Formal Vulnerability Analysis of Security Components

Abstract

Vulnerability to malicious fault attacks is an emerging concern for hardware circuits that are employed in mobile and embedded systems and process sensitive data. We describe a new methodology to assess the vulnerability of a circuit to such attacks, taking into account built-in protection mechanisms. Our method is based on accurate modeling of fault effects and detection status expressed by Boolean satisfiability (SAT) formulas. Vulnerability is quantified based on the number of solutions of these formulas, which are determined by an efficient #SAT solver. We demonstrate the applicability of this method for design space exploration of a pseudo random number generator and for calculating the attack success rate in a multiplier circuit protected by robust error-detecting codes.Index Terms-Error detection, fault attacks, random number generators, satisfiability (SAT), vulnerability analysis.

ForASec: Formal Analysis of Hardware Trojan-Based Security Vulnerabilities in Sequential Circuits

“…Typically, model based simulations are used for analyzing the security vulnerabilities [14], [15], but they cannot cover all possible test cases in complex systems because of their computational constraints (energy and memory) [16] and floating point inaccuracies [17]. To ensure the completeness and accuracy, mathematical modeling and formal verification based vulnerability analysis techniques have been proposed [18], [19], [20], [21], [22], [23], [24], [25], [26], [27], as shown in Table 1. Although, to some extent, mathematical modeling can overcome above-mentioned limitations, it is still prone to human error and increases the design time.…”

“…The SAT solver based approaches are used for multistage assertion-based verification, code coverage analysis, redundant circuit removal for isolation of suspicious signals and sequential automatic test pattern generations in vulnerability analysis [18], [19]. However, they provide the information about the satisfaction of certain property but in case of failure they are unable to identify the reason, thus lack completeness in vulnerability analysis [31].…”

Trust in technology: interlocking trust concepts for privacy respecting video surveillance

“…There are, for example, fault attacks where the attacker aims to induce transient errors into the chip (Bar-El et al, 2006). Making a chip robust against fault attacks can therefore be similar to making it robust against system-inherent errors (Feiten et al, 2015). However, the crucial difference is that system-inherent errors occur anywhere with a given probability, whereas a deliberate fault-attack aims to induce errors at exactly the right time and location.…”

Combining Conflict-Driven Clause Learning and Chronological Backtracking for Propositional Model Counting

“…The task of computing the number of models of a propositional formula, also referred to as #SAT, has various applications in hardware and software verification [5,4,12,15,11] as well as cryptography [16]. Classical applications are found in the area of probabilistic reasoning [24] as well as Bayesian networks [2,19,27] which are adopted in medical diagnosis and planning.…”