An efficient algorithm for identifying security relevant logic and vulnerabilities in RTL designs

Abstract

For complex production hardware designs, a significant challenge is to decide where to look for security issues. Published approaches to information flow security analysis find all paths from signals for an asset to ports accessible by an adversary, such as a secret key to a point of disclosure. Although this can be beneficial in eliminating areas of the hardware designs that need not be reviewed, what is included is still overwhelmingly large for a proper review for security vulnerabilities. However, it is not necessary to review all of the paths, but instead to review access control mechanisms that limit information flow between adversary and asset. Our method of using multiple information flow paths allows us to identify access control mechanisms and evaluate whether they are used on every access to the asset. Our technique was used commercially in production hardware design to successfully find critical security issues before tape-in by pre-Si validation engineers at Intel.