Time-triggered ethernet switch security test system and test method

Abstract

The application discloses a time-triggered Ethernet switch security test system, which is used for testing RTL design of a time-triggered Ethernet switch, taking RTL design code as platform input, converting the circuit design into a netlist based on a synthesis tool, and further converting the netlist into a model with a security attribute label by using a corresponding model library; meanwhile, according to the security requirement of the time-triggered Ethernet switch, the security attribute to be detected is determined, and the security attribute is mapped into the model by using a formal language. After the model is processed, the verification is carried out by a detection tool, and if a failure result is found, it is indicated that there may exist defects and vulnerabilities. The application is used for security evaluation in the design stage of the time-triggered Ethernet switch, and is used for detecting whether there exist security vulnerabilities and malicious modules in the time-triggered Ethernet switch, verifying whether there exist hardware Trojan horses and the like in third-party IP used in the time-triggered Ethernet switch, and verifying whether the syntax in a self-defined module is standard and whether there exist security vulnerabilities.

Description

Technical Field

[0001] This invention relates to a time-triggered Ethernet switch security testing system and method, belonging to the field of aerospace component quality assurance and testing technology. Background Technology

[0002] The time-triggered Ethernet switch supports gigabit / 100 Mbps ports, dual / triple-network high-reliability architectures, and TT, RC, and BE services. Its main function is to implement time-triggered Ethernet network switching. The entire device consists of a network packet switching processing unit (SWCORE), a processor, and peripheral interfaces.

[0003] The Network Packet Switching Processing Unit (SWCORE) consists of time synchronization, data switching, and built-in terminal interface modules. It mainly completes the time synchronization of network packet switching nodes and the forwarding of mixed TT, RC, and BE services.

[0004] The processor contains the following modules:

[0005] 1) It has an internal arithmetic unit to perform instruction parsing and calculation;

[0006] 2) It has a Joint Test Interface (JTAG) for online debugging;

[0007] 3) It has a phase-locked loop (PLL) to support the configuration of the processor clock's operating frequency;

[0008] 4) It has instruction memory (IRAM) and data storage (DRAM) units for online program execution;

[0009] 5) It has a read-only memory (ROM) for the chip to boot the program;

[0010] 6) It features a Vector Interrupt Controller (VIC) to enhance and extend the processor's interrupt handling performance;

[0011] 7) It has a data transfer controller (DMA) for copying address space data.

[0012] Peripheral interfaces include System Control (SCFG), External Bus (EBI), Serial Port (UART), Serial Peripheral Interface (QSPI), General Purpose Input / Output Interface (GPIO), Management Data Input / Output Interface (MDIO), Timer, Watchdog (WDOG), and other interfaces.

[0013] Whether it's the Network Packet Exchange Unit (SWCORE), the processor, or the peripheral interfaces, many of these modules rely on third-party IPs and cannot be fully controlled independently. They are highly susceptible to being embedded with malicious modules such as Trojans. Therefore, it is urgent to conduct security testing on them to ensure the safe and reliable application of time-triggered Ethernet switches. Summary of the Invention

[0014] The purpose of this invention is to overcome the shortcomings of the prior art and propose a security testing system for time-triggered Ethernet switches. This system analyzes the functional correctness, security, and reliability of time-triggered Ethernet switches, verifies whether they meet the design specifications, and detects whether there are any design vulnerabilities, security loopholes, or reliability risks.

[0015] The technical solution adopted in this invention is as follows:

[0016] On the one hand, this invention proposes a time-triggered Ethernet switch security testing system, including a security model construction module, a sub-module extraction module, a security attribute extraction and mapping module, a model detection module, and a vulnerability and defect location module;

[0017] The security model building module converts and processes the RTL design code of time-triggered Ethernet switches to generate a circuit model with security attributes.

[0018] The sub-module extraction module is used to decompose the entire circuit model into several sub-circuit models with smaller state spaces;

[0019] The security attribute extraction and mapping module determines the security attributes to be verified based on security requirements and transforms them into constraints that can be recognized by the model detection module.

[0020] The model detection module traverses the state space of all sub-circuit models and verifies whether the constraints or assertions pass based on the constraints.

[0021] The vulnerability and defect localization module performs reverse analysis on the failure results detected by the model detection module, thereby determining the corresponding information transmission path and input state.

[0022] Furthermore, the security model construction module includes a comprehensive tool and an information flow logic model library;

[0023] The synthesis tool is a core component in the integrated circuit design flow. It is used to convert the RTL design code of the time-triggered Ethernet switch circuit into a gate-level netlist, and then use the corresponding information flow logic model library to further convert the gate-level netlist into a security model with security attribute labels, i.e., a circuit model for security analysis.

[0024] Furthermore, the information flow logic model library is composed of basic logic units with security attribute tags, wherein each basic logic unit not only contains logical information, but also carries corresponding security information.

[0025] Furthermore, the integrated tool refers to EDA software.

[0026] Furthermore, the security attribute extraction and mapping module extracts the security attributes of interest to the time-triggered Ethernet switch from the security attribute library according to the security requirements of the time-triggered Ethernet switch, and uses them as security attributes to be verified. Then, it uses a formal language to describe the security attributes to be verified as assertions and constraint information of the security model, which serve as constraint conditions.

[0027] Furthermore, the security attribute library contains design attributes, which refer to the security, reliability, and fault tolerance design attributes that integrated circuit designs should meet.

[0028] Secondly, the present invention also proposes a security testing method for time-triggered Ethernet switches, comprising the following steps:

[0029] (1) Convert the RTL design code of the time-triggered Ethernet switch into a circuit model with security attributes;

[0030] (2) Decompose the entire circuit model into several sub-circuit models with smaller state spaces;

[0031] (3) Determine the security attributes to be verified based on security requirements and convert them into constraints that can be identified during model detection;

[0032] (4) Traverse the state space of all sub-circuit models and verify whether the constraints or assertions pass according to the constraints.

[0033] (5) Perform reverse analysis on the failed detection results to determine the corresponding information transmission path and input status.

[0034] Furthermore, step (1) converts the RTL design code of the time-triggered Ethernet switch into a circuit model with security attributes, specifically as follows:

[0035] Convert the RTL design code of the time-triggered Ethernet switch circuit into a gate-level netlist;

[0036] The gate-level netlist is converted into a security model with security attribute labels using the corresponding information flow logic model library, which is a circuit model for security analysis.

[0037] Furthermore, the information flow logic model library is composed of basic logic units with security attribute tags, wherein each basic logic unit not only contains logical information, but also carries corresponding security information; the integrated tool refers to EDA software.

[0038] Furthermore, the security attribute extraction mapping involves extracting the security attributes of interest to the time-triggered Ethernet switch from the security attribute library based on the security requirements of the time-triggered Ethernet switch. These attributes are then used as security attributes to be verified. Subsequently, a formal language is used to describe the security attributes to be verified as assertions and constraint information of the security model, serving as constraint conditions.

[0039] The beneficial effects of this invention compared to the prior art are as follows:

[0040] This invention analyzes the functional correctness, security, and reliability of time-triggered Ethernet switches, verifies whether they meet design specifications, and detects any design vulnerabilities, security flaws, or reliability risks. This invention ensures the safe and reliable application of time-triggered Ethernet switches. Attached Figure Description

[0041] Figure 1 This is a system block diagram of a time-triggered Ethernet switch security testing platform;

[0042] Figure 2 A schematic diagram of the security model building modules;

[0043] Figure 3 Extract the module diagram for the submodule;

[0044] Figure 4 A schematic diagram of the security attribute extraction and mapping module;

[0045] Figure 5 This is a schematic diagram of the model detection module;

[0046] Figure 6 A schematic diagram of a vulnerability / defect localization module;

[0047] Figure 7 Flowchart for a time-triggered Ethernet switch security testing platform. Detailed Implementation

[0048] To better understand the above technical solutions, the specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0049] Security testing of time-triggered Ethernet switches primarily targets their RTL (Real-Time Level) design. This invention first uses the RTL design code as input, converting the circuit design into a netlist using synthesis tools. Then, using a corresponding model library, the netlist is further converted into a model with security attribute labels. Simultaneously, based on the security requirements of time-triggered Ethernet switches, the security attributes to be tested are determined, and these are mapped into the model using a formal language. After processing the model, it is verified by a testing tool. Failure to verify the results indicates potential defects or vulnerabilities. Reverse engineering of the model can then locate abnormal inputs and paths.

[0050] Specifically, such as Figure 1 As shown, the present invention proposes a time-triggered Ethernet switch security detection system, which is a formal verification platform for circuit design. It can be used in the design phase of time-triggered Ethernet switches to verify whether there are defects and vulnerabilities in their internal units. The system specifically includes five components: a security model construction module, a sub-module extraction module, a security attribute extraction and mapping module, a model detection module, and a vulnerability / defect localization module. Figure 1 As shown.

[0051] The security model building module converts and processes the RTL design code of time-triggered Ethernet switches to generate a circuit model with security attributes.

[0052] The sub-module extraction module is used to decompose the entire circuit model into several sub-circuit models with smaller state spaces;

[0053] The security attribute extraction and mapping module determines the security attributes to be verified based on security requirements and transforms them into constraints that can be recognized by the model detection module.

[0054] The model detection module traverses the state space of all sub-circuit models and verifies whether the constraints or assertions pass based on the constraints.

[0055] The vulnerability and defect localization module performs reverse analysis on the failure results detected by the model detection module, thereby determining the corresponding information transmission path and input state.

[0056] The following is a detailed introduction:

[0057] 1. Security Model Construction Module

[0058] The security model building module can convert the RTL (Register Transfer Level) design of a time-triggered Ethernet switch into a security model with security attributes. For example... Figure 2 As shown, the security model building module includes a comprehensive tool and an information flow logic model library;

[0059] The synthesis tool is a core component in the integrated circuit design flow. It is used to convert the RTL design code of time-triggered Ethernet switch circuits into gate-level netlists, and then further convert the gate-level netlists into security models with security attribute tags using the corresponding information flow logic model library. These security models are circuit models used for security analysis. The information flow logic model library consists of basic logic units with security attribute tags. Each basic logic unit contains not only logical information but also corresponding security information.

[0060] In practice, the first step is to obtain the RTL design of the time-triggered Ethernet switch, typically in HDL (Hardware Description Language) code. The second step involves using specialized synthesis tools to convert the RTL design into a gate-level netlist. These synthesis tools are commonly used EDA tools in circuit design. The main purpose of synthesis is to convert arithmetic operations and branching structures into basic logic units, facilitating subsequent model mapping. The third step primarily utilizes models from the basic unit logic model library to convert the gate-level netlist into a security model. The logic unit models in the information flow logic model library can be viewed as basic logic units with added security attribute labels.

[0061] 2. Submodule extraction module

[0062] The sub-module extraction module primarily performs preprocessing on the overall circuit model before detection. It decomposes the entire circuit model into several sub-circuit models with smaller state spaces. For example... Figure 3 As shown, the idea is that each circuit design consists of several sub-modules. This is especially true for time-triggered Ethernet switches, which are complex circuits composed of packet switching processing units, processors, memory, and various peripheral interfaces. Directly testing and analyzing the entire circuit could easily lead to convergence issues due to the excessively large state space. Therefore, the entire circuit design can be decomposed into multiple sub-circuit modules to reduce the model's state space. Furthermore, during the circuit design process, a module may be instantiated multiple times, or multiple modules may be equivalent in terms of security. Equivalent substitutions can be performed to further simplify the model and facilitate subsequent testing.

[0063] 3. Security Attribute Extraction Module

[0064] like Figure 4 As shown, the security attribute extraction and mapping module is responsible for extracting the security attributes of interest to time-triggered Ethernet switches from the security attribute library, and mapping them into constraints and assertions of the model through a formal language for subsequent detection criteria.

[0065] The security attribute library contains design attributes, which refer to the security, reliability, and fault tolerance design attributes that integrated circuit designs should meet.

[0066] 4. Model Detection Module

[0067] The model detection module traverses the state space of all sub-circuit models and verifies whether the constraints or assertions pass based on the constraints.

[0068] In practice, the model detection module can be a formal verification tool, such as... Figure 5 As shown, its main function is to automatically traverse the model's state space and determine whether the corresponding safety attributes are satisfied. Compared to traditional functional simulation, it has higher verification coverage and faster traversal speed.

[0069] 5. Vulnerability and Defect Location Module

[0070] like Figure 6 As shown, the vulnerability and defect localization module operates based on the output of the model detection module. For verification failures, vulnerabilities and defects are highly likely to exist. In such cases, the vulnerability and defect localization module performs reverse analysis to reconstruct the information path and input state. Furthermore, it interprets the functionality to determine whether it is indeed a vulnerability or defect.

[0071] Figure 7 The process of triggering the Ethernet switch security detection method throughout the entire time period includes:

[0072] (1) Convert the RTL design code of the time-triggered Ethernet switch into a circuit model with security attributes;

[0073] The RTL design code of the time-triggered Ethernet switch circuit is converted into a gate-level netlist; the gate-level netlist is then converted into a security model with security attribute labels using the corresponding information flow logic model library, i.e., a circuit model for security analysis.

[0074] (2) Decompose the entire circuit model into several sub-circuit models with smaller state spaces;

[0075] (3) Determine the security attributes to be verified based on security requirements and convert them into constraints that can be identified during model detection;

[0076] (4) Traverse the state space of all sub-circuit models and verify whether the constraints or assertions pass according to the constraints.

[0077] (5) Perform reverse analysis on the failed detection results to determine the corresponding information transmission path and input status.

[0078] The contents not described in detail in this specification are common knowledge to those skilled in the art.

Claims

1. A time-triggered Ethernet switch security testing system, characterized in that: It includes a security model building module, a sub-module extraction module, a security attribute extraction and mapping module, a model detection module, and a vulnerability and defect location module; The security model building module converts and processes the RTL design code of time-triggered Ethernet switches to generate a circuit model with security attributes. The sub-module extraction module is used to decompose the entire circuit model into several sub-circuit models with smaller state spaces; The security attribute extraction and mapping module determines the security attributes to be verified based on security requirements and transforms them into constraints that can be recognized by the model detection module. The model detection module traverses the state space of all sub-circuit models and verifies whether the constraints or assertions pass based on the constraints. The vulnerability and defect localization module performs reverse analysis on the failure results detected by the model detection module, thereby determining the corresponding information transmission path and input status.

2. The time-triggered Ethernet switch security testing system according to claim 1, characterized in that: The security model construction module includes comprehensive tools and an information flow logic model library; The synthesis tool is a core component in the integrated circuit design flow. It is used to convert the RTL design code of the time-triggered Ethernet switch circuit into a gate-level netlist, and then use the corresponding information flow logic model library to further convert the gate-level netlist into a security model with security attribute labels, i.e., a circuit model for security analysis.

3. The time-triggered Ethernet switch security testing system according to claim 2, characterized in that: The information flow logic model library consists of basic logic units with security attribute tags, where each basic logic unit contains not only logical information but also corresponding security information.

4. The time-triggered Ethernet switch security testing system according to claim 2, characterized in that: The integrated tool mentioned refers to EDA software.

5. The time-triggered Ethernet switch security testing system according to claim 1, characterized in that: The security attribute extraction and mapping module extracts the security attributes of interest to the time-triggered Ethernet switch from the security attribute library according to the security requirements of the time-triggered Ethernet switch. These attributes are then used as security attributes to be verified. Subsequently, the security attributes to be verified are described as assertions and constraint information of the security model using a formal language, which serve as constraint conditions.

6. The time-triggered Ethernet switch security testing system according to claim 5, characterized in that: The security attribute library contains design attributes, which refer to the security, reliability, and fault tolerance design attributes that integrated circuit designs should meet.

7. A security testing method for a time-triggered Ethernet switch, characterized in that... include: (1) Convert the RTL design code of the time-triggered Ethernet switch into a circuit model with security attributes; (2) Decompose the entire circuit model into several sub-circuit models with smaller state spaces; (3) Determine the security attributes to be verified based on security requirements and convert them into constraints that can be identified during model detection; (4) Traverse the state space of all sub-circuit models and verify whether the constraints or assertions pass according to the constraints. (5) Perform reverse analysis on the failed detection results to determine the corresponding information transmission path and input status.

8. The time-triggered Ethernet switch security testing method according to claim 7, characterized in that: Step (1) converts the RTL design code of the time-triggered Ethernet switch into a circuit model with security attributes, specifically: Use synthesis tools to convert the RTL design code of time-triggered Ethernet switch circuits into a gate-level netlist; The gate-level netlist is converted into a security model with security attribute labels using the corresponding information flow logic model library, which is a circuit model for security analysis.

9. A time-triggered Ethernet switch security testing method according to claim 8, characterized in that: The information flow logic model library consists of basic logic units with security attribute tags, where each basic logic unit contains not only logical information but also corresponding security information; the integrated tool refers to EDA software.

10. A time-triggered Ethernet switch security testing method according to claim 7, characterized in that: The security attribute extraction and mapping module extracts the security attributes of interest to the time-triggered Ethernet switch from the security attribute library based on the security requirements of the time-triggered Ethernet switch. These attributes are then used as security attributes to be verified. Subsequently, the security attributes to be verified are described as assertions and constraint information of the security model using a formal language, serving as constraint conditions.

Images