Security In 2.5D

The long-anticipated move to 2.5D and fan-outs is raising some familiar questions about security. Will multiple chips combined in an advanced package be as secure as SoCs where everything is integrated on the same die? The answer isn’t a simple yes or no.

Put in perspective, all chips are vulnerable to side channel attacks, hacking of memory—a risk that increases with shared memory—and monitoring of I/O over many different protocols and communications possibilities involving the . And virtually all SoCs have multiple third-party IP blocks ranging from memory, memory controllers, I/O blocks, as well as processors, accelerators and power management modules.

What changes with fan-outs is that more of the components that typically would be on a PCB are included inside the package. For a 2.5D chip, it would include multiple chips connected through high-speed interconnects such as interposers or bridges. How those pieces are connected, and how secure the chips themselves are, will determine whether a 2.5D configuration is more or less vulnerable to attack.

“Any type of stacking architecture (2.5D, 3D IC) is interesting, considering that some of the interconnects that used to be accessible to the outside world become hidden or more inaccessible,” said Steven Woo, vice president of solutions marketing at Rambus. “When that happens, it becomes harder to attach to and monitor individual signals.”

Woo said the downside is it makes it harder, if not impossible, to rework chips in manufacturing, which in turn can affect yield. But in other ways, the impact is minimal. “Regarding cache coherency, there’s probably little inherent effect one way or the other. However, there can now be much more capacity available in the 2.5D and 3D stacks, such that caches have to be managed more effectively to account for the higher capacities.”

Even those who don’t believe there a big change in security have some caveats.

“I don’t think there would be much of a security impact,” said Serge Leef, vice president of new ventures and general manager of the System-Level Engineering Division at Mentor Graphics. “The only situation that may increase risk is if the security module communicates to other blocks via the interposer, which is presumably more accessible to the outside world since the metal lines are closer to the surface. In such a case, an attacker can potentially access security-related data flowing between parts of the design and compromise it in some way.”

Mileage may vary
Security also depends on how many companies are involved in producing the components of a 2.5D or fan-out. At the moment, most of the chips being developed are using proprietary interposers or interconnects, and most of the integration is being done with well-tested IP and other components.

Marvell‘s MoChi 2.5D architecture, for example, is based on its own interconnect technology with all other components internally qualified and developed into modules that can be connected like LEGOs. In addition, the company has leveraged the high throughput and shorter distances—one of the big selling points of 2.5D, which also equates into lower power and better performance—to build in security without slowing down the overall device’s performance or impacting the power budget.

“Security is best implemented in hardware,” said Michael Zimmerman, vice president and general manager of Marvell’s connectivity, storage and infrastructure business. “But it also requires high bandwidth for faster encryption/decryption. And you need a secure boot-load, which can be kept separate from the other components so it can’t be tampered with. This architecture allows us to build security as a separate entity. You can interconnect to it or not, depending upon your security needs. And with an acceleration platform, you can develop bigger keys.”

With a public key infrastructure, the secure function can be done on a completely separate chip within the module. That could include a one-time programmable image, which is unique to each device, according to Mordi Blaunstein, senior director of product marketing at Marvell. “And because it’s modular, it can be separated, contained, interconnected at will, and manufactured using different processes.”

The same is happening on the fan-out side. Tom Quan, a director at TSMC, said the company’s InFo (integrated fan-out) packaging approach has a big impact on security. “If you can do away with the PCB, you do a lot better. This will be in high volume in 2016. Designs are already in production.”

Making comparisons
One of the reasons it’s so hard to make draw definitive comparisons to existing chips is that, for the most part, the majority of existing SoCs are not very secure. In many designs, security is an afterthought rather than part of the initial architecture. A similar problem occurred with low power, which was largely ignored by systems architects until the boom in full-function smartphones and other mobile electronics and the widespread negative reaction by consumers to short battery life.

Adding security increases costs and requires an adjustment in design flows, because everything from design through layout through verification needs to be security-aware. As the IoE begins picking up steam, and as more designs are created for specifically for the IoE, that will change. Security is a requirement for a successful IoE product, and the more breaches that occur with IoE devices—and the more systems companies are forced to deal with those breaches—the more engineering teams will focus on security.

While 2.5D and fan-outs are not a new concept, the current adoption is new enough that companies developing them are very mindful of the security implications of the architectures. That in itself provides an advantage over complex SoCs, where they have evolved from standalone devices with limited connectivity.

“From an external perspective, it’s not about some chip or package or board,” said Linley Gwennap, founder and principal analyst at the Linley Group. “If there is a physical attack, it’s more difficult to get access to a fan-out because of the package than a PCB and maybe an SoC. The software is likely going to be the same.”

But there’s more to the security picture than just the physical package, he noted. The reduction in power needed to drive signals also makes it more difficult to detect them in the case of a physical attack.

However, while it may be difficult, it’s not impossible. Scanning electron microscopes, grinders, probes, monitoring of signals in and out of memory, are the new weapons of serious hackers. The price of a scanning electron microscope used to be millions of dollars. They are now available on eBay for a fraction of the cost. And while it’s still cheaper to hire coders to crack software and algorithms, being able to infiltrate embedded code on a device is much harder to stop.

IP vendors have been the first to fully embrace the need for security. ARM, Imagination Technologies, Synopsys (ARC processor and memory IP), Cadence (Tensilica DSPs and memory IP), Rambus, and Andes Technology all have been actively working on security. And all of that IP is being used for 2.5D packages and fan-outs.

“Security is a big issue, particularly secure addresses and memory,” said Frankwell Lin, Andes president. “New applications should pay more attention to that.”

He noted that the concerns are the same, whether it’s 2.5D and planar SoCs. But with 2.5D, there is less experience, so it’s not yet clear where the issues might crop up.

On the other side, with existing 2.5D and fan-out designs now under the tight control of one foundry or chipmaker—TSMC, GlobalFoundries, Samsung, UMC, HiSilicon, Marvell, AMD, IBM, as well as services providers such as eSilicon and Open-Silicon, and s such as ASE—security is a well-managed design risk factor. But as this packaging approach begins gaining popularity, and more companies begin adopting it and putting together pieces that are not necessarily designed with security in mind, the need for standards and security-aware methodologies will increase.

Conclusion
While it’s too early to tell exactly what the security impact will be of new packaging approaches, 2.5D and fan-outs initially have a couple things working in their favor. First, the supply chain for parts that go into those chips will be tightly managed, at least initially, as companies developing these chips proceed cautiously to avoid any costly missteps. And second, individual chips with specific functions are much less complex than fully integrated SoCs, which means security risks should—at least in theory—be easier to identify.

How that plays out in a mass-adoption world remains to be seen. Given the rise in security breaches, and the concern for improved security, the whole semiconductor world may be adopting security much more quickly than anyone would have considered possible five years ago. But knowledge is growing on both sides of the fence, good and bad, and hardware, firmware and embedded software increasingly will be part of the attack surface, no matter how good a design looks on the drawing board.