Earlier this month, Paul Kocher, a Rambus security technology advisor, spoke with Ed Sperling of Semiconductor Engineering about the importance of hardware-based security solutions.
According to Kocher, the industry is finally realizing that hardware-based security solutions are not cost-prohibitive for transistors.
“If you look at what it costs for a small microprocessor on a die, then you’re in the order of magnitude of a penny, depending on what logic you add around it. Often it costs you nothing if you don’t change the number of chips that you get on the reticle itself,” he explained.
“If you have some corner and it’s going to be otherwise unused, and you stick some logic there—especially if it doesn’t have tight timing constraints—you can often just squeeze it in somewhere on a chip and it ultimately won’t cost anything. So, we are seeing a lot of that sort of thing happening.”
Kocher also acknowledged some of the challenges the industry faces as it begins to place more of an emphasis on hardware-based security solutions.
“There’s a problem with people who have been trained to optimize for performance and efficiency. To go and add something that adds neither performance or efficiency is hard to do mentally,” he elaborated.
Nevertheless, says Kocher, most popular devices are vulnerable and just a few bugs away from being compromised.
“The adversary process is to find the vulnerability, develop and exploit, and you can take over everything running on the device. We need to get much more durable and reliable mechanisms so, for example, the video game you’re playing doesn’t have the ability to steal your banking credentials,” he added.
“It may well involve using separate hardware. If you think about the design constraints for the graphics processor, it’s performance-driven, but not so much security-driven. Figuring out how to get high-assurance pieces of chips to exist alongside, for example, high-performance silicon is something where chip companies are ultimately going to have to do a lot better job if people making products using their silicon are going to be successful on security front.”
While security may be improving, cautions Kocher, attacks are steadily becoming more powerful. This is due to several factors, including an exponential increase in the complexity of devices.
“If I make something 10X more complex, I’m going to get at least 10X as many bugs if my software and design quality stay the same. Quality has improved if you measure it on a per-line-of-code basis, but the improvement hasn’t kept up with the increasing complexity,” he stated. “If Moore’s Law slows down greatly, that actually may start letting security catch up. But over the last decade, Moore’s Law has moved faster than our ability to debug and improve the quality. So, we have one exponential place where we are losing ground relative to complexity.”
Concurrently, says Kocher, there has been a rapid increase in the number of devices since the days when a corporate network was solely comprised of PCs. Because modern networks are a heterogeneous mix of different devices, they’re far more difficult to protect, both at the end user layer as well as the manufacturer side. Moreover, the value of data has increased as well.
“Trends that are good for creating functionality are just swamping our ability to defend systems and keep them secure. I don’t think that’s going to dramatically change over the next five years. I don’t see any silver bullet coming along that will improve security in such a dramatic and rapid way even to make things equivalent to where they are now. I make the prediction every year that the following 12 months will have more spectacular and worse security breaches than the previous 12 months. That’s been a fairly safe bet over the past decade plus,” Kocher concluded.
Interested in learning more? You can read the full text of “Security: Losses Outpace Gains” on Semiconductor Engineering here.
