EAGER: Collaborative: IC Supply Chain Security and Quality Control in Business and Social Context

可信硬件对于实现安全可信的网络空间至关重要。然而，这种安全基础并不是没有威胁的。具体地说，涉及集成电路(IC)开发和供应的对手可能会发动多项攻击，如窃取知识产权、篡改设计、伪造和生产过剩。国家综合网络安全倡议已将这一供应链风险管理问题确定为国家首要任务。解决这一问题需要了解该链中各方的激励措施和能力，包括业务和技术方面。该项目结合了计算机安全、商业和工业工程的专业知识，以开发具有安全和供应链意识的风险评估技术、管理机制和IC设计技术。这一跨学科的多大学合作项目通过在产品开发、供应链和项目管理中利用现有的管理科学技术，为IC开发和供应链安全风险缓解和质量控制开发了新的方法。具体地说，研究人员(1)基于博弈论中的委托代理模型评估潜在的隐性激励和盈利结构，(2)开发具有安全风险意识的IC设计和管理技术，以及(3)整合经济学和管理科学技术，例如(I)揭示原理和其他激励合同，(Ii)各种努力、收入和成本分担机制与新的安全增强IC设计和制造方法，(Iii)设计数据访问控制，(Iv)相互验证和(V)数字取证技术。

Trusted hardware is essential to achieving a secure and trustworthy cyberspace. However, this security foundation is not free of threats. Specifically, an adversary involved in Integrated Circuit (IC) development and supply may launch a number of attacks such as intellectual property theft, design tamper, counterfeiting and overproduction. The Comprehensive National Cyber Security Initiative has identified this supply chain risk management problem as a top national priority. Addressing this requires understanding the incentives and capabilities, both business and technical, of parties in this chain. This project combines expertise from computer security, business, and industrial engineering to develop risk assessment techniques, management mechanisms, and IC design techniques that are security and supply-chain aware. Findings from this research will lead to improved trust and closer cooperation among various parties in industry ecosystems.This inter-disciplinary multi-university collaborative project develops new methodologies for IC development and supply chain security risk mitigation and quality control by leveraging the existing management science techniques in product development, supply chain and project management. Specifically, the investigators (1) assess potential hidden incentive and profitability structures based on principal-agent models in game theory, (2) develop security risk-aware IC design and management techniques, and (3) integrate economics and management science techniques such as (i) revelation principle and other incentive contracts, (ii) various effort, revenue and cost sharing mechanisms with new security-enhancing IC design and manufacturing methodologies (iii) design data access control, (iv) mutual verification and (v) digital forensics techniques.