Here’s a fact: the counterfeit market for semiconductors is real, sizable and growing.

Here’s a much more sobering fact: earlier this decade, the Senate Armed Services Committee found over 1,800 cases where counterfeit electronic components were introduced into U.S. military hardware, including airplanes, helicopters and missiles. Let’s be clear about what that means; in each of those cases, a semiconductor of unknown origin, of dubious quality, and operating in a manner which cannot be assessed found its way into equipment used by our servicemen and women. This is not only an immediate risk to the health and safety of our troops, but also a potential significant security threat.

To be clear: Not all counterfeit semiconductors are the product of nefarious parties. Some are simply “recovered” from scrap stock, while others are removed from older circuit boards and reworked to look new. However, there is no real way to know this. While some may be the product of a party simply trying to reuse discarded stock, many of the counterfeit semiconductors are in fact manufactured to look and function like the real thing…but why? Further clarity: Like counterfeit consumer goods, it’s often impossible to visually determine if a semiconductor is authentic or not.

It’s not all doom and gloom though. There are ways to help address this issue. Rambus has recently released a white paper on this topic, where we explore the topic of how to combat counterfeit semiconductors in the military supply chain. Specifically, we address:

• The magnitude of the problem of counterfeit chips in the military supply chain?
• How and why are chips counterfeited?
• Why is the defense market in particular so susceptible to counterfeiting?
• The consequences of an unsecured supply chain
• How our CryptoManager Infrastructure and CryptoManager Root of Trust can help address this growing threat

The white paper is free to download. Click here for access.

Nicole Wetsman of The Verge recently penned an in-depth article about the many security issues plaguing the global health care sector. Protecting medical devices is not an easy job. As Wetsman observes, most hospitals and physicians are unprepared to counter critical cybersecurity threats, even though they pose a clear and present danger to public health.

Connected Medical Devices: Cyberattacks and Vulnerabilities

“The health care industry increasingly relies on technology that’s connected to the internet: from patient records and lab results to radiology equipment and hospital elevators,” she writes. “That’s good for patient care, because it facilitates data integration, patient engagement and clinical support. On the other hand, those technologies are often vulnerable to cyberattacks, which can siphon off patient data, hijack drug infusion devices to mine cryptocurrency, or shut down an entire hospital until a ransom is paid.”

These vulnerabilities, says Wetsman, have prompted the FDA to issue specific guidelines that detail how medical device manufacturers should manage security risks – both before and after products are put on the market. The FDA also illustrated the importance it places on keeping medical devices secure when the government agency hosted a workshop on the subject in January 2019.

“At the workshop, a group of device makers (including big names like Abbott and Medtronic) committed to working closely with [white hat] hackers and security researchers on vulnerabilities,” she adds.

Altering Programming on an Implanted Defibrillator

Just a few months after the above-mentioned FDA workshop, the United States Department of Homeland Security (DHS) issued an alert confirming that approximately 750,000 heart devices manufactured by Medtronic had a serious cybersecurity vulnerability. According to the DHS, this vulnerability could have potentially allowed an attacker with insider knowledge to harm a patient by altering programming on an implanted defibrillator. Moreover, the vulnerability affected bedside monitors that read data from the devices in patients’ homes and in-office programming computers used by doctors.

As Joe Carlson of the Star Tribune reports, the first, more serious vulnerability could have allowed an attacker to intercept and modify data sent between a defibrillator and an external device such as an at-home monitor.

“The system [didn’t] use formal authentication or authorization protections, which means an attacker with short-range access to the device could [have] inject[ed] or modif[ied] data and change[d] device settings,” he explains. “The second vulnerability allow[ed] an attacker to read sensitive data streaming out of the device, which could include the patient’s name and past health data stored on their device. The system [did] not use data encryption.”

Protecting Medical Devices: Rebuilding Trust with Secure by Design

From our perspective, patients need to be able to trust their healthcare providers. Similarly, healthcare providers should be able to trust the medical devices they use. Indeed, according to Scott Best, Rambus’ Technical Director of Anti-Counterfeiting Technology, the most effective way to ensure trust all around is for health device manufacturers to adopt a “secure by design” approach to product development.

“Secure by design means making security the number one priority during the design phase and keeping it there throughout the whole lifecycle of the device,” Best explains in a recent ITProPortal article. “Without security, none of the other safeguards that are designed to prevent harm can be assured.”

More specifically, says Best, manufacturers should integrate a hardware-based root of trust in their medical devices.

“In general, there are good reasons why hardware-based security is considered more secure than a purely software-based approach,” he elaborates. “Delivered at chip level through a secure core, the hardware root of trust separates general processing from secure processing – allowing a separate processor element dedicated to security tasks.”

A hardware root of trust, says Best, uniquely and immutably identifies a device and can be used as a cryptographic seed.

“This permits a manufacturer to manage the access rights for the devices it produces and assign those access rights to legitimate parties,” he explains. “Using cryptographic functions, this then enables a secure line of communication to be had between the device and those who need access to it, removing the ability for remote access by a non-approved individual. By eliminating the risk of unauthorized communication and access, along with enabling devices to only accept digitally signed updates that are specific to the device, trust can be assured both in the functions of the device and the data it reports.”

As Best concludes, if the industry really wants to see the connected age deliver on its healthcare promise, device manufacturers need to ensure that security is front and center of the conversation.

“If we don’t do this, then the trust needed for the healthcare sector to benefit from connectivity, big data and automation will be lacking and patients won’t see the benefits they should,” he adds.

Read more: Hardware Root of Trust: Everything you need to know »

Automatic Implementation of Secure Silicon (AISS)

The Defense Advanced Research Projects Agency (DARPA) recently published an article that details the goals of its Automatic Implementation of Secure Silicon (AISS) program. As the name implies, AISS aims to automate the process of incorporating scalable defense mechanisms into chip designs, while enabling designers to explore economics versus security trade-offs and maximize design productivity.

“The security, design and economic objectives of a chip can vary based on its intended application. As an example, a chip design with extreme security requirements may have to accept certain tradeoffs,” explains Serge Leef, a program manager in DARPA’s Microsystems Technology Office (MTO). “Achieving the required security level may cause the chip to become larger, consume more power, or deliver slower performance. Depending on the application, some or all of these tradeoffs may be acceptable, but with today’s manual processes it’s hard to determine where tradeoffs can be made.”

According to DARPA, AISS aspires to develop a design tool and IP ecosystem – which includes tool vendors, chip developers, IP licensers and the open source community – that will enable security to be inexpensively incorporated into chip designs with minimal effort and expertise. More specifically, AISS addresses four specific attack surfaces: side channel attacks, reverse engineering attacks, supply chain attacks and malicious hardware attacks.

In addition to on-chip defenses, AISS seeks to ensure that silicon IP blocks remain secure throughout the design process. As such, the program aims to advance provenance and integrity validation techniques for preexisting design components by improving current methods or inventing novel technical approaches. Such techniques could include IP watermarking and threat detection to help validate the chip’s integrity and IP provenance throughout its lifetime.

Secure silicon in a post-Meltdown & Spectre world

From our perspective, DARPA’s AISS program is critical in a world haunted by the fallout of Meltdown and Spectre, which were independently disclosed in January 2018 by multiple security researchers, including senior Rambus technology advisor Paul Kocher and senior Rambus security engineer Mike Hamburg. Essentially, the two security flaws exploited critical vulnerabilities across a wide range of modern processors, including Intel, ARM and AMD. Although Meltdown and Spectre were certainly not the first high-profile semiconductor security flaws to gain widespread attention, they did represent a new class of vulnerabilities related to out-of-order and speculative execution.

As Kocher notes in a recent Rambus Press article, the industry is clearly in need of better ways to protect security-critical computations, ideally without the slowing of less sensitive performance-critical tasks.

“Processor design teams are radically rethinking the relationship between hardware and software,” he writes. “The one-size-fits-all philosophy that has historically limited thinking for computing architectures has been replaced with excitement about tailored designs. Looking toward 2019 and beyond, we’re going to see processors that are tailored for specific requirements, including security.”
According to Kocher, chipmakers and innovators are collectively leveraging open-source to develop better solutions and reduce time-to-market.

“The open source RISC-V architecture is particularly notable for its availability of unencumbered reference implementations and compiler/software support,” he explains. “As a result, RISC-V greatly reduces the amount of ancillary work required for a processor security project, allowing design teams to move more quickly and focus on areas of innovation – including security.”

Some of the largest initial gains, says Kocher, will be realized by adding separate security processors onto chips.

“For example, instead of building a chip with 16 identical performance-optimized cores, a chip designer can integrate 15 fast cores and one security-optimized core,” he elaborates. “The software stack for the secure core(s) can also be independent from the main processor, helping reduce software-related risks as well.”

Multiple roots of trust

Siloed from the primary processor, a security core can enable anti-tamper features that detect fault injection (glitch) attacks which push operating circuits outside their normal operating conditions.  Likewise, secure cores can integrate more aggressive protections against cache attacks, differential power analysis (DPA) and other side channel attacks.

Moreover, a security core can safely host multiple roots of trust, with hardware ensuring isolation of resources, keys and security assets. In real-world terms, this means each entity – such as a chip vendor, OEM or service provider – has access to its own ‘virtual’ security core and performs secure functions without having to ‘trust’ other entities. This allows individual entities to possess unique root and derived keys, as well as access only to specified features and resources such as OTP, debug and control bits. Moreover, support for multiple roots of trust enables the security core to assign or delegate permissions to other entities at any point in the device lifecycle, while isolating (in hardware) unique signed apps that are siloed away from other programs. These multiple roots of trust effectively create a hierarchical and secure execution environment in which mutually distrusting entities are safe to execute on the same CPU.

Interested in learning more about securing silicon with Rambus? You can check out our CryptoManager Security Platform product page here and our CryptoManager Root of Trust white paper here.