A Physical Unclonable Function based on Capacitor Mismatch in a Charge-Redistribution SAR-ADC

Size: px

Start display at page:

Download "A Physical Unclonable Function based on Capacitor Mismatch in a Charge-Redistribution SAR-ADC"

Baldric Boone
5 years ago
Views:

1 A Physical Unclonable Function based on Capacitor Mismatch in a Charge-Redistribution SAR-ADC Qianying Tang, Won Ho Choi, Luke Everson, Keshab K. Parhi and Chris H. Kim University of Minnesota Department of Electrical and Computer Engineering Minneapolis, MN

2 Outline Background and Motivation Proposed SAR-ADC PUF 65nm PUF Chip Data Summary SAR ADC: Successive Approximation Register Analog to Digital Converter PUF: Physical Unclonable Function 2

3 Conventional PUFs MUX stages Arbiter VDD 1 1 S Q 1 Response SR Latch Q QB R BL BLB C<> C<1> C<127> Arbiter PUF: Entropy source: Delay path variation Number of challenge-response pairs (CRPs) exponentially proportional to the number of cells strong PUF SRAM PUF: Entropy source: Cell mismatch Number of CRPs proportional to the number of cells weak PUF 3

variation as compared to active devices Metal wire resistance

4 Passive Device based PUFs J. Ju, HOST, 213 M. Wan, TCAS-I, 215 Passive devices are more stable under V, T variation as compared to active devices Metal wire resistance variation in chip power grid (left) Capacitance variation in switch capacitor circuit (right) 4

5 Contributions of This Work V ip Vcm 4C 2C C C 4C 2C C C SAR Logic D2~D ADC Digital Output w mismatch w/o mismatch V in V REF /2 V REF ADC Analog Input Extract mismatch in capacitor array of standard charge redistribution SAR-ADC minimal design and area overhead Experimentally verify if indeed passive PUFs are stable under V and T variations (so far, results are inconclusive) 5

6 Outline Background and Motivation Proposed SAR-ADC PUF 65nm PUF Chip Data Summary 6

7 Modifications to Standard SAR-ADC Vref C9 C8 C7 C6 C5 C4 C3 C2 C1 Cdummy C9' CU<62:31> C8' CU<3:15> C4' CU<1> C3 C2 C1 Cd CU<> Vcm Vcm SAR ctrl. PUF ctrl. C9 C8 C7 C6 C5 C4 C3 C2 C1 Cdummy Vref 4% area overhead PUF control logic Independent control of unit caps A counter to determine soft response (not shown here) 7

8 Test Chip Layout and Die Photo PUF control Cap. Array Comparator & SAR Logic Cap. Array 45µm -bit SAR ADC in 65nm 63 unit capacitors on the same column of each capacitor array are utilized for PUF function 8

9 Step 1: Sampling Phase PUF Switch Ctrl. CLK_CMP V DD S 62 S j S i S Auto-zeroing for offset compensation PUF_EN V cm S VCM CU<62> CU<j> CU CU<> PUF_EN CMPO S S 1 CU<62> CU<j> CU CU<> CLK_CMP S vcm V + /V - V DD S 62 S j S i S CMPO V+ and V- are initialized to the common-mode voltage Vcm Two unit capacitors are enabled and connected in series between VDD and GND Charge on top plate: Q V cm C U i V cm VDD CU j

10 Step 2: Evaluation Phase PUF Switch Ctrl. CLK_CMP S 62 S i S j S V DD PUF_EN S VCM CU<62> CU CU<j> CU<> PUF_EN S V cm CMPO S 1 CU<62> CU CU<j> CU<> CLK_CMP S vcm V + /V - V V DD S 62 S i S j S CMPO Connection of S i and S j are swapped, Vcm is disconnected CU i C U j Charge on top plate: Qclk1 Qclk3 V VCM V DD CU i CU j Capacitance difference between C U and C U<j> results in different input voltage V: CU i CU j CU i C U j V V V V DD CU i CU j CU i C U j

11 Overall Flow and Soft Response Measurement PUF Switch Ctrl. S N S 2 S 1 S PUF Soft Response SAR ADC CMPO Counter + - PUF_EN CLK_CMP PUF_Thr Soft-response measurement Repetitively evaluating the PUF using the same challenge Counting the number of times the comparator output evaluates to 1 using an on-chip counter 11

12 Outline Background and Motivation Proposed SAR-ADC PUF 65nm PUF Chip Data Summary 12

13 Probability (%) Measured Soft Response Stable : 37.6% 1.2V, 25ºC,16 unit caps. evaluations 8 challenges Stable 1 : 35.8% Pr(Soft response = 1 ) 8, different challenges were applied and each challenge was evaluated times 13

14 2 Stability Comparison 65nm, 1.2V, 25ºC 2 32nm,.9V, 25ºC Probability (%) 1-1 SAR-ADC PUF (This Work) Probability (%) 1-1 Arbiter PUF (Chen, et al., ISLPED16, DAC17) Soft response Soft response Stability of SAR-ADC PUF not better than that of Arbiter PUF Noise due to active devices in SAR-ADC PUF makes response unstable 14

15 Solution #1: Dynamic Thresholding PDF PDF. Intra-chip Overlap Applying Dynamic Thresholding Intra-chip Inter-chip No overlap Inter-chip.5 1. Intra-chip HD (µ and σ) V, 25ºC,16 unit caps...5 Hamming distance 1../1..1/.9.2/.8 Enrollment threshold (D/D1) Improve the consistency and uniqueness by suppressing intra-chip HD Approach: Stringent threshold for enrollment, relaxed threshold for authentication 15

16 PDF. Solution #2: Low VDD Enrollment 1.2V Hamming distance 1. Intra-chip HD for Authentication 65nm,.8V-1.2V, 25ºC, w/ dyn. thres Supply Voltage for Enrollment (V) V of SAR-ADC PUF is proportional to VDD response will be more stable at higher VDDs Approach: Low VDD (.8V) for enrollment, any VDD (.8-1.2V) for authentication µ & σ Max. 16

17 Probability (%) After Incorporating Solutions #1 and # Intra-chip HD: µ =.46 σ =.537 max =.49 Margin =.28 65nm,.8~1.2V, 25ºC Inter-chip HD µ =.58 σ =.67 min = Hamming Distance Threshold # of challenges 8k Pr( 1 )<.1 or Pr( 1 )>.9 Discarded responses 47.8% Enrollment VDD Authentication VDD Intra-chip # of cycles for eval. 99.8V.8~1.2V 4, stable challenges are applied to the different chips with a supply voltage ranging from.8v to 1.2V Group the CRPs into bit responses for inter-chip HD eval.: μ = 5.6%, close to the ideal 5% inter-chip HD max(intra-chip) min(inter-chip) = 2.8%, suggests good uniqueness Inter-chip 8k # chips 1 17

18 Outline Background and Motivation Proposed SAR-ADC PUF 65nm PUF Chip Data Summary 18

19 Summary Capacitance mismatch in a standard SAR-ADC utilized for PUF operation 65nm test chip shows worse stability compared to arbiter PUFs due to active devices Solutions for overcoming stability issues: Soft response thresholding, low VDD enrollment Possible future work: Security analysis of passive device based PUFs Acknowledgement: This research was supported by the National Science Foundation under grant number CNS and the semiconductor research corporation under contract number 214-TS

A DRAM based Physical Unclonable Function Capable of Generating >10 32 Challenge Response Pairs per 1Kbit Array for Secure Chip Authentication

A DRAM based Physical Unclonable Function Capable of Generating >10 32 Challenge Response Pairs per 1Kbit Array for Secure Chip Authentication Q. Tang, C. Zhou, *W. Choi, *G. Kang, *J. Park, K. K. Parhi,