US 11,599,703 B2Granted

Chip security verification tool

AssigneeMellanox Technologies, Ltd.

InventorsDotan Finkelstein, Roman Manevich, Lidiya Ivanitskaya

Life of this patent

Estimating the term…

Loading patent…

Abstract

An apparatus reads a chip design comprising first and second blocks corresponding to first and second hardware modules, nodes, and data path segments that each connect a pair of nodes or a node to a block. Tracing backward along data paths that terminate at the second block, the apparatus identifies a secure cone. The secure cone comprises secure path segments of the data paths terminating at the second block and corresponding nodes. The apparatus identifies data paths originating at the first block and that are at least partially within the secure cone and determines whether any terminate outside the secure cone. When none of the data paths originating at the first block terminate outside the secure cone, the apparatus verifies the chip design. When a data path originating at the first block terminates outside the secure cone, the apparatus determines that the chip design has a potential leak.

Claims20

Dependent claims

A method for verifying a chip design for a computer chip, the method comprising:

reading, by an analysis apparatus, a chip design, the chip design comprising a first block corresponding to a first hardware module, a second block corresponding to a second hardware module, a plurality of nodes, and a corresponding plurality of data path segments, wherein each data path segment connects a pair of nodes or connects a node to one of the first or second blocks;
by tracing backwards along data paths that terminate at the second block, identifying, by the analysis apparatus, a secure cone, wherein the secure cone comprises all data path segments of the data paths that terminate at the second block and any nodes that connect the data path segments of the secure cone;
based on the secure cone, defining, by the analysis apparatus, at least one of (a) a set of nodes that are located within the secure cone or (b) a set of data paths segments that are located within the secure cone;
identifying, by the analysis apparatus, data paths that originate at the first block and that are at least partially within the secure cone;
determining, by the analysis apparatus and based at least in part on the at least one of (a) a set of nodes that are located within the secure cone or (b) a set of data paths segments that are located within the secure cone, whether any of the data paths that originate at the first block and are at least partially within the secure cone terminate at a node that is not in the secure cone by tracing forward along each of the data paths that originate at the first block and that are at least partially within the secure cone from the first block to determine whether each of the data paths terminate at the second block;
responsive to determining that each of the data paths that originate at the first block and are at least partially within the secure cone terminate at the second block, determining, by the analysis apparatus, that the chip design is verified;
and
responsive to determining that at least one of the data paths that originate at the first block and are at least partially within the secure cone does not terminate at the second block:
determining, by the analysis apparatus, that the chip design has a potential leak, and
causing, by the analysis apparatus, display of an indication of the potential leak.

7 more elements

An apparatus comprising at least one processor and at least one memory storing computer program code, the at least one memory and the computer program code configured to, with the processor, cause the apparatus to at least:

read a chip design, the chip design comprising a first block corresponding to a first hardware module, a second block corresponding to a second hardware module, a plurality of nodes, and a corresponding plurality of data path segments, wherein each data path segment connects a pair of nodes or connects a node to one of the first or second blocks;
by tracing backwards along data paths that terminate at the second block, identify a secure cone, wherein the secure cone comprises all data path segments of the data paths that terminate at the second block and any nodes that connect the data path segments of the secure cone;
based on the secure cone, define at least one of (a) a set of nodes that are located within the secure cone or (b) a set of data paths segments that are located within the secure cone;
identify data paths that originate at the first block and are at least partially within the secure cone;
determine, based at least in part on the at least one of (a) a set of nodes that are located within the secure cone or (b) a set of data paths segments that are located within the secure cone, whether any of the data paths that originate at the first block and that are at least partially within the secure cone terminate at a node that is not in the secure cone by tracing forward along each of the data paths that originate at the first block and that are at least partially within the secure cone from the first block to determine whether each of the data paths terminate at the second block;
responsive to determining that of the data paths that originate at the first block and are at least partially within the secure cone terminate at the second block, determine that the chip design is verified;
and
responsive to determining that at least one of the data paths that originate at the first block and are at least partially within the secure cone does not terminate at the second block:
determine that the chip design has a potential leak, and
cause display of an indication of the potential leak.

7 more elements

A non-transitory, machine-readable storage medium comprising a plurality of instructions that, when executed with a processor of an apparatus, cause the apparatus to:

read a chip design, the chip design comprising a first block corresponding to a first hardware module, a second block corresponding to a second hardware module, a plurality of nodes, and a corresponding plurality of data path segments, wherein each data path segment connects a pair of nodes or connects a node to one of the first or second blocks;
by tracing backwards along data paths that terminate at the second block, identify a secure cone, wherein the secure cone comprises all data path segments of the data paths that terminate at the second block and any nodes that connect the data path segments of the secure cone;
based on the secure cone, define at least one of (a) a set of nodes that are located within the secure cone or (b) a set of data paths segments that are located within the secure cone;
identify data paths that originate at the first block and are at least partially within the secure cone;
determine, based at least in part on the at least one of (a) a set of nodes that are located within the secure cone or (b) a set of data paths segments that are located within the secure cone, whether any of the data paths that originate at the first block and that are at least partially within the secure cone terminate at a node that is not in the secure cone by tracing forward along each of the data paths that originate at the first block and that are at least partially within the secure cone from the first block to determine whether each of the data paths terminate at the second block;
responsive to determining that each of the data paths that originate at the first block and are at least partially within the secure cone terminate at the second block, determine that the chip design is verified;
and
responsive to determining that at least one of the data paths that originate at the first block and are at least partially within the secure cone does not terminate at the second block:
determine that the chip design has a potential leak, and
cause display of an indication of the potential leak.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/783,237Filed 6 Feb 2020
Published: US 2021/0248274 A112 Aug 2021
Granted: 7 Mar 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

G06F 30/398
Circuit design at the physical level: design verification or optimisation, e.g. using design rule check [DRC], layout versus schematics [LVS] or…
G06F 21/72
To assure secure computing or processing of information: in cryptographic circuits
G06F 30/33
Circuit design at the digital level: design verification, e.g. functional simulation or model checking
G06F 2119/02
Details relating to the type or aim of the analysis or the optimisation: reliability analysis or reliability optimisation; Failure analysis, e.g.…