IEEE Spectrum February, 2015 - 48

oday's chips are so complex and costly to design
and build that it's very difficult for a single company
to create them without outside help. one company
might conceive and market an integrated circuit, but
other companies often make critical contributions to pinning
down the design. still others may have a hand in manufacturing, packaging, and distributing the chips.
With so many cooks in the kitchen, there are multiple opportunities to meddle with the hardware. a natural place to start
is at the very beginning, when a chip is being designed. today,
that's done using sophisticated computer-aided-design software. these CaD tools are created by specialized companies
that often work closely with chipmakers. the tools frequently
contain millions of lines of code, and they change quickly: new
algorithms are added almost continuously to help design faster,
lower-power circuits. In principle, among the many thousands
or perhaps millions of lines of code, it is easy to slip in a few
extra ones to modify a hardware design. and there are multiple places it could be done. For one thing, routine circuit
blocks, such as the accelerators used to crunch numbers for
encryption and decryption, are often designed by third parties.
the other obvious time for an integrated circuit to be altered
is during manufacturing. this was less of a concern decades
ago, when chip manufacturing was more affordable and com48

feB 2015

north AmericAn

spectrum.ieee.orG

panies could make their own chips in their own fabrication
plants, or fabs. But nowadays a new chip fab can cost upwards
of us $10 billion, and research and development costs keep
increasing. Because of this very high up-front cost, most chipmakers now rely on a handful of outside foundry services,
based in China, south Korea, taiwan, and the united states,
among other countries, that specialize in implementing silicon designs. although there is no reason to suspect that any
of these foundries may be adding malicious hardware, it's
impossible to exclude the possibility that they might make
undesirable adjustments to the designs, potentially altering
an entire batch of chips or a subset of them.
the u.s. Department of Defense is of course well aware
of these vulnerabilities. to help address them, its trusted
Foundry program has accredited foundries, along with other
links in the supply chain. the set of foundries allowed to work
on these "trusted" chips is generally restricted to those in the
united states. this limits access to the most advanced chips;
many trusted u.s. foundry services have not been able to
keep up their investments and are producing chips that are
10 years or more behind the current state-of-the-art manufacturing process. What's more, the DoD program is focused on
military chips for applications such as weapons and avionics.
the integrated circuits used in such vital nonmilitary applica-

ProP stylist: robin Finlay

questions about just how much the global supply chain for integrated circuits can be trusted.
If any such episode has led to calamity, the role
of the trojan has been kept secret. Indeed, if any
potentially threatening hardware trojans have
been found, the news hasn't yet been made public. But clearly, in the right place a compromised
chip could scuttle antimissile defenses, open up
our personal data to the world, or down a power
plant or even a large section of a power grid.
a lot of research is still being devoted to understanding the scope of the problem. But solutions are already starting to emerge. In 2011, the
united states' Intelligence advanced research
Projects activity (IarPa) started a new program
to explore ways to make trusted chips. as part of
that program, our team at stanford university,
along with other research groups, is working
on fundamental changes to the way integrated
circuits are designed and manufactured.
today we try to protect against hardware
trojans by keeping careful tabs on where chips
are made, limiting the opportunity for mischief
by limiting who is authorized to make a chip.
But if this research succeeds, it could make it
practical for anyone to design and build a chip
wherever they like and trust that it hasn't been
tampered with. More radically, our research
could open up ways to let you use a chip even
if there is a trojan inside.

http://spectrum.ieee.orG

Table of Contents for the Digital Edition of IEEE Spectrum February, 2015