Xiaomei Tang
Current Organizations / Institutes
The organizations/institutes from the scholar's latest article
Research Subjects
Xiaomei Tang has a total of 74 co-authors. Here are the top co-authors by number of shared publications:
- Honglei Lin
College of Electronic Science and Technology, National University of Defense Technology, Changsha, China
7 shared publications - Chunjiang Ma
College of Electronic Science and Engineering, National University of Defense Technology, Changsha 410073, China
5 shared publications - Feixue Wang
College of Electronic Science and Technology, National University of Defense Technology, Changsha, China
4 shared publications - Guangfu Sun
National University of Defense Technology
4 shared publications - Jian Wu
College of Electronic Science and Technology, National University of Defense Technology, Changsha 410073, China
4 shared publications Feixue Wang
College of Electronic Science, National University of Defense Technology, Changsha, China
3 shared publications
Latest Publications
- 29 October 2026
- Published by Springer Nature in Journal of Cryptology
- Vol. 40 (1) , 3
Feistel-Like Structures Revisited: Classification and Cryptanalysis
- 29 October 2026
- Published by Springer Nature in Journal of Cryptology
- Vol. 40 (1) , 3
Feistel-Like Structures Revisited: Classification and Cryptanalysis
- Open Access
Design of AFDM Waveform Encryption for LEO Satellite Networks
Low Earth orbit (LEO) satellite downlinks broadcast over wide ground footprints, exposing Earth-observation and remote-sensing sensor data to passive eavesdropping. Affine frequency division multiplexing (AFDM) is a candidate waveform for the doubly dispersive LEO channel and a natural integrated sensing and communication (ISAC) waveform whose delay–Doppler structure supports target parameter estimation; yet existing secure-AFDM schemes act only in the discrete affine Fourier transform (DAFT) parameter domain, leaving the transmitted waveform structurally recognizable. To address this gap, this paper applies time-domain waveform obfuscation to AFDM as physical layer encryption. Using a secret key, the transmitter permutes the inverse-DAFT samples and applies a phase rotation before chirp-periodic-prefix generation; the mask is unitary, so the peak-to-average power ratio is preserved exactly, and the key-holding receiver retains AFDM’s full delay–Doppler sensing capability, while a no-key receiver obtains a dense composite response that destroys target localization (sensing concentration drops from 0 dB to −16.6 dB). Secret pilot phases enable channel estimation at the legitimate receiver while blocking a naive composite-channel attack. Simulations at and 128 show that a wrong-key eavesdropper achieves uncoded BER within of across 0–20 dB and that blind Viterbi–Viterbi phase recovery is no more effective under QPSK (BER –), while the legitimate SNR penalty stays below dB. The mask also suppresses AFDM’s internal structure to the AWGN level under AFDM-aware processing. Time-domain obfuscation offers a complementary physical-layer security layer for confidential LEO remote-sensing data downlink and ISAC waveforms.Open AccessDesign of AFDM Waveform Encryption for LEO Satellite Networks
Low Earth orbit (LEO) satellite downlinks broadcast over wide ground footprints, exposing Earth-observation and remote-sensing sensor data to passive eavesdropping. Affine frequency division multiplexing (AFDM) is a candidate waveform for the doubly dispersive LEO channel and a natural integrated sensing and communication (ISAC) waveform whose delay–Doppler structure supports target parameter estimation; yet existing secure-AFDM schemes act only in the discrete affine Fourier transform (DAFT) parameter domain, leaving the transmitted waveform structurally recognizable. To address this gap, this paper applies time-domain waveform obfuscation to AFDM as physical layer encryption. Using a secret key, the transmitter permutes the inverse-DAFT samples and applies a phase rotation before chirp-periodic-prefix generation; the mask is unitary, so the peak-to-average power ratio is preserved exactly, and the key-holding receiver retains AFDM’s full delay–Doppler sensing capability, while a no-key receiver obtains a dense composite response that destroys target localization (sensing concentration drops from 0 dB to −16.6 dB). Secret pilot phases enable channel estimation at the legitimate receiver while blocking a naive composite-channel attack. Simulations at and 128 show that a wrong-key eavesdropper achieves uncoded BER within of across 0–20 dB and that blind Viterbi–Viterbi phase recovery is no more effective under QPSK (BER –), while the legitimate SNR penalty stays below dB. The mask also suppresses AFDM’s internal structure to the AWGN level under AFDM-aware processing. Time-domain obfuscation offers a complementary physical-layer security layer for confidential LEO remote-sensing data downlink and ISAC waveforms. - Open Access
Intermodulation Component-Based Authentication for Civilian GNSS Signals
We propose a navigation signal authentication scheme for civilian GNSS receivers that exploits the intermodulation components introduced by constant envelope modulation without relying on modernized authenticatable signals or direct access to authorized spreading codes. Since the product of multiple authorized spreading codes is unpredictable and does not reveal the original codes, the spreading code of the intermodulation component can serve as an authentication feature similar to that of authorized signals. The receiver obtains the intermodulation spreading code via a communication link, then authenticates the GNSS signal by detecting the presence of this code through a correlation-based hypothesis test. We analyze the scheme using the operational GPS L1 signal as an example and compare its performance with Chimera (proposed for GPS), OSNMA (proposed for Galileo), and authorized spreading code authentication in PROSPA. Results show that the proposed scheme achieves robustness and security comparable to Chimera, while avoiding the authorization restrictions associated with authorized codes. Under a 63.82 kbps communication rate and a civilian signal of 30 dB-Hz, its authentication efficiency exceeds Chimera’s fast channel, with substantially lower data storage requirements.Open AccessIntermodulation Component-Based Authentication for Civilian GNSS Signals
We propose a navigation signal authentication scheme for civilian GNSS receivers that exploits the intermodulation components introduced by constant envelope modulation without relying on modernized authenticatable signals or direct access to authorized spreading codes. Since the product of multiple authorized spreading codes is unpredictable and does not reveal the original codes, the spreading code of the intermodulation component can serve as an authentication feature similar to that of authorized signals. The receiver obtains the intermodulation spreading code via a communication link, then authenticates the GNSS signal by detecting the presence of this code through a correlation-based hypothesis test. We analyze the scheme using the operational GPS L1 signal as an example and compare its performance with Chimera (proposed for GPS), OSNMA (proposed for Galileo), and authorized spreading code authentication in PROSPA. Results show that the proposed scheme achieves robustness and security comparable to Chimera, while avoiding the authorization restrictions associated with authorized codes. Under a 63.82 kbps communication rate and a civilian signal of 30 dB-Hz, its authentication efficiency exceeds Chimera’s fast channel, with substantially lower data storage requirements. - Open Access
WAWA: Wavelet Analysis-Based Watermarking Authentication for GNSS Civil Signal with Immediate Symbol-Level Verification
Existing GNSS authentication schemes suffer from critical drawbacks such as high verification latency and prohibitive memory requirements, leaving time-sensitive applications vulnerable to spoofing. The core challenge is the inability to transmit strong, real-time cryptographic credentials through the bandwidth-limited GNSS signal. This paper introduces WAWA, a Wavelet Analysis-based Watermarking Authentication scheme that operates at the physical layer of the GNSS signal. The central innovation of WAWA is its use of the wavelet domain to achieve a high-capacity data channel, allowing a complete public-key digital signature to be embedded directly within the signal structure. This enables receivers to perform immediate, symbol-level authentication using a public key, which fundamentally removes the verification delay and reliance on time synchronization seen in conventional methods. Furthermore, it eliminates the need for large memory buffers, a critical barrier for resource-constrained devices. We present the complete design of the watermark generation, embedding, and extraction process, alongside a novel dual-path verification framework adaptable to both standalone and network-assisted receivers. Performance analysis shows that WAWA achieves immediate authentication while offering superior effective bandwidth and maintaining low memory overhead. Although it introduces a controllable signal correlation loss, validated through both theoretical modeling and simulation, WAWA presents an exceptional balance of security, immediacy, and resource efficiency, offering a promising new paradigm for ensuring trustworthy PNT sensor data in time-critical and resource-sensitive applications, particularly in large-scale sensor networks and autonomous systems.
Open AccessWAWA: Wavelet Analysis-Based Watermarking Authentication for GNSS Civil Signal with Immediate Symbol-Level Verification
Existing GNSS authentication schemes suffer from critical drawbacks such as high verification latency and prohibitive memory requirements, leaving time-sensitive applications vulnerable to spoofing. The core challenge is the inability to transmit strong, real-time cryptographic credentials through the bandwidth-limited GNSS signal. This paper introduces WAWA, a Wavelet Analysis-based Watermarking Authentication scheme that operates at the physical layer of the GNSS signal. The central innovation of WAWA is its use of the wavelet domain to achieve a high-capacity data channel, allowing a complete public-key digital signature to be embedded directly within the signal structure. This enables receivers to perform immediate, symbol-level authentication using a public key, which fundamentally removes the verification delay and reliance on time synchronization seen in conventional methods. Furthermore, it eliminates the need for large memory buffers, a critical barrier for resource-constrained devices. We present the complete design of the watermark generation, embedding, and extraction process, alongside a novel dual-path verification framework adaptable to both standalone and network-assisted receivers. Performance analysis shows that WAWA achieves immediate authentication while offering superior effective bandwidth and maintaining low memory overhead. Although it introduces a controllable signal correlation loss, validated through both theoretical modeling and simulation, WAWA presents an exceptional balance of security, immediacy, and resource efficiency, offering a promising new paradigm for ensuring trustworthy PNT sensor data in time-critical and resource-sensitive applications, particularly in large-scale sensor networks and autonomous systems.
- Open Access
- 24 August 2025
- Published by MDPI AG in Remote Sensing
- Vol. 17 (17) , 2937
Pulse Interference Mitigation Method for BeiDou Receivers Based on Message Randomization
In complex electromagnetic environments, especially those with pulsed interference sources, long-period pulsed interference can repeatedly disrupt the real-time data within navigation messages, preventing receivers from obtaining complete message information and significantly extending the time to first fix (TTFF). To address this problem, the interference mechanism is modeled and analyzed from the perspective of navigation message structure. An anti-interference strategy based on navigation message scrambling is proposed, including two key techniques: random scrambling of subframe order and message interleaving encoding. Simulation and experimental results demonstrate that various pulsed interference patterns, with different periods and duty cycles, can significantly impact TTFF. The subframe scrambling method is effective against interference whose period exceeds the subframe duration but is limited when the period is equal to or shorter than the subframe. In contrast, the interleaving method provides more universal resistance across interference patterns. When both techniques are combined, the overall anti-interference performance is further enhanced. Specifically, for interference patterns with periods longer than the subframe duration, the probability that the receiver fails to achieve positioning across multiple consecutive frames is reduced by at least 50% compared to the case without interference mitigation.
- 24 August 2025
- Published by MDPI AG in Remote Sensing
- Vol. 17 (17) , 2937
Open AccessPulse Interference Mitigation Method for BeiDou Receivers Based on Message Randomization
In complex electromagnetic environments, especially those with pulsed interference sources, long-period pulsed interference can repeatedly disrupt the real-time data within navigation messages, preventing receivers from obtaining complete message information and significantly extending the time to first fix (TTFF). To address this problem, the interference mechanism is modeled and analyzed from the perspective of navigation message structure. An anti-interference strategy based on navigation message scrambling is proposed, including two key techniques: random scrambling of subframe order and message interleaving encoding. Simulation and experimental results demonstrate that various pulsed interference patterns, with different periods and duty cycles, can significantly impact TTFF. The subframe scrambling method is effective against interference whose period exceeds the subframe duration but is limited when the period is equal to or shorter than the subframe. In contrast, the interleaving method provides more universal resistance across interference patterns. When both techniques are combined, the overall anti-interference performance is further enhanced. Specifically, for interference patterns with periods longer than the subframe duration, the probability that the receiver fails to achieve positioning across multiple consecutive frames is reduced by at least 50% compared to the case without interference mitigation.
- Open Access
Cost-Effective Optimization and Implementation of the CRT-Paillier Decryption Algorithm for Enhanced Performance
To address the privacy protection problem in cloud computing, privacy enhancement techniques such as the Paillier additive homomorphism algorithm are receiving widespread attention. Paillier algorithm allows addition and scalar multiplication operations in dencrypted state, which can effectively protect privacy. However, its computational efficiency is limited by complex modulo operations due to the ciphertext expansion followed by encryption. To accelerate its decryption operation, the Chinese Remainder Theorem (CRT) is often used to optimize these modulo operations, which lengthens the decryption computation chain in turn. To address this issue, we propose an eCRT-Paillier decryption algorithm that shortens the decryption computation chain by combining precomputed parameters and eliminating extra judgment operations introduced by Montgomery modular multiplications. These two improvements reduce 50% modular multiplications and 60% judgment operations in the postprocessing of the CRT-Paillier decryption algorithm. Based on these improvements, we propose a highly parallel full-pipeline architecture to eliminate stalls caused by multiplier reuse in traditional modular exponentiation operations. This architecture also adopts some optimizations such as simplifying modular exponentiation units by dividing the exponent into segments and parallelizing data flow by multi-core instantiation. Finally, a high-throughput and efficient Paillier accelerator named MESA was implemented on the Xilinx Virtex-7 FPGA for evaluation, which can complete a decryption using 2048-bit key within 0.577ms under 100 MHz clock frequency. Compared to prior works, MESA demonstrates a throughput improvement of 1.16 to 313.21 under identical conditions, also with enhancements in area efficiency for LUT, DSP, and FF of 3.32 to 117.55, 1.49 to 1.64, and 2.94 to 9.94, respectively.
Open AccessCost-Effective Optimization and Implementation of the CRT-Paillier Decryption Algorithm for Enhanced Performance
To address the privacy protection problem in cloud computing, privacy enhancement techniques such as the Paillier additive homomorphism algorithm are receiving widespread attention. Paillier algorithm allows addition and scalar multiplication operations in dencrypted state, which can effectively protect privacy. However, its computational efficiency is limited by complex modulo operations due to the ciphertext expansion followed by encryption. To accelerate its decryption operation, the Chinese Remainder Theorem (CRT) is often used to optimize these modulo operations, which lengthens the decryption computation chain in turn. To address this issue, we propose an eCRT-Paillier decryption algorithm that shortens the decryption computation chain by combining precomputed parameters and eliminating extra judgment operations introduced by Montgomery modular multiplications. These two improvements reduce 50% modular multiplications and 60% judgment operations in the postprocessing of the CRT-Paillier decryption algorithm. Based on these improvements, we propose a highly parallel full-pipeline architecture to eliminate stalls caused by multiplier reuse in traditional modular exponentiation operations. This architecture also adopts some optimizations such as simplifying modular exponentiation units by dividing the exponent into segments and parallelizing data flow by multi-core instantiation. Finally, a high-throughput and efficient Paillier accelerator named MESA was implemented on the Xilinx Virtex-7 FPGA for evaluation, which can complete a decryption using 2048-bit key within 0.577ms under 100 MHz clock frequency. Compared to prior works, MESA demonstrates a throughput improvement of 1.16 to 313.21 under identical conditions, also with enhancements in area efficiency for LUT, DSP, and FF of 3.32 to 117.55, 1.49 to 1.64, and 2.94 to 9.94, respectively.
- 9 June 2025
- Published by Royal Society of Chemistry (RSC) in Physical Chemistry Chemical Physics
- Vol. 27 (24) , 13071-13082
Study on the mass transfer behavior of single CO2 bubbles in sodium silicate solution
The mass transfer behavior of single CO2 bubbles in sodium silicate solutions was investigated. The effects of pH, static pressure, and solution concentration on bubble dissolution and absorption kinetics were systematically revealed.
- 9 June 2025
- Published by Royal Society of Chemistry (RSC) in Physical Chemistry Chemical Physics
- Vol. 27 (24) , 13071-13082
Study on the mass transfer behavior of single CO2 bubbles in sodium silicate solution
The mass transfer behavior of single CO2 bubbles in sodium silicate solutions was investigated. The effects of pH, static pressure, and solution concentration on bubble dissolution and absorption kinetics were systematically revealed.
- Open Access
- 21 November 2024
- Published by MDPI AG in Preprints.org
Single-Epoch Power Positioning Method for Multi-Beam LEO Satellites
LEO satellites offer reduced signal loss, fast movement, multi-beam, typically providing single coverage. This paper introduces a novel multi-beam power positioning method for low-orbit single-satellite, addressing the slow convergence and low accuracy of Doppler positioning. It establishes a power observation equation system, initializes with the nearest neighbor algorithm, and refines with the least squares method. Monte Carlo simulations indicate that with good initial values, the method converges in under 10 iterations, achieving 88.06% availability at 20° elevation with errors of 5331m (vertical) and 8798m (horizontal), and a timing error of 205μs. At 70° elevation, all users converge with errors of 1614m and 1088m, and a timing error of 31.3μs, demonstrating high power positioning availability. The statistical results show that power positioning users can obtain the positioning accuracy of kilometers and the timing accuracy of microseconds, which meets initial timing needs under strong confrontation, enhancing the medium and high orbit satellite navigation.
- 21 November 2024
- Published by MDPI AG in Preprints.org
Open AccessSingle-Epoch Power Positioning Method for Multi-Beam LEO Satellites
LEO satellites offer reduced signal loss, fast movement, multi-beam, typically providing single coverage. This paper introduces a novel multi-beam power positioning method for low-orbit single-satellite, addressing the slow convergence and low accuracy of Doppler positioning. It establishes a power observation equation system, initializes with the nearest neighbor algorithm, and refines with the least squares method. Monte Carlo simulations indicate that with good initial values, the method converges in under 10 iterations, achieving 88.06% availability at 20° elevation with errors of 5331m (vertical) and 8798m (horizontal), and a timing error of 205μs. At 70° elevation, all users converge with errors of 1614m and 1088m, and a timing error of 31.3μs, demonstrating high power positioning availability. The statistical results show that power positioning users can obtain the positioning accuracy of kilometers and the timing accuracy of microseconds, which meets initial timing needs under strong confrontation, enhancing the medium and high orbit satellite navigation.
- Open Access
- 17 October 2024
- Published by MDPI AG in Remote Sensing
- Vol. 16 (20) , 3856
DOA Estimation of GNSS Signals Based on Deconvolved Conventional Beamforming
The Direction of Arrival (DOA) parameter is a key parameter in directional channel modeling for GNSS systems and multipath suppression. However, achieving high-precision, low-complexity DOA estimation of multiple signal sources without requiring a known source number is still a challenge. This paper introduces a satellite navigation DOA parameter estimation method based on deconvolution beamforming. By exploiting the translational invariance property of the uniform linear array pattern, the deconvolution process is applied to the de-spread array pattern of satellite navigation signals, achieving high-precision estimation of DOA parameters. This method can achieve high-precision blind DOA estimation of multiple signal sources while significantly reducing the estimation complexity. Compared with traditional methods, precise DOA estimation can be achieved even in low-signal-to-noise-ratio conditions and with a small number of elements in the array. The theoretical analysis and simulation results verify the effectiveness of the proposed algorithm.
- 17 October 2024
- Published by MDPI AG in Remote Sensing
- Vol. 16 (20) , 3856
Open AccessDOA Estimation of GNSS Signals Based on Deconvolved Conventional Beamforming
The Direction of Arrival (DOA) parameter is a key parameter in directional channel modeling for GNSS systems and multipath suppression. However, achieving high-precision, low-complexity DOA estimation of multiple signal sources without requiring a known source number is still a challenge. This paper introduces a satellite navigation DOA parameter estimation method based on deconvolution beamforming. By exploiting the translational invariance property of the uniform linear array pattern, the deconvolution process is applied to the de-spread array pattern of satellite navigation signals, achieving high-precision estimation of DOA parameters. This method can achieve high-precision blind DOA estimation of multiple signal sources while significantly reducing the estimation complexity. Compared with traditional methods, precise DOA estimation can be achieved even in low-signal-to-noise-ratio conditions and with a small number of elements in the array. The theoretical analysis and simulation results verify the effectiveness of the proposed algorithm.
- 15 October 2024
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Sensors Journal
- Vol. 24 (23) , 39418-39431
Blind Spoofing Detection for Anti-Jamming Multiantenna GNSS Receivers
Multi-antenna Global Navigation Satellite System (GNSS) receivers with adaptive array processing are widely used in harsh jamming environments. However, spoofing is still a security threat to multi-antenna systems because it can go unnoticed by existing array anti-jamming techniques. Direction-of-arrival estimation is one possible technique to identify a spoofing attack. However, such methods are expensive to implement due to the need for array calibration. In this paper, a simple spoofing detection method with anti-jamming capability is proposed. This method can be operated without any supporting information or sensors, thanks to its blind characteristics. Specifically, multichannel anti-jamming processing is first used to suppress jamming, and then an extended double difference carrier phase (DDCP) model is established. Based on the above, a test statistic for spoofing detection is derived using the generalized likelihood ratio test (GLRT) approach. The detection performance is analyzed theoretically and the detection threshold is derived. Furthermore, methods to reduce false alarms are also discussed. Finally, several real-world experiments are performed to verify the effectiveness of the proposed method.
- 15 October 2024
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Sensors Journal
- Vol. 24 (23) , 39418-39431
Blind Spoofing Detection for Anti-Jamming Multiantenna GNSS Receivers
Multi-antenna Global Navigation Satellite System (GNSS) receivers with adaptive array processing are widely used in harsh jamming environments. However, spoofing is still a security threat to multi-antenna systems because it can go unnoticed by existing array anti-jamming techniques. Direction-of-arrival estimation is one possible technique to identify a spoofing attack. However, such methods are expensive to implement due to the need for array calibration. In this paper, a simple spoofing detection method with anti-jamming capability is proposed. This method can be operated without any supporting information or sensors, thanks to its blind characteristics. Specifically, multichannel anti-jamming processing is first used to suppress jamming, and then an extended double difference carrier phase (DDCP) model is established. Based on the above, a test statistic for spoofing detection is derived using the generalized likelihood ratio test (GLRT) approach. The detection performance is analyzed theoretically and the detection threshold is derived. Furthermore, methods to reduce false alarms are also discussed. Finally, several real-world experiments are performed to verify the effectiveness of the proposed method.