[Paper Review] FVCARE:Formal Verification of Security Primitives in Resilient Embedded SoCs

Avani Dave, Nilanjan Banerjee+1 more|arXiv (Cornell University)|Apr 22, 2023

Security and Verification in Computing4 citations

TL;DR

FVCARE presents the first end-to-end formal co-verification framework for secure boot and remote attestation in resilient small embedded systems, combining hardware verification via SMV and software verification using Frama-C with custom plugins for assertion, LTL, and weakness prediction. It achieves full verification of security properties and functional correctness in under 0.2 seconds for a 5.6 KB secure boot implementation.

ABSTRACT

With the increased utilization, the small embedded and IoT devices have become an attractive target for sophisticated attacks that can exploit the devices security critical information and data in malevolent activities. Secure boot and Remote Attestation (RA) techniques verifies the integrity of the devices software state at boot-time and runtime. Correct implementation and formal verification of these security primitives provide strong security guarantees and enhance user confidence. The formal verification of these security primitives is considered challenging, as it involves complex hardware software interactions, semantics gaps and requires bit-precise reasoning. To address these challenges, this paper presents FVCARE an end to end system co-verification framework. It also defines the security properties for resilient small embedded systems. FVCARE divides the end to end system co verification problem into two modules: 1) verifying the (bit precise) initial system settings, registers, and access control policies by hardware verification techniques, and 2) verifying the system specification, security properties, and functional correctness using source-level software abstraction of the hardware. The evaluation of proposed techniques on SRACARE based systems demonstrates its efficacy in security co verification.

Motivation & Objective

• To address the challenge of verifying complex hardware-software interactions in security-critical embedded systems.
• To provide formal verification of security primitives like secure boot and remote attestation in small embedded and IoT devices.
• To bridge the gap in existing tools that lack end-to-end co-verification for system-level security properties.
• To enable bit-precise verification of initial system state, register settings, and access control policies alongside functional correctness.
• To demonstrate practical formal verification of SRACARE-based resilient systems with onboard recovery and strong security guarantees.

Proposed method

• Divides system verification into two parts: hardware verification of initial settings and access control policies using SMV and NuSMV.
• Uses hardware-software co-verification by abstracting hardware as software for formal analysis with Frama-C.
• Employs Frama-C with three custom plugins: Weakness Prediction (WP), assertion checking, and Linear Temporal Logic (LTL) verification.
• Converts SystemVerilog hardware modules to SMV for formal hardware verification of security-critical properties.
• Applies bounded model checking and K-induction-based verification for functional correctness and security property coverage.
• Validates system-level correctness by combining hardware verification of crypto-core with software abstraction of system behavior.

Figure 1: Highlights the proposed SRACARE system design flow. It represents the lightweight authenticated secure communication protocol and a new RA and secure boot architecture using custom CARE module.

Experimental results

Research questions

• RQ1 How can formal verification be effectively applied to hardware-software interactions in small embedded systems?
• RQ2 What is the most scalable and precise method for verifying secure boot and remote attestation in resilient SoCs?
• RQ3 Can a hybrid hardware-software co-verification framework achieve full coverage of security properties and functional correctness?
• RQ4 How can bit-precise verification of initial system state and access control policies be achieved?
• RQ5 Can formal verification tools be extended to support security-specific properties like key confidentiality and attack detection?

Key findings

• FVCARE achieves formal verification of secure boot for a 5.6 KB firmware in 0.2 seconds using hardware abstraction and Frama-C plugins.
• The framework successfully verifies 100% of specified security properties, including access control enforcement, key confidentiality, and attack detection.
• Hardware verification via SMV and NuSMV confirms correct initialization of system registers and access control policies.
• The integration of Frama-C with custom plugins enables assertion checking, LTL model checking, and weakness prediction for software-level verification.
• FVCARE is the first framework to provide end-to-end co-verification of secure boot, remote attestation, and onboard recovery in SRACARE-based systems.
• Evaluation shows that FVCARE outperforms existing approaches by combining hardware and software formal verification with full coverage of edge cases and security properties.

Figure 2: Highlights the system design and key contributions of SRACARE : 1) Novel lightweight, secure authenticated communication protocol (steps 1 to 12), and 2) Secure boot with CARE and remote attestation architecture for the P r device (steps 13 to 20)).