Measurement mechanism for physically non-cloning functions

Abstract

A measurement mechanism for physically non-cloning functions (PTFs). Multiple PTF bit cells are measured by providing multiple threshold control values ​​to PTF bit cells. The measurement results associated with each threshold control value are evaluated to determine threshold control pairs among the multiple threshold control values, having positive and negative threshold control values ​​that result in a desired number of PTF bit cells being strong 1 and strong 0.

Description

Technical Field

[0001] This disclosure relates to measuring the Physically Unclonable Function (PUF), in which the reliability of PUF bits can be effectively evaluated. Background Technology

[0002] A Physically Unclonable Function (PUF) is the random behavior of a circuit that generates random bits. This random behavior ensures that random bits generated between seemingly identical integrated circuits are different. PUFs are used in security applications, such as encryption keys.

[0003] There are many methods for fabricating PUF bit cells. One such method is based on SRAM bit cells, which have a smaller area compared to other PUF methods such as ring oscillators. A serious problem with SRAM PUF bit cells is the high natural error rate of up to 15% after voltage (V), temperature (T), and aging variations, requiring extremely expensive (area, time, power) encoding to reconstruct and reduce errors.

[0004] Existing technical solutions for reducing errors include determining whether repeatedly read bits produce the same value. This allows for the selection of only bits with a voltage offset greater than [value missing]. (V noise Those bits. However, the noise voltage is typically much smaller than the jump point changes caused by voltage, temperature, aging (VTA), and therefore still includes bits with fairly small jump points. This results in very limited reduction in the error rate. Furthermore, assuming the noise and initial offset are Gaussian distributed and that there is a non-zero deviation in the bit cell statistics, this process exacerbates the error.

[0005] The aim is to improve error reduction by utilizing improved measurement techniques based on simulated PUF. Summary of the Invention

[0006] In one embodiment, an apparatus includes a plurality of Physically Unclonable Function (PUF) bit cells. An active measurement control function is configured to provide a plurality of positive threshold control values ​​and a plurality of negative threshold control values ​​for use in passive measurements of the PUF bit cells, and to receive passive measurement results indicating the number of strong 1s associated with each positive threshold control value and the number of strong 0s associated with each negative threshold control value. The active measurement control function is further configured to determine threshold control pairs from the passive measurement results, having positive and negative threshold control values, such threshold control pairs resulting in a first desired number of PUF bit cells being strong 1s and a second desired number of PUF bit cells being strong 0s.

[0007] In another embodiment, a method for measuring a PUF having a plurality of physically non-cloning function (PUF) bit cells includes: providing a plurality of threshold control values ​​for use in a read operation of the PUF. The method further includes: receiving a passive measurement result of the read operation, and determining from the passive measurement result a threshold control pair having a positive threshold control value and a negative threshold control value among the plurality of threshold control values, the threshold control pair causing a first desired number of PUF bit cells to be strong 1 and a second desired number of PUF bit cells to be strong 0. Attached Figure Description

[0008] The invention can be better understood by referring to the accompanying drawings, and many of its objects, features and advantages will be apparent to those skilled in the art.

[0009] Figure 1 An embodiment of the PUF bit cell is shown.

[0010] Figure 2A The diagram shows four transistors in two inverters within a PUF bit cell, as well as an NMOS switch located between the common source and actual ground.

[0011] Figure 2B The diagram shows four transistors in two inverters within a PUF bit cell, as well as a PMOS switch located between the common source and VDD.

[0012] Figure 3 An embodiment of a differential fractional-to-analog converter (DAC) is shown, which includes providing differential analog bus pairs to bit line termination circuitry.

[0013] Figure 4 An embodiment is shown in which an array of PUF bit cells is arranged in a PUF page.

[0014] Figure 5 An array formed by PUF pages is shown.

[0015] Figure 6 A timing diagram is shown, illustrating the application of an offset to a PUF bit cell and then reading that bit cell.

[0016] Figure 7 A high-level block diagram of a PUF based on a ring oscillator is shown.

[0017] Figure 8 Various offset voltages (V) are shown. os The probability density function (pdf) of 1 and 0 of ).

[0018] Figure 9 The values ​​for offset control used during reconstruction (which are equal to the average of the positive and negative threshold control values) are shown to minimize the error.

[0019] Figure 10A The probability of obtaining a "1" by applying a threshold to a bit cell with a strong 0 is shown.

[0020] Figure 10B The probability of obtaining "1" by applying a threshold to a weak bit cell is shown.

[0021] Figure 10C The probability of obtaining "1" by applying a threshold to a bit cell with a strong 1 is shown.

[0022] Figure 11 An example of a hardware implementation for passive measurement is shown.

[0023] Figure 12 The typical relationship between threshold settings and passive measurement results is shown.

[0024] Figure 13 A flowchart of the active measurement process is shown.

[0025] Figure 14 An alternative search technique approximating Newton's method is shown.

[0026] Using the same reference numerals in different figures indicates similar or identical items. Detailed Implementation

[0027] By evaluating the reliability of individual PUF bits and excluding unreliable bits from further use, the bit error rate (BER) is significantly improved. The evaluation method assesses the offset of bit cells in an analog PUF and selects bit cells with large positive or negative natural offsets for use, thereby significantly reducing the error rate. In other words, bit cells with large positive or negative offsets are less likely to change in response to drift, as further illustrated herein. One embodiment of the bit cell described herein that allows for such evaluation is a less complex circuit with a lower bit cell area (compared to prior art methods). In one embodiment, the bit cell described herein allows an offset to be applied before reading the bit cell to determine whether the bit cell is regenerated as 1 or 0. This allows for the selection of strong 1s and strong 0s, thereby reducing the error rate associated with more conventional PUF methods.

[0028] Figure 1 A PUF bit cell 101 according to one embodiment is shown. The PUF bit cell includes a 6-transistor (6T) SRAM bit cell. The 6T cell includes a latch 102 formed by two inverters and two transmission gates 103 and 105. The four transistors of the two inverters are connected in... Figure 2AAs shown in the diagram. Transmission gate 103 couples internal node 107 of the bit cell to bit line 109. Transmission gate 105 couples internal node 111 to bit line 115. PUF cell 101 also includes an NMOS switch 117 located between the common source (inverter ground) and actual ground (GND). When the strobe signal 119 is asserted, the inverter is coupled to actual ground, and the latch regenerates to 1 or 0.

[0029] Although a PUF bit cell 101 with a single NMOS transistor between the inverter's ground and actual GND has been drawn, Figure 2B In another embodiment shown, a single PMOS transistor 201 is used between the inverter's VDD and actual VDD, replacing the single NMOS transistor 117. It should also be noted that in another embodiment, PMOS transmission gates 103 and 105 are replaced by NMOS devices to couple internal nodes 107 and 111 to their respective bit lines. In one embodiment, the PMOS transmission gates are used to ensure that the NMOS offset dominates (and is larger in some processing techniques) when the NMOS devices within the inverter begin regeneration first.

[0030] Figure 3 One embodiment is shown, which includes a differential fractional-to-analog converter (DAC) 301 that receives digital control signals 302 and provides differential analog bus pairs 303 (dac_p and dac_n) to bit line termination circuitry 304. The positive DAC signal dac_p is coupled to bit line 109 via transistor switch 306. The negative DAC signal dac_n is coupled to bit line 115 via transistor switch 308. In one embodiment, multiple independently controllable DACs are used to generate the differential analog signals coupled to the bit lines. Bit line termination circuitry 304 includes two transistor switches 307 and 309 that ground bit lines 109 and 115 to discharge the bit lines, as further described herein. Finally, a tri-state driver 311 receives bit line 109 (or bit line 115 in another embodiment) and drives the selected PUF bit logic state to a common data output bus. Although a tri-state driver is shown, other circuitry can be used to couple the PUF bit logic states to the data bus, such as transmission gates or multiplexer circuitry, to select from different banks of the PUF array.

[0031] Figure 4An array of PUF bit cells 101 arranged in PUF page 400 is shown. The row decoder 401 for each row of page 400 receives the address, page selection, conn signal, and strobe, and provides conn_n signal 121 to open the transmission gate when the row is selected and provides strobe signal 119 to regenerate the PUF bit cells upon declaration (see [link]). Figure 1 Additionally, multiple bit-line termination circuits 304 terminate the bit lines of each column of the PUF page 400. DAC differential signals are coupled to all bit lines of each column of the page. Finally, the data output bus dOut[N-1:0] 403 receives the latch values ​​of the PUF bit cells read and provided by the tri-state drivers of each bit-line termination circuit. The page size is determined based on the desired PUF array speed. A larger page size may result in a slower PUF array.

[0032] Figure 5 An array 500 formed by PUF pages 400 is shown. A page decoder 501 selects a specific page of the array 500, and a memory controller 503 controls access to the array of pages. The memory controller receives memory addresses, read commands, and clock signals, and controls access to precharge and read PUF bit cells, as further described herein. Figure 5 Also shown is a DAC 301 coupled to drive bit lines of array 500, a data output bus 403 coupled to receive data read from array 500, and a storage element 505, such as a flip-flop, storing the data read from the array and providing output data words. In one embodiment, the array size is between 4K and 8K PUF bits.

[0033] Figure 6 A timing diagram is shown illustrating a read operation that applies an offset to a PUF bit cell to precharge it, and then reads the contents of that bit cell. Unlike existing methods, the PUF bit cell allows the use of bit lines for analog input connections to apply the offset to the bit cell, and the same bit lines for digital output connections to read the contents of the bit cell. Control logic in the memory controller controls the operation of inserting the offset and then reading the bit cell. The control logic, or portions thereof, resides in memory controller 503, page decoder 501, and / or row decoder 401. Reference Figure 1 , Figure 3 and Figures 4 to 6At 601, the DAC is enabled and begins driving the differential DAC output to the differential bus pair 303. In the addressed pages, bit line termination circuitry 304 connects the differential analog signals to the bit lines via transistor switches 306 and 308. Simultaneously, at 602, the conn_n signal 121 (active low) is declared to connect the transfer transistors 103 and 105 in each bit cell of the addressed word to the bit lines currently carrying analog signals for pre-charging the bit cells. During the application of an offset voltage to pre-charge the bit cells, the strobe signal 119 remains deasserted, thereby decoupling the latch from one of the power nodes. The control logic allows time to stabilize the analog voltage in each bit cell of the addressed word. As shown at 603, the internal nodes 107 and 111 of the bit cells in the addressed word follow the differential voltage on the bit lines. After stabilization, the control logic disconnects the bit line from the bit cell by not declaring the conn_n signal 121 at 604 (the signal becomes high), and enables the dacDrv signal 310 by turning off switches 306 and 308 in each bit line termination circuit 304. Figure 6 (Not shown) is not declared to disconnect the bit line from the global DAC output bus. At 605, the control logic declares strobe signal 119 to fire the latch, causing positive feedback to force each addressed bit cell into a "1" or "0" state and allow time for full regeneration. The latch is resolved to 1 or 0 around time 607. The resolved state depends on the difference between the natural offset and the offset introduced by the DAC differential signal during precharge.

[0034] Simultaneously with triggering the latch, at position 609, depending on whether the bit cell's transmission gate transistor is PMOS or NMOS, the control logic precharges the bit line to an appropriate voltage. For example, in... Figure 6As shown, for a PMOS transmission gate transistor, the bit line is precharged low by enabling discharge switches 307 and 309. In an embodiment with an NMOS transmission gate transistor, the bit line is precharged high. After sufficient time has elapsed to precharge the bit line low, the precharging stops, and the control logic declares conn_n 121 on the address word at 611 to reconnect the regenerated internal node of the bit cell to the bit line. The control logic waits for the bit line to stabilize. The control logic declares a tri-state driver 311 (triStateDrv) at 615 to send the read data to the dOut[N-1:0] bus and then clocks the output data flip-flop (or latch) to hold the resulting output word together with the new output data word at 617. After the read operation, the bit line and the internal node of the bit cell return to the disabled state at 619 and 621, respectively. In the disabled state, the latch is disconnected from the power supply, the transmission gate is open, and both bit lines are set to the preselected logic level. Figure 6 In the illustrated embodiment, the preselected logic level is a high voltage level. Figure 6 In this embodiment, the bit line and DAC output are high during the idle period, reflecting the presence of, for example, Figure 1 The illustration shows an embodiment of a bit cell with an NMOS ground switch and a PMOS transmission gate. In that case, keeping the bit line (and internal nodes) high when the bit cell is disabled ensures that no current flows in the bit cell and there is no differential voltage across any matched device. This eliminates most of the mechanisms that cause drift due to aging of the bit cell's base voltage or natural offset voltage.

[0035] Therefore, an SRAM-type PUF has been described, in which, during a read operation, a digitally controlled analog signal (via a DAC) adds an offset to each PUF bit cell. As a result of selecting a specific digital offset setting, on-chip hardware is used to determine how many strong "1"s or "0"s are obtained (from a pre-selected portion of the entire PUF or the entire PUF). This operation is referred to as "surveying". For security reasons, it is advantageous for this surveying operation to be performed by hardware. Of course, embodiments can utilize software to perform the surveying operation, but it should be noted that certain security vulnerabilities may be exposed. The hardware and / or software control the surveying operation to select two thresholds that result in the number of strong "1"s and the number of strong "0"s being: (1) similar and (2) approximately matching some pre-selected number. For security reasons, it is advantageous for the number of strong 1s and the number of strong 0s to be similar. It should be noted that in Figure 1 In the SRAM-type PUF shown, the threshold is an offset provided by the DAC at the start of a read operation to precharge the bit cell.

[0036] Before describing some aspects of the measurement method, let's first define some terminology. The so-called bias of random binary data means p(1) ~= p(0). The bias is generally defined as: bias = p1 - 0.5. It has been shown that a non-zero bias in the PUF content can reduce entropy (making it easier to guess), especially when used in conjunction with long repeating codes. One use of the PUF content is for root keys, which are often viewed unfavorably by security-conscious clients who believe they are easily guessed.

[0037] The term "analog PUF" describes a PUF in which digital control (e.g., a multi-bit digital control word) is used to adjust the probability of obtaining a binary 1 due to the address word of reading a bit cell in the PUF. The details of the PUF implementation need not be related to... Figure 1 The PUF bit cell matching described in [the text is missing here]. Instead, the term requires that digital control be available to make 1 more likely (in one direction of control) or less likely (in another direction). For example, [the text is missing here]. Figure 7 A ring oscillator-based PUF is shown. Two ring oscillators, 701 and 703, oscillate at different frequencies, which are counted by counters 705 and 707 and compared in a comparator 709 that provides the PUF bits. In a ring oscillator-based PUF, the random variable is the ratio of the frequencies of the two oscillators. For seemingly identical oscillators, the comparator output takes a random value. In a simple implementation, the number of bits in the counters is N, and the comparator function is based on toggling to or from a reset state before one of the N bits in one counter toggles to the same bit in the other counter. Other implementations of ring oscillator-based PUFs are known. It should be noted that although two ring oscillators are shown, some embodiments may have, for example, 256 ring oscillators, with two selected for comparison. The oscillation frequency can be biased higher or lower by bias control 711. In some embodiments, analog or digital control of the varactor diodes loaded in the oscillators, or the power supply or bias current or voltage fed into the oscillators, is used to increase or decrease the oscillation frequency. For example, if the ring oscillators are current-limited (IC0), where each has its own current source to supply its local power supply voltage, then directing a small amount of current to one power supply or the other current-mode DAC would be an effective way to adjust the frequency ratio.

[0038] Post-silicon selection (PSS) refers to selecting only those bits (determined as "strong" during registration) for use (i.e., those whose polarity does not flip with drift compared to "weak" bits). This selection information is combined with auxiliary data to allow the reconstruction algorithm to skip weak bits.

[0039] An array of PUF bit cells is part of the system required to reliably regenerate the secure root key. Other parts of the system include registration hardware and / or software. Registration refers to the generation of “auxiliary data” (typically stored in flash memory) that is used during the reconstruction process. Registration is usually performed only once, during product testing of the security system. Registration can use the random polarity of a subset of the PUF bits to generate the entropy required in the root key, or it can use the output of a True Random Number Generator (TRNG).

[0040] Reconstruction refers to reliably regenerating a set of bits (often called the root key) using PUF content and auxiliary data. Reconstruction using hardware and / or software can optionally be performed once after each power-on, once after recovery from a low-power state, or once whenever the root key is required.

[0041] In an array of PUF bit cells, each cell has a base offset or natural offset V. os This offset may vary (drift) with changes in supply voltage, temperature, and aging. At read time, the binary result depends on: sign(V os +V noise -V control It should be noted that while the symbol "V" is generally used for voltage, it can also represent time or frequency in delay-based or oscillator-based PUF cells. As used herein, V control It is V os The applied offset (voltage, time, frequency, etc.) must be overcome to maintain the value corresponding to the base offset of the PUF bit cell. It should be noted that V... relative to the standard deviation of the offset voltage... noise It is usually very small. The term "drift" represents V. os The drift varies with voltage, temperature, and aging (VTA). Drift can be considered noise in the communication channel. Measured drift is typically independent bit-by-bit and has a distribution that at least reasonably matches a Gaussian distribution. If V... os If the value is large enough (positive or negative), the sign of the bit cell is less likely to be affected by drift. V control It can be used to determine which bit cells have a sufficiently high V. os And therefore can be considered as strong 1 or strong 0. For example, reference Figure 1 V control It is the amount of differential bias applied to the bit line. If the fundamental offset of bit cell 101 is strong enough to overcome the bias caused by V control The applied differential bias, as indicated, depends on the specific V applied. control A bit unit can be considered as a strong 1 or a strong 0.

[0042] In traditional PUF implementations, there is no control (Vcontrol =0). Ignoring noise will lead to an error in the following situations: This means offset drift (V) osDrift ) greater than the original offset (V oso And in the opposite direction. Therefore, the error rate is dominated by bits with small offsets. For SRAM PUF implementations, the error rate can be as high as 15-20% at poor VTA corners. High BER necessitates the use of powerful error-correcting codes. These codes are expensive in terms of the required PUF bit width, the required auxiliary data size, silicon area, and reconstruction time and effort.

[0043] Figure 8 The diagram shows the effects on different offset voltages (V). os The probability density function (pdf) of 1 and 0 of ) is given. Given a simulated PUF, during registration, a set of two offset controls (positive threshold control value (V)) can be selected. thr+ ) and negative threshold control value (V thr -)) to allow for the selection of sufficiently strong (positive and negative) bits. V thr+ Indicates the V used to determine strong 1 control Value, V thr - indicates the V used to determine strong 0. control Value. If the original offset distribution is not zero-mean, the bias (mismatch in the number of positive and negative offsets) can only be small if the selected thresholds have different magnitudes. During reconstruction, the drift may be large enough to introduce error. (See reference...) Figure 9 Assuming symmetry in the drift, then during reconstruction, by using the mean(V) thr+ V thr -) The corresponding offset control value is used to minimize the error count.

[0044] In this context, measurement implies passive measurement: the number of selected 1s or 0s is determined by using a specific threshold. Alternatively, in some cases, knowing only the polarity of the difference between the resulting number and the desired number may suffice. Active measurement refers to combining passive measurement with a search algorithm (e.g., successive approximation, Newton's approximation, linear scan) to determine the thresholds that produce the desired number of 1s and 0s. It should be noted that, typically, active measurement requires running once to find the positive threshold for producing the desired number of 1s, and then running again to find the negative threshold for producing the desired number of 0s. As used in this paper, the positive threshold controls V. thr+ Corresponding to V ctl And indicates the applied offset (e.g., to) Figure 1 The PUF SRAM cell described in the text is opposite to or contrary to the basic offset of the PUF cell.

[0045] There are several security vulnerabilities associated with the measurements. Since measurements are typically performed only during product testing, their power or energy costs and execution time are not critical. This makes it attractive to perform all measurements in software, as this completely eliminates hardware costs. However, using software for all measurements necessarily means that, at least during registration, the computer performing this work has access to the data in the PUF. This implies the existence of a connection (PUF output to the computer), meaning an attacker (or hacker) who can replace different instructions during product testing can substitute the code; for example, they could upload the PUF content to a file accessible to the attacker. If this is not possible, an attacker who can compromise the system after registration to allow access to the PUF data could obtain the root key. Security is enhanced if there is no connection between the PUF output and the software-accessible registers. Therefore, it is preferable that at least the passive measurement steps are performed in hardware rather than software.

[0046] Furthermore, passive measurements should not provide high-resolution partial results. For example, if it were possible to control passive measurements to count only J bits, and J could be programmed to be high-resolution, an attacker obtaining the result as a function of J would have strong information that facilitates accurate guessing of the root key. Generally, there is no reason to allow such control, as using all PUFs results in a lower raw BER.

[0047] As long as passive measurements are performed in hardware, performing active measurements in software does not pose a safety risk. It should be noted that hardware implementation of active measurements is also possible.

[0048] Differential power analysis (DPA) or simple power analysis (SPA) attacks are used to analyze power consumption patterns to obtain cryptographic information such as secret keys. DPA is based on examining the differences between power traces obtained due to different messages. For PUF, there is only one "message," so DPA cannot be applied. SPA is a suitable but weaker technique. SPA attacks are also difficult to succeed. Even without countermeasures, successive reconstructions may produce different power traces due to different errors occurring. Attackers cannot average them. Each track is likely to be different, but attackers cannot average them. Measurement necessarily means placing the threshold in the "thicker" part of the PDF. A few percent of the bit cell offset will be very close to the threshold, so reading thousands of bits in a PUF array will result in Each bit will change on each read trace. Furthermore, there will be no bit serialization operations. A PUF array read can be 16, 32, or even 64 bits. Power consumption will have a component determined based on the sum of the changes in many random bits. This conversion of data-dependent power provides little information to an attacker. Countermeasures against SPAs include avoiding zeroing operations on the PUF's internal data bus. Zeroing means that power consumption (for bus driving) is proportional to the number of 1s in the bus. If power consumption is proportional to the number of transitions on a wide bus, then much less information is provided. Another potential countermeasure is to read the entire PUF array starting from a random address (different each time) during rebuilding. Therefore, if you start reading the PUF array at address N, the read operation will wrap around to address N-1, or at least until all locations containing strong 1s and strong 0s have been read. In such embodiments, the integrated circuit containing the PUF can further include a random address generator (e.g., a True Random Number Generator (TRNG)). The weak cells of the PUF can also be used to seed the random address generator or to determine random addresses.

[0049] Figures 10A-10C This shows the probability of obtaining a "1" by applying a threshold to bit cells that are strong 0, weak, and strong 1, respectively. (Refer to...) Figure 10A Curve 1001 shows the probability of obtaining a "1" for a bit cell that is strongly 0. At the threshold (V) thr -) If the bias is sufficiently negative (opposite to / opposite to the natural bias) and there is a lack of additional bias, the probability of 1 at 1003 will become 100%. Figure 10B Curve 1005 in the diagram illustrates the probability of obtaining a "1" for a weak element at different offset levels. For the weak element represented, when V... thr When V is positive, the probability of obtaining "1" is zero, while when V is positive... thr When the value is slightly negative, the probability becomes 100%. Figure 10C In the diagram, curve 1007 shows the curve for a unit with a strong 1. The probability of obtaining a "1" is 100% until the positive threshold (V). thr+ ) until it reaches 1009 and overcomes the fundamental offset of the strong element, where V threshold V corresponds to the following formula control :sign(V os +V noise -V control Finally, at point 1009, V thr It is so large that it overcomes any potential V that might otherwise cause the cell to read "1". os .

[0050] One method for determining the strong and weak cells suitable for measurement is to read PUF bit cells with a positive threshold to determine cells with a strong "1" and with a negative threshold to determine cells with a strong "0". If a positive threshold V is applied... thr+ And the result of reading this unit is 1 ( Figure 10C If a value is found to be a strong "1", then the cell is considered a strong "1"; otherwise, the strong or weak state of the cell remains unknown. If a negative threshold (V) is applied... thr -), the result is 0( Figure 10B If a bit is strong, it is represented as a strong "0"; otherwise, the strong or weak state of the bit cell remains unknown. Weak bits will be all bits that are not strong. Measurement operations using this method will apply a positive threshold, read the entire PUF, and count all strong 1s. Measurement operations will then apply a negative threshold, read the entire PUF, and count all strong 0s. Of course, the order in which strong 1s and strong 0s are determined can be reversed.

[0051] Figure 11 An embodiment of a hardware implementation for passive measurement is shown. "Passive" here means that the hardware only observes PUF bit cells without altering threshold control. Passive measurement hardware 1101 includes an address counter / state machine 1102 that responds to a start command 1104 to guide the reading of all words (or a portion thereof) in PUF 1103. PUF 1103 is M x N bits in size, with a total of S bits, where M, N, and S are integers. The address counter / state machine provides a read address 1107 and a read command 1109. When the reading of PUF 1103 is complete, the address counter / state machine provides a completion signal 1105.

[0052] Passive measurement reads one word from PUF array 1103 at a time, and for a word length of N, PUF 1103 provides N bits of data on the read data bus 1111. Summer 1115 operates on (Nx1) independent binary bits provided on bus 1111, summing the total number of bits with preselected states in the provided N bit words, and providing this total as a single word of size ceil(log2(N+1)). The preselected states can be 0 or 1. For example, when the word size N = 32, the number of 1s in a single word is in the range of 0-32 (inclusive), requiring 6 bits to represent the count value.

[0053] The second summer 1117 and register 1119 form an integrator that counts all 1s in the entire PUF 1103. Register 1119 provides the final count value to a set of AND gates 1121 and performs an AND operation on the bits of the final count value and the completion signal 1105 to reduce data-related power consumption (suitable for smaller SPA attack surfaces). In other embodiments, AND gates 1121 are omitted. Measurement result 1123 indicates the number of 1s obtained by reading S bits of the PUF at a specified threshold level. Of course, the number of 1s represents the number of 0s, since the number of 0s is (S - measurement result), which can be easily determined by hardware or software. In one embodiment, passive measurement circuit 1101 counts 0s instead of 1s, and then the number of 1s is (S - measurement result). In other embodiments, passive measurement circuit 1101 may be configured to count 0s or 1s. In such an embodiment, the passive measurement circuit receives a control signal (not shown) to indicate whether to count 0s or 1s.

[0054] In one embodiment, a processor, such as processor 1131 with associated memory, or a programmed microcontroller, controls passive measurement hardware during active measurements. The processor provides DAC control values ​​to cause the DAC to provide appropriate threshold and start signals 1104. The processor and memory 1131 receive and utilize measurement results as further described herein. The memory stores software for controlling the processor, stores the DAC control values, and stores the measurement results. The memory is a non-transitory computer-readable medium, such as volatile or non-volatile memory.

[0055] The goal of active measurement is to find the threshold control pair that results in a preselected number of 1s and a preselected number of 0s. Typically, the preselected numbers of 1s and 0s are the same. Of course, in practice, noise (e.g., resolution from the DAC) ensures that repeated readings under the same applied threshold will produce some variability in the number of 1s and 0s obtained. Embodiments of active measurement can be implemented in hardware or software using a processor and memory 1131, or some embodiments can use both. For each desired threshold control (one threshold control for the number of 1s, one threshold control for the number of 0s), an iterative search is performed. Each step in the iterative search uses passive measurement to count the number of 1s (or 0s) resulting from a particular selection of the threshold control. Different embodiments implement the search in different ways. One embodiment uses a linear search that compares the preselected number with the number of bits in the preselected state in the measurement results (obtained for each threshold setting within the preselected range). Another embodiment uses a binary search within the preselected range. Binary searches can be easily and simply implemented in hardware or software. Other search methods, such as Newton's method, can also be used.

[0056] Figure 12The typical relationship between threshold settings and passive measurement results SR is shown. Thr+ corresponds to a positive threshold setting that results in the desired preselection number of 1. Thr+ is between the minimum threshold (ThrMn) (corresponding to DAC being set to 0) and the maximum threshold (ThrMax) (corresponding to DAC being set to 2). k-1 The range between ) and ), where K is the number of bits in the resolution of the DAC. The DAC can correspond to Figure 3 The DAC 301 shown.

[0057] Figure 13 A flowchart is shown to illustrate the active measurement process for finding Thr+ using binary search. This process can be stored in memory and processed by processor 1131 (see...). Figure 11 The software implementation runs on the control module, or it can be implemented in hardware. In 1301, the control software (or hardware) sets the loop counter to zero and sets a step value for the threshold increment. In 1303, the control hardware or software sets the current threshold to the average of ThrMn and ThrMx. The active measurement loop begins in 1305, which obtains the measurement result SR by performing a passive measurement using the current threshold. Passive measurements preferably use methods such as... Figure 11 The hardware shown is similar to the one used to implement passive measurements. A loop counter is incremented in 1307 and checked in 1309 to see if the loop counter has reached its maximum loop count. If the loop count has reached its maximum, the active measurement is complete. Otherwise, in 1311, the current threshold is adjusted in steps in the direction determined by the sign of (SR-P), where P is a predetermined number of desired 1s. In other words, if the measurement result SR (the number of bits in the preselected state) is greater than the desired number of preselected bits P, the positive threshold V is increased. thr+ If the preselected number is greater than the measurement result, the positive threshold is reduced. If SR = P, the sign of 0 is defined as 1, -1, or 0, depending on the specific implementation. The step size is halved in 1315, and the process returns to 1305 to perform the passive measurement using the updated threshold. Once the active measurement is complete, the microcontroller evaluates the passive measurement result SR to determine the positive threshold that provides the expected number P of 1s. It should be noted that the selected positive threshold typically provides the number of 1s closest to P, rather than an exact match to P.

[0058] Figure 14 An alternative search technique approximating Newton's method is described. In Newton's method, iterative measurements are performed by updating the equation: Among them, such as combination Figure 14 The use of Thr, SR, and P is described above. Figure 14The term 's' in this context refers to the assumed average derivative (slope) of SR as a function of Thr in the region of interest. It should be noted that the classic Newton's method uses the actual derivative, not the assumed average. Using a fixed value makes the division function a simple fixed multiplication scaling operation. Assuming the error of 's' does not exceed -25% to +25%, each step reduces the error by a factor of 4, and only a few steps are required.

[0059] Due to noise during measurement, PUF bit cells with values ​​close to the current Thr value will produce non-deterministic results. The total count SR will have some distribution around its mean. To reduce errors caused by noise, the measurement results can be averaged or the results can be accumulated from multiple reads of each PUF cell. The average can be approximated by adding steps using increasingly smaller adjustments: {0.5x, 0.5x, 0.25x, 0.25x, 0.25x, 0.125x…}.

[0060] Passive measurements are repeated to determine Thr-values ​​to complete the determination of the threshold control pair (which results in a preselected number of 1s and a preselected number of 0s). In one embodiment, after obtaining a positive threshold that provides SR = P (or approximately equal to P), the SR result is used to determine the number of P for the negative threshold. The determined pair of threshold control values ​​is stored, for example, in auxiliary data and used during reconstruction. In one embodiment, the average of the positive and negative thresholds (or a rounded form of the average suitable for DAC) is used as the threshold during reconstruction.

[0061] After active measurement is completed, a threshold is used during the registration process. The registration process uses a pair of thresholds determined during active measurement. During registration, the positions of a sufficient number of strong bits (1s and 0s) are stored in a mask in the auxiliary data so that the same strong bit positions can be used during reconstruction. For example, the auxiliary data can store approximately 3000 strong bit positions in a PUF array, divided between strong 1s and strong 0s. The number of PUF bits stored depends on the required level of encoding. PUF bit units are logically combined with secret data (e.g., a 256-bit root key provided by a real random number generator (or another source with sufficient entropy)) to reliably reproduce the root key during the reconstruction phase. Therefore, the auxiliary data includes a PUF mask identifying the positions of the strong bits needed for reconstruction, and a threshold V. thr+ and V thrThe average value of the root key (or the threshold itself), and an encoding sufficient to reliably reconstruct the root key. For example, the encoding could include a repeating code in which many PUF bits, such as 7 bits, are XORed with a portion of the secret data (the root key). The result of this operation is stored in auxiliary data. During reconstruction, the same PUF bits are XORed with the 7 bits of the stored information to recover one bit of the secret data. Ideally, the 7 bits produced by the XOR during reconstruction should be consistent in whether the secret bit is 1 or 0, but if there is disagreement, a voting mechanism can be used to select the majority of 4, 5, or 6 matching results. Additional encoding, such as different Hamming codes, can be used and stored in the auxiliary data to further reduce the error rate to an acceptable level for reconstructing the root key. The level of encoding in the auxiliary data may depend on the strength of the strong 1s and 0s. The stronger the 1s and 0s, the lower the error rate, and the less encoding may be needed to reliably generate the root key.

[0062] Therefore, various aspects relating to the measurement operations of PUF bit cells have been described. The description of the invention set forth herein is illustrative and is not intended to limit the scope of the invention as set forth in the appended claims. Other variations and modifications may be made to the embodiments disclosed herein based on the description set forth herein without departing from the scope of the invention as set forth in the appended claims.

Claims

1. An apparatus comprising: a plurality of physically unclonable function (PUF) bit cells; an active measurement control function configured to provide a plurality of positive threshold control values and a plurality of negative threshold control values for use in a passive measurement of the PUF bit cells, and to receive passive measurement results indicative of a number of strong ones associated with each of the positive threshold control values and a number of strong zeros associated with each of the negative threshold control values, and to determine from the passive measurement results a threshold control pair having a positive threshold control value and a negative threshold control value that results in a first desired number of the PUF bit cells being strong ones and a second desired number of the PUF bit cells being strong zeros.

2. The apparatus of claim 1, further comprising a non-transitory computer- readable medium storing software instructions to cause a processor to: provide the plurality of positive threshold control values and the plurality of negative threshold control values for use in the passive measurement; and determine the threshold control pair from the passive measurement results.

3. The apparatus of claim 2, wherein, the software instructions further causing the processor to: for each passive measurement operation having a positive threshold, compare a number of PUF bit cells that are strong ones to a first preselected number; and based at least in part on a difference between the number of PUF bit cells that are strong ones and the first preselected number, adjust the positive threshold to a new positive threshold.

4. The apparatus of claim 1, wherein, the positive threshold control values and the negative threshold control values have different magnitudes.

5. The apparatus of claim 1, wherein, the first desired number and the second desired number are equal or substantially equal.

6. The apparatus of any one of claims 1 to 5, further comprising: passive measurement circuitry to perform the passive measurement, the passive measurement circuitry comprising: digitally controlled offset circuitry to apply each of the positive threshold control values to the PUF bit cells; a read controller coupled to perform a respective read operation to read the PUF bit cells after each of the positive threshold control values is applied; and counter circuitry to count a total number of PUF bit cells having a first preselected state during each of the read operations, and to provide a respective passive measurement result indicative of the total number.

7. The apparatus of claim 6, wherein, the counter circuitry further comprising: first summing circuitry coupled to the plurality of PUF bit cells to count a number of bits in a plurality of words of the PUF bit cells having the first preselected state; and integrating circuitry coupled to the first summing circuitry to integrate the number of bits in each word with the first preselected state, thereby providing the total number of PUF bit cells in the plurality of PUF bit cells having the first preselected state during the read operation.

8. The apparatus of claim 7, further comprising: a plurality of logic gates to logically combine the total number with a completion signal, and to provide a passive measurement result indicative thereof; and wherein the read controller generates the completion signal when all of the PUF bit cells have been read.

9. A method for measuring a physically unclonable function (PUF) having a plurality of PUF bit cells, comprising: a plurality of threshold control values are provided for use in a read operation of the PUF; passive measurements of the read operation are received; and from the passive measurements, a threshold control pair having a positive threshold control value and a negative threshold control value among the plurality of threshold control values is determined, the threshold control pair resulting in a first desired number of the PUF bit cells being strong 1 and a second desired number of the PUF bit cells being strong 0.

10. The method of claim 9, wherein, the measurements further comprise: performing a passive measurement operation using a first threshold control value among the plurality of threshold control values in a first read operation to determine how many of the PUF bit cells have a first preselected value and providing a passive measurement result containing a first number, the first number indicating how many of the PUF bit cells have the first preselected value.

11. The method of claim 10, wherein, the first read operation reads all addresses of an array formed by the PUF bit cells.

12. The method of claim 10 or 11, wherein, the measurements further comprise: performing a passive measurement operation using a second threshold control value among the plurality of threshold control values in a second read operation to determine how many of the PUF bit cells have a second preselected value and providing another passive measurement result containing a second number, the second number indicating how many of the PUF bit cells have the second preselected value.

13. The method of claim 12, wherein, the first preselected value is 1 and the second preselected value is 0.

14. The method of claim 10 or 11, wherein, the passive measurement operation further comprises: counting the number of bits in each word of the read PUF bit cells having the first preselected value, thereby generating a first preselected state bit count for each word; and summing the first preselected state bit counts for each word to produce a total number of PUF bit cells having the first preselected value read during the first read operation.

15. The method of claim 14, comprising: producing a completion signal indicating an end of each of the first read operations; and logically combining the total number with the completion signal and providing the passive measurement result.

16. The method of claim 10 or 11, further comprising: comparing the first number of PUF bit cells to a first preselected number; adjusting the first threshold control value to a new threshold control value based at least in part on a difference between the first number of PUF bit cells having a first preselected state and the first preselected number; using the new threshold control value, reading the PUF bit cells in an additional read operation; during the additional read operation, counting a new number of PUF bit cells having the first preselected state; comparing the new number to the first preselected number; and adjusting the new threshold control value to a second new threshold control value based at least in part on a difference between the new number of PUF bit cells having the first preselected state and the first preselected number.

17. The method of any of claims 9 to 11, further comprising: using a binary search, a linear search or using an approximate Newton method to search for the threshold control pair.

18. The method of any of claims 9 to 11, further comprising: storing a number based on an average of the positive threshold control value and the negative threshold control value for use after measurement.

19. An apparatus comprising: a plurality of physically unclonable function (PUF) bit cells; means for measuring the plurality of PUF bit cells to determine a first offset to use during a first read operation of the plurality of PUF bit cells, the first offset resulting in a first desired number of PUF bit cells that are strong 1 when read; and wherein the means for measuring is configured to further determine a second offset to use during a second read operation of the plurality of PUF bit cells, the second offset resulting in a second desired number of PUF bit cells that are strong 0 when read.

20. The apparatus of claim 19, wherein, the first desired number and the second desired number are equal or substantially equal.

Images