RISC-V processors are becoming ubiquitous in critical applications, but their susceptibility to microarchitectural side-channel attacks is a serious concern. Detection of microarchitectural attacks in RISC-V is an emerging research topic that is relatively underexplored, compared to x86 and ARM. The first line of work to detect flush+fault-based microarchitectural attacks in RISC-V leverages Machine Learning (ML) models, yet it leaves several practical aspects that need further investigation. To address overlooked issues, we leveraged gem5 and propose a new detection method combining statistical preprocessing and association rule mining having reconfiguration capabilities to generalize the detection method for any microarchitectural attack. The performance comparison with state-of-the-art reveals that the proposed detection method achieves up to 5.15% increase in accuracy, 7% rise in precision, and 3.91% improvement in recall under the cryptographic, computational, and memory-intensive workloads alongside its flexibility to detect new variant of flush+fault attack. Moreover, as the attack detection relies on association rules, their human-interpretable nature provides deep insight to understand microarchitectural behavior during the execution of attack and benign applications.

Semiconductor supply chain vulnerability presents a significant obstacle to creating reliable systems. At various phases of the Integrated Circuit (IC) design life-cycle, malicious modifications, known as Hardware Trojans (HTs), can be introduced. Logic testing, a widely recognized approach for Automatic test pattern Generation (ATPG) in HT detection, encounters substantial challenges due to the vast complexity of the search space, making it impractical and leading to inadequate trigger coverage. This paper proposes a Particle Swarm Optimization (PSO) based method that leverages information on effective inputs to facilitate the detection of conditionally triggered ultra-small HTs. An evaluation of the technique on ISCAS-85 benchmarks reveals substantial improvements in trigger coverage and a notable reduction in runtime compared to state-of-the-art methods.

RISC-V is gaining popularity for its adaptability and cost-effectiveness in processor design. With the increasing adoption of RISC-V, the importance of implementing robust security verification has grown significantly. In the state of the art, various approaches have been developed to strengthen the security verification process. Among these methods, assertion-based security verification has proven to be a promising approach for ensuring that security features are effectively met. To this end, some approaches manually define security assertions for processor designs; however, these manual methods require significant time, cost, and human expertise. Consequently, recent approaches focus on translating pre-defined security assertions from one design to another. Nonetheless, these methods are not primarily centered on processor security, particularly RISC-V. Furthermore, many of these approaches have not been validated against real-world attacks, such as hardware Trojans. In this work, we introduce a methodology for translating security assertions across processors with different architectures, using RISC-V as a case study. Our approach reduces time and cost compared to developing security assertions manually from the outset. Our methodology was applied to five critical security modules with assertion translation achieving nearly 100% success across all modules. These results validate the efficacy of our approach and highlight its potential for enhancing security verification in modern processor designs. The effectiveness of the translated assertions was rigorously tested against hardware Trojans defined by large language models (LLMs), demonstrating their reliability in detecting security breaches.

The global distribution of the semiconductor supply chain has heightened the risk of hardware Trojans (HTs), small malicious circuits that adversaries may embed during various stages of the system-on-chip (SoC) design process. Frequently implanted by untrusted third parties, these HTs can operate covertly and, when activated, pose a serious threat to the integrity, performance, and functionality of the system. Although there are promising test generation techniques for HT detection, they face two significant practical limitations: a lack of scalability for large designs and insufficient trigger coverage. The effective detection of HTs requires the application of appropriate test vectors. This paper introduces PATROL, a novel algorithm that combines Particle Swarm Optimization (PSO) and Genetic Algorithms (GA) within a scalable framework for the detection of HTs. This framework employs Automated Test Pattern Generation (ATPG)-based activation to achieve high trigger coverage. This approach significantly accelerates the convergence towards a solution while substantially improving the solution accuracy. Our experimental results demonstrate that our proposed method is more than 43 times faster and achieves an average increase in trigger coverage of more than 34%, significantly outperforming state-of-the-art test generation techniques for Trojan detection.

This paper presents FORTUNE, a hardware-agnostic fault tolerance technique for DNNs that leverages quantization to enhance reliability without significant performance overhead. Unlike conventional methods like Triple Modular Redundancy (TMR), which are computationally expensive, the proposed approach uses memory savings from quantization to protect the critical Most Significant Bit, improving fault tolerance in Deep Neural Networks (DNNs). Memory utilization has been reduced by 37.5% across all networks, with vulnerability in AlexNet reduced by 56% compared to the 8-bit version and 84% compared to the unprotected 3-bit version. These improvements come with only a minor increase in execution time of less than 3%. Using AlexNet as an example demonstrates how our approach effectively enhances memory utilization and resilience while causing only a minimal increase in execution time.

Association rule mining is a promising data mining approach that aims to extract correlations and frequent patterns between items in a dataset. On the other hand, in the realm of assertion-based verification, automatic assertion mining has emerged as a prominent technique. Generally, to automatically mine the assertions to be used in the verification process, we need to find the frequent patterns and correlations between variables in the simulation trace of hardware designs. Existing association rule mining methods cannot capture temporal behaviors such as next[N], until, and eventually that hold significance within the context of assertion-based verification. In this paper, a novel association rule mining algorithm specifically designed for assertion mining is introduced to overcome this limit. This algorithm powers ARTmine, an assertion miner that leverages association rule mining and temporal behavior concepts. ARTmine outperforms other approaches by generating fewer assertions, achieving broader design behavior coverage in less time, and reducing verification costs.

Autonomous driving (AD) system designers need methods to efficiently debug vulnerabilities found in control algorithms. Existing methods lack alignment to the requirements of AD control designers to provide an analysis of the parameters of the AD system and how they are affected by cyber-attacks. We introduce ADAssure, a methodology for debugging AD control system algorithms that incorporates automated mechanisms which support generation of assertions to guide the AD system designer to identify vulnerabilities in the system. Our evaluation of ADAssure on a real-world AD vehicular system using diverse cyber-attacks developed a set of assertions that identified weaknesses in the OpenPlanner 2.5 AD planning algorithm and its constituent planning functions. Working with an AD control system designer and safety validation engineer, the results of ADAssure identified remediation of the AD control system, which can support the implementation of a redundant observer for data integrity checking and improvements to the planning algorithm. The adoption of ADAssure improves autonomous system design by providing a systematic approach to enhance safety and reliability through the identification and mitigation of vulnerabilities from corner cases.

Multiplication is the most resource-hungry operation in the neural network’s processing elements. In this paper, we propose an architecture of a novel adaptive fault-tolerant approximate multiplier tailored for ASIC-based DNN accelerators. AdAM employs an adaptive adder relying on an unconventional use of the leading one position value of the inputs for fault detection through the optimization of unutilized adder resources. The proposed architecture uses a lightweight fault mitigation technique that sets the detected faulty bits to zero. The hardware resource utilization and the DNN accelerator’s reliability metrics are used to compare the proposed solution against the triple modular redundancy (TMR) in multiplication, unprotected exact multiplication, and unprotected approximate multiplication. It is demonstrated that the proposed architecture enables a multiplication with a reliability level close to the multipliers protected by TMR utilizing 63.54% less area and having 39.06% lower power-delay product compared to the exact multiplier.

Assertion-based verification is a promising method that uses predefined rules, known as assertions, to check the functionality of hardware designs. The manual assertion definition is time-consuming and requires expert knowledge. Automatic assertion mining is gaining acceptance as a trustworthy method for assertion definition. Some automatic assertion miners extract assertions from simulation traces of the design, but the quality of mined assertions depends on the coverage of the stimuli used to generate the traces. Existing stimuli generation methods are either random or exhaustive. A random approach can only cover some design behavior, resulting in incomplete assertions. On the other hand, an exhaustive approach can cover all the design behavior but produces lengthy simulation traces that cause a high overhead for the miner. We propose a novel approach for stimul generation based on constraint random verification. A set of user-defined metrics then examines the generated stimuli to measure how much of the design specification has been exercised by the verification environment. Our approach uses a coverage model that defines, collects, and analyzes the design’s functionalities and identifies the gaps in the verification. The assertions generated by the proposed method have been compared with a well-known assertion miner, GoldMine. The result showed that our method detects $\mathbf{2 0 . 6 3 \%}$ more faults in the design than GoldMine in a shorter time. Moreover, it produces assertions that are about $\mathbf{7 9 \%}$ more effective.

The globalization of the semiconductor industry has introduced security challenges to Integrated Circuits (ICs), particularly those related to the threat of Hardware Trojans (HTs) – malicious logic that can be introduced during IC fabrication. While significant efforts are directed towards verifying the correctness and reliability of ICs, their security is often overlooked. In this paper, we propose a comprehensive framework that integrates a suite of methodologies for both front-end and back-end stages of design, aimed at enhancing the security of ICs. Initially, we outline a systematic methodology to transform existing verification assets into potent security checkers by repurposing verification assertions. To further improve security, we introduce an innovative methodology for integrating online monitors during physical synthesis – a back-end insertion providing an additional layer of defense. Experimental results demonstrate a significant increase in security, measured by our introduced metric, Security Coverage (SC), with a marginal rise in area and power consumption, typically under 20%. The insertion of online monitors during physical synthesis enhances security metrics by up to 33.5%. This holistic framework offers a comprehensive defense mechanism across the entire spectrum of IC design.

International audience

Assertion-based verification is one of the viable solutions for the verification of computer systems. Assertions can be automatically generated by assertion miners however, these miners typically generate a high number of possibly redundant assertions. In turn, this results in higher costs and overheads in the verification process. Furthermore, these assertions have every so often low readability due to the high number of propositions that they contain. In this paper, an Innovative cost-effective Method for Minimizing assertion sets (IMMizer) has been proposed. IMMizer is performed by iden-tifying Contradictory Terms. These terms present the behaviors of the design under verification which are not specified by the initial assertion sets. Subsequently, a new assertion set is extracted based on the identified Contradictory Terms. Contrary to data-mining approaches that are unable to minimize the initial assertion set, but can only rank the set according to data-mining measurements, or mutant analysis approaches that require a long execution time, IMMizer is able to minimize the initial assertion set in a very short execution time. Experimental results showed that in the best case, this method has drastically reduced the number of assertions by 93% and the memory overhead imposed on the system by 87%, without any reduction in the detection of injected mutants.

Cache logical side channel attacks pose a significant threat to the security of modern computer systems. This is a result of exploitation of cache information leakages arising from cache contention. Detection of such leakages can be inferred from cache behavior and processes' access patterns during run time. To achieve this, a detection template that uses available information on cache outputs and process accesses at run-time is required. In this work, such template is proposed and implemented as a hardware monitor called Cache Leakage Detector (CLD). CLD is a high-accuracy, cost-effective and scalable run-time cache information leakage detector. CLD uses cache signals and process IDs to detect exploitable cache access patterns. It does so by identifying potential information leakage patterns. Accuracy of CLD is evaluated by using several benchmarks and injecting attacks into a 128-bit key AES algorithm. The experiments demonstrate that CLD has far higher detection accuracy (0.7964 vs 0.3195) and lower percentage of false positive detections (1.2% vs 30.6%) compared to a state-of-the-art hardware detector. Moreover, CLD introduces a very low area overhead of 0.002% to the total area of the cache. Experimental result section reports the above claims in detail.

In the recent years, cache based side-channel attacks have become a serious threat for computers. To face this issue, researches have been looking at verifying the security policies. However, these approaches are limited to manual security verification and they typically work for a small subset of the attacks. Hence, an effective verification environment to automatically verify the cache security for all side-channel attacks is still missing. To address this shortcoming, we propose a security verification methodology that formally verifies cache designs against cache side-channel vulnerabilities. Results show that this verification template is a straightforward, automated method in verifying cache invulnerability.

Self-healing is a promising approach for designing reliable digital systems. It refers to the ability of a system to detect faults and automatically fixing them to avoid total failure. With the development of digital systems, heterogeneous systems, in which some parts of the system are executed on the programmable logic, and some other parts run on the processing elements (CPU), are becoming more prevalent. In this work, we propose an adjustable self-healing method that is applicable to heterogeneous systems with accelerated functions and enables the designers to add the self-healing feature to the design. In this method, by manipulating the software codes that are being executed on the processing element, we add the ability to verify the accelerated functions on the programmable logic and heal the possible failures to the system. This is done not only in a straightforward manner but also without being forced to choose a specific reliability-overhead point. The designer will have the option to select the optimum configuration for a desired reliability level. Experimental results on a large design including several accelerated functions are provided and show 42% improvement of reliability by having 27% overhead, as an example of the reliability-overhead point.

Interest in memory systems' security has increased during the last decade due to their vulnerabilities to be exploited by logical side channels attacks. A promising approach for attack detection at run-time is to monitor the cache memory's behavior. However, designing an environment capable of detecting and mitigating these attacks is very challenging. In current monitoring systems, attack mitigation has been largely neglected. To overcome these shortcomings, in this work, we present a secure cache called SCAAT. SCAAT is equipped with an attack mitigation system to handle attacks by remapping where data is stored in the cache to random locations. In addition, SCAAT uses an attack monitor that identifies suspicious behavior that indicates cache logical side-channel attacks. The effectiveness of SCAAT is analyzed and evaluated for several cache configurations in terms of area overhead and performance.

Cache attacks are one of the most wide-spread and dangerous threats to embedded computing systems' security. A promising approach to detect such attacks at runtime is to monitor the System-on-Chip (SoC) behavior. However, designing a secure SoC capable of detecting such attacks is very challenging: the monitors should be lightweight in order to avoid excessive power/energy and area costs and the attack behavior should be clearly known upfront. In this work, we present LiD-CAT, a lightweight and flexible hardware detector that is aware of leakage patterns that can be used by attackers to perform cache based attacks. LiD-CAT is a cache wrapper that implements a set of leakage properties derived from cache attacks and cache models using templates. These templates identify suspicious behavior that may lead to cache attacks. LiD-CAT is evaluated using two different cache architectures, one with a secure cache and one without. On each of them, SPEC2000 benchmarks are run together with malicious applications that execute cache attacks (i.e., Evict+Time, Prime+Probe, Flush+Reload and Flush+Flush). Results show that our lightweight detector successfully detects 99.99% of the attacks with less than 1% false-positives, has no timing penalties, and increases the area of a SoC with only 1.6%.

We present a three-step flow to improve Assertion-based Verification methodology with integrated RTL-to-TLM abstraction: First, an automatic assertion miner generates a large set of possible assertions from an RTL design. Second, automatic assertion qualification identifies the most interesting assertions from this set. Third, the assertions are abstracted to the transaction level, such that they can be re-used in TLM verification. We show that the proposed flow automatically chooses the best assertions among the ones generated to verify the design components when abstracted from RTL to TLM. Our experimental results indicate that the proposed methodology allows us to re-use the most interesting set at TLM without relying on any time consuming or error-prone manual transformations with a considerable amount of speed up and considerable reduction in the execution time.

Several approaches exist for specification mining of hardware designs, both at the RTL and system levels (e.g, TLM). These approaches mine assertions that specify the behavior of the design. Some of the techniques require the source code itself while others can extract assertions directly from simulation traces. The performance of some approaches is highly dependent on the number of simulation traces/use cases while there exist approaches which can extract assertions from a limited number of simulation traces. Apart from this aspect, the core of each assertion miner is different from the other ones. Some use expression templates to define assertions while some are based on the static analysis or information flow analysis. Unfortunately, it has been rarely considered which of the current approaches are more effective in describing functionality of particular types of designs. Thus, in this work, we analyze assertion miners which are template based and dynamic dependency graph based, respectively. We generate assertions from both approaches. The evaluation considers fault analysis on both assertion sets of extracted assertions. Moreover, both sets are combined and fault analysis has been applied on them. Experimental results show that each set approximately detects the same number of faults while when the two sets are combined the number of detected faults increases. Finally, a new, more efficient architecture for an effective assertion miner has been developed based on the study in this work.

The effectiveness of Assertion-Based Verification (ABV) depends on the quality of assertions. Assertions can be manually or automatically generated. In both cases assertion generation is error prone and needs high expertise. Moreover, the number of generated assertions is generally too large. Thus, assertion qualification is necessary to evaluate the quality of generated assertions to assist verification engineers to select only the highest quality assertions for systems' verification. Most of the current works for assertion qualification are based on fault injection analysis, which requires long simulation time. To fill in the gap, this work proposes a new automatic data mining-based approach for assertions already defined for a design, which in contrast to the state-of-the-art can evaluate assertions' quality precisely within a very short simulation time. Experimental results support the benefit of the proposed methodology.

The shrinking feature size in semiconductor technology beyond the sub-micron domain negatively affects the reliability of digital circuits and makes them more susceptible to run-time faults (such as wear-out and aging) and transient faults during systems life time. This motivates investigation of online faults detection approaches, which would react instantaneously at run-time, concurrent with the system operation. Concurrent online checkers have been one of the approaches introduced in the literature for handling run-time faults online in control part of digital systems. An ideal set of checkers provides high fault detection and localization with minimal area overhead. To reach such optimal set, a diverse initial set of checkers are required which provide a trade-off between the above mentioned parameters. This work presents a methodology to generate (1) high-level functional checkers based on abstract design specification, and (2) structural checkers, which are devised from Register Transfer Level (RTL) description of the circuit. The functional checkers are fewer in number with lower area overhead and provide high fault coverage, however they lead to lower fault localization accuracy and cannot cover all the Single Event Upsets (SEUs). On the other hand, structural checkers provide higher localization accuracy and guarantee 100% SEU coverage, but at the price of higher area overhead. The proposed methodology provides the designer with trade-offs between the parameters mentioned above, for further optimization. The proposed methodology has been applied to the control part of routing logic of a NoC router.

We present an outline of the field of Design Understanding and summarize state-of-the-art research in deriving human-understandable knowledge in form of logic properties from an unknown design.

The definition of assertions is a fundamental phase for formal and semi-formal verification strategies as well as for documenting purposes. Assertions are generally manually defined, but several (semi-) automatic approaches have been also proposed that mine assertions directly from execution traces of the design under verification (DUV). In both cases, assertion qualification is necessary to evaluate the quality of the defined assertions. Current approaches evaluate the interestingness of a set of assertions by measuring the percentage of DUV's behaviours covered by the assertions, mainly by adopting techniques based on mutation analysis, which require long simulation time. On the contrary, this work proposes an automatic technique to estimate the interestingness of assertions by ranking them according to metrics typically adopted in the context of data mining, which reveals to be a faster approach. Experimental results that compare the proposed assertion ranking strategy with assertion qualification based on mutation analysis are reported.