SemiconductorX > Chip Types > Compute & Logic > Security Silicon
Security Silicon
Security silicon provides hardware-enforced roots of trust, cryptographic acceleration, tamper resistance, and secure key storage — functions that software alone cannot guarantee against a physical adversary. Unlike most semiconductor categories where the primary competitive dimension is performance or power efficiency, security silicon competes on certification: a TPM 2.0 chip without Common Criteria EAL4+ certification cannot be used in enterprise PC platforms, and a secure element without EMVCo certification cannot be embedded in a payment card regardless of its technical capability. This certification dependency creates qualification lock-in that structurally resembles AEC-Q100 for automotive MCUs — changing security silicon vendors requires re-certification of the platform, not just re-qualification of the device.
The security silicon market is smaller in revenue than any other Compute & Logic sub-segment, but its strategic importance exceeds its size. Every server platform ships with a TPM 2.0. Every payment card embeds a secure element. Every enterprise laptop requires a TPM for Windows 11 bitlocker and remote attestation. Every hyperscaler data center deploys custom security ASICs (AWS Nitro, Google Titan) to enforce tenant isolation. And every connected vehicle faces UN Regulation No. 155 (UNECE WP.29) cybersecurity management system requirements that are driving new security IC design-in across automotive ECU architectures.
Security Silicon Families — Products & Process
| Category / family | Flagship products | Process node | Supplier & market position |
|---|---|---|---|
| TPM 2.0 (Trusted Platform Modules) | Infineon OPTIGA TPM SLB9670/SLB9672 (dominant PC/server TPM); STMicro ST33KTPM2XSPI; Nuvoton NPCT650 (budget tier); Microchip ATECC608B (IoT crypto coprocessor, TPM-adjacent) | 40–90nm; security silicon prioritizes side-channel attack resistance and tamper-proof physical design over transistor density; older nodes provide better established certification history | Infineon dominant (SLB9670 is near-standard in enterprise PC and server TPM slot); STMicro second; Nuvoton budget; Microsoft Windows 11 mandatory TPM 2.0 requirement expanded market from enterprise to consumer PC |
| HSM (Hardware Security Modules) | Thales Luna Network HSM 7 (banking and PKI infrastructure); Entrust nShield (enterprise key management); Utimaco SecurityServer; AWS CloudHSM (cloud-hosted, custom ASIC backend) | Appliance-level products — FIPS 140-3 Level 3/4 certified; internal ASIC varies by vendor; not a discrete chip market — HSM is a certified appliance containing proprietary security ASIC | Thales (Gemalto acquisition); Entrust; Utimaco; AWS CloudHSM; deployed in banking, payment network PKI (Visa, Mastercard), certificate authorities, and enterprise key management; regulatory requirement in financial services globally |
| Secure Elements (SE) | NXP EdgeLock SE050 (IoT device identity, CC EAL6+); NXP SE051 (FIPS 140-2 Level 3); Infineon SLM76 (payment card SE); STMicro STSAFE-A110 (IoT/industrial); Microchip ATECC608A (lightweight SE) | 40–90nm; tamper mesh, active shielding, and physical security features are process-independent — security architecture matters more than node | NXP dominant in IoT SE (EdgeLock); Infineon dominant in payment card SE (SLM76, SLE97); STMicro strong in industrial IoT; Microchip ATECC608 in maker/IoT ecosystem; EMVCo certification required for payment applications |
| Root of Trust IP (embedded in SoC) | Apple Secure Enclave (embedded in every A/M-series SoC); Arm TrustZone (IP licensed by Arm, deployed in billions of Cortex-A/M devices); Arm CryptoIsland-300 (RoT IP for IoT SoC); Rambus CryptoManager RT-130 | Co-fabricated on host SoC node — N3 for Apple Secure Enclave in A18 Pro; mature node for Arm TrustZone in MCU/SoC; process node follows the host die | Apple (captive Secure Enclave, most advanced embedded RoT in consumer silicon); Arm (TrustZone IP licensing — in virtually every smartphone and IoT device with Cortex core); Rambus, Synopsys (RoT IP for third-party SoC designers) |
| eSIM / eUICC | Infineon SLx9635 eSIM (automotive telematics); STMicro ST33G1M2 eUICC; Giesecke+Devrient eSIM OS (software on top of SE silicon); Kigen OS (Arm eSIM OS platform) | 40–65nm SE process; GSMA SGP.02/SGP.22 specification compliance required; M2M eSIM (SGP.02) for automotive and industrial, consumer eSIM (SGP.22) for smartphones | Infineon, STMicro, NXP (silicon); Arm Kigen (OS/platform); eSIM adoption accelerating in automotive telematics (every new connected vehicle requires M2M eSIM for OTA update and telematics SIM management) |
| Automotive Cybersecurity ICs | NXP SE050 automotive variant (AEC-Q100, in-vehicle secure element); Infineon AURIX TC3xx HSM core (on-chip hardware security module integrated in safety MCU); Microchip CEC1736 (automotive HSM standalone) | 28–40nm AEC-Q100 qualified; UNECE WP.29 / UN-R 155 compliance driving new automotive cybersecurity IC design-in; ISO/SAE 21434 as the automotive cybersecurity engineering standard | NXP and Infineon dominant; automotive cybersecurity IC is a nascent but fast-growing market as regulatory mandates (UN-R 155 in force for new vehicle types in Europe from 2022, all vehicles from 2024) require documented cybersecurity management systems with hardware enforcement |
| Hyperscaler Custom Security ASICs | AWS Nitro Security Chip (custom ASIC in every EC2 instance, enforces hypervisor isolation and secure boot); Google Titan M2 (Pixel devices + data center); Microsoft Pluton (embedded in AMD EPYC and Intel Xeon via IP integration) | Mature node (40–65nm for security-optimized process); captive designs — not merchant silicon | AWS (Nitro captive); Google (Titan captive); Microsoft (Pluton IP, licensed to AMD and Intel for integration); hyperscaler custom security silicon represents the highest-trust tier of cloud infrastructure — physically enforced tenant isolation at the silicon level |
Deployment & Supply Chain Risk
| Category | Focus sector deployment | Primary supply chain risk |
|---|---|---|
| TPM 2.0 | Enterprise PC and laptop (Windows 11 mandatory); server platform (every x86 server shipped); AI inference server secure boot; smart infrastructure device attestation | Infineon near-monopoly in enterprise TPM slot; CC EAL4+ certification re-qualification required for new device; Windows 11 rollout created demand surge that exposed TPM supply concentration |
| Secure Elements | IoT device identity (NXP EdgeLock in industrial and connected device); payment card (Infineon SLM76); EV charging station authentication; smart meter tamper detection | EMVCo / CC certification lock-in; NXP and Infineon duopoly in high-assurance SE; payment card SE supply tied to bank card issuance cycles |
| Automotive Cybersecurity ICs | UN-R 155 compliance in every new vehicle type sold in Europe, Japan, Korea; EV OTA update integrity; V2X communication authentication; in-vehicle network (CAN/Ethernet) security | AEC-Q100 qualification combined with ISO/SAE 21434 certification creates a two-dimensional qualification burden; nascent supply base — few qualified automotive cybersecurity IC options vs demand growth driven by regulation |
| Hyperscaler Custom Security | AWS EC2 instance isolation (Nitro); Google Pixel and datacenter trust anchor (Titan); Microsoft Azure VM attestation (Pluton via AMD/Intel integration) | Captive — not externally procurable; design team concentration risk; supply is internal to each hyperscaler's silicon program and not visible to market |
Certification Lock-In — The Security Silicon Paradox
Security silicon faces a qualification paradox that is structurally more severe than automotive MCU AEC-Q100 lock-in. An automotive OEM replacing a qualified MCU must re-run electrical and environmental qualification — a 12–24 month process. A platform designer replacing a certified TPM or secure element must re-run the full Common Criteria evaluation for the new device, re-qualify the platform's cryptographic key management protocols, and in many cases re-certify the platform itself under FIPS 140-3 or payment card PCI DSS requirements. The total timeline is 18–36 months and the cost includes both the device certification ($500K–$2M for CC EAL5+) and the platform re-certification effort.
This creates a near-permanent lock-in once a security IC is certified and deployed at scale. Infineon's OPTIGA TPM dominance in enterprise PC is not primarily the result of performance advantage — it is the result of decades of certification history and platform integration that makes switching economically irrational for any OEM with an existing qualified platform. The same dynamic applies to NXP's EdgeLock in industrial IoT and Infineon's SLM76 in payment cards.
Supply Chain Bottlenecks
| Bottleneck | Affects | Severity |
|---|---|---|
| CC / FIPS certification lock-in | All security silicon procurement decisions; 18–36 month re-certification for platform redesign | Structural — more severe than AEC-Q100; switching cost is financial and temporal and regulatory simultaneously |
| Infineon TPM near-monopoly in enterprise PC | Enterprise PC and server platform TPM supply; demonstrated during Windows 11 TPM demand surge | High — Windows 11 requirement elevated TPM from enterprise to consumer, exposing concentration in a single-supplier slot |
| Automotive cybersecurity IC supply base nascency | UN-R 155 compliance across all new vehicle platforms in EU, Japan, Korea from 2024 | Medium-High — regulatory demand is mandatory and on a fixed timeline; qualified supplier count is low relative to the design-in volume required across the global automotive supply chain |
| Mature node capacity for security process | TPM, SE, automotive security IC — all at 40–90nm with security-specific process modifications | Medium — 200mm fab capacity ceiling applies; security-specific process (tamper mesh, active shield layers) limits which fabs can run security IC process |
Related Coverage
Compute & Logic Hub | Mature Node MCUs — The $2 Chip Paradox | SoCs | ASICs | Semiconductor Bottleneck Atlas
Cross-Network — ElectronsX Demand Side
UN-R 155 automotive cybersecurity mandates are creating a new mandatory design-in of automotive security ICs across every new vehicle platform sold in regulated markets — a direct EV and AV supply chain dependency. EV charging station authentication, smart meter tamper detection, and smart grid substation cybersecurity all require hardware-level security enforcement that drives security IC demand across the electrification infrastructure stack.
EX: EV Semiconductor Dependencies | EX: ADAS/AV Compute Architecture