Comprehensive evaluation method and system for hardware security of universal processor

Abstract

The invention discloses a general processor hardware security comprehensive evaluation method and system, and belongs to the technical field of chip security. The method comprises the following steps: constructing hardware security requirements of a processor chip, wherein the hardware security requirements comprise a function correctness requirement, a data integrity requirement, an information privacy requirement and a system availability requirement; according to the influence of each hardware security requirement on the processor chip, carrying out importance assignment on the hardware security requirement; based on the micro-architecture schematic diagram of the processor, obtaining a hardware security requirement set corresponding to the processor; wherein each hardware security requirement corresponds to a plurality of test cases; based on the test case, determining detection and / or random testing of the processor are / is completed; and obtaining a hardware security comprehensive evaluation result of the processor according to the detection result and the importance assignment of the hardware security requirement. According to the invention, comprehensive evaluation of the hardware security of the general processor can be realized.

Description

Technical Field

[0001] The present invention relates to the field of chip security technology, and in particular to a method and system for comprehensive evaluation of hardware security of a general-purpose processor. Background Art

[0002] General-purpose processor chips are used in a large number of important industries such as communications, manufacturing, and rail transportation. With the development of technology, the above industries have begun to pay attention to the hardware security of processor chips. How to comprehensively evaluate the overall hardware security of processor chips is the key problem to be solved by the present invention.

[0003] Existing analysis methods have the following shortcomings when it comes to processor security evaluation:

[0004] 1. Mainly based on document analysis, lack of effective technical analysis methods;

[0005] 2. Failure to comprehensively consider the impact of security functions and security vulnerabilities on overall security;

[0006] 3. Lack of calculation methods for comprehensive safety evaluation. Summary of the invention

[0007] The present invention proposes a general-purpose processor hardware security comprehensive evaluation method and system, which tests the security requirements of processor chips by combining deterministic testing and random testing. At the same time, a comprehensive scoring method based on security requirements and their importance is formulated to achieve a comprehensive evaluation of the general-purpose processor hardware security.

[0008] To achieve the above objectives, the technical solution of the present invention includes the following contents.

[0009] A method for comprehensive hardware security evaluation of a general-purpose processor, the method comprising:

[0010] Establishing hardware security requirements for processor chips, including functional correctness requirements, data integrity requirements, information privacy requirements, and system availability requirements;

[0011] Assign importance to each hardware security requirement based on its impact on the processor chip;

[0012] Based on the microarchitecture diagram of the processor, a set of hardware safety requirements corresponding to the processor is obtained; wherein each hardware safety requirement corresponds to multiple test cases;

[0013] Performing deterministic testing and / or random testing of the processor based on the test case;

[0014] Based on the detection results and the importance assignment of the hardware safety requirements, a comprehensive hardware safety evaluation result of the processor is obtained.

[0015] Furthermore, the data integrity requirements include: basic integrity requirements and advanced integrity requirements; wherein,

[0016] The basic integrity requirements include:

[0017] Configuration / control registers and status registers related to the basic functions of the processor should not be tampered with;

[0018] and / or,

[0019] The processor includes circuits or sensors for checking multiple voltage and clock glitches;

[0020] and / or,

[0021] There are no high-risk CVE vulnerabilities and CWE defects involving integrity;

[0022] The high-level integrity requirements include:

[0023] During the trusted verification process, the registers storing the trusted verification and measurement results, or the trusted root of trust used to perform the trusted verification, are not tampered with or bypassed;

[0024] and / or,

[0025] The configuration / control registers and status registers involved in the security domain cannot be tampered with;

[0026] and / or,

[0027] There are no medium-risk CVE vulnerabilities or CWE flaws involving integrity.

[0028] Furthermore, the information privacy requirements include: basic confidentiality requirements and advanced confidentiality requirements; wherein,

[0029] The basic confidentiality requirements include:

[0030] Objects involved in sharing and permission control in the processor will not have illegal access errors across permissions;

[0031] and / or,

[0032] The physical access control mechanism of the processor should not allow unauthorized participants to access the protected areas;

[0033] and / or,

[0034] The debugging function of the processor should not allow unauthorized participants to tamper with or access protected areas in a specific mode;

[0035] and / or,

[0036] The processor's encryption and decryption modules should not have side channel information leakage;

[0037] and / or,

[0038] There are no high-risk CVE vulnerabilities and CWE flaws involving confidentiality;

[0039] The high-level confidentiality requirements include:

[0040] Processors with security domains should not have illegal information access across security domains;

[0041] and / or,

[0042] Objects involved in sharing and permission control in the processor should not forward information across permission domains;

[0043] and / or,

[0044] There are no medium-severity CVE vulnerabilities or CWE flaws involving confidentiality.

[0045] Furthermore, the system availability requirements include: basic system availability requirements and advanced system availability requirements; wherein,

[0046] The basic system availability requirements include:

[0047] There are no high-risk CVE vulnerabilities and CWE defects involving availability;

[0048] and / or,

[0049] The mean time between failures, mean time between failures and mean time to repair of the processor shall not be lower than the reliability requirements of the entire information system by the demander;

[0050] The high-level system availability requirements include: no medium-severity CVE vulnerabilities and CWE defects related to availability.

[0051] Furthermore, the micro-architecture diagram based on the processor is used to obtain a set of hardware security requirements corresponding to the processor, including:

[0052] identifying a border of the microarchitecture schematic;

[0053] Determine whether there is annotated text in the border area;

[0054] In the case where there are annotated texts, object unit recognition is performed based on the annotated texts to obtain the model of the processor;

[0055] In the absence of annotated text, image matching is performed on the microarchitecture schematic diagram based on the cell library to obtain the model of the processor;

[0056] Gets the security requirement set corresponding to the processor model.

[0057] Further, completing the determination and detection of the processor based on the test case includes:

[0058] Generate test input according to the input instruction sequence and operands required by the test case;

[0059] Based on the test input, detecting whether the output of the processor meets the test case output requirements;

[0060] If the output requirements are met, the test case passes;

[0061] If the output requirements are not met, the test case fails.

[0062] Further, completing random testing of the processor based on the test case includes:

[0063] Extract the tested address and input instruction sequence of the test case;

[0064] Generate a test input sequence according to the tested address and the input instruction sequence;

[0065] Based on the test input, detecting whether the output of the processor meets the test case output requirements;

[0066] If the output requirements are not met, the test case fails;

[0067] If the output requirements are met, the coverage rate (N t +M t ) / (N+M), and combined with a set threshold, determine whether the test case has passed the test; where N t is the number of instructions used in the actual test, M t is the number of operands used in the actual test, N is the number of instructions available to the processor, and [0, M-1] is the range of operands available to the processor;

[0068] In the case where the test case fails the test based on the coverage, after mutating the instructions and operands, the test input is re-executed to detect whether the output of the processor meets the test case output requirement.

[0069] Furthermore, according to the importance of the detection result and the hardware security requirement, a comprehensive hardware security evaluation result of the processor is obtained, including:

[0070] Calculate test penalty points for each hardware safety requirement Among them, d i represents the importance of the i-th hardware safety requirement, q irepresents the number of test cases corresponding to the i-th hardware safety requirement that has passed the test in the detection, p i represents the number of confirmed detection test cases corresponding to the i-th safety requirement, T npi Represents the set of test cases that failed in any test, s i represents the number of random detection test cases corresponding to the i-th safety requirement, c j represents the tool detection coverage corresponding to the jth test case in random detection;

[0071] Calculate the hardware security score for this processor Among them, A means the total score required;

[0072] Based on the hardware security score Z, a comprehensive hardware security evaluation result of the processor is obtained.

[0073] A hardware security comprehensive evaluation system for a general-purpose processor, the system comprising:

[0074] A construction module, used to construct hardware security requirements for processor chips, wherein the hardware security requirements include functional correctness requirements, data integrity requirements, information privacy requirements, and system availability requirements;

[0075] An assignment module, used to assign importance to each hardware security requirement according to its impact on the processor chip;

[0076] The processing module agrees to obtain a set of hardware security requirements corresponding to the processor based on a micro-architecture diagram of the processor; wherein each hardware security requirement corresponds to a plurality of test cases;

[0077] A testing module, used to perform a deterministic test and / or a random test of the processor based on the test case;

[0078] The evaluation module is used to assign importance values ​​to the detection results and hardware safety requirements to obtain a comprehensive hardware safety evaluation result of the processor.

[0079] An electronic device, characterized in that the electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the hardware security comprehensive evaluation method of the general-purpose processor described in any one of the above items is implemented.

[0080] Compared with the prior art, the present invention has at least the following beneficial effects.

[0081] 1. The content of processor hardware security testing is defined by adopting a security requirement set approach, including four dimensions: functional correctness, data integrity, information privacy, and system availability.

[0082] 2. Use the importance assignment method to define the importance of each safety requirement. The importance assignment affects the deduction score after the test.

[0083] 3. Use a testing method that combines deterministic testing and random testing, and include whether to use random testing in the final safety evaluation classification basis. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] Figure 1 Flowchart of the comprehensive evaluation method for hardware security of general-purpose processors.

[0085] Figure 2 Flowchart of processor model extraction.

[0086] Figure 3 Flowchart of random testing. DETAILED DESCRIPTION

[0087] The present invention is further described in detail below in conjunction with specific embodiments. The given examples are only for illustrating the present invention, but not for limiting the scope of the present invention.

[0088] The general processor hardware security comprehensive evaluation method of the present invention is as follows: Figure 1 As shown, the following steps are included:

[0089] 1. Build a set of processor chip hardware security requirements.

[0090] The first step of the present invention is to formulate a hardware security requirement set {r i ,i=0,1,…,N}, where N is the number of security requirements. Hardware security requirements are descriptions of the functional correctness requirements and system security requirements that the processor chip should meet.

[0091] 1) Functional correctness requirements.

[0092] Functional correctness requirements can be divided into two categories: basic functional requirements set and advanced functional requirements set. The basic functional requirements set is a set of functions that do not involve security domains. The advanced functional requirements set includes basic functional requirements and should also include a set of functional requirements related to security domains.

[0093] The functional correctness description consists of three parts: environmental conditions, input conditions, and output requirements.

[0094] 2) System security requirements.

[0095] System security mainly includes three security attributes: data integrity, information privacy and system availability. The description of each security attribute should include three parts: environmental conditions, processor object module and security attribute requirements.

[0096] Data integrity requirements.

[0097] Data integrity requirements mainly describe the requirements for data tampering in processor-specific object modules under certain environmental conditions.

[0098] Integrity testing content: divided into basic integrity requirements and advanced integrity requirements.

[0099] Under the operating environment conditions of the processor (environmental conditions), the basic requirements for processor integrity are as follows:

[0100] 1) Configuration / control registers and status registers (processor object module) related to the basic functions of the processor should not be tampered with (security attribute requirement).

[0101] 2) The processor contains necessary circuits or sensors to detect multi-level voltage and clock glitches.

[0102] 3) There are no high-risk CVE vulnerabilities and CWE defects involving integrity.

[0103] The high-level requirements for processor integrity include the basic requirements and should also include the following requirements:

[0104] 1) During the trusted verification process, the registers storing the trusted verification and measurement results, or the trusted root of trust used to perform the trusted verification, cannot be tampered with or bypassed.

[0105] 2) Configuration / control registers and status registers involving the security domain should not be tampered with.

[0106] 3) There are no medium-risk CVE vulnerabilities and CWE flaws involving integrity.

[0107] The tester and the user should formulate specific safety requirements that meet the above requirements, for example:

[0108] Example: In a physically isolated network environment (environmental conditions), the configuration registers of the processor (object module) should not be tampered with (security attribute requirements)

[0109] Information privacy requirements.

[0110] Information privacy requirements describe situations in which, under certain environmental conditions, unauthorized access to specific object modules (such as memory and registers) within the processor and information leakage may occur.

[0111] Information privacy testing content: divided into basic confidentiality requirements and advanced confidentiality requirements.

[0112] Under the operating environment conditions of the processor, the basic requirements for processor confidentiality are as follows:

[0113] 1) Objects involved in sharing and permission control in the processor (including Pagetable, address space, registers, memory, bus, execution unit, etc.) should not have cross-permission illegal access errors.

[0114] 2) The physical access control mechanism of the processor should not allow unauthorized participants to access the protected areas.

[0115] 3) The debugging function of the processor should not allow unauthorized participants to tamper with or access protected areas in specific modes.

[0116] 4) The encryption and decryption module of the processor should not have side channel information leakage.

[0117] 5) There are no high-risk CVE vulnerabilities and CWE flaws involving confidentiality.

[0118] The high-level requirements for processor confidentiality include the basic requirements and should also include the following requirements:

[0119] 1) For processors with security domains, illegal information access across security domains should not occur.

[0120] 2) Objects involved in sharing and permission control in the processor (including Pagetable, address space, registers, memory, bus, execution unit, etc.) should not forward information across permission domains.

[0121] 3) There are no medium-risk CVE vulnerabilities and CWE flaws involving confidentiality.

[0122] System availability requirements.

[0123] System availability requirements describe the service interruption situations that occur under certain environmental conditions.

[0124] Under the operating environment conditions of the processor, the basic availability requirements of the processor are as follows:

[0125] 1) There are no high-risk CVE vulnerabilities and CWE defects involving availability.

[0126] 2) The mean time between failures, mean time between failures, and mean time to repair of the processor shall not be lower than the reliability requirements of the entire information system by the demander.

[0127] The advanced availability requirements for processors include the basic availability requirements and should also include the following requirements:

[0128] 1) There are no medium-severity CVE vulnerabilities and CWE flaws related to availability.

[0129] 2. Assignment of processor hardware security importance.

[0130] According to the impact of each safety requirement on the target, the importance of each safety requirement is assigned. If the safety requirement fails the test in the subsequent test, points will be deducted according to the importance assigned. The importance assigned to the i-th safety requirement is denoted as d i .

[0131] Table 1 Importance assignment table

[0132]

[0133] 3. Automated security requirements testing.

[0134] Automated test case generation first automatically extracts modules from the processor microarchitecture schematic to match the object module that should be tested for this model test. Then, the set of security requirements that the module should meet is searched to form a test case set. Each security requirement will correspond to multiple test cases, which contain the object module, input instruction sequence, and input and output requirements of the security requirement.

[0135] 1) Automatic extraction of the module under test

[0136] The image classifier based on neural network is used to automatically cut, identify and extract the processor micro-architecture modules. Figure 2 shown.

[0137] 2) Confirm the detection

[0138] Automated safety requirement testing is divided into two parts: deterministic testing and random testing. Deterministic testing is mainly functional testing, and its goal is to detect whether the processor correctly implements the functions required in the functional specification. Deterministic testing automatically screens the test cases to be tested based on the matched processor object module. According to the input instruction sequence and operands required by the test case, the test input is generated, and the object module output is tested to see if it meets the test case output requirements. If it meets the output requirements, the test passes, otherwise, the test fails.

[0139] 3) Random testing

[0140] Random detection uses an intelligent fuzzy testing method based on coverage feedback to test whether there will be no violation of reliability properties under various unexpected random input conditions, thereby reducing the risk of exploitable vulnerabilities in the processor. The flowchart is as follows Figure 3 shown.

[0141] During random testing, the coverage is calculated based on the number of instructions and operands covered in the test case. If the number of instructions available to the object module is N, and the operand range is [0, M-1], the number of instructions used in the actual test is N. t , the number of operands is M t , then the coverage is (Nt +M t ) / (N+M).

[0142] 4. Score the test results.

[0143] 1) Scoring steps for a single safety requirement

[0144] The result of the functional detection test case is pass or fail. If the number of functional detection test cases corresponding to the i-th safety requirement is p i , where the number of test cases that pass the test is q i , then the test pass rate is q i / p i Assume that the importance of this safety requirement is assigned to d i , then the test deduction for this safety requirement is d i (1-q i / p i ).

[0145] In addition to passing or failing, the random detection test results should also include the coverage of the tool for the functional unit during this test. If the number of random detection test cases corresponding to the i-th safety requirement is s i , where the number of test cases that pass the test is t i , assuming that the set of test cases that pass is T pi , the set that failed is T npi , the tool detection coverage corresponding to the jth test case is c j The importance of the i-th safety requirement is assigned to d i , then the test deduction for the i-th safety requirement is

[0146] 2) Overall scoring steps

[0147] a) Basic requirements scoring criteria:

[0148] If the total score of the basic requirements is 100, the test score is If the total score is greater than 90 points, the basic requirements are passed, otherwise the basic requirements are not passed.

[0149] b) Advanced Requirements Scoring Criteria:

[0150] If the total score of the advanced requirement is 100, the test score is If the total score is greater than 90 points, the advanced requirement is passed, otherwise the advanced requirement is not passed.

[0151] 4. Comprehensive Rating of Processor Chip Hardware Security

[0152] An overall rating of the processor hardware security level is given based on whether the basic and advanced requirements are passed, and whether random testing methods are used during the testing process.

[0153] The rating method is:

[0154]

[0155] The above embodiments are only for illustrating the technical concept and features of the present invention, and their purpose is to enable people familiar with the technology in this field to understand the content of the present invention and implement it, and they cannot be used to limit the protection scope of the present invention. Any equivalent changes or modifications made according to the spirit of the present invention should be included in the protection scope of the present invention.

Claims

1. A hardware security comprehensive evaluation method for a general-purpose processor, characterized in that: The method comprises: Establishing hardware security requirements for processor chips, including functional correctness requirements, data integrity requirements, information privacy requirements, and system availability requirements; Assign importance to each hardware security requirement based on its impact on the processor chip; Based on the microarchitecture diagram of the processor, a set of hardware safety requirements corresponding to the processor is obtained; wherein each hardware safety requirement corresponds to multiple test cases; Performing deterministic testing and / or random testing of the processor based on the test case; Based on the detection results and the importance assignment of the hardware safety requirements, a comprehensive hardware safety evaluation result of the processor is obtained.

2. The method according to claim 1, characterized in that The data integrity requirements include: basic integrity requirements and advanced integrity requirements; The basic integrity requirements include: Configuration / control registers and status registers related to the basic functions of the processor should not be tampered with; and / or, The processor includes circuits or sensors for checking multiple voltage and clock glitches; and / or, There are no high-risk CVE vulnerabilities and CWE defects involving integrity; The high-level integrity requirements include: During the trusted verification process, the registers storing the trusted verification and measurement results, or the trusted root of trust used to perform the trusted verification, are not tampered with or bypassed; and / or, The configuration / control registers and status registers involved in the security domain cannot be tampered with; and / or, There are no medium-risk CVE vulnerabilities or CWE flaws involving integrity.

3. The method according to claim 1, characterized in that The information privacy requirements include: basic confidentiality requirements and advanced confidentiality requirements; among which, The basic confidentiality requirements include: Objects involved in sharing and permission control in the processor will not have illegal access errors across permissions; and / or, The physical access control mechanism of the processor should not allow unauthorized participants to access the protected areas; and / or, The debugging function of the processor should not allow unauthorized participants to tamper with or access protected areas in a specific mode; and / or, The processor's encryption and decryption modules should not have side channel information leakage; and / or, There are no high-risk CVE vulnerabilities and CWE flaws involving confidentiality; The high-level confidentiality requirements include: Processors with security domains should not have illegal information access across security domains; and / or, Objects involved in sharing and permission control in the processor should not forward information across permission domains; and / or, There are no medium-severity CVE vulnerabilities or CWE flaws involving confidentiality.

4. The method according to claim 1, characterized in that: The system availability requirements include: basic system availability requirements and advanced system availability requirements; The basic system availability requirements include: There are no high-risk CVE vulnerabilities and CWE defects involving availability; and / or, The mean time between failures, mean time between failures and mean time to repair of the processor shall not be lower than the reliability requirements of the entire information system by the demander; The high-level system availability requirements include: no medium-severity CVE vulnerabilities and CWE defects related to availability.

5. The method according to claim 1, characterized in that The step of obtaining a set of hardware security requirements corresponding to the processor based on the micro-architecture diagram of the processor includes: identifying a border of the microarchitecture schematic; Determine whether there is annotated text in the border area; In the case where there are annotated texts, object unit recognition is performed based on the annotated texts to obtain the model of the processor; In the absence of annotated text, image matching is performed on the microarchitecture schematic diagram based on the cell library to obtain the model of the processor; Gets the security requirement set corresponding to the processor model.

6. The method according to claim 1, characterized in that The processor is determined and tested based on the test case, including: Generate test input according to the input instruction sequence and operands required by the test case; Based on the test input, detecting whether the output of the processor meets the test case output requirements; If the output requirements are met, the test case passes; If the output requirements are not met, the test case fails.

7. The method according to claim 1, characterized in that The random test of the processor is completed based on the test case, including: Extract the tested address and input instruction sequence of the test case; Generate a test input sequence according to the tested address and the input instruction sequence; Based on the test input, detecting whether the output of the processor meets the test case output requirements; If the output requirements are not met, the test case fails; If the output requirements are met, the coverage rate (N t +M t ) / (N+M), and combined with a set threshold, determine whether the test case has passed the test; where N t is the number of instructions used in the actual test, M t is the number of operands used in the actual test, N is the number of instructions available to the processor, and [0, M-1] is the range of operands available to the processor; In the case where the test case fails the test based on the coverage, after mutating the instructions and operands, the test input is re-executed to detect whether the output of the processor meets the test case output requirement.

8. The method according to claim 1, characterized in that According to the detection results and the importance of hardware security requirements, a comprehensive hardware security evaluation result of the processor is obtained, including: Calculate test penalty points for each hardware safety requirement Among them, d i represents the importance of the i-th hardware safety requirement, q i represents the number of test cases corresponding to the i-th hardware safety requirement that has passed the test in the detection, p i represents the number of confirmed detection test cases corresponding to the i-th safety requirement, T npi Represents the set of test cases that failed in any test, s i represents the number of random detection test cases corresponding to the i-th safety requirement, c j represents the tool detection coverage corresponding to the jth test case in random detection; Calculate the hardware security score for this processor Among them, A means the total score required; Based on the hardware security score Z, a comprehensive hardware security evaluation result of the processor is obtained.

9. A hardware security comprehensive evaluation system for a general-purpose processor, characterized in that: The system comprises: A construction module, used to construct hardware security requirements for processor chips, wherein the hardware security requirements include functional correctness requirements, data integrity requirements, information privacy requirements, and system availability requirements; An assignment module, used to assign importance to each hardware security requirement according to its impact on the processor chip; The processing module agrees to obtain a set of hardware security requirements corresponding to the processor based on a micro-architecture diagram of the processor; wherein each hardware security requirement corresponds to a plurality of test cases; A testing module, used to perform a deterministic test and / or a random test of the processor based on the test case; The evaluation module is used to assign importance values ​​to the detection results and hardware safety requirements to obtain a comprehensive hardware safety evaluation result of the processor.

10. An electronic device, characterized in that: The electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the hardware security comprehensive evaluation method of the general-purpose processor as described in any one of claims 1 to 8 is implemented.

Images