Analog security is the protection of the continuous-signal parts of a system, such as sensors, ADCs, PHYs, RF front ends and power management, against tampering, leakage and fault injection. It is becoming urgent for two reasons. Multi-die packages split a design into chiplets whose links can be probed or spoofed, and edge devices increasingly make decisions, and train models, on analog sensor data. Digital security has mature tools; analog security largely does not yet.
Image source: Altium
Key takeaways
- Multi-die systems let analog blocks live on mature, cheaper nodes, which helps analog design but exposes die-to-die links that used to be buried inside one SoC.
- Monolithic SoCs enjoyed a kind of "security by density"; chiplets lose it, so every chiplet link needs authentication and, where it matters, encryption.
- Analog attacks are subtle: fault injection, side channels and sensor spoofing can shift a signal without any digital alarm.
- Defences include roots of trust in each chiplet, authenticated sensor data, on-die attack sensors, redundancy and tamper-aware packaging.
- Standards, EDA tools and verification methods for analog security are still immature, so it is an open field for industry and research.
Why this is coming up now
The shift towards multi-die assemblies and the growing importance of sensor-driven analog data at the edge are spotlighting a critical yet underexplored issue: security in analog circuits.
As the semiconductor industry moves from traditional system-on-chip (SoC) designs to heterogeneous systems-in-package (SiPs) built from 2.5D, 3D and 3.5D architectures, new opportunities and challenges arise for analog integration. These advances loosen the constraints of on-chip real estate and give analog designers more freedom, but they also expose analog circuits to new security weaknesses that have long been overshadowed by digital security concerns.
This article looks at the technical, market and security implications of analog circuits in modern chip design, and at the emerging solutions and future directions.
The evolving role of analog in multi-die systems
Historically, security in SoC designs has been a predominantly digital concern. Digital circuits, particularly in data centres and high-end edge computing, benefit from well-established security measures such as encryption, secure boot and hardware security modules (HSMs).
Analog circuits, by contrast, have been held back by their inability to scale with Moore's Law, which led to their progressive replacement by digital-heavy mixed-signal intellectual property (IP). The limited area in planar SoCs forced analog components to shrink or be replaced, because analog designs do not gain from scaling the way digital transistors do: matching, noise and supply headroom get harder, not easier, at small nodes.
Multi-die assemblies are reshaping this. In SiPs, analog dies can be built on process nodes chosen for their performance rather than being forced onto the leading-edge nodes used for digital logic. For instance, power management units, radio frequency (RF) transceivers or sensor interfaces can be developed on mature nodes (for example 28 nm or 40 nm), where cost and reliability are favourable, and then integrated in one package alongside advanced digital chiplets on 5 nm or 3 nm.
This flexibility reduces development cost and makes it easier to reuse silicon-proven analog IP across designs, which improves time to market and reliability.
The heterogeneous and globally asynchronous nature of SiPs also lets analog circuits run with more independence. In monolithic SoCs, analog signals are often disturbed by noise from densely packed digital transistors. SiPs offer more physical room to isolate analog components, reducing interference and improving performance. The extra area can also hold larger analog dies with more complex functions, such as high-precision sensor interfaces or advanced analog-to-digital converters (ADCs).
The trade-off: more exposure
These advantages come with a trade-off: increased exposure to security risks.
In traditional SoCs, the dense integration of billions of transistors created a form of "security by density": subsystems such as security processors were hard to isolate or target, because their signals ran on internal wires under many metal layers.
Multi-die assemblies split functions into distinct chiplets, so subsystem-to-subsystem traffic becomes more reachable. A security processor chiplet talking to a performance chiplet across the package could be intercepted or tampered with, enabling attacks that were nearly impossible in a monolithic design. That calls for point-to-point security, encryption and authentication, on chiplet-to-chiplet interfaces, because neither side of the link can be trusted by default.
| Aspect | Monolithic SoC | Multi-die SiP |
|---|---|---|
| Analog process node | Same as digital, often leading edge | Chosen per die, often mature (28 to 40 nm) |
| Noise isolation | Hard, digital noise couples into analog | Easier, physical separation between dies |
| Internal links | Buried wires, hard to probe | Die-to-die links, easier to reach |
| Trust model | One vendor, one die | Several dies, possibly several vendors |
| Security need | Mainly at chip boundary | At every chiplet boundary |
Security challenges in analog circuits
The security challenges in analog circuits span physical, electrical and system-level weaknesses. Digital circuits work with discrete binary states, whereas analog circuits process continuous signals, so they are open to small manipulations that can go unnoticed. The key areas of concern are below.
1. Physical layer weaknesses
The physical interfaces that move and convert analog data, such as SerDes (serialiser/deserialiser) PHYs, ADCs and RF transceivers, are prime targets. Thermal fuzzing (heating a chip to change its behaviour), electromagnetic fault injection or laser attacks can distort analog signals, leading to wrong data or malfunction. A small shift in a SerDes eye, like the one shown in the image above, can raise the bit error rate without tripping any digital check.
In safety-critical uses such as automotive or aerospace, such distortions could have catastrophic consequences, for example misreading sensor data used for autonomous driving or navigation.
2. Side-channel attacks
Analog circuits are particularly exposed to side-channel attacks, in which an attacker uses physical characteristics such as power draw, electromagnetic emissions or timing variation to extract cryptographic keys or other secrets. In multi-die systems, exposed chiplet interfaces add to this risk, because inter-chiplet traffic is easier to probe than signals inside one SoC.
3. Sensor degradation and fault injection
Sensors, which are inherently analog, are central to edge applications, particularly AI-driven systems for automotive, industrial and IoT use. Analog sensors degrade over time through noise, hot carrier effects or bias drift, which reduces their precision and can make them more open to fault injection.
For example, an attacker could inject a voltage or clock glitch to skip an authentication step in secure boot, allowing unauthorised code to run. To counter this, sensors often need recalibration or redundancy, but those measures add cost and power, a real trade-off in constrained designs.
4. Counterfeit chiplets in open marketplaces
As the chiplet ecosystem develops, third-party chiplets are expected to multiply, creating an open marketplace. That encourages innovation and lowers cost, but it also brings the risk of counterfeit or malicious chiplets. A bad actor could design a chiplet that appears functional but contains backdoors or weaknesses, compromising the whole system.
Building resistance to side-channel attacks and proving chiplet authenticity are both essential for a workable chiplet era.
| Threat | Typical target | Example effect | Typical counter |
|---|---|---|---|
| Fault injection (voltage, clock, EM, laser) | Secure boot, crypto engines, ADCs | Skipped check, corrupted result | Glitch and light detectors, redundant checks |
| Side channels (power, EM, timing) | Crypto cores, die-to-die links | Key extraction | Masking, constant-time logic, supply filtering |
| Thermal fuzzing | References, oscillators, sensors | Drifted thresholds or timing | Temperature monitors, safe-state on out-of-range |
| Sensor spoofing | Cameras, radar, MEMS, ADC inputs | False readings accepted as true | Authenticated sensor data, plausibility checks |
| Counterfeit or malicious chiplet | Package assembly, supply chain | Backdoor inside the package | Per-chiplet identity and attestation |
Analog security at the edge
AI and machine learning (ML) at the edge raise the stakes further. Edge devices such as autonomous vehicles, smart sensors and IoT nodes rely heavily on analog sensor data to interact with the physical world. That data is increasingly valuable, not only for real-time decisions but also for training ML models. Securing it needs a change in how analog circuits are designed and protected.
One approach is to make sensors smarter by giving them cryptographic capability. For the best outcome, sensors should authenticate their data so that it can be checked when it is used. This targets the classic time-of-check to time-of-use (TOCTOU) gap: a reading that was valid when it was captured must still be the same reading when the system acts on it, which prevents tampering or spoofing in between.
Similarly, ML models stored in external flash and executed in place (XIP) must be authenticated, and decrypted where they are confidential, at run time to keep the system's integrity.
Another strategy uses analog sensors to watch the security of the system itself. Voltage, temperature, electromagnetic and light sensors can detect signs of attack, such as decapping a chip or injecting faults. These sensors bring a recursive problem: how do you secure the sensors that protect the system? Their integrity depends on robust design practice, such as tamper-resistant layout and secure calibration.
Emerging solutions and future directions
Addressing analog security in multi-die systems and edge applications needs hardware, software and system-level work together. Promising approaches include the following.
1. Hardware security modules for analog chiplets
Integrating HSMs, or a smaller root of trust, into analog chiplets can give each one a unique identity and cryptographic functions, enabling authentication and secure communication. This approach, advocated by Synopsys' Koeter (as reported at the time), means each chiplet, analog or digital, can be trusted within the system. Industry efforts such as the DMTF SPDM protocol for device authentication and the open-source Caliptra root of trust show the direction digital silicon is taking; analog chiplets need equivalents sized for their area and power budgets.
2. Polymorphic analog circuits
Research into polymorphic circuits, such as work funded by DARPA, offers a different way to strengthen analog security. A polymorphic circuit changes its function depending on operating conditions, such as supply voltage, which makes it hard to reverse-engineer or to attack through side channels. As an example of the idea, a circuit could perform AES encryption at 1.5 V and SHA hashing at 1.2 V; its behaviour then depends on dynamic conditions an attacker may not see.
3. System-level security management
Treating each chiplet as a standalone, secure subsystem is central to multi-die security. A central system chiplet can act as the security manager, coordinating authentication, encryption and monitoring across the package. This supports "security islands", where chiplets run at different trust levels, which improves resilience.
4. Advanced packaging for security
Advanced packaging such as 2.5D interposers or 3D stacking can itself help security. Embedding secure interconnects or tamper-detection meshes within the package can protect chiplet-to-chiplet traffic, and 3D stacking can bury sensitive links between dies where probing is harder. As packaging costs fall, more heterogeneous integration of analog components, such as RF or sensor chiplets, will become practical.
5. Redundancy and monitoring
In safety-critical applications, redundant analog sensors and continuous monitoring reduce risk. Aging monitors can adjust operation as sensors degrade, while environmental sensors (for temperature or light, for example) can detect physical attacks. These measures must still balance security against cost and power.
A worked example: one sensor, three layers of defence (illustrative)
Consider a radar chiplet feeding an ADAS processor chiplet in one package. An illustrative defence plan might look like this:
- Identity. At power-up the processor challenges the radar chiplet, which answers using a key held in its own small root of trust. A counterfeit chiplet without the key fails here.
- Data integrity. Each radar frame carries a message authentication code and a counter, so a replayed or altered frame is rejected even if the link is probed.
- Physical monitoring. Supply glitch and temperature detectors on the radar die flag out-of-range conditions; frames captured during an alarm are marked untrusted and the system falls back to a safe state.
Each layer costs area, power and latency. A frame MAC on every capture, for instance, adds a few cycles of latency and some logic on a die that may be on 40 nm, so architects have to decide which data really needs it. That is the analog security trade-off in miniature.
Implications for industry and research
The growing role of analog circuits in multi-die systems and edge applications has wide implications for the semiconductor industry.
Chipmakers need to invest in analog security research, because a focus on digital security alone is not enough for heterogeneous designs. That includes new design methods, EDA tools for analog security analysis, and standards for chiplet interoperability and authentication.
The open chiplet marketplace, while promising, needs robust ways to keep out counterfeit or malicious chiplets. Industry consortia such as the Universal Chiplet Interconnect Express (UCIe) consortium could play a role in defining security requirements for chiplet-based systems. Collaboration between analog and digital design teams is also essential, so that security is handled across the whole system rather than domain by domain.
For researchers, analog security is a rich field. Side-channel-resistant analog design, fault-tolerant sensor architectures and secure analog-digital interfaces all need more work. Government-funded initiatives, such as DARPA's work on asynchronous and polymorphic circuits, could speed progress.
Common mistakes in design reviews
- Assuming the package boundary is the trust boundary. In a multi-vendor SiP, every die-to-die link is a boundary.
- Securing the digital controller of a sensor but trusting the raw analog front end without plausibility checks.
- Adding attack detectors without a defined response. A detector that only sets a status bit nobody reads adds cost and no protection.
- Leaving the security sensors themselves uncalibrated or unmonitored, so an attacker can disable the guard first.
FAQ
What is analog security in chip design?
Protecting the analog and mixed-signal parts of a chip, such as sensors, converters, PHYs, clocks and power circuits, against manipulation, leakage and fault injection, not just the digital logic.
Why are chiplets harder to secure than a monolithic SoC?
Their links run between dies and may be easier to probe, and the dies may come from different suppliers, so each one has to prove who it is and protect what it sends.
How do you protect sensor data at the edge?
Authenticate data close to the sensor, check it again when it is used, monitor supply, temperature and light for signs of attack, and use redundancy where safety depends on the reading.
Is there a standard for chiplet security?
Not a complete one for analog chiplets. Device authentication protocols and open roots of trust exist on the digital side, and chiplet consortia such as UCIe are the natural place for further work.
Conclusion
The move to multi-die assemblies and the rising value of analog data at the edge are pushing analog security to the front of semiconductor design. Multi-die systems allow more flexibility and reuse of analog components, but they also expose analog circuits to new weaknesses, from physical attacks to side-channel exploits. At the edge, the reliance on analog sensors for AI and IoT applications makes securing analog data and processing a requirement.
By integrating hardware security modules, exploring polymorphic circuits and adopting system-level security management, the industry can address these challenges. That needs a concerted effort to advance analog security research, develop new design tools and establish industry standards. As analog and digital domains converge in multi-die systems, securing both is critical to the next generation of electronics. The stakes are highest in safety-critical applications such as automotive and aerospace, where secure analog circuits are not only a technical requirement but a matter of life and death.
Your comments will be moderated before it appears here.