Protecting assets against information leakage is crucial to ensure System-on-Chip (SoC) security. This paper introduces a Time and Distance-based security metric (TDM) to assess information leakage risks across hardware Intellectual Properties (IPs) in SoC architectures. TDM quantifies both asset exposure time and spatial proximity to external threats, identifying vulnerable locations and critical timings. Using graph-based analysis, we map data flow, evaluating risk based on how long and how closely sensitive data resides near output ports. Applied to five open-source designs, TDM effectively enhances SoC security by measuring susceptibility to threats.

The ubiquitous presence and utilization of System-on-Chips (SoCs) have made them critical to our daily life. As SoCs become more complex to meet multiple applications, their susceptibility to security threats has also increased. The comprehensive security assurance of an SoC system requires a deep knowledge of the design and security-critical assets that must be protected. As SoC applications vary, the assets vary in number, type, importance-level, and form based on the various hardware blocks that construct the SoC and their complex interactions. Some assets are distinctive in their definition and characteristics, making them easily identifiable, such as encryption/decryption keys, logic locking keys, etc. However, other assets, such as system bus control registers that are internal to the design, require a more complex design analysis. Automatic identification of these security assets at the pre-silicon stage can help designers take the necessary precautions to protect them. Equipped with the security assets, designers can then incorporate techniques to protect these security assets against various threats such as information leakage, side-channel leakage, access control violations, and more. This paper presents the variation among security assets based on hardware design and defines specific attributes to help classify them. Then, we introduce SAIF, an automated framework that can help identify security assets for a design at the register-transfer level (RTL). We introduce a set of metrics into SAIF to perform comprehensive vulnerability analysis and identify security assets that are prone to specific vulnerabilities. Lastly, we report our findings on the effectiveness of SAIF for various open-source hardware designs and finalists of the National Institute of Standards and Technology (NIST) lightweight crypto standardization process such as ASCON, GIFT-COFB & Romulus. We show that SAIF can automatically identify critical security assets in a design with high accuracy and performance. Moreover, we analyze the security implication of the identified secondary assets to show their importance in pre-silicon security verification.

The globalization of the System-on-Chip (SoC) design process has made hardware designs prone to many security vulnerabilities. One of the most critical security vulnerabilities is information leakage (IL), which allows an attacker to gain access to a design’s secret information. IL vulnerabilities can result from unintended design flaws or the intentional insertion of malicious functionality into the design. Such vulnerabilities should be identified at the early design stages to secure a hardware design. Property-driven security verification has emerged as a promising method of verifying that such security vulnerabilities do not exist. This verification technique requires developing an appropriate set of assertions to formally represent the properties. However, forming a comprehensive set of assertions that can cover all potential vulnerabilities in design is challenging. Assertion generation cannot be done manually due to the large complexity of designs, lack of security experts as well as the existence of untrusted observable points in the design. In this work, we propose AGILE, a framework to automatically generate security assertions for property-driven verification to identify IL-based vulnerabilities. The experimental results show that the assertions provided by AGILE can detect both intentional and unintentional IL paths in the input design. We demonstrate the effectiveness of AGILE on the NIST standard, Trust-Hub, and OpenCores benchmarks. Moreover, we use code coverage analysis to evaluate the accessibility of the generated assertions to the source code. The analytical result indicates that by utilizing the assertions generated by AGILE, security coverage of the design under verification (DUV) can be improved significantly.

With the increasing complexity, modern system-onchip (SoC) designs are becoming more susceptible to security attacks and require comprehensive security assurance. However, establishing a comprehensive assurance for security often involves knowledge of relevant security assets. Since modern SoCs contain myriad confidential assets, the identification of security assets is not straightforward. The number and types of assets change due to numerous embedded hardware blocks within the SoC and their complex interactions. Some security assets are easily identifiable because of their distinct characteristics and unique definitions, while others remain in the blind-spot during design and verification and can be utilized as potential attack surfaces to violate confidentiality, integrity, and availability of the SoC. Therefore, it is essential to automatically identify security assets in an SoC at pre-silicon design stages to protect them and prevent potential attacks. In this paper, we propose an automated CAD framework called SAF to identify an SoC's security assets at the register transfer level (RTL) through comprehensive vulnerability analysis under different threat models. Moreover, we develop and incorporate metrics with SAF to quantitatively assess multiple vulnerabilities for the identified security assets. We demonstrate the effectiveness of SAF on MSP430 micro-controller and CEP SoC benchmarks. Our experimental results show that SAF can successfully and automatically identify an SoC's most vulnerable underlying security assets for protection.