XCOM–Shenzhen Cyber-Physical Security Joint Lab · 深圳信息物理安全联合实验室

Hardware that can be ordered, not merely claimed

Every R&D claim in §6 maps to a purchasable line in the equipment annex, and every line maps back to a claim. Total ¥4,800,000 (¥1.5M municipal + ¥3.3M self-raised), 12 line items, 116 units, composite Shenzhen/CN content ≈78% against a ≥70% commitment.

¥540,000一 · SDR & RF testbeds
¥1,000,000二 · fault injection & anti-tamper
¥200,000三 · G3-PLC powerline
¥2,160,000四 · compute & network capture
¥900,000五 · lab infrastructure

The frontier programme this buys

Layer Capability Instruments behind it
Packet layer eBPF/XDP AI takeover: silent C2 drop or synthetic-response injection at nanosecond scale (§6.2) 100 Gbps hardware TAPs ×2, datacenter switches — 100% CN
RF spectrum Phantom BLE/Wi-Fi populations, GPS/PTP spoofing detection (§5.4) USRP N320 ×2, HackRF/BladeRF ×30 (90% SZ), 3m anechoic chamber 100% SZ
Powerline G3-PLC covert mesh inside RF-jammed premises (§6.5) 50× QCA7000/HiSilicon coupling kits — 95% SZ/CN
Silicon Voltage fault-injection self-audit; thermal zeroization on sacrificial nodes (§6.3–6.4) ChipWhisperer-Husky ×3, 8 GHz Infiniium scopes ×2, thermal chamber (−40–150 °C) 100% CN
Compute 42-server MCP mesh, local Qwen/DeepSeek inference (§4.2, §4.5) 4× dual A6000 MCP nodes (80% CN/SZ), 4× ClickHouse NVMe nodes, 15 R&D workstations

Why exactly these instruments

Strategic value for the review committee

By explicitly detailing the Keysight Infiniium scopes and the ChipWhisperer-Husky platforms, XCOM proves it understands the deep physics of hardware security: nanosecond voltage droop, EM side-channel leakage, secure-boot trust anchors, thermal limits of silicon.

By explicitly calling out the QCA7000 PLC modules and the 100G TAPs, XCOM demonstrates that its powerline and XDP claims rest on real, orderable engineering parts — not theoretical whitepaper concepts.

Keysight Infiniium UXR · 8 GHz / 25 GS/sNodig om een glitch te kúnnen zién: sub-nanoseconde droop is de eenheid waarin secure-boot-bypass wordt gemeten. No 8 GHz front end, no credible fault-injection claim.
ChipWhisperer-Husky + ProThe instrumented ground truth behind the §6.3 self-audit — the same class of tool used to publish hardware attacks, pointed at our own silicon.
QCA7000 G3-PLC modulesTurns §6.5 from a diagram into an orderable part: a mains-borne, RF-independent channel, testable at 50-node scale.
100 Gbps hardware TAPLossless mirroring is the precondition for proving a nanosecond-scale decision actually saw every packet (§6.2).

Compliance frame

Procurement methods (annex D.2): general equipment (<¥300k) via 询价采购 three-quotation; specialised imported instruments (8 GHz scope, USRP) via 进口产品审批 import approval then single-source/competitive negotiation; custom builds (chamber, fixtures) via 竞争性磋商 with qualified Shenzhen integrators.

Asset management (annex D.3): all municipal-funded equipment enters the fixed-asset ledger with “深圳市科技创新委员会资助项目” labels; no disposal, transfer or diversion without the competent authority's approval during the project period.

Local-content commitment (annex D.1): chamber, thermal chamber, PLC modules, switches and lab wiring are 100% Shenzhen-local/domestic; compute and storage nodes are assembled and liquid-cooling-integrated in Shenzhen; composite ≈78% vs the ≥70% annex commitment.