Download as PDF, PPTX
![page 24
A Reconfigurable Resistive-RAM PUF .
▪ Resulting in significant current difference →BER ~0%
▪ PUF cells can be reconfigured (reset both to HRS and “split” again)
– Do we really want a reconfigurable PUF?
– Reconfigurability of RRAM is not ideal [2]
WL
R1 R2
I1 I2
I1>I2
I1<I2
Split
resistance
Vsense
WL
R1 R2
I1 I2
Set R1 to LRS
Reset R2 to HRS
Vsense
WL
R1 R2
I1 I2
Reset R1 to HRS
Set R2 to LRS
Vsense
[1] Y. Pang, et. al, “A reconfigurable RRAM physically unclonable function utilizing post-process randomness source with <6×10-6 native bit error rate,” ISSCC 2019
[2] K. Chuang, et. al, “A Cautionary Note When Looking for a Truly Reconfigurable Resistive RAM PUF,” Trans. CHES 2018
[1]](https://image.slidesharecdn.com/puflecture4-230606124627-356f6596/75/PUF_lecture4-pdf-24-2048.jpg)
![page 33
SRAM data identification .
N1 N2
P1 P2
N1 N2
P1 P2
ordline
bitline
bitline
DD DD
0 1
N1 N2
P1 P2
Sensitive locations
ordline
bitline
bitline
DD DD
1 0
N1 N2
P1 P2
Sensitive locations
The image is obtained by
measuring the supply
current fluctuation under
laser stimulation at
different locations
[5] D. Nedospasov et. al, “Invasive PUF Analysis,” 2013 Workshop on Failure
Diagnosis and Tolerance in Cryptography](https://image.slidesharecdn.com/puflecture4-230606124627-356f6596/75/PUF_lecture4-pdf-33-2048.jpg)
![page 34
Attack using data-remanence effect at low-T .
Data remains within SRAM cells even after power-down
[9] N. A. Anagnostopoulos, et al. "Low-temperature data remanence attacks
against intrinsic SRAM PUFs." 2018 21st Euromicro Conference on Digital
System Design (DSD). IEEE, 2018.](https://image.slidesharecdn.com/puflecture4-230606124627-356f6596/75/PUF_lecture4-pdf-34-2048.jpg)
![page 36
Helper data attacks also lead to faults .
▪ SRAM PUF cannot operate without storing helper data in NVM
▪ NVM contents can be erased by heat/radiation
PUF
Helper
Data
(NVM)
Post-
processing
Reconstructed PUF secret will be corrupted if the helper data
storage is subject to attacks
PUF secret
[11] S. Skorobogatov, "Local heating attacks on Flash memory devices." 2009 IEEE
International Workshop on Hardware-Oriented Security and Trust. IEEE, 2009.
→ Modify HD without having write access
[12]](https://image.slidesharecdn.com/puflecture4-230606124627-356f6596/75/PUF_lecture4-pdf-36-2048.jpg)
PUF_lecture4.pdf
- 2. PUF Implementations and Benchmarking. Dr. Kent Chuang 2022 September
- 3. Outline . 1. Recap 2.Different PUF circuit implementations 3. Performance and security analysis of PUFs 4. Conclusion
- 4. Outline . 1. Recap 2.Different PUF circuit implementations 3. Performance and security analysis of PUFs 4. Conclusion
- 5. page 5 Recap . Inthe previous lectures, we have introduced ▪ Basics about PUF ▪ Important PUF properties and design considerations ▪ Quantum tunneling PUF ▪ Security applications of PUFs
- 6. page 6 Key GenerationUsing PUF . KDF Device Secret Auxiliary Input (Optional) Secret Key PUF Array 0 1 0 1 0 1 0 0 0 Readout Interface ▪ Unique device secret can be derived from the PUF array ▪ Secret key can be further derived by sending the device secret into the key derivation function (KDF)
- 7. page 7 Plenary Speech2 PUF Array PUF Bit-Cell PUF Enrollment BL BL VAF-0 VAF-1 AF-0(VPP) AF-1(VPP) AF-0(VPP) AF-1(VPP) 50% 50% “1” Cell “0” Cell 0 1 0 1 0 1 0 1 1 1 0 1 0 0 1 0 A Quantum Tunneling PUF .
- 8. page 8 PUF responsesare consistent . ▪ No bit error found across all tested conditions → Wide supply voltage range covering the ULP spec → Wide temperature range from -40 °C to 175 °C 0.8 1.0 1.2 1.4 2.0 2.4 2.8 3.2 0 1 2 3 Bit Error Rate (ppm) Supply Voltage (V) VDD VDD2 -40 0 40 80 120 160 200 0 1 2 3 Bit Error Rate (ppm) Temperature (C) Wu, et. al, A PUF Scheme using Competing Oxide Rupture with Bit Error Rate Approaching Zero, ISSCC, 2018
- 9. Outline . 1. Recap 2.Different PUF circuit implementations 3. Performance and security analysis of PUFs 4. Conclusion
- 10. page 10 Arbiter PUF– based on timing differences . · · · Arbiter 0/1 “1” “0” “0” “1” 0 1 1 0 N-bit challenge → 2 N possible CRPs (Strong PUF) Challenge Response J. Lee, et. al, “A Technique to Build a Secret Key in Integrated Circuits for Identification and Authentication Applications,” Symp. VLSI-C 2004
- 11. page 11 Entity authenticationusing strong PUFs . ▪ A huge amount of CRPs is needed (cannot reuse a CRP) ▪ Strong PUFs (e.g. Arbiter PUFs) provide such functionality PUF1 PUF2 PUF3 Ci,1 Ci,2 Ci,3 Ri,1 Ri,2 Ri,3 1. Send random challenges to PUFs Ci,2 R’i,2 R’i,2=Ri,2? 1. Send stored challenges to PUF 2. Verify if the responses are correct → Determine if PUF’2 is PUF2 2. Receive responses and store CRPs Enroll PUF’2 Authenticate Server
- 12. page 12 Arbiter PUFis not an ideal strong PUF . ▪ Linear additive structure: sum of delays ▪ Similar challenges → similar responses “1” “0” · · · “0” “1” Arbiter 0/1 Δt1,1 Δt2,0 ΔtN-1,0 ΔtN,0 + + + + = C1: Δt1,1 Δt2,0 ΔtN-1,1 ΔtN,0 + + + + Δt1 - ΔtN-1,0 + ΔtN-1,1 = Addition of N elements >> Difference of one element Not likely to change sign “1” “0” “1” “1” C2: Change only one bit Δt1
- 13. page 13 Responses canbe easily predicted . ▪ CRPs are highly correlated: low entropy ▪ → Prone to machine learning (ML) attacks → Experiments on 65 nm CMOS Arbiter PUF: only 1000+ CRPs are sufficient to model the PUF with high accuracy G. Hospodar, “Machine learning attacks on 65nm Arbiter PUFs: Accurate modeling poses strict bounds on usability,” WIFS 2012
- 14. page 14 Unpredictability enhancedby XORing . · · · Arbiter · · · Arbiter · · · Arbiter “1” “0” “0” “1” 0/1 Assume response bit has 5% probability to flip when changing a challenge bit XOR by 3 ➔ ~14% Entropy is summed-up by XORing → more unpredictable XOR PUF
- 15. page 15 Reliability isthe bottleneck for XOR PUFs . ▪ Assume 100 arbiter PUFs are XORed → BER ~50% ▪ Unpredictable, but not a PUF BER: 6% BER: 8% BER: 4% BER: ~16% Errors are also summed-up by XORing Are there good strong PUFs?
- 16. page 16 Ring-Oscillator (RO)PUF . ▪ Each RO consists of odd stages of inverting gates ▪ Oscillation frequency depends on logic delays – Affected by device variations within logic gates ▪ Two identically designed ROs oscillate at different frequencies EN EN
- 17. page 17 RO-PUF basedon frequency comparison . ▪ Select two ROs to be compared based on challenge – N(N-1)/2 challenges → smaller than an arbiter PUFs with the same N ▪ Response is generated by comparing the counter values MUX Counter >? Counter MUX RON RO2 RO1 0/1 Challenge Response
- 18. page 18 SRAM PUF– a classic weak PUF . ▪ 2D array of 1-bit memory cells ▪ Using the mismatch between the cross-coupled inverters ordline bitline bitline DD DD 6T-SRAM cell I1 I2 “1” “0” “0” “1” Bi-stable states I1 I2 I2 I1 Two possible outcomes after power-up
- 19. page 19 Power-up behaviorgenerate PUF bits . No-mismatch I1-skewed 1/0 0/1 I1 I2 1 0 I1 I2 0 1 I1 I2 I2-skewed
- 20. page 20 ordline bitline bitline DD DD identical identical Smallmismatch causes instability . ▪ Mismatches are random – Also possible to have very small mismatches ▪ An SRAM can enter noise-sensitive metastable state – SRAM PUF data may change in different power-ups 50% “0” “1” 50% “1” “0” Bit errors!
- 21. page 21 Monostable PUFs. ▪ Less sensitive to noise when powering-up – No metastable state ▪ Readout events are affected by noise → still have bit errors Alvarez, A., et. “A 15fJ/b static physically unclonable functions for secure chip identification with <2% native bit instability and 140× inter/intra PUF hamming distance separation in 65nm”, ISSCC 2015 These PUF cells may cause errors
- 22. page 22 NAND chainbased PUF . ▪ Small VT variations is amplified by inverting logic gates – Response = 1 if VT1>VT2 (assuming odd stages) – Response = 0 if VT1<VT2 ▪ Monostable behavior → less errors than SRAM PUF B. Karpinskyy, et. al, “Physically Unclonable Function for Secure Key Generation ith a Key Error Rate of 2E-38 in 45nm Smart-Card Chips”, ISSCC2016 VT1 VT2 Response EN
- 23. page 23 2-bit/cell PUFusing two oxide-BD mechanisms . ▪ Oxide-breakdown PUFs using high-k metal gate – Breakdown to low-resistance (anti-fuse) – Breakdown to high-resistance (dielectric-fuse) ▪ Experimental results from device-level characterization – Feasibility for mass production is unknown E. Hsieh, et. al, “Embedded PUF on 14nm HKMG FinFET platform: A novel 2-bit-per-cell OTP-based memory feasible for IoT secuirty solution in 5G era,” Symp. VLSI-T 2019 WL BL 1/0 1/0 Metal High-k SiO2 D S Metal High-k SiO2 D S Metal High-k SiO2 D S Metal High-k SiO2 D S 0 / 1 1 / 0 0 / 0 1 / 1 AF DF
- 24. page 24 A ReconfigurableResistive-RAM PUF . ▪ Resulting in significant current difference →BER ~0% ▪ PUF cells can be reconfigured (reset both to HRS and “split” again) – Do we really want a reconfigurable PUF? – Reconfigurability of RRAM is not ideal [2] WL R1 R2 I1 I2 I1>I2 I1<I2 Split resistance Vsense WL R1 R2 I1 I2 Set R1 to LRS Reset R2 to HRS Vsense WL R1 R2 I1 I2 Reset R1 to HRS Set R2 to LRS Vsense [1] Y. Pang, et. al, “A reconfigurable RRAM physically unclonable function utilizing post-process randomness source with <6×10-6 native bit error rate,” ISSCC 2019 [2] K. Chuang, et. al, “A Cautionary Note When Looking for a Truly Reconfigurable Resistive RAM PUF,” Trans. CHES 2018 [1]
- 25. Outline . 1. Recap 2.Different PUF circuit implementations 3. Performance and security analysis of PUFs - Reliability, Yield, and Randomness - Security against attacks 4. Conclusion
- 26. page 26 Smaller VTvariation SRAM PUF is very sensitive to technology . ordline bitline bitline DD DD ordline bitline bitline DD DD VT σ PDF σ=20mV σ=10mV σ VT PDF More likely to have smaller mismatches → More unstable SRAM cells Technology Optimization Technology tuning/optimization (by the foundry) might lead to performance degradation of an existing SRAM PUF design
- 27. page 27 Randomness isalso sensitive to technology . * G. Schrijen, and V. Van Der Leest. "Comparative analysis of SRAM memories used as PUF primitives." 2012 Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 2012. ordline bitline bitline DD DD M1 M2 M3 M4 M5 M6 M1 M2 M3 M5 M6 M4 An example SRAM layout Not fully symmetric Possible that Pr(VT2 >VT1)>0.5 due to deterministic layout/process patterns * Some SRAM designs are heavily biased The randomness of a SRAM-PUF may change across technology platforms, process corners, lots, wafers, and even die locations
- 28. page 28 Yield issue– reliability and randomness . ▪ Stability/randomness is not qualified → Yield loss ▪ The quality varies a lot due to process variation PUF Helper Data (NVM) Post- processing Raw PUF-bits PUF secret Error-rate < 1e-9 Entropy=256 bit Fixed for a hardware-PUF (t and k are fixed) # error < t-bit entropy > k-bit A chip fails the yield test if raw data is not qualified
- 29. page 29 SRAM PUFsare prone to aging effects . Biased-temperature instability (BTI) effects will make mismatch smaller → PUF cell becomes less stable ordline bitline bitline DD DD wea k nBT I 0 VDD power-up During power-up Higher current flows through when charging- up this node, inducing hot-carrier injection (HCI) stress effect → PUF cell becomes less stable After power-up ordline bitline bitline DD DD 0V →VDD 0V →0V HCI → Stability and randomness can both be affected by aging Can also cause permanent bit-flips if aging effect is strong → HW changes
- 30. page 30 Conventional PUF(e.g. SRAM PUF) Quantum Tunneling PUF Technology SRAM startup behavior Quantum Tunneling Inter- HD (Uniqueness) 45%~50% * 50% HW (Randomness) 0.4~0.65 * 0.5 Bit Error Rate (Robustness) 1.5%~20% * 0% Device Aging May cause stability and randomness degradation Insensitive to aging Comparison . * G. Schrijen, and V. Van Der Leest. "Comparative analysis of SRAM memories used as PUF primitives." 2012 Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 2012.
- 31. Outline . 1. Recap 2.Different PUF circuit implementations 3. Performance and security analysis of PUFs - Reliability, Yield, and Randomness - Security against attacks 4. Conclusion
- 32. page 32 ordline bitline bitline DD DD ProbingSRAM PUF data using laser glitches . ▪ Laser stimulation at N1 will increase the voltage of the left node → Induce current flow through P2 and N2 ordline bitline bitline DD DD D. Nedospasov et. al, “Invasive PUF Analysis,” 2013 Workshop on Failure Diagnosis and Tolerance in Cryptography 0 1 1 0 N1 N2 P1 P2 “Seebeck voltage” Laser Stimulation → Induce Heat Current ▪ Laser stimulation at N1 will NOT increase the voltage of the left node → NO current flow through P2 and N2 Laser Stimulation Logic states can be distinguished by checking the “current sensitivity” to laser at certain locations Measure changes of supply current
- 33. page 33 SRAM dataidentification . N1 N2 P1 P2 N1 N2 P1 P2 ordline bitline bitline DD DD 0 1 N1 N2 P1 P2 Sensitive locations ordline bitline bitline DD DD 1 0 N1 N2 P1 P2 Sensitive locations The image is obtained by measuring the supply current fluctuation under laser stimulation at different locations [5] D. Nedospasov et. al, “Invasive PUF Analysis,” 2013 Workshop on Failure Diagnosis and Tolerance in Cryptography
- 34. page 34 Attack usingdata-remanence effect at low-T . Data remains within SRAM cells even after power-down [9] N. A. Anagnostopoulos, et al. "Low-temperature data remanence attacks against intrinsic SRAM PUFs." 2018 21st Euromicro Conference on Digital System Design (DSD). IEEE, 2018.
- 35. page 35 Attack example. Bootloader SRAM PUF Bootloader SRAM PUF Read Erase Other NA SRAM PUF Other R/W Pre-erasure Post-erasure Boot flow Only bootloader has access to the SRAM power-up state Non-privileged code has access to SRAM data after erasure Freeze the SRAM after power-up Data is not overwritten successfully → Attacker can read SRAM-PUF data using non-privileged codes N. A. Anagnostopoulos, et al. "Low-temperature data remanence attacks against intrinsic SRAM PUFs." 2018 21st Euromicro Conference on Digital System Design (DSD). IEEE, 2018.
- 36. page 36 Helper dataattacks also lead to faults . ▪ SRAM PUF cannot operate without storing helper data in NVM ▪ NVM contents can be erased by heat/radiation PUF Helper Data (NVM) Post- processing Reconstructed PUF secret will be corrupted if the helper data storage is subject to attacks PUF secret [11] S. Skorobogatov, "Local heating attacks on Flash memory devices." 2009 IEEE International Workshop on Hardware-Oriented Security and Trust. IEEE, 2009. → Modify HD without having write access [12]
- 37. page 37 Entropy-loss introducedby ECC . Example: correcting 100-bit SRAM with different error correction ratio ECC corrects up to 30-bit errors entropy loss >80% Entropy is estimated by guessing probability The probability of having a correct guessing an 𝑚-bit data with 𝑡-bit error tolerance is: Pr 𝑐𝑜𝑟𝑟𝑒𝑐𝑡 𝑔𝑢𝑒𝑠𝑠𝑖𝑛𝑔 = Pr(#𝑒𝑟𝑟𝑜𝑟 ≤ 𝑡) = 𝑖=0 𝑡 𝑚 𝑖 1 − 𝑝 𝑖𝑝𝑚−𝑖 Where 𝑝 is the success probability of guessing a bit, which is equal to 0.5 assuming that the 𝑚-bit data is full-entropy. The resulting entropy is estimated using the equation: H = − log2 Pr 𝑐𝑜𝑟𝑟𝑒𝑐𝑡 𝑔𝑢𝑒𝑠𝑠𝑖𝑛𝑔 → More entropy loss when correcting more errors
- 38. page 38 Comparison . ConventionalPUFs Quantum Tunneling PUF Optical Attacks - Data leakage due to optical sensitivity - Fault injected by laser Insensitive to optical glitches Temperature Attacks - Faults induced by varying temperature - Data remanence attack at low temperature Insensitive to temperature Voltage glitches - Faults induced by varying supply voltage or power-up behavior Insensitive to supply voltage in a wide operating range (e.g. 0.8V-1.4V) Helper data attack - Fault attacks on helper data - Helper data manipulation attacks No helper data → No risk
- 39. Outline . 1. Recap 2.Different PUF circuit implementations 3. Performance and security analysis of PUFs 4. Conclusion
- 40. PUFsecurity page 40 page 40 Conclusion. Different PUF implementations have been introduced … ▪ Most PUFs do not provide ideal performance ▪ May be vulnerable to different physical attacks ▪ Helper data is not good for entropy and physical security … quantum tunneling PUF is a better solution
- 41. Thank you! More educationalmaterials? Feel free to follow us!
- 42. PUFsecurity page 42 page 42 Outlook. Coming up: ▪ True Random Number Generators ▪ Cryptographic Algorithms – Hash functions – Symmetric key cryptography – Asymmetric (public) key cryptography