Rethinking SoC Verification for Secure Cross-Layer Interactions

The hardware and software layers of a modern System-on-Chip (SoC) play complementary roles to safeguard the confidentiality, integrity, and availability of security critical data and information. Due to the increasing complexity of their designs, unanticipated inter-layer and intra-layer interactions can result in system vulnerabilities that can be exploited through the software layer. Prior SoC security verification research has primarily put emphasis on single layer approaches that are inadvertently unable to take these complex hardware-software (HW-SW) interactions into account. Further, the comparative and standardized analysis of effective verification methodologies against these types of vulnerabilities is stymied by the fact that existing vulnerability databases (e.g., MITRE CVE & CWE) contain only high level descriptions of vulnerabilities and do not host full-stack SoC implementations on which test applications may be readily executed. In response to these limitations, (i) we propose a rethinking of the SoC security verification strategy by drawing up a blueprint of a top-down dynamic co-verification approach, discussing its advantages and associated future research directions, (ii) we publish and open-source a vulnerability database, featuring benchmark SoC implementations with system vulnerabilities based on the high-level descriptions provided on the existing popular databases. These benchmarks are equipped with comprehensive “ready-to-go” software execution environments with all required components to execute software workloads, and corresponding reference software exploits for the inserted vulnerabilities.