An Instruction-Based Secure Coprocessor Architecture for Cross-Layer Trust Closure

WANG Junhui; PENG Yijing; LIU Jiahong; WANG Yaohua

doi:10.11999/JEIT260619

Article Contents

Article Navigation > Journal of Electronics & Information Technology > 2025 >

WANG Junhui, PENG Yijing, LIU Jiahong, WANG Yaohua. An Instruction-Based Secure Coprocessor Architecture for Cross-Layer Trust Closure[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260619

Citation:

WANG Junhui, PENG Yijing, LIU Jiahong, WANG Yaohua. An Instruction-Based Secure Coprocessor Architecture for Cross-Layer Trust Closure[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260619

Citation:

PDF( 1934 KB)

An Instruction-Based Secure Coprocessor Architecture for Cross-Layer Trust Closure

doi: 10.11999/JEIT260619 cstr: 32379.14.JEIT260619

1.
College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China
2.
Key Laboratory of Advanced Microprocessor Chips and Systems(NUDT), Ministry of Education, Changsha 410073, China

Received Date: 2026-05-18
Accepted Date: 2026-10-16
Rev Recd Date: 2026-09-29

Available Online: 2026-10-25

Abstract

Abstract

Objective With the rapid development of the Internet of Things (IoT), large numbers of terminal devices deployed in physically open environments are vulnerable to physical probing, side-channel attacks, and bus sniffing. Existing IoT security solutions have several limitations. Software-based protocol implementations suffer from severe performance bottlenecks and lack physical protection, whereas dedicated hardware accelerators based on Finite State Machine (FSM) configurations face state explosion, limited scalability, coarse control granularity, and the risk of sensitive data exposure on unprotected buses due to frequent data movement. Therefore, resource-constrained IoT devices require an efficient, lightweight hardware protection architecture that supports fine-grained operator orchestration and cross-layer trust closure and whose security properties can be analyzed. Methods To address these issues, an Instruction-Based Secure Coprocessor Architecture (IBSCA) for cross-layer trust closure is proposed. The architecture replaces traditional hardwired FSM-based control with a processor-like “decode-dispatch-execute” pipeline based on the Reduced Instruction Set Computer (RISC) paradigm. A dedicated 32-bit reduced instruction set architecture is defined, with each instruction divided into five fields: control bits, functional unit selection, operand addresses, destination address, and reserved bits. The control bits specify data flow and operational attributes, with the source-selection and result write-back bits playing key roles in implementing the on-chip data-residency security policy. The hardware microarchitecture comprises four core modules: the interface module, control logic module, functional unit module, and memory module. The interface module serves as the sole communication channel to minimize the attack surface. The control logic module dynamically generates micro-operation control signals. The functional unit module integrates heterogeneous operators, including the Physical Unclonable Function (PUF), Elliptic Curve Cryptography (ECC), and hash operations. The memory module protects data confidentiality through on-chip data residency. The execution process comprises three coupled stages: instruction-sequence generation, instruction fetch and decoding, and instruction execution. The host injects instruction streams through the standard bus, while the architecture represents heterogeneous operators as independently addressable atomic operations, thereby decoupling control logic from data paths. A PUF-based lightweight Wi-Fi authentication protocol is mapped to the IBSCA to verify the design. Results and Discussions The IBSCA secure coprocessor is implemented and evaluated on a Field-Programmable Gate Array (FPGA) platform. Waveform-level simulation verifies functional correctness: when a PUF instruction is issued, the coprocessor decodes it correctly, activates the PUF module, and writes the response to an on-chip register (Fig. 4). This confirms that sensitive data, including PUF responses and keys, remain entirely on-chip during processing. End-to-end protocol tests are conducted by mapping the PUF-based lightweight Wi-Fi authentication protocol to the IBSCA. The protocol steps are successfully translated into binary instruction sequences and executed continuously to produce the correct response and session key (Fig. 5). Performance evaluations show that the IBSCA access latency is 6 802 ns, which is 23.95% shorter than that of the software baseline (8 944 ns) and 12.2% longer than that of the FSM baseline (6 062 ns) (Table 2). The small latency difference relative to the FSM baseline is attributable to implementation details, such as handshake bubbles, rather than limitations inherent to the instruction-driven paradigm. Resource-overhead analysis shows that the IBSCA control module uses only 800 Look-Up Tables (LUTs) and 1 550 Flip-Flops (FFs), representing reductions of 67.8% and 57.8%, respectively, compared with the FSM control module (2 483 LUTs and 3 676 FFs). These reductions arise because the general scheduling logic encodes complexity in instructions rather than representing it through explicit state nodes. Furthermore, post-route power analysis using the Switching Activity Interchange Format (SAIF), with 100% net matching and high confidence, shows that the total on-chip power of the IBSCA is 0.365 W at a timing-verified clock frequency of 100 MHz. The control module contributes only about 5 mW of dynamic power, accounting for 4.1% of the total dynamic power. Conclusions An instruction-based secure coprocessor architecture for cross-layer trust closure is proposed to address the limitations of existing IoT security solutions. By adopting a RISC-based paradigm and constructing a processor-like pipeline, the architecture decouples control logic from data paths, eliminates the FSM state-explosion problem, and enables runtime programmability. Fine-grained orchestration of heterogeneous operators and on-chip data residency keep sensitive data within the chip throughout processing, thereby establishing a hardware trust chain from generation of the physical root of trust to runtime data protection through encryption. FPGA prototype verification and resource analysis confirm that the IBSCA achieves a favorable balance among protocol extensibility, hardware resource overhead, and security performance, providing a flexible, efficient, and reliable hardware security foundation for resource-constrained IoT devices.
- Secure coprocessor,
- Internet of things,
- Instruction-driven,
- Cross-layer trust closure

FullText(HTML)

References(40)

References

[1]	DING Suiting, TUKKER A, and WARD H. Opportunities and risks of internet of things (IoT) technologies for circular business models: A literature review[J]. Journal of Environmental Management, 2023, 336: 117662. doi: 10.1016/j.jenvman.2023.117662.
[2]	CHHIKARA D, RANA S, SINGH G, et al. Blockchain-based partial group key agreement protocol for intelligent transportation systems[J]. IEEE Transactions on Vehicular Technology, 2023, 72(12): 16701–16710. doi: 10.1109/TVT.2023.3299705.
[3]	TAHERDOOST H. Security and Internet of Things: Benefits, challenges, and future perspectives[J]. Electronics, 2023, 12(8): 1901. doi: 10.3390/electronics12081901.
[4]	SZYMONIAK S, PIĄTKOWSKI J, and KURKOWSKI M. Defense and security mechanisms in the Internet of Things: A review[J]. Applied Sciences, 2025, 15(2): 499. doi: 10.3390/app15020499.
[5]	王伟, 王伟克, 刘嘉萌, 等. 针对 RISC-V 物联网设备运行时安全的攻击、防御与展望: 综述[J]. 计算机与安全, 2026, 163: 104817. doi: 10.1016/j.cose.2025.104817. WANG Wei, WANG Weike, LIU Jiameng, et al. Attacks, defenses and perspectives for the runtime security of RISC-V IoT devices: A review[J]. Computers & Security, 2026, 163: 104817. doi: 10.1016/j.cose.2025.104817.
[6]	MUSTAFA R, SARKAR N I, MOHAAGHEGH M, et al. A secure and energy-efficient cross-layer framework for internet of things[C]. 2024 International Conference on Information Networking (ICOIN), Ho Chi Minh City, Vietnam, 2024: 661–666. doi: 10.1109/ICOIN59985.2024.10572109.
[7]	MOHAMMED B A, AL-SHAREEDA M A, HOMOD R Z, et al. Taxonomy-based lightweight cryptographic frameworks for secure industrial IoT: A survey[J]. IEEE Internet of Things Journal, 2025, 12(20): 43296–43316. doi: 10.1109/JIOT.2025.3595649.
[8]	SCHILLER E, AIDOO A, FUHRER J, et al. Landscape of IoT security[J]. Computer Science Review, 2022, 44: 100467. doi: 10.1016/j.cosrev.2022.100467.
[9]	MISHRA R and MISHRA A. Current research on Internet of Things (IoT) security protocols: A survey[J]. Computers & Security, 2025, 151: 104310. doi: 10.1016/j.cose.2024.104310.
[10]	DI MATTEO S, BALDANZI L, CROCETTI L, et al. Secure elliptic curve crypto-processor for real-time IoT applications[J]. Energies, 2021, 14(15): 4676. doi: 10.3390/en14154676.
[11]	AKTER S, KHALIL K, and BAYOUMI M. A survey on hardware security: Current trends and challenges[J]. IEEE Access, 2023, 11: 77543–77565. doi: 10.1109/ACCESS.2023.3288696.
[12]	ROJAS-MUÑOZ L F, SÁNCHEZ-SOLANO S, MARTÍNEZ-RODRÍGUEZ M C, et al. On-line evaluation and monitoring of security features of an RO-based PUF/TRNG for IoT devices[J]. Sensors, 2023, 23(8): 4070. doi: 10.3390/s23084070.
[13]	GOŁOFIT K. Security primitives for memoryless IoT devices based on physical unclonable functions and true random number generators[J]. Scientific Reports, 2024, 14(1): 24060. doi: 10.1038/s41598-024-75373-6.
[14]	SCHÖFFEL M, LAUER F, RHEINLÄNDER C C, et al. Secure IoT in the era of quantum computers—Where are the bottlenecks?[J]. Sensors, 2022, 22(7): 2484. doi: 10.3390/s22072484.
[15]	RIZVI S, ORR R, COX A, et al. Identifying the attack surface for IoT network[J]. Internet of Things, 2020, 9: 100162. doi: 10.1016/j.iot.2020.100162.
[16]	NANNIPIERI P, CROCETTI L, DI MATTEO S, et al. Hardware design of an advanced-feature cryptographic tile within the European Processor Initiative[J]. IEEE Transactions on Computers, 2025, 74(3): 762–775. doi: 10.1109/TC.2023.3278536.
[17]	MAACHE A and KALACHE A. Design and implementation of a flexible multi-purpose cryptographic system on low cost FPGA[J]. International Journal of Electrical and Computer Engineering Systems, 2023, 14(1): 45–58. doi: 10.32985/ijeces.14.1.6.
[18]	BACHANNA P, SANKAR P H, TRIPATHI M K, et al. Optimization of re-configurable multi-core processors and security based on field programmable gate arrays[J]. Indonesian Journal of Electrical Engineering and Computer Science, 2024, 33(1): 568–580. doi: 10.11591/ijeecs.v33.i1.pp568-580.
[19]	王杰, 王鹃. 面向RISC-V平台的安全高效固件可信平台模块设计与实现[J]. 电子与信息学报, 2025, 47(7): 2385–2395. doi: 10.11999/JEIT241112. WANG Jie and WANG Juan. The design and implementation of a secure and efficient firmware trusted platform module for RISC-V platforms[J]. Journal of Electronics & Information Technology, 2025, 47(7): 2385–2395. doi: 10.11999/JEIT241112.
[20]	ALSULIEMAN R, HERNANDEZ ESCOBAR E, SWILLEY R, et al. Hardware implementation-based lightweight privacy-preserving authentication scheme for Internet of Drones using physically unclonable function[J]. Sensors, 2026, 26(7): 2224. doi: 10.3390/s26072224.
[21]	NIAZY M, AZMI H, and MAHMOUD M M A. A scalable security co-processor design for IoT applications[J]. Scientific Reports, 2026, 16(1): 19192. doi: 10.1038/s41598-026-58079-9.
[22]	THABIT F, CAN O, ALJAHDALI A O, et al. Cryptography algorithms for enhancing IoT security[J]. Internet of Things, 2023, 22: 100759. doi: 10.1016/j.iot.2023.100759.
[23]	TANVEER M, BADSHAH A, KHAN A U, et al. CMAF-IIoT: Chaotic map-based authentication framework for industrial Internet of Things[J]. Internet of Things, 2023, 23: 100902. doi: 10.1016/j.iot.2023.100902.
[24]	ZUBAYDI H D, VARGA P, and MOLNÁR S. Leveraging blockchain technology for ensuring security and privacy aspects in Internet of Things: A systematic literature review[J]. Sensors, 2023, 23(2): 788. doi: 10.3390/s23020788.
[25]	GUGUEOTH V, SAFAVAT S, SHETTY S, et al. A review of IoT security and privacy using decentralized blockchain techniques[J]. Computer Science Review, 2023, 50: 100585. doi: 10.1016/j.cosrev.2023.100585.
[26]	KHASHAN O A and KHAFAJAH N M. Efficient hybrid centralized and blockchain-based authentication architecture for heterogeneous IoT systems[J]. Journal of King Saud University-Computer and Information Sciences, 2023, 35(2): 726–739. doi: 10.1016/j.jksuci.2023.01.011.
[27]	RANI S, BABBAR H, SRIVASTAVA G, et al. Security framework for Internet-of-Things-based software-defined networks using blockchain[J]. IEEE Internet of Things Journal, 2023, 10(7): 6074–6081. doi: 10.1109/JIOT.2022.3223576.
[28]	夏卓群, 苏潮, 徐梓桑, 等. 基于物理不可克隆函数的轻量级可证明安全车联网认证协议[J]. 电子与信息学报, 2024, 46(9): 3788–3796. doi: 10.11999/JEIT240141. XIA Zhuoqun, SU Chao, XU Zisang, et al. A lightweight and provably secure authentication protocol for Internet of Vehicles using physical unclonable function[J]. Journal of Electronics & Information Technology, 2024, 46(9): 3788–3796. doi: 10.11999/JEIT240141.
[29]	MAHALAT M H, SAHA S, MONDAL A, et al. A PUF based light Weight protocol for secure WiFi authentication of IoT devices[C]. 2018 8th International Symposium on Embedded Computing and System Design (ISED), Cochin, India, 2018: 183–187. doi: 10.1109/ISED.2018.8703993.
[30]	李雪筠, 叶靖, 黄正峰, 等. 基于PUF的硬件辅助软件认证方法[J]. 郑州大学学报: 理学版, 2021, 53(1): 88–94. doi: 10.13705/j.issn.1671-6841.2020268. LI Xueyun, YE Jing, HUANG Zhengfeng, et al. PUF-based hardware-assisted software authentication method[J]. Journal of Zhengzhou University: Natural Science Edition, 2021, 53(1): 88–94. doi: 10.13705/j.issn.1671-6841.2020268.
[31]	ALTAIBEK M, ISSAINOVA A, AIDYNOV T, et al. A survey of cross-layer security for resource-constrained IoT devices[J]. Applied Sciences, 2025, 15(17): 9691. doi: 10.3390/app15179691.
[32]	POURRAHMANI H, YAVARINASAB A, MONAZZAH A M H, et al. A review of the security vulnerabilities and countermeasures in the Internet of Things solutions: A bright future for the blockchain[J]. Internet of Things, 2023, 23: 100888. doi: 10.1016/j.iot.2023.100888.
[33]	RAJMOHAN T, NGUYEN P H, and FERRY N. A decade of research on patterns and architectures for IoT security[J]. Cybersecurity, 2022, 5(1): 2. doi: 10.1186/s42400-021-00104-7.
[34]	LAPIETRA J, KURDZIEL M, and ŁUKOWIAK M. FSMLock: Sequential logic locking case study[C]. 2025 32nd International Conference on Mixed Design of Integrated Circuits and System (MIXDES), Szczecin, Poland, 2025: 107–111. doi: 10.23919/MIXDES66264.2025.11091994.
[35]	YE Haojie, XIA Yuchen, CHEN Yuhan, et al. Palermo: Improving the performance of oblivious memory using protocol-hardware co-design[C]. 2025 IEEE International Symposium on High Performance Computer Architecture (HPCA), Las Vegas, USA, 2025: 380–393. doi: 10.1109/HPCA61900.2025.00038.
[36]	赵毅强, 闫明凯, 张启智, 等. 基于多阶段相关功耗分析的SM4-XTS侧信道分析方法[J]. 电子与信息学报, 2024, 46(11): 4161–4169. doi: 10.11999/JEIT240183. ZHAO Yiqiang, YAN Mingkai, ZHANG Qizhi, et al. SM4-XTS side channel analysis method based on multi-stage CPA[J]. Journal of Electronics & Information Technology, 2024, 46(11): 4161–4169. doi: 10.11999/JEIT240183.
[37]	赵毅强, 李政阳, 张启智, 等. 基于混合阶数掩码的门级电路侧信道防护方法[J]. 电子与信息学报, 2025, 47(9): 3274–3285. doi: 10.11999/JEIT250198. ZHAO Yiqiang, LI Zhengyang, ZHANG Qizhi, et al. Gate-level side-channel protection method based on hybrid-order masking[J]. Journal of Electronics & Information Technology, 2025, 47(9): 3274–3285. doi: 10.11999/JEIT250198.
[38]	赵毅强, 孔金笛, 付玉成, 等. 面向模块化格基密钥封装机制算法多项式乘法的侧信道安全防护关键技术研究[J]. 电子与信息学报, 2025, 47(9): 3126–3136. doi: 10.11999/JEIT250292. ZHAO Yiqiang, KONG Jindi, FU Yucheng, et al. Research on key technologies of side-channel security protection for polynomial multiplication in ML-KEM/Kyber algorithm[J]. Journal of Electronics & Information Technology, 2025, 47(9): 3126–3136. doi: 10.11999/JEIT250292.
[39]	DENG Shuwen, GÜMÜŞOĞLU D, XIONG Wenjie, et al. SecChisel framework for security verification of secure processor architectures[C]. The 8th International Workshop on Hardware and Architectural Support for Security and Privacy, Phoenix, USA, 2019: 7. doi: 10.1145/3337167.3337174.
[40]	于斌, 闵玉新, 张自豪, 等. 基于RISC-V指令扩展的双线性对协处理器设计[J]. 电子与信息学报, 2025, 47(9): 3137–3145. doi: 10.11999/JEIT250367. YU Bin, MIN Yuxin, ZHANG Zihao, et al. Design of a bilinear pairing coprocessor based on RISC-V instruction extension[J]. Journal of Electronics & Information Technology, 2025, 47(9): 3137–3145. doi: 10.11999/JEIT250367.