Presentation
Risk Analysis for Chiplets, and Security Architecture
DescriptionDesigning with chiplets is attractive to enable easier configurability, while reducing costs. This paradigm is safe when a complex system is disaggregated into multiple chiplets.
Now, even more savings will be achieved when the chiplets will be sourced from different vendors. Integration of chiplets of various provenances, hence of uneven quality, poses the question of the overall liability of the assembly. Actually, the downside of subcontracting is that the quality is that of poorest chiplet.
But even worse, the system in package (SiP) can happen to be non-functional if only one of the chiplets fail. Other risks exist, such as the opportunity for a competitor to (illegitimately) copy one chiplet alongside with its firmware.
In order to determine how to mitigate these issues, a risk analysis is a necessary prerequisite. In this presentation, we give our findings, based on ISO 31000 and Common Criteria methodologies. Interestingly, most serious risks concern the supply chain:
- Abuse of disaggregation to inject rogue FW / keys for backdoor access, by interjecting into the chain of custody;
- Counterfeiting by over-provisioning.
In response to those threats, we have been drafting a set of security assurance requirements (SAR) and security functional requirements (SFR), gathered in a Protection Profile (PP). We will uncover this PP, that is designed to complement other market/domain-specific security requirements. The official publication of this PP is scheduled end of Q2 2026.
Eventually, we touch architectural implications. At hardware level, we analyze the need and the role of a "Root of Trust" (RoT), liable to implement security by default. The RoT is also the hardware support for the enforcement of the ownership handover mechanism. Additionally, we explain the need for inter-chiplet communication protection, to ensure end-to-end data protection, against both spoofing and alteration. At software level, it is possible to make up if some chiplets are not capable of managing security, or are not provisioned. Also, software brings security services, namely hardware bill of material (BoM) verification through aggregated secure boot, and software BoM verification through distributed remote attestation.
Now, even more savings will be achieved when the chiplets will be sourced from different vendors. Integration of chiplets of various provenances, hence of uneven quality, poses the question of the overall liability of the assembly. Actually, the downside of subcontracting is that the quality is that of poorest chiplet.
But even worse, the system in package (SiP) can happen to be non-functional if only one of the chiplets fail. Other risks exist, such as the opportunity for a competitor to (illegitimately) copy one chiplet alongside with its firmware.
In order to determine how to mitigate these issues, a risk analysis is a necessary prerequisite. In this presentation, we give our findings, based on ISO 31000 and Common Criteria methodologies. Interestingly, most serious risks concern the supply chain:
- Abuse of disaggregation to inject rogue FW / keys for backdoor access, by interjecting into the chain of custody;
- Counterfeiting by over-provisioning.
In response to those threats, we have been drafting a set of security assurance requirements (SAR) and security functional requirements (SFR), gathered in a Protection Profile (PP). We will uncover this PP, that is designed to complement other market/domain-specific security requirements. The official publication of this PP is scheduled end of Q2 2026.
Eventually, we touch architectural implications. At hardware level, we analyze the need and the role of a "Root of Trust" (RoT), liable to implement security by default. The RoT is also the hardware support for the enforcement of the ownership handover mechanism. Additionally, we explain the need for inter-chiplet communication protection, to ensure end-to-end data protection, against both spoofing and alteration. At software level, it is possible to make up if some chiplets are not capable of managing security, or are not provisioned. Also, software brings security services, namely hardware bill of material (BoM) verification through aggregated secure boot, and software BoM verification through distributed remote attestation.
Event Type
Engineering Poster
TimeMonday, July 275:00pm - 6:00pm PDT
LocationDAC Pavilion, Exhibit Floor