HyperFuzzing for SoC Security Validation

Automated validation of security properties in modern systems-on-chip (SoC) designs is challenging due to three reasons: (i) specification of security in the presence of adversarial behavior, (ii) co-validation of hardware (HW) and firmware (FW) as security bugs may span the HW/FW interface, and (iii) scaling verification to the analysis of large systems-on-chip designs. In this paper, we address the above concerns via the development of a unified co-validation framework for SoC security property specification. On the specification side, we introduce a new logic, HyperPLTL (Hyper Past-time Linear Temporal Logic), that enables intuitive specification of SoC security concerns. On the validation side, we introduce a framework for mutational coverage-guided fuzzing of hyperproperties. The three novel aspects of our validation framework are a novel methodology for incorporating adversarial behavior through tamper functions, novel coverage-metrics that guide the fuzzer toward generating useful stimuli, and algorithms for efficient evaluation of hyperproperty satisfaction. Experiments on a small but realistic SoC show promising results.