Hardware-assisted debugging provides the necessary infrastructure for developers to closely monitor program behaviors at the microarchitectural level in a system-on-chip (SoC). However, debug infrastructure jeopardizes the security of the system by providing a backdoor for accessing crucial assets embedded in the system because of the inevitable increase in observability. While trusted execution environments (TEE) provide an extra level of security and isolate design assets, the security implication of hardware debug integration on TEEs has not been investigated. In this paper, we introduce a multi-level bidirectional access authentication mechanism over the debug module that defines the minimum number of privilege levels needed and the access details at each level so that debug users are authorized and blocked from accessing assets private to other entities. Trust is established by exchanging certificates both from the debugger and SoC sides to implement a bidirectional authorization platform in order to restrict the debugger’s access to SoC assets as well as prevent the debugger’s test data from being accessed by an SoC impersonator through emulation. We provide a prototype of the debug authentication platform on RISC-V architecture that proves the small overhead of the approach while staying compatible with traditional debug efforts.

Verifying the security of System-on-Chip (SoC) designs against hardware vulnerabilities is challenging because of the increasing complexity of SoCs, the diverse sources of vulnerabilities, and the need for comprehensive testing to identify potential security threats. In this paper, we propose RL-TPG, a novel framework that combines traditional verification with hardware security verification using Reinforcement Learning (RL) in Register Transfer Level (RTL) design. Significant research has been done on formal verification, semi-formal verification, automated security asset identification, and gate-level netlist. However, the area of automated simulation using machine learning at RTL is still unexplored. RL-TPG employs an RL agent that generates intelligent test patterns targeting security properties, verification coverage, and rare nodes of the design to achieve security property violation, increase verification coverage, and reach rare nodes. Our framework triggers all embedded vulnerabilities, achieving an average of 90% traditional coverage in an average of 192 seconds for the experimental benchmarks. To demonstrate the effectiveness of the approach, the results are compared with JasperGold by Cadence.

As modern SoC architectures incorporate many complex/heterogeneous intellectual properties (IPs), the protection of security assets has become imperative, and the number of vulnerabilities revealed is rising due to the increased number of attacks. Over the last few years, penetration testing (PT) has become an increasingly effective means of detecting software (SW) vulnerabilities. As of yet, no such technique has been applied to the detection of hardware vulnerabilities. This paper proposes a PT framework, SHarPen, for detecting hardware vulnerabilities, which facilitates the development of a SoC-level security verification framework. SHarPen proposes a formalism for performing gray-box hardware (HW) penetration testing instead of relying on coverage-based testing and provides an automation for mapping hardware vulnerabilities to logical/mathematical cost functions. SHarPen supports both simulation and FPGA-based prototyping, allowing us to automate security testing at different stages of the design process with high capabilities for identifying vulnerabilities in the targeted SoC.

The modern System-on-Chips (SoCs), with numerous complex and heterogeneous intellectual properties (IPs), and the inclusion of highly-sensitive assets, become the target of malicious attacks. However, security verification of these SoCs remains behind compared to the advances in functional verification, mostly because it is difficult to formally define the accurate threat model(s). Few recent studies have investigated the possibility of engaging fuzz testing for hardware-oriented vulnerability detection. However, they suffer from several limitations, i.e., lack of cross-layer co-verification, the need for expert knowledge, and the inability to capture detailed hardware interactions. In this paper, we propose SoCFuzzer, an automated SoC verification assisted by fuzz testing for detecting SoC security vulnerabilities. Unlike the previous HW-oriented fuzz testing studies, which mostly rely on traditional (code) coverage-based metrics, in SoCFuzzer, we develop (i) generic evaluation metrics for fuzzing the hardware domain, and (ii) security-oriented cost function. This relieves designers of making correlations between coverage metrics, test data, and possible vulnerabilities. The SoCFuzzer cost functions are defined high level, allowing us to follow the gray-box model, which requires less detailed and interactive information from the design-under-test. Our experiments on an open-source RISCV based SoC show the efficiency of these metrics and cost functions on fuzzing for generating cornerstone inputs to trigger the vulnerability conditions with faster convergence.

Due to the global supply of semiconductor intellectual property (IP) cores, modern system-on-chip (SoC) designs are vulnerable to malicious functionality, referred to as hardware Trojans. Hardware Trojans are inserted to bypass the security mechanisms in a SOC or cause confidentiality, integrity, and availability violations. There is an increased emphasis on finding effective solutions to generate tests to activate Trojans in hardware designs (if any) in third party IPs. However, state-of-the-art approaches suffer from ineffectiveness in detection and scalability. In this paper, we propose SymbA that utilizes symbolic execution at C/C++ level to activate malicious functionality hidden in RTL designs. SymbA is based on mapping of RTL design to C level and leveraging the existing powerful software-level symbolic execution engine to generate tests. SymbA maps back the generated tests to RTL and checks if the hidden Trojans have been activated. In this paper, we use KLEE Symbolic Execution Engine and show the efficiency of SymbA by applying it to a number of Trust-Hub benchmarks. SymbA improves the existing state-of-the-art techniques significantly with regard to performance, coverage and memory usage.

Transistor and interconnect wearout is accelerated with transistor scaling resulting in timing variations and consequently reliability challenges in digital circuits. With the emergence of new issues like Electro-migration these problems are getting more crucial. Age monitoring methods can be used to predict and deal with the aging problem. Selecting appropriate locations for placement of aging monitors is an important issue. In this work we propose a procedure for selection of appropriate internal nodes that expose smaller overheads to the circuit, using correlation between nodes and the shareability amongst them. To select internal nodes, we first prune some nodes based on some attributes and thus provide a near-optimal solution that can effectively get a number of internal nodes and consider the effects of electro-migration as well. We have applied our proposed scheme to severalprocessors and ITC benchmarks and have looked at its effectiveness for these circuits.