RTL Security Issue Detection via Simulation Dataflow Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Information Flow Tracking (IFT) techniques for detecting security issues in hardware designs face challenges such as low performance, high complexity, low precision, and high overhead, often resulting in false positives and over-tainting, particularly due to the need for instrumentation of Hardware Description Languages (HDL) which complicates implementation and increases overhead.
Innovation Solution
The proposed solution involves detecting dataflows without modifying the HDL code by comparing unmodified simulations to altered simulations, where RTL signal values are modified at specific dataflow start points, allowing for the identification of potential security issues through flow metadata generation and policy application, thereby reducing complexity and overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If instrumentation of HDL code is used for IFT, then detection capability is improved, but device complexity and overhead increase
Solution Approach 1:
The patent extracts the instrumentation logic from the HDL code itself and places it in a separate simulation environment. Instead of modifying the HDL code with instrumentation, the system uses external simulation tools to perform IFT analysis, thereby removing the complex instrumentation burden from the hardware description while maintaining detection capability.
Solution Approach 2:
The patent introduces a simulation environment as an intermediary between the HDL code and the IFT analysis. This simulation environment acts as a mediator that can alter signal values and track dataflows without requiring direct modification of the HDL code, thus reducing implementation complexity while maintaining analysis capability.
2Reliability
If instrumentation of HDL code is used for IFT, then detection capability is improved, but simulation overhead increases
Solution Approach 1:
The patent extracts the overhead-generating instrumentation logic from the HDL code and relocates it to a separate simulation framework. This separation allows the simulation environment to perform IFT analysis without continuously instrumenting the HDL code, thereby reducing the simulation overhead while preserving detection capability.
Solution Approach 2:
The patent performs preliminary actions by establishing the simulation environment and defining dataflow specifications before actual simulation runs. This preliminary setup allows for efficient simulation execution by pre-configuring the analysis framework, reducing the overhead during actual IFT detection operations.
3Reliability
If instrumentation of HDL code is used for IFT, then detection capability is improved, but precision decreases due to false positives
Solution Approach 1:
The patent uses a simulation environment as an intermediary that can precisely control and track dataflows without the inaccuracies introduced by HDL instrumentation. This intermediary simulation framework allows for more accurate detection by using controlled signal alterations and comprehensive dataflow tracking, thereby reducing false positives and improving precision.
Solution Approach 2:
The patent implements feedback mechanisms in the simulation environment that continuously monitor and adjust the dataflow tracking process. By comparing simulated behavior against expected dataflow patterns and using this feedback to refine the analysis, the system improves detection precision and reduces false positives while maintaining comprehensive detection capability.
Data Source
AI summary
Embodiments described herein are generally directed to detecting security issues in a hardware design using IFT. In an example, dataflows are tracked within a hardware design represented in an HDL without instrumenting the HDL. Dataflow primitives are received specifying taint sources from which the dataflows are to be tracked. A baseline simulation trace log is obtained for a baseline RTL simulation of the hardware design by causing a simulator to perform the baseline RTL simulation during which none of the taint sources are altered. Injection simulation trace logs are obtained for injection RTL simulations by causing the simulator to perform an injection RTL simulation, for each taint source, during which the taint source is altered. The dataflows are then identified based on comparisons between the baseline and the injection simulation trace logs. A potential security issue is detected within the hardware design by applying a policy to the dataflows.