An Instruction-Based Secure Coprocessor Architecture for Cross-Layer Trust Closure

WANG Junhui; PENG Yijing; LIU Jiahong; WANG Yaohua

doi:10.11999/JEIT260619

Article Contents

Article Navigation > Journal of Electronics & Information Technology > 2026 >

WANG Junhui, PENG Yijing, LIU Jiahong, WANG Yaohua. An Instruction-Based Secure Coprocessor Architecture for Cross-Layer Trust Closure[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260619

Citation:

WANG Junhui, PENG Yijing, LIU Jiahong, WANG Yaohua. An Instruction-Based Secure Coprocessor Architecture for Cross-Layer Trust Closure[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260619

Citation:

PDF( 1996 KB)

An Instruction-Based Secure Coprocessor Architecture for Cross-Layer Trust Closure

doi: 10.11999/JEIT260619 cstr: 32379.14.JEIT260619

1.
College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China
2.
Key Laboratory of Advanced Microprocessor Chips and Systems(NUDT), Ministry of Education, Changsha 410073, China

Received Date: 2026-05-15
Accepted Date: 2026-10-16
Rev Recd Date: 2026-09-28

Available Online: 2026-10-25

Abstract

Abstract

Objective With the rapid development of the Internet of Things, massive terminal devices deployed in physically open environments are highly vulnerable to physical probing, side-channel attacks, and bus sniffing. Current IoT security solutions exhibit significant limitations: software-based protocol implementations suffer from severe performance bottlenecks and lack physical protection, while dedicated hardware accelerators based on Finite State Machine (FSM) configurations experience state explosion, poor scalability, coarse control granularity, and the critical risk of sensitive data exposure on unprotected buses due to frequent data movement. Therefore, it is of great necessity and importance to construct an efficient, lightweight, and security-analyzable hardware protection system that supports fine-grained operator orchestration and cross-layer trust closure for resource-constrained IoT devices. Methods To address the aforementioned issues, an Instruction-Based Secure Coprocessor Architecture for Cross-Layer Trust Closure (IBSCA) is proposed. The architecture abandons the traditional FSM hard-wired control mode and introduces a Reduced Instruction Set Computer concept to construct a processor-like “Decode-Dispatch-Execute” pipeline. A dedicated 32-bit reduced instruction set architecture is defined, where all instructions are divided into five functional fields: Control Bits, Functional Unit Selection, Operand Addresses, Destination Address, and Reserved Bits. The Control Bits explicitly define data flow direction and operational attributes, where the source selection bit and result write-back bit are key to realizing the “data residency” security policy. The hardware microarchitecture consists of four core modules: Interface, Control Logic, Functional Unit, and Memory. The Interface Module serves as the sole communication channel to minimize the attack surface; the Control Logic Module dynamically generates micro-operation control signals; the Functional Unit Module integrates heterogeneous operators like PUF, ECC, and Hash; and the Memory Module guarantees data confidentiality through on-chip data residency. The execution flow comprises three coupled stages: instruction sequence generation, fetch and decode, and instruction execution. The host directly injects instruction streams via the standard bus, abstracting heterogeneous operators into independently addressable atomic operations to decouple control logic from data paths. Furthermore, a PUF-based lightweight WiFi authentication protocol is mapped into the IBSCA to verify the design. Results and Discussions Based on the FPGA platform, the IBSCA secure IP is implemented and evaluated. Functionally, waveform-level simulation verifies that when a PUF instruction is issued, the coprocessor accurately decodes it, activates the PUF module, and writes the response back to the on-chip register, explicitly demonstrating that sensitive data like PUF responses and keys reside and flow entirely within the chip (Fig. 4). End-to-end protocol tests are conducted by mapping the PUF-based WiFi authentication protocol into the IBSCA. The protocol steps are successfully translated into binary instruction sequences, executing continuously to output the correct Response and Session Key (Fig. 5). Performance evaluations indicate that the access latency of IBSCA is 6802 ns, which is 23.95% shorter than the software baseline (8944 ns) and only 12.2% longer than the FSM baseline (6062 ns) (Table 2). The slight latency gap compared to FSM stems from implementation details such as handshake bubbles rather than paradigm flaws. Resource overhead analysis shows that the IBSCA control module consumes only 800 LUTs and 1550 FFs, achieving a significant reduction of 67.8% and 57.8% respectively compared to the FSM control module (2483 LUTs and 3676 FFs), as its general scheduling logic absorbs complexity into instruction encoding rather than explicit state nodes. Furthermore, SAIF-annotated post-route power analysis (100% nets matched, high confidence) shows that, at the timing-verified 100 MHz clock, the total on-chip power of IBSCA is 0.365 W, of which the control module contributes only about 5 mW of dynamic power (4.1% of the total dynamic power). Conclusions An instruction-based secure coprocessor architecture for cross-layer trust closure is proposed to address the limitations of existing IoT security solutions. By introducing a reduced instruction set paradigm and constructing a processor-like pipeline, the architecture successfully decouples control logic from data paths, eliminating the FSM state explosion problem and providing runtime dynamic programming capabilities. The fine-grained orchestration of heterogeneous operators and the on-chip data residency mechanism ensure that sensitive data form a closed loop on-chip, constructing a robust hardware closed-loop trust chain from physical root of trust generation to runtime data encryption protection. FPGA prototype verification and resource analysis confirm that IBSCA achieves a superior balance among protocol extension flexibility, hardware resource overhead, and security performance, providing a flexible, efficient, and reliable hardware security foundation for resource-constrained IoT terminal devices.
- Secure coprocessor,
- Internet of things,
- Instruction-Driven,
- Cross-Layer trust closure

FullText(HTML)

References(40)

References

[1]	DING Suiting, TUKKER A, and WARD H. Opportunities and risks of internet of things (IoT) technologies for circular business models: A literature review[J]. Journal of Environmental Management, 2023, 336: 117662. doi: 10.1016/j.jenvman.2023.117662.
[2]	CHHIKARA D, RANA S, SINGH G, et al. Blockchain-based partial group key agreement protocol for intelligent transportation systems[J]. IEEE Transactions on Vehicular Technology, 2023, 72(12): 16701–16710. doi: 10.1109/TVT.2023.3299705.
[3]	TAHERDOOST H. Security and Internet of Things: Benefits, challenges, and future perspectives[J]. Electronics, 2023, 12(8): 1901. doi: 10.3390/electronics12081901.
[4]	SZYMONIAK S, PIĄTKOWSKI J, and KURKOWSKI M. Defense and security mechanisms in the Internet of Things: A review[J]. Applied Sciences, 2025, 15(2): 499. doi: 10.3390/app15020499.
[5]	王伟, 王伟克, 刘嘉萌, 等. 针对 RISC-V 物联网设备运行时安全的攻击、防御与展望: 综述[J]. 计算机与安全, 2026, 163: 104817. doi: 10.1016/j.cose.2025.104817. WANG Wei, WANG Weike, LIU Jiameng, et al. Attacks, defenses and perspectives for the runtime security of RISC-V IoT devices: A review[J]. Computers & Security, 2026, 163: 104817. doi: 10.1016/j.cose.2025.104817.
[6]	MUSTAFA R, SARKAR N I, MOHAAGHEGH M, et al. A secure and energy-efficient cross-layer framework for internet of things[C]. 2024 International Conference on Information Networking (ICOIN), Ho Chi Minh City, Vietnam, 2024: 661–666. doi: 10.1109/ICOIN59985.2024.10572109.
[7]	MOHAMMED B A, AL-SHAREEDA M A, HOMOD R Z, et al. Taxonomy-based lightweight cryptographic frameworks for secure industrial IoT: A survey[J]. IEEE Internet of Things Journal, 2025, 12(20): 43296–43316. doi: 10.1109/JIOT.2025.3595649.
[8]	SCHILLER E, AIDOO A, FUHRER J, et al. Landscape of IoT security[J]. Computer Science Review, 2022, 44: 100467. doi: 10.1016/j.cosrev.2022.100467.
[9]	MISHRA R and MISHRA A. Current research on Internet of Things (IoT) security protocols: A survey[J]. Computers & Security, 2025, 151: 104310. doi: 10.1016/j.cose.2024.104310.
[10]	DI MATTEO S, BALDANZI L, CROCETTI L, et al. Secure elliptic curve crypto-processor for real-time IoT applications[J]. Energies, 2021, 14(15): 4676. doi: 10.3390/en14154676.
[11]	AKTER S, KHALIL K, and BAYOUMI M. A survey on hardware security: Current trends and challenges[J]. IEEE Access, 2023, 11: 77543–77565. doi: 10.1109/ACCESS.2023.3288696.
[12]	ROJAS-MUÑOZ L F, SÁNCHEZ-SOLANO S, MARTÍNEZ-RODRÍGUEZ M C, et al. On-line evaluation and monitoring of security features of an RO-based PUF/TRNG for IoT devices[J]. Sensors, 2023, 23(8): 4070. doi: 10.3390/s23084070.
[13]	GOŁOFIT K. Security primitives for memoryless IoT devices based on physical unclonable functions and true random number generators[J]. Scientific Reports, 2024, 14(1): 24060. doi: 10.1038/s41598-024-75373-6.
[14]	SCHÖFFEL M, LAUER F, RHEINLÄNDER C C, et al. Secure IoT in the era of quantum computers—Where are the bottlenecks?[J]. Sensors, 2022, 22(7): 2484. doi: 10.3390/s22072484.
[15]	RIZVI S, ORR R, COX A, et al. Identifying the attack surface for IoT network[J]. Internet of Things, 2020, 9: 100162. doi: 10.1016/j.iot.2020.100162.
[16]	NANNIPIERI P, CROCETTI L, DI MATTEO S, et al. Hardware design of an advanced-feature cryptographic tile within the European Processor Initiative[J]. IEEE Transactions on Computers, 2025, 74(3): 762–775. doi: 10.1109/TC.2023.3278536.
[17]	MAACHE A and KALACHE A. Design and implementation of a flexible multi-purpose cryptographic system on low cost FPGA[J]. International Journal of Electrical and Computer Engineering Systems, 2023, 14(1): 45–58. doi: 10.32985/ijeces.14.1.6.
[18]	BACHANNA P, SANKAR P H, TRIPATHI M K, et al. Optimization of re-configurable multi-core processors and security based on field programmable gate arrays[J]. Indonesian Journal of Electrical Engineering and Computer Science, 2024, 33(1): 568–580. doi: 10.11591/ijeecs.v33.i1.pp568-580.
[19]	王杰, 王鹃. 面向RISC-V平台的安全高效固件可信平台模块设计与实现[J]. 电子与信息学报, 2025, 47(7): 2385–2395. doi: 10.11999/JEIT241112. WANG Jie and WANG Juan. The design and implementation of a secure and efficient firmware trusted platform module for RISC-V platforms[J]. Journal of Electronics & Information Technology, 2025, 47(7): 2385–2395. doi: 10.11999/JEIT241112.
[20]	ALSULIEMAN R, HERNANDEZ ESCOBAR E, SWILLEY R, et al. Hardware implementation-based lightweight privacy-preserving authentication scheme for Internet of Drones using physically unclonable function[J]. Sensors, 2026, 26(7): 2224. doi: 10.3390/s26072224.
[21]	NIAZY M, AZMI H, and MAHMOUD M M A. A scalable security co-processor design for IoT applications[J]. Scientific Reports, 2026, 16(1): 19192. doi: 10.1038/s41598-026-58079-9.
[22]	THABIT F, CAN O, ALJAHDALI A O, et al. Cryptography algorithms for enhancing IoT security[J]. Internet of Things, 2023, 22: 100759. doi: 10.1016/j.iot.2023.100759.
[23]	TANVEER M, BADSHAH A, KHAN A U, et al. CMAF-IIoT: Chaotic map-based authentication framework for industrial Internet of Things[J]. Internet of Things, 2023, 23: 100902. doi: 10.1016/j.iot.2023.100902.
[24]	ZUBAYDI H D, VARGA P, and MOLNÁR S. Leveraging blockchain technology for ensuring security and privacy aspects in Internet of Things: A systematic literature review[J]. Sensors, 2023, 23(2): 788. doi: 10.3390/s23020788.
[25]	GUGUEOTH V, SAFAVAT S, SHETTY S, et al. A review of IoT security and privacy using decentralized blockchain techniques[J]. Computer Science Review, 2023, 50: 100585. doi: 10.1016/j.cosrev.2023.100585.
[26]	KHASHAN O A and KHAFAJAH N M. Efficient hybrid centralized and blockchain-based authentication architecture for heterogeneous IoT systems[J]. Journal of King Saud University-Computer and Information Sciences, 2023, 35(2): 726–739. doi: 10.1016/j.jksuci.2023.01.011.
[27]	RANI S, BABBAR H, SRIVASTAVA G, et al. Security framework for Internet-of-Things-based software-defined networks using blockchain[J]. IEEE Internet of Things Journal, 2023, 10(7): 6074–6081. doi: 10.1109/JIOT.2022.3223576.
[28]	夏卓群, 苏潮, 徐梓桑, 等. 基于物理不可克隆函数的轻量级可证明安全车联网认证协议[J]. 电子与信息学报, 2024, 46(9): 3788–3796. doi: 10.11999/JEIT240141. XIA Zhuoqun, SU Chao, XU Zisang, et al. A lightweight and provably secure authentication protocol for Internet of Vehicles using physical unclonable function[J]. Journal of Electronics & Information Technology, 2024, 46(9): 3788–3796. doi: 10.11999/JEIT240141.
[29]	MAHALAT M H, SAHA S, MONDAL A, et al. A PUF based light Weight protocol for secure WiFi authentication of IoT devices[C]. 2018 8th International Symposium on Embedded Computing and System Design (ISED), Cochin, India, 2018: 183–187. doi: 10.1109/ISED.2018.8703993.
[30]	李雪筠, 叶靖, 黄正峰, 等. 基于PUF的硬件辅助软件认证方法[J]. 郑州大学学报: 理学版, 2021, 53(1): 88–94. doi: 10.13705/j.issn.1671-6841.2020268. LI Xueyun, YE Jing, HUANG Zhengfeng, et al. PUF-based hardware-assisted software authentication method[J]. Journal of Zhengzhou University: Natural Science Edition, 2021, 53(1): 88–94. doi: 10.13705/j.issn.1671-6841.2020268.
[31]	ALTAIBEK M, ISSAINOVA A, AIDYNOV T, et al. A survey of cross-layer security for resource-constrained IoT devices[J]. Applied Sciences, 2025, 15(17): 9691. doi: 10.3390/app15179691.
[32]	POURRAHMANI H, YAVARINASAB A, MONAZZAH A M H, et al. A review of the security vulnerabilities and countermeasures in the Internet of Things solutions: A bright future for the blockchain[J]. Internet of Things, 2023, 23: 100888. doi: 10.1016/j.iot.2023.100888.
[33]	RAJMOHAN T, NGUYEN P H, and FERRY N. A decade of research on patterns and architectures for IoT security[J]. Cybersecurity, 2022, 5(1): 2. doi: 10.1186/s42400-021-00104-7.
[34]	LAPIETRA J, KURDZIEL M, and ŁUKOWIAK M. FSMLock: Sequential logic locking case study[C]. 2025 32nd International Conference on Mixed Design of Integrated Circuits and System (MIXDES), Szczecin, Poland, 2025: 107–111. doi: 10.23919/MIXDES66264.2025.11091994.
[35]	YE Haojie, XIA Yuchen, CHEN Yuhan, et al. Palermo: Improving the performance of oblivious memory using protocol-hardware co-design[C]. 2025 IEEE International Symposium on High Performance Computer Architecture (HPCA), Las Vegas, USA, 2025: 380–393. doi: 10.1109/HPCA61900.2025.00038.
[36]	赵毅强, 闫明凯, 张启智, 等. 基于多阶段相关功耗分析的SM4-XTS侧信道分析方法[J]. 电子与信息学报, 2024, 46(11): 4161–4169. doi: 10.11999/JEIT240183. ZHAO Yiqiang, YAN Mingkai, ZHANG Qizhi, et al. SM4-XTS side channel analysis method based on multi-stage CPA[J]. Journal of Electronics & Information Technology, 2024, 46(11): 4161–4169. doi: 10.11999/JEIT240183.
[37]	赵毅强, 李政阳, 张启智, 等. 基于混合阶数掩码的门级电路侧信道防护方法[J]. 电子与信息学报, 2025, 47(9): 3274–3285. doi: 10.11999/JEIT250198. ZHAO Yiqiang, LI Zhengyang, ZHANG Qizhi, et al. Gate-level side-channel protection method based on hybrid-order masking[J]. Journal of Electronics & Information Technology, 2025, 47(9): 3274–3285. doi: 10.11999/JEIT250198.
[38]	赵毅强, 孔金笛, 付玉成, 等. 面向模块化格基密钥封装机制算法多项式乘法的侧信道安全防护关键技术研究[J]. 电子与信息学报, 2025, 47(9): 3126–3136. doi: 10.11999/JEIT250292. ZHAO Yiqiang, KONG Jindi, FU Yucheng, et al. Research on key technologies of side-channel security protection for polynomial multiplication in ML-KEM/Kyber algorithm[J]. Journal of Electronics & Information Technology, 2025, 47(9): 3126–3136. doi: 10.11999/JEIT250292.
[39]	DENG Shuwen, GÜMÜŞOĞLU D, XIONG Wenjie, et al. SecChisel framework for security verification of secure processor architectures[C]. Proceedings of the 8th International Workshop on Hardware and Architectural Support for Security and Privacy, Phoenix, USA, 2019: 7. doi: 10.1145/3337167.3337174.
[40]	于斌, 闵玉新, 张自豪, 等. 基于RISC-V指令扩展的双线性对协处理器设计[J]. 电子与信息学报, 2025, 47(9): 3137–3145. doi: 10.11999/JEIT250367. YU Bin, MIN Yuxin, ZHANG Zihao, et al. Design of a bilinear pairing coprocessor based on RISC-V instruction extension[J]. Journal of Electronics & Information Technology, 2025, 47(9): 3137–3145. doi: 10.11999/JEIT250367.