The Next Big Threat: Power And Performance

In the shiny world of consumer electronics and powerful computers, taking a grinder to the outside of a package may sound more like safecracking than sophisticated electronic code hacking. The reality is there is more in common than most semiconductor companies would like to admit, and the starting point often is just as crude.

To no small extent, systems on chip have become miniature safes. There is a hard shell around the outside, and inside there are electronic security gates, locks that close, and clocks that restrict access to the valuables—in this case, data. And like most sophisticated vaults, there are people who want to get in and others doing their best to keep them out. The problem in semiconductors is there aren’t enough people working on the defensive plan, and there are way too many points of access.

“There’s one fundamental assumption, which is that your hardware itself is secure,” said Lawrence Loh, vice president of engineering at Jasper Design Automation. “What if the hardware itself has a flaw so information can be obtained through improper channels? That compromises a lot of things, from applications to firmware. There are many people targeting many different areas in design, but they are all necessary to contain the problem.”

There also is information leaking out of a chip whenever any portion of that chip is operational. Any signal and any power differential says something about what’s going on inside a chip. And to a hacker—particularly to an emerging breed of SoC hackers who understand both hardware and software (see part one of this series ) — turning on and off power domains, or even starting up one or more processor cores or memories, sends a signal that something is happening inside a chip. And when they grind down the chip and insert probes in various regions, they can even figure out the actual sequencing and codes down to the ones and zeroes.

“You can do a cryptographic calculation of the current flow,” said Pankaj Rohatgi, director of engineering at Cryptography Research, which is now part of Rambus. “You can sample activity and see how the net emissions change over time. If it’s a zero it will do one operation and if it’s a one it will do another operation. You can see the sequence and if you can distinguish whether it’s type A or type B, or shape A or shape B, that’s an easy type of attack.”

So what exactly can be done to stop these kinds of attacks? There are two key ways of approaching this, each with many nuances.

Hide everything
One of the most tested approaches to security is probably the oldest. Restrict access and hide the parts that can compromise the entire system.

“There are a number of security features you can use to actually repel physical attacks, which can include everything from lasers to differential power analysis,” said Hayden Povey, director of marketing for security at ARM. “Secure cores have the same programming model as TI’s M-Shield (which requires authorized software source and encryption prior to booting), but there are a number of other security features on top of that. Those can go into smart cards, bank cards, secure elements that are integrated into application processes and the Internet of things. It’s a physically robust platform to hold keys. But that’s also much easier on a small device than on a complex processor.”

The challenge in an SoC is that everything is connected, from IP blocks for I/O to memory. And in a multicore SoC, cache coherency requires memories to share data, which makes it even harder to lock down. The more cores, the more difficult it becomes.

“It’s very easy to create an unintended path from the memory into the secure data,” said Jasper’s Loh. “System architecture now plays a big role. Traditionally, system architects were only thinking about performance. System architecture is an important part of security, though. How can you contain data and block any other access? It’s blocking at the right place where no other sites pass data.”

Confuse the enemy
In wiretaps during the Cold War era, one of the most commonly used approaches to combat eavesdropping was to turn on the radio. It’s possible to filter out those kinds of noise these days, but the approach is roughly similar. If you can insert random bits into data, you can alter the cryptographic calculation in a way that is much, much harder to crack, according to Rohatgi.

The concept is called active noise, and it makes the hacking more difficult—theoretically to the point where it isn’t worth the time of would-be thieves. The modern version of active noise works somewhat analogously to spread spectrum phones, where the noise is removed at the end using a cryptographic key.

“You also can change the way a cryptographic calculation is made in the first place—basically randomizing the calculation,” said Rohatgi. “It’s like working with unpredictable information. And you can change the key management layer, so you never get enough information to get the key. That requires you to change everything regularly.”

Death pulses and other threats
Perhaps the most lethal weapon on both sides—defense and offense—is  electromagnetic interference. This is more than just theory. In some cases, often by mistake, it has been responsible for circuit failures. But it’s proven that highly sensitive circuits, particularly analog circuits, will fail when blasted with electromagnetic energy.

“If you run a high current at an electromagnetic coupling you will induce current in an IC,” said Arvind Shanmugavel, director of application engineering at ANSYS-Apache. “In a highly secure environment, without even touching anything, you can make the system fail. In a car, they design for things like electromagnetic interference because you may have a huge current next to an IC. But if you’re not thinking about it, you may miss it.”

That vigilance is critical, and it’s the one thing that security experts say is the scariest aspect of security—design teams not considering all the possibilities. It also means writing the embedded software in a way that’s secure and protected.

“It usually comes back to software and how the software is written or makes use of the hardware,” said David Doughty, director of security engineering at Intel. “We’ve been continuing to improve our guidance to OEMs that security is more and more important. And to the point we can, we’re helping others embrace that. We’ve set up a safe code board to enhance security, and there are security processors and co-processors to execute code in a controlled space and sequester critical operations. Those things help.”

Still, all it takes is one weak link in the chain.

“What worries me is the progression of attacks on heavily dependent systems,” said Rohatgi. “There’s a lot of ignorance in the design community. When you look at full-scale servers or hardware security modules, it’s surprising how susceptible they are and how they can fall to single attacks.”

That sentiment is being echoed across the industry these days, particularly as the Internet of Things looms as series of interconnected security holes.

“Once you break into a device and it’s networked, you can break into all similar devices,” said Chris Rowen, a Cadence fellow. “This fundamentally has become an arms race, and we’re trying to lock the doors that someone has already broken into.”

To view part one of this series, click here.