As the Internet of Things (IoT) continues to expand into mission-critical and long-lived applications, securing low-power wide-area networks (LPWANs) such as Narrowband IoT (NB-IoT) against both classical and quantum threats becomes imperative. Existing NB-IoT security mechanisms terminate at the core network, leaving transmission payloads exposed. This paper proposes HySecure, an FPGA-based hybrid cryptographic platform that integrates both classical elliptic curve and post-quantum schemes to achieve end-to-end (E2E) security for NB-IoT communication. Our architecture, built upon the lightweight RISC-V PULPino platform, incorporates hardware accelerators for X25519, Kyber, Ed25519, and Dilithium. We design a hybrid key establishment protocol combining ECDH and Kyber through HKDF, and a dual-signature scheme using EdDSA and Dilithium to ensure authenticity and integrity during handshake. Cryptographic functions are evaluated on FPGA, achieving a 32.2× to 145.4× speedup. NS-3 simulations under realistic NB-IoT configurations demonstrate acceptable latency and throughput for the proposed hybrid schemes, validating their practicality for secure constrained IoT deployments and communications.

Lattice-based cryptography (LBC) is an essential direction in the fields of homomorphic encryption (HE), zero-knowledge proofs (ZK), and post-quantum cryptography (PQC), while number theoretic transformations (NTT) are a performance bottleneck that affects the promotion and deployment of LBC applications. Field-programmable gate arrays (FPGAs) are an ideal platform for accelerating NTT due to their reconfigurability and parallel capabilities. High-level synthesis (HLS) can shorten the FPGA development cycle, but for algorithms such as NTT, the synthesizer struggles to handle the inherent memory dependencies, often resulting in suboptimal synthesis outcomes for direct designs. This paper proposes a systematic HLS co-design to progressively guide the synthesis of NTT accelerators. The approach integrates several key techniques: arithmetic module resource optimization, conflict-free butterfly scheduling, memory partitioning, and template-based automated design fusion. It reveals how to resolve pipeline bottlenecks in HLS-based designs and expand parallel processing, guiding microarchitecture iterations to achieve an efficient design space. Compared to existing HLS-based designs, the area-latency product achieves a performance improvement of 1.93 to 191 times, and compared to existing HDL-based designs, the area-cycle product achieves a performance improvement of 1.7 to 10.6 times.

The evaluation of hardware security through physical side-channel measurements heavily relies on the volume and diversity of acquired sensor data, encompassing sufficient time-series instances for varying operational states. Synthesizing high-fidelity artificial measurement signals offers a compelling solution to augment limited empirical sensor data; however, manual crafting is infeasible, and existing automated generative approaches often fail to capture complex physical noise profiles. Recently, Denoising Diffusion Probabilistic Models (DDPMs) have emerged as superior alternatives to Generative Adversarial Networks (GANs) for modeling realistic, noisy data distributions. This paper explores the application of DDPMs for synthesizing side-channel sensor traces. We propose a novel conditional diffusion framework utilizing a specialized U-Net architecture, equipped with residual blocks and self-attention mechanisms, to learn and replicate complex temporal measurement dynamics. Trained on pre-processed measurement traces acquired via the industry-standard ChipWhisperer sensing platform, our model enables precise, conditional signal generation corresponding to specific hardware states. A critical advantage of our approach is its remarkable data efficiency: the proposed model requires merely 2,560 empirical measurement traces for training, highlighting the practical data efficiency of the proposed framework; however, such cross-study comparisons should be interpreted with caution when the experimental settings are not identical. Experimental results demonstrate the high physical fidelity of the synthesized signals. A classifier trained on empirical measurements achieves 97.7% label consistency accuracy when evaluated on our synthetic traces, closely rivaling the 99.6% SOTA accuracy and providing strong evidence that critical physical leakage characteristics are preserved under the evaluated setting. Furthermore, in hardware vulnerability assessments, analytical models augmented with our synthetic data achieve a Guessing Entropy of one, matching best-in-class performance. In simulated evaluation scenarios using these ChipWhisperer-based traces, models trained with our synthesized physical signals achieve 91.1% accuracy in same-device characterizations and 82.4% in challenging cross-device assessments. Ultimately, these generated traces serve as a promising signal augmentation tool, significantly enhancing profiling models and providing a more rigorous evaluation of hardware security under constrained sensor data conditions.

Speculative execution attacks significantly compromise the security of modern processors by enabling information leakage. These well-known attacks exploit speculative cache-based covert channels to effectively exfiltrate secret data by altering cache states. Existing hardware defenses specifically designed to prevent cache-based covert channels are effective at blocking explicit channels. However, their protection against implicit attack variants remains limited, since these hardware defenses do not fully eliminate secret-dependent microarchitectural changes in caches. In this paper, we propose TrackRISC, a framework which comprises (i) a refined implicit attack flow model specifically for the exploration and analysis of implicit cache-based speculative execution attacks which severely compromise the security of existing hardware defenses, and (ii) a security-enhanced tracking and mitigation microarchitecture, termed TrackRISC-Defense, designed to mitigate both implicit and explicit attack variants that use speculative cache-based covert channels. To obtain realistic hardware evaluation results, we implement and evaluate both TrackRISC-Defense and a representative existing defense on top of the Berkeley’s out-of-order RISC-V processor core (SonicBOOM) using the VCU118 FPGA platform running Linux. Compared to the representative existing defense which incurs a performance overhead of 13.8%, TrackRISC-Defense ensures stronger security guarantees with a performance overhead of 19.4%. In addition, TrackRISC-Defense can mitigate both explicit and implicit speculative cache-based covert channels with a register-based hardware resource overhead of 0.4%.