Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 1 UxIDs: Unclonable Mixed-Signal Integrated Circuits Identification Contract Review Presentation November 17, 2010 SRC Task: ICSS Faculty Advisor: Farinaz Koushanfar Post-Doctorate Associate: Golsa Ghiaasi Hafezi Student Researcher: Mehrdad Majzoobi Electrical and Computer Engineering, Rice University Texas Instruments DSP Leadership University

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 2 Task Thrust Participants Executive Summary Deliverables Project Description Conclusion OVERVIEW ICSS Task ID:

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 3 THRUST AREA Circuit Design/ICSS Task Description Architecture, design, fabrication, testing, and analysis of novel circuits for current-based physically unclonable functions (PUFs). The circuit has a much higher precision and accuracy than the state-of-the-art PUFs Architecture, design and silicon implementation of novel on-chip current sensors for nondestructive post- silicon characterization and for noninvasive sensing of the aging process Task Thrust

ParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 4 TASKPARTICIPANTS Task Leader: Farinaz Koushanfar, Rice University Co Leader : Golsa Ghiaasi Hafezi, Post Doctorate Associate, Rice University Students : Mehrdad Majzoobi, PhD Student, Rice University Expected graduation date: June 2011 Industry Liaison : Sani Nasif, IBM Erik Welsh, TI Participations

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 5 EXECUTIVE SUMMARY Executive Summary Accomplishments – Dr. Ghiaasi-Hafezi (design expert) joined the team – Finalized the authentication protocol – Finalized the architecture and design details Future directions – Upcoming tape-out in December 2010 – Circuit testing and measurements – Security tests and countermeasures – Impact of aging and stress on the sensing mechanisms – Proposal for an improved architecture for sense -amp

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 6 EXECUTIVE SUMMARY Executive Summary Technology Transfer –Interacted with MIT faculty working on PUF Industrial interactions –Dr. Sani Nassif from IBM Austin Research Lab –Mr. Erik Welsh and Dr. Gene Frantz from Texas Instruments Inventions –In process of submitting a patent request to Rice University

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 7 RESEARCHDELIVERABLES Annual review presentation, October 2009 Report on the new robust architecture, mechanisms, and proof-of-concept fabrication and testing results of secure current-based physically unclonable functions and other forms of unclonable identification, July 2010 Annual review presentation, October 2010 Report on the security analysis alongside with introduction and enabling of new mechanisms and protocols for IC protection, content-protection, and secure third-party IP protection and thus responding to rapidly changing semiconductor business requirements, July 2011 Deliverables

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 8 RESEARCHDELIVERABLES Report on the design, proof-of-concept fabrication, and testing of new current-based on-chip sensors for nondestructive and noninvasive post-silicon characterization, for use in a variety of post-silicon optimizations, July 2012 Report on the characterizing and quantification of the impact of random environment variations, aging and stress on the introduced sensing mechanisms and current-based PUFs, July 2012 Final report summarizing research accomplishments and future direction, July 2012 Deliverables

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion Physical Unclonable Functions (PUF) A unique identifier for each chip –The intrinsic analog variations of a physical attribute [Pappu et al. Science’02] [Gassend et al. CCS‘02] Viable for current and future silicon technologies Properties –Unclonable –Fast to evaluate –Hard to remove 9 9 Roy and Asenov, Science, 2005 Friedberg et al., ISQED, BACKGROUND Project Description/Result

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 10 AUTHENTICATION PROTOCOL Project Description/Result Before deployment, a set of challenge and response pairs are measured and stored for each PUF challenge Response challengeresponse 11011… … … Database

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 11 BACKGROUND Project Description/Result Arbiter-based PUF: convert analog information to digital * Compare two paths with an identical delay in design –Random process variation determines which path is faster –An arbiter outputs 1-bit digital response Multiple bits can be obtained by either duplicate the circuit or use different challenges –Each challenge selects a unique pair of delay paths … c-bit Challenge Rising Edge 1 if top path is faster, else 0 DQ G Response * J. Lee, D. Lim, B. Gassend, G. E. Suh, M. van Dijk and S. Devadas, "A Technique to Build a Secret Key in Integrated Circuits for Identification and Authentication Applications", VLSI Circuits Symposium, Suh and Devadas, DAC 2007

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 12 OBJECTIVES Project Description/Results Current-based PUF Ultra-low power response generation –Exploit sub-threshold leakage current –Automatic current cut-off Shorter evaluation time Robustness of responses –In presence of temperature and voltage supply variations Exponential number of challenge-response pairs

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 13 MACROARCHITECTURE Project Description/ Results Block diagram of PUF architecture –Generation of process sensitive currents and voltages e.g., I = {I 1,…,I N } –The inputs (challenges) are used to select two equivalent subset of currents a and b the currents are equivalent by construction, but differ because of process variations –The task of combination could be linear or non-linear –Comparison of two selected groups

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 14 CIRCUIT LEVEL ARCHITECTURE Project Description/Results PUF architecture with current generators, current switches, and a latch based sense amplifier. Current generation –Single N-FETs with fixed gate voltage Selection and combination –Differential current switches –Stir the current to the left and right based on the input challenges C a,C b Comparison –Sense amplifier

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 15 SENSE AMPLIFIER OPERATION Project Description/Results Before (1) M5, M6: on and the rest are off V SON =V SO =VDD (1) M5 and M6: off, M1 and M3:on Discharge SON, SO nodes I a > I b (2) V SON -V SO =V tp M2: on Strong positive feedback : more rapid discharge of V SON (3) V SON < V tn M3 :off

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 16 SENSINGRESOLUTION Project Description/ Results Monte Carlo simulations at two extreme temperature points –Using minimum size devices –   X-axis: Current difference (%) Y-axis: Current average (common component) in μA Z-axis: Instability of the sense amp output The dark blue area represents the best operation region (0.5 means 50% of responses are errors)

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 17 EXPRIMENTALSETUP Project Description/Results Experiment setup –N=64 current generators (and current switches) –IBM 90nm technology stochastic models –Device sizes are set to the technology minimum W/L = 120nm/100nm –Using Monte Carlo simulation 100 circuit instances are generated –Apply 100 challenges to each PUF circuit instance –Rate of applying challenges: 100MHz … … …

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 18 OPERATION POINT SELECTION Project Description/Results Response distribution For each chip –the number of ’1’s in 100 responses normalized to 100 –ideal: equal number of ‘1’s and ‘0’s in responses for highest level of randomness –for V gate /V DD = 0.1 the responses are highly biased toward ‘1’ the generated currents are too small to provoke any response from the sense amp Distribution of ‘1’ responses across the 100 PUF instances versus different gate voltages for different number of active currents.

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 19 SENSITIVITY TO OPERATIONAL VARIATION Project Description/ Results Response robustness –The PUF was evaluated under multiple modes of operation, i.e., for various V gate /V DD Temperature points V DD points Number of active currents Lowest error rate is achieved for smallest V gate under which the sense amp operates correctly Response error rate under different levels of temperature and V DD variations Temperature Range (C°) commercial: [0,75] industrial: [-40,85] military: [-55,125]

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 20 FLOORPLAN /TESTING STRATEGY Project Description/Results The die floorplan of the final chip. The challenges and responses are read in/out serially through scan chains. - Redundant sense amps on both ends for more reliable operation and defect tolerance - I/O scan chains to read in/out the challenge and responses serially - Buffers act as repeaters to strengthen the challenge signals and reduce noise Fabrication plan IBM CMOS 9FLP (90nm) 6 Metal stack (6_02_00_00_LB) MOSIS/SRC joint program Ceramic dual in line packaging

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 21 SECURITY ANALYSIS Project Description/ Results Randomness and uniqueness tests Nonlinearity tests Reverse-engineering tests Resiliency evaluation against side-channel attacks Input / interconnect networks (permutation and substitution of challenges) Output network (XOR mixing)

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 22 PRELIMINARY SECURITY ANALYSIS Conclusion Publications and preprints M. Majzoobi, F. Koushanfar. "Time-bounded Authentication of PUFs." Article under review, IEEE Transactions on Information Forensics and Security, F. Koushanfar, M. Majzoobi, U. Ruhrmair, S. Devadas. “Physical Unclonable Function (PUF) Hardware and Security Analysis.” Book Chapter in Hardware-Based Security, John Wiley and Sons, M. Majzoobi, G. Ghiaasi, F. Koushanfar, S. Nassif. " Ultra-low Power Current-based PUF.” submitted to IEEE International Symposium on Circuits and Systems (ISCAS), 2011.

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 23 CONCLUSION Conclusion Physical unclonable functions (PUFs) –Emerging paradigm for intrinsic identification and authentication Novel current-based PUF –Lightweight –Higher entropy of responses (output) Devised macro-, micro- and circuit-level architecture Simulations results for robustness and stability Preliminary security analysis for randomness and uniqueness Tape-out scheduled for December 2010

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion 24 QUESTIONS / DISCUSSION :

Task ThrustParticipationsExecutive SummaryDeliverables Project Description/ ResultConclusion Overview & objectives Architecture, design, fabrication, testing, and analysis of novel circuits for current-based Physical Unclonable Functions (PUFs) The circuit has a much higher precision and accuracy while lower power than the state-of- the-art PUFs Architecture, design and silicon implementation of novel on-chip current sensors Nondestructive post- silicon characterization and for noinvasive sensing for aging Distribution of ‘1’ responses across the 100 PUF instances versus different gate voltages for different number of active currents. Response error rate under different levels of temperature and V DD variations HIGHLIGHT