Integrated sensing and communication (ISAC) technology breaks the limitation of traditional wireless networks in which communication and sensing operate independently, and can significantly improve network resource utilization efficiency and system flexibility. It has been widely applied in various civilian and military fields, such as smart cities and emergency rescue. However, due to the openness of wireless channels, ISAC systems inevitably introduce more severe information leakage when communication signals are exploited for target sensing, and thus face more stringent security challenges compared to conventional wireless communication systems. Fortunately, reconfigurable intelligent surface (RIS), which can flexibly reconfigure the wireless transmission environment by adjusting electromagnetic signal propagation parameters, have shown great potential in enhancing the security performance of ISAC systems. In this paper, a secure ISAC system with multiple communication users and multiple sensing targets was considered, and RIS-assisted secure ISAC transmission was investigated. A joint transmit and passive beamforming optimization algorithm for the base station and the RIS was proposed to satisfy sensing constraints while maximizing the sum secure rate of legitimate users. An alternating optimization framework was developed, in which fractional programming, successive convex approximation, and semidefinite relaxation techniques were embedded to effectively solve the original non-convex problem. Simulation results demonstrated the effectiveness of the proposed algorithm. Under the same parameter initialization in a single convergence test, the achievable sum secure rate of the proposed method was improved by 49.49% compared with the random RIS phase scheme, and the trade-off between sensing performance and secure communication was revealed.

RISC-V devices are widely used in diverse IoT applications, where security is critical. Control flow hijacking attacks can circumvent existing security mechanisms to transfer the program control flow to harmful gadget chains arranged by adversaries, which are primarily initiated by tampering with the data frame and return address within the stack. In this work, we present a microarchitecture-level, hardware-assisted, lightweight scheme for encrypting and verifying stack integrity, thereby transparently enforcing runtime control-flow integrity (CFI). The encrypted stack hinders attackers' analysis and increases the difficulty of assembling malicious gadgets. Stack integrity verification enables the system to detect malicious actions that tamper with return addresses and crucial registers at runtime. We implement the system on an Xilinx XC7K325T FPGA with the T-head Xuantie E906 RISC-V core. The experimental results show that, with a 16-kB D-Cache across the ten selected benchmark sets, this work incurs an average performance overhead of 4.89%. At the same time, the CoreMark score decreases by merely 0.10%. The area introduced by the proposed hardware is 10.01% of the total system-on-chip (SoC) under SAED 32-nm technology.

With the extensive application of embedded devices in daily life, the security issues have gained escalating significance. There are numerous researches and countermeasures dealing with the security problems of mainstream processor architectures. As an emerging Instruction Set Architecture (ISA), RISC-V has drawn widespread attention owing to its openness, flexibility, and extensibility. With its popularization in diverse fields, ensuring the security becomes crucially important. Aiming at the runtime security of RISC-V IoT devices, this paper reviews all the published papers in RISC-V security, and investigates three mainstream attack approaches and corresponding defense solutions. We analyze five common side-channel attacks with distinct attack focuses, categorize defense schemes into three types based on different levels and strategies of defense technology, and summarize several existing defense schemes on RISC-V platforms. Then, in the context of program vulnerability exploitation attacks, we present the attack process and offer a comprehensive overview and comparison of hardware-assisted defense mechanisms that have been implemented on RISC-V platforms in the recent years. This analysis is carried out from four key strategies, namely Code Integrity, Control Flow Integrity, Data Flow Integrity, and Information Confidentiality. For higher-level network attacks that are less correlated with the underlying ISA, we provide a brief statement and introduce two mainstream mechanisms, namely Intrusion Detection System and Data Encryption. Besides, this paper offers the critical perspectives and future development directions for the defense strategies corresponding to each type of attack. It is convinced that this review will act as a valuable resource for fellow researchers in RISC-V security.

The utilization of SPI-Flash in embedded systems is widespread, primarily serving as program storage during the boot process. As a result, the boot process is influenced to some extent by the SPI-Flash controller. This paper presents a lightweight SPI-Flash controller that simplifies the boot process design by establishing a direct connection between the SPI-Flash and AHB-lite bus interface, enabling rapid program execution in RAM instead of directly from the SPI-Flash. Additionally, the controller can function as a bare-metal program downloader for testing the boot process functionality during FPGA-based SoC (system-on-chip) prototype verification. The system-level simulation and FPGA verification results demonstrate that the proposed SPI-Flash controller successfully achieves its intended functional impact in operations to target the Micron N25Q256A SPI-Flash chip, boot process design, and bare-metal program download. The synthesis results under the SMIC 180 nm 1P8M technology process indicate that this SPI-Flash controller exhibits remarkable performance, power consumption, and area utilization. The source code of the proposed lightweight SPI-Flash controller has been uploaded to GitHub as an open-source project.

Control flow critical metadata play a key role in hardware-based control flow integrity (CFI) mechanisms that effectively monitor and secure program control flow based on pre-extracted metadata. The existing control flow analysis tools exhibit some deficiencies, including inadequate compatibility with the RISC-V architecture, a steep learning curve, limited automation capabilities, and restricted data output formats. CFIEE is an open-source tool with a graphical interface for the automated extraction of control flow critical metadata. The tool possesses the capability to analyze RISC-V binary executables, transforming the binary into an intermediate representation (IR) in the form of the disassembled code, and extracting the critical metadata required for studying hardware-based CFI mechanism through a designed control flow transfer relationship analysis algorithm. The extracted metadata include program basic blocks and their corresponding hash values, control flow graphs, function call relationships, distribution of forward transfer instructions, etc. We selected 15 embedded system programs with processor adaptation for functional verification. The results demonstrate the CFIEE’s capability to automatically analyze programs within the supported RISC-V instruction set and generate comprehensive and precise metadata files. This tool can significantly enhance the efficiency of control flow metadata extraction and furnish configurable metadata for the hardware-based security mechanisms.

The growing prevalence of embedded systems in various applications has raised concerns about their vulnerability to malicious code reuse attacks. Current software-based and hardware-assisted security techniques struggle to detect or block these attacks with minor performance and implementation overhead. To address this issue, this paper presents a lightweight hardware-assisted scheme to enhance the security of embedded systems against code reuse attacks. We develop an on-chip lightweight hardware shadow stack to validate target addresses at runtime for backward-edge control flow integrity, which backs up valid return addresses during function calls and automatically verifies actual return addresses during the return phase. Additionally, we propose a lightweight stream cipher circuit that encrypts and decrypts critical stack data related to control flow manipulation, preventing attackers from analyzing or tampering with them. When designing and implementing the security mechanism for embedded systems, we fully consider the constraints of limited system resources and performance, optimizing both the architecture design and implementation of the proposed hardware. Finally, we integrate both the proposed lightweight hardware shadow stack and the runtime data encryption hardware into the OR1200 processor. We have verified the system security function on the Terasic DE1-SoC FPGA platform and evaluated the system performance as well as implementation overhead. The results show that the proposed lightweight hardware-assisted scheme can provide a dedicated defense capability against code reuse attacks for embedded systems, with an average system performance overhead of 0.39% and an area footprint of 0.316 mm2.

Code Reuse Attacks (CRA) represent a type of control flow hijacking that attackers exploit to manipulate the standard program execution path, resulting in abnormal processor behaviors. In response to the security concern, proposals for Control Flow Integrity (CFI) verification have emerged. The CFI scheme diligently monitors program jumps during execution, effectively restraining abnormal program execution and robustly safeguarding against CRA. This paper provides a comprehensive analysis and synthesis of the current state of hardware-based CFI implementations. In this survey, we initially discuss common attack methods and variations of predominant CRA, elucidating the general procedural steps intrinsic to such attacks. We delve into the protective capacities inherent in contemporary hardware-based CFI implementations. By conducting a thorough examination and organization of diverse research endeavors on hardware-based CFI, we systematically classify CFI based on implementation methodologies, including label verification, instruction encryption, stack edge detection, instruction tracing, sensitive data isolation, and basic block validation. We provide comprehensive explanations and critical evaluations for each category followed by comparative analyses while offering personal insights on the evolution of hardware-based CFI.

The Control Flow Graph represents all possible paths a program may take during execution. Control Flow Integrity is a critical concern in embedded system security, and the CFG can be integrated with hardware circuit design to validate CFI. In this paper, we present a static CFG extraction scheme for RISC-V program based on the executable files. During the construction of CFGs, information such as instructions in each basic blocks, basic block length, transfer instructions of basic blocks, and transfer targets can be extracted. Additionally, data such as hash values for basic blocks can be calculated. Those metadata elements are sensitive information for the subsequent runtime CFI check. We use this extraction scheme to perform static analysis on several benchmark programs, and experimental results demonstrate that this scheme can generate correct CFGs and key sensitive information for runtime CFI verification.

In order to reduce the decoding latency, a new early stopping criterion is proposed for belief propagation (BP) decoding. A kind of special processing elements (PEs) of BP decoder called frozen and information PE (FIPE) is selected to predict whether decoding is successful or not. Statistics indicate that FIPE can be considered reliable when the frozen bit is decoded successfully. The proposed criterion is based on the fact that the number of reliable FIPE increase along with iterations and the variation trend is approximate to the ratio of correct information bits. In the term of hardware complexity, the proposed method has a linear correlation with the number of FIPE. This criterion consumes only ‘xor’ and ‘or’ gates to check stopping condition. Simulation results show that the proposed criterion achieves lower latency than Worst Information Bits (WIB) and Frozen Bit Error Rate (FBER) without BLER degradation compared with fixed and G-matrix. Compared with WIB, FBER, Best Frozen Bits (BFB) criterion, the proposed criterion has the lowest hardware complexity.

At present, the embedded systems are facing various kinds of attacks, especially for the data stored in the external memories. This paper presents a hardware-enhanced protection method to protect the data integrity and confidentiality at runtime, preventing the data from spoofing attack, splicing attack, replay attack, and some malicious analysis. For the integrity protection, the signature is calculated by the hardware implemented Lhash engine before the data sending off the chip, and the signature of the data block is recalculated and compared with the decrypted one at the load time. For the confidentiality protection, an AES encryption engine is used to generate the key stream, the plain data and the cipher data can translate through a simple XOR operation. The hardware cryptographic engines are optimized to work simultaneously with the memory access operation, which reduces the hardware overhead and the performance overhead. We implement the proposed architecture within OR1200 processor on Xilinx Virtex 5 FPGA platform. The experiment results show that the proposed hardware-enhanced protection method can preserve the integrity and confidentiality of the runtime data in the embedded systems with low power consumption and a marginal area footprint. The performance overhead is less than 2.27% according to the selected benchmarks.

With the popularity of node data to the sink-node in wireless sensor networks (WSNs), it is vital to protect the privacy of data and enable the sink-node to easily manage the data at the same time. Under such demands, reversible data steganography in encrypted images attracts more and more researchers’ attention. In this paper, we propose a novel reversible mean shift steganography algorithm for improving the security of data communication in WSNs. The algorithm first calculates the l, α, and β sub-components after removing the l component of the original image. At the same time, we use mean shift clustering algorithm to calculate the 3-dimensional regional maximum points based on l, α, and β components and mark them. Finally, the secret information is encoded and hidden in the corresponding extreme points of the Bit plane 0 of the sub-components, and then scrambled with the key. The extensive experimental results show that the proposed algorithm has little influence on the original image, and the histogram is almost the same, and the average error bit ratio (EBR) is only 0.164%.

The security1 of embedded systems has received much attention due to its widespread use and open application environment. Hash function is a commonly used solution to protect embedded system security. Due to the influence of area and power consumption, traditional hash encryption algorithms cannot be directly applied to embedded system because they consume too many resources. Therefore, lightweight encryption algorithms are receiving more and more attention. This paper proposes a method of applying LHash in embedded systems. The experimental results show that the method can correctly implement the LHash algorithm, and can simultaneously consider the area, power consumption and encryption speed, and has good applicability and security.

A novel system power management technique is proposed that employs a novel cost function based on state-action. Compared with the conventional algorithm, by using multiple parameter constraints in cost function of power management framework, the improved Q-learning can effectively make decisions to achieve a rational optimisation room. The proposed power management framework does not need any prior data and is running on a power model. As uncertainties can be effectively captured and modelled, the framework based on the model can help to explore an ideal trade-off and converge to the best power management policy. The results obtained showed that improved algorithm achieved remarkable significance.

: Security of embedded system is widely noticed for its common usage and open application environment. A hardware-assisted monitoring architecture based on lightweight hash function is proposed to detect run-time program integrity on the embedded processor. The fine-grained property information is extracted as the integrity verification object, and hashed by lightweight hash function as the monitoring model. The hardware architecture is implemented on an SoPC platform. Take five standard benchmarks for experimental objects, the experiments show that the proposed monitor accounts for less than 8.37% area overheads of the processor, and the average CPI of our secure processor with pipelined lightweight hash functions increases no more than 6.36%.

Embedded systems are subjecting to various kinds of security threats. Some malicious attacks exploit valid code gadgets to launch destructive actions or to reveal critical details. Some previous memory encryption strategies aiming at this issue suffer from unacceptable performance overhead and resource consumption. This paper proposes a hardware based confidentiality protection method to secure the code and data stored and transferred in embedded systems. This method takes advantage of the I/D-cache structure to reduce the frequency of the cryptographic encryption and decryption processing. We implement the AES engine with composite field arithmetic to reduce the cost of hardware implementation. The proposed architecture is implemented on EP2C70 FPGA chip with OpenRisc 1200 based SoC. The experiment results show that the AES engine is required to work only in the case of I/D-cache miss and the hardware implementation overhead can save 53.24% and 13.39% for the AES engine and SoC respectively.

At present, the IoT devices face many kinds of software and hardware attacks, especially buffer overflow attacks. This paper presents an architectural-enhanced security hardware design to detect buffer overflow attacks. One part of the design is instructions monitoring and verification used to trace the execution behavior of programs. Another one is secure tag validation used to monitor the attributes of every memory segment. The automated extraction tools extract the monitoring model and secure tag of each memory segment at the compile time. At run-time, the designed hardware observes its dynamic execution trace and checks whether the trace conforms to the permissible behavior, if not the appropriate response mechanisms will be triggered. The proposed schemes don’t change the compiler or the existing instruction set and imposes no restriction to the software developer. The architectural design is implemented on an actual OR1200-FPGA platform. The experimental analysis shows that the proposed techniques can detect a wide range of buffer overflow attacks. And it takes low performance penalties and minimal overheads.

Embedded systems are subjected to various adversaries including software attacks, physical attacks, and side channel attacks. Most of these malicious attacks can lead to the invalid execution of programs, and launch of destructive actions or reveal critical information. However, most previous security mechanisms suffer from coarse checking granularity and unacceptable performance overhead, due to strict restriction on system resources. This paper presents a fine-grained hardware-based security approach to ensure runtime code integrity in the embedded systems by offline profiling of the program features and runtime integrity check. We design a hardware implemented instruction stream integrity checker (ISIC) to perform runtime checking of pre-extracted features. Any invalid execution of the program will trigger the corresponding exception signal. We implement the ISIC with OR1200 processor on XC5VLX50T field-programmable gate array (FPGA). The experimental results show that the proposed approach can detect all the attacks destructing integrity of the instruction stream, and the performance overhead induced by the security mechanism is less than 3.45% according to the selected benchmarks.

Linear layer of lightweight hash functions is ordinarily too simple to resist statistical saturation attack.A novel lightweight hash function is proposed,which is based on the sponge structure and inspired by affine transformation S-box.The affine transformation S-box inherit the excellent cryptographic properties of original S-box,and offset lack of simple linear layer to a great extent as well.The original 4 bit S-box is selected by computing numbers of differential pairs with the largest differential probability,masks with the best linear approximation and maximum branch number of optimal S-box affine equivalent classes.Security of holis-tic and internal primitives is analyzed with differential and linear cryptanalysis,and especially statistical satu-ration attack.The control logic of affine transformation structure and the serial／parallel hardware architecture are designed and synthesized by Design Compiler.The results show that in case of adding a few control logic, the lightweight hash function with affine transformation S-box increases difficulty of tracing specific bit in diffusion trail,that is,structures of affine transformations increase confusion of linear diffusion layer and im-prove the ability against statistical saturation attack.

The security of embedded systems has attracted much attention as they are being used in more and more fields. The rapid growth and pervasive use of embedded systems make it easier for a sophisticated attacker to gain physical access to launch physical attacks on insecure off-chip memory and bus. This paper presents a novel hardware-based security mechanism to protect confidentiality and integrity of data, preventing the system data from being stolen or tampered by a malicious attacker. The proposed mechanism protects the confidentiality of data using advanced encryption standard (AES) stream encryption algorithm in parallel with the memory access process. This mechanism provides integrity protection for data by attaching integrity signatures generated using hash algorithm to data stored in external memory. The signature is verified when data is fetched into the chip. The security architecture has been tested and validated on the system on a programmable chip (SoPC) with OR1200(processor based on OpenRISC1000 architecture) processor. The experimental result shows that the proposed security mechanism ensures the integrity and confidentiality of system data, introducing low performance penalties.