The IC Supply Chain: The Day After Tomorrow

Last month, I wrote about the implications of hacking in a connected world. Judgment Day from the Terminator franchise came to mind. All that paranoia is still “out there” a bit, I admit. Let’s bring it down to a more pedestrian level in this post…

Plenty has been written about the disaggregated, distributed, worldwide semiconductor supply chain. Design groups all over the world work on the same system-on-chip (SoC) design. Semiconductor intellectual property (IP) is procured from more than a dozen suppliers, also worldwide, for a typical design. Specialty services (e.g., package design, reliability engineering, physical layout) are often involved, also from many disparate locations. And when the design is finally ready to fabricate, it’s shipped off to a wafer fab somewhere far away.

That’s an awful lot of people touching your design—a design that might run a smartphone app, or maybe control a pacemaker, or the trajectory of a nuclear missile, or the brakes in your car or the security system in your home. When you deploy one of those applications in your life (or your body), are you *really* certain that everything in the chip is configured exactly as intended? No rogue hardware or malicious functions in there, right?

Before you accuse me of being too paranoid, let me ask a simple question. Many of us use a credit card to purchase items online. Has your card ever been hijacked? Have you ever received a fraud alert from your credit card company? I suspect many of us have, often more than once. These events are typically the result of inappropriate use of appropriate access to information. If someone has an argument that says all hardware, software and firmware designers who work in the semiconductor supply chain are immune to these kinds of temptations, well, I’d like to hear that argument.

The reality is that the whole supply chain does have vulnerability. Some areas are worse than others. As more of the silicon coming out of that supply chain goes into mission-critical and financially sensitive applications, the breaches will need to be closed. And some great new companies will be born in the process.

One last thing to think about: Storefronts that shred sensitive documents for consumers have started popping up all over the place. As we all go paperless, safely getting rid of sensitive documents has become a choke point for some. These places solve the problem very nicely. You go there with your box of documents, and you watch them as they shred it. Now consider the manufacturer of your all-important SoC. You purchase perhaps 500,000 units. Those units got shipped to you on time. But are you sure that’s all the units that were manufactured? Next time, try and visit the fab and tell them you want to watch them make your parts and see what happens.