What Is Hardware Security?

Hardware security is the branch of computer and electronics engineering concerned with protecting integrated circuits, boards, and physical computing platforms against tampering, counterfeiting, reverse engineering, and information leakage. It addresses threats that software defenses cannot reach, because the attacker's access is physical or lies in the supply chain that produced the device. It also covers the reverse relationship, in which hardware provides the anchor that software security depends on.

The field grew out of two developments: the globalization of semiconductor design and fabrication, which distributed trust across foundries, intellectual property vendors, assembly houses, and distributors, and the discovery in the late 1990s that cryptographic keys leak through a chip's power consumption and timing. An overview of hardware security and trust prepared for the National Science Foundation groups the resulting concerns into attacks on the design, on the manufactured part, and on the deployed system.

Supply Chain Threats

A hardware Trojan is a malicious modification inserted during design or fabrication, typically a small circuit that stays dormant until a rare trigger condition activates it, at which point it leaks keys, degrades performance, or disables the part. Because a Trojan may occupy a few gates in a design of billions, detection is a needle-in-haystack problem attacked through functional testing, logic verification of third-party intellectual property blocks, optical and X-ray inspection, and side-channel fingerprinting against a golden reference. Related supply chain risks include recycled or remarked counterfeit components, overproduction by an untrusted foundry, and cloning of design files. NIST guidance in Special Publication 1800-34 on validating the integrity of computing devices addresses the acquisition side of this problem, showing how provenance and platform attestation can be checked as devices move from manufacturer to operator.

Physical and Side-Channel Attacks

Once an adversary holds the device, its physical behavior becomes an information channel. Differential power analysis correlates instantaneous supply current with hypothesized key bits; electromagnetic, timing, acoustic, and photonic emission attacks exploit the same principle through other observables. Fault injection takes the complementary approach of forcing errors through voltage or clock glitching, laser pulses, or electromagnetic pulses, then deriving keys from the faulty outputs. Invasive attacks go further with decapsulation, focused ion beam edit, and microprobing of internal buses. Countermeasures include masking and hiding in cryptographic implementations, randomized clocking, sensors that detect abnormal supply or temperature conditions, shields, and error detection on cryptographic datapaths. Detection research also runs the other direction, using side-channel analysis to expose hardware Trojans whose presence perturbs a chip's power signature.

Roots of Trust and Countermeasures

Defensive hardware provides the base that secure boot, attestation, and disk encryption rely on, a role surveyed in a NIST presentation on the hardware root of trust for cyber security. A hardware root of trust is a small block of immutable code and keys, implemented in a trusted platform module, a secure element, or on-die security engine, that measures each subsequent stage of the boot chain before transferring control. Physical unclonable functions derive a device-unique identifier from manufacturing variation rather than storing a key in nonvolatile memory, and true random number generators supply entropy from thermal or jitter sources. Design-side techniques such as logic locking, camouflaging, and split manufacturing aim to make a stolen netlist or mask set unusable, while trusted execution environments isolate sensitive computation from a compromised operating system.

Applications

Hardware security has applications across a range of domains, including:

• Payment cards, secure elements, and mobile device protection
• Defense and aerospace electronics procurement
• Automotive controllers and vehicle-to-everything communication
• Industrial control systems and critical infrastructure
• Cloud server attestation and confidential computing
• Internet of Things device identity and firmware integrity