Chip guard is designed to address hardware supply chain risks where attackers might replace ASIC or CPU chips in a Cisco router with counterfeit or malicious units. Compromised chips threaten performance, reliability, and security, potentially introducing hidden vulnerabilities. By validating chips before deployment, chip guard helps preserve hardware integrity.
Summary
The key components involved in the process are:
-
Application Specific Integrated Circuit (ASIC): Executes critical hardware operations, such as scanning the egress queue for error causes.
-
CPU chip: Runs the router’s operating system and manages core processing.
-
TAm chip with Imprint and Observed databases: Stores and compares SHA-256 chip ID hashes to verify authenticity during boot.
Chip guard hardware integrity checks help ensure Cisco routers contain authentic ASIC and CPU components during secure boot, protecting against supply chain attacks and counterfeit chips.
Workflow
These stages describe how the chip guard hardware integrity checks work.
- Router manufacturing: The TAm chip is programmed with SHA-256 hashes (digital fingerprints) of the CPU and ASIC chip IDs, stored in the Imprint database (Imprint DB). These values remain immutable for the router’s lifetime.
- Router deployed and powered up: During the secure boot process, the chip guard feature recomputes the SHA-256 hashes of the CPU and ASIC chip IDs, creating the Observed database (Observed DB) within the TAm chip.
- Comparison of Imprint and Observed databases:
-
If the Imprint DB and Observed DB match, chip guard validates the hardware as authentic and allows the router to continue booting.
-
If the databases do not match, chip guard identifies a counterfeit chip and halts secure boot. A warning message is displayed, indicating that supply chain integrity has been compromised.
Result
Chip guard ensures that only genuine ASIC and CPU components are used in the Cisco router. If counterfeit chips are detected, secure boot is halted, preventing compromised devices from entering the network.
Stages of chip guard implementation
The table shows the various stages through which chip guard is implemented on the router.
Table 1. Table
|
Stage
|
Process/Action
|
Result
|
|
1. Router Manufacturing
|
SHA 256 hashes of the electronic chip IDs of both the CPU and ASIC are programmed in the TAm chip and stored in a database known as Imprint DB.
|
The Imprint DB inside the TAm chip contains the SHA 256 hashes, which cannot be modified during the router’s lifetime.
|
|
2. Router Deployed in the Field and Powered Up
|
During the secure boot process, the chip guard feature recomputes the SHA 256 hashes of the electronic chip IDs of both the CPU and ASIC and creates a database known as Observed DB.
|
The Observed DB values are stored inside the TAm chip.
|
|
3. Comparison of Imprint DB and Observed DB
|
DBs match
|
The router continues to boot. Depending on the capability of the underlying router, the chip guard feature validates either the CPU, ASIC, or both.
|
|
DBs do not match
|
The router notifies that either the CPU or ASIC is counterfeit, and the secure boot process halts. A message is displayed on the console about the chip guard validation failure.
|