Automatic Implementation of Secure Silicon (AISS)
The Defense Advanced Research Projects Agency (DARPA) recently published an article that details the goals of its Automatic Implementation of Secure Silicon (AISS) program. As the name implies, AISS aims to automate the process of incorporating scalable defense mechanisms into chip designs, while enabling designers to explore economics versus security trade-offs and maximize design productivity.
“The security, design and economic objectives of a chip can vary based on its intended application. As an example, a chip design with extreme security requirements may have to accept certain tradeoffs,” explains Serge Leef, a program manager in DARPA’s Microsystems Technology Office (MTO). “Achieving the required security level may cause the chip to become larger, consume more power, or deliver slower performance. Depending on the application, some or all of these tradeoffs may be acceptable, but with today’s manual processes it’s hard to determine where tradeoffs can be made.”
According to DARPA, AISS aspires to develop a design tool and IP ecosystem – which includes tool vendors, chip developers, IP licensers and the open source community – that will enable security to be inexpensively incorporated into chip designs with minimal effort and expertise. More specifically, AISS addresses four specific attack surfaces: side channel attacks, reverse engineering attacks, supply chain attacks and malicious hardware attacks.
In addition to on-chip defenses, AISS seeks to ensure that silicon IP blocks remain secure throughout the design process. As such, the program aims to advance provenance and integrity validation techniques for preexisting design components by improving current methods or inventing novel technical approaches. Such techniques could include IP watermarking and threat detection to help validate the chip’s integrity and IP provenance throughout its lifetime.
Secure silicon in a post-Meltdown & Spectre world
From our perspective, DARPA’s AISS program is critical in a world haunted by the fallout of Meltdown and Spectre, which were independently disclosed in January 2018 by multiple security researchers, including senior Rambus technology advisor Paul Kocher and senior Rambus security engineer Mike Hamburg. Essentially, the two security flaws exploited critical vulnerabilities across a wide range of modern processors, including Intel, ARM and AMD. Although Meltdown and Spectre were certainly not the first high-profile semiconductor security flaws to gain widespread attention, they did represent a new class of vulnerabilities related to out-of-order and speculative execution.
As Kocher notes in a recent Rambus Press article, the industry is clearly in need of better ways to protect security-critical computations, ideally without the slowing of less sensitive performance-critical tasks.
“Processor design teams are radically rethinking the relationship between hardware and software,” he writes. “The one-size-fits-all philosophy that has historically limited thinking for computing architectures has been replaced with excitement about tailored designs. Looking toward 2019 and beyond, we’re going to see processors that are tailored for specific requirements, including security.”
According to Kocher, chipmakers and innovators are collectively leveraging open-source to develop better solutions and reduce time-to-market.
“The open source RISC-V architecture is particularly notable for its availability of unencumbered reference implementations and compiler/software support,” he explains. “As a result, RISC-V greatly reduces the amount of ancillary work required for a processor security project, allowing design teams to move more quickly and focus on areas of innovation – including security.”
Some of the largest initial gains, says Kocher, will be realized by adding separate security processors onto chips.
“For example, instead of building a chip with 16 identical performance-optimized cores, a chip designer can integrate 15 fast cores and one security-optimized core,” he elaborates. “The software stack for the secure core(s) can also be independent from the main processor, helping reduce software-related risks as well.”
Multiple roots of trust
Siloed from the primary processor, a security core can enable anti-tamper features that detect fault injection (glitch) attacks which push operating circuits outside their normal operating conditions. Likewise, secure cores can integrate more aggressive protections against cache attacks, differential power analysis (DPA) and other side channel attacks.
Moreover, a security core can safely host multiple roots of trust, with hardware ensuring isolation of resources, keys and security assets. In real-world terms, this means each entity – such as a chip vendor, OEM or service provider – has access to its own ‘virtual’ security core and performs secure functions without having to ‘trust’ other entities. This allows individual entities to possess unique root and derived keys, as well as access only to specified features and resources such as OTP, debug and control bits. Moreover, support for multiple roots of trust enables the security core to assign or delegate permissions to other entities at any point in the device lifecycle, while isolating (in hardware) unique signed apps that are siloed away from other programs. These multiple roots of trust effectively create a hierarchical and secure execution environment in which mutually distrusting entities are safe to execute on the same CPU.
Interested in learning more about securing silicon with Rambus? You can check out our CryptoManager Security Platform product page here and our CryptoManager Root of Trust white paper here.
Leave a Reply