4.7 Case Study of the Development …
351
4.7.1 Justification and Motivation
4.7.1.1 Critical Analysis of the IC Supply Chain
The IC supply chain, figuratively speaking, is the process by which a conceptual idea
is transformed into an IC. The transformation process begins with the IC designer,
who creates an RTL description of an IC according to the project specification generated by the customer (in our case, the US Department of Defense). This description,
usually in HDL form, is the intellectual property (IP) of the constructor. When the
project stage is complete, RTL moves to a synthesis stage, and this begins a series of
CAD stages using standard software tools made by companies like Cadence, Mentor
Graphics, and Synopsys to get a complete topological diagram (i.e., netlist). These
steps begin with a logical synthesis that converts an RTL project into a DAG representation (directed acyclic graph). Automatic logic optimization using CAD tools
uses complex heuristic rules to find graph transformations for optimization for a
specific metric. Then the displaying heuristics converts the graph to other representations—already on primitive gates. Placement and tracing give each gate a physical
location on the IC topology and establish their interconnections. After the synthesis is
completed, the production receives a synthesized design. Then production can make
masks and use its technological base. The manufactured ICs are then transferred to
the end users (in our case, they are units of the US Department of Defense).
As we have repeatedly noted, earlier each equipment manufacturing company
could use its own “vertical” process for both design and manufacturing. However, as
the critical size of transistors and time to market continue to decline simultaneously
with the growing need for low-power high-quality ICs, expenses for organizing a fullscale modern semiconductor production have become limiting (very heavy) (over
$4 billion) even for large companies. Due to these factors, the IC supply chain
has become “horizontal.” Hardware IC suppliers who specialize in the design of
functional units, memory, and bus controllers have emerged. These providers license
their technology to others using these units in their own IC projects. IC design
companies integrate third-party IP along with their own IP.
As was shown at the beginning of this chapter, the entire chain [197] is vulnerable,
but the special attention of security specialists should be directed to HDL and foundry
production. In the same way, that software describes what a program vulnerable to
malicious descriptions should do, HDL describes the operation of a circuit and is
also vulnerable to the inclusion of a malicious circuit element. An attacker who is
able to add this circuit to a project using HDL has almost unlimited potential and
flexibility. Since an attack occurs at a very early stage of the process, the recognition
and detection of malicious intent in this case become a very difficult task.
351
4.7.1 Justification and Motivation
4.7.1.1 Critical Analysis of the IC Supply Chain
The IC supply chain, figuratively speaking, is the process by which a conceptual idea
is transformed into an IC. The transformation process begins with the IC designer,
who creates an RTL description of an IC according to the project specification generated by the customer (in our case, the US Department of Defense). This description,
usually in HDL form, is the intellectual property (IP) of the constructor. When the
project stage is complete, RTL moves to a synthesis stage, and this begins a series of
CAD stages using standard software tools made by companies like Cadence, Mentor
Graphics, and Synopsys to get a complete topological diagram (i.e., netlist). These
steps begin with a logical synthesis that converts an RTL project into a DAG representation (directed acyclic graph). Automatic logic optimization using CAD tools
uses complex heuristic rules to find graph transformations for optimization for a
specific metric. Then the displaying heuristics converts the graph to other representations—already on primitive gates. Placement and tracing give each gate a physical
location on the IC topology and establish their interconnections. After the synthesis is
completed, the production receives a synthesized design. Then production can make
masks and use its technological base. The manufactured ICs are then transferred to
the end users (in our case, they are units of the US Department of Defense).
As we have repeatedly noted, earlier each equipment manufacturing company
could use its own “vertical” process for both design and manufacturing. However, as
the critical size of transistors and time to market continue to decline simultaneously
with the growing need for low-power high-quality ICs, expenses for organizing a fullscale modern semiconductor production have become limiting (very heavy) (over
$4 billion) even for large companies. Due to these factors, the IC supply chain
has become “horizontal.” Hardware IC suppliers who specialize in the design of
functional units, memory, and bus controllers have emerged. These providers license
their technology to others using these units in their own IC projects. IC design
companies integrate third-party IP along with their own IP.
As was shown at the beginning of this chapter, the entire chain [197] is vulnerable,
but the special attention of security specialists should be directed to HDL and foundry
production. In the same way, that software describes what a program vulnerable to
malicious descriptions should do, HDL describes the operation of a circuit and is
also vulnerable to the inclusion of a malicious circuit element. An attacker who is
able to add this circuit to a project using HDL has almost unlimited potential and
flexibility. Since an attack occurs at a very early stage of the process, the recognition
and detection of malicious intent in this case become a very difficult task.