SecChisel Framework for Security Verification of Secure Processor Architectures
SecChisel Framework for Security Verification of Secure Processor Architectures
复制标题
用于安全处理器架构安全验证的 SecChisel 框架
DOI：
10.1145/3337167.3337174
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Szefer, Jakub
中科院分区：
文献类型：
--
作者：
Deng, Shuwen;Gümüşoğlu, Doğuhan;Xiong, Wenjie;Sari, Sercan;Gener, Y. Serhan;Lu, Corine;Demir, Onur;Szefer, Jakub
这项工作提出了一个安全处理器架构的设计时安全验证框架。我们的新SecChisel框架是建立在Chisel硬件构造语言和工具，并使用信息流分析，以验证在设计时的架构的安全属性。为了加强信息流的安全性，该框架支持将安全标签添加到线路、寄存器、模块和设计描述的其他部分，并允许定义自定义安全网格和自定义信息流策略。该框架在新的SecChisel解析器中执行自动安全标记传播分析，并使用Z3 SMT求解器进行信息流检查。相同的SecChisel代码库用于设计硬件模块以及验证安全属性，确保验证的设计直接对应于实际设计。该框架在扩展了AES和SHA模块的RISC-V Rocket芯片上进行了评估。该框架能够捕获硬件错误或木马中的信息泄漏。
This work presents a design-time security verification framework for secure processor architectures. Our new SecChisel framework is built upon the Chisel hardware construction language and tools, and uses information flow analysis to verify the security properties of an architecture at design-time. To enforce information flow security, the framework supports adding security tags to wires, registers, modules, and other parts of the design description, as well as allows for defining a custom security lattice and custom information flow policies. The framework performs automatic security tag propagation analysis in a new SecChisel parser and information flow checking using the Z3 SMT solver. The same SecChisel codebase is used to design hardware modules as well as to verify the security properties, ensuring that the verified design directly corresponds to the actual design. This framework is evaluated on RISC-V Rocket Chip expanded with AES and SHA modules. The framework was able to capture information leaks in the hardware bugs or Trojans that it was tested with.
DOI：
--
发表时间：
2003
期刊：
2003 Symposium on Security and Privacy, 2003.
影响因子：
--
作者：
D. Lie;John C. Mitchell;C. Thekkath;M. Horowitz
通讯作者：
M. Horowitz