Securing the
RISC‑V revolution
SiFive Shield
An Open, Scalable Platform Architecture for Security
The SiFive® Shield™ solution is an open, scalable platform architecture designed to enable system-level security of RISC-V SoCs and thus, by offering multiple layers of security, to address different threats. SiFive Shield and WorldGuard enable a scalable architecture with the ability to offer greater isolation.
WorldGuard
WorldGuard is a fine-grain security model for isolated code execution and data protection. WorldGuard offers SoC-level information control with advanced isolation control, based on multiple levels of privilege per world, and an unlimited amount of worlds. WorldGuard offers multi-domain security, to offer data protection for core, cache, interconnect, peripheral, and memory.
In addition to the RISC-V Physical Memory Protection (PMP) that provides memory isolation for code and data manipulated by the CPU, WorldGuard expands hardware isolation to the whole SoC in order to protect caches, interconnects, arbitrary bus masters, memories and peripherals. A wgMarker, adds a World ID to all transactions that are issued by that particular CPU core. This additional bit of metadata is then propagated through the interconnect down to peripherals and memories where access controls are enforced. Feature-rich OS, applications, and Trusted Execution Environments (TEE) can be isolated and protected inside a high-performance multi-core system.
Threat Prevention
Secure SoC design is enabled by accurate threat modeling. Inside an SoC, the flow of information for processing requires an array of technologies. To deter physical tamper attacks, fault detectors for the SoC ensure that operation continues as intended. Physical Memory Protection (PMP) and Physical Memory Attributes (PMA) are supported in the RISC-V ISA and leveraged by SiFive Shield to set limitations on memory ranges and memory-mapped peripherals by privilege, enabling scalable domain security.
SiFive Shield builds on the open and freely available RISC-V ISA, enabling a new approach to security that can scale.
Verified Crypto-Engines
The SiFive Shield architecture includes both RISC-V vector crypto extensions for high-throughput AES and SHA operations but also a dedicated AES cryptographic engine that is protected against SPA/DPA/EMA attacks and that offers block cipher and authenticated encryption support. Secure hash like SHA-2 and public Key cryptography such as ECDSA are also offered. In addition, a 100% digital NIST SP 800-90A/B/C compliant true random number generator (TRNG) enables cryptographic or entropy-based secure features.