SoftFlow: Automated HW-SW Confidentiality Verification for Embedded Processors

TL;DR

SoftFlow is an automated EDA tool that verifies software-hardware confidentiality in embedded processors, identifying and mitigating data leakage paths to enhance security without compromising performance.

Contribution

It introduces a novel approach to verify and prevent software-exploited hardware leakage paths, integrating hardware and software security analysis in the design process.

Findings

Identified vulnerabilities in OpenSSL cryptographic programs.

Redesigned cryptographic software to prevent key leakage.

Validated effectiveness on RISC-V architecture.

Abstract

Despite its ever-increasing impact, security is not considered as a design objective in commercial electronic design automation (EDA) tools. This results in vulnerabilities being overlooked during the software-hardware design process. Specifically, vulnerabilities that allow leakage of sensitive data might stay unnoticed by standard testing, as the leakage itself might not result in evident functional changes. Therefore, EDA tools are needed to elaborate the confidentiality of sensitive data during the design process. However, state-of-the-art implementations either solely consider the hardware or restrict the expressiveness of the security properties that must be proven. Consequently, more proficient tools are required to assist in the software and hardware design. To address this issue, we propose SoftFlow, an EDA tool that allows determining whether a given software exploits existing leakage paths in hardware. Based on our analysis, the leakage paths can be retained if proven not to be exploited by software. This is desirable if the removal significantly impacts the design's performance or functionality, or if the path cannot be removed as the chip is already manufactured. We demonstrate the feasibility of SoftFlow by identifying vulnerabilities in OpenSSL cryptographic C programs, and redesigning them to avoid leakage of cryptographic keys in a RISC-V architecture.