DARPA Effort Embeds Security Into Chip Designs
by 
The final Defense Federal Acquisition Regulation Supplement (DFARS) rule regarding the sourcing of electronic components is being viewed favorably by advocates of the authorized supply chain. The rule, issued August 2, incorporates language suggested by the Electronic Components Industry Association (ECIA) and other industry groups that clarifies terms, such as “authorized dealer” and “trusted supplier;” and issues, such as traceability and flow-down requirements.
According to ECIA, the term “authorized dealer” was deleted in the latest rule and replaced with the term “authorized supplier.” Authorized supplier means a supplier, distributor, or an aftermarket manufacturer with a contractual arrangement with, or express written authority of, the original manufacturer or current design activity to buy, stock, repackage, sell or distribute the part. The term “trusted supplier” was deleted and replaced with the term “contractor-approved supplier.” Contractor-approved supplier means a supplier that does not have a contractual agreement with the original component manufacturer for a transaction, but has been identified as trustworthy by a contractor or subcontractor.
The rule also establishes a strict, three-tiered approach to the procurement of electronics parts; it provides that the contractor is responsible for inspection, testing and authentication if the contractor cannot establish traceability from the original manufacturer for a specific part; and it clarifies that the flow-down requirements do not apply to the original component manufacturer.
Clarification in the DFARS rule has been necessary due to the way the Department of Defense (DoD) procures electronic components. Because the lifespan of military and aerospace equipment exceeds some of the components used in these systems the DoD needs access to end-of-life (EOL) components. When a component maker ceases to manufacture a part (rendering it EOL) it often places the remaining inventory of that part up for sale. Authorized distributors often avoid buying inventory that may not sell. Unauthorized distributors are often willing to take that risk and buy and sell EOL devices.
Counterfeit components have been known to enter the supply chain though unauthorized sources and parts have failed in mission-critical applications. To protect their brand and reputation component makers will only guarantee parts that are sold through authorized distribution. However, many DoD contractors claim they cannot buy the EOL parts they need through the authorized channel and therefore turn to unauthorized sources. The authorized channel protects itself from counterfeit-component transactions by distinguishing itself from unauthorized sources.
"[DFARS] isn't perfect, but we believe that the DoD listened to the industry and we think this rule goes a long way toward making it clear that all DoD contractors and subcontractors at all tiers are responsible for detecting and avoiding counterfeit electronic parts,” said Robin Gray, COO and general counsel for ECIA. The DoD also determined that commercial items (COTS) are not exempt from the applicability of this rule, he said. "The final rule is a clear affirmation by the DoD of the importance of procuring parts from authorized sources. It reflects the years of effort by NEDA, and subsequently by ECIA, to promote the advantages of the authorized supply chain."
ECIA submitted comments in response to the proposed rule (DFARS Case 2014-D005) focused on five main areas: 1) use and definition of the terms “authorized dealer” and 2) “trusted supplier;” 3) procurement policy; 4) traceability; and 5) flow down requirements. Traceability pertains to customers’ ability to track a device back to the original component maker’s (OCM) factory; and flow-down addresses how compliance to the DFARS regulation is passed through the supply chain.
These clarifications have been a long time in coming, Gray added. The National Defense Authorization Act (NDAA) of 2012 required the DoD promulgate rules pertaining to anti-counterfeiting. Semiconductor manufacturers, standards bodies and industry associations all had been working separately to clarify language in the NDAA/DFARS. The ECIA, which represents all types of component manufacturers and their distributors, in conjunction with several semiconductor industry associations, finally succeeded.
Related posts
