Consumer devices and mission-critical security systems are increasingly dependent on commercial-off-the-shelf (COTS) components. These packages typically have "excess" functionality that create vulnerabilities that can be exploited by bad actors and adversaries. Commercial hardware devices are largely manufactured or assembled in countries that lack strong trust commitments (or relationships) with buyers, including defense-related industries. Even if a sub-system is directly purchased from an allied manufacturer, the components are often manufactured and assembled in untrusted foundries. As such, the devices may contain hidden hardware or be manufactured using counterfeit components that already contain Trojan content. Without some form of security and trust verification, it is almost impossible to know if a COTS device is authentic or safe to use. In this talk, we will discuss such security challenges and some novel approaches to address them.   

Hide abstract »