The move
Design the enclosure, not the chip
By protocol, the hardware distributor designs a tamper-responsive HSM enclosure around commodity compute — rather than trying to make the chipsets themselves secure. The root of trust moves from silicon nobody can audit to a boundary anyone can inspect.
Why does that matter? Because a physical enclosure is transparent and verifiable by ordinary users. Anyone can understand that a hard, sealed box is expensive to break into, and that breaching it zeroizes the keys. You can see it, weigh it, test it. The security is a property of the object in your hands.
Why not the chip
Silicon trust is unverifiable — and keeps failing
The opposite model — trusting the chip (TEEs, secure enclaves) — is impossible for a user to verify. You cannot prove the absence of side-channel attacks at the silicon level. "Trust us, the die is secure" is a claim you have no way to check.
History is not kind to that claim. Meltdown and Spectre turned speculative execution into a data-exfiltration channel across a whole generation of CPUs. The steady drip of TEE and enclave breaks — Intel SGX among them — has continued for years. Each one was invisible until researchers found it, which is exactly the point: silicon security fails silently, and you never had a way to see it coming.
- You can see it, weigh it, probe it.
- "Hard to open" is a physical fact you can test.
- Breach triggers zeroization — keys gone.
- The boundary is the thing you're trusting.
- You cannot inspect the die.
- Absence of side-channels is unprovable.
- Meltdown, Spectre, SGX breaks — invisible until found.
- Failures are silent; you never see them coming.
So Noolog moves the root of trust to a boundary users can actually reason about: the enclosure.
The cost myth
The physics is cheap. The paperwork is expensive.
Real HSMs today live almost exclusively in banking infrastructure — cold-wallet vaults — and are wildly overpriced, often thousands of dollars a unit. That price tag has convinced everyone that strong physical security is intrinsically expensive. It isn't.
Academic research shows that high-assurance, tamper-responsive enclosures with the physical properties intended by EN ISO/IEC 19790 Level 4 / FIPS 140-2 Level 4 / GM/T 0028-2024 can be built from low-cost, off-the-shelf parts. The barrier isn't physics — it's manufacturing fine-litho meshes and clearing certification bureaucracy.
Tamper-responsive enclosure, coarse mesh, MEMS sensing, zeroization circuit — buildable from commodity parts.
Docs, supply-chain audit, accredited-lab testing, entropy guarantees. This — not the physics — is what costs.
The headline result
Spin a cheap mesh instead of buying an expensive one
The work to cite is Götte & Scheuermann (2021), "Can't Touch This: Inertial HSMs Thwart Advanced Physical Attacks." Instead of an expensive fine stationary mesh, an Inertial HSM (IHSM) spins a coarse, cheap PCB mesh fast around the payload. A sub-$20 automotive high-g MEMS accelerometer detects an attacker slowing the rotation to drill or laser through — and triggers key zeroization in microseconds.
The prototype was built from off-the-shelf parts in a lockdown, and the authors open-sourced the schematics, PCB, CAD and firmware, claiming security comparable to commercial HSMs. Cheap parts, coarse mesh, motion as the sensor — a fundamentally different cost curve.
Götte, J. S. & Scheuermann, B. (2021) — "Can't Touch This: Inertial HSMs Thwart Advanced Physical Attacks", arXiv:2111.02391.
There's also the cheaper classic-mesh path — no spinning required. Standard low-cost rigid or flexible FR-4 PCB meshes are monitored by TDR (Time-Domain Reflectometry) or PUF principles: instead of checking mere electrical continuity, they measure an impedance / capacitance / reflection fingerprint. Even a microscopic drill hole changes that fingerprint and trips the alarm.
Coarse cheap mesh spun fast; a <$20 high-g MEMS accelerometer catches an attacker slowing it to drill. Zeroizes in microseconds.
Low-cost FR-4 mesh watched by Time-Domain Reflectometry — a reflection fingerprint, not continuity. A microscopic breach shifts it.
The mesh's own impedance / capacitance is its unclonable signature. Drill through it and the physical fingerprint no longer matches.
The picture
One boundary you can watch, one you can't
The enclosure wraps the payload — compute and keys — in a spinning coarse mesh with an accelerometer wired to a zeroization trigger. Breach it and the keys are gone. Contrast the "trust the chip" model: the security boundary lives inside the die, invisible and unverifiable.
No enclosure is unbreakable, and certification is partly a badge buyers and regulators recognise. What the physical design buys you is honesty: the guarantee is real and testable — hard to open, self-wiping on breach — instead of a claim about silicon you were never able to check.
The takeaway
A hackerhouse HSM on every node
A phenomenally hard-to-penetrate, self-wiping enclosure — a "hackerhouse HSM" — is buildable cheaply from commodity parts. So every Noolog node can carry a real root of trust, not a silicon promise. That's the foundation strangers need to safely share compute at the edge.
All the way up
The software on top is verifiable too
The enclosure makes the hardware inspectable; open-source Slint does the same for the software. Noolog's whole interface is statically typed and compiled to native code with no garbage-collected runtime and deterministic execution — source you can read, not a binary you must trust. The same discipline that gets safety-critical UIs certified.
See how this boundary plugs into the wider machine in Why it works, and how it maps onto regulation in Compliance.