高级搜索

留言板

尊敬的读者、作者、审稿人, 关于本刊的投稿、审稿、编辑和出版的任何问题, 您可以本页添加留言。我们将尽快给您答复。谢谢您的支持!

姓名
邮箱
手机号码
标题
留言内容
验证码

一种支持跨层信任闭环的指令驱动安全协处理器架构

王俊辉,  彭奕景,  刘家宏,  王耀华

王俊辉, 彭奕景, 刘家宏, 王耀华. 一种支持跨层信任闭环的指令驱动安全协处理器架构[J]. 电子与信息学报. doi: 10.11999/JEIT260619
引用本文: 王俊辉, 彭奕景, 刘家宏, 王耀华. 一种支持跨层信任闭环的指令驱动安全协处理器架构[J]. 电子与信息学报. doi: 10.11999/JEIT260619
WANG Junhui, PENG Yijing, LIU Jiahong, WANG Yaohua. An Instruction-Based Secure Coprocessor Architecture for Cross-Layer Trust Closure[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260619
Citation: WANG Junhui, PENG Yijing, LIU Jiahong, WANG Yaohua. An Instruction-Based Secure Coprocessor Architecture for Cross-Layer Trust Closure[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260619

一种支持跨层信任闭环的指令驱动安全协处理器架构

doi: 10.11999/JEIT260619 cstr: 32379.14.JEIT260619
详细信息
    作者简介:

    王俊辉:男,副研究员,研究方向为微处理器设计与芯片安全

    彭奕景:男,博士生,研究方向为微处理器设计与芯片安全

    刘家宏:男,博士生,研究方向为微处理器设计与芯片安全

    王耀华:男,研究员,研究方向为微处理器设计与芯片安全

    通讯作者:

    彭奕景 pengyijing@nudt.edu.cn

  • 中图分类号: TN47

An Instruction-Based Secure Coprocessor Architecture for Cross-Layer Trust Closure

  • 摘要: 针对物联网设备安全防护中传统纯软件方案性能低且易受物理攻击,以及基于有限状态机(FSM)配置的硬件加速器存在状态爆炸、扩展困难及敏感数据易在总线暴露等问题,该文提出一种支持跨层信任闭环的指令驱动安全协处理器架构(IBSCA)。该架构摒弃传统FSM硬连线控制,引入精简指令集概念构建“译码-调度-执行”流水线,将PUF、Hash及加解密等异构算子抽象为可独立寻址的原子操作;通过指令驱动范式解耦控制与数据通路,赋予运行时动态编程能力以解决FSM状态爆炸问题;同时实现算子级细粒度编排与关键数据片上驻留,构建从物理信任源到数据加密的跨层硬件信任闭环,杜绝总线监听风险。基于FPGA的原型验证结果表明,该架构可正确支撑IoT场景复杂协议,相比传统FSM设计具备更高的协议扩展灵活性,为资源受限IoT终端提供了可靠的硬件安全底座。
  • 图  1  指令格式定义

    图  2  安全协处理器硬件微架构示意图

    图  3  IBSCA 调度流程

    图  4  WiFi协议模拟结果R3

    图  5  WiFi协议服务器验证结果

    1  控制逻辑模块核心实现

     1 module control (
     2 input [31:0] instr, //   指令字
     3 input instr_vld, //   指令有效
     4 input [255:0] data_in1, data_in2,
     5 input [511:0] data_result, //   执行结果
     6 input response, //   完成响应
     7 output [5:0] src1, src2, dst, //   地址域
     8 output [9:0] valid_signals, //   one-hot选通
     9 output [511:0] data_out); //   操作数据
     // (1) 译码站:并行提取指令字段(图1)
     10 assign m_lo = instr[0]; //   源选择位
     11 assign m_st = instr[1]; //   写回位
     12 assign op_cnt = instr[4]; //   操作数数量
     13 assign funct = instr[9:5]; //   功能单元选择
     14 assign {dst, src2, src1} = instr[27:10];
     // (2) 源数据站:按m_lo选源
     15 always @(posedge clk) if (instr_vld) begin
     16 {op2, op1} <= m_lo ?
     17 {op_cnt ? data_in2 : 0, data_in1}
     18: : result_reg; //   片内前递
     19: data_vld <= 1; end //   就绪,交调度站
     // (3) 调度站:译码funct与装载的数据汇合
     20: always @(posedge clk)
     21: if (data_vld && funct==Hash) begin
     22: data_out <= {op2, op1}; //   组512位消息块
     23: valid_signals[0] <= 1; end //   启动Hash
     // 其余算子同理。各站间以op1/op2与data_vld寄存器分隔:功
     能单元执行第i条指令时,译码站与源数据站可推进后续指令,
     实现指令级并行与流水线重叠
     // (4) 结果驻留站:m_st = 0时片内锁存
     24: always @(posedge clk) if (response&&!m_st)
     25: result_reg <= data_result; //   片内复用
     26: endmodule
    下载: 导出CSV

    2  基于PUF的轻量级WiFi认证算法

     输入:C1',C2',C3,R2',R3'
     输出:R1new',R2new',R3new',R1',Hclient
     1 R3 ← P(C3)  // 由片上PUF生成响应
     2 nonce ← R3 $\oplus $ R3'  // 恢复会话随机数
     3 C2 ← C2' $\oplus $ nonce
     4 R2 ← R2' $\oplus $ nonce
     5 if R2 ≠ P(C2) then  // 设备端校验
     6  return 认证拒绝
     7 end if
     8 C1 ← C1' $\oplus $ nonce
     9 R1″ ← P(C1)
     10 R1' ← nonce $\oplus $ R1″
     11 R1new ← P(C1 $\oplus $ C3)
     12 R1new' ← nonce $\oplus $ R1new
     13 R2new ← P(C2 $\oplus $ C3)
     14 R2new' ← nonce $\oplus $ R2new
     15 R3new ← P(C3 $\oplus $ nonce)
     16 R3new' ← R3new $\oplus $ nonce
     17 Hclient ← H(R1new ∥ R2new ∥ R3new ∥ R1″)
     18 return R1new',R2new',R3new',R1',Hclient
    下载: 导出CSV

    表  1  安全认证协议指令编码信息表

    指令二进制编码 功能描述
    算法2 安全WiFi认证算法(4.2节)
    32’b0000_000010_000011_000000_00001_0_01_1_1 计算 R3 = P(C3)
    32’b0000_000011_000010_000000_00010_1_01_1_1 计算 nonce = R3 $\oplus $ R3'
    32’b0000_000100_000011_000000_00010_1_01_1_1 计算 C2 = C2' $\oplus $ nonce
    32’b0000_000101_000011_000000_00010_1_01_1_1 计算 R2 = R2' $\oplus $ nonce
    32’b0000_000110_000011_000100_00001_0_01_1_1 计算 P(C2)
    32’b0000_111111_000101_000110_00101_1_01_1_1 验证 R2 与 P(C2) 是否相等
    … …
    32’b0000_010010_001001_001011_00000_0_01_1_0 计算 Hclient = H(R1new || R2new || R3new || R1'')
    算法3 软硬件认证协议(4.3节)
    32’b0000_111111_000010_000001_00101_1_01_1_1 验证 ID
    32’b0000_000101_000100_000011_00010_1_01_1_1 计算 A′ = A $\oplus $ R
    32’b0000_000100_000000_000000_00001_0_01_1_1 计算 R = P(C)
    32’b0000_000110_000100_000101_00010_1_01_1_1 计算 A = A′ $\oplus $ R
    下载: 导出CSV

    3  基于PUF的软硬件绑定认证协议

     输入:设备标识 ID(C),应用标识 ID(A),原始应用A,服务器
     端预存CRP数据库
     输出:仅在合法设备C上正确执行的应用运行结果
     客户端(设备C):
     1 用户获取内嵌PUF的设备C
     2 向服务器发起应用A的下载请求
     3 发送 {ID(C),ID(A)} 至服务器
     服务器:
     4 验证 ID(C) 与 ID(A) 的合法性
     5 R ← CRP_database[ID(C)] 
     6 A′ ← Obfuscate(A,R)  
     7 将受保护应用A′下发至客户端
     客户端(设备C):
     8 R* ← 片上PUF实时生成的响应
     9 以R*解混淆并运行A′
     10 return 与设备绑定的执行结果
    下载: 导出CSV

    表  2  三类实现方式的访问延迟对比

    实现方式 访问延迟
    OA 8944 ns
    FSM 6062 ns
    IBSCA 6802 ns
    下载: 导出CSV
  • [1] DING Suiting, TUKKER A, and WARD H. Opportunities and risks of internet of things (IoT) technologies for circular business models: A literature review[J]. Journal of Environmental Management, 2023, 336: 117662. doi: 10.1016/j.jenvman.2023.117662.
    [2] CHHIKARA D, RANA S, SINGH G, et al. Blockchain-based partial group key agreement protocol for intelligent transportation systems[J]. IEEE Transactions on Vehicular Technology, 2023, 72(12): 16701–16710. doi: 10.1109/TVT.2023.3299705.
    [3] TAHERDOOST H. Security and Internet of Things: Benefits, challenges, and future perspectives[J]. Electronics, 2023, 12(8): 1901. doi: 10.3390/electronics12081901.
    [4] SZYMONIAK S, PIĄTKOWSKI J, and KURKOWSKI M. Defense and security mechanisms in the Internet of Things: A review[J]. Applied Sciences, 2025, 15(2): 499. doi: 10.3390/app15020499.
    [5] 王伟, 王伟克, 刘嘉萌, 等. 针对 RISC-V 物联网设备运行时安全的攻击、防御与展望: 综述[J]. 计算机与安全, 2026, 163: 104817. doi: 10.1016/j.cose.2025.104817.

    WANG Wei, WANG Weike, LIU Jiameng, et al. Attacks, defenses and perspectives for the runtime security of RISC-V IoT devices: A review[J]. Computers & Security, 2026, 163: 104817. doi: 10.1016/j.cose.2025.104817.
    [6] MUSTAFA R, SARKAR N I, MOHAAGHEGH M, et al. A secure and energy-efficient cross-layer framework for internet of things[C]. 2024 International Conference on Information Networking (ICOIN), Ho Chi Minh City, Vietnam, 2024: 661–666. doi: 10.1109/ICOIN59985.2024.10572109.
    [7] MOHAMMED B A, AL-SHAREEDA M A, HOMOD R Z, et al. Taxonomy-based lightweight cryptographic frameworks for secure industrial IoT: A survey[J]. IEEE Internet of Things Journal, 2025, 12(20): 43296–43316. doi: 10.1109/JIOT.2025.3595649.
    [8] SCHILLER E, AIDOO A, FUHRER J, et al. Landscape of IoT security[J]. Computer Science Review, 2022, 44: 100467. doi: 10.1016/j.cosrev.2022.100467.
    [9] MISHRA R and MISHRA A. Current research on Internet of Things (IoT) security protocols: A survey[J]. Computers & Security, 2025, 151: 104310. doi: 10.1016/j.cose.2024.104310.
    [10] DI MATTEO S, BALDANZI L, CROCETTI L, et al. Secure elliptic curve crypto-processor for real-time IoT applications[J]. Energies, 2021, 14(15): 4676. doi: 10.3390/en14154676.
    [11] AKTER S, KHALIL K, and BAYOUMI M. A survey on hardware security: Current trends and challenges[J]. IEEE Access, 2023, 11: 77543–77565. doi: 10.1109/ACCESS.2023.3288696.
    [12] ROJAS-MUÑOZ L F, SÁNCHEZ-SOLANO S, MARTÍNEZ-RODRÍGUEZ M C, et al. On-line evaluation and monitoring of security features of an RO-based PUF/TRNG for IoT devices[J]. Sensors, 2023, 23(8): 4070. doi: 10.3390/s23084070.
    [13] GOŁOFIT K. Security primitives for memoryless IoT devices based on physical unclonable functions and true random number generators[J]. Scientific Reports, 2024, 14(1): 24060. doi: 10.1038/s41598-024-75373-6.
    [14] SCHÖFFEL M, LAUER F, RHEINLÄNDER C C, et al. Secure IoT in the era of quantum computers—Where are the bottlenecks?[J]. Sensors, 2022, 22(7): 2484. doi: 10.3390/s22072484.
    [15] RIZVI S, ORR R, COX A, et al. Identifying the attack surface for IoT network[J]. Internet of Things, 2020, 9: 100162. doi: 10.1016/j.iot.2020.100162.
    [16] NANNIPIERI P, CROCETTI L, DI MATTEO S, et al. Hardware design of an advanced-feature cryptographic tile within the European Processor Initiative[J]. IEEE Transactions on Computers, 2025, 74(3): 762–775. doi: 10.1109/TC.2023.3278536.
    [17] MAACHE A and KALACHE A. Design and implementation of a flexible multi-purpose cryptographic system on low cost FPGA[J]. International Journal of Electrical and Computer Engineering Systems, 2023, 14(1): 45–58. doi: 10.32985/ijeces.14.1.6.
    [18] BACHANNA P, SANKAR P H, TRIPATHI M K, et al. Optimization of re-configurable multi-core processors and security based on field programmable gate arrays[J]. Indonesian Journal of Electrical Engineering and Computer Science, 2024, 33(1): 568–580. doi: 10.11591/ijeecs.v33.i1.pp568-580.
    [19] 王杰, 王鹃. 面向RISC-V平台的安全高效固件可信平台模块设计与实现[J]. 电子与信息学报, 2025, 47(7): 2385–2395. doi: 10.11999/JEIT241112.

    WANG Jie and WANG Juan. The design and implementation of a secure and efficient firmware trusted platform module for RISC-V platforms[J]. Journal of Electronics & Information Technology, 2025, 47(7): 2385–2395. doi: 10.11999/JEIT241112.
    [20] ALSULIEMAN R, HERNANDEZ ESCOBAR E, SWILLEY R, et al. Hardware implementation-based lightweight privacy-preserving authentication scheme for Internet of Drones using physically unclonable function[J]. Sensors, 2026, 26(7): 2224. doi: 10.3390/s26072224.
    [21] NIAZY M, AZMI H, and MAHMOUD M M A. A scalable security co-processor design for IoT applications[J]. Scientific Reports, 2026, 16(1): 19192. doi: 10.1038/s41598-026-58079-9.
    [22] THABIT F, CAN O, ALJAHDALI A O, et al. Cryptography algorithms for enhancing IoT security[J]. Internet of Things, 2023, 22: 100759. doi: 10.1016/j.iot.2023.100759.
    [23] TANVEER M, BADSHAH A, KHAN A U, et al. CMAF-IIoT: Chaotic map-based authentication framework for industrial Internet of Things[J]. Internet of Things, 2023, 23: 100902. doi: 10.1016/j.iot.2023.100902.
    [24] ZUBAYDI H D, VARGA P, and MOLNÁR S. Leveraging blockchain technology for ensuring security and privacy aspects in Internet of Things: A systematic literature review[J]. Sensors, 2023, 23(2): 788. doi: 10.3390/s23020788.
    [25] GUGUEOTH V, SAFAVAT S, SHETTY S, et al. A review of IoT security and privacy using decentralized blockchain techniques[J]. Computer Science Review, 2023, 50: 100585. doi: 10.1016/j.cosrev.2023.100585.
    [26] KHASHAN O A and KHAFAJAH N M. Efficient hybrid centralized and blockchain-based authentication architecture for heterogeneous IoT systems[J]. Journal of King Saud University-Computer and Information Sciences, 2023, 35(2): 726–739. doi: 10.1016/j.jksuci.2023.01.011.
    [27] RANI S, BABBAR H, SRIVASTAVA G, et al. Security framework for Internet-of-Things-based software-defined networks using blockchain[J]. IEEE Internet of Things Journal, 2023, 10(7): 6074–6081. doi: 10.1109/JIOT.2022.3223576.
    [28] 夏卓群, 苏潮, 徐梓桑, 等. 基于物理不可克隆函数的轻量级可证明安全车联网认证协议[J]. 电子与信息学报, 2024, 46(9): 3788–3796. doi: 10.11999/JEIT240141.

    XIA Zhuoqun, SU Chao, XU Zisang, et al. A lightweight and provably secure authentication protocol for Internet of Vehicles using physical unclonable function[J]. Journal of Electronics & Information Technology, 2024, 46(9): 3788–3796. doi: 10.11999/JEIT240141.
    [29] MAHALAT M H, SAHA S, MONDAL A, et al. A PUF based light Weight protocol for secure WiFi authentication of IoT devices[C]. 2018 8th International Symposium on Embedded Computing and System Design (ISED), Cochin, India, 2018: 183–187. doi: 10.1109/ISED.2018.8703993.
    [30] 李雪筠, 叶靖, 黄正峰, 等. 基于PUF的硬件辅助软件认证方法[J]. 郑州大学学报: 理学版, 2021, 53(1): 88–94. doi: 10.13705/j.issn.1671-6841.2020268.

    LI Xueyun, YE Jing, HUANG Zhengfeng, et al. PUF-based hardware-assisted software authentication method[J]. Journal of Zhengzhou University: Natural Science Edition, 2021, 53(1): 88–94. doi: 10.13705/j.issn.1671-6841.2020268.
    [31] ALTAIBEK M, ISSAINOVA A, AIDYNOV T, et al. A survey of cross-layer security for resource-constrained IoT devices[J]. Applied Sciences, 2025, 15(17): 9691. doi: 10.3390/app15179691.
    [32] POURRAHMANI H, YAVARINASAB A, MONAZZAH A M H, et al. A review of the security vulnerabilities and countermeasures in the Internet of Things solutions: A bright future for the blockchain[J]. Internet of Things, 2023, 23: 100888. doi: 10.1016/j.iot.2023.100888.
    [33] RAJMOHAN T, NGUYEN P H, and FERRY N. A decade of research on patterns and architectures for IoT security[J]. Cybersecurity, 2022, 5(1): 2. doi: 10.1186/s42400-021-00104-7.
    [34] LAPIETRA J, KURDZIEL M, and ŁUKOWIAK M. FSMLock: Sequential logic locking case study[C]. 2025 32nd International Conference on Mixed Design of Integrated Circuits and System (MIXDES), Szczecin, Poland, 2025: 107–111. doi: 10.23919/MIXDES66264.2025.11091994.
    [35] YE Haojie, XIA Yuchen, CHEN Yuhan, et al. Palermo: Improving the performance of oblivious memory using protocol-hardware co-design[C]. 2025 IEEE International Symposium on High Performance Computer Architecture (HPCA), Las Vegas, USA, 2025: 380–393. doi: 10.1109/HPCA61900.2025.00038.
    [36] 赵毅强, 闫明凯, 张启智, 等. 基于多阶段相关功耗分析的SM4-XTS侧信道分析方法[J]. 电子与信息学报, 2024, 46(11): 4161–4169. doi: 10.11999/JEIT240183.

    ZHAO Yiqiang, YAN Mingkai, ZHANG Qizhi, et al. SM4-XTS side channel analysis method based on multi-stage CPA[J]. Journal of Electronics & Information Technology, 2024, 46(11): 4161–4169. doi: 10.11999/JEIT240183.
    [37] 赵毅强, 李政阳, 张启智, 等. 基于混合阶数掩码的门级电路侧信道防护方法[J]. 电子与信息学报, 2025, 47(9): 3274–3285. doi: 10.11999/JEIT250198.

    ZHAO Yiqiang, LI Zhengyang, ZHANG Qizhi, et al. Gate-level side-channel protection method based on hybrid-order masking[J]. Journal of Electronics & Information Technology, 2025, 47(9): 3274–3285. doi: 10.11999/JEIT250198.
    [38] 赵毅强, 孔金笛, 付玉成, 等. 面向模块化格基密钥封装机制算法多项式乘法的侧信道安全防护关键技术研究[J]. 电子与信息学报, 2025, 47(9): 3126–3136. doi: 10.11999/JEIT250292.

    ZHAO Yiqiang, KONG Jindi, FU Yucheng, et al. Research on key technologies of side-channel security protection for polynomial multiplication in ML-KEM/Kyber algorithm[J]. Journal of Electronics & Information Technology, 2025, 47(9): 3126–3136. doi: 10.11999/JEIT250292.
    [39] DENG Shuwen, GÜMÜŞOĞLU D, XIONG Wenjie, et al. SecChisel framework for security verification of secure processor architectures[C]. Proceedings of the 8th International Workshop on Hardware and Architectural Support for Security and Privacy, Phoenix, USA, 2019: 7. doi: 10.1145/3337167.3337174.
    [40] 于斌, 闵玉新, 张自豪, 等. 基于RISC-V指令扩展的双线性对协处理器设计[J]. 电子与信息学报, 2025, 47(9): 3137–3145. doi: 10.11999/JEIT250367.

    YU Bin, MIN Yuxin, ZHANG Zihao, et al. Design of a bilinear pairing coprocessor based on RISC-V instruction extension[J]. Journal of Electronics & Information Technology, 2025, 47(9): 3137–3145. doi: 10.11999/JEIT250367.
  • 加载中
图(5) / 表(5)
计量
  • 文章访问数:  9
  • HTML全文浏览量:  1
  • PDF下载量:  0
  • 被引次数: 0
出版历程
  • 收稿日期:  2026-05-15
  • 修回日期:  2026-09-28
  • 录用日期:  2026-10-16
  • 网络出版日期:  2026-10-25

目录

    /

    返回文章
    返回