This article presents RTL-ConTest, a register transfer-level (RTL) security vulnerability detection algorithm, that extracts critical process flows from a RTL design and executes RTL-level concolic testing to generate security test cases for identifying critical exploits manifested in a System on Chip (SoC). The efficiency of the proposed approach is evaluated on opensource RISC-V-based SoCs. Our technique is successful in detecting the security vulnerabilities manifested in the processor core as well as in the rest of the SoC, e.g., debug modules, peripherals, etc., thereby providing a thorough vulnerability check on the entire hardware design. As demonstrated by our experimental results, in circumstances where conventional security verification tools are limited, RTL-ConTest furnishes significantly improved efficiency in detecting SoC security vulnerabilities.

We present an effective methodology for formally verifying security-critical flows in a commercial System-on-Chip (SoC) which involve extensive interaction between firmware (FW) and hardware (HW). We describe several HW-FW interaction scenarios that are typical in commercial SoCs. We highlight unique challenges associated with formal verification of security properties of such interactions and discuss our approach of property-specific abstraction and software model checking to circumvent those challenges. To the best of our knowledge, this is the first exposition on formal co-verification of security-specific HW-FW interactions in the context and scale of a commercial SoCs. Despite traditional scalability challenges, we demonstrate that many such flows are amenable to effective formal verification.

Security and reliability have become important concerns in the design of computer systems. On one hand, microarchitectural enhancements for security (such as for dynamic integrity checking of code at runtime) have been proposed. On the other hand, independently, microarchitectural enhancements for reliability to detect and tolerate natural faults have also been proposed. A fault in these security enhancements due to alpha particles or aging might potentially pass off maliciously modified instructions as safe, rendering the security enhancements useless. Deliberate fault attacks by attackers can be launched to disable the security enhancements and then launch the well-known security attacks that would otherwise have been detected by these enhancements. We report an integrated microarchitecture support for security and reliability in multicore processors. Specifically, we add integrity checkers to protect the code running on the multiple cores in a multicore processor. We then adapt these checkers to check one another periodically to ensure reliable operation. These checkers naturally can check the other parts of the core. The average performance, power, and area costs for these security-reliability enhancements are 6.42%, 0.73%, and 0.53%, respectively.

The performance of an IC degrades over its lifetime, ultimately resulting in IC failure. In this article, we present a hardware attack (called MAGIC) to maliciously accelerate NBTI aging effects in cores. In this attack, we identify the input patterns that maliciously age the pipestages of a core. We then craft a program that generates these patterns at the inputs of the targeted pipestage. We demonstrate the MAGIC-based attack on the OpenSPARC processor. Executing this program dramatically accelerates the aging process and degrades the processor’s performance by 10.92% in 1 month, bypassing existing aging mitigation and timing-error correction schemes. We also present two low-cost techniques to thwart the proposed attack.

High performance and low power consumption have traditionally been the primary design goals for computer architects. With computer systems facing a wave of attacks that disrupt their normal execution or leak sensitive data, computer security is no longer an afterthought. Dynamic integrity checking has emerged as a possible solution to protect computer systems by thwarting various attacks. Dynamic integrity checking involves calculation of hashes of the instructions in the code being executed and comparing these hashes against corresponding precomputed hashes at runtime. The processor pipeline is stalled and the instructions are not allowed to commit until the integrity check is complete. Such an approach has severe performance implications as it stalls the pipeline for several cycles. In this paper, we propose a hardware-based dynamic integrity checking approach that does not stall the processor pipeline. We permit the instructions to commit before the integrity check is complete, and allow them to make changes to the register file, but not the data cache. The system is rolled back to a known state if the checker deems the instructions as modified. Our experiments show an average performance overhead of 1.66%, area overhead of 4.25%, and a power overhead of 2.45% over a baseline processor.

A trusted platform module (TPM) enhances the security of general purpose computer systems by authenticating the platform at boot time. Security can often be compromised due to the presence of vulnerabilities in the trusted software that is executed on the system. Existing TPM architectures do not support runtime integrity checking and this allows attackers to exploit these vulnerabilities to modify the program after it has been verified (at time of check or TOC) but before the time of its use (at time of use or TOU) to trigger unintended program behavior, such as the execution of malicious code or the leaking of sensitive data. In this paper, we present a dynamic integrity checker (DIC) to improve security by thwarting TOCTOU attacks. The paper makes four contributions. First, we show how to integrate the integrity checker module with a superscalar pipeline. Second, we present an architecture for dynamic integrity checking by monitoring the dynamic execution traces of the program. Third, we present several optimizations to reduce performance impact without compromising the security of the system. Finally, we evaluate the proposed scheme using a cycle-accurate simulator. Results indicate that the proposed technique enhances security against the TOCTOU attacks with 8% performance overhead and 2.52% area overhead over a baseline processor.

A Trusted Platform Module (TPM) authenticates general purpose computing platforms. This is done by taking platform integrity measurement and comparing it with a precomputed value at boot-time. Existing TPM architectures do not support run-time integrity checking of a program on the platform. Attackers can modify the program after it has been verified at the Time Of Check (TOC) and before its Time Of Use (TOU). In this paper we study the feasibility of integrating a dynamic on-chip TPM (DTPM) into the core processor pipeline to protect against TOCTOU attacks. We explore the challenges involved in designing DTPM and describe techniques to improve its performance. The proposed DTPM has 2.5% area overhead and 18% performance impact when compared to a single processor core without DTPM.