Security Architecture

Stages

3. Security Requirements & Compliance Targets^A
4. Security Architecture (this stage)^A
5. Secure Design & Implementation^A

Product and assurance milestones

• Assurance and compliance plan agreed (AP)

Security engineering milestones

• Threat model baselined (TM)
• Security requirements baselined (RB)
• Security architecture approved (AA)
• Secure design review complete (DR)

Disciplines

• Product security management^A
  • Security Requirements & Compliance Targets: maturity 0.3, Outlined. Security priorities set from the threat model; the review board has held its first review and the assurance targets are outlined.
  • Security Architecture: maturity 0.5, Analysed. Requirements, assurance plan and security architecture reviewed by the board; residual risks listed with owners.
  • Secure Design & Implementation: maturity 0.5, Analysed. Requirements, assurance plan and security architecture reviewed by the board; residual risks listed with owners.
• Threat analysis and risk assessment^A
  • Security Requirements & Compliance Targets: maturity 0.5, Analysed. Threat model analysed and baselined: attack paths rated for every asset and each high risk given a treatment; the requirements and the architecture are checked against it.
  • Security Architecture: maturity 0.5, Analysed. Threat model analysed and baselined: attack paths rated for every asset and each high risk given a treatment; the requirements and the architecture are checked against it.
  • Secure Design & Implementation: maturity 0.8, Feature complete. Threat model checked against the implemented design at the secure design review; every mitigated threat traced to a countermeasure in the design.
• Security architecture^A
  • Security Requirements & Compliance Targets: maturity 0.3, Outlined. Root of trust, trust domains and isolation options outlined against the draft requirements and the chip architecture.
  • Security Architecture: maturity 0.5, Analysed. Security architecture approved: every requirement allocated to an element, and the root of trust, boot chain, key hierarchy and lifecycle states specified.; Security architecture approved (milestone for one item)
  • Secure Design & Implementation: maturity 0.8, Feature complete. Architecture updated for the secure design review findings; every element built as specified or changed under joint change control.
• Cryptography and countermeasures^A
  • Security Requirements & Compliance Targets: maturity 0.3, Outlined. Algorithms, key sizes and random number needs outlined from the draft requirements, enough to classify the cryptographic functions for export.
  • Security Architecture: maturity 0.5, Analysed. Cryptographic design, key management and countermeasure specifications approved: each side-channel and fault threat has a countermeasure or an accepted risk.^A
  • Secure Design & Implementation: maturity 0.8, Feature complete. Accelerators and countermeasures designed and through the secure design review; leakage and fault assessment running on the design.
• Secure hardware design^D
  • Security Requirements & Compliance Targets: maturity 0.3, Outlined. Root of trust, fuse controller and isolation blocks outlined; candidate security IP and its provenance evidence listed.
  • Security Architecture: maturity 0.5, Analysed. Block structure and interfaces fixed with the approved architecture; security IP chosen and its provenance checked; RTL started.
  • Secure Design & Implementation: maturity 0.8, Feature complete. Security block RTL feature complete and through the independent secure design review with no open high-severity finding.
• Security firmware and secure boot^D
  • Security Requirements & Compliance Targets: maturity 0.3, Outlined. Secure boot flow, update and anti-rollback approach outlined against the draft requirements.
  • Security Architecture: maturity 0.5, Analysed. Secure boot specification approved with the architecture; the structure of the boot ROM code and security firmware set and coding started.
  • Secure Design & Implementation: maturity 0.8, Feature complete. Boot ROM security code and security firmware complete and through the secure design review; security tests running.^D
• Security verification^A
  • Security Requirements & Compliance Targets: maturity 0.3, Outlined. Traceability matrix started: each requirement linked to its threat, with a verification method outlined.
  • Security Architecture: maturity 0.5, Analysed. Security verification plan approved: properties, negative and abuse tests, fault models and the environment structure defined for every requirement.
  • Secure Design & Implementation: maturity 0.8, Feature complete. Environment, property set, negative tests and fault campaigns complete and running on every design drop; results and coverage still closing.
• Secure debug and test access^A
  • Security Requirements & Compliance Targets: maturity 0.3, Outlined. Debug and test access paths, and the lifecycle states that open or close them, outlined from the draft requirements.
  • Security Architecture: maturity 0.5, Analysed. Debug and lifecycle state specification approved: the test, debug and key access of each state defined, and every transition one way or authenticated.
  • Secure Design & Implementation: maturity 0.8, Feature complete. Debug authentication and test mode protection designed with the security blocks and through the secure design review.
• Security evaluation and penetration testing^O
  • Security Requirements & Compliance Targets: maturity 0.0, Planned. Attack testing scope agreed with the requirements: the attack potential to test against, whether an outside laboratory is needed, and the samples and rigs to budget; no test strategy yet.
  • Security Architecture: maturity 0.3, Outlined. Attack test strategy outlined from the threat model and the draft architecture: which attacks, at which attack potential, on which samples.
  • Secure Design & Implementation: maturity 0.5, Analysed. Attack test plan analysed: each threat in scope has a planned attack, and the test rigs, reference peers and samples are specified.
• Supply chain security and provisioning^A
  • Security Requirements & Compliance Targets: maturity 0.0, Planned. Provisioning needs taken from the requirements: which keys and identities each part needs, the sites that will handle them and a first cost estimate; no flow outlined yet.
  • Security Architecture: maturity 0.3, Outlined. Provisioning flow outlined from the key management specification: where keys are generated, injected and recorded, and which sites handle secrets.
  • Secure Design & Implementation: maturity 0.5, Analysed. Provisioning flow, design data protection and counterfeit controls analysed for every site; the fuse map and test program content agreed for tape-out.
• Certification and assurance^A
  • Security Requirements & Compliance Targets: maturity 0.3, Outlined. Schemes, target assurance levels and the evaluation laboratory chosen; the evidence each scheme needs outlined.
  • Security Architecture: maturity 0.3, Outlined. Schemes, target assurance levels and the evaluation laboratory chosen; the evidence each scheme needs outlined.
  • Secure Design & Implementation: maturity 0.5, Analysed. Security target drafted and the design evidence mapped to the requirements and architecture; gaps against each scheme tracked.
• Regulatory and export compliance^A
  • Security Requirements & Compliance Targets: maturity 0.3, Outlined. Security regulations and export rules for each target market listed; the cryptographic functions classified for export.
  • Security Architecture: maturity 0.3, Outlined. Security regulations and export rules for each target market listed; the cryptographic functions classified for export.
  • Secure Design & Implementation: maturity 0.5, Analysed. Each regulatory obligation mapped to the requirements, design and process evidence that will show it is met.