Hardware security checks in static verification of integrated circuit designs

1 . A method comprising:

receiving an integrated circuit design;

classifying, by a processing device, a signal path of a sub-circuit of the integrated circuit design based on a connection between an input port of the signal path and a component of the sub-circuit to generate a classification of the signal path;

computing, by the processing device, a security vulnerability result of the sub-circuit of the integrated circuit design based on the classification of the signal path and based on a trust level of a zone in a fan-in cone to the input port of the signal path; and

generating a security vulnerability report based on the security vulnerability result of the sub-circuit of the integrated circuit design.

2 . The method of claim 1 , wherein the security vulnerability result of the sub-circuit comprises a score computed based on:

a bus width of the signal path; and

a number of branches in the signal path.

3 . The method of claim 1 , wherein the classification of the signal path comprises a data path classification, the signal path being connected to a data pin of the component of the sub-circuit, and

wherein the security vulnerability result comprises a score computed based on:

a bus width of the signal path; and

a number of branches in the signal path.

4 . The method of claim 1 , wherein the classification of the signal path comprises a clock path classification, the signal path being connected to a clock pin of the component of the sub-circuit, and

wherein the security vulnerability result of the signal path is computed based on:

detecting a clock control structure on the signal path;

identifying an input to the clock control structure; and

computing a vulnerability score for the signal path based on a trust level of a fan-in cone of the input to the clock control structure.

5 . The method of claim 4 , wherein the vulnerability score is computed based on a bus width of the input to the clock control structure.

6 . The method of claim 1 , wherein the classification of the signal path comprises a control path classification, the signal path being connected to a control pin of the component of the sub-circuit, and

wherein the security vulnerability result of the signal path is computed based on:

detecting a reset control structure on the signal path;

identifying an input to the reset control structure; and

computing a vulnerability score for the signal path based on a trust level of a fan-in cone of the input to the reset control structure.

7 . The method of claim 1 , wherein the security vulnerability result comprises a vulnerability score computed based on a fan-out cone from an output port of the signal path.

8 . A system comprising:

a memory storing instructions; and

a processor, coupled with the memory and to execute the instructions, the instructions when executed cause the processor to:

receive an integrated circuit design comprising a plurality of sub-circuits;

compute a plurality of sub-circuit level security vulnerability scores for corresponding ones of the plurality of sub-circuits of the integrated circuit design, a sub-circuit level security vulnerability score being computed for a sub-circuit of the plurality of sub-circuits based on:

classifying a signal path of the sub-circuit of the plurality of sub-circuits to generate a classification of the signal path; and

computing a security vulnerability score of the sub-circuit based on the classification of the signal path and based on a trust level of a zone in a fan-in cone of the signal path; and

generate a hardware security vulnerability report for the integrated circuit design based on the plurality of sub-circuit level security vulnerability scores.

9 . The system of claim 8 , wherein the security vulnerability score of the sub-circuit is further computed based on a bus width of the signal path.

10 . The system of claim 9 , wherein the classification of the signal path comprises a data path classification, and

wherein the computing the security vulnerability score of the sub-circuit further comprises a calculation proportional to the bus width of the signal path and inversely proportional to a number of branches in the signal path.

11 . The system of claim 9 , wherein the classification of the signal path comprises a control path classification, and

wherein the computing the security vulnerability score of the sub-circuit comprises a calculation inversely proportional to the bus width of the signal path.

12 . The system of claim 9 , wherein the classification of the signal path comprises a clock path classification, and

wherein the computing the security vulnerability score comprises a calculation inversely proportional to a bus width of a control signal controlling a clock control structure on the signal path.

13 . The system of claim 9 , wherein the computing the security vulnerability score comprises identifying sub-circuits in a fan-out cone from an output port of the signal path.

14 . The system of claim 13 , wherein the computing the security vulnerability score comprises weighting the security vulnerability score based on a number of sub-circuits in the fan-out cone from the output port of the signal path.

15 . A non-transitory computer-readable medium comprising stored instructions, which when executed by a processor, cause the processor to:

receive an integrated circuit design comprising a plurality of sub-circuits;

classify a signal path of a sub-circuit of the integrated circuit design based on a connection between an input port of the signal path and a component of the sub-circuit to generate a classification of the signal path;

compute a security vulnerability result of the sub-circuit of the integrated circuit design based on the classification of the signal path and based on a trust level of a zone in a fan-in cone to the input port of the signal path; and

generate a security vulnerability report based on the security vulnerability result of the sub-circuit of the integrated circuit design.

16 . The non-transitory computer-readable medium of claim 15 , wherein the security vulnerability result of the sub-circuit comprises a score computed based on:

a width of the signal path; and

a number of branches in the signal path.

17 . The non-transitory computer-readable medium of claim 15 , wherein the classification of the signal path comprises a data path classification, the signal path being connected to a data pin of the component of the sub-circuit, and

wherein the security vulnerability result comprises a score computed based on:

a bus width of the signal path; and

a number of branches in the signal path.

18 . The non-transitory computer-readable medium of claim 15 , wherein the classification of the signal path comprises a clock path classification, the signal path being connected to a clock pin of the component of the sub-circuit, and

wherein the security vulnerability result of the signal path is computed based on:

detecting a clock control structure on the signal path;

identifying an input to the clock control structure; and

computing a vulnerability score for the signal path based on a trust level of a fan-in cone of the input to the clock control structure.

19 . The non-transitory computer-readable medium of claim 15 , wherein the classification of the signal path comprises a control path classification, the signal path being connected to a control pin of the component of the sub-circuit, and

wherein the security vulnerability result of the signal path is computed based on:

detecting a reset control structure on the signal path;

identifying an input to the reset control structure; and

computing a vulnerability score for the signal path based on a trust level of a fan-in cone of the input to the reset control structure.

20 . The non-transitory computer-readable medium of claim 15 , wherein the security vulnerability result comprises a vulnerability score computed based on a fan-out cone from an output port of the signal path.