Design & Reuse: A Repeatable Framework for Hardware Security Assurance

  • Mark Labbato
  • 2 min read

As the complexity of microelectronics accelerates across commercial and government systems, security assurance and trust is becoming a defining requirement rather than a secondary consideration. This complexity growth has also expanded the role of third-party intellectual property (3PIP) used in today’s chip designs allowing for a faster, more scalable path to complex system design. To fully realize these benefits, system developers need a standardized, repeatable process that improves visibility into 3PIP design and behavior. This visibility is critical to hardware security, helping teams detect misconfigurations, unintended access paths, and other vulnerabilities that can emerge when third-party IP becomes part of the full system. Security does not automatically carry across combined components, making system-level security practices essential. As a result, design teams are shifting to an executable, robust, and end-to-end structure that ensures performance gains do not come at the expense of security.

The adoption and openness of the RISC-V instruction set architecture has driven innovation, flexibility, and rapid ecosystem growth. This has put a larger emphasis on adopting standardized tools and approaches to ensure the functionality and security of RISC-V designs are complete and correct especially in safety critical systems.

Defining a Systematic Approach

To support this shift, Cycuity, recently acquired by Arteris, has developed a four-step security assurance methodology, recognizing that a structured and repeatable framework is needed to evaluate and verify third-party IP at scale.

  1. Scope inclusion: Identify relevant Common Weakness Enumeration (CWE) categories from the MITRE-maintained database for IP under review.
  2. Security requirements: Translate identified weaknesses into concrete, design-specific security requirements.
  3. Verification development: Create security properties and corresponding tests to validate those requirements.
  4. Evidence collection: Gather artifacts to support, document, and validate the results.

Most of the engineering effort is concentrated in Steps 3 and 4, where security requirements are implemented as security properties and rules, tests are executed in the security analysis environment, and the resulting evidence is reviewed, collected, and archived. This process establishes hardware security as a structured verification workflow supported by repeatable artifacts.

To read the full article on Design & Reuse, click here.