New And Innovative Supply Chain Threats Emerging

The electronics supply chain is seeing evidence of increased sophistication in the counterfeiting of complex ICs and simple passives, both of which can impact the functioning and safety of the systems that use them.

New technologies are being developed to build trust by helping to identify counterfeit devices before assembly and during failure analysis. It’s too early to tell how effective those measures will be, but individual component identification is becoming an important tool in that effort.

“Trust requires looking at the whole value chain, from design through manufacturing, and carefully monitoring every step,” said Tom Katsioulas, head of trust-chain business at Mentor, a Siemens Business. “Security is about the digital assets. Trust is about the physical assets. And identity connects the two.”

Questions about authenticity can occur at a supplier, with contractors to a supplier, or during the movement of components between contractors and to the customer. The types of anti-counterfeiting options to be used depend both on the value of the component and the consequences of fake components. But they all focus on the ability to uniquely identify a component so it can be tracked through final system assembly.

Counterfeiting can occur anywhere there’s a reliable revenue stream. “There’s $70 billion a year in printer consumables sold into the world,” said Scott Best, technical director of anti-counterfeiting products at Rambus. “This is a remarkable opportunity for counterfeiters. It is a $10 million effort to take apart somebody else’s security chip, completely reverse engineer it (the reverse engineering is completely legal), and print a functional clone. That’s 50 people for a couple of years. But if you can do it, there’s a guaranteed $100 million annual product stream from that chip.”

In addition to lost revenues and profits, safety is driving much of the concern today. “What I’ve seen now are other, more important markets, looking for anti-counterfeiting solutions because of safety issues,” added Best.

This changes the stakes of counterfeiting. “If this is a Gucci bag, you [as a customer] might have lost if you paid for a real one and got a fake one,” said Ophir Gaathon, CEO of Dust Identity. “Clearly, an airbag has a completely different implication.”

Fig. 1: An illustration of the many aspects of the supply chain for an electronic device. Source: Keyfactor

Anti-counterfeiting measures have similarities with traceability, especially when it comes to developing unique component IDs. While such IDs solve two different problems, they go much further with anti-counterfeiting. Critically, wherever economically feasible, counterfeiting protections can be used in a forward-looking manner — as a system is being assembled. They also help in retrospect if a failure ends up being caused by a counterfeit component.

“One of the big problems is being able to identify a part, and there have been different tag technologies that have surfaced over the years to address that,” said John Hallman, product manager for trust and security at OneSpin Solutions. “If you go back 10 years ago, there were attempts to attach DNA tags. They’ve made some progress. Now there are all sorts of electronic IDs, where you have an identifier that is random in silicon, and authorization technologies. We’re looking at verification data as a unique identifier, where you take verification data and attach that to the IP using blockchain technology.”

In effect, that data becomes unique down to the individual bit. “That data can then stay with the device, and if someone modifies it, you can see that,” Hallman said. “This approach turns the problem of trying to look at a piece of IP or chip and assess it into one of how to build this into a device so it can travel along with that IP. The data stays encrypted and is connected in an external database.”

Zero trust
Trust traditionally has been established at the organization level by vetting. But just having an approved vendor is no longer good enough. “The problem with ‘trust, but verify’ is that you’re assuming trust at the outset,” said Steve Carlson, director, aerospace and defense solutions at Cadence.. “And if you do some verification one time, then you say, ‘Okay, now they’re trustworthy,’ then they have free rein within the system.”

The newer approach is to assume that, at any given time, no entity can be trusted without proof, no matter how many times that proof has been given in the past. It’s called “zero trust,” and it treats every interaction as if it was the first. “It was a false notion that because the manufacturing was onshore, you could trust that supplier because it was done through ‘guns, guards and gates,’” Carlson noted.

But humans in the process can reduce the level of trust. “When we’re talking about zero trust and zero touch, where we don’t want to include advanced human intervention in the various stages, automation is key,” said Ellen Boehm, senior director of IoT product management at Keyfactor.

Trusting devices
The notion of “trust” is an overarching concept that covers many specific elements. One of them has to do with whether or not one trusts the components going into a system as being authentic or counterfeit. Assigning each such component a unique identifier – “serialization” — is one step toward being able to authenticate components.

But serialization can be a challenge. “The biggest problems with serialization are the commitment to specific serial numbers, having all participants in the ecosystem commit to the same serial numbers, and having a system that will be able to recall the serial numbers,” said Gaathon. This creates a need for more sophisticated approaches.

An electronic system — whether a satellite, automobile, or high-availability computer — can have an extremely sophisticated supply chain. Chips and passives are assembled onto boards, boards are assembled into modules, and modules come together into a finished system.

“There’s a difference between identity and identifiers,” noted Katsioulas. “I may have identifiers for multiple purposes. For a single device, between design, manufacturing, and assembly, before I ship the chips out to the wilderness, I can have three or four or five identifiers. I create a unified identity that consists of those identifiers.”

It’s also important to consider that, while there is always a risk of a rogue operator within an organization, much of the vulnerability comes when components or sub-assemblies are transferred between different participants in the supply chain — or even between different plants belonging to a single supplier.

Identifying ICs
The focus of most ID efforts has been on silicon chips, for a couple of reasons. The most obvious is the fact that these tend to be the high-value components that supply much of the differentiation in a system. The second reason is the fact that they’re amenable to having an electronic ID that can be interrogated and read, either while the chip is isolated or while it’s in a system.

There are several approaches to creating a unique chip ID. They overlap, so conceptually they could be used in a complementary fashion.  The chip ID that has received the most attention is an electronically addressable ID. Used for traceability, it could be created during manufacturing using a number of different techniques. But counterfeiting places more constraints on the ways such an ID can be established. “[With] an injected ID, you create some secret number on a server,” said Dave Huntley, business development at PDF Solutions and co-chair of three SEMI committees/task forces. “Then you have the problem of who’s controlling the server.”

The gold standard is an ID that originates in the chip itself, which is an internal hardware root of trust (HRoT). “The alternative is based on physical properties of the actual device,” said Huntley. “And when it powers up, it creates its own unique identity at that moment.”

There are different ways of implementing this, but the one that receives the most mentions is the physically unclonable function (PUF). A PUF leverages some random source of high entropy,  like the random power-up state of an SRAM array, to establish an identity. Because the ID is intrinsic to the device, it is immutable. That is an important characteristic of any component ID.

With such a device, the first time it powers up, it “enrolls” its ID. From that point forward, it can identify or “authenticate” itself during manufacturing and even after deployment. Systems can verify all of their chips on each power-up to ensure that nothing has been tampered with

HRoTs serve several purposes, including acting as a seed for public and private keys. For the purposes of those applications, it’s essential — and fundamental — that the actual value returned by the HRoT be confidential in order to protect those keys. It should never leave the device. But a component ID, by definition, must be able to leave the device. So the component ID can also be derived from the HRoT, just like the keys. The HRoT value remains hidden, while the derived ID can be made visible.

For chips that don’t implement a HRoT, it’s still possible to inject an ID. This must be done within a trusted environment to ensure that the equipment loading the ID into the chip and storage of the ID cannot be hacked or gamed.

There are other complementary approaches to proving the integrity of an IC. One technique assures that a given IC has been built using approved masks rather than an altered mask set. “Cadence has technology that essentially imprints some ‘DNA’ into the mask set to be able to detect whether or not the masks were altered,” said Carlson.

This approach is useful only during processing, however, because successive layers of masks will cover the underlying “DNA” traces. Once the device is complete, this approach is no longer useful for validating the chip. “The pattern is put into the mask during the steps that include multi-patterning for mask generation. The choice of layers and locations is a part of the decision process based on mid-manufacturing access to sample wafers,” noted Carlson.

There are also visual cues that can be used to identify an ID. “Multibeam [e-beam] is making it possible to write identifiers on a device in silicon — not electrically, but visually — so you have to get an electron microscope to look at it,” said Huntley. This has the benefit of being created outside the electronic testing flow, and so it can’t be gamed in the same manner as an electronic ID. But electronic and visual IDs are still likely to be used together. “Once that chip is on the circuit board and it’s in a product, you can no longer see it,” said Michael Ford, senior director of emerging industry strategy at Aegis Software and chair of three committees for the IPC standards body. “So visual IDs do not work.”

Passive components
Passives, such as resistors and capacitors, are often considered to be low-value components that don’t merit the attention lavished on ICs. But there are significant efforts to counterfeit them, as well. “I went to this MTA counterfeit summit, and I was blown away by people talking about fake resistors and counterfeit capacitors and the impact it has in the supply chain,” said Katsioulas.

He’s not alone. “The greatest increase in counterfeiting has been in ceramic condensers,” said Ford. “It’s because there was a shortage in the market. [The counterfeits] looked like capacitors and they behaved like capacitors. The only difference was the dielectric was of a lower quality than normal.”

This can have real-world impacts. “There was a specific case where an Air-Force jet went up, and the ‘Friend or Foe’ circuit failed,” continued Ford. “They thought one of the big PGAs had been counterfeited. But it was the ceramic condenser, because the signal goes through the passive component to get to the PGA.”

Many such passives arrive mounted on reels. As a result, they’re naturally serialized, and it’s theoretically possible to do individual incoming inspection. “If you have a box full of reels, you might choose to have something that, you know, verifies the box first, opens the box, opens the reels, put the reels on a [spool], and reads all the package IDs in the background before it gets put into production,” said Huntley.

But today, identifying individual passives is likely too cumbersome. Instead, the reel gets a batch ID, and any passive is noted to have come from that reel. “Verifying every single capacitor is probably not worth it,” Huntley observed.

Alric Althoff, senior hardware security engineer at Tortuga Logic, agreed. “It’s going to be hard to do this beyond batches,” he said. While a system might not be traceable back to a specific passive device, it would be traceable to the batch from which the device came.

That’s not necessarily fail-safe, because there are some sophisticated efforts afoot to get counterfeits past incoming quality checks. “There was one case we saw where there was a reel of SMT components, and the first 100 were genuine,” said Ford. “And then every seventh one was a counterfeit. So this has been a reel which has been taken by somebody, all the parts taken off, and then the parts put back on again, specifically designed to defeat any incoming inspection regime. If somebody were to find an unexpectedly high quality problem, it’s so random that they can’t find a path to the responsible party.”

Meanwhile, not all assembly is automated. “For manual assembly, it’s a little trickier, because they have bins of components that are just filled up from time to time,” said Ford. “So you have to have procedures to make sure that you never mix the different batches or lots of components within a bin.

One challenge with batches is that batch size doesn’t always match assembly demands. “Let’s say you need to make 100 products, and on those hundred products you use two of a certain component,” Ford said. “So you’re going to use 200 parts. But the parts come on a reel of 1,000. So ERP thinks you’re going to use the 200 parts, and it allocates those. The other 800 have to be there just because they’re physically connected.

“Meanwhile, on a different production line, a guy runs out of materials because there’s some issue. He doesn’t care about anything other than getting his line running, because that’s what he’s judged on.” So some of the 800 parts get used there, without proper tracking. “This is happening all the time in every manufacturing company unless they have transitioned to lean material management,” he added.

Once components are identified, either individually or in batches, they’ll be assembled onto boards and into subsystems. Those units also will need identification.

— Ed Sperling contributed to this report.

Related
Uniquely Identifying PCBs, Subassemblies, And Packaging
New approaches to preventing counterfeiting across the supply chain.
Security Tradeoffs In Chips And AI Systems
Experts at the Table: How security affects power and performance, why AI systems are so difficult to secure, and why privacy is a growing consideration.
All-In-One Vs. Point Tools For Security
Security is a complex problem, and nothing lasts forever.
Dealing With Security Holes In Chips
Challenges range from constant security updates to expected lifetimes that last beyond the companies that made them.
What Makes A Chip Tamper-Proof?
Identifying attacks and protecting against them is still difficult, but there has been progress.