Which is an appropriate way to think about security when combining chiplets from several companies in one package?

Answer: C. Check by authentication or attestation that each chiplet is genuine and running the correct firmware, and protect communication between dies where needed

Inside a single chip, it used to be normal for one company to design all the circuits and for them to be made in the same fab. With chiplets, dies designed by different companies and made in separate fabs are combined, so one has to consider that one of the dies may be fake or may contain a hardware Trojan. Approaches under consideration therefore include having a die with a root of trust check the identities and measurements of the other dies, and using encryption and tamper detection on the links between dies. The package assembly process and the ports used for testing are also managed so that they do not become entry points for attacks.

• A. Because dies from different suppliers are combined, the premise of unconditional trust is hard to justify.
• B. A die may be replaced with a fake one during assembly or distribution.
• C. Correct. Even inside the package, whether each die can be trusted is checked.