FortifyIQ: Hardware Security Verification

What’s the best way to protect against side-channel attacks? FortifyIQ believes the answer lies at least partly in the verification process.

Side channel and fault-injection attacks have been garnering more attention lately as hackers continue to branch out from software to a combination of software and hardware. This is especially worrying for safety-critical applications, such as automotive, medical, and industrial, where hacking hardware can give cybercriminals control of entire systems, as well as increasingly valuable data.

There are multiple ways to take over a chip, many of which are well understood. But while chipmakers recognize that security needs to be built into chips at multiple levels, it has not permeated every level of the design flow. This is where startup FortifyIQ sees an opening.

“We’re seeing an opportunity emerging as our customers are getting requirements from their customers, who say there has to be protection from these kinds of attacks,” said Will Ruby, FortifyIQ’s COO. “The bad actors — as the industry calls them, the hackers — they’re getting more sophisticated and attacking the hardware, where these new types of attacks can circumvent known protection schemes. The security experts need to stay a couple of steps ahead of these bad actors and understand what type of attacks can be mounted on devices.”

Hackers have the advantage of being able to hop from target to target, mission failed or successful. For the defenders, preventing attacks isn’t so simple, even when the attack vector is identified. Once a chip is manufactured, it’s difficult to fix, and the push toward more domain-specific architectures makes it imperative to fix security weaknesses much earlier in design flow.

“The idea here is that security verification becomes part of the functional verification,” Ruby said. “So as part of the functional verification, you also show hardware vulnerabilities. There are security concerns from the application, the operating system, the firmware, and ultimately at the bottom of that stack you have the actual hardware itself with a root of trust. If you break the hardware security, then the upper layers become exposed.”

FortifyIQ, co-founded by Alexander Kessler and Yuri Kreimer, has developed a pre-silicon evaluation toolset that can be used to verify hardware designs, as well as IP cores. The technology produces physical attack simulation, where one can “mount a series of attacks and then uncover the values of secret keys as proof that the design is vulnerable,” Ruby said.

There is good reason for chipmakers to take security more seriously. There are more regulations being applied to safety- and mission-critical markets, many of them carrying penalties or other liability. The EU Agency for Cybersecurity (ENISA), for example, has established a new working group to develop a scheme to certify in-circuit testing. The scheme is expected to be fully functional beginning this year.

While there are plenty of companies working on hardware security, Ruby said the goal is to complement what is already available in the market today. “These are all different types of solutions that are aiming to address this equal opportunity problem of hardware security verification,” he added.

Currently, FortifyIQ is focused solely on addressing hardware and what vulnerabilities it can encounter. The startup hopes to provide a solution for firmware type analysis — keeping in mind the vulnerabilities that may come up as a chip ages — down the line.

The company is privately funded and is targeting North American customers initially.

—Ed Sperling contributed to this report.

Related
Why It’s So Difficult — And Costly — To Secure Chips
Threats are growing and widening, but what is considered sufficient can vary greatly by application or by user. Even then, it may not be enough.
Semiconductor Security Knowledge Center
Startup Knowledge Center
Monthly startup funding reports and new startup corners.