FSM Anomaly Detection Using Formal Analysis

Finite state machines (FSMs) control the functionality of the overall design. Any deviation from the specified FSM behavior can endanger the trustworthiness of the design. This is a critical concern when an FSM is responsible for controlling the usage or propagation of protected information (e.g. secret keys) in a secure component. FSM vulnerabilities can be created by a rogue designer or an attacker by inserting hardware Trojans in the FSM implementation. The vulnerability can also be introduced unintentionally by a CAD tool (e.g., when a synthesis tool is trying to optimize a gate-level netlist). In this paper, we present an efficient formal analysis framework based on symbolic algebra to find FSM vulnerabilities. The proposed method tries to find inconsistencies between the specification and FSM implementation through manipulation of respective polynomials. Security properties (such as a safe transition to a protected state) are derived using specification polynomials and verified against implementation polynomials. In a case of a failure, the vulnerability is reported. While existing methods can verify legal transitions, our approach tries to solve the important and non-trivial problem of detecting illegal accesses to the design states (e.g., protected states). We demonstrated the merit of our proposed method by detecting the vulnerabilities in various FSM designs, while state-of-the-approaches failed to identify the security flaws.