SRAM-based Physical Unclonable Functions

Transcription

1 Feb 26, Worcester Polytechnic Institute SRAM-based Physical Unclonable Functions Daniel E. Holcomb UMass Amherst Collaborators for these works: Wayne P Burleson Kevin Fu Amir Rahmati Uli Ruhrmair Negin Salajegheh Xiaolin Xu

2 Counterfeit Electronics DoD:.8k incidents in 29/; M parts Recycled e-waste Test rejects Regrading aeri.com SRAM PUFs WPI, Feb 25 2

3 Counterfeit Electronics DoD:.8k incidents in 29/; M parts Recycled e-waste Test rejects Regrading aeri.com We do not want a $2 million missile defense interceptor's reliability compromised by a $2 counterfeit part. -- General Patrick O Reilly, Director, Missile Defense Agency mhra.gov.uk Both components and devices have been counterfeited, and the practice appears to be growing. With a high potential profit, counterfeiting medical devices is a huge business. -- Unique Identification for Medical Devices -- FDA-sponsored report, 26 SRAM PUFs WPI, Feb 25 2

4 Counterfeit Electronics DoD:.8k incidents in 29/; M parts Recycled e-waste Test rejects Regrading aeri.com We do not want a $2 million missile defense interceptor's reliability compromised by a $2 counterfeit part. -- General Patrick O Reilly, Director, Missile Defense Agency mhra.gov.uk Both components and devices have been counterfeited, and the practice appears to be growing. With a high potential profit, counterfeiting medical devices is a huge business. -- Unique Identification for Medical Devices -- FDA-sponsored report, 26 SRAM PUFs WPI, Feb 25 2

5 Counterfeit Electronics DoD:.8k incidents in 29/; M parts Recycled e-waste Test rejects Action Regrading Medical Device Alert Ref: MDA/2/4 Issued: 8 January 2 at : Device Counterfeit Covidien Nellcor We do not want SpO a $2 2 Durasensor million (DS-A) missile defense interceptor's sensors. reliability compromised by a $2 counterfeit part. aeri.com -- General Patrick O Reilly, Director, Missile Defense Agency mhra.gov.uk Both components and devices have been counterfeited, and the practice appears to be growing. With a high potential profit, counterfeiting medical devices is a huge business. -- Unique Identification for Medical Devices -- FDA-sponsored report, 26 SRAM PUFs WPI, Feb 25 2

6 Unique Features Abstraction: the act of considering something as a general quality or characteristic, apart from concrete realities, specific objects, or actual instances. [dictionary.com] Biometrics: the measurement and analysis of unique physical or behavioral characteristics especially as a means of verifying personal identity. [merriam-webster.com] [Bertillon, 893] SRAM PUFs WPI, Feb 25 3

7 Unique Features Abstraction: the act of considering something as a general quality or characteristic, apart from concrete realities, specific objects, or actual instances. [dictionary.com] Biometrics: the measurement and analysis of unique physical or behavioral characteristics especially as a means of verifying personal identity. [merriam-webster.com] Camera Sensors [Lukas et al., 26] Blank Paper Gait Analysis Retina [Clarkson et al., 29] [Nixon et al., 996] Fingerprints [Hill, 978] Ear shape [Galton, 895] Iris Compact Discs [Bertillon, 893] [Choras et al., 24] [Daugman, 993] [Hammouri et al, 29] SRAM PUFs WPI, Feb 25 3

8 Overview Introduction to PUFs. SRAM power-up state as PUF 2. SRAM data retention voltage as PUF 3. Modified SRAM as challenge-response PUF SRAM PUFs WPI, Feb 25 4

9 Physical Unclonable Functions Silicon Physical Random Functions Research Mentions by Year Blaise Gassend, Dwaine Clarke, Marten van Dijk and Srinivas Devadas Massachusetts Institute of Technology Laboratory for Computer Science Cambridge, MA 239, USA ABSTRACT { } We introduce the notion of a Physical Random Function (PUF). We argue that a complex integrated circuit can be viewed as a silicon PUF and describe a technique to identify and authenticate individual integrated circuits (ICs). We describe several possible circuit realizations of differ- Year SRAM PUFs WPI, Feb 25 5

10 Physical Unclonable Functions Physical Behavior depends on physical variations Unclonable No way to predict outputs Behavior cannot be modeled Challenges f PUF Characterized by Challenge-Response Pairs (CRPs) Responses Behavior cannot be observed Function Produces responses, possibly from challenges SRAM PUFs WPI, Feb 25 6

11 Design Considerations for Silicon PUFs Outputs determined by uncorrelated variation Random dopant fluctuations and small devices Balanced parasitics and wire lengths to avoid bias Variation and noise hard to separate Distance-based matching Error correction Secure Unreadable by invasive attack SRAM PUFs WPI, Feb 25 7

12 Weak vs Strong PUFs Weak PUFs Strong PUFs Use cases: New form of key storage Use cases: New cryptographic primitive No challenge, just response Many challenge-response pairs Responses remain internal Public CRP interface Perfect internal error correction Error correction outside PUF is possible Attacks: Cloning and invasive reading of responses Attacks: Modeling attacks and protocol attacks SRAM PUFs WPI, Feb 25 8

13 Weak vs Strong PUFs Weak PUFs Strong PUFs Use cases: New form of key storage Use cases: New cryptographic primitive No challenge, just response Responses remain internal Perfect internal error correction Attacks: Cloning and invasive reading SIMPL, of responses etc Many challenge-response pairs Weak and strong are two PUF subclasses among many Controlled PUFs Public PUFs Public CRP interface Error correction outside PUF is possible Attacks: Modeling attacks and protocol attacks SRAM PUFs WPI, Feb 25 8

14 Examples of Strong PUFs Optical PUF [Pappu et al. 2] Arbiter PUF [Gassend et al. 2, Lim et al. 5] Bistable Ring PUF [Chen et al. ] Low-power current-based PUF [Majzoobi et al. ] Research Mentions by Year "Arbiter PUF" "PUF" SRAM PUFs WPI, Feb 25 Year 9

15 Strong PUF Protocols Identification/Authentication () Key Exchange (2,3) Oblivious transfer (4,3,5,6) enables secure two-party computation Bit commitment (3,5,6,7,8) enables zero-knowledge proofs Combined key exchange and authentication (9) () R. Pappu et al, Science 22 (2) M.v.Dijk, US Patent 2,653,97, 24 (3) C. Brzuska et al, CRYPTO 2 (4) U. Rührmair, TRUST 2 (5,6) U. Rührmair, M.v.Dijk, CHES 22 and JCEN 23 (7) U. Rührmair, M.v. Dijk, Cryptology eprint Archive, 22 (8) Ostrovsky et al., EUROCRYPT 23 (9) Tuyls and Skoric, Strong Authentication with Physical Unclonable Functions, Springer 27 SRAM PUFs WPI, Feb 25

16 Arbiter PUF [B Gassend et al., 2] [D. Lim et al., 5] S Q R Challenges: c i 2 m (m= num stages) Responses: r i, Uses variations in subcomponent delays SRAM PUFs WPI, Feb 25

17 Arbiter PUF [B Gassend et al., 2] [D. Lim et al., 5] S Q R Challenges: c i 2 m (m= num stages) Responses: r i, Uses variations in subcomponent delays SRAM PUFs WPI, Feb 25

18 Arbiter PUF [B Gassend et al., 2] [D. Lim et al., 5] S Q R Challenges: c i 2 m (m= num stages) Responses: r i, voltage Q= S R time Uses variations in subcomponent delays SRAM PUFs WPI, Feb 25

19 Arbiter PUF [B Gassend et al., 2] [D. Lim et al., 5] S Q R Q= Challenges: c i 2 m (m= num stages) voltage S R Responses: r i, time Uses variations in subcomponent delays SRAM PUFs WPI, Feb 25

20 Arbiter PUF [B Gassend et al., 2] [D. Lim et al., 5] S Q R Challenges: c i 2 m (m= num stages) Responses: r i, voltage Q= S R time Uses variations in subcomponent delays SRAM PUFs WPI, Feb 25

21 Arbiter PUF [B Gassend et al., 2] [D. Lim et al., 5] S Q R Q= Challenges: c i 2 m (m= num stages) voltage S R Responses: r i, Uses variations in subcomponent delays voltage time Q= R S time SRAM PUFs WPI, Feb 25

22 Arbiter PUF [B Gassend et al., 2] [D. Lim et al., 5] S Q R Challenges: c i 2 m (m= num stages) Responses: r i, Uses variations in subcomponent delays SRAM PUFs WPI, Feb 25 voltage voltage Assumes that model cannot be created by observing CRPs But basic arbiter PUF susceptible to additive delay model Q= S R time Q= R S time

23 Arbiter PUF [B Gassend et al., 2] [D. Lim et al., 5] XOR Arbiter PUF resists additive model S R Q [G. Suh et al., 7] [M. Majzoobi et al., 8] Challenges: c i 2 m (m= num stages) Responses: r i, Uses variations in subcomponent delays SRAM PUFs WPI, Feb 25 voltage voltage Assumes that model cannot be created by observing CRPs But basic arbiter PUF susceptible to additive delay model Q= S R time Q= R S time

24 Authentication using Strong PUF Enroll PUF Choose random challenges Apply and store private CRPs Strong PUF (c,r ) (c,r ) (c 2,r 2 ) SRAM PUFs WPI, Feb 25 2

25 Authentication using Strong PUF Enroll PUF Choose random challenges Apply and store private CRPs (c,r ) (c,r ) (c 2,r 2 ) SRAM PUFs WPI, Feb 25 2

26 Authentication using Strong PUF Enroll PUF Choose random challenges Apply and store private CRPs Strong PUF (c,r ) (c,r ) (c 2,r 2 ) SRAM PUFs WPI, Feb 25 2

27 Authentication using Strong PUF Enroll PUF Choose random challenges Apply and store private CRPs c Strong PUF (c,r ) (c,r ) (c 2,r 2 ) SRAM PUFs WPI, Feb 25 2

28 Authentication using Strong PUF Enroll PUF Choose random challenges Apply and store private CRPs (c,r ) (c,r ) (c 2,r 2 ) Authenticate r r? c r Strong PUF SRAM PUFs WPI, Feb 25 2

29 Authentication using Strong PUF Enroll PUF Choose random challenges Apply and store private CRPs (c,r ) (c,r ) (c 2,r 2 ) Authenticate r r? c r Strong PUF SRAM PUFs WPI, Feb 25 2

30 Authentication using Strong PUF Enroll PUF Choose random challenges Apply and store private CRPs (c,r ) (c,r ) (c 2,r 2 ) Authenticate r r? c r Strong PUF Responses can be public if PUF resists modeling SRAM PUFs WPI, Feb 25 2

31 Examples of Weak PUFs Using custom circuits Drain currents [Lofstrom et al. 2] Capacitive coating PUF [Tuyls et al. 6] Cross-coupled devices [Su et al. 7] Sense amps [Bhargava et al. ] "SRAM PUF" "PUF" Using existing circuits Clock skew [Yao et al. 3] Research Mentions by Year Flash latency [Prabhu et al. ] Year Power-up SRAM state [Guajardo et al. 7, Holcomb et al. 7] SRAM PUFs WPI, Feb 25 3

32 Applications of Weak PUFs Identification Authentication Secret key Random number generation SRAM PUFs WPI, Feb 25 4

33 RFID Security 27 IEEE Transactions on Computer 29 SRAM Power-up State Using Retention voltage of SRAM cells as a signature Daniel E. Holcomb Kevin Fu Wayne Burleson See also: Guajardo et al., CHES 7 Intrinsic ID

34 6-Transistor SRAM Cell Ubiquitous memory Two stable states: (AB=) (AB=) Wordline selects a cell for reading/writing Complementary bitlines read/write values to/from selected cells wordline wordline A B A B bitlines BL BLB BL SRAM PUFs WPI, Feb 25 bitlines BLB 6

35 SRAM Power-up State Utilize inherent power-up bias of each SRAM cell BLB A VDD WL B BL Voltage VDD A B Time [ns] No challenge other than cell selection Responses: r 2 n (power-up state of n cells) Behavior from threshold variation of transistors in cell SRAM PUFs WPI, Feb 25 7

36 SRAM Variation Static noise margin [Seevink et al., 987] B Sets lower bound on safe V DD A State State VA SNM VB SRAM PUFs WPI, Feb V DD 8

37 SRAM Power-up Power-up sensitive to variations Uncorrelated across cells and chips B Persistent A.4.3 V DD..75 State State V.2 SNM Time [ns] SRAM PUFs WPI, Feb V DD 9

38 SRAM Power-up Power-up sensitive to variations Uncorrelated across cells and chips B Persistent A.4.3 V DD A B..75 State State V.2 SNM Time [ns] SRAM PUFs WPI, Feb V DD 9

39 Power-up Fingerprint 64-bit fingerprints Population size of 5,2 Frequency.24 Between Class Within Class Hamming Distance SRAM PUFs WPI, Feb 25 2

40 Temperature Frequency C C 5C Within Class Hamming Distance SRAM PUFs WPI, Feb 25 2

41 NBTI Aging Stored state impacts subsequent power-up tendency Favors opposite of stored state Possible directed attack Recovery after stress removed A= B= Directed aging can improve reliability Constructively bias cells away from metastability [Bhargava et al. HOST 2] [Mathew et al. ISSCC 4] SRAM PUFs WPI, Feb 25 22

42 Power-up State PUF as Secret Key Enroll PUF at Manufacture Weak PUF Learn response r Choose key k and derive public helper data h: h = Encode(k) r code offset construction [Dodis et al. 8] SRAM PUFs WPI, Feb 25 23

43 Power-up State PUF as Secret Key Enroll PUF at Manufacture Weak PUF Learn response r Choose key k and derive public helper data h: h = Encode(k) r Store h with PUF Disable access to response r h code offset construction [Dodis et al. 8] SRAM PUFs WPI, Feb 25 23

44 Power-up State PUF as Secret Key Enroll PUF at Manufacture Learn response r Generate Key in Field Choose key k and derive public helper data h: h = Encode(k) r Store h with PUF Weak PUF Disable access to response r h code offset construction [Dodis et al. 8] SRAM PUFs WPI, Feb 25 23

45 Power-up State PUF as Secret Key Enroll PUF at Manufacture Learn response r Choose key k and derive public helper data h: h = Encode(k) r Store h with PUF Disable access to response r k is reliable key Generate Key in Field Measure r h Key k = Decode(r h) Weak PUF h code offset construction [Dodis et al. 8] SRAM PUFs WPI, Feb 25 23

46 Power-up State PUF as Secret Key Enroll PUF at Manufacture Learn response r Choose key k and derive public helper data h: h = Encode(k) r Store h with PUF Disable access to response r k is reliable key Generate Key in Field Measure r h Key k = Decode(r h) Weak PUF h Reliable unclonable key for crypto Assumes that r cannot be read in field code offset construction [Dodis et al. 8] SRAM PUFs WPI, Feb 25 23

47 RFID Security 22 IEEE Transactions on CAD 25 DRV Fingerprinting Using Retention voltage of SRAM cells as a signature Daniel Holcomb Xiaolin Xu Amir Rahmati Negin Salajegheh Kevin Fu Wayne Burleson

48 DRV Fingerprint Matching Fingerprint of cell is a pair [Vc, Vc] Vc : Highest voltage that causes flip from state Vc : Highest voltage that causes flip from state Frequency Frequency Vc vc [mv] Identification using Euclidean distance matching SRAM PUFs WPI, Feb 25 Vc vc Unique [mv] 2 Correct Match DRV 99.7% Power-up 7.7% 25

49 Data Retention Voltage More informative than power-up state..75 State State C SNM VDD V State State C SNM VDD SRAM PUFs WPI, Feb 25 26

50 Data Retention Voltage More informative than power-up state..75 State State C SNM.5.25 V VDD C.A C.B C.A C.B SNM VDD V State State C VDD Time [ns] SRAM PUFs WPI, Feb 25 26

51 Data Retention Voltage More informative than power-up state..75 State State C SNM VDD V VDD.3 SNM State State C. Time VDD SRAM PUFs WPI, Feb 25 26

52 Data Retention Voltage More informative than power-up state..75 State State C SNM VDD V VDD.3 SNM State State C. Time VDD SRAM PUFs WPI, Feb 25 26

53 Data Retention Voltage More informative than power-up state Support from non-volatile storage..75 State State C SNM VDD V VDD.3 SNM State State C. Time VDD SRAM PUFs WPI, Feb 25 26

54 Data Retention Voltage More informative than power-up state Support from non-volatile storage..75 State State C SNM VDD V VDD.3 SNM State State C. Time VDD SRAM PUFs WPI, Feb 25 26

55 DRV PUF as Secret Key Encode/Decode n-bit key using 2n-bit SRAM helper data Address SRAM PUFs WPI, Feb 25 DRV arbitrary key 7 7 index-based syndrome coding [Yu et al. D&TC ] [Hiller et al. HOST 2] 27

56 DRV PUF as Secret Key Encode/Decode n-bit key using 2n-bit SRAM bit i = if first address in pair i has higher DRV encode helper data arbitrary key Address SRAM PUFs WPI, Feb DRV ,x,x index-based syndrome coding [Yu et al. D&TC ] [Hiller et al. HOST 2]

57 DRV PUF as Secret Key Encode/Decode n-bit key using 2n-bit SRAM bit i = if first address in pair i has higher DRV encode helper data arbitrary key 9,, x,x, x,x Address SRAM PUFs WPI, Feb DRV ,x,x index-based syndrome coding [Yu et al. D&TC ] [Hiller et al. HOST 2]

58 DRV PUF as Secret Key Encode/Decode n-bit key using 2n-bit SRAM bit i = if first address in pair i has higher DRV encode helper data arbitrary key,9, x,x, x,x Address SRAM PUFs WPI, Feb DRV ,x,x index-based syndrome coding [Yu et al. D&TC ] [Hiller et al. HOST 2]

59 DRV PUF as Secret Key Encode/Decode n-bit key using 2n-bit SRAM helper data,9, x,x, x,x bit i = if first address in pair i has higher DRV Address SRAM PUFs WPI, Feb 25 DRV arbitrary key index-based syndrome coding [Yu et al. D&TC ] [Hiller et al. HOST 2] 27

60 DRV PUF as Secret Key Encode/Decode n-bit key using 2n-bit SRAM bit i = if first address in pair i has higher DRV decode helper data arbitrary key,9, x,x, x,x Address DRV ,x,x index-based syndrome coding [Yu et al. D&TC ] [Hiller et al. HOST 2] SRAM PUFs WPI, Feb 25 27

61 DRV PUF as Secret Key Encode/Decode n-bit key using 2n-bit SRAM bit i = if first address in pair i has higher DRV decode helper data arbitrary key,9, x,x, x,x Address DRV % reliable key generation using silicon data Cost of DRV characterization in field is a limitation,x,x index-based syndrome coding [Yu et al. D&TC ] [Hiller et al. HOST 2] SRAM PUFs WPI, Feb 25 27

62 Cryptographic Hardware and Embedded Systems 24 Bitline PUF: Building Native Challenge-Response PUF Capability into Any SRAM Daniel E. Holcomb Kevin Fu Acknowledgment: This work was supported in part by C-FAR, one of six centers of STARnet, a Semiconductor Research Corporation program sponsored by MARCO and DARPA, and by NSF CNS Any opinions, findings, conclusions, and recommendations expressed in these materials are those of the authors and do not necessarily reflect the views of the sponsors.

63 Contributions Adding a few gates to wordline drivers of SRAM creates a new PUF Bitline PUF Challenge-response operation Low area overhead Simple Word Enable Word Clk Reset Eval Word Y- Holcomb and Fu Bitline PUF CHES 24 29

64 Reading an SRAM Cell Precharge Circuits Wordline Drivers Word Word Word Y- Sense Amps Holcomb and Fu Bitline PUF CHES 24 3

65 Reading an SRAM Cell Precharge Circuits PRE Wordline Drivers Word Word Word Y- Sense Amps WL BLi BLBi RE RE RE Holcomb and Fu Bitline PUF CHES 24 3

66 Reading an SRAM Cell Precharge Circuits PRE Wordline Drivers Word Word Word Y- Sense Amps WL BLi BLBi.2 Voltage.8.4 PRE (Precharge) 2 3 Time [ns] RE RE RE Holcomb and Fu Bitline PUF CHES 24 3

67 Reading an SRAM Cell Precharge Circuits PRE Wordline Drivers Word Word Word Y- Sense Amps WL BLi BLBi.2 Voltage.8.4 PRE (Precharge) WL (Wordline) 2 3 Time [ns] RE RE RE Holcomb and Fu Bitline PUF CHES 24 3

68 Reading an SRAM Cell Precharge Circuits PRE Wordline Drivers Word Word Word Y- Sense Amps WL BLi BLBi.2 Voltage.8.4 PRE (Precharge) WL (Wordline) RE (Read Enable) 2 3 Time [ns] RE RE RE Holcomb and Fu Bitline PUF CHES 24 3

69 Bitline PUF Accumulate wordline enable signals for concurrent read Concurrent reading causes contention Contention resolves according to variations Enable Clk Reset Eval Word Word Word Y- Write SRAM cells Load WL Drivers Read Holcomb and Fu Bitline PUF CHES 24 3

70 Reading a Bitline PUF Read with contention PRE Contention resolves according to variation WL WL BLi BLBi RE RE Write SRAM cells Load WL Drivers Read RE Holcomb and Fu Bitline PUF CHES 24 32

71 Reading a Bitline PUF Read with contention PRE Contention resolves according to variation WL WL BLi BLBi.2 Voltage.8.4 WL RE RE WL 2 3 Time [ns] RE Holcomb and Fu Bitline PUF CHES 24 32

72 Reading a Bitline PUF Read with contention PRE Contention resolves according to variation WL WL BLi BLBi.2 Voltage.8.4 WL RE RE WL 2 3 Time [ns] RE Holcomb and Fu Bitline PUF CHES 24 32

73 Reading a Bitline PUF Read with contention PRE Contention resolves according to variation WL WL BLi BLBi.2 Voltage.8.4 WL RE RE WL 2 3 Time [ns] RE Holcomb and Fu Bitline PUF CHES 24 32

74 Reading a Bitline PUF Read with contention PRE Contention resolves according to variation WL WL BLi BLBi.2 Voltage.8.4 WL RE RE WL 2 3 Time [ns] RE Holcomb and Fu Bitline PUF CHES 24 32

75 Reading a Bitline PUF Read with contention PRE Contention resolves according to variation WL WL BLi BLBi.2 Voltage.8.4 WL RE RE WL 2 3 Time [ns] RE Holcomb and Fu Bitline PUF CHES 24 32

76 Reading a Bitline PUF Read with contention PRE Contention resolves according to variation WL WL BLi BLBi.2 Voltage.8.4 WL RE RE WL 2 3 Time [ns] RE Holcomb and Fu Bitline PUF CHES 24 32

77 Reading a Bitline PUF Read with contention PRE Contention resolves according to variation WL Largely consistent over time for given column WL BLi BLBi.2 Voltage.8.4 WL RE RE WL 2 3 Time [ns] RE Holcomb and Fu Bitline PUF CHES 24 32

78 Reading a Bitline PUF Read with contention PRE Contention resolves according to variation WL Largely consistent over time for given column WL BLi BLBi.2 Voltage.8.4 WL RE RE WL 2 3 Time [ns] RE Holcomb and Fu Bitline PUF CHES 24 32

79 Reading a Bitline PUF Read with contention PRE Contention resolves according to variation WL Largely consistent over time for given column WL Varies across columns or chips BLi BLBi.2 Voltage.8.4 WL RE RE WL 2 3 Time [ns] RE Holcomb and Fu Bitline PUF CHES 24 32

80 Challenge Response Pairs PUF Challenge: Y 4 possible challenges (Y = num. rows) For each cell in column:. wordline on, cell value 2. wordline on, cell value 3. wordline off, cell value 4. wordline off, cell value PUF Response: Value read by sense amp of column(s) Holcomb and Fu Bitline PUF CHES 24 33

81 Performance and Overhead Load Challenge Eval. Responses Write SRAM cells Load WL Drivers Read Y Cycles Y Cycles Cycle Word Word Word Y- Holcomb and Fu Bitline PUF CHES 24 34

82 Performance and Overhead Load Challenge Eval. Responses Write SRAM cells Load WL Drivers Read Y Cycles Y Cycles Cycle Word Word Word Y- Holcomb and Fu Bitline PUF CHES 24 34

83 Performance and Overhead Load Challenge Eval. Responses Write SRAM cells Load WL Drivers Read Y Cycles Y Cycles Cycle Word Word Word Y- Holcomb and Fu Bitline PUF CHES 24 34

84 Performance and Overhead Load Challenge Eval. Responses Write SRAM cells Load WL Drivers Read Y Cycles Y Cycles Cycle Word Word Word Y- Holcomb and Fu Bitline PUF CHES 24 34

85 Performance and Overhead Load Challenge Eval. Responses Write SRAM cells Load WL Drivers Read Y Cycles Y Cycles Cycle Word Word Word Y- Holcomb and Fu Bitline PUF CHES 24 34

86 Performance and Overhead Load Challenge Eval. Responses Write SRAM cells Load WL Drivers Read Y Cycles Y Cycles Cycle X X X X Word Word X X Word Y- Holcomb and Fu Bitline PUF CHES 24 34

87 Performance and Overhead Load Challenge Eval. Responses Write SRAM cells Load WL Drivers Read Y Cycles Y Cycles Cycle X X Word X X X Word X Word Y- Holcomb and Fu Bitline PUF CHES 24 34

88 Performance and Overhead Load Challenge Eval. Responses Write SRAM cells Load WL Drivers Read Y Cycles Y Cycles Cycle Word-parallel (e.g. 256 columns) Response latency 6 cycles for 256-bit response as shown Depends on number of enabled rows Area overhead A few extra gates per SRAM row Don t need to add circuitry on all rows X X X X Word Word X X Word Y- Holcomb and Fu Bitline PUF CHES 24 34

89 Integration Simple digital interface No power-cycling required Non-exclusive, SRAM rows still usable as memory when not used for PUF Does not upset stored data in non-used rows Word Enable Word Word Y- Clk Reset Eval Holcomb and Fu Bitline PUF CHES 24 35

90 Methodology Circuit simulation using Ngspice Devices are 9nm Predictive Technology Model [] Sizing according to Nii et al. [2] Variation: threshold voltage and channel length [3,4] Noise: between cross-coupled nodes [5] experiment code available online: Holcomb and Fu Bitline PUF CHES 24 n4 p2 n2 µ σ µ σ [] Predictive Technology Model. 9nm NMOS and PMOS BSIM4 Models [2] Nii et al., IEEE Journal of Solid State Circuits, 24 [3] Pelgrom et al. IEEE Journal of Solid State Circuits, 989 [4] Seevinck et al. IEEE Journal of Solid State Circuits, 987 [5] Anis et al. Workshop on System-on-Chip for Real-Time Applications, p n n3 36

91 Choosing Useful Challenges Word Word Word Word Word Y- Word Y- Holcomb and Fu Bitline PUF CHES 24 37

92 Choosing Useful Challenges Useful challenges have equal number of s and s Exponential subset of the 4 Y possible challenges Num. s in Challenge Num. s in Challenge 5% 4% 3% 2% % % Prob. of Diff. Response Num. of Challenges e+4 e+ e+6 equal / 2 Y e Y (Num. of SRAM Rows) (Asymmetric designs may have different useful challenges) Holcomb and Fu Bitline PUF CHES 24 38

93 Uniqueness and Reliability Applying random challenges with equal number s and s Nominal conditions:.2v and 27 C Frequency.5.25 Nominal BER is 2.3% Hamming Distance Between 32-bit Responses Within-Class Between-Class BER vs.2 V BER 7.6% across voltage and temperature Supply Voltage [V] BER vs 27 C Temperature [C] Holcomb and Fu Bitline PUF CHES 24 39

94 Modeling Attacks Can a model predict Bitline PUF s responses? (Yes) 3 2 Challenge values. WL on, value 2. WL on, value 3. WL off, value 4. WL off, value CRPs must be obfuscated Prediction Accuracy % 9% 8% 7% 6% 5% Classification using SVM light [] PUF A PUF B PUF C Size of Training Set [] Joachims. Making large-scale SVM Learning Practical. Advances in Kernel Methods - Support Vector Learning, 999 Holcomb and Fu Bitline PUF CHES 24 4

95 Summary PUFs as a new key storage mechanism. SRAM power-up: Use initial RAM state as basis for key 2. DRV fingerprint: Use minimum data retention voltage as basis for key 3. Bitline PUF: Modify SRAM array to enable physical challenge-response hashing Thank you for your attention. Questions? SRAM PUFs WPI, Feb 25 4