For decades, the cybersecurity industry has operated under a well-defined mandate: protect the software and secure the network. Billions of dollars have been poured into firewalls, encryption protocols, and endpoint detection software. However, as the digital landscape undergoes a seismic shift toward distributed systems, AI-driven workloads, and the widespread adoption of chiplets, the industry’s focus is undergoing a critical, overdue correction. The most fundamental layer of our digital existence—the silicon itself—is emerging as the primary target for sophisticated adversaries.
In the latest episode of Amelia’s Weekly Fish Fry, host Amelia Dalton sat down with Jason Oberg, a leading expert from Arteris, to unpack this profound transition. The conversation sheds light on why hardware is no longer the passive foundation of computing but the most volatile frontier in modern security.
Main Facts: The Shift from Software to Silicon
The traditional approach to security has often assumed that the hardware—the physical processor and its interconnects—could be trusted. That assumption is no longer tenable. As chip designs grow in complexity to meet the performance demands of Artificial Intelligence (AI) and Large Language Models (LLMs), the "attack surface" for hardware has expanded exponentially.
According to Oberg, the last five years have seen a significant spike in hardware-level vulnerabilities. This is driven by two primary factors:
- Complexity as a Liability: As gate counts increase and designs become more intricate, security vulnerabilities often hide in the "cracks" of that complexity.
- The Software-Hardware Exploitation Bridge: Historically, researchers believed hardware was isolated from software-based attacks. The discovery of vulnerabilities like Meltdown and Spectre shattered this illusion. Attackers have learned that modern processors, which share resources across applications and virtual machines (VMs), can be manipulated via software to leak sensitive information between isolated processes.
Chronology: From Meltdown to the Era of Chiplets
The evolution of hardware security can be traced through a series of wake-up calls:
- The Pre-2018 Paradigm: Cybersecurity was almost exclusively a software concern. Hardware was viewed as a stable, "known-good" entity.
- The Spectre/Meltdown Era: These high-profile vulnerabilities demonstrated that transient execution and shared hardware resources could be leveraged to bypass software-level protections. This was the turning point for the industry.
- The Rise of Heterogeneous Computing (2020–Present): The push for performance in the AI era led to the rise of complex SoCs (Systems-on-Chip) and chiplets. As companies move toward disaggregated architectures—where different chiplets from different vendors are integrated into a single package—the ability to verify the entire system has become exponentially more difficult.
- The Arteris-Cycuity Integration: Recently, the acquisition of Cycuity by Arteris marked a strategic effort to bake security into the very fabric of system-level design, shifting the paradigm from "patching after the fact" to "verifying by design."
Supporting Data: The Hidden Costs of Complexity
To understand the scale of the challenge, one must look at the nature of modern system interconnects. A modern chip is not a monolith; it is a city of hundreds of subsystems linked by a Network-on-Chip (NoC).
The Problem of "Unknown Unknowns"
Traditional functional verification is designed to ensure a chip does what it is supposed to do. However, security is inherently about ensuring the chip does not do what it is not supposed to do. Oberg notes that functional verification, while rigorous, often misses the "negative" test cases where unauthorized information flow occurs.
Symbolic Analysis: The New Standard
To address these gaps, the industry is moving toward symbolic analysis. Unlike traditional simulation, which tests specific input scenarios, symbolic analysis allows engineers to track the flow of information at the bit level. This allows developers to prove, mathematically, that sensitive data—such as cryptographic keys or user-specific information—cannot traverse unauthorized paths, even if a software-based exploit attempts to trigger such a flow.
Official Perspective: The Arteris Approach to System-Level Security
The integration of Cycuity’s technology into the Arteris portfolio provides a unique vantage point. Arteris provides the NoC (Network-on-Chip) infrastructure that serves as the "highway system" for data within a chip. By applying security assurance directly to this interconnect, designers can implement access controls at the architectural level.
"We can proactively identify security weaknesses, generate secure NoC configurations, and address fundamental security weaknesses that arise from system complexity," Oberg explains.
This approach is critical for the "chiplet" era. In a standard SoC, one company might design the entire system. In a chiplet-based system, a developer is integrating third-party components where they may have access to the specification, but not the internal implementation. This creates a "black box" problem. By securing the interconnect, designers can enforce security policies even when they cannot see into the individual chiplets, effectively creating a "zero-trust" environment at the silicon level.
Implications: Preparing for the AI-Powered Threat
The most chilling development on the horizon is the use of AI by adversaries. Just as designers are using AI to optimize chip performance, attackers are using LLMs to scan for vulnerabilities and automate the generation of multi-stage exploits.
The Arms Race
Oberg warns that AI will eventually move beyond software vulnerability detection and begin "fuzzing" hardware designs to discover new, exotic ways to exploit side channels.
Designing for Resilience
The solution, according to Oberg, is not to try and out-patch the attackers, but to eliminate the root causes of vulnerabilities. If a chip is designed such that information flow between two security domains is physically impossible, then no amount of AI-generated code can bypass that hardware constraint.
"If information flow is impossible at the hardware level, then even sophisticated AI-generated attacks cannot exploit something that fundamentally doesn’t exist," Oberg states. This represents a shift toward "Security by Design," where the objective is to make entire classes of exploits mathematically impossible.
Conclusion: The Path Forward
The security of our global infrastructure—from smartphones and satellites to cloud servers—now rests on the ability of engineers to secure the hardware layer. The era of treating hardware as an afterthought is over.
For teams struggling with the complexities of modern, distributed silicon, the message is clear:
- Shift Left: Integrate security analysis early in the design cycle.
- Focus on Information Flow: Do not just verify function; verify the integrity of data paths.
- Secure the Interconnect: In an age of chiplets, the NoC is the most critical point of control.
As the industry continues to evolve, the partnership between organizations like Arteris and the broader engineering community will be vital in ensuring that the next generation of computing remains robust against an increasingly sophisticated threat landscape. For those interested in diving deeper into this field, the "Fish Fry" archive remains a goldmine of expert insights into the future of security, from IoT protection to the hardening of orbital assets.
For more information on the evolving state of hardware security, visit the EE Journal archives and explore the dedicated security playlist on the EE Journal YouTube channel.
