[BOM 2] Supply-Chain Threats Aimed at Infrastructure...Need to Secure an HBOM System
IT DAILY ·
✦ AI Summary
As supply-chain security discussions in the AI era expand beyond data and models (AI-BOM) to the hardware infrastructure layer, the need for HBOM is coming into focus.
HBOM is a system for managing the history of physical parts and information such as manufacturers, manufacturing locations, part numbers, and firmware for servers, storage, and network equipment.
For public institutions and major infrastructure, there are calls for an institutional foundation that can verify whether documents match physical equipment and secure audit authority and accountability.
As discussions of supply-chain security in the AI era expand beyond software code to data and models (AI-BOM), the need to also inspect the supply chains of the hardware infrastructure layers that actually run them is coming into focus.
The topic of this article is the need to secure an HBOM system to counter supply-chain threats targeting infrastructure. As the scope of supply-chain security expands to include the data and model domain represented by AI-BOM, the need to inspect the supply chains of hardware infrastructure layers is also growing.
Against this backdrop, the hardware bill of materials (HBOM) is emerging as a way to transparently manage the history of physical parts in server and storage equipment. HBOM is drawing attention as a system for managing the history of physical components used in the base equipment of AI data centers and enterprise infrastructure.
The purpose of HBOM is to inspect the supply chain of physical hardware layers such as servers, storage, and network equipment. AI-BOM, by contrast, is about transparency in data and models.
Hardware equipment for AI data centers and enterprise infrastructure is built not only around the main processor (CPU and GPU) but also a large number of semiconductor chips and components. That has raised the need to examine the supply chain of hardware components as a whole.
Examples of additional components include power management chips, network controllers, and remote-control chips. That is why the need for HBOM has been raised as a system for inspecting the supply chain of the physical hardware layer, including these parts.
Some parts in the manufacturing and distribution process can be mixed with counterfeit components, and parts with malicious functions can also be introduced. When such components are introduced, there is a risk of internal information leakage regardless of upstream software security, and remote servers could be disabled. These problems are severe, exceed the scope of corporate security, and are issues that may be linked to national security.
These problems are also tied to the hardware industry's multi-tier subcontracted manufacturing structure and the complex global distribution network for hardware. It is difficult to fully guarantee the safety of individual chipsets on internal boards based on appearance alone, and it is also difficult to fully guarantee that safety based only on standard delivery documents. That makes it important to use hardware from trusted vendors, but trusted vendor hardware alone is not enough.
For this reason, the need for HBOM is growing. HBOM should record the manufacturer and manufacturing location of internal components, part numbers, and firmware information, and this information needs to be disclosed transparently. The disclosed information serves as a starting point for verification, and based on it, capabilities for physical verification and legal audit rights are also needed.
The HBOM debate is connected to the sovereign AI perspective emphasized in South Korea. Alongside introducing trustworthy hardware, another important factor is whether there is a system in place that can independently verify issues and hold parties accountable when HBOM-related problems arise.
In particular, hardware supply-chain security incidents can occur in major national infrastructure such as public institutions, defense, and finance. If the entity verifying the incident is only an overseas manufacturer or an overseas institution rather than a domestic operator, there are practical limits to post-incident response and accountability.
Industry officials say there are two practical tasks needed to ensure the effectiveness of HBOM from a sovereign AI perspective. The first is technical verification capability that can confirm whether documents and physical products match.
If one relies only on the HBOM documents prepared and submitted by a hardware supplier, it is impossible to verify whether the internal components and firmware of the equipment actually delivered match the specifications.
Critics say that without domestic self-verification infrastructure and specialized firms, dependence on documentation provided by foreign suppliers becomes unavoidable. Accordingly, there is growing concern that the country needs the ability to compare written specifications with actual physical equipment, as well as the ability to verify firmware integrity.
It is noted that physical equipment delivered to South Korea can be disassembled and analyzed domestically for verification. This means verification is possible even without cooperation from overseas headquarters or downstream suppliers. However, it is also pointed out that board-level comparison and firmware analysis alone have limits in fully identifying tampering at the chip level.
Questions of legal jurisdiction and audit authority are also being raised. If a hardware security issue occurs with imported equipment, domestic institutions would have difficulty forcing direct on-site investigations against overseas headquarters or downstream component suppliers located in third countries. Overseas manufacturers may also try to shift blame to secondary or tertiary downstream supply chains. In addition, there may be constraints in clearly identifying the technical cause when dealing with local subsidiaries that only handle sales, and there may also be limits to legal and administrative accountability.
For that reason, analysts say this is linked to the need to require BOM submission at the contract stage for public and major infrastructure procurement. They also say it should be tied to the issue of compelling audit cooperation and forcing accountability when an incident occurs.
For supply-chain management in the AI era to be effective, AI-BOM and HBOM need to work together. In this framework, AI-BOM plays the role of verifying the source of training data and usage conditions, while HBOM verifies the reliability of physical infrastructure. This perspective is closely tied to the active debate in South Korea over developing domestic AI models and expanding data centers, and it leads to the task of establishing an institutional foundation that can independently verify BOM information, along with managing BOM information across data and hardware.
Source: IT DAILY · Kwon Young-seok
Original: https://www.itdaily.kr/news/articleView.html?idxno=242313
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.