Hardware security verification acceleration method based on control data flow diagram and RTL cutting
By constructing a control data flow graph and using RTL pruning to identify high-risk paths, removing redundant logic, and generating a simplified model, the problems of low efficiency and inaccurate results in hardware security verification are solved, achieving efficient and reliable verification results.
Patent Information
- Application Number
- CN202511682237.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-17
- Publication Date
- 2026-02-10
AI Technical Summary
Existing technologies struggle to effectively identify and remove hardware Trojans during hardware security verification, resulting in low verification efficiency, inaccurate results, and state space explosion.
By constructing a control data flow graph (CDFG) and performing RTL pruning, high-risk paths are identified and precisely pruned, removing logic unrelated to high-risk paths, and generating a simplified model for formal verification.
It achieves efficient and reliable hardware security verification, avoids the problem of false counterexamples, significantly reduces the memory consumption and time overhead of model detection, and improves verification efficiency and the accuracy of results.
Smart Images
Figure CN121503373A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of electronic design automation technology, and in particular to a method for accelerating hardware security verification based on control data flow graphs and RTL pruning. Background Technology
[0002] As integrated circuit (IC) designs become increasingly complex, maliciously implanted logic such as hardware trojans (HTs) poses a severe challenge to traditional simulation verification due to their strong concealment and stringent triggering conditions. Formal verification, especially model checking, is the most reliable means of discovering such vulnerabilities, but it encounters the fundamental obstacle of "state space explosion" in its application, leading to low verification efficiency or even failure.
[0003] To address this problem, existing technologies, while each with its own focus, all have significant shortcomings. For example, improving the model detector's algorithm itself does not reduce the complexity of the problem; its core technologies (such as OBDD and SAT) have performance bottlenecks. Abstraction-based techniques, on the other hand, sacrifice accuracy, and their core drawback is the introduction of difficult-to-handle "spurious counterexamples," leading to inaccurate verification results and reduced automation efficiency. Traditional model simplification techniques often have excessively coarse reduction granularity, failing to deeply analyze the critical execution paths within the design, frequently resulting in insufficient reduction rates or potentially the erroneous removal of critical logic.
[0004] Therefore, a hardware security verification acceleration method based on control data flow graph and RTL pruning is provided to solve the above problems. Summary of the Invention
[0005] To address the aforementioned challenges, this invention provides a hardware security verification acceleration method based on control data flow graphs and RTL pruning. It constructs a control data flow graph (CDFG) from the register-transfer level RTL design and applies a specific algorithm to identify "high-risk paths" carrying potential threats. Subsequently, guided by these high-risk paths, a precise set of RTL pruning rules is used to physically remove the source code, thereby generating a streamlined model that retains key security features but is significantly smaller in size.
[0006] To achieve the above objectives, this invention provides a hardware security verification acceleration method based on control data flow graphs and RTL pruning, comprising the following steps: S1: Perform coarse-grained filtering on the received register transmitter RTL design code and the predefined Trojan trigger and load signal set, and parse it into a structural dependency graph; S2: Perform fan-out and fan-in analysis on the structural dependency graph GS, take the intersection of the fan-out and fan-in results, and identify the "high-risk area" containing all structural paths from trigger to load. S3: Enter the behavior-level precise pruning stage, and set the original RTL to a tree-shaped control data flow graph (CDFG) that finely describes the conditional execution behavior; S4: Guided by the high-risk area, traverse the CDFG tree obtained in S3, detect redundant branch nodes that are not related to the signal in the high-risk area, and obtain the CDFG that retains the core behavior after pruning. S5: Based on the pruned CDFG, the original RTL code is automatically modified by applying the RTL pruning rule set through the pre-established pruning mapping relationship from graph nodes to source code. S6: Output a simplified RTL model that retains key safety features but is smaller in size, and perform formal verification.
[0007] Preferably, in S1, the RTL design to be verified is received and a set of seed signals predefined by the user or security expert is received. The seed signal set includes a set of Trojan trigger signals T for activating the Trojan and a set of Trojan payload signals P suspected of being used by the Trojan to leak information or perform destructive actions. A structural dependency graph GS is generated from the RTL code using a dynamic analysis tool.
[0008] Preferably, in step S2, after obtaining the structural dependency graph GS, a forward traversal is performed starting from the trigger signal T to calculate the complete fan-out influence cone; simultaneously, a reverse graph traversal is performed starting from the load signal P to calculate the complete fan-in influence cone. By taking the intersection of the fan-out influence cone and the fan-in influence cone, the "high-risk path" connecting the trigger end and the load end is obtained. The "high-risk path" surrounds a high-risk area, which contains a set of signal nodes. All "irrelevant logic" not on the "high-risk path" are the pruning targets.
[0009] Preferably, in S3, logic unrelated to "high-risk paths" is further eliminated at the behavioral level, specifically by performing the following operations: S31: Perform in-depth analysis on the input RTL design to be verified, and transform it into a tree-shaped control data flow graph (CDFG) that can accurately reflect its conditional control flow; S32: In the CDFG obtained in S31, the if-else or case conditional control structure is mapped to a branch node containing conditional judgments, true branches, and false branches. S33: The CDFG nodes generated during the conversion process will be appended with their location metadata in the original code to ensure the traceability of subsequent code mapping.
[0010] Preferably, step S4 is specifically manifested as follows: S41: After obtaining the complete CDFG, start the pruning algorithm, and use the signal node set of the high-risk area as input to perform bottom-up recursive traversal of the CDFG tree; S42: For branch nodes in the tree, the pruning algorithm checks whether the included branches drive or use signals in high-risk areas. If a branch is determined to be unrelated to a high-risk path, the branch node will be completely removed from the CDFG tree, leaving only the "related branches". S43: Obtain the pruned CDFG.
[0011] Preferably, in S5, the pruned abstract CDFG model obtained in step S43 is automatically converted back into a syntactically correct, logically equivalent, and physically smaller RTL model under the guidance of predefined RTL pruning rules.
[0012] Preferably, the pruning rule set application example follows the conditional statement simplification rule, specifically described as follows: For the if-else structure in the original logic, if the analysis in the second stage determines that only the operation within the if branch is a high-risk path, the conditional expression of the if statement will be forcibly replaced with a constant 1'b1 when generating the final RTL model; the high-risk path is fixed under the corresponding execution condition, and the normal operation logic within the else branch becomes an unreachable "dead code".
[0013] Preferably, the pruning rule set also includes removing all case branches that are not related to high-risk signals for case statements.
[0014] Preferably, in step S6, a simplified RTL design file is output, which removes a large amount of logic unrelated to high-risk paths at the physical level, while fully retaining all necessary control and data flows.
[0015] Therefore, the hardware security verification acceleration method based on control data flow graph and RTL pruning described above has the following beneficial effects: (1) Through its "path-centric" collaborative reduction strategy, this invention can accurately identify and retain all control and data flows related to potential security threats. By physically removing redundant code rather than logical abstractions, it fundamentally avoids the "pseudo-counterexample" problem, thereby ensuring the completeness of verification and the reliability of results. This two-stage precise pruning method can maximize the elimination of irrelevant logic, physically reduce the size of the design model, and thus significantly reduce the memory consumption and time overhead of model detection, effectively alleviating the state space explosion problem.
[0016] (2) This invention constructs a complete and automated framework from high-level graph analysis to low-level code modification, without the need for complex heuristic strategies or expert intervention, thereby improving the efficiency and ease of use of the model reduction process.
[0017] (3) As a preprocessing technique independent of the verifier, this invention is orthogonal to the specific model detector algorithm and can be used in combination with various existing verification tools to achieve better overall results.
[0018] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0019] Figure 1 This is a flowchart of the hardware security verification acceleration method based on control data flow graph and RTL pruning in this invention; Figure 2 This is a schematic diagram illustrating the principle of high-risk area acquisition in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the pruning principle of an embodiment of the present invention. Detailed Implementation
[0020] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.
[0021] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains.
[0022] The terms "comprising" or "including" as used in this invention mean that the element preceding the term encompasses the element listed after the term, and do not exclude the possibility of encompassing other elements. Terms such as "inner," "outer," "upper," and "lower" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. When the absolute position of the described object changes, the relative positional relationship may also change accordingly. In this invention, unless otherwise explicitly specified and limited, the term "attached" and similar terms should be interpreted broadly. For example, it can refer to a fixed connection, a detachable connection, or an integral part; it can refer to a direct connection or an indirect connection through an intermediate medium; it can refer to the internal communication of two elements or the interaction relationship between two elements. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.
[0023] Example like Figure 1As shown, the hardware security verification acceleration method based on control data flow graph and RTL pruning includes the following steps: S1: Performs coarse-grained screening on the received register transmitter RTL design code and predefined Trojan trigger and payload signal sets, parsing them into a structural dependency graph; S1 receives the RTL design to be verified and a set of seed signals predefined by the user or security expert. The seed signal set includes the Trojan trigger signal set T used to activate the Trojan and the Trojan payload signal set P suspected of being used by the Trojan to leak information or perform destructive actions. The structural dependency graph GS is generated from the RTL code using dynamic analysis tools (using open-source synthesis tools such as Yosys).
[0024] S2: Perform fan-out and fan-in analysis on the structural dependency graph GS, and take the intersection of the fan-out and fan-in results to identify the "high-risk area" containing all structural paths from triggering to load; such as Figure 2 As shown, in step S2, after obtaining the structural dependency graph GS, a forward traversal is performed starting from the trigger signal T to calculate the complete fan-out influence cone; at the same time, a reverse graph traversal is performed starting from the load signal P to calculate the complete fan-in influence cone. By taking the intersection of the fan-out influence cone and the fan-in influence cone, the "high-risk path" connecting the trigger end and the load end is obtained. The "high-risk path" surrounds the high-risk area, which contains a set of signal nodes. All "irrelevant logic" not on the "high-risk path" are the pruning targets.
[0025] S3: Enter the behavior-level precise pruning stage, setting the original RTL to a tree-structured control data flow graph (CDFG) that finely describes the conditional execution behavior; such as Figure 3 As shown, in S3, logic unrelated to "high-risk paths" is further eliminated at the behavioral level, specifically by performing the following operations: S31: Perform in-depth analysis on the input RTL design to be verified (in this embodiment, it is a piece of Verilog source code) and transform it into a tree-shaped control data flow graph (CDFG) that can accurately reflect its conditional control flow. S32: In the CDFG obtained in S31, the if-else or case conditional control structure is mapped to a branch node containing conditional judgments, true branches, and false branches. S33: The CDFG nodes generated during the conversion process will be appended with their location metadata in the original code to ensure the traceability of subsequent code mapping.
[0026] S4: Guided by the high-risk area, traverse the CDFG tree obtained in S3, detect redundant branch nodes that are not related to the signal in the high-risk area, and obtain the CDFG that retains the core behavior after pruning. Step S4 is specifically manifested as follows: S41: After obtaining the complete CDFG, start the pruning algorithm, and use the signal node set of the high-risk area as input to perform bottom-up recursive traversal of the CDFG tree; S42: For branch nodes in the tree, the pruning algorithm checks whether the included branches drive or use signals in high-risk areas. If a branch is determined to be unrelated to a high-risk path, the branch node will be completely removed from the CDFG tree, leaving only the "related branches". S43: Obtain the pruned CDFG.
[0027] S5: Based on the pruned CDFG, the original RTL code is automatically modified by applying the RTL pruning rule set through the pre-established pruning mapping relationship from graph nodes to source code. In S5, the pruned abstract CDFG model obtained in step S43 is automatically converted back into a syntactically correct, logically equivalent, and physically smaller RTL model under the guidance of predefined RTL pruning rules.
[0028] The pruning rule set application example adheres to the conditional statement simplification rule, specifically: For if-else structures in the original logic, if the second-stage analysis determines that only the operations within the if branch are high-risk paths, the conditional expression of the if statement will be forcibly replaced with a constant 1'b1 when generating the final RTL model; high-risk paths are fixed under the corresponding execution conditions, while normal operations within the else branch, although possibly preserved in the code, become logically unreachable "dead code." This will not affect verification analysis or consume verification resources.
[0029] The pruning rule set also includes removing all case branches that are not related to high-risk signals for case statements.
[0030] S6: Output a simplified RTL model that retains key security features but is smaller in size, and perform formal verification. In step S6, the simplified RTL design file is output. At the physical level, a large amount of logic unrelated to high-risk paths is removed, while all necessary control and data flows are fully retained, preparing it for efficient and in-depth security analysis by subsequent formal verification tools.
[0031] Therefore, this invention adopts the above-mentioned hardware security verification acceleration method based on control data flow graph and RTL pruning. By physically removing code rather than logically abstracting, it fundamentally avoids the "pseudo-counterexample" problem, ensuring that the behavior of the reduced model is a true subset of the original design, making the verification results more reliable. This provides a practical path that combines efficiency and accuracy for applying rigorous formal verification in complex hardware designs.
[0032] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.
Claims
1. A hardware security verification acceleration method based on control data flow graph and RTL pruning, characterized in that, Includes the following steps: S1: Perform coarse-grained filtering on the received register transmitter RTL design code and the predefined Trojan trigger and load signal set, and parse it into a structural dependency graph; S2: Perform fan-out and fan-in analysis on the structural dependency graph GS, take the intersection of the fan-out and fan-in results, and identify the "high-risk area" containing all structural paths from trigger to load. S3: Enter the behavior-level precise pruning stage, and set the original RTL to a tree-shaped control data flow graph (CDFG) that finely describes the conditional execution behavior; S4: Guided by the high-risk area, traverse the CDFG tree obtained in S3, detect redundant branch nodes that are not related to the signal in the high-risk area, and obtain the CDFG that retains the core behavior after pruning. S5: Based on the pruned CDFG, the original RTL code is automatically modified by applying the RTL pruning rule set through the pre-established pruning mapping relationship from graph nodes to source code. S6: Output a simplified RTL model that retains key safety features but is smaller in size, and perform formal verification.
2. The hardware security verification acceleration method based on control data flow graph and RTL pruning as described in claim 1, characterized in that: In S1, the RTL design to be verified is received, along with a set of seed signals predefined by the user or security expert. The seed signal set includes a set of Trojan trigger signals T for activating the Trojan and a set of Trojan payload signals P suspected of being used by the Trojan to exploit leaked information or perform destructive actions. A structural dependency graph GS is generated from the RTL code using dynamic analysis tools.
3. The hardware security verification acceleration method based on control data flow graph and RTL pruning as described in claim 2, characterized in that: In step S2, after obtaining the structural dependency graph GS, a forward traversal is performed starting from the trigger signal T to calculate the complete fan-out influence cone; simultaneously, a reverse graph traversal is performed starting from the load signal P to calculate the complete fan-in influence cone. By taking the intersection of the fan-out influence cone and the fan-in influence cone, the "high-risk path" connecting the trigger end and the load end is obtained. The "high-risk path" forms a high-risk region containing a set of signal nodes. All "irrelevant logic" not on the "high-risk path" are pruning targets.
4. The hardware security verification acceleration method based on control data flow graph and RTL pruning as described in claim 3, characterized in that: In S3, logic unrelated to "high-risk paths" is further eliminated at the behavioral level, specifically by performing the following operations: S31: Perform in-depth analysis on the input RTL design to be verified, and transform it into a tree-shaped control data flow graph (CDFG) that can accurately reflect its conditional control flow; S32: In the CDFG obtained in S31, the if-else or case conditional control structure is mapped to a branch node containing conditional judgments, true branches, and false branches. S33: The CDFG nodes generated during the conversion process will be appended with their location metadata in the original code to ensure the traceability of subsequent code mapping.
5. The hardware security verification acceleration method based on control data flow graph and RTL pruning as described in claim 4, characterized in that: Step S4 is specifically manifested as follows: S41: After obtaining the complete CDFG, start the pruning algorithm, and use the signal node set of the high-risk area as input to perform bottom-up recursive traversal of the CDFG tree; S42: For branch nodes in the tree, the pruning algorithm checks whether the included branches drive or use signals in high-risk areas. If a branch is determined to be unrelated to the high-risk path, the branch node will be completely removed from the CDFG tree, leaving only the "related branches". S43: Obtain the pruned CDFG.
6. The hardware security verification acceleration method based on control data flow graph and RTL pruning as described in claim 5, characterized in that: In S5, the pruned abstract CDFG model obtained in step S43 is automatically converted back into a syntactically correct, logically equivalent, and physically smaller RTL model under the guidance of predefined RTL pruning rules.
7. The hardware security verification acceleration method based on control data flow graph and RTL pruning as described in claim 6, characterized in that: The application example of the pruning rule set follows the conditional statement simplification rule, specifically described as follows: For the if-else structure in the original logic, if the analysis in the second stage determines that only the operation within the if branch is a high-risk path, the conditional expression of the if statement will be forcibly replaced with a constant 1'b1 when generating the final RTL model. High-risk paths are fixed under the corresponding execution conditions, and the normal operation logic within the else branch becomes unreachable "dead code".
8. The hardware security verification acceleration method based on control data flow graph and RTL pruning as described in claim 7, characterized in that: The pruning rule set also includes removing all case branches that are not related to high-risk signals for case statements.
9. The hardware security verification acceleration method based on control data flow graph and RTL pruning as described in claim 8, characterized in that: In step S6, a simplified RTL design file is output, which removes a large amount of logic unrelated to high-risk paths at the physical level, while fully retaining all necessary control and data flows.