very stable puf based on two mosfet
TRANSCRIPT
A Simple and Reliable Cell for Single Bit
Physically Unclonable Constants
Riccardo Bernardini and Roberto Rinaldo
DIEG–University of Udine
{riccardo.bernadini, rinaldo}@uniud.it
Extended journal version:
http://ieeexplore.ieee.org/document/7539631/
January 31, 2017
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Outline
• Motivation and Introduction
– An example: SRAM
– Double randomness and reliability
• Our proposal
– Description
– Analytic results
– Simulation results
• Conclusions & the Future
1
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Motivation
So, tell me,what is a PUC?
A Physically UnclonableConstant, a secret word, impossible to reproduceeven for the chip maker
What is used for? Chip authentication,
private keys,stuff like that…
2
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Motivation
Wouldn't a NVM suffice?
No, the secret word mustexist only when the chipis "alive"…
To avoid "offline"attacks, you see…Hmm… I see.
How do you that?By exploitingconstruction-timerandom variationsLet me use an example…
3
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
An example: SRAM
It is an SRAM! Yes, just readit without initializing it…
But you'll get a random value!
Well… Yes and no…
V1(t)V2(t)
4
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
An example: SRAM
0 0.2 0.4 0.6 0.8 1 1.20
0.2
0.4
0.6
0.8
10
x
1
V1
(V)
V2
(V)
V1(t)V2(t)
The cell will neverbe exactly symmetric,so there will be a preferred outcome
How much"preferred"depends onthe cell symmetry
noiseless
noisy
noise
5
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Double randomness
DeviceProduction
Device
Measurement StabilizerRawdata
Key
Building-timerandomness
Run-timerandomness
Off-line On-line
The bit you read isa random variablewhose "randomness"is selected at production time
Like drawing a coinfrom a bag and then throwing the coin..
Exactly! And we want thecoins in the bag as unfairas possible…
6
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Double randomness and stabilizers
DeviceProduction
Device
MeasurementRawdata
Key
Building-timerandomness
Run-timerandomness
Off-line On-line
S0, an ideal PUC is a random constant. What ifis it not "really" constant?
We use a stabilizer. Manysolutions are possible, but, basically you use some "redundance" to correct the "wrong" bits.Let me guess:
"fair coins" == expensive stabilizers
Right!
Stabilizer
7
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Measuring reliabilityCan we get a quantitative measure of the "quality" of the "bag"?
Yes, by looking at thedistribution of the reliability.
This is the caseof SRAM [1]
[1] R. Maes et al., “A soft decision helper data algorithm for SRAM PUFs,” ISIT 2009.
0.15 0.5 1.010
−4
10−3
10−2
10−1
100
Reliability = 2 | p(T)-1/2 |
F r
p(T) = 1 or 0(random constant)
p(T) = p(F) = 0.5(fair coin)
p(T) = 0.5 ± 0.075
Ideal
Curve
SRAM
8
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
What is wrong with SRAM?
0 0.2 0.4 0.6 0.8 1 1.20
0.2
0.4
0.6
0.8
10
x
1
You see, the problem isthat the SRAM has twostable states. This is finefor a memory, but it makes an unreliable PUC.
You want something more similar to a balance: a single equilibrium point that depends on the asymmetry
Right
9
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Our proposal
Q1
Q2
C IcI1
I2+-
Vc
Vraw
V0
V0
This is our idea…
Cool, how does it work?
Transistors Q1 and Q2are nominally matched,so that nominally |VT1| = |VT2|, ϐ1 = ϐ2, I1 = I2 and Ic=0
So, nominally, Vraw = V0 for ever…But Q1 and Q2 willnot be exactly matched
10
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Our proposal: qualitative analysis
Q1
Q2
C Ic
I1
I2+-
Vc
Vraw
V0
V0
Right! We are exactlygoing to exploit this!
Right, suppose now that Q2 conductsa bit more so thatIc < 0 and Vc decreases…
Vc=0, so Q1 and Q2 are in saturation…
I 2
VDS2
V0t=0
… and VDS2 decreases…
I1 Ic
11
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Our proposal: qualitative analysis
Q1
Q2
C Ic
I1
I2+-
Vc
Vraw
V0
V0
As long as VDS2 is large enough nothingchanges: Q2 remainsin saturation Ic remains constant and Vc decreases linearlywith time…
I 2
VDS2
t=t1
…until VDS2 reaches V0+VT2
VDS2(t1)
I1 Ic
12
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Our proposal: qualitative analysis
Q1
Q2
C Ic
I1
I2+-
Vc
Vraw
V0
V0
Exactly! At that timeQ2 enters the trioderegion and I2 gets smaller. MeanwhileQ1 remains in saturation,so I1 does not change
I 2
VDS2
t=t2
Therefore, Ic gets smallerand the charging slows down…
VDS2(t2)
I1 Ic
13
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Our proposal: qualitative analysis
Q1
Q2
C Ic=0
I1
I2+-
Vc
Vraw
V0
V0
…until the process endswhen I2=I1. At thattime Ic=0 and the equilibrium (stable)is reached.
I 2
VDS2
t=∞
Cool, since at eq. Q2 must bein triode region, Vraw cannot be in the shadowed area.
VDS2(∞)
I1
VT
Discontinuous
14
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Our proposal: theoretical analysis
Nice, but can you be more analytic?
−2 −1 0 1 2−2
−1.5
−1
−0.5
0
0.5
1
1.5
2x 10
−5
Perfect Match
I c(A
)
Vc
(V)
Q1 stronger
Q2 stronger
dVc/dt ∝ Ic
Q2 slightly stronger
Negative slope ⇒
Stable equilibrium
Sure, justcheck thisfigure
15
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Variations
What do wehave here? Q1
Q2
C
+-
Vc
V0
V0
Q1
Q2
C
+-
Vc
V0
V0
Two variations of thebasic scheme: the topscheme "forces" theoutput of the cellto VH/VL
In the bottomscheme the SRAMcell stores theresult, so that the PUC can beturned off
16
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Simulations
10 000 Random variations
VTi ∼ N(V T,nom, σ2Vi) σ2Vi = Kv
Li Wi
[2]
βi ∼ N(βnom, σ2βi) σ2β= βnom Kβ
Li Wi[2]
[2] P. Kinget, “Device mismatch and tradeoffs in the design of analog circuits,” IEEE Journal of Solid-State Circuits, June 2005
Sample at time t=ton + 0.5 ms
We also runsome simulationsby randomly changing theparameters
17
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Simulation results
0 0.5 1 1.5 2 2.5 30
20
40
60
80
100
120
Vraw
(V)
# O
ccur
ence
s
Temperature = 25 ° C
0 0.5 1 1.5 2 2.5 30
500
1000
1500
2000
2500
3000
Vout
(V)#
Occ
uren
ces
Temperature = 25 ° C, Prob(1)=0.4988
Prob ≈ 0.5-1.2 ⋅ 10-3
18
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Simulation results
0 0.5 1 1.5 2 2.5 30
20
40
60
80
100
120
Vraw
(V)
# O
ccur
ence
s
Temperature = 0 ° C
0 0.5 1 1.5 2 2.5 30
500
1000
1500
2000
2500
3000
Vout
(V)#
Occ
uren
ces
19
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Simulation results
20
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Simulation results
0 0.2 0.4 0.6 0.8 1 1.2 1.410
−4
10−3
10−2
10−1
100
Reliability (R)
F r
Proposed 25° CProposed −30° CSRAM
21
DIEGM University of Udine
A Simple and Reliable Cell for Single Bit Physically Unclonable Constants
Conclusions
• A very simple cell for binary PUC has been proposed
• Theoretical analysis and simulations show that
– The cell is unbiased
– The cell is very reliable, pratically ideal
– The cell works on a very large range of temperatures
• Stabilizer may be unnecessary
• Future directions
– Understanding the “eye closing”
– Experimental results on a prototype
22
DIEGM University of Udine