In-silicon enforcement

Putting a security control on hardware that is separate from the machine it governs, so that compromising the machine does not reach the control. The defining property is not the silicon — it is that the enforcement point and the enforced system fail independently.

The problem it answers

Host-based defence has one structural weakness, and it has never been fixed by making the host-based defence better: the sensor is a program on the box. An endpoint agent, an audit daemon, a hardened sysctl setting and a local firewall rule are all objects an attacker with sufficient privilege can read, disable or lie to. Every telemetry stream a SOC consumes from an endpoint is, at the limit, testimony from a witness the attacker may already control.

Moving the control off the host changes what an attacker has to do. Out-of-band management, hardware roots of trust and TPM-backed attestation are older instances of the same idea, mostly at boot time. DOCA on BlueField is the corpus’s example of it applied continuously at runtime: threat detection by reading host memory from outside, file authorization evaluated in the storage path, firewalling in the network card’s own execution domain.

What the pattern buys, and what it costs

Buys: independence of failure. A kernel-level compromise does not by itself grant the ability to edit the policy, silence the sensor, or forge the evidence, because none of those live in the address space that was taken.

Costs, in the order they bite:

1. The trust does not vanish, it moves. The operator now depends on firmware they cannot audit, usually from a single vendor, often present in every node. A defect there is a defect everywhere, and the customer has no independent way to check the enforcement point’s own integrity.
2. Introspection needs a model of the thing it watches. Reading another system’s memory means knowing that system’s layout — kernel version, structure offsets. The coupling is real even though the isolation is real, and it breaks on upgrades the vendor has not mapped.
3. Visibility is not judgement. Detecting from outside still produces alerts, and the alerts still land in the same queue with the same volume problem.

Relation to the spoke’s other layers

Not a fifth layer. It is a placement decision that can be applied to several of them: the same control, moved off the protected system. zero-trust argues about how finely a request should be authorized; in-silicon enforcement argues about where the authorizing code runs — the two are orthogonal, and DOCA Vault does both at once (per-file-request, in the card).

The corpus holds exactly one source on this, and it is the vendor’s own (T3). No independent evaluation, no failure account, and nothing at all on the DPU-as-attack-surface question is held here.