, C. Murdica, and D. Naccache, “Safe-errors on spa protected implementations with the atomicity technique,” in _The New Codebreakers_. Springer, 2016, pp. 479–493.
  * Blömer and Günther [2015] J. Blömer and P. Günther, “Singular curve point decompression attack,” in _Fault Diagnosis and Tolerance in Cryptography (FDTC), 2015 Workshop on_. IEEE, 2015, pp. 71–84.
  * Fournaris et al. [2016] A. P. Fournaris, L. Papachristodoulou, L. Batina, and N. Sklavos, “Residue number system as a side channel and fault injection attack countermeasure in elliptic curve cryptography,” in _Design and Technology of Integrated Systems in Nanoscale Era (DTIS), 2016 International Conference on_. IEEE, 2016, pp. 1–4.
  * Bos et al. [2016] J. W. Bos, C. Costello, P. Longa, and M. Naehrig, “Selecting elliptic curves for cryptography: an efficiency and security analysis,” _Journal of Cryptographic Engineering_ , vol. 6, no. 4, pp. 259–286, 2016.
  * Verbauwhede et al. [2011] I. Verbauwhede, D. Karaklajic, and J.-M. Schmidt, “The fault attack jungle-a classification model to guide you,” in _Fault Diagnosis and Tolerance in Cryptography (FDTC), 2011 Workshop on_. IEEE, 2011, pp. 3–8.
  * Barenghi et al. [2012] A. Barenghi, L. Breveglieri, I. Koren, and D. Naccache, “Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures,” _Proceedings of the IEEE_ , vol. 100, no. 11, pp. 3056–3076, 2012.
  * Barenghi et al. [2016] A. Barenghi, G. M. Bertoni, L. Breveglieri, G. Pelosi, S. Sanfilippo, and R. Susella, “A fault-based secret key retrieval method for ecdsa: Analysis and countermeasure,” _ACM Journal on Emerging Technologies in Computing Systems (JETC)_ , vol. 13, no. 1, p. 8, 2016.
  * Liao et al. [2017] K. Liao, X. Cui, N. Liao, T. Wang, D. Yu, and X. Cui, “High-performance noninvasive side-channel attack resistant ecc coprocessor for gf (2m),” _IEEE Transactions on Industrial Electronics_ , vol. 64, no. 1, pp. 727–738, 2017.
  * Chuen [2015] D. L. K. Chuen, _Handbook of digital currency: Bitcoin, innovation, financial instruments, and big data_. Academic Press, 2015.
  * Koblitz and Menezes [2015] N. Koblitz and A. J. Menezes, “The random oracle model: a twenty-year retrospective,” _Designs, Codes and Cryptography_ , vol. 77, no. 2-3, pp. 587–610, 2015.
  * Ha and Moon [2002] J. C. Ha and S. J. Moon, “Randomized signed-scalar multiplication of ecc to resist power attacks,” in _International Workshop on Cryptographic Hardware and Embedded Systems_. Springer, 2002, pp. 551–563.
  * Samotyja and Lemke-Rust [2016] J. Samotyja and K. Lemke-Rust, “Practical results of ecc side channel countermeasures on an arm cortex m3 processor,” in _Proceedings of the 2016 ACM Workshop on Theory of Implementation Security_. ACM, 2016, pp. 27–35.
  * Bhattacharya et al. [2017] S. Bhattacharya, C. Maurice, S. Bhasin, and D. Mukhopadhyay, “Template attack on blinded scalar multiplication with asynchronous perf-ioctl calls,” 2017.
  * Poussier et al. [2017] R. Poussier, Y. Zhou, and F.-X. Standaert, “A systematic approach to the side-channel analysis of ecc implementations with worst-case horizontal attacks,” in _International Conference on Cryptographic Hardware and Embedded Systems_. Springer, 2017, pp. 534–554.
  * Hedabou et al. [2005] M. Hedabou, P. Pinel, and L. Bénéteau, “Countermeasures for preventing comb method against sca attacks,” in _International Conference on Information Security Practice and Experience_. Springer, 2005, pp. 85–96.
  * Schmidt and Medwed [2009] J.-M. Schmidt and M. Medwed, “A fault attack on ecdsa,” in _Fault Diagnosis and Tolerance in Cryptography (FDTC), 2009 Workshop on_. IEEE, 2009, pp. 93–99.
  * Liu et al. [2017d] Z. Liu, D. Liu, and X. Zou, “An efficient and flexible hardware implementation of the dual-field elliptic curve cryptographic processor,” _IEEE Transactions on Industrial Electronics_ , vol. 64, no. 3, pp. 2353–2362, 2017\.
  * Sasdrich and Güneysu [2017] P. Sasdrich and T. Güneysu, “Cryptography for next generation tls: Implementing the rfc 7748 elliptic curve448 cryptosystem in hardware,” in _Proceedings of the 54th Annual Design Automation Conference 2017_. ACM, 2017, p. 16.
  * Karati et al. [2012] S. Karati, A. Das, and D. R. Chowdhury, “Using randomizers for batch verification of ecdsa signatures.” _IACR Cryptology ePrint Archive_ , vol. 2012, p. 582, 2012.
  * Fan et al. [2017] X. Fan, A. Otemissov, F. Sica, and A. Sidorenko, “Multiple point compression on elliptic curves,” _Designs, Codes and Cryptography_ , vol. 83, no. 3, pp. 565–588, 2017.
  * Rožić et al. [2017] V. Rožić, O. Reparaz, and I. Verbauwhede, “A 5.1 $\mu$j per point-multiplication elliptic curve cryptographic processor,” _International Journal of Circuit Theory and Applications_ , vol. 45, no. 2, pp. 170–187, 2017.
  * Möller [2001] B. Möller, “Securing elliptic curve point multiplication against side-channel attacks,” in _International Conference on Information Security_. Springer, 2001, pp. 324–334.
  * Möller [2002] B. Möller, “Parallelizable elliptic curve point multiplication method with resistance against side-channel attacks,” in _International Conference on Information Security_ , 2002, pp. 402–413.
  * Karaklajić et al. [2011] D. Karaklajić, J. Fan, J.-M. Schmidt, and I. Verbauwhede, “Low-cost fault detection method for ecc using montgomery powering ladder,” in _Design, Automation & Test in Europe Conference & Exhibition (DATE), 2011_. IEEE, 2011, pp. 1–6.
  * Oliveira et al. [2017] T. Oliveira, J. López, and F. Rodríguez-Henríquez, “The montgomery ladder on binary elliptic curves,” _Journal of Cryptographic Engineering_ , pp. 1–18, 2017.
  * Feng and Li [2017] X. Feng and S. Li, “A high-speed and spa-resistant implementation of ecc point multiplication over gf (p),” in _Trustcom/BigDataSE/ICESS, 2017 IEEE_. IEEE, 2017, pp. 255–260.
  * Jain et al. [2015] V. Jain, R. Kumar, and Z. Saquib, “An approach towards digital signatures for e-governance in india,” in _Proceedings of the 2015 2nd International Conference on Electronic Governance and Open Society: Challenges in Eurasia_. ACM, 2015, pp. 82–88.
  * Zefferer et al. [2013] T. Zefferer, F. Golser, and T. Lenz, “Towards mobile government: verification of electronic signatures on smartphones,” in _International Conference on Electronic Government and the Information Systems Perspective_. Springer, 2013, pp. 140–151.
  * Khatoun and Zeadally [2017] R. Khatoun and S. Zeadally, “Cybersecurity and privacy solutions in smart cities,” _IEEE Communications Magazine_ , vol. 55, no. 3, pp. 51–59, 2017\.
  * Alhaqbani and Fidge [2008] B. Alhaqbani and C. Fidge, “Privacy-preserving electronic health record linkage using pseudonym identifiers,” in _E-health Networking, Applications and Services, 2008. HealthCom 2008. 10th International Conference on_. IEEE, 2008, pp. 108–117.
  * Paganini [2014] P. Paganini, “Risks and cyber threats to the healthcare industry,” INFOSEC Institute, Tech. Rep., 2014, available at http://resources.infosecinstitute.com/risks-cyber-threats-healthcare-industry/\\#gref.
  * Health Care Authority [2016] Health Care Authority, “Data breach for apple health (medicaid) managed care plan,” https://www.hca.wa.gov/about-hca/apple-health-medicaid/data-breach-apple-health-medicaid-managed-care-plan-what-clients, Washington State, 2016.
  * Davis [2017] J. Davis, “Ehr server hack threatens data of 14,000 ivf clinic patients,” healthcare IT News, Tech. Rep., 2017, available at http://www.healthcareitnews.com/news/ehr-server-hack-threatens-data-14000-ivf-clinic-patients.
  * Garrett [2016] B. Garrett, “Vormetric data threat report,” 451 RESEARCH, Thales Group, Tech. Rep., 2016, available at https://www.thalesesecurity.com/.
  * Gajanayake et al. [2014] R. Gajanayake, R. Iannella, and T. Sahama, “Privacy oriented access control for electronic health records,” _Electronic Journal of Health Informatics_ , vol. 8, no. 2, p. 15, 2014.
  * Neubauer and Heurix [2011] T. Neubauer and J. Heurix, “A methodology for the pseudonymization of medical data,” _International Journal of Medical Informatics_ , vol. 80, no. 3, pp. 190–204, 2011.
  * Ateniese et al. [2017] G. Ateniese, G. Bianchi, A. T. Capossele, C. Petrioli, and D. Spenza, “Low-cost standard signatures for energy-harvesting wireless sensor networks,” _ACM Transactions on Embedded Computing Systems (TECS)_ , vol. 16, no. 3, p. 64, 2017.
  * Ghosh et al. [2017] S. Ghosh, A. Majumder, J. Goswami, A. Kumar, S. P. Mohanty, and B. K. Bhattacharyya, “Swing-pay: One card meets all user payment and identity needs: A digital card module using nfc and biometric authentication for peer-to-peer payment,” _IEEE Consumer Electronics Magazine_ , vol. 6, no. 1, pp. 82–93, 2017.
  * Kshetri and Voas [2017] N. Kshetri and J. Voas, “Banking on availability,” _IEEE COMPUTER SOCIETY_ , vol. 50, no. 1, pp. 76–80, 2017.
  * RSA [2017] RSA, “Web threat detection trends in e-commerce,” https://www.rsa.com/content/dam/pdfs/2-2017/rsa-web-threat-eCommerce-ebook.pdf, A Guide to Improve Fraud Detection and Investigation, 2017.
  * PHISHLABS [2017] PHISHLABS, “2017 phishing trends and intelligence report: Hacking the human,” https://pages.phishlabs.com/rs/130-BFB-942/images/2017%20PhishLabs%20Phishing%20and%20Threat%20Intelligence%20Report.pdf, Ecrime Management Strategies, 2017.
  * IPC [2017] IPC, “E-commerce sector at risk of ĺethald́dos attacks this 2017,” http://ipc.ph/en/e-commerce-sector-risk-lethal-ddos-attacks-2017/, 2017\.
  * van der Horst et al. [2017] L. van der Horst, K.-K. R. Choo, and N.-A. Le-Khac, “Process memory investigation of the bitcoin clients electrum and bitcoin core,” _IEEE Access_ , 2017.
  * Manvi and Tangade [2017] S. S. Manvi and S. Tangade, “A survey on authentication schemes in vanets for secured communication,” _Vehicular Communications_ , 2017.
  * Greenberg [2015] A. Greenberg, “Hackers remotely kill a jeep on the highway,” Tech. Rep., 2015, available at https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/.
  * Numaan Huq and Swimmer [2017] R. V. Numaan Huq and M. Swimmer, “Cyberattacks against intelligent transportation systems,” TrendLabs, Tech. Rep., 2017, available at https://documents.trendmicro.com/assets/white\\_papers/wp-cyberattacks-against-intelligent-transportation-systems.pdf.
  * Manvi et al. [2009] S. Manvi, M. Kakkasageri, and D. Adiga, “Message authentication in vehicular ad hoc networks: Ecdsa based approach,” in _Future Computer and Communication, 2009. ICFCC 2009. International Conference on_. IEEE, 2009, pp. 16–20.
  * Sharma and Kalra [2017] G. Sharma and S. Kalra, “A secure remote user authentication scheme for smart cities e-governance applications,” _Journal of Reliable Intelligent Environments_ , vol. 3, no. 3, pp. 177–188, 2017.
  * Angelopoulos et al. [2017] K. Angelopoulos, V. Diamantopoulou, H. Mouratidis, M. Pavlidis, M. Salnitri, P. Giorgini, and J. F. Ruiz, “A holistic approach for privacy protection in e-government,” in _Proceedings of the 12th International Conference on Availability, Reliability and Security_. ACM, 2017, p. 17.
  * Gupta et al. [2017] R. Gupta, S. K. Muttoo, and S. K. Pal, “Proposed framework for information systems security for e-governance in developing nations,” in _Proceedings of the 10th International Conference on Theory and Practice of Electronic Governance_. ACM, 2017, pp. 546–547.
  * Joshi [2012] S. Joshi, “112 government websites hacked in the last 3 months,” Tech. Rep., 2012, available at http://www.thehindu.com/sci-tech/technology/internet/112-government-websites-hacked-in-the-last-3-months/article2999836.ece.
  * Doug Dingwall and McIlroy [2017] F. O. Doug Dingwall and T. McIlroy, “Data breach sees records of 50,000 australian workers exposed,” The Canberra Crimes, Tech. Rep., 2017, available at http://www.canberratimes.com.au/national/public-service/data-breach-sees-records-of-50000-australian-workers-exposed-20171102-gzdef3.html.
  * Chowdhury et al. [2014] B. Chowdhury, M. Chowdhury, and J. Abawajy, “Securing a smart anti-counterfeit web application,” _Journal of networks_ , vol. 9, no. 11, pp. 2925–2933, 2014.


# Multicolor and 3D holography realized by
inverse design of single-celled metasurfaces

Sunae So,1,2,† Joohoon Kim,1,† Trevon Badloe,1,† Chihun Lee,1 Younghwan Yang,1
Hyunjung Kang,1 Junsuk Rho1,3,4,5,∗

1Department of Mechanical Engineering, Pohang University of Science and
Technology (POSTECH),
Pohang 37673, Republic of Korea
2Graduate School of Artificial Intelligence, Pohang University of Science and
Technology (POSTECH),
Pohang 37673, Republic of Korea
3Department of Chemical Engineering, Pohang University of Science and
Technology (POSTECH),
Pohang 37673, Republic of Korea
4POSCO-POSTECH-RIST Convergence Research Center for Flat Optics and
Metaphotonics,
Pohang 37673, Republic of Korea
5National Institute of Nanomaterials Technology (NINT),
Pohang 37673, Republic of Korea

†These authors contributed equally to this work

∗Corresponding author; E-mail<EMAIL_ADDRESS>
> Metasurface-generated holography has emerged as a promising route for fully
> reproducing vivid scenes by manipulating the optical properties of light
> using ultra-compact devices. However, achieving multiple holographic images
> using a single metasurface is still difficult due to the capacity limit of a
> single meta-atom. In this work, we present an inverse design method based on
> gradient-descent optimization to encode multiple pieces of holographic
> information into a single metasurface. The proposed method allows the
> inverse design of single-celled metasurfaces without the need for complex
> meta-atom design strategies, facilitating high-throughput fabrication using
> broadband low loss materials. By exploiting the proposed design method, both
> multiplane RGB color holograms and 3D holograms are designed and
> experimentally demonstrated. Up to eighteen distinct metasurface-generated
> holographic images are demonstrated, achieving the state-of-the-art data
> capacity of a single phase-only metasurface. To the best of our knowledge,
> we present the first experimental demonstration of metasurface-generated 3D
> holograms that have completely independent and distinct images in each
> plane. By demonstrating the high-density holographic information of a single
> metasurface, the current research findings provide a viable route for
> practical metasurfaces-generated holography, ultimately stepping towards
> applications in optical storage, displays, and full-color imaging.

## Introduction

Metasurfaces that exhibit unique optical properties that cannot be found in
nature have ushered in a new era of meta-optics with ultra-compact optical
devices [1]. Their constituent components, known as meta-atoms, enable the
precise tailoring of electromagnetic waves through arbitrary control of the
phase [2], amplitude [3], and polarization [4]. Such properties have been
exploited in promising potentials to miniaturize devices in various optical
applications such as computer-generated holography [5, 6], imaging [7, 8], and
optical communications [9, 10]. In particular, the versatility of metasurface-
generated holography for recreating dynamic images has attracted tremendous
interest for various applications in virtual and augmented reality [11, 12],
optical data storage [13] and security [14, 15, 16]. For these promising
practical applications, it is highly desired to develop multifunctional
metasurfaces containing independent holographic information channels for
various physical properties of light, including polarization [17], wavelength
[18], and orbital angular momentum [19].

The most general approach to design multifunctional metasurfaces is based on
physical intuition to circumvent the information capacity limitations of
single metasurfaces. These intuition-guided design methods include either
using spatial multiplexing schemes [18, 20, 21] or engineering the meta-atom
response to light with different properties [22, 23, 24]. The first approach
exploits additional spatial degrees of freedom by using interleaved [18, 25]
or pixelated metasurfaces [20, 26]. Interleaved metasurfaces incorporate
multiple optical subcomponents responsible for each function into a minimum
operating unit cell (Fig. 1A), while pixelated metasurfaces allow each
segmented region to manipulate light independently (Fig. 1B). Although these
strategies are the most intuitive ways to achieve multifunctional
metasurfaces, they face complications in both the design and fabrication,
while facing substantial crosstalk resulting from unwanted coupling between
the neighboring structures. Furthermore, the physical size of the unit-cell is
vastly increased, which can induce undesired effects such as diffraction. As
such, the meta-atoms should be delicately tailored to operate independently to
suppress crosstalk in these design strategies, which is accompanied by a
significant reduction in efficiency. In addition, the spatial constraints
fundamentally restrict the number of functionalities. Recently, multilayer
metasurfaces that vertical stack several metasurfaces into a single system
[27, 28] have been reported to add extra degrees of freedom, but the
complexity of the system poses difficulties in fabrication due to the
precision needed to align metasurfaces correctly.

On the other hand, other design strategies for multifunctional metasurfaces
have been proposed by carefully designing complex meta-atoms; these approaches
often decouple individual functionalities and design delicately tailored meta-
atoms to satisfy the desired multiple functionalities independently [29, 30,
31]. For example, polarization-multiplexing metasurfaces exploit the
polarization-selective responses of asymmetric meta-atoms [32, 33]. The major
challenge in designing these multifunctional metasurfaces, however, is finding
appropriate meta-atoms to impart desired amplitude and phase independently for
different functionalities. An upper limit of six degrees of freedom in a
single 2d planar device has been suggested. Based on the Jones matrix of a
four meta-atom unit-cell, along with the linear polarization state of the
input and output light, three unique near field prints and three far-field
holograms have been demonstrated from a single metasurface [34]. Recently,
modern machine learning schemes have been used to design meta-atoms without
decoupling optical functionalities [35, 36]. Still, these methods require a
vast library of meta-atoms with complex geometries that result in complicated
design and limitations in fabrication (Fig. 1C). In addition, finding meta-
atoms may be less practical or even unfeasible as the number of
functionalities increases. Most of all, despite the complex design strategies
that considered many degrees of freedom, there are limits to experimentally
showing multiple holographic images with a single metasurface so far; for
example, using an end-to-end design framework, a total of eight holographic
images have been achieved experimentally in the near-infrared regime using a
single metasurface with complex meta-atoms [35].

Figure 1: Schematic illustration of design strategies for multifunctional
metasurfaces based on three previous design strategies of (A) interleaved
metasurfaces, (B) pixelated metasrufaces, (C) metasurfaces with complex meta-
atoms, and (D) our simple single-celled metasurfaces. (A) The unit-cell of
interleaved metasurface consists of several basic sub-components responsible
for each functionality. (B) Pixelated metasurfaces are divided into segmented
regions, allowing independent light modulation. (C) Other metasurfaces
composed of carefully engineered complex meta-atoms. (D) Our single-celled
metasurfaces can perform multiple tasks simultaneously by using the geometric
phase of simple structures. (E) Schematic illustration of multiplane RGB
holograms, one of the examples of multifunctional metasurfaces.

With the ultimate goal to have high-density information of a single
metasurface without sacrificing design simplicity and device efficiency, in
this work, we present single-celled metasurfaces to achieve multiple
holographic images (Fig. 1D). We present an inverse design scheme [37, 38] to
encode multiple holographic information into a single metasurface through
computational optimization. Here, we propose an inverse design method based on
gradient-descent optimization method by alleviating optical diffraction
calculations and gradient calculation difficulties. This method allows the
design and fabrication of metasurfaces comprised of simple meta-atoms by
optimizing a single phase profile to provide multiple holographic images. To
demonstrate the concept, we design metasurfaces for both multiplane RGB
holograms (Fig. 1E), and 3D holography. The phase profiles of the designed
metasurfaces are experimentally demonstrated using a high throughput
nanoimprint lithography (NIL) fabrication method.

## Results

### Design principle

Figure 2: Flowchart of the inverse design method for multifunctional
metasurface. Starting from a random initial state of phase profile $\varphi$,
the phase profile is optimized to minimize the objective function ($l$) that
measures the difference between the images reconstructed at the target planes
($z=z_{1},...,z_{n}$) and the target images. In each iteration, an angular
spectrum method is used to compute the forward calculation of the wave
propagation, and the optimization is performed by stepping in the opposite
direction of the gradient to update the phase profile. For efficient and fast
computations, we leveraged automatic differentiation to compute gradients for
arbitrary many input variables. After 200 iterations, the optimized phase
profile is then mapped to corresponding meta-atoms that impart the required
phase profile through rotation of the meta-atoms.

To encode multiple pieces of holographic information into a single phase
profile, we present an inverse design method based on gradient-descent
optimization (Fig. 2). In the present design method, the goal of inverse
design is to optimize the phase profile of the metasurface to have desired
holographic images at the target image planes. i.e., the required phase
($\varphi$) at each spatial location of the metasurface is set as an
optimization variable and adjusted to minimize the objective function $l$
using a gradient descent optimization based on adaptive moment estimation. The
objective function is defined as the mean squared error (MSE) between the
target images ($|\hat{U}(x,y,z)|^{2}$) and the images formed in the image
planes ($|U(x,y,z)|^{2}$),

$l=\frac{1}{N}\sum_{i=1}^{N}(|(U(x_{i},y_{i},z)|^{2}-|\hat{U}(x_{i},y_{i},z)|^{2})^{2},$
(1)

where the reconstructed images $|U(x,y,z)|^{2}$ are calculated using an
angular spectrum method (see Supplementary Note 1 for details),

$U(x,y,z)=\mathscr{F}^{-1}\\{A(\frac{\alpha}{\lambda},\frac{\beta}{\lambda};z)\\}=\mathscr{F}^{-1}\\{\mathscr{F}\\{U(x,y,0)\\}\times
H(\frac{\alpha}{\lambda},\frac{\beta}{\lambda},z)\\}.$ (2)

For an efficient and fast computation of gradients for arbitrary many input
variables, we take advantage of automatic differentiation, a method of
calculating partial derivatives for each parameter through the chain rule:
within the automatic differentiation framework, the forward problem of light
propagation is computed; then, the computation graph is automatically
constructed from the forward calculation consisting of a sequence of
elementary operations for which all gradients are known. Therefore, by
leveraging automatic differentiation, only a single forward simulation is
needed to calculate gradients with respect to many input variables. This is in
contrast to the traditional brute-force methods that require independent
iterative simulations to explore every geometric perturbation with full-wave
simulations, prohibiting the overall size of the metasurface to tens of
microns [39]. Once the gradient ($\nabla_{\varphi}l$) is known, the
optimization is performed by adjusting optimization variables against the
gradient. In this work, automatic differentiation and backpropagation are
implemented with the aid of the modern machine learning library of PyTorch
(See Methods for details).

Figure 3: Simulation results for unit cell structure design. (A) Top view of
the asymmetric nanobar-shaped meta-atoms composed of TiO2 nano PER with
broadband low loss properties. The parameters $P,L_{x},L_{y}$, and $\theta$
denote the period, length, width, and the rotation angle of the meta-atom to
impart the required geometric phases, respectively. (B) The simulated
conversion efficiency with different lengths and widths at
$\lambda=532\text{nm}$ with fixed period $P=450~{}\text{nm}$ and height
$H=910~{}\text{nm}$. The meta-atoms with length $L_{x}=400~{}\text{nm}$, and
width $L_{y}=120~{}\text{nm}$ are chosen for the maximum conversion
efficiency, as shown in the star-mark. (C) The calculated conversion
efficiency of the chosen meta-atoms in the wavelength range from
$430~{}\text{nm}$ to $650~{}\text{nm}$. For the tree wavelengths of RGB, the
conversion efficiency is $70,81,\text{and}~{}69\%$, respectively. (D) The
normalized simulated electric field distribution in the yz plane at the three
wavelengths, when x-polarized light is incident on the meta-atom rotated by an
angle of $\theta=45^{\circ}$.

After the optimization is performed to include the multiple holographic
information to the metasurface, the method of physically realizing the phase
profile through meta-atoms is required. Since we achieve a single phase
profile, we can simply exploit the concept of geometric phase (so called
Panacharatnam-Berry phase) using simple asymmetric meta-atoms. This
significantly alleviates the need for the design of complex, multi-structured
meta-atom. Therefore, asymmetric nanobar-shaped meta-atoms composed of
titanium dioxide nano-particle embedded resin (TiO2 nano PER) are used as the
building blocks, which provides both ease of fabrication through NIL, and also
broadband low loss (Fig. 3, see Supplementary Note 2 for details). To exploit
the geometric phase properties, each meta-atom is designed to act as a local
half-wave plate that flips the handedness of the input circularly polarized
light at the target wavelengths (see Supplementary Note 3 for details). i.e.,
the meta-atom imparts phase delays of $\pi$ between the two orthogonal
electric field components (i.e. $|\phi_{x}-\phi_{y}|=\pi$). Here, we chose
three working wavelengths of $\lambda=635,532,$ and $450~{}\text{nm}$,
relating to the three primary colors of red, green, and blue light,
respectively. The meta-atoms with height $H=910~{}\text{nm}$, length
$L_{x}=400~{}\text{nm}$, width $L_{y}=120~{}\text{nm}$, and period
$P=450~{}\text{nm}$ are chosen for the maximum polarization conversion
efficiency for three target wavelengths $\lambda=450,532,$ and
$635~{}\text{nm}$ (Fig. 3B). The designed meta-atom exhibits a high conversion
efficiency over a broad wavelength range of visible light between
$400~{}\text{and}~{}700~{}\text{nm}$, with an average efficiency over $70\%$
at three wavelengths (Fig. 3C). Figure 3E shows the electric field
distribution in the yz plane when x-polarized light is incident on the meta-
atom rotated by an angle of $\theta=45^{\circ}$. It is clear to see that the
outgoing wave is polarized along the y-axis, exhibiting the desired half-wave
plate-like behavior of the meta-atom at the three target wavelengths.

### Multiplane RGB holograms

Figure 4: Demonstration of multiplane RGB holograms. (A) The phase profile of
the optimized metasurface, and (B) and (C) the optical microscopy and scanning
electron microscopy images of the fabricated metasurface with the scale bar of
$100~{}\mu\text{m}$ and $1~{}\mu\text{m}$, respectively. (D) The target,
calculated, and experimentally measured holograms are shown at three different
focal lengths of $z=300,800$, and $1500~{}\mu\text{m}$. (E) A total of nine
individual holographic images are obtained at each of three wavelengths and
three focal lengths using a simple single-celled metasurface.

To verify the design strategy, we conducted the inverse design of a single-
celled metasurface to achieve multiplane RGB holograms. Multicolor holograms
are one of the most sought-after practical applications of multifunctional
metasurfaces but have been difficult to realize due to substantial crosstalk
among different wavelengths. Here, we aim to design and fabricate a
metasurface consisting of $900\times 900$ pixels ($405~{}\mu\text{m}\times
405~{}\mu\text{m}$) with three focal planes ($300,800$, and
$1500~{}\mu\text{m}$) corresponding to NA of $0.56,0.25,0.13$, respectively.
Using the developed inverse design method, the single phase profile for
metasurface was optimized to reconstruct target multicolor holograms of the
”RGB-color palette,” ”cube,” and ”flower” images (Fig. 4A). The designed
metasurface was then fabricated using the high-throughput and low-cost
fabrication NIL method (Fig. 4B and C, and see Supplementary Note 4 for
fabrication details). We emphasize that the designed single-celled metalens
can be readily fabricated using such facile, low-cost, repeatable and scalable
NIL method because it consists of simple meta-atoms that do not have extremely
high-resolution feature sizes. As shown in Figure 4D, the calculated and
measured holograms at each focal plane agrees well with the target multicolor
holograms (see Supplementary Note 5 for optical setup). We calculate the peak
signal-to-noise ratio (PSNR) as a measure of the image quality of the
experimentally measured holograms as,

$PSNR=10\log_{10}\frac{(MAX_{I}^{2})}{MSE},$ (3)

where $MAX_{I}^{2}$ is the maximum intensity of the target image. The
calculated PSNR of the three measured holograms are $12.24$, $12.08$, and
$15.56~{}\text{dB}$, respectively. We observe a relatively high speckle noise
in the measured holographic images (Fig. 4D (1)-(9)), especially for the ”RGB
color palette.” This is the typical limitation of phase-only holograms, and
the image qualities can be improved by modulating both the phase and
amplitude. Nevertheless, despite the information loss due to phase-only
holograms, the experimental results show the distinctive multiplane projection
capability of the developed metasurface encompassing a total of 9 unique
images. Indeed, to the best of our knowledge, this is the highest number of
phase-only holograms to have been experimentally demonstrated using a single
metasurface, even compared to using complex meta-atom design strategies [35].

Reference | Materials | Red | Green | Blue
---|---|---|---|---
$\lambda$ (nm) | Efficiency (%) |  $\lambda$ (nm) | Efficiency (%) |  $\lambda$ (nm) | Efficiency (%)
Ref. [40] | Al nanoslit | 633 | 1.0 | 532 | 2.8 | 420 | 0.4
Ref. [41] | TiO2 | 635 | 4.8 | 532 | 4.7 | 450 | 2.6
Ref. [42] | c-Si | 633 | 10.3 | 532 | 7.8 | 473 | 6.4
Ref. [18] | Si | 633 | 18.0 | 532 | 5.2 | 473 | 3.6
Ref. [43] | Ag/HSQ/Ag | 633 | 10.8 | 532 | 12.6 | 450 | 22.1
Ref. [44] | Si | 633 | 49.0 | 532 | 30.0 | 488 | 20.0
This work | TiO2 nano PER | 635 | 61.7 | 532 | 75.5 | 450 | 51.6
Table 1: Comparison of the measured conversion efficiency for various
metasurface-generated multicolor holograms

In addition, most design strategies for multicolor holograms to date have
resorted to using highly dispersive materials or strong resonances to suppress
crosstalk among different wavelengths [18]. In contrast, since we can achieve
multicolor holograms using a single-phase profile, we can utilize the
dispersionless feature of the geometric phase; accordingly, a high- conversion
efficiency multicolor hologram is achieved using the broadband low loss of
TiO2 nano PER across the entire visible spectrum. The experimentally measured
conversion efficiency of the multicolor holograms at R, G, and B are
$61.7~{}\%$, $75.5~{}\%$, and $51.6~{}\%$, respectively, where the efficiency
is defined as the ratio of the intensity of the light with opposite helicity
at the target plane to that of the incident circularly polarized light (see
Supplementary Note 7 for details). Table 1 compares the efficiency of
previously reported RGB multicolor holograms. We clearly achieve the highest
average efficiency of $63~{}\%$ at RGB wavelengths. This conversion efficiency
is considerably high compared to other works. It should be noted that the
conversion efficiency does not directly measure the hologram efficiency, which
should be the ratio of the incident power to the desired holograms.
Nevertheless, the conversion efficiency still represents the ratio of the
energy that is used to generate desired source fields to the incident power.
The unprecedented high conversion efficiency is achieved due to the low-loss
materials of TiO2 nano PER without significant energy loss. This has hardly
been achievable using previously used materials that are highly dispersive or
have strong absorptions. The image quality can be further improved by
decreasing the number of target holograms or increasing the number of pixels
in the metasurface, which comes at a computational cost, however,
significantly less than using full-wave simulations (see Supplementary Note 8
for details).

### Experimental demonstration of 3D holograms in multiplane projections

Figure 5: Illustration of metasurface-generated 3D hologram. (A) A 3D target
object of airplane and (B) its multi-sliced images. (C) The experimentally
reconstructed 3D hologram from a single metasurface consisting of $990\times
990$ pixels. (D) The experimentally measured hologram at each target plane
with focal distances linearly spanning from $500~{}\mu\text{m}$ to
$2200~{}\mu\text{m}$.

Furthermore, we present metasurface-generated three-dimensional (3D)
holograms. A 3D-like hologram can be achieved by projecting images onto a
large number of successive planes. Therefore, for 3D hologram reconstruction,
a target object of an airplane (Fig. 5A) is sliced into a total of 18
individual images (Fig. 5B), and the phase profile for the metasurface was
optimized to project the desired image onto each target plane. For the
experimental demonstration, a single-celled metasurface consisting of
$990\times 990$ pixels ($455~{}\mu\text{m}\times 455~{}\mu\text{m}$) was
designed and fabricated to operate at $\lambda=532~{}\text{nm}$. Figure 5C
shows the experimental results of the 3D hologram with a total depth of
$1700~{}\mu\text{m}$. The results clearly demonstrate the successful
reconstruction of 3D holographic images with highly suppressed crosstalk. Due
to such low crosstalk, holographic images of airplane can be viewed from any
observation angle, reconstructing a genuine 3D hologram (See Supplementary
Video 1 for experimentally observed 3D holograms). Figure 5D shows the on-axis
evolution of the total 18 projection planes, which are in good agreement with
simulation results (See Supplementary Note 10 for simulation results). To the
best of our knowledge, this is the first experimental demonstration of a
metasurface-generated 3D hologram having completely independent and distinct
images in many successive planes. This is in contrast to other metasurface-
generated 3D holography, which present 3D holography by projecting multiple
interrelated images onto different planes [45, 46]. By projecting cross-
sectional holographic images onto a total 18 image planes, the reconstructed
holograms can be observed with a very large viewing angle. This is also
remarkable result compared to eleven distinct phase-only holograms
experimentally achieved using conventional spatial light modulator at a very
low NA of 0.003 to 0.03 [47]. The crosstalk can be further suppressed by
increasing the distance between adjacent planes [47]. In addition, by
combining the developed inverse design method with other design strategies for
wavelength division multiplexing methods, it is expected that we can design
multicolor and 3D holograms with an arbitrary number of functionalities.

## Conclusion

To conclude, we have proposed an inverse design method to produce simple,
single-celled metasurfaces for multicolor and 3D holography. On the basis of
the developed gradient-descent optimization method, both multiplane RGB
holograms and 3D holograms have been demonstrated by simply exploiting the
concept of geometric phase with a single meta-atom. It is worth mentioning
that up to eighteen distinct holographic images were experimentally
demonstrated without the need for complex design strategies or structures. The
simple design also allowed broadband high-efficiency and facilitated facile,
low-cost and high-throughput fabrication, paving the way for practical
metasurfaces-generated holography. In addition, with efforts to contain high-
density data capacity of a single metasurface, the current research findings
can be easily combined with other design approaches such as spatial
multiplexing, and meta-atom designs, ultimately providing numerous holographic
images using a single device. The proposed design method can be generally
applied to fields requiring mass information, such as high-density information
storage, optical security, and multi-channel images.

## Methods

Gradient descent optimization
For gradient descent optimization, an adaptive moment estimation (Adam) was
implemented as the optimization algorithm,

$\displaystyle
m_{t}=\beta_{1}m_{t-1}+(1-\beta_{1})\nabla_{\varphi}l(\varphi_{t}),\quad$
$\displaystyle
v_{t}=\beta_{2}v_{t-1}+(1-\beta_{2})(\nabla_{\varphi}l(\varphi_{t}))^{2},\quad\varphi_{t+1}=\varphi_{t}-m_{t}\frac{\eta}{\sqrt{v_{t}+\epsilon}},$

where $m$ and $v$ is the first and second moment vector, respectively, and the
learning rate of $\eta=0.05$, and
$\beta_{1}=0.9,\beta_{2}=0.999,\epsilon=1e-08$ were used as hyper-parameters.
The Adam optimizer was used to optimize the phase profile over 200 iterations.
In this work, the forward calculations of scalar diffraction and phase profile
optimizations were performed in Python v3.6 using the PyTorch v1.8.1
framework.

Numerical simulation
To analyze the amplitude and phase response of each meta-atom, numerical
simulations using rigorous coupled-wave analysis (RCWA) were performed by
using an in-house code. The amplitude and phase retardation of various meta-
atoms with height $H=910$ nm, lengths from $L_{x}=60$ to $400$ nm, width from
$L_{y}=60$ to $400$ nm, and period $P=450$ nm were calculated using the RCWA
method. In addition, to quantify the half-wave plate-like behavior of the
designed meta-atom, finite-difference time-domain (FDTD) simulations were
performed using a commercially available FDTD solver from Lumerical Inc.,
Ansys. In the FDTD simulations, periodic boundary conditions were used along
the x- and y- directions, and perfectly matched layer conditions were used
along the z-direction.

## References

  * [1] N. Yu, et al., Light propagation with phase discontinuities: generalized laws of reflection and refraction.  Science 334, 333 (2011).
  * [2] Y. F. Yu, et al., High-transmission dielectric metasurface with 2$\pi$ phase control at visible wavelengths.  Laser & Photonics Reviews 9, 412 (2015).
  * [3] L. Liu, et al., Broadband metasurfaces with simultaneous control of phase and amplitude.  Advanced Materials 26, 5031 (2014).
  * [4] P. C. Wu, et al., Versatile polarization generation with an aluminum plasmonic metasurface.  Nano Letters 17, 445 (2017).
  * [5] X. Ni, A. V. Kildishev, V. M. Shalaev, Metasurface holograms for visible light.  Nature Communications 4, 1 (2013).
  * [6] G. Zheng, et al., Metasurface holograms reaching 80% efficiency.  Nature Nanotechnology 10, 308 (2015).
  * [7] M. Khorasaninejad, et al., Metalenses at visible wavelengths: Diffraction-limited focusing and subwavelength resolution imaging.  Science 352, 1190 (2016).
  * [8] W. T. Chen, et al., A broadband achromatic metalens for focusing and imaging in the visible.  Nature Nanotechnology 13, 220 (2018).
  * [9] H. Zhao, et al., Metasurface-assisted massive backscatter wireless communication with commodity wi-fi signals.  Nature Communications 11, 1 (2020).
  * [10] C. Liaskos, et al., A new wireless communication paradigm through software-controlled metasurfaces.  IEEE Communications Magazine 56, 162 (2018).
  * [11] G.-Y. Lee, et al., Metasurface eyepiece for augmented reality.  Nature Communications 9, 1 (2018).
  * [12] Z. Li, et al., Meta-optics achieves rgb-achromatic focusing for virtual reality.  Science Advances 7, eabe4458 (2021).
  * [13] D. Wen, et al., Helicity multiplexed broadband metasurface holograms.  Nature Communications 6, 1 (2015).
  * [14] I. Kim, et al., Pixelated bifunctional metasurface-driven dynamic vectorial holographic color prints for photonic security platform.  Nature Communications 12, 1 (2021).
  * [15] J. Li, et al., Addressable metasurfaces for dynamic holography and optical information encryption.  Science Advances 4, eaar6768 (2018).
  * [16] J. Kim, et al., Photonic encryption platform via dual-band vectorial metaholograms in the ultraviolet and visible.  ACS Nano (2022).
  * [17] J. B. Mueller, N. A. Rubin, R. C. Devlin, B. Groever, F. Capasso, Metasurface polarization optics: independent phase control of arbitrary orthogonal states of polarization.  Physical Review Letters 118, 113901 (2017).
  * [18] B. Wang, et al., Visible-frequency dielectric metasurfaces for multiwavelength achromatic and highly dispersive holograms.  Nano Letters 16, 5235 (2016).
  * [19] H. Ren, et al., Complex-amplitude metasurface-based orbital angular momentum holography in momentum space.  Nature Nanotechnology 15, 948 (2020).
  * [20] Y.-W. Huang, et al., Aluminum plasmonic multicolor meta-hologram.  Nano Letters 15, 3122 (2015).
  * [21] E. Maguid, et al., Multifunctional interleaved geometric-phase dielectric metasurfaces.  Light: Science & Applications 6, e17027 (2017).
  * [22] G. Yoon, et al., Wavelength-decoupled geometric metasurfaces by arbitrary dispersion control.  Communications Physics 2, 1 (2019).
  * [23] Q. Song, et al., Broadband decoupling of intensity and polarization with vectorial fourier metasurfaces.  Nature Communications 12, 1 (2021).
  * [24] B. Xiong, et al., Realizing colorful holographic mimicry by metasurfaces.  Advanced Materials 33, 2005864 (2021).
  * [25] C. Spägele, et al., Multifunctional wide-angle optics and lasing based on supercell metasurfaces.  Nature Communications 12, 1 (2021).
  * [26] Q. Song, et al., Ptychography retrieval of fully polarized holograms from geometric-phase metasurfaces.  Nature Communications 11, 1 (2020).
  * [27] P. Georgi, et al., Optical secret sharing with cascaded metasurface holography.  Science Advances 7, eabf9718 (2021).
  * [28] Y. Zhou, et al., Multifunctional metaoptics based on bilayer metasurfaces.  Light: Science & Applications 8, 1 (2019).
  * [29] Q. Dai, et al., A single-celled tri-functional metasurface enabled with triple manipulations of light.  Advanced Functional Materials 30, 2003990 (2020).
  * [30] A. C. Overvig, et al., Dielectric metasurfaces for complete and independent control of the optical amplitude and phase.  Light: Science & Applications 8, 1 (2019).
  * [31] T. Badloe, I. Kim, Y. Kim, J. Kim, J. Rho, Electrically tunable bifocal metalens with diffraction-limited focusing and imaging at visible wavelengths.  Advanced Science 8, 2102646 (2021).
  * [32] A. Arbabi, Y. Horie, M. Bagheri, A. Faraon, Dielectric metasurfaces for complete control of phase and polarization with subwavelength spatial resolution and high transmission.  Nature Nanotechnology 10, 937 (2015).
  * [33] W. T. Chen, et al., High-efficiency broadband meta-hologram with polarization-controlled dual images.  Nano Letters 14, 225 (2014).
  * [34] Y. Bao, L. Wen, Q. Chen, C.-W. Qiu, B. Li, Toward the capacity limit of 2d planar jones matrix with a single-layer metasurface.  Science Advances 7, eabh0365 (2021).
  * [35] W. Ma, et al., Pushing the limits of functionality-multiplexing capability in metasurface design based on statistical machine learning.  Advanced Materials p. 2110022 (2022).
  * [36] S. An, et al., Multifunctional metasurface design with a generative adversarial network.  Advanced Optical Materials 9, 2001433 (2021).
  * [37] S. So, T. Badloe, J. Noh, J. Bravo-Abad, J. Rho, Deep learning enabled inverse design in nanophotonics.  Nanophotonics 9, 1041 (2020).
  * [38] S. Molesky, et al., Inverse design in nanophotonics.  Nature Photonics 12, 659 (2018).
  * [39] A. Michaels, E. Yablonovitch, Leveraging continuous material averaging for inverse electromagnetic design.  Optics Express 26, 31717 (2018).
  * [40] W. Wan, J. Gao, X. Yang, Full-color plasmonic metasurface holograms.  ACS Nano 10, 10671 (2016).
  * [41] D. Wen, J. J. Cadusch, J. Meng, K. B. Crozier, Multifunctional dielectric metasurfaces consisting of color holograms encoded into color printed images.  Advanced Functional Materials 30, 1906415 (2020).
  * [42] Y. Bao, et al., Full-colour nanoprint-hologram synchronous metasurface with arbitrary hue-saturation-brightness control.  Light: Science & Applications 8, 1 (2019).
  * [43] Y. Hu, et al., 3d-integrated metasurfaces for full-colour holography.  Light: Science & Applications 8, 1 (2019).
  * [44] L. Jin, et al., Noninterleaved metasurface for (26-1) spin-and wavelength-encoded holograms.  Nano Letters 18, 8016 (2018).
  * [45] X. Li, et al., Multicolor 3d meta-holography by broadband plasmonic modulation.  Science Advances 2, e1601102 (2016).
  * [46] L. Huang, et al., Three-dimensional optical holography using a plasmonic metasurface.  Nature communications 4, 1 (2013).
  * [47] G. Makey, et al., Breaking crosstalk limits to dynamic holography using orthogonality of high-dimensional random vectors.  Nature Photonics 13, 251 (2019).

## Acknowledgments

This work was financially supported by the POSCO-POSTECH-RIST Convergence
Research Center program funded by POSCO, and the National Research Foundation
(NRF) grants (NRF-2019R1A2C3003129, CAMM-2019M3A6B3030637,
NRF-2019R1A5A8080290) funded by the Ministry of Science and ICT (MSIT) of the
Korean government. S.S. acknowledges the NRF Sejong Science fellowship
(NRF-2022R1C1C2009430), and the Institute of Information & Communications
Technology Planning & Evaluation (IITP) grant (No.2019-0-01906, POSTECH
Artificial Intelligence Graduate School Program) funded by the MSIT of the
Korean government.

## Author contributions

S.S., T.B., and J.R. conceived the concept and initiated the project. S.S.
developed the method and calculation. S.S., and C.L. performed the numerical
calculations. J.K., Y.Y., and H.K. fabricated the metasurfaces and performed
the experimental measurements. J.R. guided the entire project. All authors
participated in the discussion and confirmed the final manuscript.

## Competing interests

The authors declare no competing interests.

## Data availability

The data that support the findings of this study are available from the
corresponding authors upon reasonable request.

## Supplementary materials

Supplementary Note 1-9
Supplementary Video 1
Figures S1 to S10
Table S1
References (S1-S3)