Sure 😊
Cryptography is the practice of protecting information by turning it into a secret code so that
only authorized people can read or use it.
In simple words:
👉 It keeps data safe and private when it is stored or sent over the internet.
Example:
When you send a message or make an online payment, cryptography scrambles the data so
hackers can’t understand it—even if they intercept it.
Why it’s used:
🔒 Protects passwords and personal data
📩 Secures messages and emails
💳 Enables safe online transactions
So, cryptography = secure communication using codes.
Here is a simple and easy-to-understand version of the paper summary:
This paper presents a lightweight and secure communication system for the Industrial Internet
of Things (IIoT) using an FPGA. It is designed to work efficiently on devices with limited
hardware resources and low power availability.
The system secures UDP network data by encrypting it with Xoodyak, a modern lightweight
cryptography algorithm selected from the NIST Lightweight Cryptography finalists. Xoodyak is
chosen because it provides strong security (128-bit) and good resistance to side-channel
attacks, while remaining efficient for small UDP data packets.
To ensure smooth data transfer, the FPGA design uses two asynchronous FIFO buffers. These
buffers help manage data flow between the network interface and the encryption core, even
when they operate at different clock speeds or handle large data bursts.
Overall, the proposed solution uses much less hardware and power than traditional public-key
encryption methods, making it well-suited for secure IIoT gateway applications.
If you want, I can also make it even shorter, more technical, or presentation-ready.
What does Industrial IOT means here?
In this paper, Industrial IoT (IIoT) means:
👉 The use of Internet of Things technologies in industrial environments such as factories,
power plants, oil & gas facilities, smart grids, and manufacturing systems.
More simply:
Industrial IoT = connected industrial machines that share data securely and reliably.
What it means here specifically
In the context of this paper, IIoT refers to:
Industrial sensors and controllers (temperature, pressure, motors, PLCs)
FPGA-based gateways that collect and forward data
Real-time machine-to-machine communication over networks (using UDP)
Systems with strict limits on power, hardware, and latency
Why security matters in IIoT
Industrial systems:
Run 24/7
Control critical infrastructure
Often use small, resource-constrained devices
So they need:
Lightweight cryptography (low power, low hardware cost)
Fast communication (UDP instead of heavy protocols)
Strong protection against attacks
Simple one-line definition
Industrial IoT is the networking of industrial machines and sensors to monitor, control, and
automate industrial processes securely.
If you want, I can also explain how IIoT is different from normal IoT in one short table.
User Datagram Protocol (UDP) Overview
UDP is a connectionless, unreliable transport layer protocol that prioritizes speed and efficiency
over guaranteed delivery of data. Unlike TCP, UDP does not establish a formal connection (no
three-way handshake), retransmit lost packets, or manage the order of packet delivery.
Key Characteristics:
Connectionless: No virtual circuit is established before data is sent.
Faster Transmission: The lack of overhead (handshaking, acknowledgments, flow
control) results in speedier communication.
Unreliable: Data packets may be lost, duplicated, or arrive out of order without the
sender being notified.
Simple Header: The UDP header is only 8 bytes long, containing source port, destination
port, length, and a basic checksum field (which is optional in IPv4).
Common Use Cases:
UDP is ideal for time-sensitive applications where occasional data loss is preferable to delays
caused by retransmission, such as:
Voice over IP (VoIP)
Online gaming
Streaming media (audio/video)
Domain Name System (DNS) lookups
How does Xoodyak's inherent side-channel protection outweigh the risks of recent
decryption attacks mentioned?
Xoodyak was chosen because it is designed to resist side-channel attacks (SCA), which
are common in real IIoT hardware. The algorithm supports frequent key updates and
works well with masking and threshold techniques, making it very difficult for attackers
to extract keys using power or electromagnetic analysis.
Although some studies have shown key-recovery attacks on reduced-round versions of
Xoodyak and related algorithms, these attacks apply only to weakened or incomplete
versions, not the full algorithm used in practice. The full Xoodyak implementation
provides 128-bit security and uses the Xoodoo permutation, which spreads internal
data effectively and reduces information leakage that attackers rely on.
As a result, the risk from these academic attacks is very low in real systems. In contrast,
power-analysis attacks are a real and common threat in deployed IIoT devices.
Therefore, Xoodyak offers a better practical security balance, where strong side-channel
resistance is more valuable than defending against unlikely theoretical attacks.
Why prioritize UDP implementation over more reliable protocols when securing critical
IIoT infrastructure?
Here is a simplified and easy-to-read version of the topic:
UDP is chosen because it is simple and lightweight, which makes it ideal for FPGA-
based IIoT gateways that have limited hardware area and power. Using UDP reduces
both hardware complexity and energy consumption.
The system uses a 32-bit UDP data format that directly matches the NIST Lightweight
Cryptography API. This avoids extra data padding or format conversions, keeping the
design efficient and compact.
Because the UDP module and the encryption core run at different clock speeds, two
asynchronous FIFO buffers are used. These buffers allow smooth data transfer, maintain
high throughput, and protect data integrity even during large data bursts.
A CRC check is included in the UDP block to detect transmission errors, providing basic
reliability without adding complex features like retransmissions or flow control.
In many IIoT systems, low latency, low power use, and small hardware size are more
important than guaranteed packet delivery—especially when reliability is handled at
higher software layers. As a result, the proposed system delivers secure and efficient
communication with much lower hardware cost than traditional public-key encryption
methods, while still meeting industrial reliability needs.
If you want, I can also make this shorter, bullet-pointed, or exam-ready.
How effectively does the dual asynchronous FIFO structure compensate for disparate
clock domain frequencies?
Here is a simplified and easy-to-understand version of the explanation:
The design uses two asynchronous FIFO buffers to safely connect the fast UDP clock
domain with the slower cryptographic core (CryptoCore). One FIFO is placed at the
input side (pdi) and the other at the output side (ciphertext).
Because UDP and the CryptoCore run at different clock speeds, they cannot operate on
the same clock. The FIFOs act as temporary storage buffers that handle timing
differences and sudden bursts of data.
The input (pdi) FIFO is made large enough to store two full data blocks plus extra space
for unusually long messages. Its size is calculated so the faster UDP side can keep
sending data while the CryptoCore processes it more slowly.
The output (do) FIFO only needs to store one ciphertext block, since encrypted data is
produced at a much slower rate than input data arrives.
With these FIFOs in place:
UDP can send data continuously
The CryptoCore can process data at its own speed
No data is lost or delayed due to clock mismatch
Timing analysis after implementation confirms that both clock domains meet their
timing requirements, and the FIFOs introduce no errors. This proves that the dual-FIFO
approach successfully maintains high throughput and data reliability, even during large
data transfers.
If you want, I can also make this shorter, diagram-friendly, or exam-ready.
What specific hardware resource trade-offs justify selecting FPGA over ASIC for this
lightweight IIoT encryption?
FPGAs are well suited for this system because they are low-cost to develop and
reconfigurable. Unlike ASICs, which must be permanently fixed at fabrication, an FPGA
can be programmed to exactly match the data width and multiple clock domains
required by the UDP-based lightweight cryptography system.
The design uses only a small portion of the FPGA resources—about one-third of the
available logic—so it easily fits into a small, low-power IIoT gateway. This shows that
the system is efficient and does not require large or power-hungry hardware.
While an ASIC would need similar or even more silicon area to implement the same
encryption core and FIFO buffering, it would also involve very high upfront
manufacturing costs and no flexibility to change the design later. Any future updates—
such as adjusting buffer sizes or switching to a new cryptographic standard—would
require a complete redesign.
The FPGA implementation also meets all timing requirements for both the encryption
and UDP clocks without errors, proving that the design achieves the needed
performance with minimal resources. Compared to the complexity and cost of designing
an ASIC, the FPGA approach is more practical, flexible, and efficient for lightweight
encryption in IIoT systems.
How might frequent private key replacement, recommended for Xoodyak, impact overall
system throughput and latency?
FPGAs are well suited for this system because they are low-cost to develop and
reconfigurable. Unlike ASICs, which must be permanently fixed at fabrication, an FPGA
can be programmed to exactly match the data width and multiple clock domains
required by the UDP-based lightweight cryptography system.
The design uses only a small portion of the FPGA resources—about one-third of the
available logic—so it easily fits into a small, low-power IIoT gateway. This shows that
the system is efficient and does not require large or power-hungry hardware.
While an ASIC would need similar or even more silicon area to implement the same
encryption core and FIFO buffering, it would also involve very high upfront
manufacturing costs and no flexibility to change the design later. Any future updates—
such as adjusting buffer sizes or switching to a new cryptographic standard—would
require a complete redesign.
The FPGA implementation also meets all timing requirements for both the encryption
and UDP clocks without errors, proving that the design achieves the needed
performance with minimal resources. Compared to the complexity and cost of designing
an ASIC, the FPGA approach is more practical, flexible, and efficient for lightweight
encryption in IIoT systems
Here is a simple, step-by-step explanation of the diagram:
What this diagram shows
The diagram explains how data is securely sent from a computer to an FPGA using UDP
communication and lightweight cryptography (LWC).
It has two main sides:
Left side: Personal Computer (PC)
Right side: FPGA platform (main focus of the work)
Left Side: Personal Computer
1. Personal Computer & Local Storage
Data is created or read from storage on the PC.
2. Data Transfer Module
Prepares the data to be sent over the network.
3. Asynchronous FIFO
Temporarily stores data and smooths out speed differences between software and
network hardware.
4. Interface
Sends the data as UDP packets to the FPGA.
👉 At this stage, data is still unencrypted.
Middle: UDP Transmission
Data is transmitted over the network using UDP.
UDP is chosen because it is fast, simple, and lightweight, which suits IIoT systems.
Right Side: FPGA Platform (Main Focus)
1. Interface
Receives UDP data from the PC.
2. Asynchronous FIFO
Buffers incoming data because the network runs faster than the encryption hardware.
3. Pre-Processor
Formats incoming data so it matches the NIST Lightweight Cryptography (LWC) API.
4. Crypto-Core
Performs encryption or decryption using a lightweight algorithm (e.g., Xoodyak).
5. Post-Processor
Formats the encrypted (or decrypted) data for output.
6. Asynchronous FIFO (Output)
Buffers encrypted data before sending it back or forwarding it further.
Why FIFOs are important
Different parts run at different clock speeds
FIFOs prevent data loss and keep data flowing smoothly
They allow high-speed UDP communication to work with slower cryptographic
hardware
Big Picture (One-Line Summary)
👉 The system securely encrypts UDP data on an FPGA using lightweight cryptography,
while FIFOs handle speed differences to keep communication fast, reliable, and low-
power for IIoT applications.
If you want, I can also explain this for viva, in 3 bullet points, or as a data-flow story.