Method for detecting security vulnerabilities caused by asynchronous reset
By constructing control flow diagrams and symbolic execution of security attributes, the problem of difficulty in detecting security vulnerabilities caused by asynchronous reset in the prior art is solved, and detailed vulnerability identification and correction of circuit design is achieved.
Patent Information
- Application Number
- CN202411593652.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-08
- Publication Date
- 2025-02-18
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
The prior art is difficult to accurately detect asynchronous reset signals that trigger security vulnerabilities, resulting in some potential security vulnerabilities that may be missed.
By building a control flow diagram of security attributes, extracting the condition list, finding always blocks that may violate security attributes, performing symbolic execution, finding the source of the violation signal, and building a complete violation path.
Effectively identify security vulnerabilities caused by asynchronous reset, accurately find violation paths, provide more detailed correction information for circuit design, and improve system reliability and security.
Smart Images
Figure CN119475354A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of formal verification of integrated circuits, and in particular to a method for detecting security holes caused by asynchronous reset. Background Art
[0002] In SOC (System on Chip) design, checking for security vulnerabilities in circuit design is an important means of ensuring circuit reliability.
[0003] Dynamic simulation tests circuit functionality under actual operating conditions, verifying the correctness of the design by inputting stimulus signals and observing the output results. However, dynamic simulation can typically only verify a limited number of signal combinations and cannot exhaust all possible combinations, potentially missing potential security vulnerabilities.
[0004] Take the asynchronous reset signal as an example. Asynchronous reset signals are widely used in various functional modules to address runtime issues. However, the non-deterministic nature of asynchronous resets can lead to information flow violations, threatening system security. The non-deterministic nature of asynchronous resets means that when triggered by the asynchronous reset signal, the system state may be restored in different ways at different times. This uncertainty can prevent the circuit from stabilizing to a known state during the reset process, leading to information flow violations. Information flow violations occur when signals in a circuit are incorrectly propagated or sample an incorrect state when they should not be propagated. For example, in a register, if the data input does not stabilize in time when the reset signal is activated, the register may sample incorrect data after reset, resulting in inconsistent results in subsequent logic. In this case, circuit behavior becomes unpredictable, affecting system reliability.
[0005] Similarly, dynamic simulation testing struggles to cover all possible reset combinations, primarily because reset signals can be triggered at different clock cycles and under different conditions, creating a complex state space. Furthermore, the number of test cases and design complexity limit the scenarios that can be effectively tested, resulting in certain specific reset sequences and combinations not being fully verified, making it difficult to detect asynchronous reset signals that can trigger security vulnerabilities in circuit designs.
[0006] Therefore, providing a detection method for an asynchronous reset signal that can cause a security vulnerability is a technical problem to be solved. Summary of the Invention
[0007] In order to solve the technical problem in the prior art that the asynchronous reset signal causing the security vulnerability cannot be accurately found, the present invention proposes a method for detecting the security vulnerability caused by the asynchronous reset.
[0008] The present invention proposes a method for detecting security vulnerabilities caused by asynchronous reset, comprising:
[0009] Extracting a control flow graph of the security attribute of the circuit design, and extracting all conditions from the control flow graph of the security attribute to form a first condition list, wherein the conditions in the first condition list are first conditions;
[0010] For each security attribute, create a corresponding path with an initial value of empty;
[0011] Traverse each module in the circuit design, find the always blocks that may violate the security attribute, mark the path, and add the marked always blocks to the path corresponding to the security attribute;
[0012] Extracting conditions in the path corresponding to the security attribute to form a second condition list, where the conditions in the second condition list are second conditions;
[0013] Search the first condition list of the security attribute for a first condition that is the same as the second condition corresponding to the security attribute. If not found, cancel the path mark. If found, align the corresponding second condition with the corresponding first condition.
[0014] After all second conditions in the second condition lists corresponding to the security attributes are searched and processed, symbolic execution is performed based on the path;
[0015] If a safety property is found to be violated, start from the statement where the safety property is violated, search the driving signals of the signals in the statement in turn, and determine whether there is a violation until the source of the violation signal is found;
[0016] Construct the complete path from the source of the violating signal to the violating statement.
[0017] Furthermore, the control flow graph is extracted by the following steps:
[0018] Extracting a node in the security attribute, wherein the node includes at least one of a conditional statement, an assignment statement, a combinational logic, and a sequential logic;
[0019] Taking the corresponding security attribute as a unit, the nodes in the same unit are connected according to the execution order of the nodes, and the start node and the end node are added to the node group in each interconnected unit to form a control flow graph of the corresponding security attribute.
[0020] Furthermore, before extracting the nodes in the security attribute, the security attribute is converted into Verilog code, so that the conditional statement of the security attribute is converted into a Boolean expression, and / or the assignment statement of the security attribute is converted into an assignment statement expressed in the Verilog language, and / or the combinational logic of the security attribute is converted into the combinational logic expressed in the Verilog language, and / or the sequential logic of the security attribute is converted into the sequential logic expressed in the Verilog language.
[0021] Furthermore, the always block in the circuit design that may violate the corresponding security attribute is an always block of a signal whose trigger signal belongs to a sensitivity list of the security attribute.
[0022] Furthermore, the order of adding the always blocks is based on the execution order of the control flow graph of the corresponding security attributes.
[0023] Further, aligning the corresponding second condition with the corresponding first condition includes:
[0024] When the first conditions corresponding to two or more second conditions are in an AND relationship in the first condition list, the corresponding second conditions in the second condition list are updated and the corresponding second conditions are matched with the corresponding first conditions;
[0025] When the first conditions corresponding to two or more second conditions are in an OR relationship in the first condition list, the second condition list is not updated.
[0026] Furthermore, the symbolic execution of the path includes:
[0027] Determine whether the reset signal in the sensitivity list of the security attribute is a regular signal. If so, perform full symbolic execution.
[0028] Determine whether the reset signal in the sensitivity list of the security attribute will not be triggered. If so, perform regular symbolic execution.
[0029] Furthermore, the complete path of the offending statement is obtained by the following steps:
[0030] Create an empty traceability path;
[0031] Modules that violate security properties are considered as illegal modules;
[0032] Extract the control flow graph of the offending module and find all the inputs of the offending module and add them to the input list corresponding to the offending module;
[0033] Add the path of the control flow graph of the offending module to the traceability path;
[0034] When the current input list does not contain all the inputs of the circuit design, the previous module of the offending module is treated as the offending module according to the module hierarchy, and the process returns to the step corresponding to extracting the control flow graph of the offending module to continue processing;
[0035] When the current input list includes all inputs of the circuit design, according to the traceability path, starting from the asynchronous reset signal of the circuit design and ending at the statement with the security property violation, a complete violation path is formed.
[0036] Furthermore, when there is a mutual relationship between two modules in the module hierarchy, the mutual relationship between the two modules is a parent-child relationship or a brother relationship, and the previous module of the illegal module is the parent module of the illegal module.
[0037] Furthermore, the input of the illegal module is obtained by creating a register class to store all register information of the illegal module, and the register class is used to obtain the input of the illegal module.
[0038] Furthermore, obtaining the input of the offending module based on the register class includes:
[0039] Analyzing the input signals and conditions of each register in the register class in turn;
[0040] If the input signal of the current register comes directly from the input port of the module, then add the input port to the input list;
[0041] If the input signal of the current register comes from the assignment statement of other registers, then the register involved in the assignment statement is added to the input list;
[0042] If the input signal of the current register comes from a conditional statement, the register involved in the conditional statement is added to the input list.
[0043] The present invention obtains a first condition list by constructing a control flow graph of security attributes, aligns the condition of the corresponding always block with the first condition in the first condition list, adds it to the path, and then performs symbolic execution. It can effectively identify security vulnerabilities caused by asynchronous resets, and through the tracing algorithm of the present invention, it can accurately find the illegal path, providing more detailed correction information for circuit design. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] The present invention is described in detail below with reference to the embodiments and accompanying drawings, in which:
[0045] Figure 1 It is the main flow chart of the present invention. DETAILED DESCRIPTION
[0046] In order to make the technical problems, technical solutions and beneficial effects to be solved by the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.
[0047] Thus, a feature indicated in this specification is intended to illustrate one of the features of one embodiment of the present invention, rather than to imply that every embodiment of the present invention must have the described feature. In addition, it should be noted that this specification describes many features. Although certain features can be combined together to illustrate possible system designs, these features can also be used in other, not explicitly described, combinations. Thus, unless otherwise noted, the described combinations are not intended to be limiting.
[0048] like Figure 1 As shown, the method for detecting security vulnerabilities caused by asynchronous reset proposed by the present invention includes the following main steps.
[0049] Extracting a control flow graph of the security attribute of the circuit design, and extracting all conditions from the control flow graph of the security attribute to form a first condition list. To facilitate the clear description of the technical solution of the present invention, the conditions in the first condition list are referred to as first conditions, that is, the conditions in the first condition list are first conditions;
[0050] For each security attribute, create a corresponding path with an initial value of empty;
[0051] Traverse each module in the circuit design, find the always blocks that may violate the security attribute, mark the path, and add the marked always blocks to the path corresponding to the security attribute;
[0052] Extracting conditions in the path corresponding to the security attribute to form a second condition list. Similarly, for ease of description, the conditions in the second condition list are referred to as second conditions, that is, the conditions in the second condition list are second conditions.
[0053] Search the first condition list of the security attribute for a first condition that is the same as the second condition corresponding to the security attribute. If not found, cancel the path mark. If found, align the corresponding second condition with the corresponding first condition.
[0054] After all second conditions in the second condition lists corresponding to the security attributes have been searched and processed, symbolic execution is performed based on the path.
[0055] If a security property is found to be violated, start from the statement with the illegal security property and search the driver signal of the signal in the statement in turn.
[0056] signal, and judge whether there is a violation until the source of the violation signal is found;
[0057] Construct the complete path from the source of the violating signal to the violating statement.
[0058] In the above technical solution, aligning the corresponding second condition with the corresponding first condition ensures that the judgment logic of the conditions in the always block in the Verilog code is consistent with the conditions and control logic listed in the control flow diagram of the safety attribute. In other words, the implementation of the conditions in the always block must be consistent with the control flow and safety S attributes defined during the design phase, and judgment and execution must be carried out according to the planned order and logic.
[0059] The modules in the above technical solution refer to the modules in the Verilog code, such as all modules defined in the RTL (register-transfer level) code, which may include control modules, interface modules, etc. Different specific design functions correspond to different modules.
[0060] The specific content included in the first condition list of the present invention is a conditional expression, that is, a conditional expression of all security attributes. Similarly, the second condition list is a conditional expression of the always block in the path.
[0061] The always block is a specific component unit of circuit design implementation, and the security attribute is used to verify whether the circuit design meets the corresponding safety standards. However, the conditions of the two are aligned. During the path execution process, if the security attribute is violated, there must be a security vulnerability in the circuit design. Therefore, the security vulnerability in the circuit design can be accurately detected, avoiding the problem that the security vulnerability of the circuit design may not be fully detected due to the limited signal combination test of dynamic simulation.
[0062] In one embodiment, the control flow graph is extracted using the following steps.
[0063] Extracting nodes from the security attribute, where the nodes include at least one of a conditional statement, an assignment statement, a combinational logic, and a sequential logic;
[0064] Taking the corresponding security attribute as a unit, the nodes in the same unit are connected according to the execution order of the nodes, and the start node and the end node are added to the node group in each interconnected unit to form a control flow graph of the corresponding security attribute.
[0065] In one embodiment, before extracting the nodes in the security attribute, the security attribute is converted into Verilog code, so that the conditional statement of the security attribute is converted into a Boolean expression, and / or the assignment statement of the security attribute is converted into an assignment statement expressed in the Verilog language, and / or the combinational logic of the security attribute is converted into the combinational logic expressed in the Verilog language, and / or the sequential logic of the security attribute is converted into the sequential logic expressed in the Verilog language.
[0066] Assume the following security properties:
[0067] property reset_value_set_0;
[0068] @(posedge clk and negedge nRST)! nRST|=>ifid.instr_out==0&&ifid.pc_next_out==0;
[0069] endproperty / / reset_value_set_0
[0070] This security property indicates that when the reset signal nRST falls, if the nRST signal is low, the values of the ifid.instr_out and ifid.pc_next_out registers must be 0.
[0071] Then the steps to create the control flow graph of this security property are as follows.
[0072] First, parse the security attributes and convert them into Verilog code as shown below.
[0073]
[0074] Determine whether the safety logic needs to process conditional statements and extract the conditional statements! nRST.
[0075] Determine whether the security logic needs to process assignment statements, and extract the assignment statements ifid.instr_out==0 and ifid.pc_next_out==0.
[0076] Create separate nodes for conditional statements and assignment statements.
[0077] Connect the condition nodes and assignment nodes according to the execution order.
[0078] It is determined whether the security logic needs to process combinational logic, and it is determined that the security attribute does not include combinational logic.
[0079] Determine whether the security attribute needs to process sequential logic, create nodes for the sequential logic posedge clk and negedgenRST, and add them before all nodes.
[0080] For the above node group, add a start node and an end node to complete the control flow graph of this security property.
[0081] In one embodiment, the always block that may violate the corresponding security attribute in the circuit design is an always block that triggers a signal that is included in the sensitive list of security attributes. The signals included in the sensitive signal list are typically clock signals and / or reset signals. These signals are more likely to cause security risks, especially reset signals.
[0082] In one embodiment, the order in which the always blocks are added in the path is based on the execution order of the control flow graph of the corresponding security attributes.
[0083] In one embodiment, aligning the corresponding second conditions with the corresponding first conditions includes the following steps.
[0084] When the first conditions corresponding to two or more second conditions are in an AND relationship in the first condition list, the corresponding second conditions in the second condition list are updated and the corresponding second conditions are matched with the corresponding first conditions;
[0085] When the first conditions corresponding to two or more second conditions are in an OR relationship in the first condition list, the second condition list is not updated.
[0086] The following example illustrates this. Assume there is an always block with the following code.
[0087]
[0088]
[0089] Corresponding security attributes:
[0090] property regA_prop;
[0091] @(posedge clk)disable iff(reset)
[0092] (A==B)&&(C==D)|->regA==valA;
[0093] endproperty
[0094] The trigger condition clk of the always block is a signal in the sensitive list. The conditions of the always block are A == B, C == D, which are also included in the second condition list. The AND relationship between the two conditions is determined by the security attribute, that is, the corresponding first condition in the first condition list is (A == B) && (C == D). At this time, the two second conditions in the second condition list, A == B, C == D, should be updated. Update these two second conditions to (A == B) && (C == D).
[0095] When searching for security vulnerabilities caused by reset signals, we can determine whether the reset signal in the security attribute's sensitivity list is a regular signal. If so, we perform full symbolic execution. If the reset signal in the security attribute's sensitivity list is not triggered, we perform regular symbolic execution.
[0096] Determine whether the reset signal is a regular signal, and if so, perform full symbolic execution. Regular signals in the present invention refer to signals generally generated by control logic or timers in a circuit, such as clock signals, counter signals, etc.
[0097] Determine whether the reset signal is triggered. If so, perform regular symbolic execution. Determine whether the reset signal is triggered based on the reset situation.
[0098] Synchronous reset is usually controlled by a clock signal, and its triggering condition is related to the circuit's clock signal. For example, when the rising edge of the clock signal arrives, the reset signal will be triggered.
[0099] Asynchronous reset is usually triggered by external events, such as power failure, error detection, etc. Its triggering condition is independent of the circuit's clock signal.
[0100] The main difference between full symbolic execution and regular symbolic execution lies in the treatment of the state space.
[0101] Full symbolic execution explores all possible execution paths, including all conditions and branches, to find all potential errors in the code. It can find all possible input combinations, thereby revealing all potential errors and security vulnerabilities. Conventional symbolic execution, on the other hand, focuses only on some paths and is suitable for rapid verification in specific scenarios. It uses a strategy (such as depth-first or breadth-first) to selectively explore specific paths.
[0102] To match the always block or conditional block with the symbolic execution path, you can mark the path, that is, mark the use of symbolic variables and the path condition (PC) corresponding to each path.
[0103] The following example shows an always block with symbolic variable annotations. Multiple path conditions are annotated in this always block, including path1, path1.1, path1.2, path2, and path2.1. In symbolic execution, a is replaced with the symbolic variable A, and b is replaced with the symbolic variable B. For example, path1 has the condition A > 4, meaning that the path is executed only when the value of a is greater than 4.
[0104]
[0105] If the security properties are found to be violated during symbolic execution, it means that there is a security vulnerability in the circuit design.
[0106] In one embodiment, the complete path of the offending statement is obtained through the following steps.
[0107] Create an empty traceability path;
[0108] Modules that violate security properties are identified as offending modules. The control flow graph of the offending module is extracted, and all inputs of the offending module are found and added to the input list corresponding to the offending module. In other words, each offending module corresponds to an input list, and the input signals in the input list are the input signals that may cause security vulnerabilities in the offending module. The extraction of the module's control flow graph is similar to the extraction of the control flow graph of the security property. The nodes in the module are extracted, and the nodes include at least one of conditional statements, assignment statements, combinational logic, and sequential logic. Taking the corresponding module as the unit, the nodes in the same unit are connected according to the execution order of the nodes, and the start node and end node are added to the node group in each interconnected unit to form the control flow graph of the corresponding module.
[0109] Add the path of the control flow graph of the offending module to the traceability path;
[0110] If the current input list does not include all inputs for the circuit design, the module hierarchy will identify the previous module as the offending module, and the process will return to the step corresponding to extracting the offending module's control flow graph to continue processing. The module hierarchy is primarily constructed through parent-child and sibling relationships. For example, assume the top module has three submodules, A, B, and C. Module A has two submodules, a1 and a2. Module B has two submodules, b1 and b2. Module a1 has two submodules, a11 and a12. Module a1 is directly connected to module b1. For example, module a1 has module A as its parent, modules a11 and a12 as its child, and module b1 as its sibling. In other words, modules with a parent-child relationship are nested during programming.
[0111] When the current input list includes all inputs of the circuit design, according to the traceability path, starting from the asynchronous reset signal of the circuit design and ending at the statement with the security property violation, a complete violation path is formed.
[0112] The current input list refers to the input list corresponding to the illegal module being analyzed.
[0113] If there is more than one illegal statement, the above method is used to find the complete illegal path for each illegal statement.
[0114] In the above technical solution, when there is a mutual relationship between two modules in the module hierarchy, the mutual relationship between the two is a parent-child relationship or a brother relationship, and the previous module of the illegal module is the parent module of the illegal module.
[0115] The following describes the flow of the violation path in detail.
[0116] The module corresponding to the violated security property is called the violating module.
[0117] 1) Initialization:
[0118] Create an empty path to store the traceability path;
[0119] Define a register class to store information about each register in the violation module. The register information includes the register name, the register to which the register is written, and the register that controls the write condition.
[0120] 2) Error signal identification:
[0121] Extract control flow graph paths from the offending module;
[0122] Using the information about register classes in the path, a list of inputs that will cause errors in the offending module is constructed;
[0123] The register class contains information about all registers in the path. The input signals and conditions of each register in the register class are analyzed in turn.
[0124] For each register:
[0125] If the register's input signal comes directly from the module's input port, add the input port to the input list.
[0126] If the input signal of a register comes from an assignment statement of another register, the register involved in the assignment statement is added to the input list.
[0127] If the input signal of a register comes from a conditional statement, add the register involved in the conditional statement to the input list.
[0128] Repeat the above steps until the input list contains all registers involved in the violation path.
[0129] Assume that the module has the following code snippet:
[0130] always@(posedge clk)begin
[0131] if(cond_A)begin
[0132] reg_A<=reg_B;
[0133] end
[0134] else if(cond_B)begin
[0135] reg_A<=reg_C;
[0136] end
[0137] else begin
[0138] reg_A<=reg_D;
[0139] end
[0140] end
[0141] In the above code, reg_A is the register used in the offending statement. reg_B, reg_C, and reg_D are other registers.
[0142] cond_A,cond_B are conditional statements.
[0143] The process of building the input list is as follows.
[0144] Starting from the offending statement reg_A<=..., find its corresponding always block.
[0145] Analyze the conditional statements in the always block to determine the source of the assignment of reg_A.
[0146] If cond_A is true, then reg_A comes from reg_B.
[0147] If cond_B is true, then reg_A comes from reg_C.
[0148] If none of the above conditions are true, then reg_A comes from reg_D.
[0149] According to the above analysis, add reg_B, reg_C, and reg_D to the input list.
[0150] 3) Tracking violation signals:
[0151] Add the control flow graph path in step 2) to the traceability path in step 1);
[0152] Check that the input list in step 2) contains all inputs for the SoC design:
[0153] If it is included, the tracing is completed and the tracing path is returned;
[0154] If not, traverse the module hierarchy upwards, find the parent module that contains the offending module, and set it as the new offending module; and return to step 2) until the input list contains all inputs.
[0155] 4) Return result: Returns the complete traceability path, which starts from the asynchronous reset of the SoC and ends at the security property violation.
[0156] The present invention aligns the conditions in the always block with the conditions of the control flow graph of the corresponding security attributes and performs symbolic execution. In conjunction with formal verification, it can model the reset signal and analyze the relationship between it and the design state, thereby systematically verifying all possible reset combinations to ensure that no potential security vulnerabilities are missed. The technical effect of effectively identifying security vulnerabilities caused by asynchronous resets is achieved. In addition, the present invention can find illegal paths through tracing, which helps developers quickly find and fix security vulnerabilities and improve the security of SoCs.
[0157] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.
Claims
1. A method for detecting a security vulnerability caused by asynchronous reset, characterized in that: include: Extracting a control flow graph of the security attribute of the circuit design, and extracting all conditions from the control flow graph of the security attribute to form a first condition list, wherein the conditions in the first condition list are first conditions; For each security attribute, create a corresponding path with an initial value of null; Traverse each module in the circuit design, find the always block that may violate the security attribute and mark the path, so that the always block marked by the path is added to the path corresponding to the security attribute; Extracting conditions in the path corresponding to the security attribute to form a second condition list, wherein the conditions in the second condition list are second conditions; Search the first condition list of the security attribute for a first condition that is the same as the second condition corresponding to the security attribute, and if not found, cancel the path mark; If found, align the corresponding second condition with the corresponding first condition; After the second conditions in the second condition list corresponding to all security attributes are searched and processed, symbolic execution is performed based on the path; If a security property is found to be violated, start from the statement where the security property is violated, search for the driving signal of the signal in the statement in turn, and determine whether there is a violation until the source of the violation signal is found; Construct the complete path from the source of the violating signal to the violating statement.
2. The method for detecting a security vulnerability caused by asynchronous reset according to claim 1, characterized in that: The control flow graph is extracted by the following steps: Extracting nodes in the security attribute, wherein the nodes include at least one of a conditional statement, an assignment statement, a combinational logic, and a sequential logic; Taking the corresponding security attribute as a unit, the nodes in the same unit are connected according to the execution order of the nodes, and the start node and the end node are added to the node group in each interconnected unit to form a control flow graph of the corresponding security attribute.
3. The method for detecting a security vulnerability caused by asynchronous reset as claimed in claim 1, characterized in that: The always block in the circuit design that may violate the corresponding security attribute is an always block of a signal whose trigger signal belongs to a sensitivity list of the security attribute.
4. The method for detecting a security vulnerability caused by asynchronous reset according to claim 1, characterized in that: The order in which the always blocks are added is based on the execution order of the control flow graph of the corresponding security attributes.
5. The method for detecting a security vulnerability caused by asynchronous reset according to claim 1, characterized in that: Aligning the corresponding second condition with the corresponding first condition includes: When the first conditions corresponding to two or more second conditions are in an AND relationship in the first condition list, the corresponding second conditions in the second condition list are updated to match the corresponding second conditions with the corresponding first conditions; When the first conditions corresponding to two or more second conditions are in an OR relationship in the first condition list, the second condition list is not updated.
6. The method for detecting a security vulnerability caused by asynchronous reset according to claim 1, characterized in that: The path for symbolic execution includes: Determine whether the reset signal in the sensitivity list of the security attribute is a regular signal. If so, perform full symbolic execution. Determine whether the reset signal in the sensitivity list of the security attribute will not be triggered. If so, perform regular symbolic execution.
7. The method for detecting a security vulnerability caused by asynchronous reset as claimed in claim 1, characterized in that: The full path of the offending statement is obtained by following the steps below: Create an empty traceability path; Modules that violate security properties are considered as offending modules; Extract the control flow graph of the offending module, and find all the inputs of the offending module and add them to the input list corresponding to the offending module; Add the path of the control flow graph of the offending module to the traceability path; When the current input list does not contain all the inputs of the circuit design, the previous module of the illegal module is taken as the illegal module according to the hierarchy of the modules, and the process is returned to the step corresponding to extracting the control flow graph of the illegal module to continue processing; When the current input list contains all inputs of the circuit design, according to the traceability path, starting from the asynchronous reset signal of the circuit design until the statement with the security property violation ends, a complete violation path is formed.
8. The method for detecting a security vulnerability caused by asynchronous reset as claimed in claim 7, characterized in that: The input of the violation module creates a register class to store all register information of the violation module, and the input of the violation module is obtained according to the register class.
9. The method for detecting a security vulnerability caused by asynchronous reset as claimed in claim 8, characterized in that: The inputs to obtain the offending module based on the register class include: Analyzing the input signal and condition of each register in the register class in turn; If the input signal of the current register comes directly from the input port of the module, add the input port to the input list; If the input signal of the current register comes from the assignment statement of other registers, the register involved in the assignment statement is added to the input list; If the input signal of the current register comes from a conditional statement, the register involved in the conditional statement is added to the input list.