Fault attack simulation

Abstract

A method, system and apparatus for fault attack simulation. A circuit design and a fault attack simulation model are obtained that defines characteristics of a multi-click attack to be simulated in a circuit. The fault attack simulation model defines at least a number of hits during a multi-strike attack, a time window simulating the multi-strike attack, and a list of potentially attacked circuit elements of the circuit during the multi-strike attack. Based on the fault attack simulation model, a plurality of fault attacks are generated that follow the fault attack simulation. Each generated fault attack includes a plurality of hits occurring for the list of potentially attacked circuit elements during a time window. The resulting fault attack is simulated using a hardware simulator that simulates the circuit design. And outputting the simulation result to the user.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is a non-provisional application and claims priority to U.S. Provisional Patent Application No. 63 / 363,749, filed on April 28, 2022, entitled “Fault Attack Simulation,” the disclosure of which is incorporated herein by reference in its entirety without disclaimer. Technical Field

[0003] The present invention relates generally to circuit design and, in particular, to verification of circuit designs. Background Art

[0004] The design process of a circuit involves planning the design of the circuit and performing verification to ensure that the circuit operates reliably and meets the required specifications. Verification can be performed on both logical and physical designs. It involves testing and verifying that the design meets the required specifications and operates correctly.

[0005] Logic design, also known as register transfer level (RTL) design, is the process of creating a high-level, abstract representation of a circuit's functionality. In RTL design, designers describe the behavior of a circuit using a hardware description language (HDL), such as Verilog or VHDL. An RTL design defines the input and output ports of the circuit, as well as the internal logic blocks necessary to implement the desired functionality, including combinational gates (also referred to herein as "gates") and storage elements, also referred to herein as flip-flops (e.g., flip-flops, latches, etc.). RTL designs can be simulated to ensure that the circuit behaves as expected and meets the functional requirements.

[0006] Physical design, on the other hand, is the process of converting the logical design into an actual physical circuit. This includes placing and routing circuit elements (such as gates, flip-flops, and wires) on a physical chip layout. Physical design also includes ensuring that the circuit meets timing and power constraints, and optimizing the circuit for performance, power, and area.

[0007] In order to shorten the circuit development time, functional verification can be performed before physical design and based on functional design. Summary of the invention

[0008] An exemplary embodiment of the disclosed subject matter is a method, an apparatus, or a system. The method includes: obtaining a circuit design, wherein the circuit includes circuit elements, the circuit elements including gates, flip-flops, and wires; obtaining a fault attack simulation model, the fault attack simulation model defining characteristics of a multi-hit attack to be simulated in the circuit, the fault attack simulation model defining at least: a number of hits during the multi-hit attack; a time window for simulating the multi-hit attack; and a list of circuit elements potentially attacked during the multi-hit attack, the list of circuit elements potentially attacked being a subset of the circuit elements. The method also includes: based on the fault attack simulation model, automatically generating a plurality of fault attacks that follow the fault attack simulation, wherein each of the plurality of fault attacks includes a plurality of hits occurring for the list of circuit elements potentially attacked during the time window, wherein the number of hits in the plurality of hits corresponds to the number of hits defined by the fault attack simulation model. The method also includes, for each of the plurality of fault attacks, simulating the fault attack on the circuit design, wherein the simulation is performed using a hardware simulator simulating the circuit design. The method also includes outputting the results of the simulation to a user.

[0009] Optionally, the fault attack simulation model further defines the fault type occurring in the hit, wherein the fault type includes a single event upset, a stuck-at fault, and a bridging fault.

[0010] Optionally, the fault attack simulation model is a pulse-based fault attack simulation model, wherein the pulse-based fault attack simulation model includes a target position of a pulse attack, wherein the target position of the pulse attack defines the list of circuit elements that are potentially attacked.

[0011] Optionally, the design is a physical design of the circuit, which defines the physical layout of the circuit elements, wherein the target location is a physical location in the physical design of the circuit, wherein the method further includes: determining a radius of the pulse attack; determining a pulse attack area based on the physical location and radius of the pulse attack; and identifying circuit elements within the pulse attack area to define the list of potentially attacked circuit elements.

[0012] Optionally, the pulse-based fault attack simulation model includes a pulse intensity attribute, wherein the radius of the determined pulse attack is determined based on the pulse intensity attribute.

[0013] Optionally, the pulse-based fault attack simulation model includes a pulse intensity attribute, wherein the number of hits during the multi-hit attack is determined based on the pulse intensity attribute.

[0014] Optionally, the design is a logic design, wherein the target location is a target circuit element selected from the circuit elements, wherein the method further comprises: determining the list of potentially attacked circuit elements based on a logical proximity to the target circuit element.

[0015] Optionally, the determining the list of potentially attacked circuit elements comprises: performing forward and backward reachability analysis from the target circuit elements.

[0016] Optionally, the forward and backward reachability analysis is performed based on a cycle-based distance from the target circuit element.

[0017] Optionally, the pulse attack is at least one of a laser attack and an electromagnetic (EM) attack.

[0018] Optionally, the pulse-based fault attack simulation model defines a first hit type for gates included in the list of potentially attacked circuit elements, wherein the pulse-based fault attack simulation model defines a second hit type for triggers included in the list of potentially attacked circuit elements.

[0019] Optionally, the fault attack simulation model is a timing-based fault attack simulation model, wherein the timing-based fault attack simulation model is related to a timing-based fault attack, and the timing-based fault attack is configured to affect the timing of registering the value of one or more triggers, wherein the list of potentially attacked circuit elements consists of one or more triggers.

[0020] Optionally, the timing-based fault attack is at least one of a voltage glitch attack and a clock glitch attack.

[0021] Optionally, the one or more triggers constituting the list of potentially attacked circuit elements are determined based on critical timing paths in the circuit design.

[0022] Optionally, the one or more flip-flops constituting the list of potentially attacked circuit elements are determined based on an estimated time budget of combinatorial logic driving the one or more flip-flops.

[0023] Optionally, the list of potentially attacked circuit elements is determined based on exclusion rules that exclude elements based on security asset information analysis of the circuit design.

[0024] Optionally, the security asset information analysis includes: acquiring one or more security circuit elements, the one or more security circuit elements being circuit elements considered as security assets; and classifying the circuit elements based on corresponding relationships with the one or more circuit elements.

[0025] Optionally, the classification includes classifying each element as at least one of: a load of the one or more safety circuit elements; a driver of the one or more safety circuit elements; and independent of the one or more safety circuit elements.

[0026] Optionally, the security asset information analysis is performed for one or more security circuit elements, wherein the exclusion rule excludes circuit elements classified as not relevant to the one or more security circuit elements.

[0027] Optionally, the method includes: obtaining one or more user instructions that define strobe signals, wherein the strobe signals are defined based on changes relative to a hit-free execution of the circuit design; wherein the simulation includes evaluating a value of the strobe signal; and wherein a result of the simulation is determined based on the value of the strobe signal.

[0028] Optionally, the strobe signal comprises a failure strobe, wherein the failure strobe indicates a successful simulated attack, wherein the result of the simulation comprises an indication of a number of successful simulated attacks out of a total number of simulated attacks attempted.

[0029] Optionally, the strobe signal comprises a detection strobe, wherein the detection strobe indicates successful detection of a simulated attack by an on-chip detection mechanism, wherein the result of the simulation comprises an indication of a number of successful detections of attempted simulated attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The subject matter disclosed in the present invention may be more fully understood and appreciated from the following detailed description in conjunction with the accompanying drawings, wherein corresponding or similar numbers or characters represent corresponding or similar components. Unless otherwise specified, the accompanying drawings provide exemplary embodiments or aspects of the present disclosure and do not limit the scope of the present disclosure. In the accompanying drawings:

[0031] Figure 1A shows a diagram of a trajectory according to some exemplary embodiments of the disclosed subject matter;

[0032] Figure 1B-Figure 1E A diagram showing a multi-hit fault attack according to some exemplary embodiments of the disclosed subject matter;

[0033] Figure 2A diagram showing classification based on secure asset information (SAI) according to some exemplary embodiments of the disclosed subject matter;

[0034] Figure 3 shows a laser attack in a physical design according to the disclosed subject matter;

[0035] Figure 4 shows a laser attack in a logic design according to the disclosed subject matter;

[0036] Figure 5A A flowchart illustrating a method according to some exemplary embodiments of the disclosed subject matter;

[0037] Figure 5B a flowchart illustrating a method according to some exemplary embodiments of the disclosed subject matter; and

[0038] Figure 6 A diagram of a screen displaying the output of the fault attack simulation is shown according to some exemplary embodiments of the disclosed subject matter. DETAILED DESCRIPTION

[0039] In the present invention, the term "signal" refers to an element of a circuit design that receives a value. A signal can be any line in the design, such as but not limited to an input, an output, an output of a storage element, an input of a storage element, an output of a gate, etc.

[0040] In the present invention, the term "storage element" or "flip-flop" refers to any circuit element that stores data in different cycles, including but not limited to flip-flops, registers, latches, counters, digital elements with the ability to store their values, etc.

[0041] One technical problem to which the disclosed subject matter relates is to verify and identify weaknesses in a circuit design. In some cases, it may be necessary to verify that the design is not vulnerable to attack. TM The Common Weakness Enumeration (CWE TM)) Identify potential weaknesses that could be exploited by a hacker trying to break into the circuit. For example, "CWE-1332: Improper Error Handling Causing Instruction Skipping" is a weakness that could be exploited in this way. An attacker could use fault injection techniques to change the operating conditions of the hardware so that safety-critical instructions are skipped more frequently or more reliably than in a "natural" setting. As another example, a flaw in the form of "CWE-1248: Semiconductor Flaw in Hardware Logic with Security-Sensitive Implications" could manifest as a glitch on a chip's internal signals or registers, with the effect that an input, output, or intermediate signal is always 0 or always 1, and does not switch as expected. The weakness "CWE-1247: Improper Protection against Voltage and Clock Glitches" concerns improper protection against attacks such as voltage glitches and clock glitches, which an attacker could use to compromise the system. The weakness "CWE-1319: Improper Protection against Electromagnetic Fault Injection (EM-FI)" concerns situations where a device is vulnerable to electromagnetic fault injection attacks, resulting in the device's internal information being compromised or safety mechanisms being bypassed. As additional examples, related weaknesses may also include "CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy", "CWE-1256: Improper Restriction of Hardware Functionality by Software Interface", "CWE-1261: Improper Handling of Single Event Upset", "CWE-1255: Comparison Logic is Vulnerable to Power Side Channel Attack", etc. It may be desirable to perform validation in an attempt to discover such weaknesses as well as other security-related weaknesses.

[0042] It may be desirable to perform verification early in the design process. In some cases, it may be desirable to perform such verification on a logical design (e.g., based only on an RTL design). Additionally or alternatively, some aspects of verification may be performed after the physical design is complete.

[0043] Usually, hackers conduct attacks under laboratory conditions. Attackers use different means (such as laser beams, electromagnetic (EM) radiation, changing the voltage at which the chip works, changing the clock frequency, etc.) to inject faults on real / physical chips. Such means may cause the chip to fail, or cause internal faults in the chip. For example, a flip-flop may not sample the correct data and provide incorrect values; the signal value of a gate, wire, or flip-flop may be flipped (for example, 0 instead of 1, or vice versa); the penetration fault in the chip may manifest itself as, for example, stuck at 0, stuck at 1, etc. The goal of the attacker is that the fault they inject will cause the protection mechanism inside the chip to fail, and some secret data inside the chip (called secret assets (SA)) is leaked to the outside and may be captured by hackers using side channel methods. SA can enable designs (also called designs under test (DUT)) to perform many functions, including: obtaining access to service networks to which they belong, for example: access to mobile networks, being able to decrypt conditional access media, accessing a bank's remote banking server; providing security services to users, such as: secure storage and access control of user passwords, licenses or loyalty data, encryption of removable storage data such as hard drives or USB memory sticks, allowing remote access to and secure communication with corporate networks; ensuring its own operational integrity by: booting from authenticated and encrypted boot software, running only authenticated programs, securely storing device-specific data (such as configuration and feature enablement settings, operating parameters (e.g., radio transmitter settings), etc.).

[0044] A simple solution to this need could be to simulate hits in the circuit. However, if the hits are randomly generated without any focus, they may not adequately represent a potential attack. For example, an attacker may focus her attention to target only a specific part of the design. As another example, an attacker may utilize different means to indicate the potentially affected parts of the design.

[0045] Before making the design, it is necessary to simulate fault attacks. In some cases, simulating the logical design may be useful. In other cases, it may be necessary to simulate the physical design.

[0046] One solution is to provide a fault simulation engine. The fault simulation engine can utilize a hardware simulator that is applicable to a logical or physical design and is used to simulate the operation of the DUT when performing a fault attack. The simulation can be implemented using any commercial simulator. The simulation can be implemented by applying specific values ​​to specific signals to simulate the fault. In some cases, the simulator that can be used can be a simulator described in U.S. Patent No. 10025895 entitled "Circuit Simulation Using Reference Execution Records", which is incorporated herein by reference in its entirety.

[0047] In some exemplary embodiments, the disclosed subject matter may utilize a fault attack simulation model. The fault attack simulation model may model a fault attack. The fault attack may be a multi-hit attack that includes multiple hits in a single execution. The hits may occur in the same signal in different cycles. Additionally or alternatively, the hits may occur in different signals in the same cycle. Additionally or alternatively, the hits may occur in different signals in different cycles.

[0048] In some exemplary embodiments, the fault attack simulation model may directly or indirectly define different features of the fault attack. For example, the model may define the number of hits. In some cases, an exact number may be defined. In other cases, a range of numbers may be provided (e.g., between 100 and 200 hits). In some cases, the fault attack simulation model may define the type of fault that occurs in each hit. The fault may be, for example, a bit flip, a single particle flip, a single bit flip, a fixed fault, a bridge fault, etc. In some exemplary embodiments, the fault attack simulation model may directly or indirectly define a time window in which the attack occurs. The time window may be defined as a range of cycles for simulating the attack. Such a time window represents the time when a hacker is assumed to attempt to attack the DUT. In some cases, the time window may depend on the properties of the attack means. For example, the attack duration of the laser pulse, the intensity of the laser, and other properties of the laser-based attack may affect the length of the time window (e.g., 100 cycles, 200 cycles, etc.). In some cases, the attack may be based on a multi-pulse attack, and a set of sub-windows with gaps that are not attacked may be defined. For example, a set of sub-windows (e.g., cycles 200-300, 500-600, 800-900) with a duration of 100 cycles and a gap of 200 cycles can be defined. In other cases, the duration of the gap may not be constant. In some cases, the duration of the sub-window may be different. The model can directly or indirectly define a list of potentially attacked circuit elements, thereby listing circuit elements (e.g., wires, triggers, gates, etc.) that may be affected by the attack. The list can be a subset of a relatively small part of the circuit elements of the design and a potential substantial subset, thereby achieving a concentrated simulation of the attack. The relatively small part can be less than 50% of the elements, less than 30% of the elements, less than 10% of the elements, less than 5% of the elements, less than 3% of the elements, etc. In some cases, the list can be explicitly defined, such as directly listing the elements. In other cases, the list can be implicitly defined and calculated based on other attributes of the attack.

[0049] Consider the following potential fault attack simulation model provided for explanation purposes.

[0050] An example model could be:

[0051] total_attacks 100000

[0052] each_attach_hits{5 10}

[0053] hits_window{50000 51000}

[0054] instance_list{aes_128 / r7}

[0055] The model defines that there will be 5 to 10 hits per attack (each_attack_hits), which occur between cycles 50,000 and 51,000 (hits_window). The model also specifies that hits will only occur on circuit elements representing bits in the seventh round (r7) of an AES128 (AES stands for Advanced Encryption Standard, representing a circuit design that implements cryptographic functions and has a secret asset, such as an encryption key)) module within the DUT. In this example, it is also shown how many attacks will be simulated - 100,000 attempts (total_attacks). This means that the simulator will simulate 100,000 fault attack attempts on the DUT. In each attack, there will be 5 to 10 hits within 50,000 to 51,000 cycles in circuit elements whose names have the prefix "aes_128 / r7".

[0056] For example, a fault attack based on the above model can be:

[0057] {(SEUF,aes_128 / r7

[127] ,50000,0)

[0058] (SEUF,aes_128 / r7

[124] ,50000,0)

[0059] (SEUF,aes_128 / r7

[126] ,50050,0)

[0060] (SEUF,aes_128 / r7

[123] ,50080,0)

[0061] (SEUF,aes_128 / r7

[120] ,50090,0)

[0062] (SEUF,aes_128 / r7

[120] ,50999,0))

[0063] The fault attack consists of 6 hits of the same type (single event subversion faults (SEUFs)) in different signals associated with aes_128 / r7 during different cycles. The time span of each hit is 0, which means that the impact only lasts during the hit cycle and the functionality returns to normal in the subsequent cycles. It is important to note that the hit can start at a certain cycle (t1) and last for a certain duration (len), which can be determined randomly or based on constraints. The hit can stop at cycle t1+len. In some cases, the hit may be permanent and last until the end of execution. It can be seen that in the same cycle (e.g., 50000), different signals are hit (aes_128 / r7

[124] and aes_128 / r7

[127] ). In addition, the same signal (aes_128 / r7

[120] ) is hit in different cycles. This example is a single multi-hit fault attack. According to the exemplary definition above, 1,000,000 such attacks may be generated for verification purposes.

[0064] Another example of a model could be:

[0065] total_attacks 1000000

[0066] each_attach_hits{5 10}

[0067] hits_window{150000 160000}

[0068] instance_list{aes_128 / r8}

[0069] The model defines that each attack (each_attack_hits) has 5 to 10 hits, which occur between cycles 150000 and 160000 (hits_window). In this case, the list of potentially attacked circuit elements is the signal associated with the eighth round of AES (aes_128 / r8).

[0070] Multiple multi-hit fault attacks are generated based on the fault attack simulation model and then simulated. The results of such simulation can be output to the user. In some cases, a strobe can be defined to determine whether the attack is successful. The determination can be based on simulation with faults and simulation without faults (also known as no-hit execution) and the difference between them. For example, if a signal has a different value than in a reference execution, it can be considered that data has been leaked. In some exemplary embodiments, a fail strobe can be used to identify a simulated execution in which data leakage occurs via a side channel or the attack successfully provides the hacker with the desired result. A detect strobe can be used to identify a simulated execution in which an on-chip detection mechanism identifies the fault and reacts to it (e.g., stops execution, takes corrective measures, etc.).

[0071] The output may indicate the number of simulations performed, the number or portion of simulations where the attack was successful, the number or portion of simulations where the attack was detected, etc. In some cases, information may be available for each simulation. Aggregate information may be available and displayed to the user at different levels. For example, a strobe-based partitioning may be displayed to show how many simulations each strobe was triggered in. A signal-based partitioning may be displayed to show how many successful attacks are associated with each attacked signal, thereby drawing the user's attention to different areas of the DUT.

[0072] In some exemplary embodiments, different strobe types may be defined and used to detect a strobe or a fail strobe. For example, a strobe of type "change" may be triggered if there is any change in the value of a monitored signal in a simulated attack compared to a reference execution. Such a strobe may be used as a fail strobe for sensitive signals that should not be affected by the attack. Additionally or alternatively, a strobe of type "change_zero" or "change_one" may be triggered if the value changes to a specific value (e.g., 1 or 0). Such a strobe type may be useful for the output of a three-way lockstep. Additionally or alternatively, a strobe of type "change_threshold" may be triggered if a threshold number of changes (any change or a change of a specific value) is identified in the monitored signal. In some cases, a strobe may be initiated if the total number of changes in a set of monitored signals exceeds a predetermined threshold value N. In other cases, a strobe may be initiated only if there are N or more changes in the same signal (e.g., even if the sum of the changes in all signals is N, no single signal has a changed value compared to a reference execution in N or more cycles). In some exemplary embodiments, a "delay" type of strobe may trigger if the value of a signal appears to be in delay compared to a reference execution. In some cases, a strobe pulse may be triggered if the delay exceeds a threshold number of N cycles. Such a strobe pulse may be useful for detecting delay attacks. In some exemplary embodiments, a "deferential_power" type of strobe pulse may be triggered based on changes in voltage, power consumption, etc. associated with a trigger, a group of triggers, an instance, etc. In some cases, changes within a predetermined range (e.g., + / -N%) are acceptable. Changes outside the range may trigger a strobe. The range may be symmetrical ([-N%, +N%], asymmetrical ([-N%, +M%]), etc. Additionally or alternatively, the range may be defined using relative terms (+N%) or using absolute terms (+N).

[0073] In some exemplary embodiments, a multi-hit fault attack can be generated based on the fault attack simulation model by using a pseudo-random generator, a theorem prover, a constraint satisfaction problem (CSP) solver, a Boolean satisfiability (SAT) solver, using brute force enumeration, etc. The generation can be performed to provide specific values ​​that will be used as multi-hit fault attacks, thereby indicating which elements are hit, and for each hit, indicating which type of hit, in which cycle, duration, etc. The generation can be performed to create different multi-hit fault attacks that follow the fault attack simulation model. In some cases, the generation can create a random sample of multi-hit fault attacks that conform to the fault attack simulation model from a population of all possible multi-hit fault attacks that conform to the fault attack simulation model. In some exemplary embodiments, all multi-hit fault attacks can be generated, and after all such attacks are available, their execution can be simulated. Additionally or alternatively, the generation and simulation can be performed together so that after the attack is generated, it can be simulated before all other attacks are generated. For example, the generation and simulation can be performed sequentially to generate an attack and simulate it before generating a new attack. As another example, after an attack is generated, it may be added to a simulation queue to be dequeued from the queue and simulated once a simulator is available to perform such simulation tasks. The generation may or may not continue to generate new attacks and add them to the queue even before simulating previous attacks.

[0074] In some exemplary embodiments, the fault attack simulation model may be a pulse-based fault attack simulation model that simulates a pulse attack. The pulse attack may be, for example, a laser attack, an electromagnetic attack, etc. The model may include a target location for the pulse attack. The target location represents an area in the circuit design where the pulse attack is concentrated. Based on the target location, a list of circuit elements that are potentially attacked may be calculated.

[0075] For example, in the case where the design is a physical design, the target position can be provided using coordinates within the design (e.g., XY coordinates, XYZ coordinates, etc.). The pulse attack radius around the target position can be determined. The radius can be determined based on the properties of the attack. For example, the radius of a laser attack can be based on the intensity of the laser, based on the type of beam used, etc. The radius can be, for example, 10um, 5um, 10um, etc. The target position and radius together can define a pulse attack area in the physical design. In some exemplary embodiments, based on the physical layout of the circuit elements, the circuit elements located within the pulse attack area can be identified and determined as the list of circuit elements that are potentially attacked. Depending on the chip technology and the type of circuit elements, the corresponding size of the circuit elements can be known, and the number and identity of the circuit elements can be determined. For example, in some cases, 100 gates can have a size of 100nm. In some exemplary embodiments, the duration of the attack can be defined, and this duration can affect the potential duration of the attack. Additionally or alternatively, the type of attack based on the pulse can indicate different types of hits on different types of elements (e.g., a laser attack can cause a flip-flop to flip its value, but cause the gate to be fixed at a specific value, while an EM attack can cause the flip-flop to be fixed at a specific value). In some cases, multi-pulse attacks may also be simulated. In this case, multiple pulses may have different timings but the same characteristics. Additionally or alternatively, each pulse may be modeled separately. In some exemplary embodiments, simulations may be performed based on an aggregation of attacks generated by models based on different pulses.

[0076] In some exemplary embodiments, the design may be a logic design that does not have layout information of the elements in the circuit itself. Since the logic design lacks the physical location of the elements, the logical proximity can be used to determine the approximation. The target location can indicate a target circuit element in the circuit that is considered to be at the center of the pulse attack. The logical proximity from the target circuit element can be calculated based on the forward and backward reachability from the target circuit element. The reachability analysis can traverse the circuit starting from the target circuit element, for example, using a breadth-first search (BFS) or any other search order, and identify all elements within a threshold logical distance from the target circuit element. For example, it can be considered that each wire traversed increases the logical distance. Therefore, all gates or triggers directly connected to the target circuit element are within a logical distance of 1, all gates or triggers directly connected to an element with a logical distance of 1 have a logical distance of 2, and so on. As another example, the logical distance can increase when traversing the trigger. Therefore, all combinational logic between the target circuit elements and between the next or previous triggers and the triggers themselves can be considered to have a zero logical distance. Combinational logic directly connected to a flip-flop at a distance of X can be considered to have a logical distance of X+1. In some exemplary embodiments, the reachability analysis can be based on cycle-based distance. The cycle-based distance can be defined based on the number of cycles it takes for information to reach a target circuit element from an element (for backward analysis) or for information to reach the element from a target circuit element (for forward analysis). It should be noted that the above is an exemplary logical distance metric and other metrics can be used. In some exemplary embodiments, the list of potentially vulnerable circuit elements can include circuit elements whose logical distance to the target circuit element is less than a threshold N. This calculation can approximate related elements that may be placed near the target circuit element, thereby providing a reasonable approximation that can be used to identify weaknesses in the logic design before physical placement.

[0077] In some exemplary embodiments, the fault attack simulation model may be a timing-based fault attack simulation model that simulates a timing-based fault attack. A timing-based fault attack may be an attack that aims to manipulate the design to affect the timing of the circuit. A timing-based fault attack may be a voltage glitch, a clock glitch, etc. The design may include combinational logic (e.g., implemented using gates) and sequential logic (e.g., implemented using flip-flops). Data may be processed by the combinational logic and then latched by the flip-flop. The timing of the clock should allow enough time to complete the combinational logic and allow the value of the flip-flop input to be registered by the flip-flop so as to be latched. Therefore, a timing condition may be T clk ≥T comb +T setup , where T clk is the clock timing, T combis the timing required for the combinational logic to be processed, T setup is the setup time required for the flip-flop. This condition holds true for all flip-flops and their respective driving combinational logic. A timing-based fault attack may attempt to subvert this requirement and cause the circuit to violate this timing requirement. For example, a clock-based attack may attempt to manipulate the clock. In some exemplary embodiments, overclocking the circuit may reduce the time period of the clock and therefore increase its frequency. As a result, the timing available to the combinational logic before the next latching edge is reduced, thereby potentially latching an incorrect value. As another example, a voltage glitch attack may manipulate the voltage supplied to the gate (e.g., underpowering the gate). The effect of the voltage glitch may change and potentially increase the delay of the gate. This delay may violate the timing requirement and cause the flip-flop to latch an incorrect value.

[0078] In some exemplary embodiments, when simulating a time-based attack, the potentially attacked circuit elements may consist only of flip-flops, rather than gates, because the effect of the attack is to cause the flip-flops to latch incorrect values. In some cases, the potentially attacked flip-flops may be selected based on the power supply situation. In a voltage glitch, all gates using the same power supply may be affected by the voltage glitch for that power supply. Therefore, the potentially attacked flip-flops may include all flip-flops driven by logic powered by the same power supply. The flip-flops may be classified into groups, each group associated with a different power supply. It should be noted that in some cases, the same flip-flop may be affected by gates that rely on different power supplies, so the flip-flop may be included in more than one group. Similarly, if the design utilizes more than one clock, then based on which clock is disturbed by the glitch, flip-flop groups based on different clock signals may be utilized. If the design uses a single clock, the clock glitch may affect all flip-flops of the design.

[0079] Additionally or alternatively, the list of potentially attacked circuit elements may be determined based on a critical timing path in a circuit design. A critical timing path is the longest path or the most sensitive path in a circuit design, which determines the maximum operating speed of the circuit. In some cases, there may be several critical timing paths (e.g., N longest / most sensitive paths), and the disclosed subject matter may be applied accordingly. However, for simplicity, a single path is discussed without narrowing the scope of the disclosed subject matter. A critical timing path may be a path where a signal takes the most time to propagate from the input of a circuit to the output, thus setting a limit on the clock frequency that can be used for reliable operation. A critical timing path may include all circuit elements that contribute to propagation delay. In some cases, the model may be intended to affect elements along a critical timing path, because such elements may be more susceptible to timing-based attacks than other elements. In some exemplary embodiments, the list of potentially attacked circuit elements may be determined based on an estimated time budget of the combinatorial logic that drives the trigger. In some cases, triggers with an estimated time budget exceeding a predetermined threshold may be included in the list, because such triggers may be considered more susceptible to time-based attacks. Additionally or alternatively, the glitch timing can be modeled based on the timing of the fault injection. Additionally or alternatively, the hit type in the model can be based on the attack. For example, a voltage glitch may mean a hit of type single event upset, bit event upset, etc. "Fixed" type hits may not be considered.

[0080] In some exemplary embodiments, the list of potentially attacked circuit elements may be determined based on a security asset information analysis of a circuit design. The static security asset information analysis of the design may be used to classify different elements into security asset information (SAI), drivers of SAI (D-SAI), loads of SAI (L-SAI), drivers and loads of SAI (DL-SAI), and unrelated to SAI (UR-SAI). In some cases, the list may be determined to include only loads of SAI (e.g., L-SAI and DL-SAI). The list may be determined to include only drivers of SAI (e.g., D-SAI and DL-SAI). In some exemplary embodiments, any element in UR-SAI may be ignored in the analysis because it cannot be used to present SAI. Therefore, exclusion rules may be used to exclude elements in UR-SAI. It should be noted that, together or in separate analyses, classifications may be determined based on different elements that may be considered security assets, so elements may be considered in different categories for different security assets. Additionally or alternatively, verification engineers may wish to focus the verification process on different aspects, such as potential drivers of security assets, potential loads affected by security assets, and the like. Verification engineers can define exclusion rules to achieve the desired aspects.

[0081] In some exemplary embodiments, the fault simulation engine may employ a fault attack simulation model (FAS_FAULT), a design, and generate a fault attack to be simulated including multiple hits. For example: FAS_FAULT may define two hits: HIT1 and HIT2. The generated fault attack may indicate that HIT1 is a soft error on flop_a at time T1, and HIT2 is a fault stuck-at-1 on net_123 at time T2 (T2>T1). A hardware simulator may be used to simulate the fault attack. The simulation may start at T0 and continue without failure until T1. At T1, the simulator may implement HIT1 by flipping the value of flop_a. The simulation will then continue until T2, and then it will change the netlist to create a fault permanently stuck at 1 at net_123. It will then continue until the fault simulation ends. In some exemplary embodiments, hitless execution may be utilized to accelerate simulation to avoid computations that remain constant relative to a hitless execution trace, as described in detail in U.S. Patent 10,025,895, entitled "Circuit Simulation Using Reference Execution Records," which is incorporated herein by reference in its entirety. It is noted that the results of a simulation may be determined using strobes defined based on a hitless execution trace that may be used as a reference execution or golden trace (even if such a trace is not used as a means to accelerate simulation).

[0082] One technical effect of the disclosed subject matter includes enabling pre-silicon security verification, which can enable shorter development time and reduce the redesign required after entering the post-silicon stage.

[0083] Another technical effect of the disclosed subject matter is to provide an efficient way to model potential attacks based on relevant parameters of the potential attacks and focus verification efforts on relevant aspects. The disclosed subject matter can enable verification engineers to perform security verification using simulations or executions of a relatively small number of designs. The tests used during verification may be engineered and biased toward potential attacks in real life, thereby helping to provide adequate security verification coverage in the early stages of development.

[0084] Another technical effect can be to provide useful models of different potential attacks and enable verification engineers to verify that a particular attack will not be useful to the circuit design. This modeling reduces the state space of potential test scenarios because the test space is limited to potential attacks. This is exemplary when addressing pulse-based attacks in the disclosed subject matter, which focus on specific areas of the circuit design and affect these areas together in view of the physical properties of the pulses used (e.g., strength, radius, etc.).

[0085] The disclosed subject matter may provide one or more technical improvements to any prior art and any previously customary or conventional technology in the art. In view of the present disclosure, additional technical problems, solutions and effects may be apparent to those of ordinary skill in the art.

[0086] Reference now Figure 1A , which shows a trace diagram according to some exemplary embodiments of the present subject matter. A trace of a hit-free execution of an example circuit is shown. The values ​​of different signals (110-140) are shown using waveforms. In different cycles (CY1, CY2, ..., CY n ), these values ​​are different. In some exemplary embodiments, a time window 100 for simulating a multi-hit fault attack can be defined. Therefore, the generated multi-hit fault attack will include hits that occur within the time window 100. In some exemplary embodiments, some signals can be considered as part of the list of circuit elements that are potentially attacked. For example, signals 110-130 can be part of the list, while signal 140 can be excluded from the list. A multi-hit attack can be generated so as to cause hits only in signals that are part of the list. Not all signals are hit in the same fault attack. In each fault attack, there are multiple hits in the same signal, in different signals, in the same cycle, in different cycles, and combinations thereof, etc. Figure 1B-Figure 1E Shows the potential multi-hit fault attacks that could occur.

[0087] exist Figure 1B In the example, two single event upsets (150b1, 150b2) may occur on two corresponding signals (110, 120) in the same cycle. Figure 1C Two hits (150c1; 150c2) occurring in the same signal (signal 120) at two different periods are illustrated. Figure 1DTwo different types of hits are illustrated. Hit 150d1 in signal 120 is a single-particle bit flip that causes the value of signal 120 to be 1 instead of 0 for a single cycle. The remaining values ​​are then calculated based on this value, and such hits are no longer considered (except for their effect on the value during the hit cycle). On the other hand, hit 150d2 is a "stuck" hit that causes signal 130 to be fixed at a specific value for the remainder of the execution. It can be seen that the effects of hit 150d2 may still exist even after time window 100. In some cases, the impact of a multi-cycle fault may be limited to time window 100. Different types of hits can occur on different signals in the same cycle, and can occur on the same signal in different cycles, and so on. FIG. 1e shows a multi-hit fault attack that causes different hits in different signals (110, 120, 130), some of which occur in the same cycle (e.g., 150e1 and 150e4), some of which occur in different cycles (e.g., 150e1, 150e2, 150e3), and some of which occur in the same signal (e.g., 150r4 and 150e5 occur in signal 130). It should be noted that some hits may be synchronous, such that two flip-flops / gates are hit at the same time in the same cycle, while other flip-flops / gates are hit in an asynchronous manner.

[0088] Reference now Figure 2 , according to some exemplary embodiments of the present subject matter, a diagram of SAI-based classification is shown.

[0089] Figure 2 A logical classification based on the interaction of each of the components in the circuit design with the security assets (SA) is shown. In some exemplary embodiments, a security information flow analysis (SIFA) can be performed based on the security asset information (SAI), wherein given the SAI as an input, an analysis can be performed, and a visual output (e.g., a color-coded output) or different types of security asset reports can be provided to indicate the gates and triggers in the design under test (DUT) based on different SIFA classifications. In some cases, SIFA can be performed multiple times, each time for a different SAI. For example, there can be different security assets, such as but not limited to security modules, security triggers, security instances, security networks, security and non-security domain separation, etc. For different groups of security assets, all security assets can be analyzed together or separately, thereby providing higher resolution and more focused verification for each security asset.

[0090] Based on SAI, static analysis can be performed on the circuit design. Forward and backward traversals starting from all SAI nets and flops can be performed. During this traversal, gates and flip-flops can be classified into: L-SAI (pure load of SAI) for gates / flip-flops visible only in the forward traversal, D-SAI (pure driver of SAI) for gates / flip-flops visible only in the backward traversal, DL-SAI (mixed driver and load of SAI) for gates / flip-flops visible in both forward and backward traversals, and UR-SAI (elements of irrelevant SAI) for gates / flip-flops that are not visible in forward or backward traversals. This information can be presented to the user. In some exemplary embodiments, this classification can be utilized during fault attack simulation by focusing potential hits only on areas that can affect SAI (e.g., not in URSAI). Additionally or alternatively, a strobe can be defined only on L-SAI or DL-SAI, because data leakage can only occur after SAI is executed. Additionally or alternatively, the verification engineer may define exclusion rules based on the classification and taking into account her verification goals and insights.

[0091] Reference now Figure 3 , according to the disclosed subject matter, a laser attack in a physical design is shown. This laser attack is an example of a pulse-based attack and can be applicable to other pulse-based attacks, such as but not limited to the scope of the present disclosure, EM attacks, x-ray attacks, attacks based on other radiation types, etc.

[0092] Chip 300 may be a physical layout of a circuit design and have a physical layout of different circuit elements therein. A potential laser attack may be aimed at a physical location 310, which may be located at the center of a laser beam used in the attack. In a physical chip, since the laser beam is circular, the list of potential attacked circuit elements may include all gates within a given circle, where the circle is centered on the laser beam and has the radio waves of the laser beam. Other injection mechanisms may have different shapes or features. Physical location 310 may be given using XY coordinates, XYZ coordinates, the name of a given element on which the laser is focused, etc. Based on physical location 310, a pulse attack area 320 may be determined. Area 320 may be determined based on location 310 and taking into account the radius 315 of the attack to define a circle with a precise physical location.

[0093] In some exemplary embodiments, modeling may be based on an estimated size of the laser beam and, accordingly, on the number of different elements that it may affect. The parameters of the model may include, for example, a target attack location, such as to specify the location of the attack or the center of the laser beam. These parameters may include an attack radius or a laser beam focus radius, such as to affect a set of gates and flip-flops that may be affected by the laser beam. These parameters may include a number of circuit elements that are attacked or actually affected by the attack. This parameter may vary with the technology node, with more gates in fewer technology nodes. As an example, at 22nm, this number may be assumed to be approximately 100 gates. The laser intensity affects the number of gates affected and may be related to the radius (the larger the radius, the lower the intensity). These parameters may include the duration of the attack - how long the chip is irradiated, when it starts, and when it ends. This parameter may affect the value duration to be modeled.

[0094] In some exemplary embodiments, a radius 315 of the attack may be determined. The radius 315 may be determined based on a pulse intensity attribute. The verification engineer may select the pulse intensity attribute from a set of potential intensities that a hacker may use. The radius may be given in um, nm, etc. In some cases, the radius of a laser attack may be 5um. In other cases, at higher intensities, the radius may increase to 10um. The radius of the EM pulse may be larger than the radius of the laser, such as 1nm, 5nm, 10nm, 20nm, etc. Additionally or alternatively, the pulse intensity may not be specified, but rather determined by the generator. The generator may select the intensity from a set of potential intensities, and therefore the radius. It should be noted that the intensity may affect the radius as well as other aspects of a pulse-based attack. For example, given a high intensity, the irradiated element may be more likely to fail and result in a "fixed" hit than a single bit flip hit. This can be modeled in a pulse-based attack model by having different sets of hit types for potential hits (e.g., only "fixed" hits and no "bit flip" hits), by setting different probabilities for different hit types and biasing the hit types accordingly (e.g., a "fixed" hit is twice as likely to occur as a "bit flip" hit), and so on.

[0095] Based on the pulse attack area 320 and taking into account the physical layout of all circuit elements, a list of potentially attacked circuit elements can be compiled. The list can include any element located within the pulse attack area 320. In some exemplary embodiments, each affected gate / flip-flop within the pulse attack area 320 can be extracted from the layout of the circuit design. In some exemplary embodiments, the list of potentially attacked circuit elements can be calculated as follows: add each gate with an X, Y physical location within the pulse attack area 320 to the list. In some exemplary embodiments, the list can exclude elements, for example, taking into account any exclusion rules that may be applied.

[0096] Reference now Figure 4 , which illustrates a laser attack in a logic design according to the disclosed subject matter. This laser attack is an example of a pulse-based attack and can be applied to other pulse-based attacks, such as but not limited to the scope of the present disclosure, EM attacks, x-ray-based attacks, etc.

[0097] In the absence of a physical design, the final layout of the circuit elements may be unknown, and the affected areas cannot be analyzed. As an example, after synthesis, the information (knowledge) of the actual gates in the chip exists, however, their locations may not have been set and known. In some cases, the RTL design may be synthesized to the gate. The list of potentially affected circuit elements can be determined based on the instance (e.g., based on the assumption that the entire instance may be affected, the elements are selected from the instance together). Additionally or alternatively, logical proximity can be used to determine an approximate list of potentially attacked circuit elements. In some exemplary embodiments, logical proximity can be calculated. Logical proximity can start from a specific trigger / gate representing the center of the laser beam and pass through a predetermined logical distance. In some exemplary embodiments, the distance traversed can be different based on the traversed element (e.g., traversing the gate can be considered to be a shorter distance than traversing the trigger). In some exemplary embodiments, traversal can be performed forward and backward from the target element, such as based on the assumption that the laser is pointing to the target element, and the radius starting from it can include the assumption of the elements before and after the target element.

[0098] In some exemplary embodiments, it is reasonable to assume that connected elements will be placed relatively close to each other. Based on the logic design of the circuit, the logical distance can be calculated from the target circuit element that is considered to be at the center of the attack. For example, trigger 420 can be considered to be the center of the attack (for example, a laser can be pointed at trigger 420 in an attempt to change its behavior and the behavior of its vicinity). Backward and forward traversals can be performed while counting the logical distance from trigger 420. In some cases, all combinational logic can be considered to be within the same distance until another trigger is reached. In other cases, each gate may increase the logical distance. Circuit elements located within a logical distance less than a threshold can be considered to be logically close to the element (for example, trigger 420) where the attack is focused. In some exemplary embodiments, the logical distance can be a cycle-based distance to represent the number of cycles used for information to reach the target circuit element from the element, and vice versa.

[0099] The list of potentially attacked circuit elements may be determined to include elements that are logically close to the target circuit element. The list may include, for example, the target circuit element and all elements that are N or less in logical distance from it. In some exemplary embodiments, the threshold for defining logical proximity may be based on the intensity of the pulse attack and its physical properties. EM attacks may be considered to affect a larger area than laser attacks, so the threshold may be higher. As another example, as the pulse intensity increases, the logical proximity threshold may also increase.

[0100] exist Figure 4 In the example, considering traversing forward from trigger 420, group 430 may include elements that are considered to be logically close to trigger 420 (elements that are within the influence cone of trigger 420 and within a logical distance that does not exceed a logical distance threshold). Considering traversing backward from trigger 420, group 440 may include elements that are considered to be logically close to trigger 420 (trigger 420 is within the influence cone of these elements and within a logical distance that does not exceed a logical distance threshold).

[0101] Reference Figure 5A , which shows a flow chart of a method according to some exemplary embodiments of the disclosed subject matter.

[0102] In step 500, a circuit design may be obtained. The circuit design may be a logic design, a physical design, or the like.

[0103] In step 510, a strobe may be defined. The strobe may be defined based on a reference hit-free execution. In some cases, a trace representing a hit-free execution may be available. If desired, a hardware simulator (not shown) may be used to simulate the design to obtain a reference trace. The strobe may be used to define whether a simulated attack is considered successful. A verification engineer may define a failure strobe to indicate a situation where an attack can succeed (e.g., when secure asset information is leaked to a side channel that can be monitored by a hacker). A detection strobe may be defined to identify situations where a design's detection mechanism is activated to prevent malicious results of an attack.

[0104] In step 520, a fault attack simulation model may be obtained. In some exemplary embodiments, by using fault simulation to try and simulate potential fault attacks, the fault attack simulation may be utilized to verify the attack protection mechanism, which may be implemented using different kinds of attack vectors.

[0105] In some exemplary embodiments, a hierarchical approach to attack modeling may be utilized. A hit is a single fault (e.g., soft error / bit flip, stuck fault, bridge fault, etc.) in a single gate / flip-flop that occurs in a single cycle or a single timestamp. It should be noted that a hit can have a single or multiple cycle time span, during which its effects persist. Additionally or alternatively, a hit can be permanent, once it starts, it will last until the end of the simulation. A fault attack can simulate a single multi-hit attack by combining several hits. An attacker may combine or cause different faults as part of his fault attack. In some exemplary embodiments, many different fault attacks (530) may be generated. The generation may be random, by using some directed or biased methods, based on modeling, etc. Additionally or alternatively, the generation may be directed, biased, etc. using CSP solvers, heuristics, etc. Additionally or alternatively, a user may provide an explicit definition of each hit in each fault attack. However, such an explicit definition may not scale and may only be used for specific examples and extreme cases. Since domain knowledge of how to conduct attacks is available, the relevant modeling disclosed in this disclosure can be utilized.

[0106] The fault attack simulation model obtained in step 520 may model different potential multi-hit fault attacks that implement the same attack vector being modeled. In some cases, the same attack may produce different results, such as a laser attack that attempts to illuminate a specific location may affect a different gate or trigger each time the hacker attempts. In some cases, the model may indicate the number of attacks to attempt.

[0107] In step 530, a single multi-hit attack is generated based on the model. Multiple hits are generated according to the model (535) and clustered together to represent a fault attack. The generated attack indicates which hits should occur, in which cycles, for how long, and on which circuit elements.

[0108] In step 540, the simulator can be used to simulate a fault attack. The simulator can simulate the execution of the circuit design using a given input. Once a loop is encountered where a hit should be implemented (based on generating a multi-hit fault attack), a hit is implemented. A hit can be implemented by flipping the value of a related signal, by updating a netlist to change the function of a signal (e.g., a fixed function), etc. During the simulation, the value of the strobe pulse can be monitored to determine whether the attack is successful. If a failure strobe pulse is triggered, the attack is considered successful. Otherwise, it may be considered unsuccessful. If the detection probe is triggered, the attack is considered unsuccessful and the simulation is stopped. As a result, if the detection strobe pulse is triggered before the failure strobe pulse is triggered, the attack is considered unsuccessful even if continuing the simulation will cause the failure strobe pulse to be triggered.

[0109] In step 550, the results may be displayed to the user. Figure 6 A non-limiting example of the output is illustrated in . It is noted that the output may indicate any combination of the following information: the number of simulated attacks, the number (or percentage) of successful simulated attacks, and the number (or percentage) of detected simulated attacks. The information may be given as an overall information, or may be separated based on different strobe pulses (e.g., strobe pulse X1 was triggered Y1 times; strobe X2 was triggered Y2 times), based on different hit elements (e.g., out of Z attacks involving a hit in element E, V attacks were successful), based on different hit periods or sub-time frames (e.g., out of X1 attacks that resulted in a hit during sub-time frame F1, Y1 attacks were successful), etc. These results may be useful for engineers to identify potential weaknesses in the design and correct them (560).

[0110] If the design is a logic design, a physical design may be designed (570), such as by defining a floorplan for the logic design. After the physical design is prepared, the fault attack simulation (520-560) may be performed again. In some cases, the fault attack model may be reused. Additionally or alternatively, the strobe may be reused or modified. In some exemplary embodiments, the second verification process may be limited to models affected by physical information (e.g., laser attack). Other models that are not affected by the floorplan or physical layout may not be reviewed.

[0111] After verifying the physical design, the circuit can be manufactured (580), and post-silicon verification (590) can be performed. Because pre-silicon verification includes fault attack verification, it is expected that in most cases, post-silicon verification may detect no or few problems related to fault attacks. Therefore, the development time span can be reduced. Additionally or alternatively, the number of silicon resources required for the verification process can be reduced because during the pre-silicon stage, a conventional CPU can be used for the simulation process instead of using expensive and scarce silicon resources of the manufactured design.

[0112] Reference now Figure 6 , which shows a screen of the output of a fault attack simulation according to some exemplary embodiments of the disclosed subject matter. A user can select a specific instance or sub-instance of an element in the hierarchy dashboard 610. A text output can be presented to display an execution log in the command dashboard 650. The log can indicate the results of each simulated attack, the summary results, information related to the resources used (e.g., time, memory usage, CPU usage, etc.), the number of faults marked as detected, the number of faults marked as propagated, the number of faults marked as dissipated, the number of faults marked as safely ending the trace, the number of faults marked as unsafely ending the trace, etc. A pane 660 can display individual results of the simulated execution of the DUT (e.g., simulated fault attacks). Each row in pane 660 displays a different fault attack simulation, indicating for each simulated fault attack the model it implements (e.g., "FAS ID"), an indication of one or more hit elements (e.g., "First Node Name"), an indication of one or more cycles in which the hit was implemented (e.g., "First Hit Time," "Last Hit Time"), a number of hits (e.g., "Number of Hits"), and a hit type (e.g., "Type Used"), etc.

[0113] The command dashboard 650 is shown as indicating that 1,000,000 simulated fault attacks based on a single model were implemented (652). In the million simulations, 30 information leaks were detected (654). For a single simulation execution, the command dashboard 650 can indicate (656) the fault attack simulation model (e.g., "FAS ID"), the hits implemented (e.g., "Hit List"), the hit type for each hit (e.g., "SEUF"), the element hit, the cycle in which the hit occurred, and the duration of the hit, etc. The results of the simulated attack can be displayed (FAS Results: Information Leakage). The resources utilized (e.g., CPU resources, memory resources, time resources, etc.) can also be indicated.

[0114] The disclosed subject matter may be a system, method, and / or computer program product. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to perform various aspects of the disclosed subject matter.

[0115] The computer readable storage medium may be a tangible device that can retain and store instructions for use by the instruction execution device. The computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing devices. A non-exhaustive list of more specific examples of computer readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanical encoding device (e.g., a punch card (punch-cards) or a raised structure in a groove on which instructions are recorded) and any suitable combination of the foregoing. As used herein, a computer readable storage medium should not be interpreted as being a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0116] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network), or downloaded to an external computer or external storage device. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium in the corresponding computing / processing device.

[0117] The computer-readable program instructions for performing the operation of the disclosed subject matter can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code (including object-oriented programming languages, such as Smalltalk, C++, etc.) and conventional program programming languages ​​(for example, "C" programming language or similar programming languages) written in any combination of one or more programming languages. The computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, partially on the user's computer as an independent software package, partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network (including a local area network (LAN) or a wide area network (WAN)), or can be connected to an external computer (for example, by using the Internet of an Internet service provider). In certain embodiments, the electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA) can be executed by using the state information of the computer-readable program instructions to personalize the electronic circuit, thereby executing the computer-readable program instructions, so as to perform the various aspects of the disclosed subject matter.

[0118] Reference is made to the flow chart and / or block diagram of the method, device (system) and computer program product according to an embodiment of the present invention, and various aspects of the present invention are described herein. It will be understood that each block of the flow chart and / or block diagram and the combination of the blocks in the flow chart and / or block diagram can be implemented by computer-readable program instructions.

[0119] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device create means for implementing the functions / actions specified in the flowchart and / or block diagram blocks. These computer-readable program instructions may also be stored in a computer-readable storage medium, which may direct a computer, a programmable data processing device, and / or other device to operate in a particular manner, such that the computer-readable storage medium having the instructions stored therein comprises an article of manufacture, which comprises instructions for implementing various aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0120] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing device, or other device to cause a series of operating steps to be performed on the computer, other programmable device, or other device, thereby producing a computer-implemented process, so that the instructions executed on the computer, other programmable device, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0121] The flow chart and block diagram in the figure show the possible implementation architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure theme.In this regard, each block in the flow chart or block diagram can represent a module, a fragment or a part of an instruction, which includes one or more executable instructions for realizing the specified logical function.In some alternative embodiments, the function marked in the box may not occur in the order marked in the figure.For example, the two boxes shown in succession can actually be performed substantially at the same time, or these boxes can sometimes be performed in reverse order, depending on the functions involved.It will also be noted that each box in the block diagram and / or the flow chart diagram and the combination of the boxes in the block diagram and / or the flow chart diagram can be implemented by a system based on special-purpose hardware, which performs a specified function or action or performs a combination of special-purpose hardware and computer instructions.

[0122] The terms used herein are only used to describe specific embodiments and are not intended to limit the disclosed subject matter. As used herein, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms as well. It should also be understood that the terms "include" and / or "comprise" when used in this specification specify the presence of stated features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0123] The corresponding structures, materials, actions, and equivalents of all means or steps plus function elements in the appended claims are intended to include any structure, material, or action for performing a function and other claimed elements specifically claimed. For the purpose of illustration and description, a description of the disclosed subject matter has been presented herein, but it is not intended to be exhaustive or to limit the disclosed subject matter to the disclosed form. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and scheme of the disclosed subject matter. The embodiment is selected and described in order to best explain the principles and practical applications of the disclosed subject matter, and to enable other persons of ordinary skill in the art to understand the disclosed subject matter of various embodiments with various modifications to be suitable for the intended specific use.

Claims

1. A method comprising: Obtaining a circuit design, wherein the circuit includes circuit elements, and the circuit elements include gates, triggers, and wires; Obtain a fault attack simulation model, wherein the fault attack simulation model defines characteristics of a multi-hit attack to be simulated in a circuit, and the fault attack simulation model at least defines: the number of hits during said multi-hit attack; a time window for simulating the multi-hit attack; and a list of circuit elements potentially attacked during the multi-hit attack, the list of circuit elements potentially attacked being a subset of the circuit elements; automatically generating a plurality of fault attacks that follow the fault attack simulation based on the fault attack simulation model, wherein each fault attack in the plurality of fault attacks includes a plurality of hits that occur during the time window for the list of potentially attacked circuit elements, wherein a number of hits in the plurality of hits corresponds to a number of hits defined by the fault attack simulation model; for each fault attack of the plurality of fault attacks, simulating the fault attack on the circuit design, wherein the simulating is performed using a hardware simulator that simulates the circuit design; and The results of the simulation are output to a user.

2. The method according to claim 1, wherein: The fault attack simulation model further defines the fault types that occur in the hit, wherein the fault types include single event upset, stuck-at fault, and bridging fault.

3. The method according to claim 1, wherein: The fault attack simulation model is a pulse-based fault attack simulation model, wherein the pulse-based fault attack simulation model includes a target location of a pulse attack, wherein the target location of the pulse attack defines the list of potentially attacked circuit elements.

4. The method according to claim 3, wherein: The design is a physical design of the circuit, the physical design defining a physical layout of the circuit elements, wherein the target location is a physical location in the physical design of the circuit, wherein the method further comprises: determining a radius of the pulse attack; determining a pulse attack area based on the physical location and radius of the pulse attack; and Circuit elements within the pulse attack region are identified to define the potentially attacked circuit element list.

5. The method according to claim 4, wherein: The pulse-based fault attack simulation model includes a pulse intensity attribute, wherein the radius of the determined pulse attack is determined based on the pulse intensity attribute.

6. The method according to claim 3, wherein: The pulse-based fault attack simulation model includes a pulse intensity attribute, wherein a number of hits during the multi-hit attack is determined based on the pulse intensity attribute.

7. The method according to claim 3, wherein: The design is a logic design, wherein the target location is a target circuit element selected from the circuit elements, wherein the method further comprises determining the list of potentially attacked circuit elements based on logical proximity to the target circuit element.

8. The method according to claim 7, wherein: The determining the list of potentially attacked circuit elements includes performing forward and backward reachability analysis from the target circuit elements.

9. The method according to claim 7, wherein: The forward and backward reachability analysis is performed based on a cycle-based distance from the target circuit element.

10. The method according to claim 3, wherein: The pulse attack is at least one of a laser attack and an electromagnetic (EM) attack.

11. The method according to claim 3, wherein: The pulse-based fault attack simulation model defines a first hit type for gates included in the list of potentially attacked circuit elements, wherein the pulse-based fault attack simulation model defines a second hit type for flip-flops included in the list of potentially attacked circuit elements.

12. The method according to claim 1, wherein: The fault attack simulation model is a timing-based fault attack simulation model, wherein the timing-based fault attack simulation model is related to a timing-based fault attack, wherein the timing-based fault attack is configured to affect the timing of registering the value of one or more flip-flops, wherein the list of potentially attacked circuit elements consists of one or more flip-flops.

13. The method according to claim 12, wherein: The timing-based fault attack is at least one of a voltage glitch attack and a clock glitch attack.

14. The method according to claim 12, wherein: The one or more flip-flops constituting the list of potentially vulnerable circuit elements are determined based on critical timing paths in the circuit design.

15. The method according to claim 12, wherein: The one or more flip-flops constituting the list of potentially vulnerable circuit elements are determined based on an estimated time budget of combinatorial logic driving the one or more flip-flops.

16. The method according to claim 1, wherein: The list of potentially vulnerable circuit elements is determined based on exclusion rules that exclude elements based on a security asset information analysis of the circuit design.

17. The method according to claim 16, wherein: The security asset information analysis includes: acquiring one or more secure circuit elements, the one or more secure circuit elements being circuit elements that are considered secure assets; and The circuit elements are classified based on corresponding relationships with the one or more circuit elements.

18. The method according to claim 17, wherein: The classification includes classifying each element as at least one of the following: a load of the one or more safety circuit elements; a driver for the one or more safety circuit elements; and Independent of the one or more safety circuit elements.

19. The method according to claim 16, wherein: The security asset information analysis is performed for one or more security circuit elements, wherein the exclusion rule excludes circuit elements classified as not relevant to the one or more security circuit elements.

20. The method of claim 1, further comprising: obtaining one or more user instructions defining a gating signal, wherein the gating signal is defined based on a change relative to a hit-free execution of the circuit design; wherein the simulating comprises evaluating a value of the strobe signal; and Wherein, the result of the simulation is determined based on the value of the selection signal.

21. The method according to claim 20, wherein: The strobe signal includes a fail strobe pulse, wherein the fail strobe pulse indicates a successful simulated attack, wherein the result of the simulation includes an indication of a number of successful simulated attacks out of a total number of simulated attacks attempted.

22. The method according to claim 20, wherein: The strobe signal includes a detection strobe pulse, wherein the detection strobe pulse indicates successful detection of a simulated attack by an on-chip detection mechanism, wherein the result of the simulation includes an indication of a number of successful detections of attempted simulated attacks.

23. A system comprising a memory and one or more processors, wherein the memory is configured to store: Circuit design, where The circuit includes circuit elements, and the circuit elements include gates, triggers and wires; and A fault attack simulation model, wherein the fault attack simulation model defines characteristics of a multi-hit attack to be simulated in the circuit, the fault attack simulation model at least defining: the number of hits during said multi-hit attack, a time window for simulating the multi-hit attack; as well as a list of circuit elements potentially attacked during the multi-hit attack, the list of circuit elements potentially attacked being a subset of the circuit elements; At least one of the one or more processors is configured to automatically generate a plurality of fault attacks following the fault attack simulation based on a fault attack simulation model, wherein each fault attack of the plurality of fault attacks includes a plurality of hits occurring during the time window for the list of potentially attacked circuit elements, wherein a number of hits in the plurality of hits corresponds to a number of hits defined by the fault attack simulation model; and For each fault attack of the plurality of fault attacks, at least one processor of the one or more processors is configured to simulate the fault attack on the circuit design, wherein the simulation is performed using a hardware simulator that simulates the circuit design.

24. A computer program product that retains non-transitory program instructions that, when executed by one or more processors, cause the one or more processors, or portions of the one or more processors, to perform: Get a circuit design where, The circuit includes circuit elements, and the circuit elements include gates, triggers and wires; Obtain a fault attack simulation model, wherein the fault attack simulation model defines characteristics of a multi-hit attack to be simulated in a circuit, and the fault attack simulation model at least defines: the number of hits during said multi-hit attack; a time window for simulating the multi-hit attack; as well as a list of circuit elements potentially attacked during the multi-hit attack, the list of circuit elements potentially attacked being a subset of the circuit elements; automatically generating a plurality of fault attacks that follow the fault attack simulation based on the fault attack simulation model, wherein each fault attack in the plurality of fault attacks includes a plurality of hits that occur during the time window for the list of potentially attacked circuit elements, wherein a number of hits in the plurality of hits corresponds to a number of hits defined by the fault attack simulation model; for each fault attack of the plurality of fault attacks, simulating the fault attack on the circuit design, wherein the simulating is performed using a hardware simulator that simulates the circuit design; and The results of the simulation are output to a user.

Images