Towards Building Trusted Systems: Vulnerabilities, Threats, and Mitigation Techniques

When an implementation under test (IUT) is state-based, and its expected abstract behavior is given in terms of a finite state machine (FSM), a checking sequence generated from the specification FSM and applied on the lUTfor testing can provide us with high-level confidence in the correct functional behavior of our implementation. One of the issues here is to generate efficient checking sequences in terms of their lengths. In this paper, we discuss the possibility of reducing the lengths of checking sequences by making use of the invertible transitions in the specification FSM to increase the choice of betasequences to be included into a checking sequence. We present a sufficient condition for adopting alternative beta-sequences and illustrate a possible way of incorporating these alternative beta-sequences into existing methods for checking sequence generation to further reduce their lengths.

Finite state machines (FSMs) control the functionality of System-on-Chip (SoC) designs. The security and trustworthiness of SoCs can be compromised by exploring the vulnerabilities of their FSMs. Any deviation from the specification of FSMs can endanger the security and trustworthiness of SoCs. This is a critical concern when an FSM is responsible for controlling the usage or propagation of protected information (e.g., secret keys) in a secure component. FSM vulnerabilities may be introduced by a rogue designer or an attacker who inserts hardware Trojans in the FSM implementation. Traditional FSM design flows as well as CAD tools may create unintentional security vulnerabilities in FSM designs (e.g., when a synthesis tool is trying to optimize a gate-level netlist). These vulnerabilities can also be introduced unintentionally by a CAD tool. In this chapter, we present an efficient formal analysis framework based on symbolic algebra to find FSM vulnerabilities. The proposed method tries to find inconsistencies between the specification and FSM implementation through manipulation of respective polynomials. Security properties (such as a safe transition to a protected state) are derived using specification polynomials and verified against implementation polynomials. In case of a failure, the vulnerability is reported. While existing methods can verify legal transitions, the proposed approach tries to solve the important and non-trivial problem of detecting illegal accesses to the design states (e.g., protected states).

ABSTRACTCurrently, security breaches in public places like airports and official buildings are a major concern by both governmental and corporative organizations. In these situations, X-ray devices must scan a vast amount of baggage in a short time frame. Hence, deploying scanners that automatize the task of detecting suspicious artefacts becomes of vital importance to prevent from threats. In this paper we present FORTIFIER, a formal distributed framework designed to detect suspicious artefacts. This approach consists in the integration of several image detection algorithms executed in a distributed environment, which are aimed to detect a wide spectrum of weapons like guns, knifes and bombs. The main core of our proposed framework for recognizing suspicious artefacts is divided in different phases, where each one is modelled with a specific finite state machine (FSM). Several FSMs are combined to detect different artefacts. We also present a case of study where some performance experiments are carried out for analysing the scalability of FORTIFIER. Initially, FORTIFIER is deployed in a single cloud environment. Once the main features that have a significant impact on the overall system performance are analysed, our proposed framework is deployed in a multi-cloud environment.

Surveying the current state of practice of spacecraft autonomy, one can detect many different attributes of the various autonomy systems currently employed to maintain the safety of the spacecraft. In an effort to move beyond the state of practice, Johns Hopkins University Applied Physics Lab has focused on three of these attributes not found together in current systems: Understandability, Flexibility and Verifiability. Understandability defines the ability to specify and review the autonomy system in such a way that any nonsoftware domain expert or system engineer can understand the design. Flexibility defines the ability to modify the design preand post-launch in parts without patching or without complete code uploads. Verifiability defines the ability to exhaustively and rapidly verify correct autonomy system behavior before it is uploaded to the spacecraft. With the goal of attaining all three of these attributes, JHU/APL has designed and developed a new autonomy system called ExecSpec (short for Executable Specification). The system has been progressed to TRL 5 and is now poised for infusion into future spacecraft programs. ExecSpec is a new visual programming approach to autonomy system development that enables any system designer or domain expert to visually create spacecraft functionality and autonomous behavior in the form of up-loadable specification diagrams. ExecSpec allows developers to interactively construct autonomy systems by drawing diagrams of individual Finite State Machines (FSM) and linking them together to form autonomy components and subsystems. The diagram components are easily understandable by non-software domain experts and system engineers, allowing for system-level review of the autonomy system design. The diagram components can either be built from scratch, or instantiated from libraries of reusable FSM components. In contrast to current software capabilities, ExecSpec is not a code generator but rather an interpreter-based system which enables the uploading diagrams directly to an on-board FSM execution engine, allowing the autonomy system to be rapidly and safely modified at any time in a project's lifecycle and thus reducing overall lifecycle and maintenance costs. This makes the system inherently flexible to post launch modifications and enables changes on the individual FSM level such that new FSM diagrams can be added or interchanged. The resulting diagram behavior produced by ExecSpec can be tested directly through interactive stimulation of system inputs or by playing back scripted input scenarios. Model checking tools can also be used to rapidly verify that the diagrams obey specified constraints and requirements, and the uploaded system behavior can be visually monitored during flight. This combination of interactive testing, model checking and in-flight monitoring ensures autonomy systems built within ExecSpec can be exhaustively verified in a rapid manner. This paper will describe in detail the three attributes chosen by JHU/APL, including the driving need for each, then go on to describe how the new ExecSpec system meets these attributes. Finally, the paper will describe the current state of the ExecSpec development and plans for infusion into future spacecraft systems.

This paper is dedicated to the problem of learning finite-state machines (FSMs), which plays a key role in automata-based programming. Metaheuristic algorithms commonly applied to this problem often use FSM mutations (small changes in the FSM structure) for solution construction. Most of them do not employ the specifics of FSMs in their work. We propose a new simple method for improving performance of these algorithms. The basic idea is to mark those transitions of FSMs that were used during fitness evaluation. Then, if a FSM mutation changes a transition that was not used in fitness evaluation, the fitness function value need not be calculated for the mutated FSM. This observation allows to conserve fitness evaluations, which often have high computational costs. The proposed method has been incorporated into several traditional and recent FSM learning algorithms based on evolutionary strategies, genetic algorithms and ant colony optimization. Experimental results are reported showing that the new method significantly improves performance of two methods based on evolutionary strategies and ant colony optimization.

Due to the globalization of Integrated Circuit supply chain, hardware Trojans and the attacks that can trigger them have become an important security issue. One type of hardware Trojans leverages the “don’t care transitions” in Finite-state Machines (FSMs) of hardware designs. In this article, we present a symbolic approach to detecting don’t care transitions and the hidden Trojans. Our detection approach works at both register-transfer level (RTL) and gate level, does not require a golden design, and works in three stages. In the first stage, it explores the reachable states. In the second stage, it performs an approximate analysis to find the don’t care transitions and any discrepancies in the register values or output lines due to don’t care transitions. The second stage can be used for both predicting don’t care triggered Trojans and for guiding don’t care aware reachability analysis. In the third stage, it performs a state-space exploration from reachable states that have incoming don’t care transitions to explore the Trojan payload and to find behavioral discrepancies with respect to what has been observed in the first stage. We also present a pruning technique based on the reachability of FSM states. We present a methodology that leverages both RTL and gate-level for soundness and efficiency. Specifically, we show that don’t care transitions and Trojans that leverage them must be detected at the gate-level, i.e., after synthesis has been performed, for soundness. However, under specific conditions, Trojan payload exploration can be performed more efficiently at RTL. Additionally, the modular design of our approach also provides a fast Trojan prediction method even at the gate level when the reachable states of the FSM is known a priori . Evaluation of our approach on a set of benchmarks from OpenCores and TrustHub and using gate-level representation generated by two synthesis tools, YOSYS and Synopsis Design Compiler (SDC), shows that our approach is both efficient (up to 10× speedup w.r.t. no pruning) and precise (0% false positives both at RTL and gate-level netlist) in detecting don’t care transitions and the Trojans that leverage them. Additionally, the total analysis time can achieve up to 1.62× (using YOSYS) and 1.92× (using SDC) speedup when synthesis preserves the FSM structure, the foundry is trusted, and the Trojan detection is performed at RTL.

This paper presents a finite-state machine (FSM) reengineering method that enhances the FSM synthesis by reconstructing a functionally equivalent but topologically different FSM based on the optimization objective. This method enables the FSM synthesis algorithms to explore a set of functionally equivalent FSMs and obtain better solutions than those in the original FSM. To demonstrate the effectiveness of the proposed method, we apply it to popular power- and area-driven FSM synthesis algorithms, respectively. Our method achieves an average of 5.5% power reduction and 2.7% area reduction, respectively, on 25 Microelectronics Center of North Carolina (MCNC) FSM benchmarks, where the proposed method is applicable. This is a significant performance improvement for the power- and area-driven FSM synthesis algorithms being used. Our method has a negligible run-time overhead, and it maintains the quality of the synthesis solutions.

Many approaches have been proposed for deriving tests from finite state machine (FSM) specifications with respect to some established coverage criteria. A fundamental core problem in FSM-based testing relates to the derivation of input sequences that can distinguish states of an FSM specification, aka distinguishing sequences. A major effort in the construction of these sequences is based on the derivation of a successors search-tree labeled by sets of pairs of states of the given machine. We aim at reducing the time associated with such constructions through the use of state-of-the-art parallel technologies. Namely, we propose a parallel algorithm that we implement and evaluate on multicore CPUs and on many-core GPUs. We evaluate two alternative GPU implementations that use the CUDA and Thrust software platforms and a network of workstations based solution. The latter sports a workload partitioning based on Divisible Load Theory. A rigorous set of experiments highlights the differences of the proposed implementations in terms of execution time and speedup.

A heuristic method for encoding internal states (state assignment) of finite state machines (FSMs) so as to reduce their power consumption is proposed. A feature of the proposed approach is that the state assignment procedure takes into account the activity function of the memory elements when the FSM transits from a current state to other states that have already been encoded. A procedure for determining the power consumption of the FSM based on the codes of its internal states and probabilities of appearance of units at each input of the FSM is described. Experiments showed that the proposed approach makes it possible to reduce the power consumption of the FSM by 39% on the average compared with the NOVA algorithm and sometimes by 68%. In conclusion, the possibilities of improving the performance of the proposed algorithm in the synthesis of a specific FSM are discussed and promising directions of further research are indicated.

Clock-gating is an effective approach to reduce power consumption of finite state machines (FSMs) which have plenty of self-loop events. To effectively apply the clock gating technique, the occurrence probability of self-loops in a FSM has to be maximized. In this paper we present a technique based on output partitioning to decompose a FSM into interactive sub-FSMs to increase the self-loop probability of each sub-FSM which in turn reduces the power consumption. Experimental results show that significant increase of the self-loop probability is achieved and power consumption is reduced with a moderate area overhead.

Switching activity and capacitive load both affect power consumption in VLSI circuits. In two-level logic implementations, due to the regular structure, more information about the find implementation is available at an early stage. In order to optimize power during the state encoding step in the synthesis of finite state machines (FSMs), both capacitance and switching activity need to be considered. Most of the previous work does not consider accurate measures of both capacitance and switching activity on all nodes in the circuit simultaneously. We propose a new approach based on the concept of dichotomy, to find accurate measures for both switching activity and capacitive load on all nodes in two-level implementations of FSMs from their symbolic specification. The area of the resulting implementation can also be measured in the proposed model. Experimental results on MCNC benchmarks indicate the effectiveness of our approach in reducing the power consumption. The areas of the resulting implementations are also reduced in almost all the cases, indicating that power and area are strongly related in two-level implementations.

This paper obtains upper and lower bounds for the switching activity on the state lines of a finite state machine (FSM) that is driven with typical input sequences. By exploiting the symmetries between the Hamming distances of state encodings, we obtain tight bounds on the average Hamming distance, which is proportional to the average switching activity and the overall power dissipation of the system. Since these bounds are independent of the state assignment and the actual circuit implementation, they can be used at an early stage of the FSM design to indicate the largest/smallest possible power consumption. The paper also discusses how redundant state encodings can be chosen to decrease power consumption.

A popular approach to reduce power consumption is to identify self-loops in a state transition graph (STG) of a finite state machine (FSM) followed by gating the clock with a suitable function to power down the circuit (implementation of the FSM) during the self-loop cycles. Although this approach is effective in circuits with plenty of self-loops, it fails for FSMs without self-loops. Since self loops may not be inherently present in a given FSM, we decompose it into interacting FSMs such that they have plenty of self-loops. In this paper we present a novel partitioning algorithm to decompose a given finite state machine. By using this approach, we could save upto 71% of the total power on circuits like fetch, where other techniques could not save any power.

RINGA: Design and verification of finite state machine for self-adaptive software at runtime

Advancements in Silicon Carbide (SiC) digital integrated circuit (IC) design have enabled the ability to design complex, dense, digital blocks. Because of the large number of transistors, these complex digital designs make the time and risk of hand-crafted digital design, which has been the norm for SiC, too costly and risky. For large scale integrated digital circuits, computer aided design (CAD) tools are necessary, specifically the use of automatic synthesis, rule-based placement and signal routing software. The tools are used in progression as a design flow and are necessary for the timely and accurate creation of high-density digital designs. Application of an automated digital design flow to high-temperature SiC processes presents new challenges, such as extraction of timing characteristics at high temperatures, specifically above 400°C, as well as managing the complexity of synthesis, optimization of cell placement, verification of timing enclosure, and identifying routing constraints. These activities all require a willingness to extend and enhance the CAD software. Presented is a high temperature SiC digital synthesis flow. This flow is fully integrated with the characterization of a standard cell library that considers the variation of voltage, temperature, and process characteristics. A digital controller for a 10,000-pixel UV focal plan array (FPA) in a SiC CMOS process was designed using this high temperature digital flow. The controller is comprised of a finite state machine (FSM), that monitors several counters, shift registers and combinational logic feedback signals. The FSM is configured to optimize the FPA for different applications and exposures. The Register-Transfer Level (RTL) design of the FSM produces between 900 and 1,000 gates, depending on the temperature-dependent time closure with a total footprint of 14mm2. Typical SiC processes present a non-monotonic clock speed over temperature. The advantage of this digital design flow is that it allows the designer to target a temperature corner for the netlist design but verify its operation over a > 400°C operating range. This flow is currently being enhanced for use with NASA's SiC JFET-R process to create a high temperature communication protocol interface.