CAREER: Supply Chain Security for Integrated Circuits

支撑现代社会关键系统的集成电路(IC)是由全球供应链生产的，该供应链涉及许多国家的各种参与者。一些演员是受信任的，但另一些不受信任。不受信任的行为者会造成供应链威胁，如质量不确定的假冒IC或恶意改变IC功能的可能性。为了保护国防、关键基础设施和医疗保健中的电子系统，确保全球IC供应链的安全变得越来越重要。该研究项目寻求保护IC免受供应链威胁的新策略。这项研究探索了一个新的供应链安全框架，该框架围绕三个主要方面展开。第一个推力探索了具有制造后可编程性的特定应用设计，以防止不受信任的代工厂定向插入特洛伊木马。这项工作的第二个主旨是解决供应链的设计方面，并寻求新的形式抽象来推理和保护整个类别的恶意电路修改。第三个重点是利用低成本的认证技术来验证封装IC的来源，以解决供应链的分销方面的问题。这一研究项目通过帮助将恶意部件排除在国防飞机和医疗设备等关键系统之外，有可能对国家安全和个人福祉产生积极影响。这项工作通过努力防止假货造成的每年数十亿美元的损失，支持了美国半导体公司的经济竞争力。该项目通过各种基于竞赛的学习活动，以及通过支持教育和研究的实验室课程供应链试验台，支持网络安全教育。与此项目相关的公共数据、工具和设计构件将在https://github.com/danholcomb/supply-chain-security.项目完成后公开提供

The integrated circuits (ICs) that underpin critical systems in modern society are produced by a global supply chain that involves a variety of actors in many countries. Some of the actors are trusted, but others are not. Untrusted actors give rise to supply chain threats such as counterfeit ICs of uncertain quality or the possibility of malicious changes to the function of ICs. To secure electronic systems in defense, critical infrastructure, and healthcare, it is increasingly important to secure the global IC supply chain. This research project pursues new strategies for securing ICs against supply chain threats. This research explores a new framework for supply chain security organized around three main thrusts. The first thrust explores application-specific designs with post-fabrication programmability to prevent targeted Trojan insertion by an untrusted foundry. The second thrust of the work addresses the design side of the supply chain, and seeks new formal abstractions for reasoning about, and protecting against, entire classes of malicious circuit modifications. The third thrust addresses the distribution side of the supply chain with a low-cost authentication technique to verify the provenance of packaged ICs. This research project has the potential to positively impact national security and well-being of individuals by helping to keep malicious parts out of critical systems such as defense aircraft and medical devices. The work supports economic competitiveness of US semiconductor companies by trying to prevent billions of dollars in annual losses from counterfeits. The project supports cybersecurity education through a variety of contest-based learning activities, and through a supply chain testbed for lab courses that supports both education and research. Public data, tools, and design artifacts associated with this project will be made publicly available through the completion of the project at https://github.com/danholcomb/supply-chain-security.