Synthesis of Sound and Precise Leakage Contracts for Open-Source RISC-V Processors

2025-09-08

AI Summary

Modeling timing side channels in open-source RISC-V processor microarchitectures remains challenging due to their complex, optimization-dependent behaviors. Method: We propose LeaSyn, the first automated leakage-contract synthesis framework operating at the RTL level. LeaSyn jointly performs empirical leakage characterization and formal verification in a closed-loop manner—without requiring expert knowledge of microarchitectural optimizations—guided by user-defined template spaces and informed by hardware behavioral observations and logical reasoning. Contribution/Results: LeaSyn synthesizes high-quality, reliable (sound, i.e., no false negatives) and precise (low false positives) leakage contracts for six mainstream open-source RISC-V CPUs. Experimental evaluation demonstrates that LeaSyn’s contracts significantly outperform existing manual and semi-automated approaches in both reliability and precision. By enabling scalable, formally verifiable hardware security abstractions, LeaSyn establishes a new paradigm for side-channel-aware processor design and verification.

Technology Category

• Machine Learning: Hardware-aware ML
• Planning, Routing, and Scheduling: Optimization of Spatio-temporal Systems
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Security and Privacy: Large-scale security measurements
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

Leakage contracts have been proposed as a new security abstraction at the instruction set architecture level. Leakage contracts aim to capture the information that processors may leak via microarchitectural side channels. Recently, the first tools have emerged to verify whether a processor satisfies a given contract. However, coming up with a contract that is both sound and precise for a given processor is challenging, time-consuming, and error-prone, as it requires in-depth knowledge of the timing side channels introduced by microarchitectural optimizations. In this paper, we address this challenge by proposing LeaSyn, the first tool for automatically synthesizing leakage contracts that are both sound and precise for processor designs at register-transfer level. Starting from a user-provided contract template that captures the space of possible contracts, LeaSyn automatically constructs a contract, alternating between contract synthesis, which ensures precision based on an empirical characterization of the processor's leaks, and contract verification, which ensures soundness. Using LeaSyn, we automatically synthesize contracts for six open-source RISC-V CPUs for a variety of contract templates. Our experiments indicate that LeaSyn's contracts are sound and more precise (i.e., represent the actual leaks in the target processor more faithfully) than contracts constructed by existing approaches.

Problem

• Automating synthesis of sound leakage contracts for processors
• Ensuring precision in contracts via empirical leak characterization
• Addressing microarchitectural side channel information leakage challenges

Innovation

• Automated synthesis of leakage contracts for processors
• Ensures contract soundness and precision via verification
• Empirical characterization of processor leaks for accuracy