Gate-level information flow security

1. A method comprising:

receiving, via a processing system, a hardware design of a not secure-by-design processor;

receiving, via the processing system, a specific software application to be executed by the not secure-by-design processor;

receiving, via the processing system, a security policy;

simulating, via the processing system, the execution of the specific software application on the not secure-by-design processor for all possible executions of the specific software application for any possible inputs to the specific software application by performing symbolic simulation to identify all possible information flows and to identify information flow violations generated by the specific software application based on the security policy; and

modifying the specific software application to prevent the identified information flow violations without the use of hardware-based information flow control mechanisms to prevent the identified information flow violations for all possible executions of the specific software application by the not secure-by-design processor,

wherein performing the symbolic simulation comprises:

initializing each gate of a gate-level netlist of the not secure-by-design processor design to an untainted X, wherein each X represents an unknown logic value;

marking tainted ports and gates of the gate-level netlist based on the security policy;

simulating the specific software application based on the marked gate-level netlist and an application binary to track taint;

tracking the most conservative gate-level state that has been observed for each conditional branch encountered during the simulation; and

in response to re-encountering a conditional branch while simulating on a control flow path:

terminating simulation down the control flow path in response to the symbolic state being simulated being a substate of the most conservative gate-level state previously observed at the conditional branch; and

in response to the symbolic state being simulated not being a substate of the most conservative gate-level state previously observed at the conditional branch, merging the symbolic state being simulated with the most conservative gate-level state previously observed at the conditional branch to update the most conservative gate-level state for the conditional branch, and continuing simulation from the updated most conservative gate-level state.

2. The method of claim 1 , wherein modifying the specific software application comprises adding a timer to reset a program counter to an untainted location.

3. The method of claim 1 , wherein modifying the specific software application comprises masking a tainted memory address such that the memory address falls within a region of data memory to which tainted code is allowed to write.

4. The method of claim 1 , wherein the not secure-by-design processor comprises an ultra-low-power processor.

5. The method of claim 1 , wherein the specific software application comprise an Internet of Things (IoT) application.

6. A system comprising:

a machine readable storage medium storing instructions; and

a simulation processor to execute the instructions to:

receive a gate-level netlist of a not secure-by-design processor;

receive an application binary for a specific software application to be executed by the not secure-by-design processor;

receive a security policy;

simulate the execution of the specific software application on the not secure-by-design processor based on the gate-level netlist and the application binary for all possible executions of the specific software application for any possible inputs to the specific software application by performing symbolic simulation to identify all possible information flows and to identify information flow violations generated by the specific software application based on the security policy; and

modify the specific software application to prevent the identified information flow violations without the use of hardware-based information flow control mechanisms to prevent the identified information flow violations for all possible executions of the specific software application by the not secure-by-design processor,

wherein the simulation processor executes the instructions to perform the symbolic simulation to:

initialize each gate of the gate-level netlist to an untainted X, wherein each X represents an unknown logic value;

mark tainted ports and gates of the gate-level netlist based on the security policy;

simulate the specific software application based on the marked gate-level netlist and the application binary to track taint;

track the most conservative gate-level state that has been observed for each conditional branch encountered during the simulation; and

in response to re-encountering a conditional branch while simulating on a control flow path:

terminate simulation down the control flow path in response to the symbolic state being simulated being a substate of the most conservative gate-level state previously observed at the conditional branch; and

in response to the symbolic state being simulated not being a substate of the most conservative gate-level state previously observed at the conditional branch, merge the symbolic state being simulated with the most conservative gate-level state previously observed at the conditional branch to create an updated most conservative gate-level state for the conditional branch, and continue simulation from the updated most conservative gate-level state.

7. The system of claim 6 , wherein the simulation processor executes the instructions to modify the specific software application to:

add a watchdog timer to reset a program counter to an untainted location.

8. The system of claim 6 , wherein the simulation processor executes the instructions to modify the specific software application to:

mask a tainted memory address such that the memory address falls within a region of data memory to which tainted code is allowed to write.

9. A method comprising:

receiving, via a processing system, a gate-level netlist of a not secure-by-design processor, a specific software application to be executed by the not secure-by-design processor, and a security policy;

initializing, via the processing system, each gate of the gate-level netlist to an untainted X, wherein each X represents an unknown logic value;

marking, via the processing system, tainted ports and gates of the gate-level netlist based on the security policy;

simulating, via the processing system, the specific software application based on the marked gate-level netlist to track taint for all possible executions of the specific software application for any possible inputs to the specific software application by performing symbolic simulation;

identifying information flow violations based on the tracked taint and the security policy; and

modifying the specific software application to prevent the identified information flow violations without the use of hardware-based information flow control mechanisms to prevent the identified information flow violations for all possible executions of the specific software application by the not secure-by-design processor,

wherein the simulating further comprises:

tracking, via the processing system, the most conservative gate-level state that has been observed for each conditional branch encountered during the simulation; and

in response to re-encountering a conditional branch while simulating on a control flow path:

terminating, via the processing system, simulation down the control flow path in response to the symbolic state being simulated being a substate of the most conservative gate-level state previously observed at the conditional branch; and

in response to the symbolic state being simulated not being a substate of the most conservative gate-level state previously observed at the conditional branch, merging, via the processing system, the symbolic state being simulated with the most conservative gate-level state previously observed at the conditional branch to create an updated most conservative gate-level state for the conditional branch, and continuing simulation from the updated most conservative gate-level state.

10. The method of claim 9 , wherein the not secure-by-design processor comprises an ultra-low-power processor.