The essence of metaphor’s reliance on two domains, a source and a target, is argued as stemming from a fundamental characteristic of higher cognition—that of conceptualizing more than one cognitive/embodied domain at the same time. This cognitive duality is argued to underlie a plethora of conceptual activities including comparison, contrast, categorization, as well as metaphorizing. Why “two” domains seems the emergent and optimal means of such meta-cognition, rather than a higher number of domains, which might confer some advantages, is argued to arise from a grand compromise between an extreme necessity of humans to create and rely-upon shared complex meanings, and the complexities in enabling such shared meaning across multiple domains. Deconstructs metaphorical structures to demonstrate the profound possibilities of dual cognitive schematic activation.Argues for a deeper understanding of metaphor beyond mere source and target domains.Emphasizes that dual activation is not in itself sufficient for metaphor to occur.Points to a wealth of other similar situations where the presence of a duality, as in metaphor, can be a tipping point in the ensuing magnitude of complexity.“Are not gross bodies and light convertible into one another, and may not bodies receive much of their activity from the particles of light which enter their composition?”“Truth is ever to be found in the simplicity, and not in the multiplicity and confusion of things.”— Isaac Newton,Opticks, 1704http://www.rarebookroom.org/Control/nwtopt/index.htmltarget domain people are seeking to understand, and a source domain used to help with that understanding. Whether the connection between these domains allows for one-way or two-way traffic, is a matter of much discussion. And what those domains actually are, as some kind of conceptual structures or something else, is also a slippery issue , . So it slanguage . Why mighappens to involve two domains. But rather that cognition itself, in a general sense, seems to involve representation and activation , of domain-like things—activating them at times to do cognitive work . But once cognition moves from dealing with one domain at a time to two—and especially with both domains being active in some particular way at the same time, something very special is enabled. Having the neural machinery to hold one conceptual domain in mind, while invoking a second one, allows for a wide variety of cognitive, or perhaps meta-cognitive processes, including metaphorical thought.compare the two things (which is bigger?), contrast them (which is better?), substitute them (a long stick STANDS FOR a long arm), as well as metaphorize the two domains (positive affect IS warm sunshine). So such an ability seems to bridge the very earliest possibilities in thought about more than one thing at a time, leading all the way up to the most profound and meaningful multimodal poetic metaphors. The latter, also enable realization of similarities between two things , yet also open up a universe of meaningful possibilities , is the very basis of the concept of comparison.sameness, difference, resemblance of varying strengths and sorts, opposition, identicality, along with various relations like member-category, initial-secondary, cause-effect, concrete-abstract, etc. One could thus argue that this ability to manage more than one representation at a time is the very birth of higher-order cognition . And, as this article will argue, it also seems to be the birthplace of metaphor.This capacity to hold more than one representation in mind somehow representation. Representation has been a dominant metaphor for thinking about cognition for millennia, if not longer.Before arguing that higher-order cognition based on cognitive parallelism is the basis of metaphor, lets first consider briefly how cognition operates in other ways, at least in generalities. As a starting point, let us consider the notion of by the neural system, perhaps sometimes as a cascade from other neural patterns themselves, but also responsive in semi-regular ways to things external to the system. All told, our entire mental/experiential capacity seems to ebb and flow in accordance with our environment .There are also approaches that attempt to avoid the concept of “representation” altogether, instead arguing for emergent patterns of semi-chaotic neural activity in the form of dynamical systems, and others . But eveWe also seem to build complexity and nuance into this general idea of representation in the form of broader cognitive structures. So we think about component parts that make up larger wholes . We think extensively about categorization, always struggling over whether a given thing belongs to this or that category . We often connect categories in the form of modal, or tree-like, or nested, or other kinds of networks .We also increasingly must cobble together new representations for things that appear or are invented in our environment. So we have “solar shingles” for roofing materials that can collect and transfer solar energy, or “fobs” which originated as straps to hold pocket watches but now refer to electronic remote-control keys for locking/unlocking things, etc. And of course many of these are based on resemblances of many kinds with pre-existing, pre-represented things .transferring of something from a representation of one thing onto another.From these sorts of resemblance-based new representations we can begin to talk about analogies. Or, a sort of representation where the form, pattern, or function/structure of one representation is extended to that of another thing. So we might say that a car fob is the modern analog of a car key. Or we might say the CPU of a computer is analogous to the brain of an animal, or the headquarters of a complex organization. This is all not so much an act of constructing a representation from scratch, but rather in a be those other things. So we drop the scaffolding or pretense around a comparison or resemblance  of A to B, and just state, show, act, think, etc., that A is a B. The particular means of this metaphorizing between two things varies of course across language (as well as languages), image, sound or any other way we can encounter/sense things, but they all posit the relationships between A and B quite boldly, in a way imposing B-ness onto A.,And finally from there we can morph into the full-on leap-of-faith of the world of metaphor where representations do not involve things just being analogous to other things, but rather when things are purported to demonstrate some of the very representation-building processes discussed above in our very attempt to understand what metaphor is. We might argue for instance that metaphor is a bit of categorization grafted onto analogy—we apply the structure or function of B to that of A , by saying that A is a member of the category B (categorization). Indeed, this seems the very approach adopted by the Categorization account of metaphor  and apply it to another (2), as in, rainforests are the lungs of the planet. And metaphors impose something from source domains (1) onto target domains (2).But even in all of the above ways in which we make and have representations, we are still always hovering around the notion or quantity of “twoness.” We build representations in our minds/bodies (1) of things in our environment (2)—with, as a caveat, our minds/bodies being fair game as part of that environment. Or we represent the entirety of a thing (1) as made up of component parts (2). We also make dichotomous decisions often as to whether a given representation (1) belongs or does not belong to a given category (2).Of course one might simply view all of these related ways in which we assemble representations as involving “two” or twoness, as simply what results once we expand beyond the singularity of just having a single thing—it might be seen as just the inevitable result of the building of complexity. You begin with nothing. Then you have something. Then for any degree of differentiation to be achieved, that something must be discerned into different somethings, so we move from having just one thing, to having another thing, such that we end up, at least at first, with “two.”But there are a huge number of ways in which our complex worlds and our complex minds operate with many levels greater than two. Just going back to the notion of wholes and parts, we are very comfortable with the idea of wholes requiring large numbers of parts. We also readily operate with a plethora of differing categories, and categories with many members. So we have the category of vehicles as well as lots of kinds of vehicles. Among the category of two-wheeled vehicles we have bicycles, motorcycles, pull-carts, push-carts, chariots, trailers, rickshaws, etc.But once we move to the level of analogies or metaphor, we seem constrained more by this notion of twoness. We very typically talk about analogies in terms of targets (1) and vehicles (2), . And metaphors as mentioned at the beginning of this article involve source (1) and target (2) domains.is. Are there reasons that we do not usually go beyond two domains—something about three or more that is detrimental? Or is the meaningful move from dealing with just one thing to a pair of things all that can be achieved? Or is there some characteristic of two domains that emerges as being most beneficial. Or is some combination of these possibilities the answer? To further our understanding of this issue, let us move away from metaphor for a moment and briefly consider other forms of figurativity or figurativesqueness that also make use of domains.So perhaps there is just something germane to metaphors and analogies that likes the use of only two domains. But the question remains as to what this “something” actually Metaphor is not the only way that we use domains in our creations of representations. We also craft metaphors both linguistically and within many other kinds of media. But we’ll confine the discussion here to forms of figurativity/figurativesqueness that are conducted via language.rhetorical question, asyndeton, metonymy, hyperbole, tautology, antimetabole, metaphor, verbal irony, idioms, proverbs, simile, oxymoron, onomatopoeia, allegory, and puns. This deconstruction involved looking at the generic structure of the figurative/figurativesque forms and determining, (1) how many domains were invoked, (2) what those domains were, (3) what is done with those domains, and (4) what doing things with those domains accomplishes for interlocutors using the figurative/figurativesque forms.caesura, pleonasm, metanoia, antonomasia, and pastiche, are presented instead , where the same essential domain, in the case of the example, the eating of the Metanoia is another “two-ish” figure (or figuresque form), in that it also invokes only a single domain, but metanoia then re-invokes the domain a second time, immediately after the first, with greater specificity. For instance, a speaker might say, “this is a form of figurative language, or at least figurativesque language” to first orient the hearer/reader to the general domain being invoked, perhaps because that general domain is more recognizable or familiar. But then the speaker qualifies the referenced domain in a subsequent adjacent construction that softens, strengthens, or somehow hones the referent domain with greater precision. Such a technique might simply reflect how people talk in normal causal conversation, where an initial idea comes to mind at first, is then uttered, but then is qualified upon further contemplation. But it could also serve to demonstrate the speakers recognition of the resemblance of the more specific description with the initial broader one, to note the subtle distinction between the two, but to not give the distinction great credence. All in all it seems to suggest the broader description is generally apt, yet to also acknowledge subtle details at play.And finally we have two examples of more genuinely 2-domain figures, which each operate a lot like metaphor in that they invoke two separate domains and invite correspondences between them. But each figure differs slightly in the nuance of those invited correspondences. For antonomasia, as in saying, “Hey, it’s the Formula One Racer!” to refer to a person who had recently exhibited great driving skills in chauffeuring several passengers up a windy mountain road, a speaker is invoking two domains. One is the actual referent, a person/driver in this case. The other, the source domain, is a member of a class of individuals known for some exceptional characteristic—Formula One Racers, who are distinguished by superior driving abilities.quality of those skills, not so much their mere presence. Other metaphors seem more involved in imposing characteristics from a source domain onto a target domain that are less-obviously already present. So antonomasia seems to have some components of hyperbole in its operation, in inflating a characteristic of a domain to draw attention to it (Antonomasia feels a lot like a metaphor—using a source domain (Formula One Racers) to highlight something about a target domain . But it seems also a little different as a cross-domain mapping in that the individual in question already has something from the source domain—driving skills. The mapping in this case thus concerns the on to it . Or evenAnd lastly we have pastiche, which also resembles metaphor in the use of a source and target domain. Although pastiche seems a bit like allegory in that it can apply quite broadly and often is not contained only in a particular linguistic utterance or other smallish meaningful construction. For allegory, that broad application is usually for some lesson, moral or other characteristic from a source domain, to apply to a relatively open class of target domains in the world of human events . For pastiche, though, the broadness lies more with what can be shared or similar between the source and target domains. And with pastiche the direction of meaning enhancement seems more nuanced. An instance of pastiche usually draws correspondences between a source and target domain, but often more for an honorary nod, or respectful, albeit often humorous, acknowledgement of the source domain from which a characteristic originally resided. But it can also lend a boost of understanding to the target domain, as is usually the main function of metaphor.For instance, in the classic American television/internet comedy shows Mystery Science Theater 3,000, and RiffTrax, among many, many others, some aspect of a particular target situation, will often be highlighted with some characteristic from a different source domain situation. A comment from an instance of riffing , or a skit involving play-acting with some motif or theme from that movie, can thus borrow content from a source domain, applying it to the target domain. So if a movie scene involves a chase where one car rapidly leaves another car behind, a commentator might mimic the classic “Beep, Beep” call of the Road Runner character from classic American Warner Brothers cartoons in the mid 1900s. The mimicry both highlights a characteristic of the target domain (one thing soundly defeating another thing in terms of their relative speed of motion), by tying it to a well-known cultural meme from another source (the Road Runner cartoons) where that characteristic is caricatured. But the mimicry also gives homage to that source domain content itself.Pastiche resembles parody in that the latter often uses a source domain content or framework to belittle (humorously or not) a target domain, occasionally making fun of both the target and source domains in the process. But pastiche is more honorary in its use of a source domain to lend a humorous take on a target domain. For instance, many musicians will uses instances of melody in a song to give both a light-hearted lilt to the composition being performed, yet tip-their-hat in an honorary nod to the source domain from where the content was borrowed.In these five cases . A smaller group use two domains more for contrast, nullification, substitution, and the like .We can see that most of the caesura and pleonasm), they use a domain in a general sense first to draw attention to it, but then to clarify its invocation (metanoia), or as mentioned they draw correspondences between two domains (antonomasia and pastiche).We see also that the figures invoke these domains and do fairly straightforward things with them. Of the five figures reviewed here, they inflate the domains in a way to increase their importance . Sun-loving plants will grow toward the sun, but not toward shade. Animals will engage in stalking behavior when they have detected prey, but not when they have not. Squirrels will store nuts when the temperature drops, but not before, etc. And these actions which are necessary for survival, as said, are encased in a way within the lifeforms via DNA-encoding or through learning and retention by nervous systems from observation or experience . Rather, we use pairs of domains to craft new representations because we perience .13extensive learning—on acquiring, developing, maintaining and expanding our learned representations of the world for our survival. An average modern person spends years of their lives in focused study and learning of skills, trades, abilities, knowledge-sets, expertise, etc., to function in the world. And increasingly, we must continue that learning throughout our lifespans since the knowledge required to maintain our survival changes and expands rapidly.But these forms of useful “meaning” are relatively simple in comparison to what humans do. Other lifeforms can rely on their DNA endowment and modest learning to survive. But we are much more dependent on share that knowledge with others, and them with us. Our collectively shared knowledge, culture if you will, is our primary means of survival. And language, it can be argued, is the primary means by which all this knowledge-sharing takes place.But even all this carefully crafted and retained knowledge is not enough to ensure our survival. We also must So humans have evolutionarily committed themselves to deriving, creating, building, sharing and using collective “meaning,” in order to survive. This need for understanding puts enormous pressure in us to get and to have meaning. We are uncomfortable if we do not have it. We strive to achieve it. We clamor to have more of it. We are devastated if it is taken from us. We are extremely happy to achieve it. We like it when it is fresh, new, more encompassing. We build entire cultures, institutions, societies, etc., around it, etc. This meaning/understanding involves the “anatomy” of our worlds (its component parts and their arrangements). These often take the form of parts, associations, relations, connections, comparisons, categorizations, hierarchical and network arrangements, etc. And meaning also involves getting the “physiology” of the world to understand how all that anatomy works together to function. All of this requires meta-representational thinking in the form of two things together making a third thing, or two things with another thing between, across, among, shared by, them, etc. And one major form that this understanding takes is the understanding of one thing, in terms of another thing—the birth of metaphor.It is more fulsomely a fundamental human individual and social requirement, one key part in our desperate attempt to fulfill our need for meaning, upon which our survival depends.So all told, we greatly need meaning, metaphorical and other kinds, causing us to create and share/borrow it extensively, and of finding means of expanding it however we can onto the myriad of things that remain unknown. So metaphor is not merely a clever way to say something. Nor is it just a structure of sorts in the mind/body.meaning-built-from-“two” can be shared. For something like metaphorical meaning to bridge two people means that the people must already share something about the individual component parts of the metaphor . If, for example, the conceptual metaphor, KNOWLEDGE is FOOD is invoked in the linguistic metaphor, “they ate it up” in response to a question about how an audience received a new idea, people must already have some individual grasp of both knowledge and food. One could argue that this explains why so many metaphors are based on either embodiment or culture (or both), in that a pair of interlocutors, in the case of successful metaphor understanding, are likely to share those things. They would share similar embodied experiences by virtue of having a similar human mind and body. And they would share a culture by virtue of overlapping on a set of beliefs, understandings, values, etc. So “two” works well on this point since it aids, expands, and shares something pre-existing in pairs, or more, of people. Yet it does not reach too far. Should a representation demand shared understanding of three or more domains, then the likelihood of adequate sharedness would diminish—the more things people must share for understanding, the less likely understanding will be. Metaphor, as such, quits while it is ahead.Part of what makes “two” useful for building representations to fulfill our need for meaning is the fluency with which positive from a human’s experience, in terms of physical upwardness, can encompass an enormity of content. We have a lot of things we might consider positive experiences. And we have a myriad of ways of referring to upwardness. Each of these domains can have a lot of variability within themselves . But they share, upwardness. The same holds for positive experiences . But a metaphor that uses one thing in common from one domain (positive polarity) in connection with one thing shared by the other domain (upwardness), aligns all those things together in a common relationship . This is a lot of meaningfulness lifted with a very small lever.A related advantage of building representations out of two domains is that the potential meaning can be pretty far-reaching. Conceptualizing something oneness, or being the same thing, might be particularly useful in achieving shared meaning. Were a speaker to posit a mere resemblance or modest overlap between two disparate things , they invite a consideration of what the things have in common . But the comparison allows for a lot of variability to remain , which can itself vary across comprehenders . The typical metaphorical construction, however, pressures comprehenders to more thoroughly align on the relationship between the two things, emphasizing and enhancing that sharedness—both the sharedness between the aligned domains and that between the interlocutors.And finally, the nature of a metaphorical linkage between two domains , being based a claim of on Related to the above ideas about metaphor expanding and enriching meaning but not going too far —leveraging a connection between two things likely already possessed by interlocutors, and that leveraging being powerful , yet limited, is the idea of a grand compromise. Metaphor, being built on two domains, might land upon the ideal degree of meaning-making. It might maximize the meaning shared between people but also minimize any hindrances in achieving that shared meaning.expanding meaning possibilities, while also ensuring the sharedness of any new meaning representations. Understanding one domain in terms of a second domain, might enable a nuanced or altogether novel understanding of the target domain, while still guaranteeing that the new understanding is within the shared reach of different individuals. Meaning expansion coupled with meaning sharedness. “Two,” again appears to be a useful compromise.A similar situation might hold for The fact that metaphor is built on the primary idea of one thing being structured in terms of another thing, all for the purposes of creating new meaningful mental representations, was argued to have a degree of special import, resting on the notion of “two” as the number of domains used. A sizeable set of similar figurative and figurativesque forms was reviewed to show their similar gravitation toward the usage of two domains. Most of those forms use two domains or something very similar to two domains, in their differing yet comparable processes for leveraging new meaning and pragmatic effects.An argument was also presented that the usage of two domains for meaning-making stems ultimately from a major early-cognitive step of meta-representation where more than one conceptual domain can be considered at a time. Such a step enables comparison, categorization, and ultimately metaphoricity.The need for metaphorical representations to be shared by interlocutors, arising from a baser need-for-meaning, endemic of the human evolutionary trend on relying on mental representations for survival, was also emphasized. The reliance of two domains for such shared meaning was presented as arising from both the advantages of what pairs of domains enables, as well as challenges if the number of domains for meaning-making expands beyond two.And finally, this tendency toward “two” for meaning-making was presented as resembling the biological compromise of relying largely on two sources of genetic material for reproduction—optimizing the diversification of individuals in response to adaptation pressures, with the realities of reproductive coordination.Our understanding of metaphor began as a tool for meaning-enhancement in language. It then moved to serving as a predominant way in which we mentally organize cognitive and embodied experiences, in language and beyond. Now it is being seen as a fundamental characteristic of shared cognitive/embodied meaning-making necessitated by a species that is extremely dependent on assembled meaningfulness for survival—to predict, navigate, and increasingly to manipulate its environment. This has been a lengthy progression.A subtle comparison was made earlier between nervous systems based on neurons versus ones based on fungal threads or hyphae as used by mycelia. Such a comparison might also hold insights for the history and evolution of thinking about metaphor. Our original idea was that metaphors were essentially interesting “fruits” found only in language. This might be akin to our older thinking that mushrooms and other fungi were also simply a form of plants with roots that fed on dying plant matter. We now know that mushrooms are merely the flowers of a much more extensive and extremely complex and arguably “intelligent” lifeform known as mycelia, warranting its own taxonomic category alongside plants and animals, and more closely resembling the latter. And also being necessary for the very existence of many other forms of life. So, as we once underestimated mushrooms, we may have also underestimated metaphors—they were once relegated to fanciful language forms, then upgraded to having prominent presence in everyday speech. They have since been understood to reside in all forms of human thought and creative activity. Now they might be realized as fundamental to the very earliest bases of representational cognition.The original contributions presented in the study are included in the article/supplementary material, further inquiries can be directed to the corresponding author.The author confirms being the sole contributor of this work and has approved it for publication.The author declares that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.


Domain-Enforced Memory Isolation and instruction-level domain isolation—with the primary idea of enabling granular access control for memory by validating the domain state of the processor and the executed instructions. By achieving fine-grained validation of memory regions, our technique safely extends the supported domain capabilities of existing technologies while eliminating the overhead associated with switching between domains. Our implementation of eight user domains shows that our approach yields a hardware overhead of a slight 8% in Ibex Core, a very lightweight RISC-V processor.Memory isolation is an essential technology for safeguarding the resources of lightweight embedded systems. This technique isolates system resources by constraining the scope of the processor’s accessible memory into distinct units known as domains. Despite the security offered by this approach, the Memory Protection Unit (MPU), the most common memory isolation method provided in most lightweight systems, incurs overheads during domain switching due to the privilege level intervention. However, as IoT environments become increasingly interconnected and more resources become required for protection, the significant overhead associated with domain switching under this constraint is expected to be crucial, making it harder to operate with more granular domains. To mitigate these issues, we propose DEMIX, which supports efficient memory isolation for multiple domains. DEMIX comprises two mainelements— In the era of the Internet of Things (IoT), the utilization of embedded systems has become highly prevalent, ranging from its use in personal health care , home auThe most common method of providing memory isolation by domain in embedded systems is using a Memory Protection Unit (MPU). The MPU enables the definition of memory regions and their associated permissions, thus constraining the scope of the processor’s accessible memory into distinct domains. However, despite the memory isolation provided by the MPU, a trade-off exists in that it incurs overheads during domain switching due to the privilege level intervention. This overhead can lead to latency issues if domain switching occurs frequently. To address this limitation, several studies have proposed ways to support unprivileged domains, such as EA-MPU ,19, ARM Our previous work, RIMI , is an aDomain-Enforced Memory Isolation, which enables supporting multiple domains and eliminating the overhead required to switch between each domain, and (2) instruction-level domain isolation, which addresses permission issues that arise as the number of supported domains increases, and prevents domain fragmentation for internal data protection.In this paper, we present DEMIX, our extended approach that addresses the limitations of existing methods for supporting unprivileged domains. DEMIX expands the number of supported domains while eliminating the overhead associated with domain switching, enabling more efficient use of resources with providing safety in lightweight embedded systems. In particular, DEMIX consists of two components: (1) In detail, our Domain-Enforced Memory Isolation technique serves as an accessible memory region through a separate domain state register managed by the processor. This register, acting as a domain identifier, allows quick reconfiguration of the address space upon domain switching by changing the stored value. Meanwhile, our instruction extension extends the instruction-level memory isolation proposed previously in RIMI. However, unlike the previous proposal that only supports two domains, our domain protection is now developed for multiple domains, which is achieved by combining it with our Domain-Enforced Memory Isolation technique. Furthermore, we also incorporate a new instruction to handle domain switching permissions issues in multiple domains support. This instruction designates domain-specific accessible entrances to code regions when a processor switches domains. As a result, our technology supports instantaneous switching for multi-domain while offering enhanced protection during domain switching. Implemented on a RISC-V core that does not support unprivileged domains, our evaluation demonstrates that DEMIX is able to support unprivileged domains with minimal resource overhead on lightweight embedded systems. More importantly, our evaluation provides evidence of the feasibility and effectiveness of our approach in improving the security of lightweight embedded systems.Increased number of supported domains: DEMIX supports multiple domains, unlike some proposals that only support one secure environment. This feature makes it more scalable and better suited for real-world use cases that are more likely to require multiple domains.Reduced overheads: DEMIX eliminates the overhead associated with domain switching, allowing for more efficient use of resources. It includes the availability of processors and the consumption of MPU entries required to use a separate switching domain.Enhanced protection during domain switching: DEMIX ensures granular permissions and correct access points per unit task inside the domain, providing improved security while minimizing the risks associated with cross-domain function calls.Fine-grained access control: DEMIX offers fine-grained access control by distributing access permissions to code in an instruction unit, providing an added layer of security for embedded systems. This capability also defines highly distributed or heterogeneous privilege configurations with minimal MPU entries.Compatibility with lightweight processors: DEMIX has been successfully implemented on the Ibex processor, a lightweight RISC-V core. This makes DEMIX a practical solution in real-world IoT environments with prevalent lightweight embedded systems.The advantages of DEMIX over existing solutions can be summarized as follows:DEMIX in DEMIX on Reduced Instruction Set Computer version 5 (RISC-V) architecture [This paper is organized as follows. First, we provide the motivation in itecture  and analPrior to our research, there have been several works that aim to implement unprivileged domains in embedded systems. These studies have utilized various methods to separate address spaces and enforce memory protection. In this section, we provide a brief review of these existing approaches.The Memory Protection Unit (MPU) ,25, one To improve the efficiency of MPU, some works have proposed an extended MPU called the Execution-Aware MPU (EA-MPU) ,19. EA-MThe Memory Protection Key (MPK) is a hardware-based memory protection technology that provides a set of hardware-enforced protection keys. MPK checks the protection key associated with a memory region and grants access if the key matches the desired value. This method provides a separate identifier for validating the domain, allowing for a fast transition by changing the protection key or a designated register instead of reconfiguring the entire address space. Intel MPK  is an exdcall) to invoke it. This reduces domain switching overhead and provides fine-grained access control in environments that require frequent domain switching. However, the need for monitor calls during the domain-switching process incurs overhead, even though the monitor operates at an unprivileged level. As a result, Donky is useful for traditional context-based protection but may not be ideal for providing more granular control over resources within a single context.Another example of using MPK technology is the Domain Keys Efficient In-Process Isolation for RISC-V and x86 (Donky) , which aHorizontal partitioning is a security technique that divides data and code into separate partitions. This method offers a minimal number of domains and policies, usually just two, but is optimized for applications that require fast domain switching. TrustZone-M  is a secOur initial version of this work, RIMI , partitiDEMIX, our proposed novel Domain-Enforced Memory Isolation technique that offers an efficient and secure solution for safeguarding sensitive code and data in embedded systems. Our proposal aims to address the challenges that lightweight embedded processors encounter in protecting their memory against malicious attacks by combining the benefits of existing methods while also overcoming their limitations. The primary goal of DEMIX is to provide strong memory isolation in embedded systems, thereby enhancing the overall security of these systems. In detail, we first describe the threat model, assumptions, and challenges to implementing DEMIX. Subsequently, we elaborate on how DEMIX handles these aspects, providing a clear mapping of the features and the corresponding threat and challenges it addresses.In this section, we elaborate on the design considerations of There are a variety of attacks that can be executed by exploiting the vulnerability of a system, in which the scenarios can be described with different threat models as presented in . In termDEMIX, including the Memory Protection Unit (MPU) configuration. We also assume that memory vulnerabilities exist in the embedded system’s software and a remote attacker has knowledge of them and can exploit them. The adversary aims to break the security by obtaining unauthorized access to sensitive functions or leaking critical data in the embedded system.In this paper, we propose an efficient unprivileged domain isolation technique to safeguard internal resources in lightweight embedded systems. Each domain that we design protects internal resources without requiring privilege-level intervention and supports instant transitions. Although our proposal primarily focuses on unprivileged-level isolation, these domains are still protected through the privileged level. Therefore, we follow the same assumptions as the existing memory isolation approach. In particular, we assume a trusted software component that operates as a Trusted Computing Base (TCB) in the system exists. This TCB ensures the integrity of critical resources for the unprivileged domain of Memory isolation that does not support multiple unprivileged domains can prevent this unauthorized access using privilege-level software. This software is always performed when switching domains, configuring the new memory access scope on the MPU, and validating legitimate access. However, as we support unprivileged domains that remove the overhead of privilege-level intervention in these processes, some threats need to be considered. T1. Unauthorized Access to Sensitive Memory: Unauthorized access to sensitive memory  is a significant concern in the systems that implement unprivileged domains and utilize MPU to manage memory access permissions for multiple domains. An adversary may attempt to gain access to sensitive data and functions from other domains that are accessible at an unprivileged level, potentially compromising the security of the system.T2. Malicious Cross-Domain Function Calls: Malicious cross-domain function calls can pose a significant security risk through incomplete function execution. An adversary may attempt to exploit the cross-domain function call mechanism by branching to a location that is not a valid function entrance for a trusted domain. This may result in unauthorized access to sensitive data or functionality, compromising the system’s security.T3. Tampering with Domain Switching Process: An adversary may attempt to gain unauthorized access to sensitive data and functionality by compromising memory isolation by manipulating the domain-switching process. This can be achieved by posing as a different domain, potentially bypassing security measures and compromising the system’s security.T4. Exploiting Shared Memory: Shared memory can be a necessary component for cross-domain data communication, but it can also be a target of exploitation by malicious parties. An adversary may attempt to compromise sensitive information or secure contexts of other domains by modifying their addresses to a shared memory location, potentially leading to data leaks.Note that we focus on providing a reliable and flexible solution for memory protection in embedded systems. Thus, we do not consider physical attacks such as side-channel attacks (SCA) as these attack types are beyond the scope of this study.DEMIX targets very lightweight embedded systems commonly used in IoT environments. These systems usually comprise a single core, a few peripherals, and flash and SRAM memory and are often utilized as endpoint sensors or simple actuators. Given these systems’ limited resources, several challenges here refers to the characteristics essential to be achieved when implementing DEMIX, denoted as C1, C2, C3, and C4 as follows.C1. Efficient Domain Description: In contrast to larger systems that support a memory management unit (MMU) for virtual memory support, these systems typically use MPU for physical memory protection. MPUs usually have a minimal configuration entity, making it challenging to define multiple domains efficiently with limited resources.C2. Efficient Domain Protection: The increased number of unprivileged domains delivers a complex challenge in managing access permissions. The limited resources of embedded processors make configuring permissions for multiple domains difficult. For example, cross-domain entry protection, which traditional techniques support using entity tables, can become inefficient as the number of domains increasesC3. Reduce Switching Overhead: Minimizing the overhead of domain switching is another challenge. Cross-domain function calls typically require a significant overhead regarding processing time and memory usage. The challenge is to minimize this overhead while maintaining the security of the domain switch process.C4. Minimum Hardware Overhead: Balancing security and hardware overhead is a major challenge in implementing embedded systems. The use of multiple unprivileged domains can improve security, but it also results in increased overhead. The challenge is to find the optimal balance between security and hardware overhead to meet the requirements of embedded systems with limited resources.DEMIX to address them:Hardware-Based Domain Identifier: This feature ensures that each domain is uniquely identified and isolated from other parts, providing a secure boundary for each domain. This identifier prevents T3  as it is managed through hardware inside the processor. At the same time, it also counteracts C3 (reduced switching overhead) because it is easy to switch which domain the processor is performing by changing the identifier.Identifier-Based Memory Authorization: This feature provides memory protection based on the domain identifier, allowing only authorized domains to access specific memory regions. Moreover, it ensures that each domain only accesses a legitimate memory area in response to T1 (unauthorized access to sensitive memory). Furthermore, since this method can be implemented using the MPU instead of the MMU, it is well suited for low-end systems, where memory resources are limited and hardware overhead is a concern. As a result, it helps address two design challenges, C1 (Efficient Domain Description) and C4 (Minimum Hardware Overhead), for lightweight embedded systems.Instruction-Level Domain Authentication: This feature validates the domain identity using instructions, providing secure access to sensitive functions. This prevents T2  by securing domain access, which enforces the rule that access to this region must perform authentication. Additionally, this method eliminates the need for a domain entity table required by traditional technologies and enables efficient and fine-grained control over which domains can access specific functions. Instruction-level domain authentication can address C1 (Efficient Domain Description), C2 (Efficient Domain Protection), and C4 (Minimum Hardware Overhead), whereas securing cross-domain function calls in lightweight systems.Instruction-Level Secure Memory Access: This feature enables secure memory access at the instruction level, protecting sensitive data. It ensures that only authorized instructions can access sensitive data while protecting them from accessing shared memory, thereby addressing the threat of T4 (Exploiting Shared Memory). It also prevents domain fragmentation by reducing the need for separate domains or privilege levels to protect sensitive data, thus addressing C1 (Efficient Domain Description) and C2 (Efficient Domain Protection).After discussing and analyzing the threat model and challenges, we determine the following features of DEMIX. First, we provide the design overview of DEMIX, then discuss the main elements of DEMIX: the Domain-Enforced Memory Isolation in the instruction-level domain isolation in This section presents a detailed description of DEMIX, presents a novel and efficient approach to memory isolation designed to meet resource-constrained IoT devices’ security needs. The solution provides these capabilities through two fundamental techniques: Domain-Enforced Memory Isolation and instruction-level domain isolation.Our proposed solution, Domain-Enforced Memory Isolation supports multiple unprivileged domains’ inter-domain isolation by utilizing a hardware-based domain identifier and identifier-based memory authorization. This technique provides an efficient domain memory isolation method while eliminating the switching overhead required. We implement this by integrating a Domain Protection Unit (DPU), which assigns domain owner, trust, and protection levels to each region of system memory. The DPU, working with the processor’s current domain state, handles access to the corresponding address space.Instruction-level domain isolation enhances the security of each domain and enables fine-grained control over access to specific regions. This technique provides secure access to sensitive functions and data regions through instruction-level domain authentication and instruction-level secure memory access. These features help ensure intra-domain isolation, providing added security to each domain. We implement the DTI instruction for sensitive functions and the Secure Load/Store instruction for data.The unprivileged domain overcomes the constraints of traditional software-defined memory isolation approaches by implementing vertical partitioning. Vertical partitioning serves within the unprivileged level, whereas horizontal partitioning is based on the privilege level. We support this by expressing, through an identifier, which domain is running in the processor and authorizing memory access through that identifier. Based on the character of this mechanism, we call this technique Domain-Enforced Memory Isolation. The implementation of Domain-Enforced Memory Isolation is achieved through two components: the domain state and the domain policy. The domain state is supplied by the processor’s Domain State Register (DSR), whereas the Domain Protection Unit (DPU) manages the domain policy.DEMIX serves two Control and Status Registers (CSR) to handle the processor’s domain state: the processor’s Domain State Register (DSR) and the Previous Domain State Register (PDSR). The DSR represents the currently active domain in unprivileged mode. It expresses either the code’s domain passed to the pipeline before or the initialized domain in privilege mode. The DSR is utilized for two primary purposes in DEMIX. Firstly, it acts as an identifier to restrict the execution of the processor within a specified domain, allowing the domain policy with multiple domains. Secondly, the DSR allows the processor to monitor domain changes by tracking the executing code’s domain and performing domain-switching validation based on protection features. Although the processor’s DSR provides partitioning between domains in unprivileged mode, the PDSR provides communication between privilege levels. When switching between privileged modes, the PDSR backs up the DSR or restores the respective domain values. Specifically, switching to privileged mode saves the DSR to the PDSR, and switching to unprivileged mode restores the DSR to the PDSR. This mechanism ensures the protection and preservation of the DSR while enabling smooth transitions between privilege levels.The Domain Protection Unit (DPU) configures address spaces and protects memory access. As an extension of the Memory Protection Unit, the DPU implements a domain policy for each memory region, allowing for the simultaneous management of address spaces for multiple domains. The domain policy assigns ownership, trust, and protection levels to each memory segment, which determines the identifier for the memory segment (ownership), the authorized domain states for accessing the memory segment (trust), and the level of security for the memory segment (protection level). In domain policy, ownership and trust are the essential resources that control the allocation and protection of the domain’s memory. Domain ownership serves as the identifier for the memory segment and allocates the processor’s DSR during execution. On the other hand, the trust activates the memory segment based on the DSR, permitting access to only those domains that have been granted authorization. The sequence of domain identifiers through the DSR ensures that when executing code with specific ownership, the processor can only access memory segments whose ownership it trusts.DEMIX, with the operation described as follows. During memory access, the processor provides the processor’s DSR to the DPU. Based on this DSR information, the DPU calculates the set of memory segments that the processor is authorized to access and provides the corresponding address space. The DSR acts as an identifier for reconstructing the processor’s accessible address space. In the figure, the domain switching process and memory protection mechanism in DEMIX are presented. For switching to User Domain1, the privilege mode sets the PDSR to Domain1 and transitions to the code in User Domain1. Upon transitioning from privileged to unprivileged, the value in the PDSR is copied to the DSR, effectively pointing to Domain1. As a result, the processor can only access memory segments authorized for Domain1.Inter-domain isolation refers to the ability to separate address space between different domains. This feature is essential to protect sensitive memory in one domain from unauthorized access in the untrusted domain. Domain3 is accessible from Domain1 as specified by the trust configuration. When Domain1 accesses the code segment of Domain3, the DSR switches to Domain3, reconfiguring the address space accessible to Domain3. This mechanism enables fast domain switching, as the domain ownership enforces the address space. However, if the access is from an untrusted domain, the access will be blocked, and an exception will be thrown. For example, in the figure, the code segment in Domain2 does not trust Domain1. Therefore, the code in Domain2 cannot be executed when the processor is in the state of Domain1.The ownership of a policy is associated with the domain that will occupy the processor’s DSR when the code segment is executed. As previously shown in DEMIX introduces an instruction-level domain isolation technique that eliminates these inefficiencies and provides robust protection. DEMIX provides extended instructions for intra-domain isolation of code and data: the Domain Target Identifier (DTI) and Secure Load/Store. The DTI instruction authorizes access by individual tasks within a domain, whereas the Secure Load/Store instructions ensure safe access to secure data segments.Intra-domain isolation enhances the protection of sensitive code and data by enabling granular access control within a single domain. This approach offers differentiated access privileges based on the functionality within a single domain, which serves as an additional layer of protection. Unfortunately, most memory isolation techniques do not consider intra-domain isolation, making constructing configuration challenging and inefficient as the number of domains increases in a multi-domain system. To address this issue, DEMIX implements the Domain Target Identifier (DTI) instruction, which provides two forms of safeguarding. First, it specifies the accessible domains based on the functionality of the tasks, enabling fine-grained access control within a multi-domain system. Second, it guarantees the entry address of the domain task, thereby mitigating the possibility of unstable behavior resulting from malicious code. As previously described in To ensure the security of cross-domain function calls, The DTI verification process consists of two stages. In the first stage, the processor verifies whether the loaded instruction is a DTI instruction when the processor’s DSR and the instruction’s ownership differ. This stage serves as an access point verification when branching to a secure code in another domain, guaranteeing the function execution entrance. In the second stage, the processor’s DSR is verified using DTI instruction. The DTI instruction encodes the trust set as an immediate value. If the processor’s DSR is within the DTI’s trust set, access is allowed. As a result, each task in secure code can specify which domains can access it based on the functionality.DEMIX supports distinct load/store instructions to enable intra-domain isolation for data segments within a domain, including normal and secure load/store instructions. Each data memory segment can specify the type of load/store instruction needed to access its data using the protection level. The processor must access each data segment with the appropriate load/store instruction. Note that the normal load/store instructions are designated for general access, whereas the secure load/store instructions are designated for secure access. Differentiating secure access to data segments can mitigate the risk of malicious or erroneous code accessing sensitive data within a domain. For example, in the case of a shadow stack, the processor should only allow access to that memory from valid locations in the code. Secure load/store instructions can restrict the scope of these access regions on an instruction level, thereby enhancing security.DEMIX to implement intra-domain isolation and assign varying permissions to resources within a single domain. Furthermore, as permissions are bonded to instructions, DEMIX eliminates the additional MPU configuration, such as entity tables, which were required in previous research. Instead, DEMIX distributes these permissions within the code, offering more efficiency in securing multiple domains with fewer entities.Instruction-level domain isolation technology offers a more fine-grained approach to access control for code and data, allowing DEMIX is based on the domain policy, which assigns an access protection strategy to each memory segment. The policy ensures that access to memory segments is only granted to authorized domains and provides a more elevated level of security in the system. The protection strategy is mainly differentiated by whether a memory segment is code or data and whether its protection level is normal or secure. The protection level supports granting access to highly distributed memory regions through instruction-level domain isolation techniques, which enables the creation of fine-grained, highly distributed permissions within the instruction unit. DEMIX. As shown, each segment in the DEMIX’s address space can be shared among different domains through trust configuration or have extra privileges granted through intra-domain isolation at the instruction level. This section provides more information on the memory protection functionality of each segment under these configurations.The protection strategy in The Normal Code Segment (NCS) is designated with a normal protection level for executable code, providing a basic level of protection through inter-domain isolation. This segment protects against executing internal functions in untrusted domains using the domain policy’s trust entry. If accessed from an untrusted domain, an exception is raised.The Secure Code Segment (SCS) is designated with a secure protection level for executable code, providing both inter-domain and intra-domain isolation. Access to the SCS, even for trusted domains, is limited to specific addresses through the DTI instruction. At the same time, the DTI instruction encodes the trusted domain which can execute, so access to that location depends on the processor’s current execution domain. This enables the SCS to define decentralized entry points for each domain within a single segment, addressing a limitation of traditional memory isolation techniques that struggle to define highly distributed regions.The Normal Data Segment (NDS) is specified with a normal protection level for data. This segment provides instruction-level isolation where only normal load/store is accessible but categorized it as providing only inter-domain isolation based on the general purpose usage of those instructions. Access to this segment is allowed when the processor executes the trusted domain’s normal load/store instructions. An exception is raised if the processor executes either within the untrusted domain or the secure load/store instructions.The Secure Data Segment (SDS) is designated with a secure protection level for data and is intended for specialized purposes within the domain. Access to the SDS is only allowed through secure load/store instructions. Attempts to access the SDS using normal load/store instructions or from an untrusted domain will raise an exception. The use of secure instructions, as opposed to normal instructions used for general purposes, allows for the distribution of accessible memory regions for the SDS throughout the code at the instruction level, resulting in finer control over access to sensitive information and improved security.DEMIX, as proposed, supports multiple domains, each isolated at the unprivileged level. During execution, the processor applies the appropriate protection and occupancy process based on the code’s ownership. The DPU uses this ownership to activate memory segments to provide a legitimate address space. This mechanism does not only isolate sensitive memory within a domain but also enables efficient domain switching.In memory protection, a domain is a logical division of memory space with assigned separate access regions and authority for each partition. Each partition acts as a unit to protect the system’s memory by organizing a specific set of memory regions that the processor can access. DEMIX provides this protection and sharing of memory segments owned by each part through Domain-Enforced Memory Isolation technology. Domain1.To ensure the security and privacy of each domain, it is necessary to implement domain protection by restricting access to sensitive data and functions to authorized domains only. Domain1, the processor must validate the current domain state with the DPU. The DPU only allows access to segments that it trusts based on the current domain state of the processor. In the figure, Region A is accessible when the processor is in Domain2 and Domain3, but Region B only allows access to Domain3. Additionally, Region A is a secure segment , a code segment of DEMIX that is protected by intra-domain isolation. The non-owner domain must perform DTI verification when accessing this segment. Therefore, in the figure, the function foo in Region A can be called from Domain2 and Domain3, but the function bar is only accessible from Domain3. In other words, function foo is public to Domain2 and Domain3, whereas function bar is protected and can only be accessed by Domain3.To access the code in Domain1, and the processor can access Regions C and D accordingly. Both regions are data segments that only Domain1 trusts. As a result, Regions C and D are inaccessible to other domains and can only access them after legitimate cross-domain function calls to Domain1. This ensures that data within a domain is protected from unauthorized access and manipulation. On the other hand, Region E is owned by Domain2 and has trusts both Domain1 and Domain2. As a result, when switching from Domain2 to Domain1, it remains accessible. This illustrates how Domain-Enforced Memory Isolation allows for the controlled sharing of data between trusted domains while restricting access to unauthorized domains.If the cross-domain function call is validated, the domain state is set to Domain1’s sensitive data is only accessible from specific locations while preventing any possibility of Domain1’s sensitive data being leaked to other domains’ shared segments, such as Region E.Finally, Regions C and D are configured with different protection levels: secure  and normal . The processor can only access each part through the dedicated load/store instruction. This ensures that DEMIX can instantly reconfigure the accessible memory region for that domain without negatively impacting the system’s performance. When accessing a task in the NCS region, the processor changes the DSR during the instruction fetch. As a result, there is no overhead compared to a typical call instruction. DEMIX also provides a DTI instruction specifying accessible domains while ensuring task entrance. It further restricts cross-domain access to authorized task entries within the NCS. In this region, if the validation of the cross-function call is successful, the processor will update the DSR with the ownership and apply the new address space. This operation incurs an overhead of only one cycle. These overheads are more efficient than previous studies that aim to guarantee cross-domain function call entry and regulate accessible memory regions.To execute a specific task in a trusted domain, the processor must change the accessible memory region for that domain before running that task. This process is known as domain switching and it is designed to be highly efficient with minimal overhead. By updating the DSR provided by the processor, DEMIX technology using the RISC-V Ibex processor. In this section, we describe the hardware implementation of applying DEMIX technology on the RISC-V processor.To verify and measure the hardware overhead of our technique, we first develop a prototype that supports DEMIX. To implement the memory protection mechanism of DEMIX, we have extended the Configuration and Status Register (CSR) by adding the dpucfg to provide domain policy to the PMP Entity. The dpucfg includes the domain policy of ownership, trust, and protection level for each memory segment defined within the RISC-V architecture. The ownership of a domain can be represented through binary encoding, whereas the protection level can be fixed to a single bit per entry. The trusted domains are defined through bit encoding for each domain ownership, with the number of bits required equal to the number of domain ownership supported by the processor. For example, supporting 4 domains requires 7 extra bits of register per entry, whereas 21 additional bits are required for 16. Larger cases are not considered as they exceed the maximum number of entries supported by the RISC-V PMP.As described in 0x03 permits access to the memory addresses when the domain state is 0 and 1. In contrast, the DTI instruction with an immediate value of 0x02 grants access only when the domain state is 1. The extended DTI instruction prototype in our implementation supports a maximum of 16 domain states, which aligns with the maximum number of PMP entries in the RISC-V architecture. The secure load/store instructions provide access to data regions with secure protection levels, and they are designed to ensure that authorized locations can only access sensitive data. These instructions are replicated from the load/store instructions in RISC-V but with a different encoding location in the ISA. If the load/store is executed at the replicated encoding, the DPU allows access to the secure data segment. For example, the lw in the original RISC-V architecture is an instruction to load word data from the normal data segment (NDS) into a register file. In contrast, the seclw instruction is the corresponding secure load/store instruction that loads word data from the secure segment  into a register file.We have enhanced the RISC-V instruction set architecture (ISA) by extending dedicated instructions for memory access. Using the custom instruction encoding capabilities of the RISC-V ISA, we have implemented DTI instructions to enforce cross-domain function call entry and Secure Load/Store instructions to restrict access to secure data. The DTI instruction restricts memory access during cross-domain function calls from a shared domain. The instruction encodes the accessible domain state as an immediate value using bit encoding, determined at compile time. Separate permissions can be configured for different domain ownership, allowing for fine-grained control over memory access. For example, the DTI instruction with an immediate value of MRET instruction, the DSR value is copied to the PDSR. Furthermore, if there is a change from user to machine privilege due to the ECALL or Interrupt, the DSR value is stored in the PDSR.DSR is located in the processor’s instruction fetch pipeline. During instruction fetch, the processor manages the DSR according to the domain policy of the loaded instruction. When the code’s domain ownership and DSR differ, the processor performs domain validation. If the verification is successful, the DSR will change to the newly loaded ownership. For DTI validation, validated instructions are masked as NOP and passed to the processor pipeline to avoid performing unnecessary actions. Additionally, the Domain State is a value that changes according to the domain policy in the user privilege level, but a direct modification must be prohibited. At the same time, it must be returned after performing other code, such as Interrupt Handler. To support this, we extend PDSR in the CSR. When the privilege level is changed from the machine to the user due to the rv32imbc. The Ibex Core was chosen because it is a very lightweight RISC-V processor, which makes the hardware overhead of extending DEMIX more visible. To accurately measure the overhead caused by the DEMIX extension, additional features such as cache and branch prediction were disabled. We tested designs that support 4, 8, and 16 user-domain partitions on the Ibex Core with 16 physical memory protection regions. Although 16 user domains may be excessive for typical use cases, they were included in our tests to measure the hardware cost of the DEMIX solution. For testing, we implemented our technique on a Xilinx Artix-7 35T FPGA, with the hardware cost results for our configuration as shown in The RISC-V Ibex Core was selected for our prototype implementation, with the processor configuration set to DEMIX and measured the results accordingly. Despite these constraints, the maximum measured overhead is below 14%, and partitions for 4 to 8 user domains can be implemented with less than 8% overhead.As shown in ecall instruction and then performing a domain switching via privilege software. To compare domain-switching overhead, we developed privileged software that performs the function of DEMIX. The software was developed as an elementary function that verifies the legitimacy of the old domain, changes the PMP configuration to limit the memory area the new domain can access, and then switches to that function. Even excluding other user-trap functions, it took 76 cycles to perform a domain switch. Part B of the figure illustrates the overhead of switching domain supported by DEMIX. DEMIX supports immediate address space conversion through Domain-Enforced Memory Isolation while supporting domain verification through DTI instructions. DEMIX supports immediate address space conversion through Domain-Enforced Memory Isolation while supporting verification through DTI instructions. As a result, domain switching using existing privilege software can be performed in a single instruction. The software overhead may vary depending on the features supported, but using DTI instructions incurs only one cycle of overhead compared to the 76 cycles of overhead developed for comparison.fbctl function in the BEEPS Benchmark takes 8893 cycles when executed via privilege-based domain switching but 8710 cycles when using DEMIX. However, for functions with short internal execution, such as crc32, the reduced overhead using DEMIX is significant at 98 cycles compared to 287 cycles when executed via privilege-based domain switching. Note that due to the separation of the timer domain and the benchmark execution domain, a round-trip switching overhead is added. DEMIX reduces the overhead of switching domains by minimizing the process, which is particularly advantageous when the amount of executed code is small after switching. The The comparison of overhead for several related techniques is presented in DEMIX incorporates Domain-Enforced Memory Isolation and instruction-level memory isolation techniques that facilitate efficient domain definition and switching across multiple domains. As a result, DEMIX can switch domains in 0 to 1 cycle, compared to the 120 to 160 cycle overhead of Multizone [DEMIX can scale for a larger number of domains. The 16 MPU entities can utilize software-defined domain policies to partition unprivileged domains. Simultaneously, by supporting domain-specific permissions and entrance positioning at the instruction level, DEMIX eliminates the need for a separate MPU entity and additional indirect jump, as required in the entities table approach [DEMIX can support more domains without sacrificing performance. In conclusion, our approach to memory isolation by domain provides a novel solution for enabling the efficient and secure execution of multiple domains on a single processor in embedded systems. It enables efficient domain definition and switching across a larger number of domains using a limited number of MPU entities. This scalability is achieved without compromising performance, making our approach well-suited for embedded environments that require a real-time response or where domain switching frequently occurs.To overcome this limitation, ultizone , which rultizone , DEMIX capproach ,21. ThisIn this section, we discuss the assessment of our approach and elaborate on its comparison with existing techniques.Flexible domain configuration: DEMIX provides flexible domain configuration by implementing the policy on the Domain Protection Unit (DPU). The domain policy is protected by a privilege level and can be configured through software. This allows the system to reconfigure the domain through a domain handler protected by the privilege level, providing the flexibility to adapt the domain configuration to the system’s requirements.Unprivileged domain isolation: DEMIX provides unprivileged domain isolation by implementing inter-domain isolation technology. This technique is implemented through domain states and policies that assign a list of accessible domain states to each memory segment. This allows the accessible segments to be adjusted by changing the domain state, providing unprivileged partition by domain state.Multiple domain partition: DEMIX supports multiple domain partitioning by using domain states as identifiers to restrict memory access for each segment. The number of domains supported by DEMIX is statically limited by hardware support, but it still provides more user domains than existing technologies. This solution is reasonably suited for lightweight embedded systems that typically have a limited number of memory configuration entities. The intra-domain isolation technology in DEMIX enables fine-tuned access control for memory segments, allowing for the efficient representation of multiple domains with limited resources.Lightweight domain switching: DEMIX enables lightweight domain switching by eliminating the need for a secure monitor or privilege mode during cross-domain function calls. Instead of relying on a secure monitor, it controls the domain state of the processor through predefined code ownership, resulting in a lightweight and streamlined switching process. As a result, DEMIX enables more rapid responsiveness in embedded systems compared to traditional approaches. Additionally, it requires at most one cycle overhead compared to a typical function call, so it can adapt to more granular domain partitions with frequent switching.Task-specific authorization: DEMIX implements task-specific authorization by providing fine-grained access control at the instruction level. This is achieved through the use of DTI instructions, which restrict access to each unit task in a code segment to only trusted domains. This approach allows highly distributed entry points to be defined for each domain within a single memory segment, resulting in more granular access control to sensitive functions. Compared to traditional techniques that use entity tables or secure monitors, DEMIX’s approach supports multiple domains with fewer memory configuration entities and reduced switching overhead.Secure data protection: DEMIX provides secure data protection through secure data segments (SDS) and secure load/store instructions. The secure load/store instructions provide access to the SDS and are designed to ensure that only authorized locations can access sensitive data. This feature allows fine-tuning access to sensitive data that needs to be separated and protected, providing an additional layer of security within a single domain.DEMIX is a novel memory protection technology that provides a more flexible and efficient solution for protecting sensitive data than existing technologies. It provides fine-grained access control over the embedded system, defining distinct access privileges based on functionality and sensitivity. This ensures that only authorized domains can access sensitive code and data, reducing the risk of security threats and improving overall system performance. DEMIX and existing techniques, with Memory Protection Key (MPK) excluded from the comparison as it is outside the scope of the lightweight embedded system. Nevertheless, it is noteworthy that the Domain-Enforced Memory Isolation technique provided by DEMIX can be considered a simplified version of MPK, merging the access permission settings for each virtual page in MPK to a specific code segment, whereas DEMIX does not provide the scalability of MPK, which allows access rights to be modified for each page in user space software, it eliminates the security vulnerabilities associated with this capability. Given that our implementation targets lightweight embedded systems, this trade-off is acceptable, as it provides a secure solution within the constraints of these systems.DEMIX’s intra-domain isolation offers an advantage over existing techniques by providing fine-grained access control at the instruction level. This allows highly distributed entry points to be defined for each domain within a single memory segment, resulting in more granular access control to sensitive functions. This approach supports multiple domains with fewer configuration entities and reduced switching overhead compared to traditional techniques using entity tables or secure monitors. In addition, the secure data protection provided by DEMIX’s secure data segments and secure load/store instructions give an additional layer of security within a single domain, ensuring that only authorized locations can access sensitive data.DEMIX from our original version , we provide the discussion as follows. In RIMI [DEMIX is built upon the idea of instruction-level authorization, but now provides a more generalized definition of the domain, whereas we borrow some concepts from RIMI , most of the work is new. In essence, we introduce a Domain-Enforced Memory Isolation technique that efficiently manages and defines multiple domains. This technique provides a user-level partitioning of multiple domains on an embedded processor without requiring privilege-level intervention. Each domain is configured to efficiently serve its address space by functioning as the new identifier, whereas the instruction-level isolation technology from RIMI strengthens the security of each domain —thus allowing for additional layers of data —enhanced features like configuring permissions within a domain or per task are not present in RIMI. Lastly, DEMIX was developed and evaluated on an FPGA instead of only on an emulator. As a result, we not only achieve user-level partitioning of multiple domains on an embedded processor but also fine-grained access control within a domain compared to our previous version, which is of significant advantage.Lastly, to clarify the difference between  In RIMI , we alsoDEMIX is the static limited number of domains it can support due to hardware constraints. In particular, the number of partitions supported by DTI instructions is limited because of bit width constraints. In addition, although our proposed technique is efficient for static domain configuration in a lightweight environment, it is unsuitable for dynamic domain adaptation. Domains in our proposal are statically specified at compile time, which is practical for splitting a single domain into subdomains to increase security or provide fixed multi-domain isolation. However, merging subdomains dynamically or changing domain ownership is difficult, which limits the to adapt dynamic environments.This paper presented a novel methodology for supporting multiple domains in lightweight embedded processors, and we have applied it to RISC-V processors. We provide an efficient solution for multi-domain isolation in these environments. However, although we offer significant advantages for these applications, it has several limitations when applied to more general-purpose systems. One of the primary limitations of DEMIX solution by deploying a trusted execution environment and evaluating its effectiveness in providing security solutions and protection against cyber-attacks. In addition, we will find methods for dynamically merging domains or changing domain ownership. It would make the solution more flexible for dynamic conditions, allowing it to adjust to changing requirements and provide more comprehensive protection against security threats.In the future, we aim to further demonstrate the practicality of the DEMIX, a novel memory isolation technique suitable for lightweight embedded systems, driven by the motivation to provide a security solution to guard against their vulnerability to malicious software. Our proposal offers a flexible configuration for multiple domains and efficient domain switching through two elements: Domain-Enforced Memory Isolation and instruction-level domain isolation, which thoroughly validates a domain’s access to sensitive tasks and provides secure access to sensitive data. This combination of flexible domain configuration and secure protection makes our solution well-suited for delivering isolated peripheral control software with secure call gates, thus offering security for the increasing protection needs of lightweight embedded systems. To evaluate the performance of our technique, we implemented our prototype on a RISC-V Ibex system, evaluating the effectiveness and overhead of our proposed solution. Our software evaluations have demonstrated that the overhead of switching to smaller code execution is negligible. Given that the code size for controlling sensors inside the SoC or external I/O in an IoT environment is very small, our technique can be safely decoupled for each peripheral without any additional overhead. As verified on the FPGA system, the overhead shows that our solution can be adaptable to the lightweight embedded system by only taking 8% of hardware overhead on an eight-user domain implementation in Ibex Core, a lightweight RISC-V processor.In this paper, we presented


One of the effective treatment options for intracranial aneurysms is stent-assisted coiling. Though, previous works have demonstrated that stent usage would result in the deformation of the local vasculature. The effect of simple stent on the blood hemodynamics is still uncertain. In this work, hemodynamic features of the blood stream on four different ICA aneurysm with/without interventional are investigated. To estimate the relative impacts of vessel deformation, four distinctive ICA aneurysm is simulated by the one-way FSI technique. Four hemodynamic factors of aneurysm blood velocity, wall pressure and WSS are compared in the peak systolic stage to disclose the impact of defamation by the stent in two conditions. The stent usage would decrease almost all of the mentioned parameters, except for OSI. Stenting reduces neck inflow rate, while the effect of interventional was not consistent among the aneurysms. The deformation of an aneurysm has a strong influence on the hemodynamics of an aneurysm. This outcome is ignored by most of the preceding investigations, which focused on the pre-interventional state for studying the relationship between hemodynamics and stents. Present results show that the application of stent without coiling would improve most hemodynamic factors, especially when the deformation of the aneurysm is high enough. The effects of hemodynamic forces on the wall of the intracranial artery may result in a pathological stretching of the vessel wall, and a deformed vessel is known as an Intracranial Aneurysm (IA). The development of IA is relevant to many pathophysiological factors, not only the hemodynamic ones, e.g., endothelial function, anatomic variations (certain areas in the Circle of Willis) are more vulnerable Liu . The maiThe primary hemodynamic factors of Oscillatory shear index (OSI), Wall shear stress (WSS) and Relative residence time (RRT) are introduced for the comparison of the different ICA aneurysms  and computed tomography angiography (CIA). In fact, these techniques enable researchers to access the main geometrical aspects of the aneurysm and use them for further investigations  is used to model of blood flow inside the aneurysm and calculating shear stress on the aneurysm wall. Comparisons of blood velocity and stream are also presented to reveal the influence of aneurysm deformation on the blood and its impact on the wall of the vessel.After evaluating of more than 30 ICA aneurysms, the geometries (.stl file) of four distinctive aneurysms are chosen from the Aneurisk website , this study reports WSS and average pressure on the vessel and mean velocity inside the sac for this stage. Meanwhile, the OSI value is calculated at the end of the third cardiac cycle (3000 steps) .As explained in the previous sections, the main attitude of the present work is to investigate the role of the stent on the hemodynamics of the blood stream inside the aneurysm. In the current study, the two stages of interventions are assumed based on the neck vessel angle mentioned in Table The impacts of aneurysm deformation on the main hemodynamic factors of mean WSS, OSI, pressure and velocity are demonstrated in Table Figure Comparison of OSI contour for original and deformed aneurysms are displayed in Fig. Figure In this study, the impacts of the stent on the flow structure of the four ICA aneurysms are comprehensively investigated. The primary attention of this research is to visualize blood flow and compared hemodynamic characteristics of ICA aneurysms before and after aneurysm deformation. Computational Fluid dynamic is applied to simulate the blood stream inside the aneurysm and calculate hemodynamic factors, i.e. WSS, pressure and OSI on the aneurysm wall. The stent effect on two-stages of deformation is disclosed and explained in this work. Attained results indicate that deformation of the aneurysm considerably decreases the WSS on the aneurysm wall due to limited blood entrance. However, the value of OSI does not change in deformed aneurysms. Pressure contour on the aneurysm wall also indicates that the value of this factor does not alter considerably while its location varies by deformation.


Magnaporthe oryzae and that have evolved multiple allelic variants, including Pikp-1/Pikp-2 and Pikm-1/Pikm-2. Some sensor NLRs contain noncanonical integrated domains that serve as effector baits to sense effector proteins. Pik-1 belongs to this category with its integrated heavy metal–associated (HMA) domain that recognizes AVR-Pik. Engineering of integrated domains like HMA can expand effector recognition specificity of the corresponding NLRs  proteins. Plant NLRs recognize pathogen virulence proteins called effectors that initiate downstream immune responses, including programmed cell death for preventing pathogen spread or growth. NLRs can work as pairs, with one acting as a sensor for perception of effectors and the other as a helper for transducing immune signaling . This ising NLRs . Howevering NLRs , which pAdam R. Bentham, Juan Carlos De la Concepcion, and colleagues  reveal the mechanistic basis for the incompatibility between Pik-1 and Pik-2 variants and demonstrate the potential of Pikp-2 as a facilitator for engineering new effector recognition specificities.In this issue, ΔHMA variant. Like Pikp-1, Pikp-1ΔHMA coexpressed with Pikm-2 exhibited constitutive cell death, whereas no cell death was observed when coexpressing with Pikp-2  interface in the RGA5 HMA domain responsible for AVR-Pia binding. Co-immunoprecipitation and multicycle or single-cycle kinetics (measured by Surface Plasmon Resonance) assays revealed high binding affinity of 3 AVR-Pik variants and weak binding affinity of AVR-Pia for the APB mutant. Consistently, Pikm-1APB coexpressed with Pikp-2 triggered cell death when challenged with AVR-Pik variants, whereas only a weak cell death response was observed when challenged with AVR-Pia. These data demonstrated that the HMA domain of Pikm-1 is amenable to engineering for expanding effector recognition specificities when pairing with Pikp-2.These results prompted the authors to test whether Pikp-2 allows for integration of an HMA domain that would normally result in auto activity. They replaced the HMA domain of Pikm-1 with that from the unrelated sensor RGA5 and termed the chimeric protein Pikm-1Finally, the authors tested the utility of this Pik system in wider aspects of NLR engineering. It was recently shown that a Pik-1-nanobody (single-domain antibody fragment) integrated with nanobodies with affinity for fluorescence proteins can recognize fluorescence proteins when coexpressed with Pik-2 , which oM. oryzae in rice.In summary, this study reveals a new strategy for NLR engineering and advances our understanding of immune signaling. Integration of new effector recognition motifs tailored to specific effector proteins into the Pik system provides a promising approach for engineering precise and efficient disease resistance. In future work, it will be important to test whether this system can provide the desired increase in resistance against


Reversible and programmable shaping of surfaces promises wide-ranging applications in tunable optics and acoustic metasurfaces. Based on acoustic radiation pressure, contactless and real-time deformation of fluid interface can be achieved. This paper presents an experimental and numerical study to characterize the spatiotemporal properties of the deformation induced by acoustic radiation pressure. Using localized ultrasonic excitation, we report the possibility of on-demand tailoring of the induced protrusion at water–air interface in space and time, depending on the shape of the input pressure field. The experimental method used to measure the deformation of the water surface in space and time shows close agreement with simulations. We demonstrate that acoustic radiation pressure allows shaping protrusion at fluid interfaces, which could be changed into a various set of spatiotemporal distributions, considering simple parameters of the ultrasonic excitation. This paves the way for novel approach to design programmable space and time-dependent gratings at fluid interfaces. In the aim of designing a reversible and programmable patterning process, several strategies have been explored using an external energy such as mechanical static energy8, thermal expansion9, microfluidics11, chemical13 or electrical tuning14. Among them, the use of fluids reveals to be particularly suitable to achieve dynamically tunable devices19. Recent advances carried out by Melde et al., showed the possibility of assembling particles at the water surface into a variety of 2D shapes using acoustic holograms and radiation pressure20. However, most of these concepts suffer from the use of discrete lattice structure to approximate smooth surfaces, or are constrained by mechanical actuators, resulting in a non-real-time of surface shaping and limiting the range of applications in a time-varying environment.Contactless deformation of surfaces is a topic of growing interest in the field of tunable optic and acoustic metasurfaces25, a promising approach is to remotely control the shape of plane fluid interfaces into 3D out of plane deformation, using acoustic radiation pressure (ARP). ARP has attracted numerous research in past years29 due to the variety of applications in biomedical33, for non-contact surface tension measurement36, or to realize functions including acoustic tweezer37, enhanced electrospinning38 and acoustic diode16. Recent study has highlighted the possibility of controlling the height of the interface deformation induced by the ARP as a function of the transient excitation parameters39. Nevertheless, determining the spatiotemporal displacement of an interface exposed to ARP remains challenging due to strong hypothesis set by the analytical model. Numerical works have been carried out to tackle these limitations and have conducted to better understanding of the dynamic of the protrusion induced by ARP40. However, to our knowledge, no studies have been carried out on the characteristics of the 3D surface deformation in space and time.Among the extensive work on non-contact deformation of soft interfacesThe present study investigates both spatial and temporal characteristics of the surface deformation induced by a transient ARP, as a function of the spatiotemporal characteristics of the incident pressure field. It provides new insights for novel application of the ARP for on-demand deformation of fluid interfaces.Based on theoretical formulation of the ARP induced by a transient ultrasonic excitation, we model the induced surface displacement using Finite Element Method (FEM). Measurements using a polychromatic confocal displacement sensor are performed to measure the time evolution of the interface displacement induced by the transient ARP. The global shape of the deformation is investigated performing a scan over the surface. Several spatiotemporal distributions of the incident pressure field are investigated.41:a space, g the gravity, In a homogeneous medium, considering an acoustic radiation pressure exerted on an interface, as well as an isentropic change of state, the Lagrangian form of the equation of motion is given by42:42.Given the space laterally unconfined, it is assumed that the Lagrangian pressure mentclass2pt{minim44. Camera based devices are exposed to several limitations, such as their field of view, which prevents access to the negative amplitudes of the surface displacement and to the 3D shape of the interface deformation. Also, the lighting condition and the tilt imposed to the camera reduces the accuracy of the measurements39. Other experimental strategies have been explored, such as the use of a laser probe47.Experimentally, the main challenge lies in measuring the entirety of the displacement of an optically transparent interface such as air–water. Classic experiments to observe the surface displacement induced by ARP are based on the use of a High-Speed Camera49 (see Methods). A white light is transmitted from the controller to the sensor head through an optical fiber. The light is then focused by a chromatic dispersive lens in the displacement probe, at different focal lengths depending on the wavelength. The position of the interface is determined by the analysis of the spectrum of the light backscattered by the surface to the spectrometer in the probe controller. More specifications about the chromatic confocal displacement sensor are given in Supplementary Table These methods are still restricted to study the time evolution of the interface deformation characterization on a few places. In the present work, tracking the surface displacement of a transparent interface has been possible through the use of a polychromatic confocal sensorz- direction. The aim is to demonstrate that different pressure fields can determine dynamics of a liquid surface under the effect of ARP. Transducers were selected to generate specific deformation for different spatiotemporal shaping and applications.The experimental setup used in this work is described in Fig. entclass1pt{minimaThe influence of the incident transient excitation parameters on the shape of the deformation is investigated experimentally and numerically. The model allows focusing on both spatial and temporal evolution of the deformation considering the formulation of the input excitation. Three different time steps can be distinguished as shown on the pictures taken with a Nikon D5600 camera Fig. a–c: riset = 8 ms, both experiments and simulations exhibit a deformation height of 0.13 mm and a deformation width of 4 mm radius for a 2.1 MPa incident pressure at r = 0. It highlights that for a water–air interface, modelling the surface displacement in space and time caused by an incident ultrasonic beam can be accurately performed using Eq.  induced by the ARP is presented in Fig. ) is the same as the pressure field distribution as highlighted in Fig. ), followed by a further widening during the decrease (6 mm at -6 dB for t = 16 ms). Finally, deformation splits into a quasi-axisymmetric circular capillary wave, centred around  as denoted by the 2D representation (black solid line) on Fig. For the spherical transducer, it can be observed that the shape of the deformation during the rise  of diameter 40 mm are used successively: a spherical one focusing at 40 mm, and a planar one with a Rayleigh distance at 120 mm. More specifications on the transducers are given in Supplementary Table The Finite Element Analysis is performed using the Comsol Multiphysics software. The module “Laminar Two-Phase Flow, Moving Mesh” is used to solve the Navier–Stokes equation for incompressible flow. This method enables to study the time evolution of the displacement of the interface between two fluids. The model consists in a 2D geometry and is bounded by two types of boundaries. The top boundary is modelled with a free surface condition, including the surface tension between the two fluid σ and two no-slip wall boundaries specifies the stationary solid walls on the bottom and right sides of the fluid domain. The geometry of the sample is large enough so the surface waves resulting from the interface deformation do not interfere with the walls during the simulation time (150 µs), with the left and right-sided wall located at ± 50 mm from the centre of the domain, and the bottom at a depth of 5 mm. The gravity is considered as a force directed downward (with ers Fig. c,d.Supplementary Tables.Supplementary Video 1a.Supplementary Video 1b.Supplementary Video 2.