task thrustparticipationsexecutive summarydeliverables project description/ resultconclusion 1...

Task Thrust Participations Executive Summary Deliverables Project Description/ Result Conclusion

1

UxIDs: Unclonable Mixed-Signal Integrated Circuits Identification

Contract Review Presentation

November 17, 2010

SRC Task: ICSS 1836.039

Faculty Advisor: Farinaz Koushanfar

Post-Doctorate Associate: Golsa Ghiaasi Hafezi

Student Researcher: Mehrdad Majzoobi

Electrical and Computer Engineering, Rice University

Texas Instruments DSP Leadership University


2

• Task Thrust

• Participants

• Executive Summary

• Deliverables

• Project Description

• Conclusion

OVERVIEWOVERVIEW

ICSS Task ID: 1836.039


3

THRUST AREATHRUST AREACircuit Design/ICSSCircuit Design/ICSS

Task Description

• Architecture, design, fabrication, testing, and analysis of novel circuits for current-based physically unclonable functions (PUFs). The circuit has a much higher precision and accuracy than the state-of-the-art PUFs

• Architecture, design and silicon implementation of novel on-chip current sensors for nondestructive post-silicon characterization and for noninvasive sensing of the aging process

Task Thrust


4

TASKTASKPARTICIPANTSPARTICIPANTS

• Task Leader: Farinaz Koushanfar, Rice University• Co Leader : Golsa Ghiaasi Hafezi , Post Doctorate

Associate, Rice University

• Students: Mehrdad Majzoobi, PhD Student, Rice University

Expected graduation date: June 2011 • Industry Liaison:• Sani Nasif, IBM• Erik Welsh, TI

Participations


5

EXECUTIVE EXECUTIVE SUMMARYSUMMARY

Executive Summary

•Accomplishments

– Dr. Ghiaasi-Hafezi (design expert) joined the team– Finalized the authentication protocol– Finalized the architecture and design details

• Future directions– Upcoming tape-out in December 2010– Circuit testing and measurements– Security tests and countermeasures– Impact of aging and stress on the sensing mechanisms– Proposal for an improved architecture for sense -amp


6

EXECUTIVE EXECUTIVE SUMMARYSUMMARY

Executive Summary

• Technology Transfer– Interacted with MIT faculty working on PUF

• Industrial interactions– Dr. Sani Nassif from IBM Austin Research Lab– Mr. Erik Welsh and Dr. Gene Frantz from Texas

Instruments

• Inventions– In process of submitting a patent request to Rice

University


7

RESEARCHRESEARCHDELIVERABLESDELIVERABLES

• Annual review presentation, October 2009

• Report on the new robust architecture, mechanisms, and

proof-of-concept fabrication and testing results of secure current-based physically unclonable functions and other forms of unclonable identification, July 2010

• Annual review presentation, October 2010

• Report on the security analysis alongside with introduction and enabling of new mechanisms and protocols for IC protection, content-protection, and secure third-party IP protection and thus responding to rapidly changing semiconductor business requirements, July 2011

Deliverables


8

RESEARCHRESEARCHDELIVERABLESDELIVERABLES

• Report on the design, proof-of-concept fabrication, and testing of new current-based on-chip sensors for nondestructive and noninvasive post-silicon characterization, for use in a variety of post-silicon optimizations, July 2012

• Report on the characterizing and quantification of the impact of random environment variations, aging and stress on the introduced sensing mechanisms and current-based PUFs, July 2012

• Final report summarizing research accomplishments and future direction, July 2012

Deliverables


• Physical Unclonable Functions (PUF)

• A unique identifier for each chip – The intrinsic analog variations of a

physical attribute [Pappu et al. Science’02] [Gassend et al. CCS‘02]

• Viable for current and future silicon technologies

• Properties– Unclonable– Fast to evaluate– Hard to remove

9

9

Roy and Asenov, Science, 2005

Friedberg et al., ISQED, 20059

BACKGROUNDBACKGROUND

Project Description/Result


10

AUTHENTICATION PROTOCOLAUTHENTICATION PROTOCOL


• Before deployment, a set of challenge and response pairs are measured and stored for each PUF

PUF

challenge

Response challenge response11011…10 1101..11000110…00 0101..011

10111…11 1000..010

Database


11

BACKGROUNDBACKGROUND


• Arbiter-based PUF: convert analog information to digital *• Compare two paths with an identical delay in design

– Random process variation determines which path is faster– An arbiter outputs 1-bit digital response

• Multiple bits can be obtained by either duplicate the circuit or use different challenges– Each challenge selects a unique pair of delay paths

…

c-bitChallenge

RisingEdge

1 if toppath is faster,else 0

D Q1

1

0

0

1

1

0

0

1

1

0

0

1 0 10 0 1

01

G

Response

* J. Lee, D. Lim, B. Gassend, G. E. Suh, M. van Dijk and S. Devadas, "A Technique to Build a Secret Key in Integrated Circuits for Identification and Authentication Applications" , VLSI Circuits Symposium, 2004.

Suh and Devadas, DAC 2007


12

OBJECTIVESOBJECTIVES

Project Description/Results

• Current-based PUF

• Ultra-low power response generation– Exploit sub-threshold leakage current– Automatic current cut-off

• Shorter evaluation time

• Robustness of responses – In presence of temperature and voltage supply variations

• Exponential number of challenge-response pairs


13

MACROMACRO ARCHITECTUREARCHITECTURE

Project Description/ Results

Block diagram of PUF architecture

– Generation of process sensitive currents and voltages

• e.g., I = {I1,…,IN}

– The inputs (challenges) are used to select two equivalent subset of currents a and b

• the currents are equivalent by construction, but differ because of process variations

– The task of combination could be linear or non-linear

– Comparison of two selected groups


14

CIRCUIT LEVELCIRCUIT LEVELARCHITECTUREARCHITECTURE


PUF architecture with current generators, current switches, and a latch based sense amplifier.

• Current generation– Single N-FETs with fixed

gate voltage

• Selection and combination– Differential current

switches – Stir the current to the left

and right based on the input challenges Ca,Cb

• Comparison– Sense amplifier


15

SENSE AMPLIFIERSENSE AMPLIFIEROPERATIONOPERATION


Before (1) M5 , M6: on and the rest are off VSON=VSO=VDD

Phase 1

Phase 2

Phase 3

Vso

Vson

Vout

VO

1

2 3 4

Trigger

VDD

Trigger

SOSON

I1 I2

M1

M2 M4

M3

M6M5

(1) M5 and M6: off, M1 and M3:onDischarge SON, SO nodes

Ia > Ib

(2) VSON-VSO=Vtp M2: onStrong positive feedback : more rapid discharge of VSON

(3) VSON< Vtn M3 :off


16

SENSING SENSING RESOLUTIONRESOLUTION


• Monte Carlo simulations at two extreme temperature points– Using minimum size devices

• X-axis: Current difference (%)• Y-axis: Current average (common

component) in μA• Z-axis: Instability of the sense

amp output

• The dark blue area represents the best operation region (0.5 means 50% of responses are errors)

VDD

Trigger

SOSON

I1 I2

M1

M2 M4

M3

M6M5


17

EXPRIMENTALEXPRIMENTAL SETUPSETUP


• Experiment setup– N=64 current generators (and

current switches) – IBM 90nm technology

stochastic models

– Device sizes are set to the technology minimum

• W/L = 120nm/100nm

– Using Monte Carlo simulation• 100 circuit instances are

generated

– Apply 100 challenges to each PUF circuit instance

– Rate of applying challenges: 100MHz

1 0 0 1 … 1 00 1 0 1 … 1 01 0 0 1 … 0 1

0 1

0 11 0


18

OPERATION OPERATION POINT SELECTIONPOINT SELECTION


Response distribution• For each chip

– the number of ’1’s in 100 responses normalized to 100

– ideal: equal number of ‘1’s and ‘0’s in responses for highest level of randomness

– for Vgate/VDD = 0.1 • the responses are highly

biased toward ‘1’• the generated currents

are too small to provoke any response from the sense amp

• Distribution of ‘1’ responses across the 100 PUF instances versus different gate voltages for different number of active currents.


19

SENSITIVITY SENSITIVITY TO OPERATIONAL VARIATIONTO OPERATIONAL VARIATION


• Response robustness– The PUF was

evaluated under multiple modes of operation, i.e., for various

• Vgate/VDD

• Temperature points• VDD points• Number of active

currents• Lowest error rate is

achieved for smallest Vgate under which the sense amp operates correctly

Response error rate under different levels of temperature and VDD variations

Temperature Range (C°)commercial: [0 ,75] industrial: [-40 ,85]military: [-55 ,125]


20

FLOORPLAN FLOORPLAN /TESTING STRATEGY /TESTING STRATEGY


The die floorplan of the final chip. The challenges and responses are read in/out serially through scan chains.

- Redundant sense amps on both ends for more reliable operation and defect tolerance

- I/O scan chains to read in/out the challenge and responses serially

- Buffers act as repeaters to strengthen the challenge signals and reduce noise

Fabrication planIBM CMOS 9FLP (90nm)6 Metal stack (6_02_00_00_LB)MOSIS/SRC joint programCeramic dual in line packaging


21

SECURITY ANALYSISSECURITY ANALYSIS


• Randomness and uniqueness tests

• Nonlinearity tests

• Reverse-engineering tests

• Resiliency evaluation against side-channel attacks

• Input / interconnect networks (permutation and substitution of challenges)

• Output network (XOR mixing)

PUF

PUFInput

Net. (G)

PUF

Input Net. (G)

Input Net. (G)

... ...Output Network (Z)

...

Interconnect Network

Input Output


22

PRELIMINARY SECURITY ANALYSISPRELIMINARY SECURITY ANALYSIS

Conclusion

• Publications and preprints

• M. Majzoobi, F. Koushanfar. "Time-bounded Authentication of PUFs." Article under review, IEEE Transactions on Information Forensics and Security, 2010.

• F. Koushanfar, M. Majzoobi, U. Ruhrmair, S. Devadas. “Physical Unclonable Function (PUF) Hardware and Security Analysis.” Book Chapter in Hardware-Based Security, John Wiley and Sons, 2011.

• M. Majzoobi, G. Ghiaasi, F. Koushanfar, S. Nassif. " Ultra-low Power Current-based PUF.” submitted to IEEE International

Symposium on Circuits and Systems (ISCAS), 2011.


23

CONCLUSIONCONCLUSION

Conclusion

• Physical unclonable functions (PUFs)– Emerging paradigm for intrinsic identification and authentication

• Novel current-based PUF– Lightweight– Higher entropy of responses (output)

• Devised macro-, micro- and circuit-level architecture• Simulations results for robustness and stability• Preliminary security analysis for randomness and

uniqueness• Tape-out scheduled for December 2010


24

QUESTIONS / DISCUSSION :

[email protected]@[email protected]


Overview & objectives

• Architecture, design, fabrication, testing, and analysis of novel circuits for current-based Physical Unclonable Functions (PUFs)

•The circuit has a much higher precision and accuracy while lower power than the state-of-the-art PUFs

• Architecture, design and silicon implementation of novel on-chip current sensors

•Nondestructive post-silicon characterization and for noinvasive sensing for aging

Distribution of ‘1’ responses across the 100 PUF instances versus different gate voltages for different number of active currents.

Response error rate under different levels of temperature and VDD variations

HIGHLIGHTHIGHLIGHT

task thrustparticipationsexecutive summarydeliverables project description/ resultconclusion 1...

Documents