A technical paper titled “SoftFlow: Automated HW-SW Confidentiality Verification for Embedded Processors” was published by researchers at RWTH Aachen University, Robert Bosch, and Newcastle University.
“Despite its ever-increasing impact, security is not considered as a design objective in commercial electronic design automation (EDA) tools. This results in vulnerabilities being overlooked during the software-hardware design process. Specifically, vulnerabilities that allow leakage of sensitive data might stay unnoticed by standard testing, as the leakage itself might not result in evident functional changes. Therefore, EDA tools are needed to elaborate the confidentiality of sensitive data during the design process. However, state-of-the-art implementations either solely consider the hardware or restrict the expressiveness of the security properties that must be proven. Consequently, more proficient tools are required to assist in the software and hardware design. To address this issue, we propose SoftFlow, an EDA tool that allows determining whether a given software exploits existing leakage paths in hardware. Based on our analysis, the leakage paths can be retained if proven not to be exploited by software. This is desirable if the removal significantly impacts the design’s performance or functionality, or if the path cannot be removed as the chip is already manufactured. We demonstrate the feasibility of SoftFlow by identifying vulnerabilities in OpenSSL cryptographic C programs, and redesigning them to avoid leakage of cryptographic keys in a RISC-V architecture.”
Find the technical paper here. Published August 2023 (preprint).
Reimann, Lennart M., Jonathan Wiesner, Dominik Sisejkovic, Farhad Merchant, and Rainer Leupers. “SoftFlow: Automated HW-SW Confidentiality Verification for Embedded Processors.” arXiv preprint arXiv:2308.02694 (2023).
Related Reading
RISC-V Disrupting EDA
Existing EDA companies say it’s unlikely there will be a major change in the industry, but that is because they are not looking at true disruptions.
Electronic Design Automation (EDA) Knowledge Center
Leave a Reply