Employing Process Variation for Building Chip Identifiers

Size: px

Start display at page:

Download "Employing Process Variation for Building Chip Identifiers"

Justina Woods
6 years ago
Views:

1 Turning Lemons into Lemonade: Employing Process Variation for Building Chip Identifiers Leyla Nazhandali, Electrical and Computer Eng. Department Virginia Tech

2 Outline Part 1: What are PUFs? Identity of People and Things PUF Qualities and Threats Part 2: Silicon PUF Process Variation and Silicon PUF Basics Some of the Major Silicon PUFs Part 3: some Highlights of VT 2

3 Identity of Persons Hi! It's Alice. Hi Alice! How's the beach? Alice Bob People recognize one another using biometrics: voice, looks, gestures, gait,... 3

Identity of Persons Hi Bank! It's Alice.

not always practical A bank uses a simple

4 Identity of Persons Hi Bank! It's Alice. Can I get a loan? Sure, Ms. Alice! What's your social security number? Alice Bank Biometric (fingerprints) are not always practical A bank uses a simple test to verify identity: a challenge/response protocol 4

5 Identity of Persons Hi Bob! It's your Alice. Alice? Hey, who's this? X Bob Biometrics are an effective fingerprint of someone's identity Unique, and very difficult to impersonate 5

6 Identity of Persons Which one will make identity theft easier? 6

7 Identity of Things Matters Electronic devices have become ubiquitous. Security and privacy in many of these devices is crucial. Identity is the heart of any secure application. 7

8 Physical Unclonable Functions (PUF) Random uncontrollable physical variations are used to produce the identifier Cannot be copied or altered easily Provides low cost and secure alternative for device authentication. Random Input On the fly Unique PUF Output 8

9 Requirements for PUF We model a PUF as a C/R function with m bits input, n bits output Challenge m bits PUF Response n bits 9

10 Requirements for PUF PUF must be unique C PUF1 R1 For an ideal PUF design: R i a PUF2 R2 R j b PUF3 R3 if i j, then P(a=b) = 0.5 if i = j, then P(a=b) = 1 Same Challenge Different PUF 10

11 Requirements for PUF PUF must be unique C PUF1 R Hamming Distance = 2 PUF2 R PUF3 R Same Challenge Different PUF 11

12 Requirements for PUF PUF must be unique C PUF1 R PUF2 R Hamming Distance = 1 PUF3 R Same Challenge Different PUF 12

13 Requirements for PUF PUF must be stable C PUF1 PUF1 R R Stability on R Ideal: 100% Actual: % Same Challenge Same PUF Different Operating Parameters 13

14 Requirements for PUF PUF must be unique C PUF1 R1 For an ideal PUF design: Same PUF Different PUF PUF2 R2 PUF3 R3 0% 50% Hamming Distance Same Challenge Different PUF 14

15 Requirements for PUF Uniqueness plot for real PUF [Holcomb 09] Same PUF Different PUF 15

16 Requirements for PUF Uniqueness plot for real PUF [Holcomb 09] Issue 1: The average Hamming Distance for different PUF is less than 50% 50% Same PUF Different PUF 16

17 Requirements for PUF Uniqueness plot for real PUF [Holcomb 09] Issue 2: The average Hamming Distance for identical PUF is bigger than 0% Same PUF Different PUF 17

18 PUF Deployment 2 ways Challenge/Response (C/R) as an authentication system with many unique C/R pairs. Challenge Response

19 PUF Deployment 2 ways Key generation in cryptographic ciphers. Challenge is fixed to get a fixed response that is used as the secret key. The key is not observable by outside world. TPM PUF 19

20 Modeling Attack on PUF Modeling Attack C PUF R C PUF' R C C1 C2 C3 C4 R R1 R2 R3 R4 20

21 Modeling Attack on PUF Modeling attacks: predict future PUF responses by reverse engineering the PUF C/R pairs (training set). Matlab based logistic regression has been used to employ the attack. Challenge PUF Training Set (Challenge/Response pairs Model training using Logistic Regression PUF Model Match y/n? Report correct prediction % 21

22 Summary Physical Unclonable Functions are challenge/response Functions based on random, but stable, physical effects Quality Factors Uniqueness + Stability + Low risk of modeling Low Implementation Cost (Area, Power) 22

23 Outline Part 1: What are PUF? Identity of People and Things PUF Qualities and Threats Part 2: Silicon PUF Process Variation and Silicon PUF Basics Some of the Major Silicon PUFs Part 3: some Highlights of VT 23

24 Chip Design Flow Designer Fabrication Chip 24

25 Sources of Variation in ICs Non-uniform conditions during fabrication Variations in process parameters e.g. oxide thickness Variations in dimensions of the devices Changes in Transistor parameters e.g. I D & V T Variations in circuit characteristics e.g. speed Limited resolution of the photolithographic process 25

26 Lemon: Random PMV Designer Fabrication Chip1 Chip3 Chip2 Processing Lithography Random Process Manufacturing Variations 26

27 Our project: PUF in silicon Designer Fabrication Chip1 Chip3 Chip2 a Physical Unclonable Function is a chip-level structure that deliberately exploits random process manufacturing variations to establish the chip identity 27

28 CMOS PUFs - Advantages A CMOS PUF is fully compatible with existing standard CMOS (digital) design Cannot be cloned/copied Low power and area efficient for constrained embedded applications Inherently secure against invasive attacks IC characteristics change during dismantling 28

29 (Other) Sources of Variation in ICs Non-uniform conditions during fabrication Aging effects Variations in process parameters e.g. oxide thickness Variations in dimensions of the devices Limited resolution of the photolithographic process Changes in Transistor parameters e.g. I D & V T Temporary variations e.g. temperature Variations in circuit characteristics e.g. speed 29

30 Delay Based (Arbiter) PUF An artificial race condition in digital logic [Lim 2005] Switch Switch Switch Arbiter Response b 0 = 1 b 1 = 0 b 2 = 1 Challenge 30

31 Delay Based (Arbiter) PUF The two signals traverse two symmetrical paths. Switch Switch Switch Arbiter Response b 0 = 1 b 1 = 0 b 2 = 1 Challenge 31

32 Delay Based (Arbiter) PUF If you have n switches, this means you have 2 n challenge space. The Challenge/Response space (CR) space is exponential in size with respect to the number of switches. Building ideal switches that are fully symmetrical is extremely hard in ASIC and almost impossible in FPGA. Switch One challenge bit 32

33 Delay Based (Arbiter) PUF Even if it is possible to build non-biased Arbiter PUFs, they are very easily modeled. At N=12, Arbiter PUF has a C/R space of more than 4000 pairs. Nevertheless, simple regression modeling reaches 98% correct prediction at a training set of only 240 C/R pairs. 33

34 RO-PUF Challenge : which 2 ROs to compare? Frequency of r1 < frequency of r2 Response = 0 (Counter2 > Counter1) 34

35 RO-PUF If you have n ROs, this means you have C n 2 challenge space. The Challenge/Response space (CR) space is polynomial in size with respect to the number of switches. Building identical ROs is relatively easy, both in ASIC and FPGA domain. It is fairly resistant to modeling attack. 35

36 Bi-stable: SRAM PUF Each 6-T SRAM cell produces one bit of PUF response. On power up, the transistor mismatch in the cross-coupled inverters results in SRAM cell converging to a logic 1 or 0. Needs to power up SRAM to obtain PUF responses 36

37 Bi-stable: SRAM PUF[1] SRAM cell skew = Process variation mismatch + Noise Un-skewed cell 0-skewed cell Susceptible to noise at low supply voltages 37

38 Other Bi-stable PUFs Fundamentally, bi-stable PUFs exploit some cross-coupled circuit elements to generate responses Sense amplifier based PUFs [2] Butter fly PUF [3] Flip-flop PUF [4] Buskeeper PUF [5] Bi-stable Ring PUF [6] 38

39 Power Grid PUF [6] PUF based on passive components Variations in metal resistances in the power grid are exploited 39

40 Power Grid PUF [6] PUF s response voltage drops measured at a set of distinct locations on the power grid. set of equivalent resistances computed at different location on power grid. Stimulus measure circuitry added to sense different locations on the power grid 40

41 Outline Part 1: What are PUF? Identity of People and Things PUF Qualities and Threats Part 2: Silicon PUF Process Variation and Silicon PUF Basics Some of the Major Silicon PUFs Part 3: some Highlights of VT Select ArbRO PUF Taking PUF out of the lab 41

42 Drawback of Current PUFs Arbiter PUF c[1] c[2] c[n-1] c[n] Ring Oscillator PUF (RO PUF) A B... E 1 E 2 E N-1 E N CLR Q D SET Q c or d1 d3 d4 d2 Exponential C/R Space Vulnerable to modeling Harder to build Arbiter (DFF) race conditions c 0 d1-d2 1 s d3-d4 MUX Path delays d1,d2,d3,d4 Easy to build: ASIC & FPGA Small C/R space Large Area 42

43 Our Motivation We would like to build a new PUF that Is easy to build in both ASIC and FPGA. Provides large C/R space in a given area. Is Resistant to Modeling Attacks. S-ArbRO PUF inherits the good traits of both Arbiter PUF and RO PUF, and improves the available C/R space while being resistant to modeling attacks. 43

44 ArbRO PUF... E 1 E 2 E m 44

45 ArbRO PUF E 1 E 2 E m f(r 1 ) f(r 2 ) f(r 7 ) f(r 4 ) f(r n-3 ) f(r n-2 ) + >0? 45

46 Select-ArbRO PUF (S-ArbRO PUF) K-element set encoding Select Lines for that set Any K of the total N elements are used to generate PUF responses. 46

47 S-ArbRO PUF by example Number of elements (N) =4 Elements in a Subset (K) = 3 E1 E2 E3 E4 Number of Possible subsets : 4 (4 choose 3) Subset combinations : {E1 E2 E3}, {E1 E2 E4}, {E1 E3 E4}, {E2 E3 E4} Challenge bits: 3-element subset encoding Select Lines for each element of the subset 2-bits: 00 -> 11 3-bits: 000 -> E1 E2 E3 01 E1 E2 E4 10 E1 E3 E4 11 E2 E3 E4 47

48 S-ArbRO PUF by example Example Challenge: E1 E2 E3 E4 Subset Encoding : 01 Subset Chosen: E1 E2 E4 Challenge bits to the subset : 101 Challenge bits to E1, E2 and E4 are 1, 0 and 1 respectively Mc: {r3-r4} E1 + {r1-r2} E2 +{r3-r4} E4 48

49 Challenge/Response Space Named S-ArbRO-4 PUF as each element has 4 ROs. As only K out of the total N elements are used to generate PUF responses: There are many (N choose K) K-element subset combinations Each subset has a C/R space of 2 K. 49

50 S-ArbRO-2 PUF The architecture of S-ArbRO-2 PUF is similar to an S-ArbRO- 4 PUF but with 2 ROs. r1 r2 Only half of the challenge space is usable. A subset with K-elements has a C/R Space of 2 K-1 50

51 S-ArbRO-2 vs. S-ArbRO-4 For a given number of ROs, ArbRo-2 is better than ArbRo-4 both in the total C/R space and the size of the model training set. 51

52 Effect of K on S-ArbRO-2 PUF Total C/R space % of correct prediction For N=12, K=7 offers more secure C/R space. K=7 provides the optimum trade-off point between the number of subsets 52

53 Uniqueness (revisit) Challenge IC IC IC IC N N responses HD between IC-1 and IC-2 is 3 Histogram of the HDs M-bits Ideal Mean HD = Number of bits in a response (M)/2 53

Reference 25C IC 1 IC 1 IC 1 Challenges Challenges 1 0 1 1

54 Stability (revisit) Reliability is the quality of being consistent irrespective of the operating environment Reference 25C IC 1 IC 1 IC 1 Challenges Challenges HD=1 HD=2 Ideal HD =

55 Variability and Reliability 1 45C 2 65C Count Count Count HD HD Number of chips = 193 Mean HD of a 1000 bit response = 464 Number of chips = 4 Mean HD of to 45C = 16 Mean HD of to 65C = 23 Error rates of 1.6% and 2.3% 55

56 LR Modeling Attack % of correct prediction At N=12, Arbiter PUF reaches 98% prediction at a training set of only 240 C/R pairs. S-ArbRO PUF (N=12 and K=7) reaches a maximum of 96% prediction when 92% of its total C/R space is used as the training set. 56

57 S-ArbRO PUF Summary We proposed a Silicon PUF called S-ArbRO PUF using ring oscillators which has High C/R space in a given area More resistant to modeling attacks Easily implementable in both ASICs and FPGAs 57

58 Taking the PUF out of the Lab PUF Challenge K bits ID Static L bits Random Variable SRAM PUF? Arbiter PUF? RO PUF? NEW PUF? How to select among x PUF designs with roughly the same I/O? (K, L bits) How to decide which provides a better source of static entropy? 58

59 The PUF Quality Design Space We cannot measure entropy directly, but we can estimate it by measuring a large amount of devices Analyze PUF responses in a four-dimensional space: Chip index (N) Bit index in a ID (L) Measurement index for each ID (T) Bit index in challenge (K) This proposal only concerns the source of entropy; it does not cover area cost, performance 59

60 Starting point: Measuring PUFs ECE VT students use a prototyping FPGA board with a unique serial number We measured, over 2 years, 193 of these boards, each configured with an RO PUF 60

61 How to Encourage Data Collection 61

62 Measurements Database chips, one PUF per chip, 512 RO s per PUF, 100 measurements per PUF N = 193, L = 512, T = 100, K = NA 62

63 First Impression Average Frequency of each RO over 125 FPGAs 63

64 7 Metrics Characterize Design Space Population Uniqueness Probability of Misclassification Identifier Uniformity Bit Aliasing Stability Reliability Steadiness Challenge/Response Diffuseness Based on proposals by Maiti, Hori, Su, ao. 64

65 Metrics characterizing chip population Uniqueness K N L T Average Hamming Distance between IDs (over K, L, N) Expect 50% 65

66 Practical Comparisons RO-PUF Spartan 3E 90nm Arbiter PUF Virtex 5 65nm N=193 chips L=512-bit ID T=100 Meas/ID K=1 ID/Chip N=45 chips L=128-bit ID T=1024 Meas/ID K=1024 ID/Chip Virginia Tech AIST, JP satoh/sasebo/en/index.ht ml 66

67 Comparative Analysis Arbiter PUF Ring Osc PUF Ideal PUF Uniqueness* 36.7% 94.1% 100% Reliability 99.8% 99.1% 100% * Scaled to 100% 67

68 Sample Size is Important Confidence is proportional to s/sqrt(n) Arbiter PUF Ring Osc PUF Uniqueness 36.7% ± 15.4% 94.1% ± 1.5% Uniformity 55.7% ± 0.3% 50.6% ± 0.2% Two-sided 95% confidence 68

69 Stability issues: PUF Aging PUF PUF Static Random Variable Static Random Variable Aging induces permanent electrical changes Slower transistors, lower drive capability (NBTI, HCI, TDDB) Wires degrade or fail (Electromigration) 69

How to test aging effects Simulated by heating/overpowering Eg. MIL-STD-883G 1005.

70 How to test aging effects Simulated by heating/overpowering Eg. MIL-STD-883G C shorter at higher temperatures, at specified bias Thermal Chamber 70

71 Experimental Setup T Stress V Stress Nominal V 1.2V V Stress 1.5V/1.8V Room Temperature 1 2 Temperature Stress (70C/80C)

72 Impact on Oscillation Frequency Frequency of 512 RO s under T + V Stress 72

73 Significant Impact on Reliability 73

74 Distribution of average frequency of 512 RO s after aging Aging after 400Hrs with T+V stress (Location-independent) Simulated Aging (Average, StdDev) 74

75 Aging Results for 178 FPGA s Uniqueness for a population of 178 FPGA s after aging Average Min Max Std Original V-stress 200 Hrs V-stress 400 Hrs T+V-stress 200 Hrs T+V-stress 400 Hrs Almost no impact! 75

76 Conclusions 4 dimensions characterize PUF quality Population Identifier Stability Challenge/Response Quality factors determined empirically PUFs grow old Impact on reliability is significant Impact on uniqueness is marginal 76

77 77

78 Thank YOU! 78

79 References [1] Daniel E. Holcomb, Wayne P. Burleson, and Kevin Fu Power-Up SRAM State as an Identifying Fingerprint and Source of True Random Numbers. IEEE Trans. Comput. 58, 9 (September 2009), DOI= /TC [2] Bhargava, M.; Cakir, C.; Mai, K., "Attack resistant sense amplifier based PUFs (SA-PUF) with deterministic and controllable reliability of PUF responses," Hardware-Oriented Security and Trust (HOST), 2010 IEEE International Symposium on, vol., no., pp.106,111, June 2010 doi: /HST [3] Kumar, S.S.; Guajardo, J.; Maes, R.; Schrijen, G.-J.; Tuyls, P., "Extended abstract: The butterfly PUF protecting IP on every FPGA," Hardware-Oriented Security and Trust, HOST IEEE International Workshop on, vol., no., pp.67,70, 9-9 June 2008 doi: /HST [4] R. Maes, P. Tuyls, and I. Verbauwhede. Intrinsic PUFs from Flip-flops on reconfigurable devices. In Workshop on Information and System Security (WISSec 2008), page 17, Eindhoven,NL,

80 References [5] Simons, P.; van der Sluis, E.; van der Leest, V., "Buskeeper PUFs, a promising alternative to D Flip-Flop PUFs," Hardware-Oriented Security and Trust (HOST), 2012 IEEE International Symposium on, vol., no., pp.7,12, 3-4 June 2012 doi: /HST Ryan Helinski, Dhruva Acharyya, and Jim Plusquellic A physical unclonable function defined using power distribution system equivalent resistance variations. In Proceedings of the 46th Annual Design Automation Conference (DAC '09). ACM, New York, NY, USA, DOI= / Qingqing Chen; Csaba, Gyorgy; Lugli, P.; Schlichtmann, U.; Ruhrmair, U., "The Bistable Ring PUF: A new architecture for strong Physical Unclonable Functions," Hardware-Oriented Security and Trust (HOST), 2011 IEEE International Symposium on, vol., no., pp.134,141, 5-6 June 2011 doi: /HST

Moving PUFs out of the lab

Moving PUFs out of the lab Patrick Schaumont 2/3/2012 Research results by Abhranil Maiti, Jeff Casarona, Luke McHale, Logan McDougall, Vikash Gunreddy, Michael Cantrell What is a Physical Unclonable Function?