Detecting potential security issues in a hardware design using register transfer level (RTL) information flow tracking

A method for tracking dataflows in a hardware design represented in a hardware description language (HDL) without instrumenting the HDL, the method comprising:

• receiving a plurality of a dataflow primitives specifying of a plurality of taint sources from which dataflows are to be tracked within the hardware design;
• obtaining a baseline simulation trace log for a baseline register transfer level (RTL) simulation of the hardware design by causing a simulator to perform the baseline RTL simulation, wherein, during the baseline RTL simulation, none of the plurality of taint sources are altered;
• obtaining a plurality of injection simulation trace logs for a plurality of injection RTL simulations of the hardware design by causing the simulator to perform, for each taint source of the plurality of taint sources, an injection RTL simulation, wherein, during the injection RTL simulation, the taint source is altered;
• for each signal of a plurality of signals in the hardware design, generating flow metadata indicative of whether the signal or a portion thereof is part of any of the dataflows at one or more instances of simulated time based on the plurality of injection simulation trace logs;
• and
• detecting a potential security issue within the hardware design by applying a policy to the flow metadata.

A system comprising:

• a processing resource;
• and
• instructions, which when executed by the processing resource cause the processing resource to:
• receive a dataflow specification indicative of a dataflow of a taint source within a hardware design to be evaluated;
• obtain a first simulation trace log for a first register transfer level (RTL) simulation of the hardware design by causing a simulator to perform the first RTL simulation;
• obtain a second simulation trace log for a second RTL simulation of the hardware design by causing the simulator to perform the second RTL simulation, wherein, during the second RTL simulation, the taint source is altered based on the dataflow specification;
• for each signal of a plurality of signals in the hardware design, generating flow metadata indicative of whether the signal or a portion thereof is part of the dataflow at one or more instances of simulated time based on the first simulation trace log and the second simulation trace log;
• and
• detect a potential security issue within the hardware design by applying a policy to the flow metadata.