Hi, and welcome to the Arm 'What is' program series. In each episode, we explore a tech
topic to give you insight and perspective into some of today's hottest design trends.
I'm Brian Fuller, editor-in-chief at Arm and today we're going to find out what is
processor security?
And to help us with that, I want to introduce Erik Jacobson,
marketing director, architecture and technology with Arm. When he's not helping us understand
what his processor security, Eric likes to go running. But he assures us, he's not a marathoner.
So let's get started. Eric, what exactly is processor security?
A lot of IT cyber security, a lot of the industry focuses at the application level
than the operational side of things. So doing things like spam detection,
intersecting phishing attacks through your email systems, mitigating distributed denial of service
attacks on enterprises. All that good stuff, which is really necessary and really important.
Processor security, however, is at a much lower level. Processor level
security focuses on the instructions that are actually being executed on the CPUs. And the
hardware support that is put in place to defend at that level. If we go back
a long time in processor history, you know, the very first processors there was implicit trust.
And I use the word trust deliberately here between the processor and the instructions that run on the
processor, you know. No one thought about this back in the, I guess the early seventies type
thing when they're just getting code up and running on a CPU was , you know, hard enough.
But as the years have gone by, decades, you know, that implicit relationship or
the implicit trust relationship has matured, perhaps. As attackers look to gain access,
especially to information in different parts of the memory that aren't meant to get to, you know.
So the processor can no longer implicitly trust the instructions that its asked to run. So
over those same years, decades, we've had hardware components added like system memory management
units, SMMUs, et cetera, which may have been introduced originally for flexibility, such as
multi-tasking. But actually have found increasing use in defending against these types of attacks.
And so this control of access to memory, so attacks might be, for instance, they overturn
orientated attack, a rock attack, or a drop or jump oriented attack.
And nowadays, we actually have processor architecture in place to help and support defend
against these attacks. So this is at the processor level and we define these different technologies.
We group them into defensive execution technologies, isolation technologies. It
could be things like branch target identification and memory tagging and for isolation, TrustZone
and secure, SEL too. So there's a lot of these technologies that we've put in place, which at
the very lowest level of the actual processor core help to defend against those attacks.
Is the responsibility for processor security, does that lie with the IP
provider or is that more of a partnership between IP provider and processor vendor?
We might define as Arm working with our partners,
we might define these processor security architecture features.
As I mentioned, you know, something like memory tagging, but we don't actually implement Silicon.
So they have to be implemented. And then a lot of these hardware support features we're
putting in have to be supported with firmware and software. So such as trusted firmware, which is an
open-source project. So they need to be deployed. They need to be, they need to work on the systems.
So ideally the various people or companies and supply chain needs to be involved.
They need to actually use the firmware and use the software, et cetera. So there's a whole lot of
links effectively that needs to be put in place for an effective system,
so that's why it's everyone's responsibility.
So a lot of work, obviously being done at the
processor level. You've mentioned all the workaround, compartmentalization.
Security is still obviously a big headline these days that we read almost every day in the
newspapers and see on television. How do you see processor security evolving in the coming years?
The most obvious thing is
say the attacks are always evolving. So there are always new attack factors.
And a few years ago, we had spectrum meltdown, which was a whole new class of attacks. You know,
it's opened up a whole new way of thinking. A lot of people in the industry and in different
companies and lots of different competitor companies hadn't actually thought about.
So to stay ahead of the game, we need to do our own research. We need to collaborate in
research and we need to keep an eye on what's going on in the market.
So there's that new type of attack always coming up, but there's also just doing the
basics really well, you know. And I think I mentioned government and regulation idea,
industry certifications, such as PSA certified in the IoT markets.
There's nothing incredibly radically new about it. It's just solid sound good practice.
And as I talked about earlier, the whole ecosystem needs to be using those best principles that we've
evolved around, you know. There's a project we are participating in, funded by the UK government
actually called Morello, which is about an improved memory protection architecture.
It can be quite a radical technology. So everyone has to be in the loop,
whether it's Arm, whether it's a Silicon vendor, whether it's operating system vendor.
And finally, one of the new paradigms is confidential computing,
which actually separates the responsibility for who owns and operates on the data
from where it's being run. And that's a paradigm shift.
Is there something you can compare this to in another industry?
So one of the analogies I've heard is just as cars have improved in safety for the driver
over the years with ADAS, airbags, advanced driver aids, so processors
have improved in their security. So in a car,
the driver hasn't had to do anything and it's gotten safer for them. Just so with application
piece of software, the underlying hardware, the post-test, the security has improved.
Well, thanks, Eric. It's incredibly reassuring to know that the industry is working so tirelessly
and relentlessly to secure our devices and obviously thinking well into the future.
Now check out all our other 'What is' programs here and be sure to
subscribe because we'll be adding more as the year progresses. Thanks for watching!