Periodic Reporting for period 2 - SafeSecS (Abstractions for Safe and Secure HW-SW Systems)
Reporting period: 2023-04-01 to 2024-09-30
Trains, planes, and other safety- and security-critical systems that our society relies on are controlled by computer systems, as is much of our critical infrastructure, including the power grid and cellular networks. But can we trust in the safety and security of these systems? The starting point of SafeSecS is the observation that today’s hardware-software abstractions, instruction set architectures (ISAs), are fundamentally inadequate for the development of safe or secure systems. Indeed, ISAs abstract from timing, making it impossible to develop safety-critical systems that have to satisfy real-time constraints on top of them. Neither do ISAs provide sufficient security guarantees, making it impossible to develop secure systems on top of them. As a consequence, engineers are forced to rely on brittle timing and security models that are proven wrong time and again, as evidenced e.g. by the recent Spectre attacks; putting our society at risk.
SafeSecS attacks the problem at its root by introducing a framework centered around hardware-software contracts that extend the guarantees provided by ISAs to capture key non-functional properties. Hardware-software contracts formally capture the expectations on correct hardware implementations and they lay the foundation for achieving safety and security guarantees as the software level. Below the hardware-software interface, SafeSecS aims to contribute modular design principles and tools to construct microarchitectures that provably satisfy a given hardware-software contract. Above the hardware-software interface, SafeSecS develops rigorous, precise, and scalable techniques to guarantee key safety and security properties at the software level on top of hardware-software contracts. As a whole, SafeSecS aims to enable the systematic engineering of safe and secure hardware-software systems we can trust in.
SafeSecS attacks the problem at its root by introducing a framework centered around hardware-software contracts that extend the guarantees provided by ISAs to capture key non-functional properties. Hardware-software contracts formally capture the expectations on correct hardware implementations and they lay the foundation for achieving safety and security guarantees as the software level. Below the hardware-software interface, SafeSecS aims to contribute modular design principles and tools to construct microarchitectures that provably satisfy a given hardware-software contract. Above the hardware-software interface, SafeSecS develops rigorous, precise, and scalable techniques to guarantee key safety and security properties at the software level on top of hardware-software contracts. As a whole, SafeSecS aims to enable the systematic engineering of safe and secure hardware-software systems we can trust in.
We have developed a framework for the specification and verification of hardware-software leakage contracts, which provide guarantees about a hardware implementation's information leakage at the level of the instruction set architecture (ISA). Employing this framework, we have formally specified and subsequently verified the security guarantees afforded by various open-source RISC-V processors. Our verification methodology is the first to bridge the gap between ISA-level security guarantees and the register-transfer level implementations of the processors. A crucial insight that renders our approach scalable is that functional and security concerns can be effectively decoupled.
Applying our framework to existing processors is challenging as they have not been designed with hardware-software leakage contracts in mind. Thus, they lack a security specification to start with. To ease the burden of applying contracts to such legacy systems, we have developed a methodology to synthesize specifications in the form of leakage contracts. Employing this methodology to the RISC-V ISA and the Ibex and CVA6 processors showed its practical applicability and uncovered subtle and previously undocumented leaks.
Due to their interaction with the physical environment, many safety-critical systems have to satisfy real-time constraints. However, proving the satisfaction of real-time constraints is frequently challenging due to the complex interplay of software and hardware. We identified a mismatch between a widely established software abstraction in timing analysis and the underlying hardware. To better align software and hardware analysis, we proposed a new software abstraction, coined symbolic control-flow graph, and a corresponding timing-analysis technique that is able to accurately account for data-cache behavior. Our new analysis achieves significant improvements in both efficiency and accuracy.
The analysis of many real-time and security properties relies on precise and accurate models of the underlying hardware. For open-source hardware designs, such models are readily available. For proprietary commercial designs, such models are often lacking in both precision and accuracy. Careful reverse engineering based on microbenchmarking has allowed us to construct highly accurate models of the core execution engines of modern commercial processors.
Applying our framework to existing processors is challenging as they have not been designed with hardware-software leakage contracts in mind. Thus, they lack a security specification to start with. To ease the burden of applying contracts to such legacy systems, we have developed a methodology to synthesize specifications in the form of leakage contracts. Employing this methodology to the RISC-V ISA and the Ibex and CVA6 processors showed its practical applicability and uncovered subtle and previously undocumented leaks.
Due to their interaction with the physical environment, many safety-critical systems have to satisfy real-time constraints. However, proving the satisfaction of real-time constraints is frequently challenging due to the complex interplay of software and hardware. We identified a mismatch between a widely established software abstraction in timing analysis and the underlying hardware. To better align software and hardware analysis, we proposed a new software abstraction, coined symbolic control-flow graph, and a corresponding timing-analysis technique that is able to accurately account for data-cache behavior. Our new analysis achieves significant improvements in both efficiency and accuracy.
The analysis of many real-time and security properties relies on precise and accurate models of the underlying hardware. For open-source hardware designs, such models are readily available. For proprietary commercial designs, such models are often lacking in both precision and accuracy. Careful reverse engineering based on microbenchmarking has allowed us to construct highly accurate models of the core execution engines of modern commercial processors.
We have presented the first approach for the verification of hardware-software leakage contracts that effectively bridges the gap between ISA-level security guarantees and register-transfer level processor designs. The approach scales to medium-sized processors due to a novel decoupling of functional and security concerns. However, scaling to significantly larger processor designs will require further methodological advances. To this end, we aim to develop a modular approach that permits to exploit the hierarchical nature of large-scale hardware designs.
Data-cache analysis is a notoriously difficult problem. With symbolic data-cache analysis we have made the first major advance in this area in the last ten years relying on two key contributions: (1) symbolic control flow graphs as a more adequate software abstraction, and (2) a careful lifting of classical least-recently-used (LRU) cache analysis to this novel abstraction. We aim to extend the applicability of this result to other common cache designs by introducing novel hardware abstractions exploiting quantitative relations between different cache designs.
We have also significantly improved the state of the art when it comes to accurate models of the core execution engines of modern commercial processors, improving the accuracy by an order of magnitude.
Data-cache analysis is a notoriously difficult problem. With symbolic data-cache analysis we have made the first major advance in this area in the last ten years relying on two key contributions: (1) symbolic control flow graphs as a more adequate software abstraction, and (2) a careful lifting of classical least-recently-used (LRU) cache analysis to this novel abstraction. We aim to extend the applicability of this result to other common cache designs by introducing novel hardware abstractions exploiting quantitative relations between different cache designs.
We have also significantly improved the state of the art when it comes to accurate models of the core execution engines of modern commercial processors, improving the accuracy by an order of magnitude.