CAKE-SiP: Chiplet Authenticate & Key Exchange for Secure Provisioning in System-in-Package

Heterogeneous integration (HI) is paving the way toward unforeseen efficiency in three driving aspects of semiconductor engineering: performance, area, and yield. System-in-packages (SiPs), consisting of multiple chiplets interwoven by package-level interconnects, are becoming common in high-performance computing applications. However, the advent of SiPs poses security threats such as information leakage, piracy, cloning, overproduction of the chiplets/system, and the extraction of security assets through probing attacks. Unfortunately, existing countermeasures for conventional monolithic integrated circuits (ICs) are not designed in the context of HI and, in some cases, thrive on flawed assumptions. In this paper, we propose CAKESiP, equipping multi-chiplet SiP design frameworks for protecting SiP security assets from supply chain and in-field vulnerabilities using two indispensable sub-modules (must be) integrating with SiP architecture, i.e., chiplet hardware security module (CHSM) and chiplet security intellectual property (CSIP). By demonstrating the details and missions of these two sub-modules, we present an inter-chiplet secure transformation protocol, in which we propose an innovative chiplet authentication and key exchange protocol that leverages a weak physical unclonable function (PUF) and a signature generator module. A comprehensive security analysis of the proposed authentication protocol has been carried out, illustrating its resilience to attacks known today while maintaining minimal area overhead.