Method for detecting security vulnerabilities of circuit design
By constructing the safety attribute control flow diagram and symbol execution of circuit design, the security vulnerabilities in circuit design are detected, and the problem of difficulty in detecting circuit design security vulnerabilities in the prior art is solved, and the effective identification of security vulnerabilities caused by asynchronous reset is achieved.
Patent Information
- Application Number
- CN202411593650.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-08
- Publication Date
- 2025-02-18
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
The prior art is difficult to accurately detect security vulnerabilities in circuit design, especially in the case of information flow violations caused by asynchronous reset signals, and dynamic simulation tests are difficult to cover all possible reset combinations.
By constructing the safety attribute control flow diagram of the circuit design, extract the conditions to form the first condition list, create the initial path, traverse the circuit module to find the always block for path marking, extract the path conditions to form the second condition list, and align it with the first condition list, Finally, the symbolic execution is performed to verify whether the security attribute is violated.
This method can effectively identify security vulnerabilities caused by asynchronous reset, ensure the security of circuit design, and avoid security vulnerabilities that may be missed by limited testing of dynamic simulations.
Smart Images
Figure CN119475353A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of formal verification of integrated circuits, and in particular to a method for detecting security holes in circuit designs. Background Art
[0002] In SOC (System on Chip) design, checking for security vulnerabilities in circuit design is an important means of ensuring circuit reliability.
[0003] Dynamic simulation is a functional test of the circuit under actual operating conditions. It verifies the correctness of the design by inputting stimulus signals and observing the output results. Dynamic simulation can usually only verify a limited number of signal combinations and cannot exhaust all possible combinations, resulting in some potential security vulnerabilities being missed.
[0004] Take the asynchronous reset signal as an example. Asynchronous reset signals are widely used in various functional modules to deal with runtime problems. However, the non-deterministic characteristics of asynchronous reset may cause information flow violations and threaten system security. The non-deterministic characteristics of asynchronous reset refer to the fact that the system state may be restored in different ways at different time points under the triggering of the asynchronous reset signal. This uncertainty may cause the circuit to fail to stabilize to a known state during the reset process, thereby causing information flow violations. Information flow violations refer to the situation where signals in the circuit are mistakenly transmitted or sampled in an incorrect state when they should not be propagated. For example, in a register, if the data input is not stabilized in time when the reset signal is activated, it may cause the register to sample incorrect data after reset, resulting in inconsistent results in the subsequent logic. In this case, the behavior of the circuit becomes unpredictable, affecting the reliability of the system.
[0005] Similarly, dynamic simulation tests are difficult to cover all possible reset combinations, mainly because the reset signal may be triggered under different clock cycles and conditions, forming a complex state space. In addition, the number of test cases and design complexity limit the scenarios that can be effectively tested, resulting in certain specific reset timings and combinations not being fully verified, making it difficult to discover security vulnerabilities in circuit design.
[0006] Therefore, providing a method for detecting security holes in circuit design is a technical problem to be solved. Summary of the invention
[0007] In order to solve the technical problem that the security loopholes of circuit design cannot be accurately detected in the prior art, the present invention proposes a method for detecting the security loopholes of circuit design.
[0008] The present invention provides a method for detecting security vulnerabilities in circuit design, comprising:
[0009] Extracting a control flow graph of the security attribute of the circuit design, and extracting all conditions from the control flow graph of the security attribute to form a first condition list, wherein the conditions in the first condition list are first conditions;
[0010] For each security attribute, create a corresponding path with an initial value of null;
[0011] Traverse each module in the circuit design, find the always block that may violate the security attribute and mark the path, so that the always block marked by the path is added to the path corresponding to the security attribute;
[0012] Extracting conditions in the path corresponding to the security attribute to form a second condition list, wherein the conditions in the second condition list are second conditions;
[0013] Search the first condition list of the security attribute for the same first condition as the second condition corresponding to the security attribute, if not found, cancel the path mark; if found, align the corresponding second condition with the corresponding first condition;
[0014] After all second conditions in the second condition list corresponding to the security attributes are searched and processed, symbolic execution is performed based on the path. If it is found that the security attribute is violated, it is determined that there is a security vulnerability in the circuit design.
[0015] Further, the control flow graph is extracted by the following steps:
[0016] Extracting nodes in the security attribute, wherein the nodes include at least one of a conditional statement, an assignment statement, a combinational logic, and a sequential logic;
[0017] Taking the corresponding security attribute as a unit, the nodes in the same unit are connected according to the execution order of the nodes, and the start node and the end node are added to the node group in each interconnected unit to form a control flow graph of the corresponding security attribute.
[0018] Furthermore, before extracting the nodes in the security attribute, the security attribute is converted into Verilog code, so that the conditional statement of the security attribute is converted into a Boolean expression, and / or the assignment statement of the security attribute is converted into an assignment statement expressed in the Verilog language, and / or the combinational logic of the security attribute is converted into the combinational logic expressed in the Verilog language, and / or the sequential logic of the security attribute is converted into the sequential logic expressed in the Verilog language.
[0019] Furthermore, the always block in the circuit design that may violate the corresponding security attribute is an always block of a signal whose trigger signal belongs to a sensitive list of the security attribute.
[0020] Furthermore, the order of adding the always blocks is based on the execution order of the control flow graph of the corresponding security attributes.
[0021] Further, aligning the corresponding second condition with the corresponding first condition includes:
[0022] When the first conditions corresponding to two or more second conditions are in an AND relationship in the first condition list, the corresponding second conditions in the second condition list are updated to match the corresponding second conditions with the corresponding first conditions;
[0023] When the first conditions corresponding to two or more second conditions are in an OR relationship in the first condition list, the second condition list is not updated.
[0024] Further, the path performs symbolic execution including:
[0025] Determine whether the reset signal in the sensitivity list of the security attribute is a regular signal. If so, perform full symbolic execution.
[0026] Determine whether the reset signal in the sensitive list of security attributes will not be triggered. If so, perform regular symbolic execution
[0027] The present invention constructs a control flow graph of security attributes to obtain a first condition list, aligns the condition of the corresponding always block with the first condition in the first condition list, adds it to the path, and then performs symbolic execution, which can effectively identify security vulnerabilities caused by asynchronous reset. BRIEF DESCRIPTION OF THE DRAWINGS
[0028] The present invention is described in detail below with reference to the embodiments and accompanying drawings, wherein:
[0029] Figure 1 It is the main flow chart of the present invention. DETAILED DESCRIPTION
[0030] In order to make the technical problems, technical solutions and beneficial effects to be solved by the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.
[0031] Thus, a feature indicated in this specification will be used to illustrate one of the features of an embodiment of the present invention, rather than implying that each embodiment of the present invention must have the described feature. In addition, it should be noted that this specification describes many features. Although some features can be combined together to illustrate possible system designs, these features can also be used in other combinations that are not explicitly described. Thus, unless otherwise stated, the described combinations are not intended to be limiting.
[0032] like Figure 1 As shown, the method for detecting security vulnerabilities in circuit design proposed by the present invention includes the following main steps.
[0033] Extracting a control flow graph of the security attribute of the circuit design, and extracting all conditions from the control flow graph of the security attribute to form a first condition list. In order to clearly explain the technical solution of the present invention, the conditions in the first condition list are referred to as first conditions, that is, the conditions in the first condition list are first conditions;
[0034] For each security attribute, create a corresponding path with an initial value of null;
[0035] Traverse each module in the circuit design, find the always block that may violate the security attribute and mark the path, so that the always block marked by the path is added to the path corresponding to the security attribute;
[0036] Extracting conditions in the path corresponding to the security attribute to form a second condition list. Similarly, for ease of description, the conditions in the second condition list are referred to as second conditions, that is, the conditions in the second condition list are second conditions.
[0037] Search the first condition list of the security attribute for the same first condition as the second condition corresponding to the security attribute, if not found, cancel the path mark; if found, align the corresponding second condition with the corresponding first condition;
[0038] After all second conditions in the second condition list corresponding to the security attributes are searched and processed, symbolic execution is performed based on the path. If it is found that the security attribute is violated, it is determined that there is a security vulnerability in the circuit design.
[0039] In the above technical solution, aligning the corresponding second condition with the corresponding first condition means ensuring that the judgment logic of the condition in the always block in the Verilog code is consistent with the conditions and control logic listed in the control flow diagram of the security attribute. In other words, in the always block, the implementation of the condition must be consistent with the control flow and security attributes defined in the design phase, and judged and executed in the planned order and logic.
[0040] The modules in the above technical solution refer to the modules in the Verilog code, such as all modules defined in the RTL (register-transfer level) code, which may include control modules, interface modules, etc. Different specific design functions have different corresponding modules.
[0041] The specific content included in the first condition list of the present invention is a conditional expression, that is, a conditional expression of all security attributes. Similarly, the second condition list is a conditional expression of the always block in the path.
[0042] The always block is a specific component unit of the circuit design implementation, and the security attribute is used to verify whether the circuit design meets the corresponding safety standards, but the conditions of the two are aligned. During the path execution process, if the security attribute is violated, there must be a security vulnerability in the circuit design. Therefore, the security vulnerability in the circuit design can be accurately detected, avoiding the problem that the security vulnerability of the circuit design may not be fully detected due to the limited signal combination test of dynamic simulation.
[0043] In one embodiment, the control flow graph is extracted using the following steps.
[0044] Extracting nodes in the security attribute, where the nodes include at least one of a conditional statement, an assignment statement, a combinational logic, and a sequential logic;
[0045] Taking the corresponding security attribute as a unit, the nodes in the same unit are connected according to the execution order of the nodes, and the start node and the end node are added to the node group in each interconnected unit to form a control flow graph of the corresponding security attribute.
[0046] In one embodiment, before extracting the nodes in the security attribute, the security attribute is converted into Verilog code, so that the conditional statement of the security attribute is converted into a Boolean expression, and / or the assignment statement of the security attribute is converted into an assignment statement expressed in the Verilog language, and / or the combinational logic of the security attribute is converted into the combinational logic expressed in the Verilog language, and / or the sequential logic of the security attribute is converted into the sequential logic expressed in the Verilog language.
[0047] Assume the following security properties:
[0048] property reset_value_set_0;
[0049] @(posedge clk and negedge nRST)! nRST|=>ifid.instr_out==0&&ifid.pc_next_out==0;
[0050] endproperty / / reset_value_set_0
[0051] This security attribute means that at the falling edge of the reset signal nRST, if the nRST signal is low, the values of the ifid.instr_out and ifid.pc_next_out registers must be 0.
[0052] Then the steps to create the control flow graph for this security property are as follows.
[0053] First, parse the security attributes and convert them into Verilog code as shown below.
[0054]
[0055] Determine whether the safety logic needs to process conditional statements and extract the conditional statements! nRST.
[0056] Determine whether the security logic needs to process assignment statements, and extract the assignment statements ifid.instr_out==0 and ifid.pc_next_out==0.
[0057] Create separate nodes for conditional statements and assignment statements.
[0058] Connect the condition nodes and assignment nodes according to the execution order.
[0059] It is determined whether the security logic needs to process the combinational logic, and it is determined that the security attribute does not include the combinational logic.
[0060] Determine whether the security attribute needs to process sequential logic, create nodes for the sequential logic posedge clk and negedgenRST, and add them before all nodes.
[0061] For the above node group, add a start node and an end node to complete the control flow graph of this security property.
[0062] In one embodiment, the always block that may violate the corresponding security attribute in the circuit design is the always block of the signal whose trigger signal belongs to the sensitive list of the security attribute. The signals included in the sensitive signal list are usually clock signals and / or reset signals. These are signals that are more likely to cause security risks, especially reset signals.
[0063] In one embodiment, the order in which the always blocks in the path are added is based on the execution order of the control flow graph of the corresponding security attributes.
[0064] In one embodiment, aligning the corresponding second condition with the corresponding first condition comprises the following steps.
[0065] When the first conditions corresponding to two or more second conditions are in an AND relationship in the first condition list, the corresponding second conditions in the second condition list are updated to match the corresponding second conditions with the corresponding first conditions;
[0066] When the first conditions corresponding to two or more second conditions are in an OR relationship in the first condition list, the second condition list is not updated.
[0067] Let's take an example. Assume there is an always block with the following code.
[0068]
[0069]
[0070] Corresponding security attributes:
[0071] property regA_prop;
[0072] @(posedge clk)disable iff(reset)
[0073] (A==B)&&(C==D)|->regA==valA;
[0074] endproperty
[0075] The trigger condition clk of the always block is a signal in the sensitive list. The conditions of the always block are A==B, C==D, which are also included in the second condition list. The AND relationship between the two conditions is determined by the security attribute, that is, the corresponding first condition in the first condition list is (A==B)&&(C==D). At this time, the two second conditions A==B, C==D in the second condition list should be updated. Update these two second conditions to (A==B)&&(C==D).
[0076] When searching for security vulnerabilities caused by reset signals, it is possible to determine whether the reset signal in the sensitivity list of the security attribute is a regular signal. If so, full symbolic execution is performed. If it is determined whether the reset signal in the sensitivity list of the security attribute will not be triggered, regular symbolic execution is performed.
[0077] It is determined whether the reset signal is a regular signal, and if so, a complete symbolic execution is performed. The regular signal of the present invention refers to a signal usually generated by a control logic or a timer in a circuit, such as a clock signal, a counter signal, and the like.
[0078] Determine whether the reset signal will not be triggered. If so, perform regular symbolic execution. Determine whether the reset signal is triggered, mainly based on the reset situation.
[0079] In the case of synchronous reset, it is usually controlled by a clock signal, and its triggering condition is related to the clock signal of the circuit. For example, when the rising edge of the clock signal arrives, the reset signal will be triggered.
[0080] Asynchronous reset condition, which is usually triggered by external events, such as power failure, error detection, etc. Its triggering condition is independent of the circuit's clock signal.
[0081] The main difference between full symbolic execution and regular symbolic execution is the treatment of the state space.
[0082] Full symbolic execution explores all possible execution paths, including all conditions and branches, to find all potential errors in the code. It can find all possible input combinations, thereby revealing all potential errors and security vulnerabilities. Conventional symbolic execution only focuses on some paths and is suitable for rapid verification of specific scenarios. It uses a certain strategy (such as depth-first or breadth-first) to selectively explore specific paths.
[0083] To match the always block or conditional block with the symbolic execution path, you can mark the path, that is, mark the use of symbolic variables and the path condition (Path Condition, PC) corresponding to each path.
[0084] The following is an example of an always block with symbolic variable annotations. Multiple path conditions are annotated in the always block, including path1, path1.1, path1.2, path2, and path2.1. In symbolic execution, a is replaced by symbolic variable A, and b is replaced by symbolic variable B. Taking path1 as an example, its condition is symbolic variable A>4, that is, the path will only be executed when the value of a is greater than 4.
[0085]
[0086] If the security property is found to be violated during symbolic execution, it indicates that there is a security vulnerability in the circuit design.
[0087] The present invention aligns the conditions in the always block with the conditions of the control flow graph of the corresponding security attributes, performs symbolic execution, and cooperates with formal verification to model the reset signal and analyze the relationship between it and the design state, thereby systematically verifying all possible reset combinations to ensure that no potential security vulnerabilities are missed, achieving the technical effect of effectively identifying security vulnerabilities caused by asynchronous resets.
[0088] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.
Claims
1. A method for detecting security vulnerabilities in circuit design, characterized in that: include: Extracting a control flow graph of the security attribute of the circuit design, and extracting all conditions from the control flow graph of the security attribute to form a first condition list, wherein the conditions in the first condition list are first conditions; For each security attribute, create a corresponding path with an initial value of null; Traverse each module in the circuit design, find the always block that may violate the security attribute and mark the path, so that the always block marked by the path is added to the path corresponding to the security attribute; Extracting conditions in the path corresponding to the security attribute to form a second condition list, wherein the conditions in the second condition list are second conditions; Search the first condition list of the security attribute for a first condition that is the same as the second condition corresponding to the security attribute, and if not found, cancel the path mark; If found, align the corresponding second condition with the corresponding first condition; After all second conditions in the second condition list corresponding to the security attributes are searched and processed, symbolic execution is performed based on the path. If it is found that the security attribute is violated, it is determined that there is a security vulnerability in the circuit design.
2. The method for detecting a security vulnerability in a circuit design as claimed in claim 1, wherein: The control flow graph is extracted by the following steps: Extracting nodes in the security attribute, wherein the nodes include at least one of a conditional statement, an assignment statement, a combinational logic, and a sequential logic; Taking the corresponding security attribute as a unit, the nodes in the same unit are connected according to the execution order of the nodes, and the start node and the end node are added to the node group in each interconnected unit to form a control flow graph of the corresponding security attribute.
3. The method for detecting a security vulnerability in a circuit design as claimed in claim 2, wherein: Before extracting the nodes in the security attribute, the security attribute is converted into Verilog code, so that the conditional statement of the security attribute is converted into a Boolean expression, and / or the assignment statement of the security attribute is converted into an assignment statement expressed in the Verilog language, and / or the combinational logic of the security attribute is converted into the combinational logic expressed in the Verilog language, and / or the sequential logic of the security attribute is converted into the sequential logic expressed in the Verilog language.
4. The method for detecting security vulnerabilities in circuit design according to claim 1, wherein: The always block in the circuit design that may violate the corresponding security attribute is an always block of a signal whose trigger signal belongs to a sensitivity list of the security attribute.
5. The method for detecting security vulnerabilities in circuit design according to claim 1, wherein: The order in which the always blocks are added is based on the execution order of the control flow graph of the corresponding security attributes.
6. The method for detecting security vulnerabilities in circuit design according to claim 1, wherein: Aligning the corresponding second condition with the corresponding first condition includes: When the first conditions corresponding to two or more second conditions are in an AND relationship in the first condition list, the corresponding second conditions in the second condition list are updated to match the corresponding second conditions with the corresponding first conditions; When the first conditions corresponding to two or more second conditions are in an OR relationship in the first condition list, the second condition list is not updated.
7. The method for detecting security vulnerabilities in circuit design according to claim 1, wherein: The path for symbolic execution includes: Determine whether the reset signal in the sensitivity list of the security attribute is a regular signal. If so, perform full symbolic execution. Determine whether the reset signal in the sensitivity list of the security attribute will not be triggered. If so, perform regular symbolic execution.