Model-Checking Speculation-Dependent Security Properties: Abstracting and Reducing Processor Models for Sound and Complete Verification

Abstract

Spectre and Meltdown attacks in modern microprocessors represent a new class of attacks that have been difficult to deal with. They underline vulnerabilities in hardware design that have been going unnoticed for years. This shows the weakness of the state-of-the-art verification process and design practices. These attacks are OS-independent, and they do not exploit any software vulnerabilities. Moreover, they violate all security assumptions ensured by standard security procedures, (e.g., address space isolation), and, as a result, every security mechanism built upon these guarantees. These vulnerabilities allow the attacker to retrieve leaked data without accessing the secret directly. Indeed, they make use of covert channels, which are mechanisms of hidden communication that convey sensitive information without any visible information flow between the malicious party and the victim. The root cause of this type of side-channel attacks lies within the speculative and out-of-order execution of modern high-performance microarchitectures. Since modern processors are hard to verify with standard formal verification techniques, we present a methodology that shows how to transform a realistic model of a speculative and out-of-order processor into an abstract one. Following related formal verification approaches, we simplify the model under consideration by abstraction and refinement steps. We also present an approach to formally verify the abstract model using a standard model checker. The theoretical flow, reliant on established formal verification results, is introduced and a sketch of proof is provided for soundness and correctness. Finally, we demonstrate the feasibility of our approach, by applying it on a pipelined DLX RISC-inspired processor architecture. We show preliminary experimental results to support our claim, performing Bounded Model-Checking with a state-of-the-art model checker.

A Multi-Valued Simplified Halpern–Shoham–Moszkowski Logic for Gradable Verifiability in Reasoning about Digital Circuits

“…It seems that some reference to these models (such as fibred models for MVHSM) is necessary if we intend to formally verify some properties of the modern digital circuits (such as processors) even if they have better 'operative' and algorithm-based depiction in terms of VHDL/Python interpreter. Some illustration how the model-checking machinery may be incorporated into the pipelined processor model-expressed in DLX assembly code-may be found in [23].…”

“…It seems to constitute a piece of novelty of the paper in the model checking immersed in electronics-based application contexts-even if the digital circuit properties's and behaviour's description-f.e. against the bounded model checking for microprocessors as in [23]-does not form a leading tendency in model checking speculations for electronics-determined application contexts.…”

“…Last, but not least-due to author's best knowledge-no more advanced model checking machinery has been yet elaborated for digital circuit's properties and behavioragainst so sophisticated attempts to adopt bounded model checking for microprocessor architectures-as in [23].…”