Architectural Extensions for a RISC V Processor for Embedded Security
summary
Built a lightweight shadow core that receives completed instructions from the main core and re-executes checks to detect faults per instruction, reducing the attack window to near–per‑instruction. Completed-instruction entries sit in a variable delay buffer so timing glitches must be precisely synchronized, and the checker uses a different implementation and power profile. Architecturally, physical memory protection gains PMP with separate M-mode permissions, a stop instruction, debug-access detection, removed profiling and NMIs; design claims to keep up with the main core and detect integrity violations.
AI-written summary · about
chapters (11)
- 0:00Introduction to security CPUs
- 1:06Hardware attack methods explained
- 3:33Software and side-channel attacks
- 6:43Limitations of lockstep execution
- 8:51Requirements for a security CPU
- 10:40Shadow core architecture
- 12:06Enhanced PMP for security
- 14:14Memory protection and stop instruction
- 15:16Debug and profiling restrictions
- 17:00Summary and RISC-V advantages
- 18:03Q&A session
related talks
18mCPU Security in the Context of RISC-V
47mA Security RISC? The State of Microarchitectural Attacks on RISC-V
27mControl Flow Integrity on RISC-V
17mSecuring High-performance RISC V-Processors from Time Speculation
15mCore slicing: closing the gap between leaky confidential VMs and bare-metal cloud
13mRISC-V: Securing the Future of Open Source Computing
06mDemo: RISC-V Dual Lock-step Implementation for Safety and Security Applications
16mMitigating Transient-Execution Attacks with CHERI Compartments