METHOD AND SYSTEMS FOR DETECTING AND ISOLATING HARDWARE TIMING CHANNELS

• US 20140259161A1
• Filed: 03/07/2014
• Published: 09/11/2014
• Est. Priority Date: 03/08/2013
• Status: Active Grant

• Current Assignee: Regents of the University of California (University of California)
• Original Assignee: Regents of the University of California (University of California)
• Inventors: Sherwood, Timothy, Kastner, Ryan, Oberg, Jason, Meiklejohn, Sarah, Tiwari, Mohit
• Granted Patent: US 9,305,166 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755

Abstract

A method for detecting a timing channel in a hardware design includes synthesizing the hardware design to gate level. Gate level information flow tracing is applied to the gate level of the hardware design via a simulation to search for tainted flows. If a tainted flow is found, a limited number of traces are selected. An input on the limited number of traces is simulated to determine whether the traces are value preserving with respect to taint inputs, and to determine that a timing flow exists if the traces are value preserving with respect to the taint inputs.

Claims

1. A method for detecting a timing channel in a hardware design, the method comprising:

receiving a hardware design;

synthesizing at least one portion of the hardware design with gate level primitives;

adding tracking logic to the gate level primitives to monitor information flow through the gate level primitives;

simulating sets of inputs to the gate level primitives including added taint inputs to identify information flows by generating outputs from the gate level primitives for every clock tick while changing only taint inputs;

separating timing flows from informational flows by conducting input to output deterministic traces to isolate functional flows in the information flows.

2. The method of claim 1, wherein said separating comprises selecting a subset of input deterministic traces for the tracking logic.

3. The method of claim 2, wherein the subset is selected by changing the value of the only the security critical inputs randomly or by a designers choice.

4. The method of claim 1, wherein said simulating comprises finding a subset of taint inputs that cause a changing in the timing of outputs without changing output values.

5. The method of claim 4, wherein said finding begins with selecting input traces which differ in values of security critical inputs.

6. The method of claim 4, wherein said finding begins with a random selection of input traces.

7. The method of claim 4, wherein said finding begins with selecting input traces aided by information provided by a hardware designer.

8. The method of claim 1, wherein said hardware design comprises a design in a hardware description language, said synthesizing the design into a gate level netlist, and the tracking logic is added to every gate level primitive in the netlist.

9. A method for detecting a timing channel in a hardware design, the method comprising:

synthesizing the hardware design to gate level;

applying gate level information flow tracing to the gate level of the hardware design via a simulation to search for tainted flows;

if a tainted flow is found, selecting a limited number of traces, simulating an input on the limited number of traces, determining whether the traces are value preserving with respect to taint inputs, and determining that a timing flow exists if the traces are value preserving with respect to the taint inputs.