Recommended
Recommended
More Related Content
Viewers also liked
Viewers also liked (18)
Similar to Reliable Single Bit PUC Cell
Similar to Reliable Single Bit PUC Cell (20)
More from Riccardo Bernardini
More from Riccardo Bernardini (7)
Recently uploaded
Recently uploaded (20)
Reliable Single Bit PUC Cell
- 1. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Riccardo Bernardini and Roberto Rinaldo DIEG–University of Udine {riccardo.bernadini, rinaldo}@uniud.it Extended journal version: http://ieeexplore.ieee.org/document/7539631/ January 31, 2017
- 2. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Outline • Motivation and Introduction – An example: SRAM – Double randomness and reliability • Our proposal – Description – Analytic results – Simulation results • Conclusions & the Future 1 DIEGM University of Udine
- 3. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Motivation So, tell me, what is a PUC? A Physically Unclonable Constant, a secret word, impossible to reproduce even for the chip maker What is used for? Chip authentication, private keys, stuff like that… 2 DIEGM University of Udine
- 4. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Motivation Wouldn't a NVM suffice? No, the secret word must exist only when the chip is "alive"… To avoid "offline" attacks, you see… Hmm… I see. How do you that? By exploiting construction-time random variations Let me use an example… 3 DIEGM University of Udine
- 5. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants An example: SRAM It is an SRAM! Yes, just read it without initializing it… But you'll get a random value! Well… Yes and no… V1(t)V2(t) 4 DIEGM University of Udine
- 6. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants An example: SRAM 0 0.2 0.4 0.6 0.8 1 1.2 0 0.2 0.4 0.6 0.8 1 0 x 1 V 1 (V) V2 (V) V1(t)V2(t) The cell will never be exactly symmetric, so there will be a preferred outcome How much "preferred" depends on the cell symmetry noiseless noisy noise 5 DIEGM University of Udine
- 7. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Double randomness Device Production Device Measurement Stabilizer Raw data Key Building-time randomness Run-time randomness Off-line On-line The bit you read is a random variable whose "randomness" is selected at production time Like drawing a coin from a bag and then throwing the coin.. Exactly! And we want the coins in the bag as unfair as possible… 6 DIEGM University of Udine
- 8. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Double randomness and stabilizers Device Production Device Measurement Raw data Key Building-time randomness Run-time randomness Off-line On-line S0, an ideal PUC is a random constant. What if is it not "really" constant? We use a stabilizer. Many solutions are possible, but, basically you use some "redundance" to correct the "wrong" bits. Let me guess: "fair coins" == expensive stabilizers Right! Stabilizer 7 DIEGM University of Udine
- 9. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Measuring reliability Can we get a quantitative measure of the "quality" of the "bag"? Yes, by looking at the distribution of the reliability. This is the case of SRAM [1] [1] R. Maes et al., “A soft decision helper data algorithm for SRAM PUFs,” ISIT 2009. 0.15 0.5 1.0 10 −4 10 −3 10 −2 10 −1 10 0 Reliability = 2 | p(T)-1/2 | F r p(T) = 1 or 0 (random constant) p(T) = p(F) = 0.5 (fair coin) p(T) = 0.5 ± 0.075 Ideal Curve SRAM 8 DIEGM University of Udine
- 10. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants What is wrong with SRAM? 0 0.2 0.4 0.6 0.8 1 1.2 0 0.2 0.4 0.6 0.8 1 0 x 1 You see, the problem is that the SRAM has two stable states. This is fine for a memory, but it makes an unreliable PUC. You want something more similar to a balance: a single equilibrium point that depends on the asymmetry Right 9 DIEGM University of Udine
- 11. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Our proposal Q1 Q2 C Ic I1 I2 +- Vc Vraw V0 V0 This is our idea… Cool, how does it work? Transistors Q1 and Q2 are nominally matched, so that nominally |VT1| = |VT2|, ϐ1 = ϐ2, I1 = I2 and Ic=0 So, nominally, Vraw = V0 for ever…But Q1 and Q2 will not be exactly matched 10 DIEGM University of Udine
- 12. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Our proposal: qualitative analysis Q1 Q2 C Ic I1 I2 +- Vc Vraw V0 V0 Right! We are exactly going to exploit this! Right, suppose now that Q2 conducts a bit more so that Ic < 0 and Vc decreases… Vc=0, so Q1 and Q2 are in saturation… I2 VDS2 V0 t=0 … and VDS2 decreases… I1 Ic 11 DIEGM University of Udine
- 13. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Our proposal: qualitative analysis Q1 Q2 C Ic I1 I2 +- Vc Vraw V0 V0 As long as VDS2 is large enough nothing changes: Q2 remains in saturation Ic remains constant and Vc decreases linearly with time… I2 VDS2 t=t1 …until VDS2 reaches V0+VT2 VDS2(t1) I1 Ic 12 DIEGM University of Udine
- 14. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Our proposal: qualitative analysis Q1 Q2 C Ic I1 I2 +- Vc Vraw V0 V0 Exactly! At that time Q2 enters the triode region and I2 gets smaller. Meanwhile Q1 remains in saturation, so I1 does not change I2 VDS2 t=t2 Therefore, Ic gets smaller and the charging slows down… VDS2(t2) I1 Ic 13 DIEGM University of Udine
- 15. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Our proposal: qualitative analysis Q1 Q2 C Ic=0 I1 I2 +- Vc Vraw V0 V0 …until the process ends when I2=I1. At that time Ic=0 and the equilibrium (stable) is reached. I2 VDS2 t=∞ Cool, since at eq. Q2 must be in triode region, Vraw cannot be in the shadowed area. VDS2(∞) I1 VT Discontinuous 14 DIEGM University of Udine
- 16. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Our proposal: theoretical analysis Nice, but can you be more analytic? −2 −1 0 1 2 −2 −1.5 −1 −0.5 0 0.5 1 1.5 2 x 10 −5 Perfect Match I c (A) V c (V) Q1 stronger Q2 stronger dVc/dt ∝ Ic Q2 slightly stronger N egative slope ⇒ Stable equilibrium Sure, just check this figure 15 DIEGM University of Udine
- 17. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Variations What do we have here? Q1 Q2 C +- Vc V0 V0 Q1 Q2 C +- Vc V0 V0 Two variations of the basic scheme: the top scheme "forces" the output of the cell to VH/VL In the bottom scheme the SRAM cell stores the result, so that the PUC can be turned off 16 DIEGM University of Udine
- 18. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Simulations 10 000 Random variations VTi ∼ N(V T,nom, σ2 Vi) σ2 Vi = Kv Li Wi [2] βi ∼ N(βnom, σ2 βi) σ2 β= βnom Kβ Li Wi [2] [2] P. Kinget, “Device mismatch and tradeoffs in the design of analog circuits,” IEEE Journal of Solid-State Circuits, June 2005 Sample at time t=ton + 0.5 ms We also run some simulations by randomly changing the parameters 17 DIEGM University of Udine
- 19. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Simulation results 0 0.5 1 1.5 2 2.5 3 0 20 40 60 80 100 120 Vraw (V) #Occurences Temperature = 25 ° C 0 0.5 1 1.5 2 2.5 3 0 500 1000 1500 2000 2500 3000 Vout (V)#Occurences Temperature = 25 ° C, Prob(1)=0.4988 Prob ≈ 0.5-1.2 ⋅ 10-3 18 DIEGM University of Udine
- 20. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Simulation results 0 0.5 1 1.5 2 2.5 3 0 20 40 60 80 100 120 V raw (V) #Occurences Temperature = 0° C 0 0.5 1 1.5 2 2.5 3 0 500 1000 1500 2000 2500 3000 Vout (V) #Occurences 19 DIEGM University of Udine
- 21. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Simulation results 20 DIEGM University of Udine
- 22. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Simulation results 0 0.2 0.4 0.6 0.8 1 1.2 1.4 10 −4 10 −3 10 −2 10 −1 10 0 Reliability (R) F r Proposed 25 ° C Proposed −30 ° C SRAM 21 DIEGM University of Udine
- 23. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Conclusions • A very simple cell for binary PUC has been proposed • Theoretical analysis and simulations show that – The cell is unbiased – The cell is very reliable, pratically ideal – The cell works on a very large range of temperatures • Stabilizer may be unnecessary • Future directions – Understanding the “eye closing” – Experimental results on a prototype 22 DIEGM University of Udine