Recently I touched base with Kapil Shankar, CEO of SiliconBlue Technologies Corp. and Jack Ogawa, the firm's VP of engineering. They filled me in on some company developments and let me know what I'd missed as far as company demos at the Consumer Electronics Show in Las Vegas earlier this year.
First, a little history. SiliconBlue was one of several promising FPGA startups that we profiled last year as part of a series of articles. The point of the series was that all of the startups sound good on paper, but face the reality that programmable logic is a tough business dominated primarily by two firmly entrenched players, and once-promising startups like MathStar and Cswitch have fallen by the wayside in the tough economy of recent times. One of the things that SiliconBlue has going for it is its focus on low-power, handheld applications. This impressed Bryan Lewis of Dataquest, who told me last year he considered SiliconBlue the most promising of the startups.
When I later sat down with Shankar at the company's offices in Santa Clara last August, he told me that the company had between 40 and 50 design wins. I was impressed.
Fast forward to late last month: one of the first things Shankar told me this time was that the company now "probably over 100 design wins." Basically, SiliconBlue has more than doubled the design wins under its belt in the last several months of 2009. That bodes well for a startup that faces the initial hurdle of persuading customers to go with a supplier that doesn't have a long and illustrious track record.
Shankar said SiliconBlue continues to see traction in applications like feature phones, e-books, pico projectors, digital cameras and others. He said the company sold more than 250,000 units last year.
"We continue to compete primarily with ASICs," Shankar said. "Our benefit is that, just like ASICs, we are able to help customers with IP and custom design solutions, yet provide the time-to-market benefits of FPGAs."
SiliconBlue, which has raised about $40 million in venture capital today, still has money in the bank but plans to seek a series C funding round in the next few months, Shankar said.
Shankar also said SiliconBlue's performance to date has exceeded his expectations for where he'd hoped the company would be at this stage. "We are in the right place at the right time with the right solution," he said.
Comment on this blog entry
January 20, 2010
Beware of DPA attacks
By
Dylan
McGrath
Benjamin Jun, vice president of technology at Cryptography Research Inc. (CRI), has a message for FPGA designers regarding differential power analysis (DPA) attacks: "In general, if you want to use a key in cryptography and that key is not going to leave the device, this is going to be an issue."
I recently stopped by CRI's headquarters in San Francisco to meet with Jun as well as Carole Coplan, CRI's vice president of business development for tamper resistance solutions and Pankaj Rohatgi, technical director of hardware and security solutions. Rohatgi walked me through some brief demonstrations of DPA attacks.
Using equipment for monitoring power consumption, an attacker can extrapolate the key to a cryptographic code by making guesses of portions of the key and observing whether the guesses cause correlation spikes in the power consumption. If the guess is correct, the power correlation spikes—quite noticeably.
If the guess is wrong, the power consumption correlation stays low and an attacker tries new numbers until he or she gets that portion of the key right. Then, they move on the next portion of the key and keep at it until they have the whole thing. The approach uses process of elimination, or what Rohatgi called "divide and conquer."
The thing that most struck me is just how easy to is to spot the power correlation spikes. You don't need a trained eye to spot the variation. There is some upfront work required for characterizing the device, but Rohatgi and Jun said an experienced attacker could extrapolate the key from a device in about 15 minutes. They emphasized that the attack is accomplished while observing a device performing its normal operations.
"The goal of deploying countermeasures is basically to frustrate this process," Jun said. "These aren't theoretical attacks. These are real attacks." He added that there is evidence of attackers using DPA attacks to try to break pay television systems.
 |
| Cryptography Research uses a Sasebo-G board integrated with its workstation to test FPGA images against side channel attacks such as simple power analysis and differential power analysis. |
CRI had successes in the 1990s in the smart card arena, an early target for security threats because in many applications the person in possession of those devices was incentivized to break the code (to get free television channels, for example). The company maintains that its licensed DPA countermeasures are now found in more than 95 percent of smart cards produced annually.
But adoption of CRI's DPA countermeasures in other devices is growing, according to the company.
Last year more than than 4.5 billion security chips were manufactured under license to CRI's semiconductor security technologies, according to the company. Despite the recession, the privately held firm said it was profitable for the fourteenth consecutive year.
IN 2009, Atmel, EM Microelectronic, Inside Contactless, Samsung and ST Microelectronics joined Infineon, NXP and Renesas on the list of chip manufacturers to sign DPA countermeasures licensing agreements with CRI, according to the company. MasterCard in 2009 began requiring that its suppliers have a license from CRI, according to the firm.
CRI says adoption of its DPA countermeasures continued to increase last year in pay television set-top boxes, secure storage devices and mobile phones. In 2010, the company plans to broaden its licensing focus for DPA countermeasures, including additional efforts to enroll manufacturers of hardware for government products, mobile devices and other commercial and consumer products where security is important.
Jun said CRI is in discussions with FPGA vendors, but he could not discuss specific companies. He said the company is trying to educate the FPGA user base on the dangers associated with DPA attacks.
Jun and the other folks at CRI are excited about DPA
resistance being defined in the National Institute of Standards and Technology's FIPS 140-3 security requirements for tamper resistant devices. Jun said this inclusion would broaden awareness of DPA attacks and increase the likelihood of people incorporating countermeasures, even in devices that aren't considered high security threats.
Comment on this blog entry
January 13, 2010
End of the road for MathStar (for real this time)
By
Dylan
McGrath
Divining the logic in MathStar's latest move takes a little bit of effort. The defunct programmable logic vendor, which shut its doors in 2008, this week acquired a language translation software vendor, Sajan Inc.
If you have trouble seeing the connection between programmable logic and translation software, you are not alone.
MathStar has been for months something of a phantom company, reportedly with just one employee. Calls to the company's headquarters don't reach live people (though it is possible to scroll through the still active voice mail boxes of dozens of former employees, like ghostly voices on an abandoned ship). The company's website is still up, but apparently hasn't been updated in a long time (it still lists as its lone employee Chairman and CEO Douglas M. Pihl, who reportedly resigned over the summer after the company signed a non-binding agreement to buy Sajan.)
The bottom line is that, as reported by the Minneapolis Star-Tribune, the Sajan deal spells the end of the line for MathStar, officially. MathStar will take its cash reserves of nearly $13 million (more like $7 million after the acquisition) and head to Wisconsin to work on language translation software. The combined company will operate under the Sajan name.
MathStar threw in the towel in 2008 due to slow sales of its field programmable object arrays (FPOA) and the fact that no buyers were forthcoming. At the time, the company said it halted development in order to consider strategic alternatives for its assets. Not sure if anyone anticipated a move this drastic, but the company's board obviously felt that Sajan represents a good investment.
As for what will become of the FPOA technology, it seems as though it will simply be discarded by the wayside. From the jump, MathStar's architecture represented a fundamental change, with silicon "objects" in the form of 16-bit arithmetic-logic units, each with its own instruction cache and scratchpad memory. The history of PLDs is littered with failed startups that tried to do something that was too fundamentally different for users to embrace, even if it promised certain advantages.
Some shareholders of MathStar had pushed hard for the company to liquidate its assets and return the proceeds to shareholders. But that plan of action was apparently voted down by shareholders. You've got to figure that some of them are not too thrilled about jumping into bed with Sajan. Apparently Pihl was one of them.
It's also interesting to note that MathStar spurned several takeover offers before choosing this path. But those offers don't appear to have adequately valued the company, considering the cash on its balance sheet.
Comment on this blog entry
December 16, 2009
Draft of FIPS 140-3 released
By
Dylan
McGrath
Last week, in his FPGA Gurus blog, Loring Wirbel had an excellent piece about cryptographic security in the world of FPGAs. As he points out, this is becoming an interesting area in light of the growing use of FPGAs in applications that adhere to the National Institute of Standards and Technology (NIST)'s FIPS 140 U.S. government computer security standards and an emerging understanding of the vulnerabilities to devices of attacks that make use of power analysis.
Like Loring, I recently spoke with Benjamin Jun, vice president of Cryptography Research Inc., which provides tools, technology and services to help customers secure their chips. Jun explained that he and his company are on a mission to educate users of FPGAs and other devices about the dangers associated with simple power analysis (SPA) and differential power analysis (DPA) attacks, particularly since the next revision of FIPS 140 will require resistance to these attacks.
 |
Benjamin Jun
Cryptography Research |
According to Cryptography Research, DPA is a form of attack that involves monitoring the fluctuating electrical power consumption of a target device and then using advanced statistical methods to derive cryptographic keys and other secrets. The company says it has a portfolio of more than 50 patents covering countermeasures to these types of attacks and says billions of chips incorporate its technologies in this and other security areas. Last month, the company announced that it licensed DPA countermeasure technology to STMicroelectronics for protecting the company's tamper-resistant chips against attacks.
Jun tipped me off that last week NIST released the second public draft of the FIPS 140-3 security requirements for tamper resistant devices, which will eventually supersede FIPS 140-2. Jun said the new draft requires SPA and DPA resistance at levels 3 and 4 of the specification. Under the FIPS 140-2 standard, last updated in 2002, SPA and DPA resistance was optional, but not required, Jun said. He said all other relevant standards worldwide have already added SPA and DPA resistance.
Jun said the publication of the second draft of FIPS 140-3 would be advantageous for companies making secure devices, providing them insight into the requirements and definitions to help them define their product roadmaps. The proposed standard will make the U.S. more up-to-date with other security standards worldwide, he said.
"I think Christmas came early for the U.S. security industry," Jun said.
According to NIST, the second draft of FIPS 140-3 contains several material differences from the previous draft. NIST is asking for public comments to the revised draft. Comments are due by March 11, 2010.
Comment on this blog entry
