wang22systematic

Introduction

Physical Unclonable Function (PUF)

What is PUF?

• PUF is a die-specific random function or a silicon biometric, which can generate a unique predetermined response to an applied stimulus or challenge.

• The uniqueness of many PUF designs is derived from the variations that occur during the fabrication process in a completely unintentional, random and uncontrollable manner.

Why do we need PUF?

• These unique responses can be used as key generation and authentication in hardware security application.

• Compared with the alternative of storing the random response information in non-volatile memory, PUFs
  provide more resilient resistance to physical attack since the information will disappear during power off. Moreover, the response from each PUF is unique, ideally even for copies of the same design in different dies.

SRAM-based PUFs

What are SRAM PUFs?

• They exploit the power-up value of cells to provide the PUF response, with the corresponding address serving as the challenge.

• The information stored in SRAM cells is unpredictable when the array is first powered on without any preceding write operation, because the state stored in the SRAM cells will be decided by the
  relative the strength of the two back-to-back inverters in the SRAM cells.

• Ideally, the two inverters in each cell are identical, but in practice they will be slightly different in unpredictable ways because of random process variations (unique to each copy of the circuit) caused by random-dopant fluctuations, line-edge roughness, etc.

Main Pros and Cons of SRAM PUFs

• Pros: SRAMs are widely employed in many system-on-chips (SoCs), which make the implementation of SRAM PUF simple and require no additional design processes.

• Cons: reliability of the SRAM cells:

  1. The power-up state in SRAM cells is highly sensitive to the noise and temperature/voltage variation, i.e. 5–10 percent of cells are unstable and do not power up to the same consistent value during multiple power-up cycles.

  2. Aging degradation affects the threshold voltage of MOSFETs and can change the relative strengths of the two inverters in a cell, resulting in a change in the power-up state.

Why reliability is important?

• In order to exploit the start-up value of the SRAM cells to perform some cryptography function
  (i.e., key generation), the response or start-up value for each SRAM cell should be highly reliable under different operating conditions (i.e., different temperature or voltage) with a bit-error-rate (BER) close to 0

→ The BER has to reach a reasonable level before SRAM has been deployed as a PUF

How to increase the reliability of the SRAM PUF? (state-of-the- art approaches)

Several mechanisms have been proposed to reduce cell instability and increase the reliability of SRAM PUFs:

Error Correction Codes (ECC)

• Error Correction Codes (ECC) is a conventional approach to enhance the reliability of SRAM PUF with the target bit error rate less than 1e–6.

• The overall methodology is divided into two steps: enrollment and regeneration.

  • During the enrollment, the ECC will perform the encoding by using a larger amount of raw (unstable) data from the SRAM array. The output of encoding will be the secret key and help data. The help data is public information and can be stored in any non-volatile memory.

  • During the regeneration phase, the user will exploit the help data and the new regenerated raw (noisy) PUF data to recover the secret key.

• This key generation scheme has two main drawbacks:

  • The ECC implementation usually requires significant hardware overhead. For example, if the target is to generate 128 bits key with a bit-error-rate less than 1e 6, the ECC typically needs 3 k-10 k PUF raw bits and the nature bit-error-rate for this raw PUF bits have to be less than 15%. Furthermore, for this case, the ECC will generate 3 k-15 k bits of help data and need to be store in the NVM.

  • The weakness of the help data. It has been shown that the help data/syndrome bits are a source of
    leaking information.

Open

Hardening

• The idea behind this is that the aging effect will increase the threshold voltage of the MOSFETs. Since the power-up state of the SRAM cells is highly dependent on the mismatch of two pairs of MOSFETs, the nature mismatch can be exaggerated by precisely choosing to apply the aging effect to specific MOSFETs.

• By writing a proper value to the SRAM array and applying burn-in aging, the SRAM PUF cells can become
  more reliable. However, the bit-error rate cannot achieve a safe level by purely applying the burn-in aging and the ECC is still required afterwards.

Preselection

• The preselection scheme filters out the unstable cells leaving behind only stable cells as the PUF output.

• In this way, the final PUF output will be virtually 100% reliable and the bit-error rate will approach zero. At the same time, the over-all hardware overhead is negligible since only the address of the selected cell requires to be stored in nonvolatile memory.

• Neighbor Analysis: To identify stable SRAM PUF cells, the researchers in previous work exploit the spatial correlation of the SRAM PUF cells indicating the higher likelihood of the most stable cells to be surrounded by the stable cells. However, this selection method still requires high-temperature/low voltage (HTLV) and low-temperature/low voltage (LTLV) to perform the enrollment test, which will increase both the test time and the cost.

• Changing the structure of the SRAM cell: Some researchers propose a revised design of the SRAM cells to fulfill the selection of the strong cells. The theory behind this approach is to introduce a skew or tilt to the cells through the revised structure of the SRAM cells. If the natural mismatch of a cell is larger than the introduced tilt, the cell will not change the value before or after introducing the tilt and will be considered as a strong cell for the PUF application. However, this selection method requires the modification of traditional SRAM cells, which will increase design costs and limit the range of application.

• Data Remanence Approach: A remanence-based method has been proposed to evaluate the strength of the SRAM PUF. A value of either a ‘1’ or ‘0’ will first be written to the SRAM cells followed by turning off the power for a very brief controlled period. Thereafter, the cell is powered back on to observe the value. If the cell flips the value that has been written in previously to the cell, it will be considered as a strong PUF cell. However, the selection method requires precise control of the power-off time. This may present implementation challenge for advanced CMOS technology.

Contributions and goal of this paper

The method proposed in this paper to increase reliability of SRAM PUF

• This work is an extension of a previous work https://ieeexplore.ieee.org/document/8349685

• The authors propose a preselection method that requires only one VDD/temperature condition.

• This will reduce the testing cost and time, compared to other methods requiring multiple voltages and temperatures.

• The authors systematically analyze how the ramp rate (power-up time) affect the powerup value of SRAM cells and how to exploit different ramp rate to facilitate selecting the most strong SRAM cells for PUF application (based on another work https://www.sciencedirect.com/science/article/abs/pii/S0026271421000159 )

Their contributions include:

1. A discussion of the start-up behavior of the SRAM cell and a detailed analysis of the ramp rate effect.

2. Proposal for a comprehensive methodology to perform preselection of the strong stable SRAM cells.

3. Presentation of the corresponding data from silicon experiments, including performing voltage and tem-
   perature variation and aging experiments to validate the reliability of the selected SRAM cells.

The main objective of this paper is to show that the proposed bit selection method can reliably select the strongest SRAM cells for PUF application.

Background

Open

SRAM PUF

SRAM cell architecture

The figure above shows the circuit schematic for a 6-transistor SRAM cell. Each cell has a pair of NMOS pull-down transistors, PMOS pull-up transistors, and NMOS pass transistors connecting each of the two (complimentary) cell output to the bit lines.

Why each SRAM cell is different?

In an ideal SRAM cell, if each transistor pair as described above is identical in every respect, including layout associated parasitic components, then the cell is perfectly balanced. In the absence of an asymmetric electrical noise, such a cell has a random 50% chance of acquiring either a ‘0’ or a ‘1’ state at power-up. However, even a small imbalance within a pair of transistors can result in a cell being biased towards either a ‘0’ or a ‘1’ power-up state. In nanometer-scale technologies, because of uncontrollable small random manufacturing variations, no two transistors in an SRAM cell are truly identical in practice.

Different classes of cells

Consequently, when the SRAM array has been powered up, the process variation along with the noise and environment variation will classify the cells into two main parts:

• Neutral cell: The cell has no strong mismatch among pull-up PMOS pairs and pull-down NMOS pairs. It does not mean no process variation happened in the transistors M1 M2 M3 M4. It only indicates the mismatch among these MOSFETs cancel each other and overall cells have no preference to the states 0 or 1. The final state of these cells will be determined by the noise present in the circuit.

• Skewed cell: The cell has relatively high mismatch among pull-up PMOS pairs (M1 and M2 ) and pull-down NMOS pairs (M3 and M4 ). These cells will have their preferred/consistent state, either a ‘0’ or a ‘1’.

Among the skewed cells, some may change their response over time due to device degradation or under different environment such as temperature, supply voltage, or electromagnetic noise.

These potential ‘weak’/ ‘neutral’ cells will raise a challenge for SRAM-based PUF since it requires 100% reliability under PUF application.

Ramp Rate Impact on Reliability of SRAM PUF

This is a technical section, check the paper, a summary:

• To simply sum up, if powering the SRAM cell under an extremely quick ramp, the effect of two NMOS (M3 and M4 ) can be ignored.

• If powering the SRAM cell under an extremely slow ramp, the effect of the capacitance can be ignored.

• If powering the SRAM cell under middle range ramp, the strength of the four MOSFETs as well as the value of the two capacitors, combined together, decide the final power-up state of the SRAM cell (either V1 or V2 will be logical 1).

→ These cells that display inconsistent values under different ramp-up rates may be the potential ’unstable’ cells for SRAM PUF applications.

Data Retention Voltage for Strong Cell Selection

This approach is already explained in the Introduction

The resulting conclusion based on the simulation

The simulation result shows that the data retention V_DD,Min voltage (the V_DD minimum value) can allow us to calibrate the strength of the selected cells for PUF applications.

Different V_DD,Min are employed for data retention testing to select and rank order the strongest cells
in the array.

Systematic Selection Method for Reliable SRAM PUFs

The goal of this work is to reliably select those reliable SRAM cell for PUF application. A systematic selection method for reliable SRAM PUF cells is proposed, this selection process has two levels:

1. Detecting the potential “unstable” cells, by noticing the cells that display inconsistent values under different ramp-up rates.

2. Exploiting data retention voltage to calibrate the strength of this bias in the SRAM cells (no precise power
   up time require to be controlled in this test).

Silicon Results

• Based on the reliability experiments presented for varying voltages, temperatures and aging*, it has been shown that by selecting an appropriate V_DD,Min voltage for stable cell strength selection, it is always possible to ensure desired reliability of an SRAM PUF.

• The trade-off is that while using a higher V_DD,Min during cell selection yields more stable and reliable cells, there are fewer such cells in any given size of an SRAM array.

• Some equipment:

  • commercial off-the-shelf (COTS) SRAM memories

  • ThermoSpot direct contact probe system (to change temperature) Temptronic ThermoSpot Systems

* Aging: the authors apply controlled random aging to the SRAM chips to mimic normal operation in the field. Random patterns were written into the SRAM, with the ratio of 40% 1 s and 60% 0 s. These random patterns are modified and updated periodically.