## 1 Introduction
A fast fault self-repairing capability after discovering the unintended behavior or instruction fault is critically important to providing a comprehensive protection for an embedded system, especially for embedded systems that are applied in remote-controlled platforms. At present, the majority of fault self-repairing techniques rely on the checkpoint and rollback-recovery technology, in which the checkpoint is utilized to backup all the data of one correct state in the processor system, while the rollback operation reverts the process back to a recently-saved checkpoint once a processor fault is detected and then resumes the normal program execution. In addition, many researchers have proposed hardware redundancy strategies, such as dual modular redundancy (DMR) [18] and triple modular redundancy (TMR) [19] to achieve hardware fault tolerance. However, the approach of simply replicating the structures of sensitive components will result in a high hardware complexity and resource overhead in a resource-limited embedded system. To the best of our of knowledge, attack detection and fault recovery are mostly studied independently in the existing hardware monitoring methods, and their excellent combination could help to improve the security capability of embedded system against various attacks. After we comprehensively assessed the advantages and disadvantages of previous protections, the security designs for embedded systems still face the following three challenges:(1) how to reduce the performance overhead induced by real-time security validation; (2) how to configure a processor with a fault self-repairing capability; and (3) how to ensure the practicality of hardware security design to be equally applicable for other different ISA platforms. In order to overcome the above three challenges of embedded system security architecture, this paper presents a hardware-implemented security processing unit (SPU) for providing real-time program execution monitoring and instruction fault self-repairing, where the internal structure consists of an instruction monitor and a fault self-repairing module (FSRM). The checkpoint-rollback mechanism applied in FSRM is tightly coupled to the program basic block (BB) integrity signature monitoring mechanism of the instruction monitor. The specific contributions of this paper are summarized as follows. * A security processing unit (SPU) is constructed into the embedded system for building the proposed CPU-SPU collaborative SoC. In the SPU, both the instruction monitor and FSRM were constructed to monitor the program execution and instruction fault self-repairing in real-time, where the real-time program execution monitoring was actualized by the instruction monitor, and the instruction fault self-repairing was actualized by FSRM. * The program basic block's (BB's) integrity checking mechanism is adopted in the instruction monitor, which is tightly coupled with the checkpoint-rollback mechanism of FSRM. Any instruction tampering behaviors caused by hardware Trojans will be detected and self-repaired by the SPU, and artificial program modification also can be detected. * In order to reduce the performance overhead of SPU induced by integrity verification and fault self-repairing, the I/D-Caches and monitor cache (M-Cache) are relicitously configured with the optimal size of 8 KB, and the average performance overhead of SPU in running different benchmarks reduces to as low as 1.92%. * Security capability evaluation and hardware implementation evaluation of the SPU in both the FPGA platform and ASIC design confirm that the CPU-SPU collaborative SoC achieved a good balance in high-security capability, low performance overhead, and reasonable hardware complexity. The remainder of this paper is organized as follows. Section 2 introduces the trustworthy assumptions and threat models of SoC considered in this paper. The preparatory works related to program monitoring and fault self-repairing are described in Section 3.