Storage-calculation-encryption integrated circuit with dual modes and operation method thereof

Abstract

The invention relates to a dual-mode storage-calculation-encryption integrated circuit and an operation method thereof, in particular to an integrated circuit with both a PUF (Physical Unclonable Function) mode and an eCIM (Enhanced Common Information Model) mode. The dual-mode signal processor, the vector coding circuit, the word line driving circuit, the bit line driving circuit, the external signal decoding circuit, the selector circuit, the comparator circuit, the analog-to-digital converter and the shift adder circuit are arranged on the periphery; according to the PUF mode, the coupling complexity of the PUF in the spatial dimension is improved through complementary word lines, nonlinear XOR operation is achieved in each basic unit through a pairing method of two state complementary transistors, Hamming distance comparison between two columns is introduced, and the machine learning modeling attack resisting safety of the PUF is improved; according to the eCIM mode, an encrypted data weight matrix stored in a transistor is protected through XOR encryption, high-energy-efficiency and high-parallelism in-memory calculation operation is achieved through a nonvolatile transistor array, and high-parallelism in-situ decryption in-memory calculation is completed through complementary word lines.

Description

Technical Field

[0001] The present invention relates to the field of in-memory computing and physically unclonable function design, and in particular to a hardware design based on a non-volatile transistor array that has both encrypted in-memory computing (eCIM) and physically unclonable function (PUF) functions. Background Art

[0002] The widespread deployment of edge devices in smart homes, smart cities, industrial electronics, healthcare and other fields has brought about a massive demand for cloud-edge data interaction. These large numbers and various types of edge hardware devices are connected to the cloud, which stores important privacy information such as user security keys, behavioral habits, and healthcare, and have become key nodes vulnerable to identity attacks and asset attacks, causing important security issues such as data leakage. Specifically, identity attacks are identity fraud, where attackers disguise themselves as legitimate users to defraud the cloud and illegally access data in the network and system; while asset attacks include directly stealing data in edge storage through methods such as reverse engineering, such as private data in sensor / communication equipment, pre-trained weights of edge artificial intelligence networks, etc. In addition, the intrusion of these IoT devices will also cause corresponding functional paralysis or malfunction, which may endanger human life in vehicle-mounted electronics or smart medical equipment.

[0003] Therefore, it is necessary to give the device a unique identifier for identity authentication under the limitations of hardware overhead such as computing power, power consumption, and area at the edge, to protect the user privacy data and pre-trained model security in the cloud; on this basis, the transmission and storage process of edge data assets should be encrypted and protected, and the reading and calculation speed during decryption should be improved. Physical Unclonable Function (PUF) and encrypted Computing in Memory (eCIM) can respectively solve the above two requirements.

[0004] As a hardware security primitive, PUF uses the process fluctuations of device preparation or the physical random mechanism in the working process as an unpredictable hardware fingerprint, providing a lightweight identity security solution for devices deployed in unsupervised environments. Therefore, it is widely used in device identity authentication and various communication security protocols. As a physical entity, PUF can perform black box processing on a given input (challenge signal Challenge, referred to as C) that is externally undetectable and mathematically unpredictable, and then transform it into an output (response signal Response, referred to as R). Because the black box operation is essentially determined by the physical mechanism and circuit design inside the PUF, the mapping relationship between its input and output signals, namely the challenge-response pair (CRP), can be used as a unique fingerprint at the hardware level for the legal identity authentication of the device. In the actual verification process, CRP is binary. The PUF will first register with the cloud in a secure environment. At this time, the cloud sends enough different Cs and collects the R returned by the PUF, and establishes the CRP library of the PUF. In an insecure environment, before the PUF requests to communicate with the cloud, the cloud will randomly select a small number of C from the established CRP library and send it to the PUF. The response result R of the PUF is compared with the existing R in the library. If the matching degree exceeds the threshold (such as 95%), the PUF can be considered to be legitimate.

[0005] eCIM is based on in-memory computing technology, and further adds the function of in-situ decryption on this basis. In-memory computing technology is completed through a non-volatile memory array. It can directly perform in-situ computing operations on the data stored in the memory and the external input data in the storage, and directly obtain the calculation results without the need for additional data reading and other handling processes. It has the advantages of high parallelism, high throughput, and low cost. eCIM further performs additional encryption protection such as XOR on the data in the memory to prevent attackers from directly reading the private data stored in the non-volatile memory. eCIM technology avoids the need for additional data reading, data decryption, and data calculation processes required by traditional encryption algorithms such as DES and AES, and completes the decryption and calculation processes simultaneously in the memory in one step, greatly improving the computational compatibility of encrypted texts and the computational throughput of the encryption system.

[0006] However, PUF needs to be a dedicated embedded module in edge devices, which will bring additional area and power consumption overhead; at the same time, in existing PUF designs, most CRP generation processes rely on simpler spatial coupling methods such as linear operations, and there are security issues with PUF under modeling attacks such as machine learning, such as speculation attacks based on greedy algorithms and simulated annealing algorithms. At the same time, the existing eCIM technology is based on double-word line SRAM cells, which requires a hardware cost of more than 6T, bringing additional area overhead. Therefore, the safe, reliable, and low-cost implementation of PUF and eCIM functions is of great significance for edge devices to resist security risks such as identity attacks and asset attacks. Summary of the invention

[0007] In view of the problems existing in the above prior art, the present invention proposes a PUF authentication mode with identity authentication and an eCIM calculation mode with in-situ decryption, realizing a circuit design integrating storage, calculation and encryption, and significantly reducing hardware overhead while ensuring high security functions. The present invention reuses PUF and eCIM for the first time in hardware, and proposes a hardware circuit design integrating storage, calculation and encryption, which has the ability to resist security risks such as asset attacks and identity attacks at the same time, and significantly optimizes the area and power consumption of the security encryption module at the edge.

[0008] The technical solution of the present invention is as follows:

[0009] A storage-computing-encryption integrated circuit with PUF and eCIM dual modes, characterized in that it has two different working modes at the same time, including a physical unclonable function PUF mode for security verification and an eCIM mode for secure in-memory computing; the circuit includes: a non-volatile transistor array, and a peripheral dual-mode signal processor (Dualsignal encoder), a vector coding circuit (Vector coding), a word line WL driving circuit and a bit line BL driving circuit, an external signal decoding circuit, a selector circuit (Selector MUX), a comparator circuit (Comparator), an analog-to-digital converter and a shift adder circuit (ADC, Shift and Add), wherein the vector coding circuit, the dual-mode signal processor, the driving circuit, the selector circuit and the non-volatile transistor array are shared circuit modules, the external signal decoding circuit and the comparator circuit are circuit modules called in the PUF mode, and the digital-to-analog converter and the shift adder are circuit modules called in the eCIM mode.

[0010] The non-volatile transistor array is a basic unit composed of two non-volatile transistors connected by circuits to form an n-row and n-column array structure. In the array structure, two word lines WL i and connected to the WL driving circuit; the bit line BL of each column of basic units is connected to the BL driving circuit, and the sense line SL is connected to the selector circuit; in the basic unit, the gates of the two non-volatile transistors are opposite and axially symmetrical, and the gate of one transistor is connected to the word line WL i Connect the gate of another transistor to the complementary word line The drains of the two nonvolatile transistors are connected to the bit line BL and the sources are connected to the sense line SL. In the basic unit, the storage states of the two nonvolatile transistors are complementary, and the two word lines WL connected to their gates are connected to the sense line SL. i and The level states of the two word lines are also complementary, that is, the two word lines on each row of the array are always complementary.

[0011] The vector encoding circuit is used to encode the Input vector input in the eCIM mode or the Challenge vector of the challenge signal in the PUF mode, and process the "1" and "0" bits in the vector into high / low levels that can be read by subsequent circuits.

[0012] The dual-mode signal processor circuit is used to further process the coded signal output by the vector coding circuit to implement the logic operations required in the eCIM or PUF. For the PUF mode, the signal processor will convert each bit C in the Challenge vector into i Expand to C i and C i The supplement The two complementary word lines WL in the WL driving circuit are output respectively. i and For eCIM mode, the signal processor will input each bit of the Input vector i Each bit of the key vector Key is i Perform logical operations and get two results: Key i andIn i The result of the operation, Key i In i The AND operation result is used as the two complementary word lines WL in the WL driving circuit. i and High and low levels, i=1,2,3...,n.

[0013] The WL and BL driving circuits are used to drive the word lines WL and bit lines BL of the non-volatile transistor array to provide a gate voltage V for the non-volatile transistors. G and drain voltage V D .

[0014] The external signal decoding circuit works in PUF mode, obtains and translates the selector circuit control bit from the output of the challenge signal vector encoding circuit as the input of the selector circuit MUX, and controls the column index of the specific two columns SL required for current size comparison and response generation in this CRP generation process.

[0015] The selector circuit is connected to the sense lines SL of the non-volatile transistor array, and randomly selects the SL currents of any two columns for reading according to the output of the external signal decoding circuit.

[0016] The comparator circuit is used for generating a response signal Response of the PUF mode, and its input is the output of the selector circuit.

[0017] The analog-to-digital converter and shift adder circuit are used for processing the calculation results of the eCIM mode. Digital operations are performed by the analog-to-digital converter ADC and the shift adder circuit to obtain the final calculation result of the eCIM, and its input is the output of the selector circuit.

[0018] Furthermore, the non-volatile transistor is a floating-gate or charge-trapping field effect transistor, that is, a storage layer is inserted into the gate stack layer, and the storage layer adopts a semiconductor material composed of a floating gate / trapping layer and a tunneling dielectric layer, and the threshold voltage of the transistor is modulated by capturing / de-trapping the charge of the channel; or it is a ferroelectric field effect transistor, that is, a layer of non-volatile material with ferroelectricity is inserted into the gate stack layer, and the threshold voltage of the non-volatile transistor is modulated by changing the polarization state of the ferroelectric material.

[0019] The present invention also provides an operation method of the above-mentioned storage-computation-encryption integrated circuit with PUF and eCIM dual modes, which is used for CRP generation in PUF mode and in-situ decryption calculation in eCIM mode respectively.

[0020] The steps of the CRP generation process in PUF mode include:

[0021] 1) Write the random fingerprint weight matrix rW to the basic unit of the n-row and n-column non-volatile transistor array. rW is a 0 / 1 binary matrix. The two complementary transistors of each basic unit store an element in rW, which are rW ij and i and j represent the row and column positions in the nonvolatile transistor array, respectively;

[0022] 2) Input challenge signal Challenge vector C passes through the vector encoding circuit and will get two different parts: the first part of the encoded vector is used to determine the "1" and "0" digital signals of the complementary word line input, which will be further obtained by the dual-mode signal processor circuit Ci and C i The supplement Finally, as a non-volatile transistor array complementary word line WL i and The high and low level inputs of the second part of the encoded vector are used to control the digital signal of the specific column index of the MUX selector circuit, which will be output to the selector circuit MUX through the external signal decoding circuit, and finally used to determine the index of the two SL columns for current comparison (here, the indexes of the two specifically selected SL columns are arbitrarily determined by the outside world);

[0023] 3) After determining the complementary word line input signal (first part) and the SL position index to be compared (second part), the non-volatile transistor array will perform an in-memory calculation operation. Each state complementary basic unit will compare the complementary word line input signal value C i , The XOR operation of the first part of the n-bit input signal is integrated with the storage value, that is, the first part of the n-bit input signal is XORed with a storage matrix rW of n rows and n columns by column, and the XOR result of each unit is summed by column to obtain the Hamming distance HD between the input signal vector and the column storage vector, and its value is reflected as the column current size on a SL. This is the processing process of the first part of the input signal inside the PUF, that is, i and j represent the row and column positions in the nonvolatile transistor array, respectively;

[0024] 4) The selector circuit determines the corresponding two SL currents from the multiple SLs of the non-volatile transistor array according to the output of the external signal decoding circuit, and inputs them to the comparator circuit to realize the comparison of the two Hamming distance HD 1 and HD 2 A 1-bit response signal Response is obtained according to the size, and the Response is used for PUF identity authentication.

[0025] The steps of the in-memory calculation process of in-situ decryption in the eCIM mode include:

[0026] 1) Write the encrypted data weight matrix eW into the basic unit of the n-row and n-column non-volatile transistor array. eW is a binary matrix of "1" and "0", which is obtained by performing an XOR encryption operation on the original weight matrix W to be kept confidential and the key Key; the two complementary transistors of each basic unit store an element of eW, which are eW ij and i and j represent the row and column positions in the nonvolatile transistor array, respectively;

[0027] 2) When in-memory calculations for in-situ decryption need to be performed, the vector Input to be calculated and the key vector Key for in-situ decryption are input, and the Key is obtained through the vector encoding circuit and the dual-mode signal processor circuit. i andIn i The result of the operation, Key i The supplement andIn i The result of the AND operation is used as the complementary word line WL of the nonvolatile transistor array. i and High and low level input;

[0028] 3) After the dual-mode signal processor circuit outputs the corresponding WL signal, the non-volatile transistor array will perform in-situ in-memory decryption calculation operations; as in the PUF mode, each state complementary basic unit will respond to the WL input signal value In i Key i , The n-bit WL input signal is subjected to a bit-by-bit XOR operation with a storage matrix eW with n rows and n columns, and the XOR results of each unit are summed up by column to obtain the Hamming distance HD between the input signal vector and the column storage vector, whose value is reflected as the column current on a SL. The difference is that, since the input WL signal is specially processed in step 2), the mathematical operation process completed inside the eCIM is: i and j represent the row and column positions in the array, respectively;

[0029] 4) The selector circuit reads all SL output currents from the non-volatile transistor array in sequence, and finally obtains the in-memory decryption calculation result of each column, which is input to the analog-to-digital converter and the shift adder circuit for processing to obtain the in-situ decrypted in-memory calculation result, that is, the matrix-vector multiplication result of the In vector and the eW matrix.

[0030] The present invention realizes for the first time an integrated circuit that combines both PUF mode and eCIM mode, achieving different security requirements required by edge devices under the premise of low area and power consumption, and can be flexibly configured and changed according to specific scenarios. The present invention avoids possible security risks such as identity attacks and asset attacks on edge devices, and uses more complex operation methods inside the array to improve the security of PUF and the privacy of eCIM. Compared with the prior art, the present invention has the following beneficial effects:

[0031] 1. The present invention integrates and reuses the PUF and eCIM modules, which can be used as a security hardware module for identity authentication and a computing module for in-memory computing at the same time, significantly optimizing the hardware cost and power consumption overhead, and reducing the difficulty of deploying these requirements on edge devices.

[0032] 2. The PUF mode of the present invention significantly improves the coupling complexity of the PUF design concept in the spatial dimension through the complementary word line scheme. The nonlinear XOR operation is realized in each basic unit through the pairing method of two state complementary transistors, and the HD 1 and HD 2 )’s Hamming distance comparison extends the conventional PUF design idea of ​​one-dimensional cascade units to two dimensions, significantly improving the security of PUF against machine learning modeling attacks.

[0033] 3. The eCIM mode of the present invention protects the encrypted data weight matrix stored in the transistor through XOR encryption, and can achieve high-energy-efficiency and high-parallelism in-memory computing operations through a non-volatile transistor array; and uses complementary word lines to complete high-parallelism in-situ decryption in-memory computing, which significantly improves the throughput of eCIM and reduces its latency cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A schematic diagram of the security risks of different types of attacks that edge devices may face;

[0035] Figure 2 This is a schematic diagram of the storage-computing-encryption integrated circuit design with dual modes according to the present invention;

[0036] Figure 3 A circuit design diagram and logic operation principle of a dual-mode signal processor provided according to an embodiment of the present invention;

[0037] Figure 4 A non-volatile transistor array circuit design diagram and a mathematical principle diagram according to an embodiment of the present invention;

[0038] Figure 5 This is an embodiment of the non-volatile transistor of the present invention, that is, a device structure of the non-volatile transistor. The leftmost and rightmost characteristic curves in the device transfer characteristic curve represent a low threshold voltage (storing data "1") and a high threshold voltage (storing data "0") respectively;

[0039] Figure 6 It is a schematic diagram of the abstract mathematical operation principle performed by the dual-mode storage-computation-encryption integrated circuit of the present invention when performing different PUF and eCIM modes. DETAILED DESCRIPTION

[0040] The present invention is further clearly and completely described below by specific embodiments in conjunction with the accompanying drawings. Although specific embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0041] Figure 1 It shows the security risks that edge devices widely deployed in scenarios such as smart homes, smart cities, industrial electronics, and healthcare may face, including identity fraud, asset theft, reverse engineering, and other illegal intrusions, which may lead to the risk of leakage of user privacy information, commercial confidential data, pre-trained model weights, and other data located in the cloud.

[0042] The storage-computing-encryption integrated circuit architecture designed by the present invention is as follows Figure 2 As shown, it includes circuit modules called by two different modes, PUF and eCIM, wherein the dual-mode signal processor, driving circuit, selector circuit and non-volatile transistor array are shared circuit modules, the challenge signal vector encoding circuit, external signal decoding circuit and comparator circuit are circuit modules called in the PUF mode, and the input vector encoding circuit, digital-to-analog converter and shift adder are circuit modules called in the eCIM mode. In the PUF mode, the non-volatile transistor array stores the random fingerprint matrix rW, and in the eCIM mode, the encrypted data matrix eW is stored. The input Input vector, key Key vector, challenge signal Challenge vector and rW, eW matrices in the circuit are all binary numbers of 0 / 1. In the PUF mode, the circuit can generate CRP according to the input challenge signal Challenge vector and the internally stored rW matrix, and obtain the corresponding Response for PUF identity authentication through the comparator circuit; in the eCIM mode, the circuit uses the input key Key to realize the in-memory calculation process of in-situ decryption, and obtains the matrix-vector multiplication result of the input Input vector and the eW matrix through the analog-to-digital converter and the shift adder circuit.

[0043] Figure 2 An embodiment of the circuit corresponding to the dual-mode signal processor in Figure 3 As shown, the WL input signal required by the subsequent non-volatile transistor array can be obtained by processing according to different modes and different previous stage inputs. One implementation method of the dual-mode signal processor circuit is to use two NOT gates and two NOR gates. The two inputs of NOR gate 1 are the outputs of NOR gate 1 and NOR gate 2, and the two inputs of NOR gate 2 are the output of NOR gate 1 and the input of NOR gate 2. In PUF mode, the input of NOR gate 1 is always high level "1", and the input of NOR gate 2 is the challenge signal C i, according to the Boolean logic of the circuit The output C of NOR gate 1 will be i , at the output of NOR gate 2 Then the two complementary word lines WL are output to the array through the WL driving circuit. i and In eCIM mode, the input of NOT gate 1 is the input vector In to be calculated. i , the input of NOT gate 2 is the encryption key vector Key i , and the output of NOR gate 1 is In i Key i , the output of NOR gate 2 is Similarly, the two complementary word lines WL are output to the array through the WL driving circuit. i and superior.

[0044] In PUF mode, first write the binary random fingerprint weight matrix rW to the basic unit of the n-row and n-column non-volatile transistor array, then input the challenge signal Challenge through the vector encoding circuit, and two different parts will be obtained. The first part of the encoded vector is used to determine the "1" and "0" digital signals input by the complementary word line, as the complementary word line WL of the non-volatile transistor array. i and The first part is used to control the high and low level input of the MUX selector circuit; the second part is used to control the digital signal of the specific column index of the MUX selector circuit, which is used to determine the index of the two SL columns where the current size comparison is located. After determining the complementary word line input signal (the first part) and the SL position index to be compared (the second part), the non-volatile transistor array will perform the in-memory calculation operation. Finally, the selector circuit determines the corresponding two SL currents from multiple SLs according to the output of the external signal decoding circuit, and inputs them to the comparator circuit to realize the comparison of the two Hamming distance HD 1 and HD 2 A 1-bit response signal Response is obtained based on the size for PUF identity authentication.

[0045] In the eCIM mode, the binary encrypted data weight matrix eW is written into the non-volatile transistor array, and is obtained by performing an XOR encryption operation on the original weight matrix W that needs to be kept confidential and the key Key. When in-memory calculations for in-situ decryption need to be performed, the vector Input to be calculated and the key vector Key for in-situ decryption are input, and Key is obtained through the vector encoding circuit and the dual-mode signal processor circuit. i andIn i The result of the operation, Key i The supplement andIn iThe result of the AND operation is used as the complementary word line WL of the nonvolatile transistor array. i and After the dual-mode signal processor circuit outputs the corresponding WL signal, the non-volatile transistor array will perform the in-situ in-memory decryption calculation operation. Finally, the selector circuit reads all SL output currents from the non-volatile transistor array in sequence to obtain the in-memory decryption calculation results of each column, which are input to the analog-to-digital converter and the shift adder circuit for processing to obtain the in-situ decrypted in-memory calculation results.

[0046] Figure 2 An implementation example of a circuit corresponding to the nonvolatile transistor array in Figure 4 As shown. The random fingerprint matrix rW or the encrypted data matrix eW required in the PUF mode and the eCIM mode will be stored in a non-volatile transistor array in a complementary manner. The circuit is based on an AND-type transistor array, and its basic unit is two non-volatile transistors ( Figure 4 The two word lines WL connected to the gate terminals of the two complementary non-volatile transistors i and The levels of the transistors in the same column are always complementary during operation, and the source terminals of the transistors in the same column are connected to the sense line SL. The input n-bit signal is input into the array as the level of WL complementarily, and 1-bit signal corresponds to one row, where the "1" / "0" value of the i-th bit signal is used as the word line WL of the i-th row. i and High / Low level.

[0047] like Figure 5 for Figure 4 The structure and electrical characteristics of the non-volatile transistor are shown in the array. The additional functional layer in the gate stack can non-volatilely regulate the potential of the channel, thereby changing the threshold voltage of the device and realizing the ability to non-volatilely store "1" or "0" data. Since the non-volatile transistor only inputs a voltage level V at the high gate terminal, G = High, storage data is 1 (w ij =1) can output the on-state current I only when both are met on , in other cases it is off state I off , so essentially it is V G and w ij In the analog domain, the AND operation is performed. Since the word line gate levels and weights in the same basic unit are complementary, the sum of the currents of the two transistors in the basic unit of the i-th row and j-th column is So the sum of the SL currents of the n 2T cells in the jth column That is, the jth column SL current and the input voltage vector WL on WL i and the j-th column weight vector wj is proportional to the Hamming distance.

[0048] Assuming that the size of the non-volatile transistor storage array is n×n, at the array level, the above operation can be mathematically equivalent to the n-bit column vector WL=[WL 1 ,WL 2 ,…WL n ] T With the stored matrix w ij Each column vector of is XORed bit by bit and summed by column (i.e., the Hamming distance between two column vectors), and the result of the jth column is Where i is the index of the row.

[0049] The equivalent mathematical formula of the in-memory calculation operation during the operation of the embodiment of the present invention is as follows: Figure 6 In PUF mode, due to the word line WL i and The input comes from the output of the dual-mode signal processor C i and Therefore, the actual mathematical operation performed on the jth column SL is:

[0050]

[0051] Further, through the selector circuit and external signals, any two columns of the SL output are input into the comparator circuit for size comparison, and a response signal of "1" or "0" is generated according to the result. Since the number of 1s and 0s in the matrix and vector is basically equal and evenly distributed, the comparison result of the size of any two columns of SL current is "1" or "0" with equal probability in mathematical expectation.

[0052] In the eCIM mode, due to the word line WL i and The input on the dual-mode signal processor comes from the output In i Key i and Therefore, the actual mathematical operation performed on the jth column SL is:

[0053]

[0054] Finally, the analog current signal can be converted into the corresponding in-memory calculation result through the subsequent analog-to-digital converter and shift adder circuit. This result is exactly the desired matrix-vector multiplication result of the input vector In and the original data matrix W. In this process, there is no need for additional steps of reading and decryption, and high-parallel in-situ decryption in-memory calculation is directly realized.

[0055] This embodiment fully and in detail describes the design and implementation principle of the PUF / eCIM dual-mode storage-computation-encryption integrated circuit based on non-volatile transistor arrays and peripheral circuits. It realizes the PUF module required for identity authentication and the eCIM module required for secure computing at the same time with low hardware cost and power consumption, and has significantly improved hardware reuse compared to other solutions. At the same time, its PUF mode uses a more complex spatial coupling scheme, improves the security of PUF against machine learning modeling, and has a reconfigurable function; while the eCIM mode can safely store encrypted data on non-volatile memory and realize a highly parallel in-situ decryption in-memory computing process.

[0056] Finally, it should be noted that the purpose of publishing the embodiments is to help further understand the present invention, but those skilled in the art can understand that various substitutions and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the contents disclosed in the embodiments, and the scope of protection claimed by the present invention shall be subject to the scope defined in the claims.

Claims

1. A storage-computing-encryption integrated circuit with PUF and eCIM dual modes, characterized in that: It also has two different working modes, including the physical unclonable function PUF mode for security verification and the eCIM mode for secure in-memory computing; the circuit includes: a non-volatile transistor array, as well as a peripheral dual-mode signal processor, a vector encoding circuit, a word line WL driving circuit and a bit line BL driving circuit, an external signal decoding circuit, a selector circuit, a comparator circuit, an analog-to-digital converter and a shift adder circuit; The non-volatile transistor array is a basic unit composed of two non-volatile transistors connected by circuits to form an n-row n-column array structure, and the two word lines WL of each basic unit in each row are i and Connected to the WL driving circuit; the bit line BL of each column of basic cells is connected to the BL driving circuit, and the sense line SL is connected to the selector circuit; The vector encoding circuit is used to encode the input vector in the eCIM mode or the Challenge vector of the challenge signal in the PUF mode, and process the "1" and "0" bits in the vector into high / low levels that can be read by subsequent circuits; The dual-mode signal processor circuit is used to further process the encoded signal output by the vector encoding circuit to implement the logic operations required in the eCIM or PUF; The WL and BL driving circuits are used to drive the word lines WL and bit lines BL of the non-volatile transistor array to provide a gate voltage V G and drain voltage V D ; The external signal decoding circuit works in PUF mode, obtains and translates the selector circuit control bit from the output of the challenge signal vector encoding circuit, and uses it as the input of the selector circuit to control the column index of the specific two columns SL required for current size comparison and response generation in the current CRP generation process; The selector circuit is connected to the sense lines SL of the non-volatile transistor array and randomly selects the SL currents of any two columns for reading according to the output of the external signal decoding circuit; The comparator circuit is used for generating a response signal Response of the PUF mode, and its input is the output of the selector circuit; The analog-to-digital converter and shift adder circuit are used for processing the calculation results of the eCIM mode. Digital operations are performed by the analog-to-digital converter ADC and the shift adder circuit to obtain the final calculation result of the eCIM, and its input is the output of the selector circuit.

2. The storage-computing-encryption integrated circuit with PUF and eCIM dual modes as claimed in claim 1, characterized in that: The vector encoding circuit, dual-mode signal processor, driving circuit, selector circuit and non-volatile transistor array are shared circuit modules, the external signal decoding circuit and comparator circuit are circuit modules called in the PUF mode, and the digital-to-analog converter and shift adder are circuit modules called in the eCIM mode.

3. The storage-computing-encryption integrated circuit with PUF and eCIM dual modes as claimed in claim 1, characterized in that: In the basic unit composed of two non-volatile transistors, the gates of the two non-volatile transistors are opposite to each other and are axially symmetrical, and the gate of one of the transistors is parallel to the word line WL. i Connect the gate of another transistor to the complementary word line The drains of the two nonvolatile transistors are connected to the bit line BL and the sources are connected to the sense line SL. The storage states of the two nonvolatile transistors are complementary, and the two word lines WL connected to their gates are connected to the sense line SL. i and The level states of the two word lines are also complementary, that is, the two word lines on each row of the nonvolatile transistor array are always complementary.

4. The storage-computing-encryption integrated circuit with PUF and eCIM dual modes as claimed in claim 1, characterized in that: The dual-mode signal processor circuit, for the PUF mode, will convert each bit C in the Challenge vector i Expand to C i and C i The complement of the two complementary word lines WL in the WL driving circuit are output respectively. i and For eCIM mode, the signal processor will input each bit of the Input vector In i Each bit of the key vector Key is i Perform logical operations and get two results: Key i andIn i The result of the operation, Key i In i The AND operation result is used as the two complementary word lines WL in the WL driving circuit. i and High and low levels, i=1,2,3...,n.

5. The storage-computing-encryption integrated circuit with PUF and eCIM dual modes as claimed in claim 1, characterized in that: The non-volatile transistor is a floating-gate or charge-trapping field effect transistor, that is, a storage layer is inserted into the gate stack layer, and the storage layer adopts a semiconductor material composed of a floating gate / trapping layer and a tunneling dielectric layer, and the threshold voltage of the transistor is modulated by capturing / de-trapping the charge of the channel; or it is a ferroelectric field effect transistor, that is, a layer of non-volatile material with ferroelectricity is inserted into the gate stack layer, and the threshold voltage of the non-volatile modulated transistor is modulated by changing the polarization state of the ferroelectric material.

6. The method for operating the storage-computing-encryption integrated circuit with PUF and eCIM dual modes as claimed in claim 1, characterized in that: The steps of the CRP generation process in PUF mode include: 1) Write the random fingerprint weight matrix rW to the basic unit of the n-row and n-column non-volatile transistor array. rW is a 0 / 1 binary matrix. The two complementary transistors of each basic unit store an element in rW, which are rW ij and i and j represent the row and column positions in the nonvolatile transistor array, respectively; 2) The input challenge signal Challenge vector C passes through the vector encoding circuit and will obtain two different parts: the first part of the encoded vector is used to determine the "1" and "0" digital signals input by the complementary word line, which will be further obtained by the dual-mode signal processor circuit C i and C i The supplement Finally, as a non-volatile transistor array complementary word line WL i and The high and low level inputs of the second part of the encoded vector are used to control the digital signal of the specific column index of the selector circuit, which will be output to the selector circuit through the external signal decoding circuit, and finally used to determine the index of the two SL columns where the current size comparison is located; 3) After determining the complementary word line input signal, i.e., the first part obtained in step 2), and the SL position index to be compared, i.e., the second part obtained in step 2), the non-volatile transistor array will perform an in-memory calculation operation, and each state complementary basic unit will compare the complementary word line input signal value C i , The XOR operation of the first part of the n-bit input signal is integrated with the storage value, that is, the first part of the n-bit input signal is XORed with a storage matrix rW of n rows and n columns by column, and the XOR result of each unit is summed by column to obtain the Hamming distance HD between the input signal vector and the column storage vector, and its value is reflected as the column current size on a SL. This is the processing process of the first part of the input signal inside the PUF, that is, i and j represent the row and column positions in the nonvolatile transistor array, respectively; 4) The selector circuit determines the corresponding two SL currents from the multiple SLs of the non-volatile transistor array according to the output of the external signal decoding circuit, and inputs them into the comparator circuit to compare the two Hamming distances HD1 and HD2, and obtains a 1-bit response signal Response according to the size. Response is used for PUF identity authentication.

7. The method for operating the storage-computing-encryption integrated circuit with PUF and eCIM dual modes as claimed in claim 1, characterized in that: The steps of the in-memory calculation process for in-situ decryption in eCIM mode include: 1) Write the encrypted data weight matrix eW into the basic unit of the n-row and n-column non-volatile transistor array. eW is a binary matrix of "1" and "0", which is obtained by performing an XOR encryption operation on the original weight matrix W to be kept confidential and the key Key; the two complementary transistors of each basic unit store an element of eW, which are eW ij and i and j represent the row and column positions in the nonvolatile transistor array, respectively; 2) When in-memory calculations for in-situ decryption need to be performed, the vector Input to be calculated and the key vector Key for in-situ decryption are input, and the Key is obtained through the vector encoding circuit and the dual-mode signal processor circuit. i andIn i The result of the operation, Key i The supplement andIn i The result of the AND operation is used as the complementary word line WL of the nonvolatile transistor array. i and High and low level input; 3) After the dual-mode signal processor circuit outputs the corresponding WL signal, the non-volatile transistor array will perform in-situ in-memory decryption calculation operations; as in the PUF mode, each state complementary basic unit will respond to the WL input signal value The n-bit WL input signal is subjected to a bit-by-bit XOR operation with a storage matrix eW with n rows and n columns, and the XOR results of each unit are summed up by column to obtain the Hamming distance HD between the input signal vector and the column storage vector, whose value is reflected as the column current on a SL. The difference is that, since the input WL signal is specially processed in step 2), the mathematical operation process completed inside the eCIM is: i and j represent the row and column positions in the array, respectively; 4) The selector circuit reads all SL output currents from the non-volatile transistor array in sequence, and finally obtains the in-memory decryption calculation result of each column, which is input to the analog-to-digital converter and the shift adder circuit for processing to obtain the in-situ decrypted in-memory calculation result, that is, the matrix-vector multiplication result of the In vector and the eW matrix.

Images