AI 中文总结
研究针对处理器设计流程中硅前功率侧信道泄漏问题，提出SPARC自动化框架，利用宏单元级信息流跟踪及增强影子逻辑，实现端到端泄漏评估与根本原因分析，在多开源RISC-V CPU上验证，加速模拟且能识别泄漏源，加强处理器安全。
AI 中文摘要
功率侧信道泄漏（PSCL）源于处理器中的架构和微架构工件，对加密软件的保密性构成严重威胁。因此，硅前PSCL评估对于安全硬件设计至关重要。现有框架要么受模拟可扩展性差的限制，要么无法将泄漏归因于正确的硬件信号和软件指令，阻碍了全面的根本原因分析。本文提出了SPARC，一个用于硅前PSCL评估和根本原因分析的自动化框架。SPARC利用宏单元级信息流跟踪（IFT），并增强了影子逻辑，标记源自秘密相关数据的开关活动。通过隔离此活动，SPARC应用统计泄漏测试来检测PSCL，同时将泄漏归因于特定硬件信号并将这些信号映射到相应软件指令。此方法为硬件和软件提供了完整的端到端泄漏评估和根本原因分析。为了演示和验证SPARC，在一系列加密工作负载上评估了多个开源RISC-V CPU的PSCL，包括具有顺序和乱序流水线的32位和64位内核，包括掩码和未掩码的AES和ML-KEM（CRYSTALS-Kyber-512）。SPARC恢复了已知泄漏源作为健全性检查，并识别了特定的微架构泄漏源，在可比设计上比以前的方法实现了8倍的每跟踪模拟加速。通过在硅前阶段实现精确且可扩展的根本原因分析，这项工作提供了一个实用框架，以在设计流程早期减轻PSCL，从而加强未来处理器的安全性。
英文摘要
Power-Side-Channel Leakage (PSCL) originates from architectural and micro-architectural artifacts in a processor and poses a severe threat to the confidentiality of cryptographic software. Consequently, pre-silicon PSCL evaluation is indispensable for secure hardware design. Existing frameworks are either limited by poor simulation scalability or fail to attribute leakage to the correct hardware signals and software instructions, thereby impeding a comprehensive root-cause analysis. This paper presents SPARC, an automated framework for pre-silicon PSCL evaluation and root-cause analysis. SPARC leverages macro-cell-level Information Flow Tracking (IFT) augmented with enhanced shadow logic that tags switching activity originating from secret-dependent data. By isolating this activity, SPARC applies statistical leakage tests to detect PSCL, while simultaneously attributing the leakage to specific hardware signals and mapping those signals to the corresponding software instructions. This approach thus delivers a full end-to-end leakage evaluation and root-cause analysis for both hardware and software. To demonstrate and validate SPARC, PSCL of multiple open-source RISC-V CPUs, encompassing 32-bit and 64-bit cores with both in-order and out-of-order pipelines, is evaluated across a range of cryptographic workloads, including masked and unmasked AES and ML-KEM (CRYSTALS-Kyber-512). SPARC recovers known leakage sources as a sanity check and identifies specific microarchitectural leakage sources, achieving an 8x per-trace simulation speedup over previously shown approaches on comparable designs. By enabling precise and scalable root-cause analysis at the pre-silicon stage, this work provides a practical framework to mitigate PSCL early in the design flow, thereby strengthening the security of future processors.
CommentsAccepted at IEEE/ACM ICCAD 2026
