Evaluating security requirements in a general-purpose processor by combining assertion checkers with code coverage

Bilzor, Michael; Huffmire, Ted; Irvine, Cynthia E.; Levin, Timothy E.

doi:10.1109/hst.2012.6224318

Cited by 38 publications

(21 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the existing literature, [2], [18] propose run-time Trojan detection methods which check whether certain rules are met (e.g whether a certain signal is behaving as expected). If not, then a Trojan is detected.…”

Section: A Meritsmentioning

confidence: 99%

See 1 more Smart Citation

Temperature Tracking: Toward Robust Run-Time Detection of Hardware Trojans

Bao

Forte

Srivastava

2015

IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst.

View full text Add to dashboard Cite

The hardware Trojan threat has motivated development of Trojan detection schemes at all stages of the integrated circuit (IC) lifecycle. While the majority of existing schemes focus on ICs at test-time, there are many unique advantages offered by post-deployment/run-time Trojan detection. However, run-time approaches have been underutilized with prior work highlighting the challenges of implementing them with limited hardware resources. In this paper, we propose three innovative low-overhead approaches for run-time Trojan detection which exploit the thermal sensors already available in many modern systems to detect deviations in power/thermal profiles caused by Trojan activation. The first one is a local sensor-based approach that uses information from thermal sensors together with hypothesis testing to make a decision. The second one is a global approach that exploits correlation between sensors and maintains track of the ICs thermal profile using a Kalman filter (KF). The third approach incorporates leakage power into the system dynamic model and apply Extended Kalman Filter (EKF) to track IC's thermal profile. Simulation results using state-ofthe-art tools on 10 publicly available Trojan benchmarks verify that all three proposed approaches can detect active Trojans quickly and with few false positives. Among three approaches, EKF is flawless in terms of the 10 benchmarks tested but would require the most overhead.

show abstract

Section: A Meritsmentioning

confidence: 99%

“…Run-time approaches. These approaches monitor for unexpected changes in logical and side-channel behavior to detect Trojans, but do so after the IC has been deployed (e.g., [7], [8], [10], [18]). Resource overheads have been the main disadvantage of run-time monitoring [2].…”

Section: A Hardware Trojans and Countermeasuresmentioning

confidence: 99%

Temperature Tracking: Toward Robust Run-Time Detection of Hardware Trojans

Bao

Forte

Srivastava

2015

IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst.

View full text Add to dashboard Cite

show abstract

“…[22][23][24][25][26][27] Some of the proposed techniques in this category are data monitoring by signal probe cells and probe networks, 22 register-transfer (RT) level access rule checking, 23 special monitoring of critical operations such as bus assignment, 24 monitoring analogous characteristics of the circuit 25 and di®erent styles of redundancy-based run-time checking of system behaviors. 26,27 These techniques are mostly introduced in RT or higher levels of design and must be usually customized for the target system.…”

Section: Design For Hardware Trustmentioning

confidence: 99%

A Trust-Driven Placement Approach: A New Perspective on Design for Hardware Trust

Shekarian

Zamani

2015

J CIRCUIT SYST COMP

View full text Add to dashboard Cite

During the last few years, hardware Trojan horses (HTHs) have become one of the most important threats to the security of very large scale integrated (VLSI) chips. Many e®orts have been made to facilitate the process of HTH detection, mostly based on the power analysis of chips. The techniques would be more bene¯cial if trust-driven techniques are used during the system design. Whereas design for hardware trust (DFHT) is one of the¯elds of interest, most current approaches include ad-hoc and gate-level design techniques. This paper discusses the advantage of physical-level design approaches with integrated strategies for improving the HTH-detection probability. As a proof of concept, a placement technique is presented with the goal of enhancing the ability of HTH detection techniques based on local power signal analysis. Our results show that the background e®ects on power pads can be leveraged by a simple partitioning-based placement algorithm. Minimizing the background e®ects leads to a better Trojan-to-background-e®ect ratio and more (by about 1.7 times) Trojan detectability.

show abstract

“…And, just as is the case with software, bugs in the hardware can create vulnerabilities that are exploitable by malicious software [15]. Recent work has demonstrated the efficacy of using assertions built in to the hardware design to protect, post-deployment, against security vulnerabilities [10,11,22]. The assertions act as an execution monitor: each assertion is a proposition encoding a property that should always hold and at run-time the assertion monitors the hardware signals and state named in the property.…”

Section: Introductionmentioning

confidence: 99%

“…Some properties seem obviously critical to security. As an example, each of the above cited works ( [10,11,22]) includes an assertion that the supervisor signal is set only in response to a small number of well defined events. Other properties, such as the one(s) violated by Intel's infamous FDIV bug [1,7], feel safely characterized as purely functional.…”

Section: Introductionmentioning

confidence: 99%

Identifying Security Critical Properties for the Dynamic Verification of a Processor

et al. 2017

View full text Add to dashboard Cite

We present a methodology for identifying security critical properties for use in the dynamic verification of a processor. Such verification has been shown to be an effective way to prevent exploits of vulnerabilities in the processor, given a meaningful set of security properties. We use known processor errata to establish an initial set of security-critical invariants of the processor. We then use machine learning to infer an additional set of invariants that are not tied to any particular, known vulnerability, yet are critical to security.We build a tool chain implementing the approach and evaluate it for the open-source OR1200 RISC processor. We find that our tool can identify 19 (86.4%) of the 22 manually crafted security-critical properties from prior work and generates 3 new security properties not covered in prior work.

show abstract

Evaluating security requirements in a general-purpose processor by combining assertion checkers with code coverage

Cited by 38 publications

References 18 publications

Temperature Tracking: Toward Robust Run-Time Detection of Hardware Trojans

Temperature Tracking: Toward Robust Run-Time Detection of Hardware Trojans

A Trust-Driven Placement Approach: A New Perspective on Design for Hardware Trust

Identifying Security Critical Properties for the Dynamic Verification of a Processor

Contact Info

Product

Resources

About