跳到内容
现在

科技 · 芯片安全

AMD计划推出Versal芯片，在背面遭到篡改后阻止启动

键合的传感器层经过设计，可在遭到篡改或移除时阻止设备启动。首批样品预计于2027年下半年推出，计划于2028年上半年投产。

文字 阅读需 5 分钟 · 17 个来源

HeyDex

原语言视频

译自英文原文。

AMD计划于2028年开始生产其新款防篡改Versal芯片——预计在当年上半年，首批样品则预计于2027年下半年推出。这段等待时间很重要：该公司承诺在硅片上内置一道防御物理攻击的屏障，但客户目前还无法在已宣布的硬件上评估这道屏障。对于应对篡改，AMD的核心做法很直接：阻止设备启动。⁠1

这些设备于2026年11月12日发布，将一层物理防护纳入自适应计算芯片，而不是把这项工作完全交给周边硬件。目标客户运营着对安全要求极高的系统，涉及国防、关键基础设施、数据中心网络和金融科技等领域——在这些场景中，保护软件和网络连接只是任务的一部分。⁠3⁠1

3款型号已公布的Versal防篡改产品系列 1
2027年下半年预计首批样品推出时间，并非普遍上市时间 1
2028年上半年计划投产时间窗口 1

覆盖硅片背面的屏障

这3款器件——2VE3358TR、2VE3558TR和2VE3858TR——扩展了AMD的Versal AI Edge Series Gen 2系列。它们属于自适应片上系统器件：将处理器与可编程硬件相结合，客户可针对特定应用对后者进行配置。新特点是在硅片背面覆盖了一层防护层，而不只是增加另一项软件安全功能。⁠1

据AMD的设计说明（IT Brief Australia对此进行了报道），一枚基于传感器的防护芯片采用三维有源对有源技术，直接与主计算芯片键合。其设计目的是保护整个背面。如果攻击者篡改或移除这枚防护芯片，设备就会被设计成拒绝启动。因此，这层防护是芯片结构的一部分，而不是围绕芯片的独立外壳。⁠1

这针对的是与入侵者通过网络访问系统不同的一类威胁。拥有物理访问权限的攻击者可以直接攻击硬件本身。运营方目前会组合使用防护外壳、专用芯片和电路板级防护措施来保护敏感信息；这些措施可能增加成本和设计复杂度。AMD提出的方案，是将更多此类防护整合进执行计算任务的设备中。⁠1

集成可能让系统更易构建。但仅凭这一点，并不能证明最终系统比其他设计更便宜或更安全。此次发布没有提供量化的成本节省数据，也没有对完整系统的防护效果进行独立比较。关键不在于是否省掉了某个独立组件，而在于集成式防御能否满足客户实际的威胁模型。

AMD称，这是自适应SoC或基于FPGA的产品中首次内置硅片背面攻击防护。这是该公司针对某一特定防护类别的说法，并不能证明这些器件能够抵御所有物理攻击。这也不意味着此前的Versal产品缺乏安全性：AMD现有的安全文档介绍了针对侧信道攻击、硬件篡改、固件篡改和知识产权盗窃的防御措施。背面防护层是在这一方案基础上的扩展。⁠3⁠7

不止一道防护层

此次公布的安全改进还涉及加密签名、密钥保护和电气故障攻击。AMD表示，将扩大对基于模块格的数字签名算法（Module-Lattice-Based Digital Signature Algorithm，ML-DSA）和无状态哈希基数字签名算法（Stateless Hash-Based Digital Signature Algorithm，SLH-DSA）的硬件加速支持。这些都是后量子数字签名算法；将它们纳入芯片，并不意味着芯片会进行量子计算。数字签名有助于验证真实性。⁠1

混合启动流程支持多种签名算法。AMD还更新了应用安全单元的密钥库，并增加了一个存储器元件老化传感器，旨在为加密密钥再添一道保护。这些是安全方案中各自独立的部分，不能与芯片背面的防护混为一谈。⁠1

故障脉冲检测也将得到增强。故障脉冲攻击会操纵电气条件，以干扰芯片的运行。AMD表示，该设计更新了现有的Versal检测器，并增加了第二个、采用正交原理的检测器，其中包括检测两个电压轨上同时发生的故障脉冲。这是一项具体的能力声明，并不意味着所有可能的电气故障攻击都已消除。⁠1

计算架构仍是这项产品主张的核心。Arm CPU负责通用处理，AI引擎提供专用算术运算，可编程逻辑则让客户能够针对各自的工作负载定制硬件。专用硬件功能和连接能力也集成在同一封装中。这些资源各有不同用途；不应把可编程逻辑容量、处理器性能和AI吞吐量合并为一个分数，也不应将它们误认为是在客户应用中测得的结果。⁠1⁠5

AMD嵌入式业务产品、软件与解决方案企业副总裁柯克·萨班（Kirk Saban）将预期收益描述为：“帮助客户简化安全关键系统的开发，同时保持其应用所需的性能和灵活性”。这就是其商业主张：将防护与强大的计算能力结合起来，减少组装周边设计所需的工作。能否真正简化开发，仍需由客户来检验。⁠1

现在可开发，日后再评估防护效果

在防护硬件问世之前，已有一条开发路径可走。每款计划推出的防篡改型号，在Versal AI Edge Series Gen 2系列中都有一款尺寸兼容的标准型号，且已上市。客户可以先基于这些标准型号开展工作，之后再迁移到防护版本。⁠1

AMD预计，这种过渡所需工作很少，也无需重复综合以及布局布线——这些步骤会将可编程设计转化为芯片上的实际布局。对于开发周期较长的组织而言，这种连续性或许是此次发布中最直接有用的部分。但兼容并不意味着现有标准器件具备新的背面防护；开发应用也不等同于测试这种防护。⁠1

因此，下一个有实际意义的里程碑是送样，而非投产。2027年下半年只是首批器件预计推出的时间窗口，并非固定交付日期，也不是普遍上市的承诺。计划投产时间为2028年上半年。支持此次发布的报道发布时，这两个里程碑都尚未实现。⁠1

现有证据能够证实的是已公布的设计，而非经独立验证的抗物理攻击能力，也不是针对TR的物理安全认证。客户仍需了解这种防护在完整系统中的表现。AMD的构想意义重大，因为它在计算设备内部设置了一道物理屏障。真正的考验在于，这道屏障能否抵御客户实际需要防范的攻击。

来源7

在此处引用的来源中，AMD Newsroom最先发布，比本报道播出早15小时。 随后还有4家媒体发布。
  1. AMD Newsroom
  2. Google News Kenya (KE:en)
  3. IT Brief US
  4. 테크월드
  5. 데이터넷
  6. HeyDay News

2家媒体未注明日期：smbtech.auThe Gate Array

按媒体查看所有来源

来自 7 家媒体的 17 个来源· 引用最多的优先

播出原貌
  1. AMD has designed chips to block startup when attackers tamper with their protective layer.
  2. The planned Versal devices put physical protection inside chips aimed at defence, critical infrastructure, data-centre networking and financial technology. But customers face a wait: AMD expects first samples in the second half of 2027.
  3. How will that built-in barrier work, and when can customers start evaluating it?
  4. AMD announced three tamper-resistant models on November 12, 2026. They extend its Versal AI Edge Series Gen 2 family, combining processing and programmable hardware with an additional protective layer over the silicon backside.
  5. An attacker who reaches the hardware presents a different problem from someone attacking through a network. Operators already use protective enclosures, specialised chips and safeguards on circuit boards to protect sensitive information. Those combinations can add cost and make systems harder to design. AMD wants to move more of that work into the computing device itself.
  6. AMD says a sensor-based protection die bonds directly to the main computing die using three-dimensional active-on-active technology. That layer is designed to shield the entire backside. If someone tampers with it or removes it, the device is designed to refuse to boot.
  7. AMD calls this the first built-in silicon-backside attack protection in adaptive system-on-chip or FPGA-based products. Those are devices with hardware that customers can configure for their applications. Earlier Versal devices already have defences against side-channel attacks, hardware tampering, firmware changes and intellectual-property theft. The backside layer extends that security approach.
  8. Kirk Saban is AMD Embedded’s corporate vice president of product, software and solutions. He says combining physical protection with different kinds of computing in one chip should help customers simplify development while keeping the processing power and flexibility their applications need.
  9. Each planned tamper-resistant model has a standard counterpart already available with a compatible footprint. Customers can begin development on those existing parts, then move to the protected versions. AMD expects that move to take minimal effort and avoid repeating synthesis and place and route, the steps that turn a programmable design into its implemented arrangement.
  10. Subscribe to this channel to follow the customer sampling schedule and evaluation of AMD’s built-in protection.
  11. AMD is also expanding hardware acceleration for post-quantum digital signatures. The announced algorithms are ML-DSA and SLH-DSA. They add another part of the security package alongside a hybrid boot process that allows multiple signature algorithms.
  12. The full names are Module-Lattice-Based Digital Signature Algorithm and Stateless Hash-Based Digital Signature Algorithm. Digital signatures help check authenticity. AMD has also updated the application security unit’s key vault and added a memory element aging sensor intended to give cryptographic keys another safeguard. These changes accompany the physical protection layer.
  13. AMD says the devices can detect glitches occurring simultaneously across two voltage rails. Glitch attacks manipulate electrical conditions to disrupt chip behaviour. The design updates the existing detector and adds a second, orthogonal detector to broaden coverage.
  14. The devices also retain the AI Edge family’s mix of computing resources. Arm processors handle general computing, AI Engines handle specialised arithmetic, and programmable logic lets customers tailor hardware to their workloads. Dedicated hardware functions and connectivity share the package. AMD gives three headline ceilings for those different resources.
  15. AMD advertises up to 229,000 DMIPS of scalar compute, a processor-performance measure. It also gives up to 369 INT8 TOPS for eight-bit AI arithmetic, and up to 543,000 lookup tables, or LUTs, for programmable-logic capacity.
  16. Lookup tables count hardware resources. The other figures describe processing capabilities. These are AMD’s advertised ceilings, and customers shouldn’t assume every model delivers every maximum or that an application will reach them. The practical appeal is having substantial processing alongside the protection, while keeping a development path from existing standard parts.
  17. AMD expects the first samples in the second half of 2027, giving customers hardware to evaluate. Production is planned for the first half of 2028. Both are future windows, and sampling comes before customers can count on production supply.
  18. The protection described so far is AMD’s design claim. Customer testing still has to show how it performs in a complete security-critical system. Developers can work now on compatible standard devices, while evaluation of the announced backside protection awaits the tamper-resistant hardware.

译文更新于

近期播出