Addressing IC Security Threats Before And After They Emerge

Semiconductor Engineering sat down to discuss different approaches to security with Warren Savage, research scientist in the Applied Research Laboratory for Intelligence and Security at the University of Maryland; Neeraj Paliwal, vice president and general manager of Rambus Security; Luis Ancajas, marketing director for IoT security software solutions at Micron; Doug Suerich, product evangelist at the Peer Group. What follows are excerpts of that conversation. Part one of this conversation is here. Part two is here.

SE: There are a lot of pieces in an SoC, and not all of them are static. Algorithms and software are updated on a regular basis, and in AI systems those devices are supposed to adapt over time. How do you maintain security under these conditions?

Ancajas: This is one of the big problems in automotive today. With updates, you are either taking data out or moving data in, and the challenge on the automotive side is this is a huge ecosystem. There are all of these different sensors along with a CAN bus and lots of communications. What the car companies are heading toward is a central gateway in the car, and that gateway is connected wirelessly. There is a lot of security behind that, and hopefully a good security perimeter that prevents dispersing of all the data. But that’s far from a perfect solution, and this is a challenge the automotive industry is looking at very seriously.

Suerich: That can be a strength rather than a weakness. It’s very difficult to build something once and expect it to be perfect and absolutely secure, and I’ve never seen a system like that. If you build in the ability to find, fix and add changes, you may still get bad problems, but solutions also can be added and deployed quickly. The ability to patch on the fly exposes you to certain problems, but in the long run you are better off. One of the challenges for fabs right now is they have ancient systems that haven’t been patched for a long time, so if one virus gets in it can shut down the whole fab because they don’t have that continuous ability to update and make changes.

SE: When NXP developed chips for credit cards, they would literally have people follow those chips through the supply chain. That isn’t always possible, though, particularly as more IP from various companies is added into designs. What impact does that have on security?

Paliwal: Securing the supply chain starts with reducing the perimeter of the problem, and then it’s back to basics. If we come up with a solution for security that is too complex, it will be of no use to anyone. For us, that basic solution is to start by providing trusted identity at the root, at the chip level, limiting the perimeter with a siloed processor, and then securing keys and the assets that we need to secure in a small surface area. We cannot control the supply chain and what goes in and out, but we can control the mask that’s building that chip. And if we can securely provision at the backend, or the programmer level, then when it goes to the supply chain we can assess its unique identity in a trusted way using a cloud management service. That’s probably a good start in securing silicon from manufacturing all the way through its lifecycle. It’s not perfect, but it’s a good start.

Savage: That might include splitting up manufacturing, where the final layers are put in by a different, more trusted zone that is more carefully controlled. I’ve seen a lot of interest in this on the manufacturing side. It’s not perfect, because there are still human beings behind it. But it’s a start.

Paliwal: It’s like establishing trust in a completely untrusted world. That’s why we need to start with identities.

SE: Other industries have security problems with their supply chains, as well. Who’s doing this right?

Suerich: Well, there’s two areas where they’re doing it fairly well. If you look at the credit card industry, they still have problems, but what they’ve done well is to build in resiliency. They know they’re going to see fraud, and they’ve built in the capability to detect and respond to it quickly. They know nothing will ever be perfect. The second area that has done well is the cloud server world, using a similar concept. They’ve set themselves up to be very distributed with their clusters, so if a zone gets knocked down, they have resiliency across the entire operation. And they are very agile, with extremely fast response time to problems. There’s no perfect brick wall. These guys assume up front that problems will occur, and they have built systems to deal with them rather than strictly to prevent them.

Ancajas: There’s a third area where they have done this well. Mobile phone makers like Apple have firm control over their supply chain. They develop their own software, do their own manufacturing — they control everything.

SE: We’re certainly seeing more vertically integrated system companies developing their own chips and algorithms. Does that help?

Paliwal: It probably helps if you’re only using that company’s products, but there are going to be multiple suppliers in any industry. So it comes back to following the basics. We’re talking about trillions of connected devices. Some people call them IoT devices. It’s unlikely there will be a top 20 or 25 suppliers to OEMs for more than half of those devices, so the supply chain is going to be quite fragmented. We might have one, two or three micro-architectures. That’s why it’s so important to start with security in mind, not as an afterthought. At the OEM level, it’s going to be hard to gain that kind of market share.

Savage: Facebook and Amazon both have big hardware teams right now. These companies have very critical secure applications. They can’t afford to have these diversified, low-cost supply chains. They have to identify what is the core secure portion of their product and what are the
portions they can live with, because chip-to-chip malware is hard to manage across the supply chain. So they have to figure out what they need to bring in-house and what they don’t.

SE: Do chip companies get this? Do they really understand security? And does the typical designer actually understand how to design in security up front?

Paliwal: If I have $200 million to start up that will become the next unicorn AI chip company with a heterogeneous architecture, the chip is not going to be my biggest worry. It’s going to be my framework and the software and how I optimize it for TensorFlow. Security is at the bottom of the list of what I want to build internally. But that doesn’t mean they can’t go back to the top suppliers that know how to do this. They do have options.

Suerich: But they don’t have an economic incentive to care about that. If there are 14 major problems, security is number 27 on the list.

SE: So who fixes this issue? And who watches over the people who fix it? How layered does the oversight chain have to be to make sure this stuff works?

Suerich: We need some government action to explicitly assign some regulations and liability. Unless we have some explicit liability for corporations we’re not going to have very good security. Our infrastructure of lawyers and insurance companies will force them to care and to take those extra steps. Without that outside influence there won’t be the necessary motivation.

Paliwal: Or the companies providing a product has to be big enough to feel liable from a brand point of view. That also works. We do see that well-funded companies increasingly are investing in security. Those include the top 20 or 30 companies. But most of these are connected to devices running one of the top two or three ISAs, where they take the core as a design start. That’s where the challenge is, and it’s where regulation and education would help immensely.

Savage: I would not put a lot of confidence that the government is going to come riding to the rescue with regulations. It’s going to come more from the markets, and maybe even companies that have differentiated their products based on security. You’ll see companies that have put in secure devices so that you can trust your data, and that will be their differentiator. And the competitive advantage will lift up all boats.

Suerich: I disagree on that one. I come from a Waterloo, Ontario, which is the home of the Blackberry. For years, they advertised themselves as the most secure solution where everything was encrypted. And then it got torched in the market by pretty bright things. The general consumer is not going to buy security. More sophisticated buyers, maybe.

SE: One last question. Are you feeling more secure or less secure than you were a year ago?

Ancajas: Less secure, because there’s much more threat in the things that we have. The cars we drive are more automated and controlled by autonomous equipment. Because the electronics are more sophisticated, the stakes are higher and we have higher dependencies on them. The technology is using crypto and the foundation for that technology has gotten better, but it has to grow faster than the need for security. That isn’t what has happened here.

Savage: From my personal point of view, learning all that I’m learning in my current role, I’m more terrified than ever. Organizations like MIT putting together papers and databases of the 30 known hardware Trojans out there that I didn’t know existed. So the stakes are getting higher, and the motivation for attacking things is getting higher. We need to be very worried about where we’re going and do something about it because the threats are not diminishing.

Paliwal: It’s directly proportional to how many connected devices we have. But there is a big difference between security and privacy, and sometimes we tend to combine the two. Security is probably easier to tackle if thought about early enough. I still don’t feel secure, of course. But privacy is an even harder problem.

Ancajas: We started out to plug one hole and now we are discovering 10, 20 or even 100 holes. So I do not feel more secure now, and unfortunately I don’t see a solution in sight.