![A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Measuring reliability
Can we get a quantitative
measure of the "quality" of
the "bag"?
Yes, by looking at the
distribution of the
reliability.
This is
the case
of SRAM [1]
[1] R. Maes et al., “A soft decision helper data algorithm for SRAM PUFs,” ISIT 2009.
0.15 0.5 1.0
10
−4
10
−3
10
−2
10
−1
10
0
Reliability = 2 | p(T)-1/2 |
F
r
p(T) = 1 or 0
(random constant)
p(T) = p(F) = 0.5
(fair coin)
p(T) = 0.5 ± 0.075
Ideal
Curve
SRAM
8
DIEGM University of Udine](https://image.slidesharecdn.com/lucidi-170128094450/85/Two-fet-based-PUF-9-320.jpg)
![A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Simulations
10 000 Random variations
VTi ∼ N(V T,nom, σ2
Vi) σ2
Vi
=
Kv
Li Wi
[2]
βi ∼ N(βnom, σ2
βi) σ2
β=
βnom Kβ
Li Wi
[2]
[2] P. Kinget, “Device mismatch and tradeoffs in the design of analog circuits,”
IEEE Journal of Solid-State Circuits, June 2005
Sample at time t=ton + 0.5 ms
We also run
some simulations
by randomly
changing the
parameters
17
DIEGM University of Udine](https://image.slidesharecdn.com/lucidi-170128094450/85/Two-fet-based-PUF-18-320.jpg)
Two-fet based PUF
- 1. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Riccardo Bernardini and Roberto Rinaldo DIEG–University of Udine {riccardo.bernadini, rinaldo}@uniud.it Extended journal version: http://ieeexplore.ieee.org/document/7539631/ https://doi.org/10.1109/TIFS.2016.2599008 February 1, 2017
- 2. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Outline • Motivation and Introduction – An example: SRAM – Double randomness and reliability • Our proposal – Description – Analytic results – Simulation results • Conclusions & the Future 1 DIEGM University of Udine
- 3. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Motivation So, tell me, what is a PUC? A Physically Unclonable Constant, a secret word, impossible to reproduce even for the chip maker What is used for? Chip authentication, private keys, stuff like that… 2 DIEGM University of Udine
- 4. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Motivation Wouldn't a NVM suffice? No, the secret word must exist only when the chip is "alive"… To avoid "offline" attacks, you see… Hmm… I see. How do you that? By exploiting construction-time random variations Let me use an example… 3 DIEGM University of Udine
- 5. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants An example: SRAM It is an SRAM! Yes, just read it without initializing it… But you'll get a random value! Well… Yes and no… V1(t)V2(t) 4 DIEGM University of Udine
- 6. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants An example: SRAM 0 0.2 0.4 0.6 0.8 1 1.2 0 0.2 0.4 0.6 0.8 1 0 x 1 V 1 (V) V2 (V) V1(t)V2(t) The cell will never be exactly symmetric, so there will be a preferred outcome How much "preferred" depends on the cell symmetry noiseless noisy noise 5 DIEGM University of Udine
- 7. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Double randomness Device Production Device Measurement Stabilizer Raw data Key Building-time randomness Run-time randomness Off-line On-line The bit you read is a random variable whose "randomness" is selected at production time Like drawing a coin from a bag and then throwing the coin.. Exactly! And we want the coins in the bag as unfair as possible… 6 DIEGM University of Udine
- 8. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Double randomness and stabilizers Device Production Device Measurement Raw data Key Building-time randomness Run-time randomness Off-line On-line S0, an ideal PUC is a random constant. What if is it not "really" constant? We use a stabilizer. Many solutions are possible, but, basically you use some "redundance" to correct the "wrong" bits. Let me guess: "fair coins" == expensive stabilizers Right! Stabilizer 7 DIEGM University of Udine
- 9. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Measuring reliability Can we get a quantitative measure of the "quality" of the "bag"? Yes, by looking at the distribution of the reliability. This is the case of SRAM [1] [1] R. Maes et al., “A soft decision helper data algorithm for SRAM PUFs,” ISIT 2009. 0.15 0.5 1.0 10 −4 10 −3 10 −2 10 −1 10 0 Reliability = 2 | p(T)-1/2 | F r p(T) = 1 or 0 (random constant) p(T) = p(F) = 0.5 (fair coin) p(T) = 0.5 ± 0.075 Ideal Curve SRAM 8 DIEGM University of Udine
- 10. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants What is wrong with SRAM? 0 0.2 0.4 0.6 0.8 1 1.2 0 0.2 0.4 0.6 0.8 1 0 x 1 You see, the problem is that the SRAM has two stable states. This is fine for a memory, but it makes an unreliable PUC. You want something more similar to a balance: a single equilibrium point that depends on the asymmetry Right 9 DIEGM University of Udine
- 11. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Our proposal Q1 Q2 C Ic I1 I2 +- Vc Vraw V0 V0 This is our idea… Cool, how does it work? Transistors Q1 and Q2 are nominally matched, so that nominally |VT1| = |VT2|, ϐ1 = ϐ2, I1 = I2 and Ic=0 So, nominally, Vraw = V0 for ever…But Q1 and Q2 will not be exactly matched 10 DIEGM University of Udine
- 12. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Our proposal: qualitative analysis Q1 Q2 C Ic I1 I2 +- Vc Vraw V0 V0 Right! We are exactly going to exploit this! Right, suppose now that Q2 conducts a bit more so that Ic < 0 and Vc decreases… Vc=0, so Q1 and Q2 are in saturation… I2 VDS2 V0 t=0 … and VDS2 decreases… I1 Ic 11 DIEGM University of Udine
- 13. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Our proposal: qualitative analysis Q1 Q2 C Ic I1 I2 +- Vc Vraw V0 V0 As long as VDS2 is large enough nothing changes: Q2 remains in saturation Ic remains constant and Vc decreases linearly with time… I2 VDS2 t=t1 …until VDS2 reaches V0+VT2 VDS2(t1) I1 Ic 12 DIEGM University of Udine
- 14. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Our proposal: qualitative analysis Q1 Q2 C Ic I1 I2 +- Vc Vraw V0 V0 Exactly! At that time Q2 enters the triode region and I2 gets smaller. Meanwhile Q1 remains in saturation, so I1 does not change I2 VDS2 t=t2 Therefore, Ic gets smaller and the charging slows down… VDS2(t2) I1 Ic 13 DIEGM University of Udine
- 15. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Our proposal: qualitative analysis Q1 Q2 C Ic=0 I1 I2 +- Vc Vraw V0 V0 …until the process ends when I2=I1. At that time Ic=0 and the equilibrium (stable) is reached. I2 VDS2 t=∞ Cool, since at eq. Q2 must be in triode region, Vraw cannot be in the shadowed area. VDS2(∞) I1 VT Discontinuous 14 DIEGM University of Udine
- 16. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Our proposal: theoretical analysis Nice, but can you be more analytic? −2 −1 0 1 2 −2 −1.5 −1 −0.5 0 0.5 1 1.5 2 x 10 −5 Perfect Match I c (A) V c (V) Q1 stronger Q2 stronger dVc/dt ∝ Ic Q2 slightly stronger N egative slope ⇒ Stable equilibrium Sure, just check this figure 15 DIEGM University of Udine
- 17. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Variations What do we have here? Q1 Q2 C +- Vc V0 V0 Q1 Q2 C +- Vc V0 V0 Two variations of the basic scheme: the top scheme "forces" the output of the cell to VH/VL In the bottom scheme the SRAM cell stores the result, so that the PUC can be turned off 16 DIEGM University of Udine
- 18. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Simulations 10 000 Random variations VTi ∼ N(V T,nom, σ2 Vi) σ2 Vi = Kv Li Wi [2] βi ∼ N(βnom, σ2 βi) σ2 β= βnom Kβ Li Wi [2] [2] P. Kinget, “Device mismatch and tradeoffs in the design of analog circuits,” IEEE Journal of Solid-State Circuits, June 2005 Sample at time t=ton + 0.5 ms We also run some simulations by randomly changing the parameters 17 DIEGM University of Udine
- 19. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Simulation results 0 0.5 1 1.5 2 2.5 3 0 20 40 60 80 100 120 Vraw (V) #Occurences Temperature = 25 ° C 0 0.5 1 1.5 2 2.5 3 0 500 1000 1500 2000 2500 3000 Vout (V)#Occurences Temperature = 25 ° C, Prob(1)=0.4988 Prob ≈ 0.5-1.2 ⋅ 10-3 18 DIEGM University of Udine
- 20. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Simulation results 0 0.5 1 1.5 2 2.5 3 0 20 40 60 80 100 120 V raw (V) #Occurences Temperature = 0° C 0 0.5 1 1.5 2 2.5 3 0 500 1000 1500 2000 2500 3000 Vout (V) #Occurences 19 DIEGM University of Udine
- 21. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Simulation results 20 DIEGM University of Udine
- 22. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Simulation results 0 0.2 0.4 0.6 0.8 1 1.2 1.4 10 −4 10 −3 10 −2 10 −1 10 0 Reliability (R) F r Proposed 25 ° C Proposed −30 ° C SRAM 21 DIEGM University of Udine
- 23. A Simple and Reliable Cell for Single Bit Physically Unclonable Constants Conclusions • A very simple cell for binary PUC has been proposed • Theoretical analysis and simulations show that – The cell is unbiased – The cell is very reliable, pratically ideal – The cell works on a very large range of temperatures • Stabilizer may be unnecessary • Future directions – Understanding the “eye closing” – Experimental results on a prototype 22 DIEGM University of Udine