By: Pim Tuyls, CEO & Co-Founder of Intrinsic ID, pim.tuyls@intrinsic-id.com, previously published on EDA Cafe.

Pim Tuyls is founder and CEO of Intrinsic ID, a spinout from Phillips Research in 2008. It was at Philips, where he was Principal Scientist and managed the cryptography cluster, that he initiated the work on Physical Unclonable Functions (PUFs) that forms the core of the Intrinsic ID technology. With more than 20 years of experience in semiconductors and security, Pim is widely recognized for his work in the field of SRAM PUFs and security for embedded applications. Pim holds a Ph.D. in mathematical physics from Leuven University and holds more than 50 patents.

The world is becoming ever more connected through the internet of things (IoT) and reliant on these connections to drive communication, commerce, healthcare, and defense systems. At the same time, cyberattacks are on the rise. This drives the need for secure authentication, trusted communication, and data protection. Each device in the connected world must be safe and trustworthy; each data communication must be protected from eavesdropping; each embedded software program must be protected from reverse-engineering; the privacy of each piece of personal data must be preserved. This is a very complex problem that is only becoming more so as connected devices have begun to comprise numerous components from multiple manufacturers.

Happily, there is rapidly growing awareness that security is vital to keep the connected world that we all depend on safe and trustworthy. Here I will identify several trends that I believe will be driving the wider adoption of security solutions for the semiconductor market in 2023.

System-in-Package

Moore’s Law is reaching its limits, and with chip designs growing ever more complex, it is becoming increasingly difficult for many designs to fit onto a single die. This is either because of limitations to the reticle size for chip manufacturing or because it’s getting more complex and very expensive to scale a monolithic system-on-chip (SoC) down to a new technology node. The solution for these limitations in the production process is the system-in-package (SiP), where one package contains multiple individual chiplets, each with their own functionality. This approach results in lower cost and faster time-to-market, while enabling specific functions to be implemented at their optimal technology nodes. Because of these benefits, Gartner predicts that by 2026, 20% of all semiconductor devices shipped will incorporate advanced 3D packaging technology, up from less than 1% in 2021.

While there are potent benefits to having individual chiplets for different functions, there is also a significant downside to this increasingly popular approach: spreading functionality over multiple chiplets increases security risks. It is easier to eavesdrop on and alter communication between chiplets than communication on an internal bus inside an SoC. Security solutions must address this vulnerability and secure component-to-component communications.

Supply-Chain Security

As highlighted above, the trend toward SiP is accelerating the complexity of already complex semiconductor product supply chains. With greater complexity, trust becomes more scarce. A typical supply chain spans several different production  and assembly facilities, where components from many different vendors are pieced together into a final product. Each of the many steps required to create a product is threatened by many possible attacks, ranging from overproduction and counterfeiting, to using malicious or lower-quality components. As products move between facilities (and sometimes between continents) during production, it is difficult to maintain trust throughout the entire process. And with the rapidly changing geopolitical landscape, “trusted” partners can become “untrusted” rather quickly.

Thankfully, we are seeing an increasing number of companies in the semiconductor industry joining forces to address these supply-chain security issues as a united front. These are battles that cannot be won by individual companies on their own, simply because there are no supply chains consisting of a single company anymore.

Matter

A key trend for 2023 is the growing adoption of a proprietary standard for home automation called Matter that aims to make smart home devices secure, reliable, and seamless to use. This standard, which is supported by Amazon, Apple, and Google, amongst others, only entered the market in 2022, but already has seen rapid adoption by many of the large semiconductor companies in the smart home industry.

One of the problems IoT markets have been struggling with is the fragmentation of the IoT hardware market among many vendors, which makes interoperability between devices complex. To address this, several large industry players started working on Matter, a wireless standard that defines how IoT devices from different manufacturers should communicate with each other. Matter has been designed explicitly for smart home to make sure that consumers can buy a device from any vendor and know that the device will be secure and will work with the other devices in their homes. The goal is to ensure that any device certified as Matter-compliant will be interoperable with any other Matter-certified device. Matter is a great step forward for smart home technology by making it much easier for consumers to connect their favorite devices to each other seamlessly and securely.

Root of Trust

Strong security starts in hardware, which provides a foundation for software security solutions. Just as one cannot build a castle on quicksand, software cannot be secure unless it leverages the trustworthiness and security of the underlying hardware on which it runs.

That is why the use of hardware-based roots of trust (RoTs) is a strong trend expected to continue. An RoT holds all secret keys and credentials of a device in a way that keeps them safe from adversaries. A hardware-based RoT gives all users trust in the secret keys and credentials in a device; without a strong RoT, there is no way for the system to be secure. Once a hardware-based RoT has been implemented, the hardware and software can start working together to make the entire system secure.

Hardware-Based Security Solutions to Meet Market Needs

Intrinsic ID offers hardware-based solutions to secure any chip. These include solutions that address many of the security trends discussed previously.

Intrinsic ID delivers flexible RoT solutions based on our patented SRAM PUF, or physical unclonable function, technology. SRAM PUFs create device-unique cryptographic keys for any semiconductor device, based on physical silicon variations inherent to every chip. Because these variations are impossible to clone, they are the ideal basis for device identification. The SRAM PUF’s root key is generated only when needed, so no sensitive data is ever stored on the chip. This technology enables the creation of an RoT with very high security and flexibility, while keeping the total cost of the hardware solution low.

Happily, many semiconductor vendors are releasing Matter-compliant chips that take security seriously. Vendors NXP and Silicon Labs have recently released Matter-compliant microcontrollers that have a security architecture based on the Intrinsic ID SRAM PUF technology. Anchoring the security of this industry-standardized protocol in the lowest level of hardware by using this kind of RoT technology guarantees the highest possible level of security for Matter-compliant chips.

Intrinsic ID is participating in multiple industry initiatives, such as the ones spearheaded by the Global Semiconductor Alliance, which are defining the ways of working required to keep the modern supply chain secure and trustworthy. Our technology plays an important role in this process, helping to track and authenticate genuine components on their journey throughout the supply chain, while preventing components from being overproduced or counterfeited.

At Intrinsic ID, we have developed solutions that scale with the stringent requirements that SiP technology is placing on security. These solutions focus on authenticating individual chiplets, even those fabricated in the most advanced nodes, preventing counterfeiting of chiplets, and protecting sensitive data at rest and in transit within the SiP.

Wide adoption of Intrinsic ID solutions has led to dramatic growth in revenue (in 2022 double the revenue of 2021) and in the number of devices deployed with our technology. We have now secured more than half a billion devices in the field with our technology and our customers include several of the biggest tech companies in the world. In 2023, we will build on this momentum with several new product releases that target very specific vertical markets within IoT. And we are looking to grow our team as well.

Conclusions

When it comes to security, there is very much to look forward to in 2023. The semiconductor industry is reaching a level of maturity where security is no longer merely considered to be a “cost adder,” but rather a “must have” – or even an opportunity to add value to products. Devices can no longer be connected to the IoT without proper security in place, because the threats they face are multiplying every day. Driven by market trends like the ones described in this article, the adoption of hardware-level security is growing quickly to ensure that our connected world will be a safer place in the years to come. At Intrinsic ID we look forward to continuing to contribute our share by making sure our security solutions are ready to face our industry’s future challenges.