SAILOR: A Scalable and Energy-Efficient Ultra-Lightweight RISC-V for IoT Security

1. Problem Statement

The rapid expansion of the Internet of Things (IoT) has created a massive demand for battery-powered devices that require both high energy efficiency and robust security. Cryptographic operations (e.g., AES, SHA-2) are essential for secure communication but can consume up to 50% of a device's total battery energy, significantly limiting device autonomy.

Existing RISC-V processor designs for IoT face a critical trade-off:

• Performance/Security Focus: Many designs prioritize performance or add cryptographic extensions at the cost of large area footprints, making them unsuitable for resource-constrained environments.
• Area Focus: Ultra-lightweight, serialized cores (e.g., SERV, QERV) minimize area but often neglect energy efficiency and lack integrated hardware support for modern cryptographic instruction set extensions (specifically the ratified NIST Zkn-Zkt suite).
• The Gap: There is a lack of integrated architectures that simultaneously optimize for minimal area, high energy efficiency, and comprehensive cryptographic support without incurring prohibitive hardware overhead.

2. Methodology

The authors propose SAILOR, a scalable, modular family of RISC-V cores designed to bridge this gap. The methodology relies on three core pillars:

A. Scalable Serialized Data Path

Instead of a fixed 32-bit data path, SAILOR utilizes a bit-serialized architecture. The internal data path width is configurable (1-bit, 2-bit, 4-bit, 8-bit, 16-bit, and 32-bit).

• Mechanism: Data is processed in chunks. The ALU performs operations on these chunks sequentially over multiple clock cycles.
• Benefit: This drastically reduces the area of the Arithmetic Logic Unit (ALU) and functional units, as the hardware only needs to handle the width of the chunk (e.g., 1-bit) rather than the full 32-bit word.
• Modularity: The memory interface and register file remain 32-bit to ensure compatibility with standard system buses (AXI, TileLink), while the execution core is serialized.

B. Lightweight Cryptographic Extensions (Zkn-Zkt)

SAILOR integrates the official RISC-V scalar cryptography extensions (Zkn suite: Zbkb, Zbkc, Zbkx, Zkne, Zknd, Zknh) and the constant-time execution subset (Zkt).

• Hardware Reuse: The design maximizes the reuse of existing baseline modules (ALU, Serializer) to minimize area overhead.
• Specialized Units:
  • AES (Zkne/Zknd): Implements a compact, single-cycle S-Box and a dedicated xt2 unit for Galois field multiplication, reusing load/store buffers to avoid extra registers.
  • SHA-2 (Zknh): Uses specialized fixed-shift and rotation logic that executes in a single cycle, bypassing the general serializer for specific operations.
  • Bit Manipulation (Zbkb/Zbkx): Enhanced ALU masking and bidirectional shift capabilities in the serializer.
• Side-Channel Resistance: The Zkt extension ensures constant-time execution (data-independent latency) to prevent timing side-channel attacks, a critical requirement for IoT security.

C. Design Implementation

• Language: Implemented in Chisel (Constructing Hardware in a Scala Embedded Language) to leverage parameterization and modularity.
• Verification: Validated using the RISC-V Torture Test framework and Spike simulator, extended to cover Zkn instructions.
• Synthesis: Synthesized using Synopsys Design Compiler with the FreePDK45 45nm library at 100 MHz.

3. Key Contributions

1. Scalable Architecture: A novel RISC-V core family spanning 1-bit to 32-bit serialized data paths, allowing designers to trade off area vs. performance based on specific IoT constraints.
2. Integrated Zkn-Zkt Support: The first comprehensive implementation of the full ratified NIST cryptographic extension suite (including AES, SHA-2, and bit-manipulation) in an ultra-lightweight, serialized architecture with minimal area overhead.
3. Modular Efficiency: A design that reuses baseline components for cryptographic acceleration, achieving high efficiency without the massive area penalties seen in dedicated co-processors or vector extensions.
4. Comprehensive Evaluation: A rigorous analysis covering area, energy, performance, and efficiency metrics (EDP and ATP) across various benchmarks and serialization widths.

4. Key Results

The paper presents extensive experimental results comparing SAILOR against state-of-the-art cores (SERV, QERV, FazyRV, PicoRV32) and other cryptographic implementations.

• Area Efficiency:

  • The 1-bit SAILOR core (with Zkn extensions) occupies ~15.6 kGE.
  • Compared to the 32-bit PicoRV32, the 16-bit and 32-bit SAILOR variants achieve 15.49% and 21.26% area reductions, respectively.
  • Compared to other cryptographic RISC-V cores, SAILOR achieves 35% to 59% smaller area due to its lightweight S-Box and lack of SM4 support (focusing on NIST standards).

• Performance & Speedup:

  • Cryptographic Workloads: SAILOR cores with Zkn extensions achieve up to 13× speedup in cryptographic tasks compared to baseline serialized cores.
  • General Workloads: The 16-bit serialized SAILOR core outperforms the 32-bit PicoRV32 by 2.0× to 3.8× in benchmarks like Coremark and Dhrystone.
  • Code Size: Enabling Zkn extensions reduces code size by 53% to 78% for cryptographic algorithms (e.g., AES-128 code size drops from 4764 bytes to 612 bytes).

• Energy Efficiency:

  • SAILOR cores reduce energy consumption by 2.75× to 4.62× compared to baseline RV32I cores.
  • Against PicoRV32, energy savings reach up to 12.79× for cryptographic workloads.
  • The 32-bit Zkn-Zkt core shows a 13.24× energy reduction over its 1-bit counterpart for SHA-256/512 due to reduced clock cycles.

• Efficiency Metrics (EDP & ATP):

  • Energy-Delay Product (EDP): Improvements of up to 153× for cryptographic extensions compared to state-of-the-art serialized cores.
  • Area-Time Product (ATP): Improvements of 3.59× to 10.51× over PicoRV32 when cryptographic extensions are enabled.

5. Significance

The SAILOR architecture demonstrates that security and efficiency are not mutually exclusive in constrained IoT environments. By utilizing a scalable serialized data path and a modular design approach, the authors prove that:

1. Lightweight cryptographic extensions can be integrated without prohibitive area overhead.
2. Energy-optimized designs do not need to sacrifice performance; in many cases, they outperform traditional 32-bit designs.
3. Scalability allows system architects to tailor the processor exactly to the application's needs (e.g., choosing a 1-bit core for extreme area constraints or a 16-bit core for balanced performance/energy).

This work fills a critical research gap, providing a practical, open-source-ready solution for securing the next generation of billions of battery-powered IoT devices.