Self-adaptive control system capable of configuring strong PUF (Physical Unclonable Function) source

Abstract

An adaptive control system configurable with a strong PUF source (CSPS), the CSPS being configured to communicate a self-registration state (SES), a key (K) and a key reconstruction state (KRS), the system comprising: an adaptive PUF control unit (ACU) configured to: receive information of an entropy of at least one key, a reliability of the at least one key and a PUF index representative of one of the at least one key; -challenging and configuring a strong PUF source (CSPS); and-receiving a quantized non-binary response in the feedback of a strong PUF source (CSPS); -a PUF control logic finite state machine (CFSM) configured to drive an adaptive control unit (ACU), the CFSM configured to: receive PUF mode operation to first perform self-registration (SE) and then perform key reconstruction (KR); -accessing data representative of a one-time programmable policy (POTP); writing and reading data of the data RAM (DRAM); and-writing and reading one time programmable data (DOTP).

Description

Technical Field

[0001] The present invention generally relates to Physically Unclonable Functions (hereinafter abbreviated as PUF). Background Art

[0002] A PUF is an object that is unique to each device, although it is obtained by manufacturing from the same design representation. Some PUFs have been introduced that exploit the redistribution of impurities dispersed inside the bulk material, whose spatial distribution is set essentially randomly during the manufacturing process (there is no way to predict their position). To identify one of the PUFs, a laser beam is used to penetrate the material and scan it (the emitted light reflection will be intrinsic to the device). In this respect, such "analog" PUFs are called "optical PUFs".

[0003] When used in the context of protecting objects (for example, ensuring a unique ID for each device service, or for deriving cryptographic keys to manage the secrets of a chip), PUFs are tamperproof. This is the case for example with optical PUFs, since an attempt to change the position of an impurity will most likely completely change the position of the properties captured in the material. The PUF is therefore simply destroyed by such an operation and is subsequently no longer recognized as authentic.

[0004] One particular class of PUFs that is of particular interest is the "Silicon PUF". Such PUFs can be integrated as logic blocks in electronic circuits, hence the name "Silicon PUF". In the following, we will focus on them, as they can be deeply integrated as building blocks into sensitive "digital" electronic designs.

[0005] Specifically, the core of a PUF is typically modeled as a Boolean function that takes a word (a bit string) as input and outputs a bit (the output of a single PUF entropy element is typically one bit. Recently, the concept of a high-order alphabet (HoA) for PUFs was proposed in "Testing and reliability enhancement of security primitives: Methodology and experimental validation, Microelectronics Reliability, Volume 147, August 2023," by Md Toufiq Hasan Anik, Jean-Luc Danger, Omar Diankha, Mohammad Ebrahimabadi, Christoph Frisch, Sylvain Guilley, Naghmeh Karimi, Michael Pehl, and Sofiane Takarabt. In this case, a single query of the PUF produces multiple response bits.). This structure can then be instantiated or queried multiple times to extract the full-length key, for example containing n=256 bits.

[0006] Therefore, each instance of a silicon PUF is typically viewed as a random function that takes a challenge as input and generates a response as output. Recall that a “random function” is a deterministic function, albeit one that is different for each individual instance.

[0007] PUFs are used in a variety of contexts. Due to their inherent tamper-resistant properties, they are often leveraged in safety-critical applications. One such use case is secure boot, where the device master key that ensures device protection is obtained from the PUF before booting the platform. In this regard, it is obvious that the PUF should reconstruct the key without errors (ideally) and ensure that the key is indeed unique per device (thus with maximum entropy). Another use case is tamper-proof chip identification. The PUF delivers an identity (nicknamed “ID”) that is unique to each chip and that cannot be forged by design nor replaced in mission mode.

[0008] Due to this diversity of use cases, PUFs must operate correctly not only under expected environmental conditions, but also under adversarial conditions, i.e. when the attacker does not play by the rules. The first case is operation within the corners (denoted as PVTA conditions, an abbreviation for process, voltage, temperature and aging). A PUF should work to specification regardless of its manufacturing quality and regardless of the environmental conditions (voltage and temperature), at least those allowed by the corner definition. The same is true for aging: the PUF should know how long it is expected to last. The second case corresponds to the case where an attacker deliberately changes the environmental conditions in order to gain an advantage from a faulty environment (possibly outside the allowed corners). Therefore, it is very important for a state-of-the-art PUF to perform "sanity checks" (also called "health tests").

[0009] Several PUF principles have been disclosed in the scientific literature. However, as described in the PhD manuscript by Roel Maes, Department of Electrical Engineering (ESAT) at KUL (Belgium), “Physically Unclonable Functions: Constructions, Properties and Applications”, it is acknowledged that PUFs can be roughly divided into two categories: (1) so-called weak PUFs that generate only one key, and (2) so-called strong PUFs that are able to generate a large number of responses. Therefore, strong PUFs can be considered a superset of weak PUFs. That is, a strong PUF addressable by an n-bit challenge can generate two response bits raised to the nth power (i.e., 2n) (exponential increase). Therefore, in the prior art, weak PUFs usually generate keys (bit vectors) through spatial instantiations of several PUFs, while strong PUF designs usually generate keys through temporal redundancy, meaning that each bit is generated as a response to a different challenge. However, two limitations should be noted about strong PUFs. First, the total entropy of a strong PUF is bounded, i.e., less than 2n, because some correlation between responses is expected. Second, it should be noted that some types of strong PUFs have been defeated in theory and practice by attackers using "machine learning" (ML) techniques. In fact, the richness of strong PUFs can become a weakness if attackers can exploit their flexibility to learn them.

[0010] Nonetheless, it is known that strong PUFs can operate in such a way that users (i.e. potential attackers) cannot submit arbitrary challenges to them, which effectively mitigates machine learning attacks.

[0011] Furthermore, we are interested in strong PUFs that produce a non-binary response. This allows online measurement of reliability. Next, we consider such PUFs, Figure 1 As shown, where the analog output is quantized (thanks to analog-to-digital conversion, also called ADC) to a non-binary value. For example, the ADC can be a counter. Therefore, the model can be checked at an upper level, for example by counting cycles in a PUF based on a free-running oscillator. It is also called a "soft decision" (based on a multi-valued variable), as opposed to a "hard decision" (based on a binary variable).

[0012] A known benefit of such strong PUFs is that their principles can be abstracted into the form of so-called “stochastic models”. As described in the next paragraph, stochastic models allow PUF metrics to be derived from measurable parameters. Note that, unfortunately, weak PUFs do not lend themselves to stochastic models, since they have no input parameters to influence their metrics. As a result, weak PUFs may suffer from insufficient metrics without the flexibility to proactively compensate for their potential deficiencies. Weak PUF metrics are “as is”, so some chips will be less good than others, or even unsuitable for operational use and should be subjected to expensive classification (unless surviving with an average metric is considered tolerable).

[0013] Note that in the sequel, we will consider two iconic PUFs: SRAM PUF (“Physically Unclonable Functions: Constructions, Properties and Applications”, PhD manuscript by Roel Maes, Department of Electrical Engineering (ESAT) at KUL (Belgium), §2.4.4 “SRAM PUF”) representing weak PUFs (the key is spontaneously generated in the SRAM after power-on), and delayed PUFs such as looped PUFs (“An Easy-to-Design PUF Based on a Single Oscillator: The Loop PUF”. DSD 2012: 156-162, p4) representing strong PUFs. This article only mentions SRAM PUF to contrast with strong PUF. Figure 1 It can be seen that the SRAM PUF is atomic (top), while the cycle-based PUF (bottom) can be decomposed into multiple sub-blocks.

[0014] Figure 1 A strong PUF with digital output (after the analog-to-digital converter block) is shown, used as quantized (ie digitized, multi-bit) but not binary value. The quantized multi-valued response allows to construct histograms and thus infer statistics.

[0015] Therefore, it is clear that PUFs should be rated according to some objective quality factor. A normative document in this regard is "Information security, cybersecurity and privacy protection-Physically unclonable functions", ISO / IEC 20897. Regardless of the design principle of the PUF, two metrics that are important to the end user are "reliability" and "entropy". Reliability is related to the correct reconstruction of an instance, while entropy is related to the independence of the PUF between different instances.

[0016] As described in "The Big Picture of Delay-PUFDependability" (Alexander Schaub, Jean-Luc Danger, Olivier Rioul, Sylvain Guilley, ECCTD 2020: 1-4), a practical way to understand these constraints is in terms of the following two properties:

[0017] - Inside the PUF: the response must be the same, measured for example by the “Bit Error Rate” BER or the “Key Error Rate” KER, which is the BER over the n bits that make up the key; these quantities are related to the concept of the “Signal to Noise Ratio” SNR, which is the ratio between the technical dispersion (local variability) and the variance of the unpredictable noise that degrades the dispersion measurement.

[0018] - Inter-PUF: the responses must be different, for example measured by some entropy tools borrowed from the information theory toolkit. For delay-strong PUFs, it may be related to the specific choice of challenge (typically, pairwise orthogonal challenges belonging to Hadamard codes).

[0019] The structural problem with PUFs is that, by design, the responses under certain challenges are unreliable. This is bound to happen because the randomness of a PUF comes from technical dispersion, and this defect is not bound to occur. This means that the technical dispersion is "none" on average. Usually, technical dispersion is seen as the bane of the technology, making its performance less predictable: it forces design kits to be more conservative (e.g., forcing derating factors) and leads to lower yields. But with PUFs, technical dispersion is the working factor. Obviously, for a PUF to be reliable, challenges that lead to unreliable responses must be excluded. The list of excluded challenges falls into the category of "pre-trained" information (permanently stored), which is often called "auxiliary data."

[0020] Note that it is possible to operate a PUF without auxiliary data (PUFs without auxiliary data do exist, but with limited reliability (or, given reliability, longer operation time than with reconstruction), which avoids many of the problems associated with the enrollment process (no device-level enrollment is required, only class-level enrollment). However, in general, to achieve reasonable metrics in a reasonable time, PUFs should be characterized "one by one". This step is called "enrollment" and is commented on next.

[0021] Recent literature discussing PUFs usually focuses on the “PUF entropy source”. However, the PUF source alone cannot meet today’s needs. In fact, several tests and checks should be performed before utilizing the PUF entropy source. In this regard, the PUF consists of several auxiliary functions, including manufacturing tests, health tests, codes to improve reliability and entropy, including non-volatile memory for storing auxiliary data. The health tests include self-checks to maintain the PUF functioning properly. Obviously, these functions are instantiated to compensate for the shortcomings of “PUF entropy source only”. Therefore, it is clear that a major drawback of today’s PUF market is that it involves dynamic use. In fact, today, the default PUF use is “single shot”, that is, statically reconstructing the key at power-on and then refusing any further service.

[0022] Let us finally note that several attacks on PUFs have been published, such as key recovery using “selected ancillary data” and “side-channel attacks”. These attacks must be mitigated in a highly secure production environment.

[0023] Current PUF technology has many shortcomings due to the static nature of its use cases. We have included a list of shortcomings below, but we would like to clarify the reasons for these limitations. Because of the “static” nature of SRAM memories (e.g., weak PUFs), such as PUFs based on the “exposed” state of SRAM at power-up (“Physically Unclonable Functions: Constructions, Properties and Applications”, PhD thesis by Roel Maes, Department of Electrical Engineering (ESAT), University of Leuven, Belgium, §2.4.4 “SRAM PUF”, p. 41), are inherently limited to one measurement per power-up cycle.

[0024] This limitation exists for all weak PUF incarnations, such as "Dielectric Breakdown PUF", "Via-PUF" (Via-PUF Security Chip for Root of Trust, https: / / www.design-reuse.com / sip / via-puf-security-chip-for-root-of-trust-ip-51118 / ), "OTP-PUF" (Secure Data Protection of Anti-Fuse OTP Memory, https: / / www.pufsecurity.com / products / secure-otp / ), etc. The power-on value is authoritative. Surprisingly, strong PUFs (as described in the latest literature) face the same limitations, because no one has actually tried to circumvent them. Therefore, they are suitable as the core "entropy source" of the present invention. Since the entropy source is configurable, the application will be more relevant, which is not necessarily the case for all existing strong PUFs.

[0025] Today, enrollment of weak PUFs requires several power on / off cycles. In practice, the reliability of a specific element of the entropy source can only be assessed based on repeated measurements. Therefore, there is a clear trade-off between enrollment time and reliability / entropy. Note that not only several (hundreds or even thousands) PUF queries are required for an accurate estimate, but also testing in all agreed PVTA corners is a requirement. We emphasize that this will require (if done effectively - a step that may be sacrificed for performance / cost issues) long interaction time with the test equipment.

[0026] Auxiliary data allow to increase the reliability of the PUF. However, it has been shown that if an attacker can secretly change the auxiliary data, information about the PUF (random) function can be recovered. Therefore, as of now, the state of the art is to perform a registration and store the result ("auxiliary data") securely with integrity (since the PUF value is obviously vulnerable to attacks). This requires the registration to be performed in a "secure place" (Ulrich Rührmair, Jan PUF Modeling Attacks: An Introduction and Overview. 2014: 1-6). A secure site is an expensive requirement. This can be met, for example, by a Common Criteria (CC) certified site, which requires compliance with the Minimum Site Security Requirements (MSSR). Moreover, if the registration is performed by a third party, this condition limits the number of possible subcontractors, which negatively affects the cost and time of the registration service.

[0027] The usual way to operate a PUF is to set it up once in a secure facility. In other words, once registered, the PUF becomes unchangeable, which is almost seen as a requirement. However, this excludes many innovative use cases where the PUF can be re-registered at any time.

[0028] This rigidity is a clear disadvantage, since if the product is compromised, it can no longer be used. Certification environments blame this behavior: for example, NIST FIPS SP 800 193 requires that devices always remain green when securely set. Now, generally speaking, products are designed in a "future-proof" way, which should make attempts to force a transition to an "end of life" lifecycle finite state machine code change unlikely.

[0029] Assuming a soft reboot or re-derived PUF value is needed for any reason, state-of-the-art PUFs are not designed to support this feature. Now, it can become a "must-have feature", for example, a security application must consider such a "warm" reboot in case an alarm is raised and the policy dictates an iSE reboot. A "warm" reboot also occurs in case of power loss or even without resetting the entire chip.

[0030] Some security standards (e.g., NIST FIPS140-3) require that any functionality be tested before use as well as periodically. Some test procedures, such as High Temperature Operating Life (JEDEC Standard, JESD22-A108G. Temperature, Bias and Operating Life. November 2022; JEDEC Standard, JEP122H. Failure Mechanisms and Models for Semiconductor Devices. September 2016), consist in running the chip under degraded conditions to simulate accelerated aging. These HTOL dynamic tests require the ability to handle the chip (in our case, the PUF) for a long period of time without powering off. State-of-the-art PUFs produce a value when powered on and keep it constant, and therefore do not meet the above standards. In contrast, our PUFs have the ability to be tested functionally and even better from a security perspective (e.g., see documents US10855476B2 or US10630492B2). Summary of the invention

[0031] The proposed solution allows solving the above mentioned problems by providing the following services / operations, namely:

[0032] - Health Test (HT), which can be run at any time to verify that the PUF has not been worn or attacked;

[0033] -Self-enrollment (SE for short), a prerequisite operation before reliable key reconstruction can be performed;

[0034] -Key reconstruction (KR), which may include multiple reconstructions within one power cycle.

[0035] According to one aspect of the present invention, an adaptive control system of a configurable strong PUF source is provided, wherein the strong PUF source is configured to transmit a self-registration state, a key, and a key reconstruction state, the system comprising:

[0036] - an adaptive PUF control unit, configured to:

[0037] - receiving entropy of at least one key, reliability of at least one key, and information representing a PUF index of one of the at least one key;

[0038] - Challenge and configure strong PUF sources; and

[0039] - receiving a quantized non-binary response in feedback from a strong PUF source;

[0040] - A PUF control logic finite state machine configured to drive an adaptive control unit, the PUF control logic finite state machine being configured to:

[0041] - Receive PUF mode operation to first perform self-registration and then perform key reconstruction;

[0042] - Access data representing one-time programmable policies;

[0043] - write and read data from data RAM; and

[0044] - Write and read one-time programmable data.

[0045] In one embodiment, the PUF control logic finite state machine is configured to:

[0046] - Access to data RAM to utilize data RAM for accumulation for repeated data collection of challenge / response;

[0047] - if the received PUF mode operation is self-registration, selecting the most reliable challenge with a reliability greater than a reliability threshold; delivering a self-registration status according to the corresponding reliability being greater than the reliability threshold and the corresponding entropy being greater than the entropy threshold, the self-registration status taking a good or bad value according to whether the self-registration is successful; and writing the whitelisted challenges with a good self-registration status into the one-time programmable data; and

[0048] - If the received PUF mode operation is key reconstruction, read the whitelist challenges in the one-time programmable data; apply all whitelist challenges; use adaptive control to decide the key bits by querying the strong bits until the entropy threshold and the reliability threshold are exceeded; pass the key reconstruction status and pass the key, the key reconstruction status takes a good or bad value depending on whether the self-registration is successful.

[0049] In one embodiment, the PUF control logic finite state machine is further configured to:

[0050] If the received PUF mode operation is a health test, the reliability and entropy of at least one key are estimated and a health test status is communicated, the health test status taking a value of good or bad depending on whether the health test was successful.

[0051] In one embodiment, the one-time programmable data includes:

[0052] - Whitelisting for each PUF instance;

[0053] - entropy threshold and reliability threshold; and

[0054] - Lifecycle of each PUF.

[0055] In one embodiment, the one-time programmable data contains the lifecycle of each PUF, including whether the PUF has been registered.

[0056] According to another aspect of the present invention, a method for transmitting a self-registration state, a key, and a key reconstruction state is also proposed, the method being implemented by an adaptive control system of a strong PUF source, the method comprising:

[0057] Implemented in the Adaptive PUF Control Unit:

[0058] - receiving entropy of at least one key, reliability of at least one key, and information representing a PUF index of one of the at least one keys;

[0059] - Challenge and configure strong PUF sources; and

[0060] - receiving a quantized non-binary response in feedback from a strong PUF source;

[0061] And the method comprises:

[0062] Implemented in a PUF control logic finite state machine configured to drive an adaptive control unit:

[0063] - Receive PUF mode operation to first perform self-registration and then perform key reconstruction;

[0064] - Access data representing one-time programmable policies;

[0065] - write and read data from data RAM; and

[0066] - Write and read one-time programmable data.

[0067] According to another aspect of the present invention, a computer program product is also proposed, which includes instructions for executing the steps of the above method. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] The invention will be better understood by studying several embodiments described by way of non-limiting examples and illustrated by the accompanying drawings, in which:

[0069] - Figure 1 Schematically illustrates a strong PUF with digital output according to the prior art;

[0070] - Figure 2 Schematically illustrates an adaptive control system of a configurable strong PUF source according to one aspect of the present invention;

[0071] - Figure 3 Schematically shows a method according to one aspect of the present invention Figure 2 A PUF control logic finite state machine of an adaptive control system of a configurable strong PUF source;

[0072] - Figure 4 Schematically illustrates an example of a typical operation mode authorization based on life cycle status according to one aspect of the present invention;

[0073] - Figure 5Schematically illustrates an example of a key reconstruction process from two responses (two queries from two conjugate challenges) according to an aspect of the present invention;

[0074] - Figure 6 schematically illustrates a visual representation of increased reliability as interaction time with a strong PUF increases according to an aspect of the present invention;

[0075] - Figure 7 Schematically illustrates PUF diversification achieved by a selected challenge offset according to one aspect of the present invention, with 2 3 = Take 8 times key diversification as an example;

[0076] - Figure 8 Schematically illustrates a random order of LPUF queries to mitigate side-channel attacks according to an aspect of the present invention;

[0077] - Fig. 9 a table schematically illustrating the benefits of using adaptive control according to an aspect of the present invention; and

[0078] - Fig.10 The flexibility in the derivation of assistance data according to an aspect of the invention is schematically illustrated. DETAILED DESCRIPTION

[0079] Elements with the same reference numbers are similar throughout the drawings.

[0080] Figure 2 An adaptive control system of a configurable strong PUF source according to an aspect of the present invention is schematically shown.

[0081] An adaptive control system of a configurable strong PUF source CSPS, wherein the configurable strong PUF source CSPS is configured to deliver a self-registration state SE_S, a key K, and a key reconstruction state KR_S, the adaptive control system comprising:

[0082] - Adaptive PUF Control Unit ACU, configured to:

[0083] - receiving entropy of at least one key, reliability of at least one key, and information representing a PUF index of one of the at least one key;

[0084] - Challenge and configure the Strong PUF Source CSPS; and

[0085] - receiving a quantized non-binary response in feedback from a strong PUF source CSPS;

[0086] -PUF control logic finite state machine CFSM, configured to drive the adaptive control unit ACU, the PUF control logic finite state machine CFSM is configured to:

[0087] - Receive PUF mode operation to first perform self-registration SE and then key reconstruction KR;

[0088] - Access data representing the one-time programmable policy P_OTP;

[0089] - write and read data from the data RAM D_RAM; and

[0090] - Write and read one-time programmable data D_OTP.

[0091] Figure 3 Schematically shows a method according to one aspect of the present invention Figure 2 The PUF control logic finite state machine of the adaptive control system of the configurable strong PUF source.

[0092] The PUF control logic finite state machine CFSM is configured as:

[0093] - Access data RAM to utilize data RAM D_RAM ​​for accumulation for repeated data collection of challenge / response;

[0094] - if the received PUF mode operation is self-registration SE, selecting the most reliable challenge whose reliability is greater than the reliability threshold; delivering a self-registration state SE_S according to the corresponding reliability being greater than the reliability threshold and the corresponding entropy being greater than the entropy threshold, the self-registration state SE_S taking a good or bad value according to whether the self-registration is successful; and writing the whitelist challenge with a good self-registration state SE_S into the one-time programmable data D_OTP; and

[0095] - If the received PUF mode operation is key reconstruction KR, read the whitelist challenges in the one-time programmable data D_OTP; apply all whitelist challenges; use adaptive control to decide the key bits by querying the strong bits until the entropy threshold and the reliability threshold are exceeded; pass the key reconstruction state KR_S and pass the key, the key reconstruction state KR_S takes a good or bad value depending on whether the self-registration is successful.

[0096] Optionally, the PUF control logic finite state machine CFSM may also be configured as:

[0097] If the received PUF mode operation is a health test HT, the reliability and entropy of at least one key are estimated and a health test status HT_S is transmitted, which takes a good or bad value depending on whether the health test is successful.

[0098] It is beneficial for PUF-based key generation modules to enforce some access control on operations. In general, when auxiliary data is lost, it is meaningless to reconstruct the key. Figure 4 The table in gives an example of a comprehensive policy. It is based on a monotonically increasing lifetime (meaning that the lifetime index can only be set to increase). Note that this table can be applied to each PUF index independently. Nevertheless, the OPT policy block is still optimal: some simple systems can work without any OTP policy.

[0099] We describe the possible and common life cycle states of a PUF and the corresponding permissions below:

[0100] 0: In the BLANK state, the chip can run without restrictions, which allows to find errors and characterize the technology. At this stage, some fine-tuning experiments can be performed;

[0101] 1: In the FACTORY state, the PUF is ready for enrollment, but for security reasons it should not be used to generate keys since the auxiliary data does not yet exist;

[0102] 2: In the PROVISIONED state, PUF can be used to reconstruct the key;

[0103] 3: In the MISSION state, permissions are the same as in the PROVISIONED state. Note that the goal of the MISSION state is not obvious here, but some other aspects can be managed, such as limited debugging capabilities;

[0104] 4: The RMA status is intended to test the chip capabilities without compromising its security. Therefore, the PUF can be tested, but it is no longer possible to register or query keys;

[0105] 5: EOL state corresponds to product retirement. Therefore, no actions are allowed, as any action can be considered an attack path.

[0106] The data RAM is a temporary location where the strong PUF stores training data. The data OTP is a permanent memory where the registration configuration (i.e. auxiliary data) is stored once. In a conventional use case, once the data OTP is programmed (also known as "programmed" or "burned"), registration is no longer possible and the only supported operation is "key reconstruction".

[0107] The PUF can be operated in a manner that exploits adaptive control. Figure 5 As shown, instead of deriving a key bit for each response (indexed by i, where 1≤i≤n), two queries c can be performed i and c' i , and based on the two corresponding responses r i and r' i Determine a key bit. Usually, c'i It can be obtained from c by a deterministic function (called "conjugation") i Export. This Figure 5 As shown in the figure, the bits used to reconstruct the key i The data carried by the bold lines are bit vectors, while the data carried by the thin lines are just bits.

[0108] This differencing approach allows filtering out environmental variations (e.g., V and T parameters in PVTA space). For example, one can use (complementary, i.e. and ). Note that in practice, V and T can span a large interval, such as in AEC-Q100[s4], where “Grade 0” means operation over the ambient operating temperature range [-40°C, +150°C].

[0109] PUF control takes as input the two most important indicators of PUF, namely:

[0110] 1) reliability; and

[0111] 2) Entropy.

[0112] These are the prescribed set points for the SE and KR commands. The set points are target values ​​for the SE and KR commands to reach, or return a "failed" type of status. In the present invention, the set points and thresholds are considered equivalent: if the set point (or threshold) is met, the operation is successful, otherwise an alarm is issued. The term "set point" is used to indicate that the "threshold" is the primary input defined and set by the user.

[0113] The PUF control logic finite state machine CFSM stimulates the PUF and retrieves an unquantized response. When the target metric is not reached, the PUF is re-stimulated, for example, using the "data RAM" for accumulation or by adjusting the "PUF configuration" input.

[0114] Regarding reliability, it is worth mentioning that the longer the interaction with the delay PUF, the better the reliability obtained. Therefore, it is beneficial to perform multiple queries in succession. For example, in Table 2, when the configuration parameter controlling the number of clock cycles increases, it can be visually seen that the reliability of deciding between one challenge (blue) and another challenge (red) increases. It is also obvious that as the number of clock cycles increases, the SNR also increases. The number of queries per challenge can be adjusted to obtain uniform reliability among the challenges.

[0115] Figure 6 It is a visual representation of the increase in reliability as the interaction time (configurable parameter N) with the strong PUF increases.

[0116] Another aspect related to key generation is the ability to enroll multiple keys. This is achieved with strong PUFs, since the number of challenges scales exponentially with the size of the PUF. However, it is also interesting to be able to use related challenges to derive related keys, so that they can be revoked and re-enrolled from the same "PUF source". This construction can be achieved using "shifted" challenges (i.e., offset by a constant, as in coset codes), such as Figure 7 A "coset code C' of code C" is another code in which all vectors in C' are translated.

[0117] PUF adaptive control can utilize randomization of the order in which challenges are applied in order to mitigate the risk of side-channel attacks that attempt to infer the relationship between measured leakage (e.g., electromagnetic or power consumption observations) and the quantized bit vector response values. Figure 7 This is explained in the interaction diagram of , which starts with a “secure” reconstruction of key bit i; recall that we assume 1≤i≤n. The challenge pair (c i and c' i ) is randomized without the aid of an external TRNG. The randomization stems from the fact that the least significant bits (LSBs) do not convey meaningful information to derive the response value (since the information is instead in the most significant bits).

[0118] Adaptive control may advantageously enable PUF response digitization, which increases resistance to auxiliary data manipulation, such as using a nonlinear metric based on binary detection to exploit response distribution quartiles, as described in document US 11005668 B2.

[0119] Fig. 9 The table of summarizes the benefits of using adaptive control. Recall that these benefits themselves rely on the fact that a strong PUF can be queried multiple times (actually at will) during a power cycle.

[0120] The PUF can receive configurations to allow the adaptive control module to have more expressive power. For example, giving the strong PUF time to produce its response allows exploring the time-to-reliability tradeoff. This law (assuming the jitter is IID) has been Figure 6 This is explained in .

[0121] In the classic architecture, the PUF is a cyclic PUF, as described in document US 8867739 B2. This PUF lets a free-running loop oscillate for a fixed time and determines the number of rounds. Two such operations are performed under two related challenges, and the response is determined based on the round pair. It has been shown that when the "fixed amount of time" is measured by the system clock, some operations of the attacker can be targeted at the free-running loop while the system clock remains stable. For this reason, in the field of true random number generators (TRNGs), structures have been proposed in which the "fixed amount of time" is measured by another free-running loop ("Towards an Oscillator Based TRNG with a Certified Entropy Rate", David Lubicz, Nathalie Bochard, IEEE Trans. Computers 64 (4): 1191-1200 (2015)). Another byproduct of this approach is that the resulting cyclic PUF (or generally delay PUF) is more immune to dynamic noise because the measurement is differential (between two cycles).

[0122] Solving all the limitations enumerated in the previous section is the subject of our invention. It requires two building blocks, namely:

[0123] 1 A configurable strong PUF source CSPS, which means it can be queried with an arbitrarily chosen challenge and provide its answer without the need to "reboot" the chip between different queries; and

[0124] 2 Adaptive PUF Control Unit ACU packages strong PUF.

[0125] The solution we propose is any strong PUF that can be run in a secure environment via digital logic. Therefore, PUF can:

[0126] - Training using a simple PUF entropy source device driver during the enrollment phase;

[0127] - Adjustments are made during the configuration phase, so that the parameters for correctly recreating the same constants are permanently fixed in non-volatile memory (even in OTP);

[0128] - Query after performing any of the above two operations.

[0129] As mentioned above, the "PUF entropy source" is the core and must be surrounded by supporting logic. The following subsections will describe the present invention from both an architectural and behavioral perspective.

[0130] - Adaptive control of the PUF source implemented in the logic, i.e. control logic in the HW or FW that feeds back to the PUF (whereas weak PUFs do not have this capability since they are generated only once at power-on). The operation mode can take three values: Self-registration SE, Key Reconstruction KR or Health Test HT. Figure 2 On the diagram, the thick lines are the "buses" that carry the bit vectors (data), while the thin lines are the control values. Also, the grey parts are optional. The strong PUF is fed by a configuration, such as a window N for cyclic measurements. The outputs are the key (valid only if the operation is a key reconstruction KR) and the status (depending on the requested operation, there are different status lines): the HT_S signal informs if the health test was successful, the SE_S indicates that the self-registration went well, and the KR_S informs that the key reconstruction has been appreciated by the client.

[0131] The present invention exploits the state, either temporarily during the PUF operation (RAM is sufficient) or permanently after a reboot (requires non-volatile memory, such as OTP). The OTP contains the following information:

[0132] - Whitelisting for each PUF instance;

[0133] - Entropy and reliability set points;

[0134] - The lifecycle of each PUF, including whether the PUF has been registered (this is optional, since by leveraging this option the PUF cannot be re-registered).

[0135] The behavior of the present invention is Figure 5 First, the policy OTP can be (optionally) read. It contains the authorized operations for each lifecycle state for each PUF index ( Figure 4 ).

[0136] The allowed operations then fall roughly into two categories:

[0137] - Update authorization (request change "Policy OTP")

[0138] - PUF operation mode is performed between HT, SE and KR.

[0139] Operations can generate two kinds of output:

[0140] - Status SE_S, KR_S, HT_S (for each of the three acceptable operations SE, KR, HT), indicating whether the operation unfolded normally. There are three status signals, one for each acceptable operation;

[0141] - Key value, if the operation requires PUF "Key Reconstruction" mode of operation. When the operation is "Health Test" or "Self Enrollment", the passed Key does not contain any meaningful operation.

[0142] The following describes the operating modes:

[0143] -HT: Health testing consists in checking whether the strong PUF still operates according to its specifications. For example, it can be as described in documents US10855476B2 or US10630492 B2. Regarding the reliability test, some challenges are repeatedly submitted to the PUF in order to evaluate the degree of reproducibility of the answers. This directly produces the BER or KER indicators under a given challenge. In order to guarantee the indicators more thoroughly, it is beneficial to utilize a random model. In this regard, the same characterization should be performed on multiple challenges in order to estimate both noise and technical dispersion. Combined, this leads to an on-site estimate of the SNR. As for entropy, it can be estimated by testing (for example, NIST SP800 22, for example, Section 4 of the bibliography of SP 800-22Rev.1a. "Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications", "A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications" Andrew Rukhin et al., April 2010). Another approach is to execute the PUF in parts in order to check the independence of the PUF parts (method in US10630492 B2). To increase security, a subset of challenges that are not used to generate keys can be tested for health, such as the "service challenge" concept described in US10855476 B2.

[0144] -SE: Self-registration allows the generation of auxiliary data for a specified key. Let us illustrate the process in the case where the auxiliary data consists of whitelisting some challenges that lead to reliable responses (or blacklisting a complementary set of challenges, i.e. the set that leads to the least reliable responses). The self-registration operation mode is (optionally) parameterized by a target reliability and a target entropy. Let us explain in detail how the current innovative FSM achieves this. On the reliability side, the adaptive PUF control selects a strong PUF entropy source configuration in a way that overcomes the target reliability. Such a set point is related to the auxiliary data stored in the data OTP. On the entropy side, the adaptive control exploits a stochastic model to determine the set of challenges to be used for a given PUF index. It may be interesting to characterize the PUF in multiple corners (some industrial products should work in dozens of corners) or in security and attack scenarios, or even just under various conditions supported by the chip DVFS strategy. A noteworthy advantage of the current self-registration process is that the auxiliary data never leave the PUF IP, making "auxiliary data" manipulation attacks impossible by design (this is not the case for weak PUFs, where the auxiliary data is entrusted to a secure device management outside the PUF ( AgilexTM Device Security User Guide)).

[0145] - KR: The "Key Reconstruction" operation recovers the set of challenges to be used to regenerate each key bit (or symbol in case of HoA) from the data OTP. Obviously, if the selected PUF has not been previously registered by the self-registration operation, the KR operation fails. The KR operation exploits the target reliability / entropy to invest less or more time in reconstructing the key. In fact, if one key bit is not reconstructed with enough confidence, it may be needed until the target reliability is overcome. This follows a similar process as already implemented during SE. Regarding the aspect of entropy; this has been ensured by the choice of challenges for the SE operation.

[0146] Figure 5 The FSM behavior represented above is implicitly recurring: once an action has been processed, another action may be accepted and subsequently executed, and so on. This enables interesting scenarios where the chip is powered up, then the health tests are checked and, if satisfactory, registered. All of these actions are chained together without requiring a reboot or power cycle.

[0147] Note that HT mode is optional. The real constraint is to have SE ready. In this case, KR can begin. The indication of HT can guide system-level users on whether SE or KR operations are justified in their "threat environment".

[0148] The HT mode of operation can also be used as a sensor. In this alternative mode, the HT is not used to check the correct behavior of the PUF, but to check the integrity of the entire host chip. The PUF is designated as an opportunity sensor.

[0149] SE operations can take advantage of adaptive control by simply chaining (performing characterization) candidate challenges per candidate challenge. But it is also possible to determine the most appropriate configuration of strong PUF entropy sources interleaved with the SE process. The configuration can be the same in all changes or it can be determined per challenge. The pseudo code for the first case is as follows:

[0150]

[0151]

[0152] In the second case, the pseudo code is as follows:

[0153]

[0154] In both pseudocodes, the reliability function takes the value of Delta_i (in Figure 5 In the expression Δ i ) is related to reliability, as in Figure 3One such relationship is given in “Improved analysis of reliability and entropy of delay PUFs”, Alexander Schaub, Jean-Luc Danger, Sylvain Guilley, Olivier Rioul, DSD 2018: 553-560, Lemma 1, p. 554].

[0155] Furthermore, in both pseudocodes, the retries in the while loop can be restarted not from the beginning, but incrementally accumulating Δ i value to utilize LLN.

[0156] exist Fig.10 The flexibility is explained in , where the advantages and disadvantages are clear. Basically, global configuration will reduce the size of the auxiliary data (one configuration applies to all queries), while per-challenge configuration will optimize the reconstruction speed (at the expense of auxiliary data size).

[0157] Therefore, the KR step can adapt to offline pre-characterized configuration values ​​or online determined configuration values. The following two pseudo codes illustrate this process of KR.

[0158]

[0159] The present invention has the following advantages:

[0160] - Adaptive control allows compensating for possible unpredictable silicon behavior, such as dynamic noise and precise process scatter, at post-silicon stages

[0161] - Jamming attacks can be detected by checking the correct key reconstruction of the PUF using a “service challenge”, as in US10855476 B2

[0162] - Self-register under a given key, re-register under another key — under lifecycle control in case registration must be locked

[0163] -PUF key revocation, enabling future-proof use of master keys while maintaining the high security of PUF

[0164] - Health testing before use and periodic testing as required by security standards such as NIST FIPS140-3

[0165] -Soft reboot of PUF to re-key, i.e. suitable for "security applications"

[0166] - Challenges are not exposed to the host, so (by design) ML / AI attacks are not possible (“Modeling Attacks on Physical Unclonable Functions”, Ulrich Rührmair, Frank Sehnke, Jan Gideon Dror, Srinivas Devadas and Jürgen Schmidhuber, CCS2010: 237-249)

[0167] - Enables more flexible characterization: in all corners / under attack / etc.

Claims

1. An adaptive control system of a configurable strong PUF source (CSPS), the configurable strong PUF source being configured to deliver a self-enrollment state (SE_S), a key (K), and a key reconstruction state (KR_S), the adaptive control system comprising: - Adaptive PUF Control Unit (ACU), configured to: - receiving information of the entropy of at least one key, the reliability of the at least one key and a PUF index, the PUF index representing one of the at least one key; - Challenge and configure the Strong PUF Source (CSPS); and - receiving a quantized non-binary response in feedback from said strong PUF source (CSPS); - a PUF control logic finite state machine (CFSM) configured to drive the adaptive control unit (ACU), the PUF control logic finite state machine (CFSM) being configured to: - Receive PUF mode operation to first perform Self-Enrollment (SE) and then Key Reconstruction (KR); - Access data representing the one-time programmable policy (P_OTP); - write and read data from the data RAM (D_RAM); and - Write and read One-Time Programmable data (D_OTP).

2. The adaptive control system of the strong PUF source according to claim 1, wherein: The PUF control logic finite state machine (CFSM) is configured as: - Accessing the data RAM to accumulate using the data RAM (D_RAM) for repeated data collection for challenge / response; - if the received PUF mode operation is self-registration (SE), selecting the most reliable challenge with a reliability greater than a reliability threshold; delivering a self-registration state (SE_S) according to the corresponding reliability being greater than the reliability threshold and the corresponding entropy being greater than the entropy threshold, the self-registration state (SE_S) taking a good or bad value according to whether the self-registration is successful; and writing a whitelist challenge with a good self-registration state (SE_S) into the one-time programmable data (D_OTP); as well as -If the received PUF mode operation is key reconstruction (KR), read the whitelist challenge in the one-time programmable data (D_OTP); apply all whitelist challenges; use adaptive control to determine the key bits by querying the strong bits until the entropy threshold and the reliability threshold are exceeded; pass the key reconstruction state (KR_S) and pass the key (Key), the key reconstruction state KR_S takes a good or bad value depending on whether the self-registration is successful.

3. The adaptive control system of the strong PUF source according to claim 2, wherein: The PUF control logic finite state machine (CFSM) is further configured to: If the received PUF mode operation is a health test (HT), the reliability and entropy of the at least one key are estimated and a health test status (HT_S) is delivered, the health test status taking a good or bad value depending on whether the health test is successful.

4. The adaptive control system of a strong PUF source according to any one of claims 1 to 3, wherein: The one-time programmable data (D_OTP) includes: - Whitelisting for each PUF instance; - entropy threshold and reliability threshold; and - Lifecycle of each PUF.

5. The adaptive control system of the strong PUF source according to claim 2 or 3, wherein: The one-time programmable data (D_OTP) contains the life cycle of each PUF, including whether the PUF has been registered.

6. A method for delivering a self-enrollment state (SE_S), a key (K), and a key reconstruction state (KR_S), the method being implemented by an adaptive control system of a strong PUF source, the method comprising: Implemented in the Adaptive PUF Control Unit (ACU): - receiving information of the entropy of at least one key, the reliability of the at least one key and a PUF index, the PUF index representing one of the at least one key; - Challenge and configure the Strong PUF Source (CSPS); as well as - receiving a quantized non-binary response in feedback from said strong PUF source (CSPS); And the method comprises: Implemented in a PUF control logic finite state machine (CFSM) configured to drive the adaptive control unit (ACU): - Receive PUF mode operation to first perform Self-Enrollment (SE) and then Key Reconstruction (KR); - Access data representing the one-time programmable policy (P_OTP); - Write and read data from data RAM (D_RAM); - Write and read One-Time Programmable data (D_OTP).

7. A computer program product comprising instructions for executing the steps of the method according to claim 6.

Images