IN Brief:
- An additional $3.3 million supports security assurance research under the US T&AM programme.
- Arteris is working with BAE Systems and SiFive on evaluation of third-party semiconductor IP.
- The methodology links hardware weakness classes, requirements, verification properties and evidence.
Arteris has secured an additional $3.3 million in US government funding to expand a semiconductor intellectual property security assurance programme developed with BAE Systems and SiFive. The work aims to establish repeatable methods for evaluating security of commercially sourced IP blocks and their integration into complex systems-on-chip, particularly those intended for defence and other applications requiring high confidence in hardware behaviour.
The US Trusted and Assured Microelectronics programme is funding the additional work, focused on establishing traceable evidence for security properties within semiconductor designs. Arteris, BAE Systems and SiFive will examine how those properties can be assessed consistently as licensed IP is brought together into more complex hardware systems.
A system-on-chip commonly combines licensed processor IP, interconnects, memory interfaces and peripheral controllers from several suppliers, each with separate security assumptions and implementation histories. Those components must ultimately work together within a single privilege and transaction architecture, even when their interfaces were developed and verified independently.
Security assessment becomes more difficult as those components are integrated because individually correct behaviour does not establish that the complete design enforces intended protections. A processor may apply privilege controls to memory transactions while a separate direct memory access engine accesses the same memory through another path. If permissions across paths are inconsistent, an integration weakness may exist even when individual blocks perform their documented functions.
The Arteris programme uses Common Weakness Enumeration categories to connect potential access control and information exposure problems to explicit hardware requirements. Security properties and verification results can then be associated with the affected IP blocks and the paths that connect them.
For each identified weakness, the assurance process must establish which design property is intended to prevent it, where that property applies and which tests or formal results support it. Evidence remains useful only if it covers the relevant operating conditions and is traceable to the version of the circuit being assessed.
Arteris describes its framework as linking weaknesses to requirements, properties and traceable verification results at a granular level. Its intention is a repeatable methodology across IP blocks, subsystems, chiplets and complete systems-on-chip. Extending across different integration levels is necessary because some vulnerabilities become visible only when information or control moves between components.
Network-on-chip communication creates security dependencies among processor initiators, memory controllers and accelerators that may carry different privileges. Transaction routing and control mechanisms must enforce the intended permissions throughout the path rather than solely at each individual endpoint.
The expanded collaboration combines Arteris’s integration and assurance technologies with BAE Systems’ mission-critical electronics work and SiFive’s RISC-V processor IP. The companies aim to improve assessment of commercially sourced semiconductor functions rather than requiring each component to be designed by the integrator of the final device. No completed processor product or deployed defence system has been identified as an outcome of the award.
Security properties need checking under unexpected access sequences and interactions between components as well as normal traffic. Tests that establish correct routine operation may leave unusual privilege transitions unexplored, so the verification evidence must indicate its coverage and limitations.
As a semiconductor design evolves, revisions to IP settings, interconnect topology or software interfaces can make earlier security results obsolete. Linking requirements and weaknesses to the corresponding verification evidence helps establish what must be repeated after each change.
Arteris has developed hardware assurance tools intended to collect evidence across semiconductor designs. The new programme expands that activity into collaborative methodology for evaluating externally sourced IP and its integration, particularly by establishing measurable, reproducible assessments. The companies have not disclosed a completion date or announced a certification scheme. Additional funding does not establish that a chip has completed security qualification; the programme supports methods to be evaluated against actual designs.
