A Focus on Security
Companies store vast amounts of sensitive information. Security breaches lead to data theft, financial loss, and erodes trust in a company’s products and services. Various regulations and standards, such as GDPR, HIPAA, and PCI DSS, require companies to protect the confidentiality, integrity, and availability of data. Several methods and practices must be deployed to meet these requirements for data security.
Cloud, enterprise, and web services use a layered approach, also known as defense in depth, to secure data. This strategy resembles a layered Swiss cheese model, where each layer has holes but when stacked together, they significantly reduce the chances of a threat breaching all the way through.
To the end user, these layers may look like multi-factor authentication, strict password policies, access principles, and data access controls and monitoring, but they extend much, much deeper. Data centric companies add layers of firewalls, intrusion detection/prevention systems, denial-of-service mitigation techniques, virtual LANs, micro-segmentation, and anti-malware software. And these are all layered on top of physical access controls, surveillance systems, encryption techniques, and hardware attestation.
“Security is not only about software-based protection. It starts with amazing hardware. Layers from the chip all the way up to the cloud.” – Panos Panay ~ CVP of Microsoft Devices (Microsoft Ignite 2022)
A Community
The most efficient hardware centric efforts to stay ahead of security threats are built on communities who author and enforce standards, policies, and methodologies.
Security features such as secure boot and hardware-based encryption are documented and managed by the Trusted Computing Group (TCG). TCG is an organization whose members work together to formulate industry standards, which it then makes public for use by component vendors. Hardware component vendors can use this rubric as a clear design target.
Regular security audits and investigations help identify and mitigate vulnerabilities in hardware and software. The Open Compute Project Security Appraisal Framework and Enablement (OCP S.A.F.E.) is one example of a community defined inspection system where audit findings are shared publicly. This transparency increases the efficiency of the community as a whole. No longer must each end customer request their own separate audit testing and report for each component in their fleet.
“I often compare open source to science. Science took this whole notion of developing ideas in the open and improving on other peoples’ ideas. It made science what it is today and made the incredible advances that we have had possible.” – Linus Torvalds ~ Creator of Linux and Git
It has been proven time and time again that “security by obscurity” does not work. Kerckhoffs’s principle asserts that the security of the system should not depend on the secrecy of its design or implementation but solely on the secrecy of the cryptographic key. Thus, developing many siloed opaque systems will be less effective than developing a transparent and publicly scrutinized security solution.
Hardware Root of Trust
With this foundation laid, let’s dive deeper into hardware security.
A hardware root of trust (RoT) is a concept in computer security that involves using a dedicated, tamper-resistant hardware component to establish a secure foundation for a system. The RoT is designed to perform critical security functions, such as generating and storing cryptographic keys, attestation of device identity including verifying the integrity of firmware and software, and securely booting the system.
The key idea behind a hardware RoT is to create a trust anchor that is resistant to various types of attacks, including physical attacks, malware, and software vulnerabilities. By establishing a hardware RoT, system designers can ensure that the most critical security functions are protected from compromise, providing a strong foundation for building secure systems.
Caliptra
Caliptra root of trust is a new open-source standard for security in computer hardware, specifically designed for data centers and confidential computing. It establishes a foundation of trust by creating a tamper-proof mechanism to verify the authenticity and integrity of the various components within a system. It was developed in a collaborative effort by industry leaders, Google, AMD, Microsoft, and NVIDIA, in companionship with OCP. It has grown to include component vendors 9elements, LUBIS EDA, AMI, ScaleFlux and several others. This community aims to address the problems of a fragmented RoT landscape for datacenter-class SoCs like CPUs, GPUs, DPUs, TPUs, and NVMe controllers.
Caliptra is implemented directly on the SoC itself using RISC-V cores. This method provides a more secure foundation of trust compared to software-based solutions. Caliptra root of trust for measurement (RTM) verifies the integrity of the system’s firmware during the component boot process. This ensures that only authorized and untampered code is loaded at the system component level.
Though some may be concerned with a ‘single source’ for hardware RoT on every system component, one must reflect on the immense knowledge pool that underpins the technology, with security experts from many companies. These experts have reviewed the RTL and source code, and stand at the ready if/when a vulnerability is identified.
“Just as cryptographers generally advise users to leverage well-vetted crypto library implementations like BoringSSL, we feel that the industry will on balance be better served by well-vetted root of trust implementations. Caliptra, as an open source standard implementation, is well-positioned to receive a significant amount of scrutiny and expert analysis from the many organizations reviewing, contributing to, integrating, and deploying Caliptra. To date, the project has received multiple security audits by reputable firms, with the results freely available for review. We are investing in the ongoing health of the Caliptra ecosystem, and intend to demonstrate that the Caliptra implementation continues to be a trustworthy anchor for device identity.” – Jeff Andersen ~ co-chair of the Security project at OCP and co-chair of the Data Center Workgroup at TCG
ScaleFlux NVMe SoC
ScaleFlux is proud to be the leading NVMe SoC partner in the Caliptra community. Bringing its 10 years of enterprise NVMe controller design and manufacturing experience to enable Caliptra RoT to protect data at rest on storage devices.
ScaleFlux will debut the first Caliptra enabled NVMe SoC later this year. A controller with key enterprise features like telemetry, latency monitoring, and flexible data placement.
“Ten months ago, we began leveraging Caliptra to develop a secure silicon solution with hardware, firmware, and standardized API interfaces. We’ve been impressed by the speed and reach of the OCP community behind Caliptra. The recently announced Caliptra 1.0 version strengthens our confidence in building chips with Caliptra, and we’re looking forward to its widespread adoption across the industry.” – Yang Liu ~ ScaleFlux VP of Architecture
ScaleFlux will continue its commitment to the storage and security community, sharing our experience as we support our SSD partners in deploying solutions with Caliptra enabled NVMe SoCs. We look forward to additional advancements in securing data at rest, as Caliptra is paired with OCP Layered Open-source Cryptographic Key-management (L.O.C.K.) in the coming years.
Educate, Engage, and Deploy
Security is and will remain top of mind as cloud and enterprise services move into the AI age. We must stay ahead of security threads with transparency and collaboration at every level, especially hardware.
“Security is a journey, not a destination.” – Lee Prewitt ~ Microsoft Principle Program Manager Lead and co-chair of the OCP Storage Project (OCP Storage Summitt 2024)
Caliptra is yet another step in the right direction, but it needs to be deployed broadly to ripe the benefits. Stay informed, get involved, and commit to deploy highly secure hardware solutions that will provide the critical foundation that additional security layers will build upon.
Please comment on Linkedin if you have any questions.
