Crossover Ring Oscillator PUF

Transcription

1 International Symposium on Quality Electronic Design (ISQED) 27 Crossover Ring Oscillator PUF Zihan Pang,2,3, Jiliang Zhang 2, Qiang Zhou 3, Shuqian Gong 2, Xu Qian, Bin Tang 4 School of Mechanical Electronic and Information Engineering, China University of Mining and Technology (Beijing), Beijing, China 2 Software College, Northeastern University, Shenyang, China 3 Department of Computer Science and Technology, Tsinghua University, China 4 Guangdong Eshore Science and Technology Co., Ltd, Guangzhou, China zhangjl@mail.neu.edu.cn ( Corresponding author) Abstract Ring Oscillator (RO) Physical Unclonable Function (PUF) is one of the most popular silicon PUFs which exploit manufacturing variations during the chip fabrication process. RO PUF can generate secret bits by comparing the frequency difference between two ROs. However, previous RO PUFs improve flexibility and reliability through adding redundant ROs and thus incur unacceptable hardware overheads. In this work, we propose a crossover RO PUF to improve flexibility and reliability and reduce hardware overheads. The basic idea is to implement one-to-one input-output mapping with Lookup Table ()-based structure in each level of inverters. Experimental results show that our proposed structure has much lower hardware overheads and better uniqueness and reliability than the previous configurable RO PUFs. In addition, individual customization on configuration bits of structure and different RO selections by challenges bring high flexibility. Keywords Physical unclonable function (PUF), ring oscillator, flexibility I. Introduction With the increasing demands of security, privacy protection, and trustworthy computing, device authentication becomes one of the most challenging design concerns, particularly for systems such as smart cards, sensors, and s- mart phones where the lack of persistent power limits the duration of countermeasure enforcement []. Silicon physical unclonable function (PUF) emerged as a new hardware primitive provides a unique device-dependent mapping from a set of challenges to a set of responses based on the unclonable properties of the underlying physical device, which is a promising solution for device authentication in power-limited areas. Starting from 2, with the introduction of physical oneway functions [2] and the silicon physical random functions [3] [4], many kinds of PUF have been proposed such as ring oscillator (RO) PUF [5], arbiter PUF [6], SRAM PUF [7] and so on. RO PUF is based on the frequency difference among ROs to generate random responses. An RO is a simple circuit of a set of inverters connected in a loop with a particular frequency. The PUF generates logic- or logic- by comparing the frequencies of any two ROs. However, the delay difference caused by manufacturing process variation is sensitive to environment, which makes the PUF responses unreliable. In order to improve reliability, -outof-8 RO PUF was proposed [5]. The key idea is to select two ROs with maximal frequency difference among eight ROs. However, -bit response will waste six ROs, which incurs unacceptable hardware overheads. Later, Maiti et al. [8] proposed a configurable method to improve reliability and reduce hardware overheads. The basic idea is that challenges select different inverters of an RO at each stage to generate multiple instantiations of ROs in a basic configurable RO structure. Tang, Lin and Zhang [9] proposed a frequency offset-based reliability-enhancing technique for RO PUF. The key idea is to make the frequency difference larger than a given threshold by offsetting the frequencies of RO pairs to improve reliability. Gao et al. [] proposed another configurable RO PUF architecture which builds at inverter level to improve flexibility of the previous configurable RO PUF. These configurable RO PUFs still incur high hardware overheads because lots of inverters are wasted, and just produce a limited response bits. In order to address above issues, this work proposes a crossover RO PUF. The flexible crossover structure can not only generate more bits of PUF responses than the traditional configurable RO PUFs but also achieve the % u- tilization of inverters in ROs. The structure can choose different inverters in each level with input challenges. Moreover, our proposed crossover RO PUF can drastically mitigate the effect of environment on PUF responses and hence generate more reliable responses. We briefly present the background of reconfigurable PUFs and provide a comparative analysis about current configurable RO PUFs in Section II. Section III gives a detailed introduction about our proposed crossover RO PUFs. Section VI gives the experimental result and analysis. Finally, we conclude in Section V. II. Related work Unlike traditional PUFs exhibiting a static challenge/response behavior, reconfigurable PUF exhibits dynamic unpredictable challenge/response behavior. In many practical applications such as resisting FPGA replay attacks [], modeling attacks and man-in-the-middle attacks [2], we expect PUFs can exhibit the reconfigurable challenge/response behavior. The concept of reconfigurable arbiter PUF was first proposed by Lee et al [6]. They proposed to integrate a floating gate transistor into the

2 delay lines of an arbiter PUF to physically change the challenge/response behavior of the PUF based on a logical state maintained in non-volatile memory []. Lao and Parhi [3] proposed several reconfigurable silicon PUF structures to change the behavior of silicon PUF after deployment and also evaluated their reconfigurability by simulation. Recently, Zhang et al [] proposed to use reconfigurable PUFs to defeat the replay attack and tested two reconfigurable PUFs that exhibit high reconfigurability. Similar to reconfigurable PUFs, configurable RO PUF is introduced by Maiti and Schaumont [8]. As shown in Fig., the key idea is that a 2 multiplexer is used to select one out of two inverters at each stage of the RO. This technique uses the configurations with the largest delay difference to improve the PUF reliability. Another highly flexible configurable RO PUF was proposed by Gao et al []. It is built at inverter level to improve the reliability of RO PUFs. The configurations for a pair of ROs would choose the largest delay difference to generate reliable PUF output. For these reconfigurable/configurable PUFs, the utilization ratio of multiplexers added in ROs is low, and the inverters are not fully used in some configuration. Challenge Fig.. Configurable RO PUF proposed in [8] Challenge Fig. 2. Configurable RO PUF proposed in [] As discussed above, to improve reliability, the existing configurable RO PUFs still incur high hardware overheads and hence make them difficult to be deployed in practice. III. Crossover RO PUF In order to improve reliability and resist potential attacks such as FPGA replay attacks, modeling attacks and man-in-the-middle attacks, we proposed a crossover RO PUF that has advantages over the previous configurable RO PUFs in terms of flexibility and reliability. Considering -out-of-n coding, an RO PUF is comprised of many ROs and the multiplexers select two of them to be compared with the comparator []. The configurable RO PUFs [] only use single RO pairs to implement configurability. Our proposed crossover RO PUF structure is much more flexible because we select every inverter from multiple RO pairs with Lookup Tables (s). n ROs S S 2 S m- Fig. 3. m levels Mux Challenge Crossover RO PUF structure A. The Architecture of Crossover RO PUF Counter > Counter Output or Fig.3 depicts the crossover architecture that shows the flexibility of selecting inverters in ROs. The crossover RO PUF has n ROs and m levels of inverters. Each RO consists of m inverters with a particular frequency. For m levels of inverters, the outputs of previous inverter level are fed as the inputs to the next inverter level after. The determines the routing path of step signals inputted without any additional logical operation. There are m- to change the configuration of the delay loop with selection inputs. As shown in Fig.3, configuration selection S = (S, S 2,..., S i,..., S m ), where S i has log 2 n bits and determines the connection order of inverter to the next inverter level in i-th stage. The number of possible different configurations of the delay loops is (A n n) m 2. The level m must be an odd number and m > 2 in order to make the delay loop form the oscillation, and it can determine the frequency level of the RO. The larger m which means more inverters in RO exhibits lower frequencies. Compared with the flexible configurable RO PUF [], we don t need to add any constraints on input challenges to ensure that the number of each RO is the same so that the frequency differences between them are caused by the differences in random manufacturing processes. Under the precondition of ensuring a one-to-one mapping, the connection of inverters can be customized by the designers and users. After selecting inverters in each level, we can get a group of fixed sequence of RO pairs. Any two of ROs chosen by the challenge through multiplexers are connected to the clock input ports of the two counters and obtain -bit PUF response by comparing the values read from the two counters within a period of time. The arbiter generates a logical or for this chosen RO pair depending on which RO has the higher frequency. By choosing different inverters to build ROs with selection input challenges, the delay difference for each pair of RO will generate more bits.

3 B. Interstage crossing a =3 a 2 =6 a 3 =8 a 4 =7 a 5 =5 RO SRAM Input A-D A A A 2 S Output A Output B RO 2 RO 3 b =9 c =5 d =2 b 2 =7 b 3 =4 b 4 =5 b 5 =5 c 2 =4 c 3 =6 c 4 =6 c 5 =5 d 2 =5 d 3 =6 d 4 =4 d 5 =3 output S 2 S 3 Output C RO 4 Fig crossover RO PUF structure 3 Input (a) Fig. 4. S 4 (b) -based network Output D In this section, we introduce a low overhead and high flexibility with s. Fig.4(a) shows the internal structure of a 3-input. An n-input can be configured to implement any n-input logic function. For example, SRAM can be set with in initialization phase to implement the function A A 2 + A Ā 2, and set with to implement Ā A 2 + A A 2. By configuring SRAM, we can easily get the logic function required in. Fig.4(b) gives an example of a 4-bit crossing network with 6-input s. Each takes A, B, C, D as 4-bit inputs and the rest two inputs as the selection imports. If the selection bits are configured as,,,, the output of the s will be A,B,C,D. In the same way, the output of the s will be shuffled as B,C,D,A when selection bits are,,,. Since the data inputs and outputs of all the interstage crossing must form a one-to-one mapping, no duplicated outputs are allowed in the network, even though the selection bits can be the same. A trusted party can set different values when configuring SRAM. And the selection bits for individual placements can be decided by the designers or users. Considering the influence of delay added in interstage crossing, the existing FPGA design tools can minimize the delay-skew between a pair of routes, but they do not guarantee the structural symmetry [4]. For example, the multiplexers and inverters in a configurable RO PUF will be connected to the switch matrix which uses routes with different lengths depending on the individual placements. So if the manufacturing process variation is not sufficient to offset it, the structure could make entire PUF circuit be highly biased. Our method can set all connections of inverters by configuring SRAM without impact the routing in switch matrixes. It means -based has high flexibility to improve PUF reliability. C. Flexibility and reliability Our proposed crossover RO PUF can get greater frequency differences between ROs than previous reconfigurable PUFs and hence generate more reliable PUF responses. In what follows, we give an example to explain the advantage. As shown in Fig.5, consider 4 5 ROs have 4 rows inverters, RO to RO 4, and each consists of 5 inverters. Assuming the delays of these inverters are: {a = 3, a 2 = 6, a 3 = 8, a 4 = 7, a 5 = 5}, {b = 9, b 2 = 7, b 3 = 4, b 4 = 5, b 5 = 5}, {c = 5, c 2 = 4, c 3 = 6, c 4 = 6, c 5 = 5}, {d = 2, d 2 = 5, d 3 = 6, d 4 = 4, d 5 = 3},where a i to d i denote the delay of the i-th inverter from RO to RO 4, respectively. The total delays of four ROs are: D RO = = 29 D RO2 = = 3 D RO3 = = 26 D RO4 = = 2 When using decoupled neighbor coding, RO is units of time slower than RO 2, and RO 3 is 6 units of time faster than RO 4. The delay difference can be up to units of time with -out-of-n coding method [5]. Generally, a large delay difference can generate a reliable bit. With the ingenious selection in crossover structure, {b, b 2, a 3, a 4, a 5 }, {a, d 2, c 3, b 4, b 5 }, {c, a 2, d 3, c 4, c 5 } and {d, c 2, b 3, d 4, d 5 } are used to build RO to RO 4. The delay difference becomes 2 (RO and RO 2 ) and (RO 3 and RO 4 ) units of time. The largest delay difference is 9 units of time, which is about twice as large as the delay difference when there is no in the ROs. The delay of each inverter is unpredictable due to fabrication variation. Any inverter in an RO is faster or slower than the inverter at the same position in another RO with equal probability. In the above example, although {a, a 2 } in RO is s- lower than {b, b 2 } in RO 2, the total delay difference will be reduced when including the rest inverters. When reconfiguring RO with the, we can choose inverters ingeniously to increase the gap of total delay between two ROs, which makes the outputs more reliable. D. Security Analysis Since and inverters are independent of each other, adversaries cannot get any delay information

4 of inverters through getting the configuration in interstage crossing. Even though they can get all configuration bits from the SRAM of s in, they still don t know which inverter will be selected in RO without any selection information. Side channel attacks statistically analyze the time, power consumption or electromagnetic emanation of the cryptographic devices to gain knowledge about integrated secrets. Most recently, Merli et al. carried out side channel attacks (EM analyses) on an RO PUF FPGA implementation leading to the extraction of a full PUF model and thereby breaking the PUFs security [5]. The authors also point that their proposed attack can be successful because they exploit that each RO has a fixed location and a specific measurement path through a multiplexer to a counter. In this paper, we can dynamically change the inverters of ROs with different configuration data to generate unclonable bit string, which makes each RO having no fixed physical location and therefore the our proposed crossover RO potentially provides a new solution to resist side channel attacks. Moreover, the security can be enhanced by increasing the number of inverters in ROs and levels of ROs. Besides, the generated response bits can be XORed with the input challenge, and the result can be used as the challenge configuration for next time. IV. Experimental results The experiments to evaluate the effectiveness of crossover RO PUF are conducted based on the Virginia Tech s public PUF dataset [6]. This dataset consist of frequency of ROs from 98 Xilinx Spartan (XC3S5E) FPGA boards. Since this dataset only has the frequency of ROs without individual inverters. We can treat each RO as an inverter in our experimentation due to the lack of public data on delay at inverter level. Among the 98 boards, 94 boards measure the frequencies of ROs at the temperature 25 C and the supply voltage of.2v. The other five boards measure the frequencies at varying supply temperatures and voltages. The ranges of temperatures are 25 C, 35 C, 45 C, 55 C and 65 C. The supply voltages are.96v,.8v,.2v,.32v, and.44v. We use the frequency dataset from five boards (D59546, D372, D3938, D22558 and D22559) to compare the hardware efficiency, uniqueness and reliability for traditional neighbor coding method, rpuf in [] and our proposed crossover RO PUF method, respectively. A. Hardware Overhead The total number of configurations is determined by the number of inverters in ROs and levels of ROs in the crossover RO PUF structure. There are (A n n) m 2 configurations in n ROs when each RO has m (m must be odd and m > 2) level inverters. For the rpuf which has n ROs and m levels of inverters, the number of possible different configurations of the delay loops is 2j+ i=3 (Ci m ).5n, where i must be odd and j must be integer. As shown in TABLE I and TABLE II, when the number of ROs is 8 and the levels of each RO is 9, the total number of configurations of crossover RO PUF reaches.73e+32 which is 5.7E+23 times larger than rpuf. We can see from TA- BLE I that the total number of configurations grows exponentially with the increasing of m and n, which provides a simple way to increase the PUF response bits. TABLE I Number of configurations for crossover RO PUF m n = 2 n = 4 n = 6 n = E E E+4.7E E+9.E+2.73E+32 The RO PUF usually consists of some basic components such as ROs, multiplexers, counters, comparators and so on. We use the reliable bits per NAND gate to evaluate the hardware overhead of each RO PUF. We can calculate the total overhead of each RO PUF with the overhead of components in TABLE III. Decouple neighbor coding uses 52 ROs to form 256 RO pairs; the overhead is 256 ( ) = The rpuf method uses 4 5-level ROs; the overhead is 4 ( ) = Our crossover RO PUF uses 4 3-level ROs; the overhead consists of the general (49+3) = 244. TABLE II Number of configurations for rpuf m n = 2 n = 4 n = 6 n = E+8 TABLE III Hardware overhead of the logic elements in the design Logic Element Overhead in terms of NAND gates 5-stage ring oscillator 5 2-to- MUX 9 4-to- MUX 3 8-to- MUX 2 7-stage ripple counter 49 Fig.6 denotes the comparison of hardware efficiency of three methods. The hardware efficiency is denoted by the number of bits generated by per NAND gate. As shown in Fig.6, more hardware resource would be used when the criterion on frequency difference for acquiring reliable ones is tightened, and crossover RO PUF method is obviously more efficient than the other two methods.

5 between any two pairs was 25.4 (49.%), which is relatively close to the ideal value 5%. TABLE IV Average HD with five boards at U=.2V Method 25 C 35 C 45 C 55 C 65 C Neighbor rpuf Crossover RO Fig. 6. Comparison of hardware efficiency TABLE V Average HD with five boards at T=25 C Method.96V.8V.2V.32V.44V Neighbor rpuf Crossover RO We get the PUF outputs at different temperature and voltage levels. TABLE.IV gives the average HD in different temperature with U =.2V. TABLE V shows the average HD in different voltage with T = 25 C. We can see from Fig.7, TABLE IV and TABLE V that our proposed crossover RO PUF has high uniqueness and hence it is unlikely for any two PUFs to generate the same response. Fig. 7. HD of crossover PUF on five boards (T=25 C and U=.2V) B. Uniqueness The uniqueness shows that different chip will have distinct PUF output, and determines the quality of the PUF. Since the output information of PUF will be used for many security applications, it is not acceptable if different PUFs produce the same or similar responses when fed with the same challenge. Hamming distance (HD) are used to evaluate PUF response s uniqueness. H D(P i, P j ) = n (r i,m r j,m ) () m= where r i,m is the m-th bit of n-bit samples for PUF response. For a pair of PUFs: P i and P j (i j) that both generate n-bit responses, their average HD will be calculated as follows. u = k 2 k(k ) k i= j=i+ H D(P i, P j ) n % (2) In the experiments, we extract a hundred of 256-bit outputs in each of five boards under 25 C and.2v. Fig.7 shows the histogram of the inter-chip HD. The average HD C. Reliability Reliability is used to measure the stability of PUF response in various environments. Ideally, the difference between any two responses generated by a PUF under the same challenge in repeated experiments should remain the same. Due to factors such as ambient temperature variation and supply voltage fluctuation where these factors may affect circuit delay in practice, the PUF responses may be unreliable. The following formula is used to evaluate the reliability of PUFs []: r = x x y= H D(R i, R i,y ) n % (3) where x is the number of samples for PUF response; R i is the response extracted from the board i; n is the number of generated response bits by the PUF; and H D(R i, R i,y ) denotes the HD between the response R i and the y-th sampling R i,y. The temperature variation plays very important role to the PUF performance in normal using scenarios, because it is an effective factor to affect the circuit delay. In this paper, we select the temperature and voltage as the effecting environmental factors to verify the PUF performance. For each 256-bit PUF on each board, we computed the HD between responses at various temperatures and voltages. As shown in Fig.8, 92% of the responses were changed by ten or fewer bits when the range of temperature is 35 C to 65 C, and no response experienced more than 2 bit flips. The average is 3.33 (.3% of the total number of bits

6 Fig. 8. HD of crossover PUF output bits with temperature varies at U=.2V As shown in Fig.9, the average distance between any two pairs under the range of voltages is quite similar to that of Fig.8. The average HD increases from 3.33 to 3.6, and the maximum HD from 2 to 8. TABLE VII shows the average HD with varying voltages comparison for three methods. Comparing TABLE VII with TABLE VI, we can see that the voltage factor have more influence on the PUF reliability than the temperature. However, comparing Fig.9 with Fig.8, we can see that the gap still exists in the distributions between 2 9 bits, which means the PUF proposed in the paper can still work effectively. As shown in TABLE VI and TABLE VII, our crossover RO PUF method has a better reliability than the other two methods in tolerating the temperature and voltage varies. Fig. 9. T=25 C HD of crossover PUF output bits with voltage varies at Fig.. Comparison of reliable RO pairs 256). More details of comparison under different temperature are reported in TABLE VI. Comparing the Fig.7 with Fig.8, we can see a large gap in the distributions roughly between 2 9 bits, which demonstrates that our proposed crossover RO PUF method can be effective for device authentication and anti-counterfeiting. TABLE VI Average HD with temperature varies at U=.2V Method 35 C 45 C 55 C 65 C Neighbor rpuf Crossover RO TABLE VII Average HD with voltage varies at T=25 C Method.96V.8V.32V.44V Neighbor rpuf Crossover RO Fig. gives the reliability trend of RO PUF with various temperatures (25 C to 65 C) when the voltage U =.2V. It is shown that our proposed method has better reliability with threshold factor increasing. V. Conclusion In this paper, we propose a new configurable RO PUF which can effectively improve the reliability and increase hardware efficiency. By selecting different inverters in ROs, the frequency difference between two ROs will be larger than the threshold, and hence generate reliable responses. Compared to the previous configurable RO PUFs, the experiment results on public RO PUF data show that our proposed crossover RO PUF has higher reliability and hardware efficiency. VI. Acknowledgements This work is supported by the National Natural Science Foundation of China under Grant No. 6627, References [] J. Zhang, G. Qu, Y. Lv, and Q. Zhou, A survey on silicon pufs and recent advances in ring oscillator pufs, Journal of Computer Science and Technology, vol. 29, no. 4, pp , 24.

7 [2] G. Hammouri, E. ztrk, and B. Sunar, A tamper-proof and lightweight authentication scheme, Pervasive and Mobile Computing, vol. 4, no. 6, pp , 28. [3] S. S. Kumar, J. Guajardo, R. Maes, G. J. Schrijen, and P. Tuyls, Extended abstract: The butterfly puf protecting ip on every fpga, in IEEE International Workshop on Hardware-Oriented Security and Trust, 28, pp [4] J. H. Anderson, A puf design for secure fpga-based embedded systems, in Asia South Pacific Design Automation Conference, Asp-Dac 2, Taipei, Taiwan, January, 2, pp. 6. [5] G. E. Suh and S. Devadas, Physical unclonable functions for device authentication and secret key generation, in Proceedings of the 44th annual Design Automation Conference, 27, pp [6] D. Lim, J. W. Lee, B. Gassend, G. E. Suh, M. Van Dijk, and S. Devadas, Extracting secret keys from integrated circuits, IEEE Transactions on Very Large Scale Integration Systems, vol. 3, no., pp. 2 25, 25. [7] M. S. Kim, D. I. Moon, S. K. Yoo, and S. H. Lee, Investigation of physically unclonable functions using flash memory for integrated circuit authentication, IEEE Transactions on Nanotechnology, vol. 4, no. 2, pp , 25. [8] A. Maiti and P. Schaumont, Improved ring oscillator puf: An fpga-friendly secure primitive, Journal of Cryptology, vol. 24, no. 2, pp , 2. [9] B. Tang, Y. Lin, and J. Zhang, Improving the reliability of ro puf using frequency offset, in 3th International Conference on Field Programmable Technology, 24, pp [] M. Gao, K. Lai, and G. Qu, A highly flexible ring oscillator puf, in 24 5st ACM/EDAC/IEEE Design Automation Conference (DAC), 24, pp. 6. [] J. Zhang, Y. Lin, and G. Qu, Reconfigurable binding against fpga replay attacks, ACM Transactions on Design Automation of Electronic Systems, vol. 2, no. 2, pp. 2, 25. [2] M. Majzoobi, F. Koushanfar, and M. Potkonjak, Techniques for design and implementation of secure reconfigurable pufs, ACM Transactions on Reconfigurable Technology and Systems, vol. 2, no., pp. 33, 29. [3] Y. Lao and K. K. Parhi, Statistical analysis of mux-based physical unclonable functions, IEEE Transactions on Computer- Aided Design of Integrated Circuits and Systems, vol. 33, no. 5, pp , 24. [4] M. Majzoobi, F. Koushanfar, and S. Devadas, Fpga puf using programmable delay lines, in 2 IEEE International Workshop on Information Forensics and Security, 2, pp. 6. [5] D. Merli, J. Heyszl, B. Heinz, D. Schuster, F. Stumpf, and G. Sigl, Localized electromagnetic analysis of ro pufs, in IEEE International Symposium on Hardware-Oriented Security and Trust, 23, pp [6] A. Maiti and P. Schaumont, Research on physical unclonble functions (pufs) at ses lab, Virginia Tech, 2.