Driving an open-source based vision for a resilient supply chain
The VE-HEP is an ambitious research project that aims to build an open-source based hardware ecosystem for trustworthy electronics and a strong, resilient supply chain as part of the HEP-alliance. The HEP alliance is a consortium of 8 academic and industry partners that are building the next generation of hardware security chips using fully open-source processors and EDA tools.
Hardware trust and secure microelectronics are key requirements that must be fulfilled by an integrated flow from architecture, design to manufacturing platform for an innovative, end-end chip design solution. These devices must function reliably and protect against malfunctions, attacks and accidents during operation. The use of open-source tools and processors are key components and provide differentiated capabilities in building and proving feasibility of this design ecosystem that are not otherwise possible using commercial tools.
OpenROAD is an important application for the generation and support of reliable, open-source hardware for trusted microelectronics. It has recently enabled the PDK support for the BiCMOS process technology created by IHP. OpenROAD is already silicon-proven in building SoCs using the RISC-V processor and its derivatives.
This is a 3 year project funded by the German Federal Ministry of Education and Research (BMBF) aimed at boosting the local semiconductor industry and EWD (Education and Workforce Development) at scale for Germany.
This blog shares the use of OpenROAD as part of this important strategy for the creation of trusted hardware. Tim Henkes from RheinMain University of Applied Sciences, a part of VE-HEP, shares his experience using the OpenROAD flow and other open-source tools to design and successfully tape out hardware security blocks.
Leveraging an open-source strategy for trusted microelectronics
The ability to create hardware for trusted microelectronics using open-source tools and hardware has far-reaching applications from military, defense, sensor based systems and personal devices. Trusted microelectronics based applications are especially important to the automotive industry since they are central to the business, brand and reputation. The use of open-source specifically for design of secure hardware offers unique advantages and enhances required capabilities:
- Safety and Security
- Prevention of cyber attacks and unlawful access to vehicle and passenger information systems
- Ensuring safety of both passenger and vehicle by preventing attacks on systems like anti-lock braking, collision avoidance, autonomous driving controls etc.
- Reliability
- Safe and reliable operation of the vehicle throughout its lifecycle under variable environmental conditions of temperature, vibrations , maintenance etc.
- Supply chain resilience
- Prevent counterfeiting and unauthorized hardware modifications that are dangerous and severely compromise passenger vehicle safety.
- Compliance, Audits and Regulatory standards
- Guaranteeing compliance, scrutiny and trust for environmental, safety and quality standards
- Ability to modify processor and hardware architecture for future generation of vehicles and standards.
- Continuous Innovation and Collaboration
- Open-source tools and flows foster continuous innovation and collaboration among a diverse community of stakeholders: hardware designers, verification engineers, and security experts.
The figure below shows the architecture envisioned by the VE-HEP project to build a reliable and flexible model for trusted microelectronics using open-source design tools and processors.
Image source : HEP alliance
RISC-V and OpenROAD : A trusted flow for HSMs
VE-HEP chose RISC-V as the processor along with OpenROAD to build and study the feasibility of trusted electronics for security using IHP Open PDK.
RISC-V is the natural choice for many applications today due to its open, flexible architecture, ability to design without licensing costs and to rapidly create custom applications for a wide range of technology nodes. The choice of RISC-V with OpenROAD enables a wide range of applications based on IHP’s high performance, 130nm BiCMOS technology: Automotive, IoT, HPC, Medical, Space and Communications and many more.
OpenROAD is the foundational application for SoC design that has been deployed in many silicon-proven designs in > 600+ tapeouts, many of them based on RISC-V microcontrollers.
VE-HEP successfully taped out three designs using OpenROAD in 2023–two of these used OpenLane and the proprietary PDK for the sg13g2 BiCMOS process and produced successfully working chips!. In Dec 2023, Tim switched the flow to use, OpenROAD-flow-scripts (ORFS) for these advantages:
- Fully open-source, Autonomous, No-Human-in-Loop (NHIL) flow from RTL-GDS
- Compatibility to other open-source and commercial tools
- Support for the IHP PDK
- Ease-of-use and flexibility
- Developer friendly for easy integration and customization
- Rapid turnaround for problem fixes and feature requests
Open-source for Design Hardening and Algorithmic security
Building trustworthy, reproducible and verifiable electronics requires a radically new approach in the design and manufacturing of chip components i.e processor, EDA tools and design and verification methodologies. Chips used for cryptographic operations must ensure algorithmic security during operation without leaking information or becoming vulnerable to hardware attacks.
Open Source design tools allow for code inspection ensuring that the EDA tool itself does not add any trojan to the hardware.
VE-HEP aims to deliver such a flow created around open-source tools and design components that can be independently customized to suit specific requirements for hardware security and supply chain sovereignty. To paraphrase their vision for the project : “Hardening the value chain through open-source, trustworthy EDA tools and processors, is to realize essential parts of the entire value chain in the area of development and production of security-relevant chips (hardware security modules) in open source for the first time”.
OpenROAD enables transparency, ownership and hardening of critical cryptographic blocks earlier in the design stage unlike the late stage hardening supported in commercial tools. The OpenROAD based No-Human-in-Loop, RTL-GDS2 flow minimizes human intervention across vulnerable stages of the design. It automatically executes synthesis, DRC-correct PnR with support using the recently enabled open-source IHP PDK. This makes it possible to prevent hardware trojan attacks, ensure wider transparency and scrutiny across the design and user community and scrutiny.
Hardware security modules (HSMs) store sensitive cryptographic keys and perform secure operations and are often vulnerable to attacks. Side channel attacks exploit unintended design and algorithmic weaknesses that leak information such as power and timing variations that can then be used to infer cryptographic keys and other sensitive information. Prevention of side channel attacks is a key requirement in the design and manufacturing of such hardware security blocks. Another mechanism used by hardware designers is that of logic locking which allows the insertion of gates to encrypt critical functionality at the RTL level. Logic locking protects the firmware and cryptographic algorithms implemented in these devices from tampering and reverse-engineering. A multi-level approach to creating trusted hardware using open-source combines several of these techniques for secure hardware implementation and verification at various design stages thereby enhancing the efficiency and reliability in the design process and reducing costs.
Created HSMs using OpenROAD
“The transition from OpenLane to ORFS was painless. Since both use OpenROAD for large parts of the flow, knowledge acquired from using OpenLane transferred well to ORFS and it was not hard to set up the project build with ORFS. The design (Verilog) was exactly the same for the second and third tapeout.”, says Tim Henkes, describing the transition to ORFS.
The design consists of a RISC-V core, VexRiscv, extended with masked AES as well as a large number multiplication units with 8, 32KiB SRAMs.
The design description uses SpinalHDL that provides useful advantages over conventional RTL descriptions to generate Verilog which was then synthesized and routed using OpenROAD-flow-scripts.
The design source is located here: https://github.com/HEP-Alliance/VE-HEP-HW-SW.
Refer to the ORFS design repository containing all the relevant scripts and design artifacts here: https://github.com/HEP-Alliance/hsm
The design flow consists of a single pass of the NHIL flow in ORFS to generate the layout from the synthesized netlist. The entire design is hardened in a single pass to ensure security in the design stages.
Results
The figure below shows the final GDS layout for the ASIC, including SRAM, the VexRiscv core and the AES block generated in the OpenROAD flow .
Final layout of the ASIC using OpenROAD-flow-scripts
The successfully taped out chip is now being tested at the board level (shown below)
Future vision for Trusted Hardware and supply chain
HEP plans to expand this project to include other key components that strengthen hardware security features that enhance random number generation (TRNG), physical unclonability (PUF) and protection of chip hardware (eFuses).
“Most importantly we want to add root-of-trust elements like a TRNG, potentially a PUF or eFuses. This will be a large part of the follow-up project we are currently planning. Parts of those efforts concern the tooling, other parts the open PDK.” concludes Tim, as he looks ahead into the near future plans for the project.
This aligns very closely with Germany’s and Europe’s vision for the semiconductor and IT industry.
OpenROAD is a critical enabler and partner in the effort to build trusted electronics and strengthen the hardware supply chain for the semiconductor industry at large.
