Information flow isolation in I2C and USB

Abstract

Flight control, banking, medical, and other high assurance systems have a strict requirement on correct operation. Fundamental to this is the enforcement of non-interference where particular subsystems should not affect one another. In an effort to help guarantee this policy, recent work has emerged with tracking information flows at the hardware level. This article uses a specific method known as gate-level information flow tracking (GLIFT) to provide a methodology for testing information flows in two common bus protocols, I2 C and USB. We show that the protocols do elicit unintended information flows and provide a solution based on time division multiple access (TDMA) that provably isolates devices on the bus from these flows. This paper also discusses the overheads in area and simulation time incurred by this TDMA based solution.

A Practical Testing Framework for Isolating Hardware Timing Channels

“…As discussed in past work [7], GLIFT allows system designers to determine if any information flows exist within their systems; we clarify here that we use information flow to mean a logical flow, as we consider other types of flows (e.g., physical phenomena such as electromagnetic radiation or power fluctuations) as out of the scope of this work. Logical flows can be further broken down into two types: functional flows and timing flows.…”

“…To do so, we apply GLIFT logic to the cache system as described in past work [7]. Specifically, we remove the hardware modules associated with the cache (cache control logic and the memory itself) and synthesize them to logic gates and flip-flops using Synopsys' Design Compiler targeting its and or.db library.…”

ASIC Implementation of I2C Master Bus Controller Firm IP Core

“…not more than two devices can be connected with each other at a time. Whereas USB has problem of using multiplexer for communication with other devices which makes it bulky [5,6] . Only I 2 C and CAN protocol uses software addressing but only I 2 C is convenient to design for ICs because CAN is specifically designed for automobiles.…”

Leveraging Gate-Level Properties to Identify Hardware Timing Channels

“…Since GLIFT targets the lowest digital abstraction, it is able to detect and capture information leaking through time. This claim, however, is made in some of the initial work on GLIFT [3], [5], [11] but never thoroughly formalized. One of the specific contributions of this paper is to make this formalism much more apparent and we do so in Section IV.…”

“…The shared bus in modern systems has been the source of the so called bus-contention channel [13] in which information can be covertly communicated through the traffic on a global bus. Previous work has explored how to identify information flows in global buses using GLIFT [11] but has fallen short of classifying these flows as functional or timing. Beyond the bus, we examine in Section VII the CPU cache; as previously mentioned, the cache is a common vulnerability in modern systems, as it is typically susceptible to leaking secret information through timing channels.…”