The confidentiality and integrity of cryptographic key material is critical to maintaining system security. A hardware root of trust, such as the Rambus CryptoManager Root of Trust, is designed to securely generate, store, and employ cryptographic keys. Tortuga Logic has independently verified the policies surrounding access to keys stored within registers in the CryptoManager Root of Trust using its Radix™ pre-silicon security verification platform.
Search Results for: cryptomanager
Rambus CryptoManager Root of Trust Cores Certified ASIL-B/D Ready for Enhanced Security in Automotive Applications
Highlights:
- Safeguards automotive Vehicle-to-Everything (V2X) communications, Advanced Driver Assistance Systems (ADAS), Electronic Control Unit (ECU) platform management, and infotainment applications
- Provides ISO 26262 Automotive Safety Integrity Level (ASIL)-B and ASIL-D ready security solutions
- Offers comprehensive suite of security features including secure boot, secure firmware updates, authentication, device personalization, secure key and data storage, and secure provisioning
Rambus is pleased to announce our CryptoManager Root of Trust RT-640 and RT-645 cores have been certified ASIL-B and ASIL-D ready, respectively. These automotive-grade secure co-processor IP safeguards SoCs in V2X communications, ADAS, ECU platform management, infotainment and other critical vehicle systems.
“As vehicles become increasingly connected, securing communications and the numerous electronic components that are responsible for critical vehicle systems is a necessity,” said Robyn Westervelt, research director, security and trust for IDC. “ASIL certification of security features such as authentication, attestation cryptographic accelerators are imperative to meet the evolving security needs in the automotive market.”
Easily integrated into chips serving the automotive market, the CryptoManager Root of Trust RT-640 and RT-645 provide a broad suite of security features. These include secure boot, secure firmware updates, secure debug, authentication, attestation, device personalization, key and data provisioning, secure feature and configuration management, cryptographic acceleration, and secure key and data storage. In addition, the RT-640 and RT-645 cores provide design integrity and reliability.
“The increasing sophistication and complexity of automotive electronic systems brings a greater attack surface. This requires robust security solutions to safeguard these vital systems from a growing range of cyber threats,” said Neeraj Paliwal, vice president and general manager of Rambus Security. “With our ASIL-ready CryptoManager secure co-processors, automotive chip makers can be assured of functional safety and have access to a rich set of security features that can be quickly implemented to accelerate the certification of their SoCs.”
With features tailored for the automotive market, the RT-640 and RT-645 can operate as E-safety Vehicle Intrusion Protected Applications (EVITA) full or medium Hardware Security Modules (HSM). Certification for ASIL-B and ASIL-D readiness and “functional safety” was provided by SGS-TÜV Saar GmbH. Copies of the certifications are available on Rambus.com.
Availability
The CryptoManager Root of Trust RT-640 and RT-645 are available for licensing. In addition to a robust Root of Trust framework with functional safety at ASIL-B and -D levels, the RT-640 and RT-645 come with a Secure Application SDK that allows rapid Secure Application development and deployment. Rambus will support its licensees by providing extensive documentation including the ISO26262 FMEDA (Failure Modes Effects and Diagnostics Analysis) sheets and Safety manuals, reducing time to ISO26262 certification and thus time to market.
Additional Information
For additional details about the CryptoManager Root of Trust RT-640 and RT-645, and copies of the ASIL-B/D certifications, please go to https://www.rambus.com/security/root-of-trust/cryptomanager-root-of-trust/rt640/ or visit https://www.rambus.com/security/root-of-trust/cryptomanager-root-of-trust/rt645/.
CryptoManager Device Key Management Product Brief
Our CryptoManager Device Key Management is a cloud-based software platform enabling customers to build and deploy key management services for chips and devices. Learn more about our CryptoManager Device Key Management and how it enables secure services across the full device lifecycle.
Rambus Expands Family of CryptoManager Root of Trust Secure Silicon IP Cores
Highlights:
- Offers tailored configurations addressing the security needs of Internet of things (IoT), artificial intelligence (AI), machine learning (ML), cloud, government, military and automotive applications
- Employs fully programmable hardware-level security co-processor with the ability to adapt to a dynamic threat environment
- Purpose-built, complete security solution offers ease of integration into SoC designs
- Features FIPS 140-2 ready crypto module and accelerators and DPA resistant crypto cores; designed for automotive-specific configuration ISO-26262-2018 ASIL-D
SUNNYVALE, Calif. – June 26, 2019 – Rambus Inc. (NASDAQ: RMBS) today announced the expansion of the CryptoManager Root of Trust family of products, a series of fully programmable, hardware-level secure silicon IP cores to address the security needs of applications including IoT, AI, ML, cloud, government, military and automotive. CryptoManager cores employ a siloed architecture. They isolate and secure sensitive code, processes, and algorithms from the main processor cores. This mitigates the risk of critical vulnerabilities like the Meltdown and Spectre security flaws. The CryptoManager Root of Trust is purpose-built for security — it features tailored configurations that allow chip designers to optimize main processors for high performance, while relying on the root of trust to perform security processes.
“Security is a mission critical imperative for SoC designs serving virtually every application space,” said Neeraj Paliwal, vice president of products, cryptography at Rambus. “The Rambus CryptoManager Root of Trust family offers tailored secure silicon IP solutions which chip architects can incorporate to meet the specific security needs of their designs.”
Offering a full array of security services, the CryptoManager Root of Trust enables secure boot and runtime integrity checking, remote authentication and attestation, and hardware acceleration for symmetric and asymmetric cryptographic algorithms. Featuring a layered security model, Federal Information Processing Standards (FIPS) 140-2 certified crypto accelerators, and multiple roots of trust to support independent privilege levels, the CryptoManager Root of Trust serves a wide range of applications.
The CryptoManager Root of Trust creates a foundation for Rambus’ comprehensive CryptoManager suite of solutions, including the CryptoManager Infrastructure for secure provisioning. For more information on the Rambus CryptoManager Root of Trust family of cores, visit rambus.com/security/cryptomanager-platform/root-of-trust/.
CryptoManager Root of Trust Technical Details
Within the product family, seven standard configurations address the specific security requirements and certification standards of different end markets. The RT-730 automotive design offers an ISO-26262-2018 ASIL-D-ready implementation, targeting vehicle-to-vehicle and vehicle-to-infrastructure (V2X), advanced driver-assistance systems (ADAS), and infotainment uses. For cloud, AI and ML accelerator chips, the RT-630 helps secure valuable training models, and training and inference data. For government-focused chip designs, the RT-650 offers a design that targets FIPS 140-2 Cryptographic Module Validation Program (CMVP) certification with Suite B accelerators. The RT-660 extends the functionality of RT-650 with the addition of Differential Power Analysis resistant cryptographic cores.
The CryptoManager Root of Trust family of products offers an end-to-end security implementation, comprised of a fully synthesizable IP core that anchors trust in silicon. It includes state-of-the-art crypto accelerators, security firewalls, an entropy source, secure key generation and derivation, secure one-time programmable (OTP) memory management, and a complete secure embedded firmware stack. The secure firmware stack offers secure boot for the root of trust as well as the SoC CPU(s), communicating securely with the SoC stack and running signed secure applications on the root of trust’s CPU. A reference SDK allows integrators to build secure boot, secure firmware updates and secure applications, with provided examples and references. Available evaluation boards and QEMU allow chip designers to easily evaluate the CryptoManager Root of Trust and secure applications.
Digital Trends highlights Rambus CryptoManager Root of Trust
Jon Martindale of Digital Trends recently sat down with Ben Levine, Rambus’ senior director of product management, to discuss the ever-growing importance of designing secure processors in the wake of Meltdown and Spectre.
According to Levine, the semiconductor industry has traditionally maintained a reactive posture to security by waiting for critical vulnerabilities to surface before fixing them. Although there are many reasons for this approach, it is important to note that designing a secure, general-purpose processor has always been a rather challenging proposition.
As Levine point out, this is precisely why the Rambus CryptoManager Root of Trust shifts critical functionality from a complex, general-purpose CPU to a secure core that is siloed from the primary processor. Indeed, the Rambus CryptoManager Root of Trust can be safely tasked with securing encryption keys, validating banking transactions, processing login attempts, storing private information in secure memory and validating that boot records haven’t been corrupted or compromised during startup.
“The idea is not to come up with one CPU that can do everything to be very fast and be very secure, but rather, let’s optimize different cores separately for different objectives,” Levine explains. “[We’re saying] let’s optimize our primary CPU for performance or lower power – whatever is important for that system – and optimize another core for security. [For example, implementing] cryptographic algorithms, encrypting or decrypting from an algorithm like AES, or using a public key algorithm like RSA or elliptic curve is relatively slow to do in software. [However], a security core [with] hardware accelerators can do it much faster.”
Depending on the application, says Levine, the use of a secure core will likely happen at the OS and system level, rather than the application level.
“If you’re building your OS and overall system software correctly, then you can utilize most of that security functionality without application developers having to worry about it,” he states. “You can provide APIs to expose some of the security core functionality that could easily be consumed by the application developer like encrypting and decrypting data.”
In addition, Levine notes that the Rambus CryptoManager Root of Trust secure core is (physically) tiny in comparison to the primary processor.
“There’s really no significant impact on the cost of the chip, power, or thermal requirements. You can do a lot in a small logic area if you design it carefully. We’re shooting for simplicity and if you keep something simple you keep it small. If it’s small it’s low power,” he elaborates. “These cores should be and need to be much smaller than one of the main big CPU cores that you get in a chip from Intel or AMD. It won’t be seven plus one, it will be eight or whatever core processor and one or perhaps more than one, small security core that provides security functions for all of the other cores.”
Levine also emphasizes that there will always be additional exploits and vulnerabilities beyond Meltdown and Spectre.
“These exploits are not the only vulnerabilities out there. There will always be more. The complexity of modern processors makes that inevitable. Let’s change the problem and let’s accept that there will be more vulnerabilities in general purpose CPUs and the things that we care a lot about, like keys, credentials, data, let’s move it out of the CPU and let’s bypass the whole problem,” he concludes.
Interested in learning more about the Rambus CryptoManager Root of Trust?
Check out our Root of Trust security solution
Micron Taps CryptoManager Platform for Secure Provisioning To Authenta Technology
The latest news coming out of the security world is the link up of Micron’s Authenta™ secure memory product and Rambus’s CryptoManager™ infrastructure to add greater protection for industrial IoT devices, as well as medical, automotive, smart cities, and connected homes applications.
This combo of security muscle provides the carte blanche for Micron to securely provision cryptographic data at any point in the extended semiconductor manufacturing supply chain and throughout its lifecycle.
In effect, the benefits to the end customer include reducing time to market and development expenses, while simultaneously providing a stronger security model for end devices.
The way this works is simple, integrated and secure. Micron’s Authenta technology places secure element features right on to flash memory. It protects an IoT device’s integrity by monitoring and safeguarding software that runs on the device.
The Micron Authenta partner, Rambus CryptoManager Infrastructure, plays its role by securely provisioning sensitive cryptographic data to devices during the manufacturing process. In so doing, it enables simple, secure end-to-end authenticated solutions for easy device management and connectivity.
At any semiconductor manufacturing site, the CryptoManager Infrastructure provides secure manufacturing control that begins with the Root Authority. Kept in a secure facility, the Root Authority is an air gapped, offline provisioning server that authorizes all provisioning activity, manages high value keys, and enables all CryptoManager transactions.
The Root Authority encrypts and signs all keys, manufacturing information and provisioning instructions. An authorized administrator then imports them into the Control Center for distribution to authorized provisioning appliances in a manufacturer’s cloud connected factory network. The Control Center distributes keys and production authorizations to the appliances which in turn provide encrypted instructions, keys and device.
All told, the CryptoManager Infrastructure system’s assignments are to securely manage provisioning and device personalization, as well as high value key management throughout a semiconductor’s life cycle. Emphasis is placed on high availability, performance, and security in all of CryptoManager Infrastructure’s components.
Hardware Security Modules or HSMs in each node of the CryptoManager Infrastructure strengthen security throughout the system. HSMs are FIPS 140-2 level 3 compliant and provide tamper resistant secure storage. Plus, they serve as a secure computation environment for the necessary cryptographic computation and sensitive operations in the CryptoManager Infrastructure.
