Security test system and test method for time-triggered Ethernet switch

Abstract

A security test system for a time-triggered Ethernet switch tests RTL design of the time-triggered Ethernet switch, takes RTL design codes as platform input, converts circuit design into a netlist based on a comprehensive tool, and further converts the netlist into a model with a security attribute tag by using a corresponding model library; meanwhile, according to the security requirement of the time-triggered Ethernet switch, a security attribute to be detected is determined, and the security attribute is mapped into the model by using a formalized language. After the model is processed, verification is carried out by a detection tool, and if a failure result is found, it is indicated that defects and vulnerabilities possibly exist. The method is used for evaluating the security of the time-triggered Ethernet switch in the design stage, detecting whether security vulnerabilities and malicious modules exist in the time-triggered Ethernet switch, verifying whether a third-party IP used in the time-triggered Ethernet switch has the problems of hardware Trojan and the like, and verifying whether grammar in a custom module is standard. Whether security vulnerabilities exist is determined.

Description

Technical Field

[0001] The invention relates to a time-triggered Ethernet switch safety test system and a test method, belonging to the field of aerospace component quality assurance and test technology. Background Art

[0002] The time-triggered Ethernet switch supports Gigabit / 100M network ports, dual-network / triple-network high-reliability network architecture, TT services, RC services, and BE services, and mainly realizes the network switching function of time-triggered Ethernet. The entire device consists of a network packet switching processing unit (SWCORE), a processor, and peripheral interfaces.

[0003] The network packet switching processing unit (SWCORE) consists of time synchronization, data exchange, and built-in terminal interface modules. It mainly completes the time synchronization of network packet switching nodes and the forwarding of TT, RC, and BE mixed services.

[0004] The processor contains the following modules:

[0005] 1) It has an internal computing unit to complete the parsing operation of instructions;

[0006] 2) It has a joint test interface (JTAG) for online debugging;

[0007] 3) A phase-locked loop (PLL) supports the operating frequency configuration of the processor clock;

[0008] 4) It has instruction storage (IRAM) and data storage (DRAM) units for online program operation;

[0009] 5) It has a read-only memory (ROM) for the chip to start the program;

[0010] 6) A vector interrupt controller (VIC) is used to enhance and expand the interrupt handling performance of the processor;

[0011] 7) Has a data transfer controller (DMA) for copying address space data.

[0012] The peripheral interfaces include system control (SCFG), external bus (EBI), serial port (UART), serial peripheral interface (QSPI), general input and output interface (GPIO), management data input and output interface (MDIO), timer (TIMER), watchdog (WDOG) and other interfaces.

[0013] Whether it is the network packet switching processing unit (SWCORE), processor or peripheral interface, many of these modules rely on third-party IP and cannot be completely autonomous and controllable. They are very likely to be embedded with malicious modules such as Trojans. Therefore, it is urgent to conduct security testing on them to ensure the safe and reliable application of time-triggered Ethernet switches. Summary of the invention

[0014] The purpose of the present invention is to overcome the shortcomings of the prior art and propose a time-triggered Ethernet switch security testing system to analyze the functional correctness, security and reliability of the time-triggered Ethernet switch, verify whether it meets the design specification requirements, and detect whether there are design vulnerabilities, security holes or reliability risks.

[0015] The technical solution adopted by the present invention is:

[0016] On the one hand, the present invention proposes a time-triggered Ethernet switch security testing system, including a security model building module, a submodule extraction module, a security attribute extraction mapping module, a model detection module and a vulnerability defect location module;

[0017] The security model building module converts and processes the RTL design code of the time-triggered Ethernet switch to generate a circuit model with security properties;

[0018] The sub-module extraction module is used to decompose the entire circuit model into several sub-circuit models with smaller state spaces;

[0019] The security attribute extraction and mapping module determines the security attributes to be verified according to the security requirements and converts them into constraints that can be identified by the model detection module;

[0020] The model checking module traverses the state space of all sub-circuit models and verifies whether the constraints or assertions are passed according to the constraint conditions;

[0021] The vulnerability defect location module performs reverse analysis on the failure results detected by the model detection module, and then determines the corresponding information transmission path and input status.

[0022] Further, the security model building module includes a synthesis tool and an information flow logic model library;

[0023] The synthesis tool is the core component in the integrated circuit design process. It is used to convert the RTL design code of the time-triggered Ethernet switch circuit into a gate-level netlist, and use the corresponding information flow logic model library to further convert the gate-level netlist into a security model with security attribute labels, that is, a circuit model for security analysis.

[0024] Furthermore, the information flow logic model library is composed of basic logic units with security attribute labels, wherein each basic logic unit contains not only logic information but also carries corresponding security information.

[0025] Furthermore, the synthesis tool refers to EDA software.

[0026] Furthermore, the security attribute extraction and mapping module extracts the security attributes of concern to the time-triggered Ethernet switch from the security attribute library according to the security requirements of the time-triggered Ethernet switch as the security attributes to be verified, and then uses a formal language to describe the security attributes to be verified as assertions and constraint information of the security model as constraints.

[0027] Furthermore, the security attribute library contains design attributes, which refer to the design attributes of security, reliability, and fault tolerance that the integrated circuit design should meet.

[0028] In a second aspect, the present invention further proposes a time-triggered Ethernet switch security testing method, comprising the following steps:

[0029] (1) Convert the RTL design code of the time-triggered Ethernet switch into a circuit model with security properties;

[0030] (2) Decomposing the entire circuit model into several sub-circuit models with smaller state spaces;

[0031] (3) Determine the security attributes to be verified based on security requirements and convert them into identifiable constraints during model checking;

[0032] (4) traversing the state space of all sub-circuit models and verifying whether the constraints or assertions are passed according to the constraint conditions;

[0033] (5) Perform reverse analysis on the failed detection results to determine the corresponding information transmission path and input status.

[0034] Furthermore, the step (1) converts the RTL design code of the time-triggered Ethernet switch into a circuit model with security attributes, specifically:

[0035] Convert the RTL design code of the time-triggered Ethernet switch circuit into a gate-level netlist;

[0036] The corresponding information flow logic model library is used to convert the gate-level netlist into a security model with security attribute labels, that is, a circuit model for security analysis.

[0037] Furthermore, the information flow logic model library is composed of basic logic units with security attribute labels, wherein each basic logic unit contains not only logic information but also carries corresponding security information; the synthesis tool refers to EDA software.

[0038] Furthermore, a security attribute extraction mapping is performed, and according to the security requirements of the time-triggered Ethernet switch, the security attributes that the time-triggered Ethernet switch is concerned about are extracted from the security attribute library as the security attributes to be verified, and then the security attributes to be verified are described as assertions and constraint information of the security model using a formal language as constraint conditions.

[0039] The beneficial effects brought by the present invention compared with the prior art are as follows:

[0040] The present invention analyzes the functional correctness, security and reliability of the time-triggered Ethernet switch, verifies whether it meets the design specification requirements, and detects whether there are design vulnerabilities, security holes or reliability risks. The present invention can ensure the safe and reliable application of the time-triggered Ethernet switch. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 The system block diagram of a time-triggered Ethernet switch security test platform is provided;

[0042] Figure 2 Building a modular diagram for the security model;

[0043] Figure 3 Extract module schematics for submodules;

[0044] Figure 4 Schematic diagram of security attribute extraction mapping module;

[0045] Figure 5 This is a schematic diagram of the model detection module;

[0046] Figure 6 This is a schematic diagram of the vulnerability defect location module;

[0047] Figure 7 This is the test flow chart of the time-triggered Ethernet switch security detection platform. DETAILED DESCRIPTION

[0048] In order to better understand the above technical solution, the specific implementation of the present invention is further described in detail below with reference to the accompanying drawings.

[0049] The security detection of time-triggered Ethernet switches mainly tests its RTL design. The present invention first uses the RTL design code as input, converts the circuit design into a netlist based on the synthesis tool, and further converts the netlist into a model with security attribute labels using the corresponding model library; at the same time, according to the security requirements of the time-triggered Ethernet switch, the security attributes to be tested are determined, and mapped to the model using a formal language. After the model is processed, it is verified by the detection tool. If a failure result is found, it indicates that there may be a defect vulnerability. After that, the model is reverse analyzed to locate abnormal inputs and paths.

[0050] Specifically, Figure 1 As shown in FIG. 1 , a time-triggered Ethernet switch security detection system proposed by the present invention is a circuit design formal verification platform, which can be used in the design stage of a time-triggered Ethernet switch to verify whether its internal units have defects and vulnerabilities. The system specifically includes five components: a security model construction module, a submodule extraction module, a security attribute extraction mapping module, a model detection module, and a vulnerability defect location module. Figure 1 shown.

[0051] The security model building module converts and processes the RTL design code of the time-triggered Ethernet switch to generate a circuit model with security properties;

[0052] The sub-module extraction module is used to decompose the entire circuit model into several sub-circuit models with smaller state spaces;

[0053] The security attribute extraction and mapping module determines the security attributes to be verified according to the security requirements and converts them into constraints that can be identified by the model detection module;

[0054] The model checking module traverses the state space of all sub-circuit models and verifies whether the constraints or assertions are passed according to the constraint conditions;

[0055] The vulnerability defect location module performs reverse analysis on the failure results detected by the model detection module, and then determines the corresponding information transmission path and input status.

[0056] The following is a detailed introduction:

[0057] 1. Security model building module

[0058] The security model building module can convert the RTL (register transfer level) design of a time-triggered Ethernet switch into a security model with security properties. Figure 2 As shown, the security model building module includes a synthesis tool and an information flow logic model library;

[0059] The synthesis tool is the core component in the integrated circuit design process. It is used to convert the RTL design code of the time-triggered Ethernet switch circuit into a gate-level netlist, and use the corresponding information flow logic model library to further convert the gate-level netlist into a security model with security attribute labels, that is, a circuit model for security analysis. The information flow logic model library consists of basic logic units with security attribute labels, each of which contains not only logic information but also corresponding security information.

[0060] In the specific implementation, the first step is to obtain the RTL design of the time-triggered Ethernet switch, usually the HDL (hardware description language) code; the second step is to convert the RTL design into a gate-level netlist using a professional synthesis tool, where the synthesis tool is an EDA tool commonly used in the circuit design process. The main purpose of synthesis is to convert structures such as arithmetic operations and branches into basic logic units to facilitate subsequent model mapping. The third step is to convert the gate-level netlist into a security model mainly using the model in the basic unit logic model library, where the logic unit model in the information flow logic model library can be regarded as adding security attribute labels on the basis of the basic logic unit.

[0061] 2. Submodule extraction module

[0062] The sub-module extraction module mainly performs a pre-processing on the overall circuit model before detection. The sub-module extraction module decomposes the entire circuit model into several sub-circuit models with smaller state spaces. Figure 3 As shown in the figure, the idea is that each circuit design is composed of several sub-modules. Especially for the time-triggered Ethernet switch, it is a complex circuit composed of a packet switching processing unit, a processor, a memory, and various peripheral interfaces. If the entire circuit is directly tested and analyzed, it is very likely that the detection process will be difficult to converge because the state space is too large. Therefore, the entire circuit design can be decomposed into multiple sub-circuit modules to reduce the state space of the model. Furthermore, during the circuit design process, a module may be instantiated multiple times, or multiple modules may be equivalent in terms of security. For this, equivalent replacement can be performed to simplify the model again to facilitate subsequent detection.

[0063] 3. Security attribute extraction module

[0064] like Figure 4 As shown, the security attribute extraction and mapping module is responsible for extracting the security attributes of the time-triggered Ethernet switch in the security attribute library, and mapping them into constraints and assertions of the model through a formal language for subsequent detection criteria.

[0065] The security attribute library contains design attributes, which refer to the design attributes of security, reliability, and fault tolerance that the integrated circuit design should meet.

[0066] 4. Model detection module

[0067] The model checking module traverses the state space of all sub-circuit models and verifies whether the constraints or assertions are passed according to the constraint conditions.

[0068] In specific implementation, the model checking module can be a formal verification tool, such as Figure 5 As shown in the figure, its main function is to automatically traverse the state space of the model and determine whether the corresponding safety attributes are met. Compared with traditional functional simulation, it has higher verification coverage and faster traversal speed.

[0069] 5. Vulnerability and defect location module

[0070] like Figure 6 As shown in the figure, the vulnerability and defect location module runs based on the output results of the model detection module. For the results that fail to be verified, there are very likely to be vulnerabilities and defects. The vulnerability and defect location module will reversely analyze them and restore their information path and input status. Furthermore, its function is explained to determine whether it is a vulnerability or defect.

[0071] Figure 7 The operation process of the Ethernet switch security detection method is triggered for the entire time, and the process includes:

[0072] (1) Convert the RTL design code of the time-triggered Ethernet switch into a circuit model with security properties;

[0073] The RTL design code of the time-triggered Ethernet switch circuit is converted into a gate-level netlist; the gate-level netlist is converted into a security model with security attribute labels, that is, a circuit model for security analysis, using the corresponding information flow logic model library.

[0074] (2) Decomposing the entire circuit model into several sub-circuit models with smaller state spaces;

[0075] (3) Determine the security attributes to be verified based on security requirements and convert them into identifiable constraints during model checking;

[0076] (4) traversing the state space of all sub-circuit models and verifying whether the constraints or assertions are passed according to the constraint conditions;

[0077] (5) Perform reverse analysis on the failed detection results to determine the corresponding information transmission path and input status.

[0078] The contents not described in detail in the specification of the present invention belong to the common knowledge of those skilled in the art.

Claims

1. A time-triggered Ethernet switch security test system, characterized in that: It includes security model building module, submodule extraction module, security attribute extraction and mapping module, model detection module and vulnerability defect location module; The security model building module converts and processes the RTL design code of the time-triggered Ethernet switch to generate a circuit model with security properties; The sub-module extraction module is used to decompose the entire circuit model into several sub-circuit models with smaller state spaces; The security attribute extraction and mapping module determines the security attributes to be verified according to the security requirements and converts them into constraints that can be identified by the model detection module; The model checking module traverses the state space of all sub-circuit models and verifies whether the constraints or assertions are passed according to the constraint conditions; The vulnerability defect location module performs reverse analysis on the failure results detected by the model detection module, and then determines the corresponding information transmission path and input status.

2. A time-triggered Ethernet switch security test system according to claim 1, characterized in that: The security model building module includes a synthesis tool and an information flow logic model library; Among them, the synthesis tool is the core component in the integrated circuit design process. It is used to convert the RTL design code of the time-triggered Ethernet switch circuit into a gate-level netlist, and use the corresponding information flow logic model library to further convert the gate-level netlist into a security model with security attribute labels, that is, a circuit model for security analysis.

3. A time-triggered Ethernet switch security test system according to claim 2, characterized in that: The information flow logic model library is composed of basic logic units with security attribute labels, wherein each basic logic unit contains not only logic information but also carries corresponding security information.

4. A time-triggered Ethernet switch security test system according to claim 2, characterized in that: The synthesis tool refers to EDA software.

5. The time-triggered Ethernet switch security test system according to claim 1, characterized in that: The security attribute extraction and mapping module extracts the security attributes concerned by the time-triggered Ethernet switch from the security attribute library according to the security requirements of the time-triggered Ethernet switch as the security attributes to be verified, and then uses a formal language to describe the security attributes to be verified as assertions and constraint information of the security model as constraint conditions.

6. A time-triggered Ethernet switch security test system according to claim 5, characterized in that: The security attribute library contains design attributes, which refer to the design attributes of security, reliability, and fault tolerance that the integrated circuit design should meet.

7. A time-triggered Ethernet switch security testing method, characterized in that include: (1) Convert the RTL design code of the time-triggered Ethernet switch into a circuit model with security properties; (2) Decomposing the entire circuit model into several sub-circuit models with smaller state spaces; (3) Determine the security attributes to be verified based on security requirements and convert them into identifiable constraints during model checking; (4) traversing the state space of all sub-circuit models and verifying whether the constraints or assertions are passed according to the constraint conditions; (5) Perform reverse analysis on the failed detection results to determine the corresponding information transmission path and input status.

8. A time-triggered Ethernet switch security testing method according to claim 7, characterized in that: The step (1) converts the RTL design code of the time-triggered Ethernet switch into a circuit model with security attributes, specifically: Convert the RTL design code of the time-triggered Ethernet switch circuit into a gate-level netlist; The corresponding information flow logic model library is used to convert the gate-level netlist into a security model with security attribute labels, that is, a circuit model for security analysis.

9. A time-triggered Ethernet switch security testing method according to claim 8, characterized in that: The information flow logic model library is composed of basic logic units with security attribute labels, wherein each basic logic unit contains not only logic information but also carries corresponding security information; the synthesis tool refers to EDA software.

10. A time-triggered Ethernet switch security testing method according to claim 7, characterized in that: The security attribute extraction and mapping module extracts the security attributes concerned by the time-triggered Ethernet switch from the security attribute library according to the security requirements of the time-triggered Ethernet switch as the security attributes to be verified, and then uses a formal language to describe the security attributes to be verified as assertions and constraint information of the security model as constraints.

Images