  Hardware vulnerabilities are generally considered more difficult to fix than
software ones because they are persistent after fabrication. Thus, it is
crucial to assess the security and fix the vulnerabilities at earlier design
phases, such as Register Transfer Level (RTL) and gate level. The focus of the
existing security assessment techniques is mainly twofold. First, they check
the security of Intellectual Property (IP) blocks separately. Second, they aim
to assess the security against individual threats considering the threats are
orthogonal. We argue that IP-level security assessment is not sufficient.
Eventually, the IPs are placed in a platform, such as a system-on-chip (SoC),
where each IP is surrounded by other IPs connected through glue logic and
shared/private buses. Hence, we must develop a methodology to assess the
platform-level security by considering both the IP-level security and the
impact of the additional parameters introduced during platform integration.
Another important factor to consider is that the threats are not always
orthogonal. Improving security against one threat may affect the security
against other threats. Hence, to build a secure platform, we must first answer
the following questions: What additional parameters are introduced during the
platform integration? How do we define and characterize the impact of these
parameters on security? How do the mitigation techniques of one threat impact
others? This paper aims to answer these important questions and proposes
techniques for quantifiable assurance by quantitatively estimating and
measuring the security of a platform at the pre-silicon stages. We also touch
upon the term security optimization and present the challenges for future
research directions.
