| Despite the implementation of a counterfeit-avoidance strategy of purchasing directly from a semiconductor manufacturer, counterfeit chips continue to enter the semiconductor system of systems, thereby threatening the security and integrity of the trusted system. A compromise of a semiconductor chip, depending on the chip's application, has the potential to cause national security damage, the failure of a component or product, and/or health and safety hazards. This research presents a mathematical model of supply-chain risk developed from an analysis of how vulnerabilities, if exploited, increases the risk of supply chain integrity being compromised. The model presented is developed based on a case study of an actual supply chain compromise involving the complex behavior of a malicious insider operating within a semiconductor supply and demand chain system. A critical finding of this work is that the most important vulnerability of a supply chain is a malicious insider. This novel finding is important because prior research assumes that any breakdown in supply chain integrity originates outside of the trusted partners of the semiconductor supply and demand chain system. Another unique finding is that the semiconductor industry's recommended counterfeit-avoidance strategy has the unintended consequence of increasing, rather than reducing, the risk of counterfeit chips entering the semiconductor supply and demand chain. Based on the results, an anti-counterfeiting security protocol is proposed to improve security and to complement existing counterfeit-risk programs. |
