System with physical non-replicable function

Abstract

The invention discloses a system with a physical non-replicable function. The system comprises a key generator array module, a confusion interconnection delay module and a response output module, the key generator array module is used for receiving the excitation signal and encrypting the excitation signal to generate a confusion excitation signal; the confusion interconnection delay module comprises a plurality of confusion interconnection delay arrays, and each delay array comprises a first buffer and a first multiplexer; the confusion interconnection delay module is used for receiving the trigger signal and the confusion excitation signal, determining a delay path according to the confusion excitation signal, and generating a delay output path through the delay path based on the trigger signal; and the response output module is used for generating an output response by comparing the delay differences of the signals in the delay output path. According to the embodiment of the invention, the uniqueness of the PUF is improved, the machine learning resistance of the PUF is improved, and the consumption of hardware resources is reduced. The circuit can be widely applied to the technical field of integrated circuits and control.

Description

Technical Field

[0001] The present invention relates to the field of integrated circuits and control technology, and in particular to a system with a physically non-copyable function. Background Art

[0002] With the development of the Internet of Things (IoTs), the usage rate of smart devices such as mobile phones and computers has continued to increase, and identity authentication and information security have become an important part of the "Internet of Everything". Compared with the traditional method of storing encryption keys in on-chip non-volatile memory (NVM), which is vulnerable to reverse engineering and detection attacks, the Physical Unclonable Function (PUF) uses the inherent random deviations in the integrated circuit manufacturing process as an entropy source to generate random, unique and unpredictable responses to effectively build a root of trust. In addition, PUF also has the advantages of low resource consumption, low power consumption, and system on chip (SoC) integration. The classic arbiter physical unclonable function (APUF) uses the delay difference on two symmetric paths to generate a response. Although it has the advantages of low hardware resource consumption, low power consumption and high speed, it is easily attacked by machine learning due to its linear mathematical model.

[0003] In related technologies, since weak PUF is not susceptible to machine learning attacks, the solution of adding weak PUF to strong PUF to form a hybrid PUF has become the mainstream for strong PUF to enhance its anti-machine learning capabilities. However, this method has extremely high requirements on the bit error rate of weak PUF, and since the number of CRPs of strong PUF grows exponentially with the number of stimuli, while weak PUF only grows linearly or polynomially, the above method requires a large number of weak PUFs and nonlinear calculations for serially connecting weak PUF units, resulting in a large amount of hardware resource consumption. Summary of the invention

[0004] The purpose of the present invention is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0005] Therefore, the object of the present invention is to provide a system that is resistant to attacks and has a physically non-copyable function.

[0006] In order to achieve the above technical objectives, the technical solutions adopted by the embodiments of the present invention include the following aspects:

[0007] On the one hand, an embodiment of the present invention provides a system with a physical non-copyable function, including: a key generator array module, a confusion interconnection delay module and a response output module; the key generator array module is used to receive an excitation signal, and encrypt the excitation signal to generate a confusion excitation signal; the confusion interconnection delay module includes a plurality of confusion interconnection delay arrays, each of which includes a first buffer and a first multiplexer; the confusion interconnection delay module is used to receive a trigger signal and the confusion excitation signal, determine a delay path according to the confusion excitation signal, and generate a delay output path through the delay path based on the trigger signal; the response output module is used to generate an output response by comparing the delay difference of the signal in the delay output path. The embodiment of the present application effectively alleviates the inherent deviation of the PUF based on the arbitrator and improves the uniqueness of the PUF through the confusion interconnection mode of the confusion interconnection delay module; improves the ability of the PUF to resist machine learning through the key generator array module and the confusion interconnection delay module; and is conducive to reducing the consumption of hardware resources through a simple composition.

[0008] In addition, the system with the physical non-copyable function according to the above embodiment of the present invention may also have the following additional technical features:

[0009] Furthermore, in the system with the physical non-copyable function of the embodiment of the present invention, the first multiplexer is a two-to-one multiplexer, the target delay array includes a plurality of target buffers and a plurality of target two-to-one multiplexers; the plurality of target buffers are connected one-to-one with the plurality of target two-to-one multiplexers through a first branch, and the plurality of target buffers are connected one-to-one with the plurality of target two-to-one multiplexers through a second branch; each of the target buffers is connected to two of the target two-to-one multiplexers through the first branch and the second branch respectively;

[0010] If the first target buffer is connected to the third target two-choice multiplexer through the first branch, the fourth target buffer is connected to the second target two-choice multiplexer through the first branch; if the first target buffer is connected to the second target two-choice multiplexer through the second branch, the fourth target buffer is connected to the third target two-choice multiplexer through the second branch;

[0011] The confusion interconnection delay module is used to determine, according to the confusion excitation signal, that the target buffer is connected to the target two-to-one multiplexer through a first branch, or that the target buffer is connected to the target two-to-one multiplexer through a second branch.

[0012] Further, in one embodiment of the present invention, the key generator array module includes a plurality of key generator array units, each of which includes a key selector and an XOR logic device;

[0013] The key selector includes a decoder, a plurality of switches, a plurality of weak PUFs, and a second multiplexer; the decoder is used to generate a switch control signal according to the excitation signal, and the switch is used to select the first weak PUF to be enabled according to the switch control signal; the first weak PUF is used to generate a unit response, and the second multiplexer is used to generate a first signal according to the unit response based on the excitation signal;

[0014] The XOR logic device is used to receive the first signal, and generate a confused excitation signal based on the excitation signal and the first signal.

[0015] Furthermore, in one embodiment of the present invention, the second multiplexer is a four-to-one multiplexer, the decoder is used to generate a switch control signal according to a two-bit excitation signal, and the two-bit excitation signal is selected sequentially from the excitation signal according to the sorting of the key generator array units; the XOR logic device is used to generate a confusion excitation signal based on the four-bit excitation signal and the first signal; the four-bit excitation signal is selected sequentially from the excitation signal at intervals according to the sorting of the key generator array units.

[0016] Further, in one embodiment of the present invention, the response output module includes two rising edge arbiters, two falling edge arbiters and an XOR tree;

[0017] The rising edge arbiter is used to determine the rising edge delay difference between the symmetrical paths in the delayed output path, and the falling edge arbiter is used to determine the falling edge delay difference between the symmetrical paths in the delayed output path; the XOR tree is used to generate an output response based on the rising edge delay difference and the falling edge delay difference.

[0018] Further, in one embodiment of the present invention, the system further comprises: a rising edge metastable detector and a falling edge metastable detector;

[0019] The rising edge metastable detector and the falling edge metastable detector are used to detect the stability of the output response.

[0020] Further, in one embodiment of the present invention, the rising edge metastable detector includes a second buffer, a first trigger, a second trigger and an OR gate;

[0021] The first trigger and the second trigger both use the trigger signal as an enable signal, the negative signal of the trigger signal as a reset signal, the power supply voltage as a data input, and the output response and the negative signal of the output response as a clock; the second buffer is used to set a detection threshold, and the OR gate is used to receive the output states of the first trigger and the second trigger, and generate a metastable flag signal based on the output states.

[0022] Furthermore, in one embodiment of the present invention, the system is used to determine the stability of the CRP through multiple consecutive metastable flag signals of the rising edge metastable detector and the falling edge metastable detector.

[0023] Further, in one embodiment of the present invention, the confusion excitation signal is sequentially used as a control signal of the two-to-one multiplexer;

[0024] If the target delay array is the first delay array among all delay arrays, the input signal of the target buffer is the trigger signal;

[0025] If the target delay array is the last delay array among all the delay arrays, the outputs of all the target two-to-one multiplexers are delay output paths.

[0026] Further, in one embodiment of the present invention, the XOR logic device includes a first XOR gate, a second XOR gate, a third XOR gate and a fourth XOR gate;

[0027] The input signals of the first XOR gate and the second XOR gate are four-bit excitation signals, the input of the third XOR gate is the output signals of the first XOR gate and the second XOR gate, and the input signal of the fourth XOR gate is the output signal of the third XOR gate and the first signal.

[0028] The system provided by the embodiment of the present invention includes: a key generator array module, a confusion interconnection delay module and a response output module; the key generator array module is used to receive an excitation signal, and encrypt the excitation signal to generate a confusion excitation signal; the confusion interconnection delay module includes a plurality of confusion interconnection delay arrays, each of which includes a first buffer and a first multiplexer; the confusion interconnection delay module is used to receive a trigger signal and the confusion excitation signal, determine a delay path according to the confusion excitation signal, and generate a delay output path through the delay path based on the trigger signal; the response output module is used to generate an output response by comparing the delay difference of the signal in the delay output path. The embodiment of the present application effectively alleviates the inherent deviation of the arbitrator-based PUF and improves the uniqueness of the PUF through the confusion interconnection mode of the confusion interconnection delay module; improves the ability of the PUF to resist machine learning through the key generator array module and the confusion interconnection delay module; and is conducive to reducing the consumption of hardware resources through a simple composition. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the embodiments of the present invention or the drawings of related technical solutions in the prior art are introduced below. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solutions of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 A schematic diagram of the structure of an embodiment of a system with a physically non-copyable function provided by the present invention;

[0031] Figure 2 A schematic diagram of the structure of an embodiment of a key generator array module provided by the present invention;

[0032] Figure 3 A schematic diagram of the structure of an embodiment of the obfuscated interconnection delay module provided by the present invention;

[0033] Figure 4 A schematic diagram of the structure of an embodiment of a response output module provided by the present invention;

[0034] Figure 5 A schematic diagram of the distribution of a delay difference between symmetrical paths provided by the present invention according to an embodiment;

[0035] FIG6( a ) is a schematic structural diagram of an embodiment of a rising edge metastable detector provided by the present invention;

[0036] FIG6( b ) is a schematic structural diagram of an embodiment of a falling edge metastable detector provided by the present invention;

[0037] Figure 7 A schematic diagram of the working principle of an embodiment of a falling edge metastable detector provided by the present invention;

[0038] Figure 8 A signal response schematic diagram of an embodiment of an unstable response provided by the present invention;

[0039] Fig. 9 A schematic diagram of a flow chart of an embodiment of a jitter detection algorithm provided by the present invention;

[0040] FIG10( a ) is a schematic diagram showing a comparison of system reliability before and after calibration provided by the present invention;

[0041] Figure 10(b) is a schematic diagram of the confidence corresponding to Figure 10(a);

[0042] FIG11( a ) is a schematic diagram of a safety test structure combining a system and a mathematical model provided by the present invention;

[0043] FIG11( b ) is a schematic diagram showing the comparison of the test results corresponding to FIG11( a );

[0044] FIG11( c ) is a schematic diagram of a security test structure combining a system and deep learning provided by the present invention;

[0045] FIG11( d ) is a schematic diagram showing the comparison of the test results corresponding to FIG11( c );

[0046] FIG12( a ) is a schematic diagram showing a comparison of the bit error rate of the system after the reliability circuit is calibrated according to the present invention and the temperature;

[0047] FIG. 12( b ) is a schematic diagram showing a comparison of the bit error rate of the system after the reliability circuit is calibrated according to the present invention and the variation of the power supply voltage. DETAILED DESCRIPTION

[0048] The embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and are not to be construed as limitations of the present invention. For the step numbers in the following embodiments, they are only provided for the convenience of explanation, and the order between the steps is not limited in any way, and the execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0049] With the development of the Internet of Things (IoTs), the usage rate of smart devices such as mobile phones and computers has continued to increase, and identity authentication and information security have become an important part of the "Internet of Everything". Compared with the traditional method of storing encryption keys in on-chip non-volatile memory (NVM), which is vulnerable to reverse engineering and detection attacks, the Physical Unclonable Function (PUF) uses the inherent random deviations in the integrated circuit manufacturing process as an entropy source to generate random, unique and unpredictable responses to effectively build a root of trust. PUF also has the advantages of low resource consumption, low power consumption, and system on chip (SoC) integration.

[0050] PUFs can usually be divided into two categories, weak PUFs and strong PUFs, based on the number of Challenge-Response Pairs (CRPs). From the application scenario point of view, weak PUFs are usually used for key generation due to their high entropy and low bit error rate (BER) properties, while strong PUFs are more suitable for device authentication due to their almost unlimited number of CRPs. Since the number of CRPs of strong PUFs grows exponentially and the key space is almost infinite, the behavior of strong PUFs cannot be completely cloned even if they are accessed for a long time. This important feature is called the unpredictability of PUFs.

[0051] The classic Arbiter Physical Unreplicable Function (APUF) uses the delay difference on two symmetric paths to generate a response. Although it has the advantages of low hardware resource consumption, low power consumption and high speed, it is vulnerable to machine learning attacks due to its linear mathematical model. Although topologies based on delay PUF design such as XOR PUF and feedforward PUF were proposed to enhance anti-machine learning capabilities, these topologies are still easy to crack as the number of trained CRPs increases, and the reliability of PUF decreases significantly as the number of response XOR increases. Generally speaking, the arbiter-based delay PUF has an inherent deviation in the multiplexer array due to the inevitable mismatch between ideal paths, which causes the uniqueness of the PUF (the characteristic that each PUF produces a unique response to a given stimulus (Challenge)) to be compromised.

[0052] However, with the development of machine learning (ML) algorithms, traditional strong PUFs are vulnerable to machine learning attacks. Attackers can build models by training a portion of CRPs exposed to the channel to predict the response to unknown challenges, and clone the behavior of strong PUFs in this way. Existing machine learning algorithms for strong PUFs can be divided into three categories. The first category is attacks based on mathematical models, which use the collected CRPs to calculate the weights in the mathematical model, and then use the model to predict unknown CRPs. The second category is based on packaged machine learning algorithms (such as deep neural networks (DNN)), which map challenges and responses based on the collected CRPs. The third category is based on side channel attacks (SCA) and evolution strategies (ES) algorithms, which simplify the model based on the reliability and power consumption of PUF to obtain higher prediction accuracy.

[0053] Nowadays, due to the characteristics of weak PUF being immune to machine learning attacks, the method of adding weak PUF to strong PUF to form a hybrid PUF has become the mainstream method for strong PUF to enhance its anti-machine learning ability. However, this method has extremely high requirements on the bit error rate of weak PUF, and because the number of CRPs of strong PUF grows exponentially with the number of stimuli, while weak PUF only grows linearly or polynomially, the above method requires a large number of weak PUFs and nonlinear calculations for connecting weak PUF units in series, resulting in a large amount of hardware resource consumption.

[0054] In addition, reliability is another important characteristic of PUF, which refers to the ability of PUF to generate consistent and repeatable responses under environmental changes (such as noise, voltage fluctuations, and temperature changes). Temporal Majority Voting / Special Majority Voting (TMV / SMV) and Error Correction Code (ECC) based on time / space frequency are common methods to improve system stability. However, the instability of PUF mainly comes from temperature changes and voltage fluctuations, and TMV / SMV can only eliminate the impact of noise on stability. The introduction of ECC will increase additional hardware resources, power consumption, delay, and design complexity, and the overhead of ECC has a superlinear relationship with the bit error rate.

[0055] Based on this, the present invention proposes a physical non-cloning function, which combines the advantages of hybrid PUF and arbiter-based PUF, and effectively improves the anti-machine learning ability, uniqueness and reliability of PUF while meeting the requirements of low power consumption and low hardware resource consumption. In the embodiment of the present application, a strong PUF is formed by forming a hybrid PUF through several weak PUFs; so that the present application can take into account the advantages of strong PUF.

[0056] The following describes in detail a system and implementation method with a physical non-copyable function according to an embodiment of the present invention with reference to the accompanying drawings. First, a system with a physical non-copyable function according to an embodiment of the present invention is described with reference to the accompanying drawings.

[0057] Figure 1 It is a schematic diagram of the system structure with a physical non-copyable function according to an embodiment of the present invention, wherein the system comprises: a key generator array module, a confusion interconnection delay module and a response output module; the key generator array module is used to receive an excitation signal, and encrypt the excitation signal to generate a confusion excitation signal; the confusion interconnection delay module comprises a plurality of confusion interconnection delay arrays, each of which comprises a first buffer and a first multiplexer; the confusion interconnection delay module is used to receive a trigger signal and the confusion excitation signal, determine a delay path according to the confusion excitation signal, and generate a delay output path through the delay path based on the trigger signal; the response output module is used to generate an output response by comparing the delay difference of the signal in the delay output path.

[0058] Reference Figure 1 As shown, the key generator array module in the embodiment of the present application is Figure 1 The key generator array in Figure 1 The symmetric confusion interconnection delay module in the embodiment of the present application is the confusion interconnection delay module, Figure 1 The response output and reliability self-check module in is the response output module in the embodiment of the present application. Figure 1 The dotted box represents the key generator array unit of the present application. The specific composition of the key generator array module in the embodiment of the present application can be as follows: Figure 2 As shown, the specific composition of the confusion interconnection delay module can be as follows Figure 3 As shown, the specific composition of the response output module can be as follows Figure 4 shown. Figure 3 The dotted box in the middle represents a delay array unit, wherein the first buffer is located in the left part of the dotted box, and the first multiplexer is located in the right part of the dotted box.

[0059] Understandably, Figure 1 The system block diagram showing the proposed physical uncopyable functionality consists of the following parts:

[0060] First, the incentive obfuscation strategy based on the key generator array;

[0061] Based on a key generator array, including a key selector based on N weak PUFs and XOR logic to generate a confusing excitation signal CO i , to achieve external input stimulus C i is encrypted and used as the control signal of the delay module.

[0062] Second, a symmetric obfuscation interconnection module that effectively mitigates the inherent bias of the arbitrator PUF;

[0063] The symmetric aliasing interconnect module is used as an entropy source, including a multiplexer (MUX) array of N symmetric aliasing interconnects and a delay array composed of buffers. The delay path is selected by the aliasing excitation signal, and the delayed output paths P0, P1, ..., P are generated by the trigger signal. n-1 .

[0064] Third, response output and reliability self-check module;

[0065] The response output and reliability self-check module consists of a metastable detection arbitrator and a jitter detection algorithm to generate and select a stable CRP. n-1 , P1 and P n-2 ) signal delay difference to generate the response R out At the same time, the flag signal R of whether CRP is stable is obtained through the metastable detection arbiter and the detection jitter algorithm F .

[0066] The physical non-copyability function proposed in the present invention realizes low resource consumption, low bit error rate and resistance to machine learning attacks. The symmetric obfuscation interconnection module proposed in the present invention can effectively alleviate the inherent deviation of the arbitrator-based PUF and improve the uniqueness and randomness of the PUF. The test results are shown in Figures 10(a) and 10(b). This method can also be applied to all arbitrator-based PUFs. The incentive obfuscation based on the key generator array proposed in the present invention can effectively improve the PUF's ability to resist machine learning, including a deep neural network with a training set of 20 million and an evolutionary strategy algorithm with a training set of 3 million based on channel measurement and reverse engineering. The test results are shown in Figure 11.

[0067] The response output and reliability self-check module proposed in the present invention makes full use of the entropy source of the delay module, detects the response in the metastable state with the least hardware resources, and selects the response insensitive to jitter as the stable output. This method effectively improves the reliability of PUF. The test results are shown in Figures 12(a) and 12(b). Therefore, this method can also be applied to all arbitrator-based PUFs.

[0068] Optionally, in the system with a physically non-copyable function in an embodiment of the present invention, the first multiplexer is a two-to-one multiplexer, the target delay array includes a plurality of target buffers and a plurality of target two-to-one multiplexers; the plurality of target buffers are connected one-to-one with the plurality of target two-to-one multiplexers through a first branch, and the plurality of target buffers are connected one-to-one with the plurality of target two-to-one multiplexers through a second branch; each of the target buffers is connected to two of the target two-to-one multiplexers through the first branch and the second branch respectively and differently;

[0069] The connection method of the target buffer and the target two-choice multiplexer includes: if the first target buffer is connected to the third target two-choice multiplexer through the first branch, the fourth target buffer is connected to the second target two-choice multiplexer through the first branch; if the first target buffer is connected to the second target two-choice multiplexer through the second branch, the fourth target buffer is connected to the third target two-choice multiplexer through the second branch;

[0070] The confusion interconnection delay module is used to determine, according to the confusion excitation signal, that the target buffer is connected to the target two-to-one multiplexer through a first branch, or that the target buffer is connected to the target two-to-one multiplexer through a second branch.

[0071] In some possible implementations, the target delay array may be any delay array in the delay arrays. Figure 3 As shown, in one embodiment, the target delay array includes 4 target buffers and 4 target two-to-one multiplexers. There are two types of connection relationships between the target buffer and the two-to-one multiplexer in each target delay array, referring to Figure 3 In the dashed box, the implementation connection and the dashed connection represent two connection relationships, which are distinguished by the first branch connection and the second branch connection in the embodiment of the present application. Both connection relationships are one-to-one connections, and the same target buffer is connected to different two-choice multiplexers in the two connection relationships.

[0072] It should be noted that, refer to Figure 5As shown, in an embodiment of the present application, under the same connection mode, the target buffer and the target two-choice multiplexer are symmetrically connected. Specifically, if the first target buffer is connected to the third target two-choice multiplexer through the first branch, it can be determined that the fourth target buffer is connected to the second target two-choice multiplexer through the first branch. If the first target buffer is connected to the second target two-choice multiplexer through the second branch, the fourth target buffer is connected to the third target two-choice multiplexer through the second branch. Similarly, if the second target buffer is connected to the third target two-choice multiplexer through the first branch, it can be determined that the third target buffer is connected to the second target two-choice multiplexer through the first branch. If the second target buffer is connected to the second target two-choice multiplexer through the second branch, the third target buffer is connected to the third target two-choice multiplexer through the second branch. Of course, the branches in the above connection relationship are illustrative examples, and the specific branches used can be adjusted. It should be noted that in the embodiment of the present application, the first target buffer is the buffer ranked first in the target buffers arranged in sequence, and the second target buffer is the buffer ranked second. By way of example, referring to Figure 3 As shown, the first target buffer is the buffer labeled 0, and the second target buffer is the buffer labeled 1. Similarly, the first and second in the first two-to-one multiplexer and the second two-to-one multiplexer also represent the sorting positions of the two-to-one multiplexers.

[0073] Optionally, in the system with the physical non-copyable function in the embodiment of the present invention, the key generator array module includes a plurality of key generator array units, each of which includes a key selector and an XOR logic device;

[0074] The key selector includes a decoder, a plurality of switches, a plurality of weak PUFs, and a second multiplexer; the decoder is used to generate a switch control signal according to the excitation signal, and the switch is used to select the first weak PUF to be enabled according to the switch control signal; the first weak PUF is used to generate a unit response, and the second multiplexer is used to generate a first signal according to the unit response based on the excitation signal;

[0075] The XOR logic device is used to receive the first signal, and generate a confused excitation signal based on the excitation signal and the first signal.

[0076] In some possible implementations, the number of key generator array units is the same as the number of delay arrays. Figure 2 As shown, the key selector includes a decoder, 4 switches, 4 weak PUFs, and a second multiplexer. Figure 2 EN0-EN3 in the present application are the switch control signals, W0-W3 are the unit responses in the present application, and Kn-1 That is the first signal in this application.

[0077] Optionally, in the system with physical non-copyability in the embodiment of the present invention, the second multiplexer is a four-to-one multiplexer, the decoder is used to generate a switch control signal according to a two-bit excitation signal, and the two-bit excitation signal is selected sequentially from the excitation signal according to the sorting of the key generator array units; the XOR logic device is used to generate a confusion excitation signal based on the four-bit excitation signal and the first signal; the four-bit excitation signal is selected sequentially from the excitation signal at intervals according to the sorting of the key generator array units.

[0078] In some possible implementations, two-bit excitation signals can determine two-bit excitation signals for the key selector in sequence according to the correspondence between the excitation signals and the key generator array units. Four-bit excitation signals can select four-bit excitation signals for the XOR logic device in sequence in segments according to the correspondence between the excitation signals and the key generator array units. Exemplarily, the first bit excitation signal of the first XOR logic device can be the first-ranked excitation signal, and the first bit excitation signal of the subsequent XOR logic devices is selected in sequence; similarly, the second bit excitation signal of the first XOR logic device can be the 23rd-ranked excitation signal, and the second bit excitation signal of the subsequent XOR logic devices is selected in sequence. According to the logic, the excitation signal of the first XOR logic device is selected in sequence; and then the second, third, and so on are determined. Of course, the determination of the positional relationship can be set according to actual needs, and this application does not make specific limitations.

[0079] Optionally, in the system with a physically non-copyable function in an embodiment of the present invention, the response output module includes two rising edge arbitrators, two falling edge arbitrators and an XOR tree;

[0080] The rising edge arbiter is used to determine the rising edge delay difference between the symmetrical paths in the delayed output path, and the falling edge arbiter is used to determine the falling edge delay difference between the symmetrical paths in the delayed output path; the XOR tree is used to generate an output response based on the rising edge delay difference and the falling edge delay difference.

[0081] Optionally, the system with a physical non-copyable function in an embodiment of the present invention further comprises: a rising edge metastable detector and a falling edge metastable detector;

[0082] The rising edge metastable detector and the falling edge metastable detector are used to detect the stability of the output response.

[0083] Optionally, in the system with a physically non-copyable function in an embodiment of the present invention, the rising edge metastable detector includes a second buffer, a first trigger, a second trigger and an OR gate;

[0084] The first trigger and the second trigger both use the trigger signal as an enable signal, the negative signal of the trigger signal as a reset signal, the power supply voltage as a data input, and the output response and the negative signal of the output response as a clock; the second buffer is used to set a detection threshold, and the OR gate is used to receive the output states of the first trigger and the second trigger, and generate a metastable flag signal based on the output states.

[0085] Optionally, the system with the physical non-copyable function in the embodiment of the present invention is used to determine the stability of CRP through multiple consecutive metastable flag signals of the rising edge metastable detector and the falling edge metastable detector.

[0086] Optionally, in the system with the physical non-copyable function in the embodiment of the present invention, the confusion excitation signal is used as the control signal of the two-to-one multiplexer in sequence;

[0087] If the target delay array is the first delay array among all delay arrays, the input signal of the target buffer is the trigger signal;

[0088] If the target delay array is the last delay array among all the delay arrays, the outputs of all the target two-to-one multiplexers are delay output paths.

[0089] Optionally, in the system with a physically non-copyable function in an embodiment of the present invention, the XOR logic device includes a first XOR gate, a second XOR gate, a third XOR gate and a fourth XOR gate;

[0090] The input signals of the first XOR gate and the second XOR gate are four-bit excitation signals, the input of the third XOR gate is the output signals of the first XOR gate and the second XOR gate, and the input signal of the fourth XOR gate is the output signal of the third XOR gate and the first signal.

[0091] The present invention proposes a physical non-copyable function with low resource consumption, resistance to machine learning attacks and low bit error rate, including: a symmetric obfuscation interconnection module that effectively alleviates the inherent deviation of PUF based on an arbiter, in which a buffer is used to realize entropy source conversion, and a multiplexer obfuscation interconnection is used to realize path selection; an incentive obfuscation strategy based on a key generator, which involves a key selector and XOR logic; a response output and reliability self-check module, which involves metastable state detection of the arbiter and jitter detection of the output signal.

[0092] The system provided by the present application is described in detail with a specific embodiment below. The specific embodiment production process of the present application is described as follows:

[0093] Figure 1 The system block diagram of the physical non-copyable function is shown, including the key generation array, the symmetric obfuscation interconnection delay module, and the response output and reliability self-check module. In order to achieve high machine learning resistance with minimal hardware resources and reduce the deviation problem caused by the delay module, the number of excitation signals in this example is 128 bits, the obfuscated excitation signal is 64 bits (i.e., i is 64), the number of delay output paths n is 4, and the external signal source is an FPGA board, model Xilinx Black Gold 7002.

[0094] Excitation signal C i Generated by FPGA, the obfuscated stimulus CO is generated by the key generator array i Signal. Figure 2 An embodiment of a key generator array unit is shown, which consists of a key selector and an XOR logic. The key selector consists of four weak PUF units and a power control switch, a 2-4 decoder, and a four-to-one multiplexer. The two-bit excitation signal controls the 2-4 decoder and the four-to-one multiplexer at the same time. The 2-4 decoder outputs EN0, EN1, EN2, and EN3 as power switch control signals for four weak PUFs so that each key generator array unit only enables one weak PUF unit to reduce the power consumption of the PUF. For example, when the two-bit excitation signal is 00, the switch controlled by EN0 is closed, the switches controlled by EN1, EN2, and EN3 are opened, and only the weak PUF0 unit is enabled. The weak PUF0 unit responds to W0 and outputs K through the four-to-one multiplexer. n-1 (i.e. the first signal) is passed to the XOR logic unit. The XOR logic unit consists of four XOR gates, whose input is the output K of the key selector unit. n-1 and four different excitation signals are C n-1 , C n+63 , C n+23 , C (n+87)％128 (n starts from 1), for example, when n=1, the four different excitation signals are C0, C 63 , C 24 , C 88 , the output is a garbled excitation signal CO iPassed to the symmetric obfuscation interconnection delay module. Similarly, if n is 2, 3, 4..., a four-bit excitation signal corresponding to the XOR logic in the key generator array unit sorted later can be obtained. In some embodiments, the two-bit excitation signal can select two bits from the excitation signal in order according to the sorting of the key generator array unit. Of course, those skilled in the art can adjust the acquisition method of the two-bit excitation signal according to needs, and this application does not make specific limitations. It should be noted that the quantitative relationship between the above-mentioned various devices and signals belongs to exemplary examples. In the embodiment of the present application, the number of excitation signals is related to the number of levels, but has nothing to do with the delayed output path. In other embodiments, when the number of excitation signals is 64, the number of obfuscated excitation signals is 32 (that is, the number of key generator array units is 32), the delayed output path is 4, and the arbitrator part remains unchanged. In other embodiments, when the number of excitation signals is 256, the number of obfuscated excitation signals is 128 (that is, the number of key generator array units is 128), the delayed output path is 4, and the arbitrator part remains unchanged.

[0095] Figure 3 The symmetrical shuffle interconnect delay module includes 64 symmetrical shuffle interconnect multiplexer arrays and delay arrays. A delay array consists of four buffers, and the buffer structure is a current-limited buffer to achieve that the buffer delay hardly changes with temperature and voltage. A symmetrical shuffle interconnect multiplexer array consists of four traditional transmission gate type two-to-one multiplexers. Figure 3 Two symmetrical confusing interconnection connection methods are shown in . The connection method can be expressed by a matrix, and the output of the buffer array is named 0, 1, 2, 3 from top to bottom. The output of the buffer array connected to the 0 branch of the two-to-one multiplexer (i.e., the first branch in this application) is 1, 0, 3, 2 from top to bottom, and the output of the buffer array connected to the 1 branch of the two-to-one multiplexer (i.e., the second branch in this application) is 0, 1, 2, 3 from top to bottom. The connection method expressed in a matrix is Symmetrical confusion interconnection must satisfy that there are no repeated elements in the rows and columns and the sum of the two middle items of each row of the matrix is ​​equal to the sum of the two side items. In the above example, the connection relationship between the buffer and the two-choice multiplexer in the embodiment of the present application is described by means of a matrix.

[0096] When the trigger signal comes, the signal will be based on the output CO of the key generator array unit. iThe selected multiplexer array path is transmitted to generate four delayed output paths P0, P1, P2, and P3. According to the simulation results obtained using the 65nm process design kit (PDK) in the Cadence environment, the delay of the two-to-one multiplexer is about 14ps, while the delay of the buffer is about 160ps. Since the single-stage delay is mainly controlled by the buffer, the delay deviation on the ideal path of the multiplexer can be ignored, which greatly alleviates the deviation caused by the mismatch, and ultimately makes the PUF meet 50% uniqueness.

[0097] Figure 4 The response output module is shown to contain two rising edge arbiters (SR latches based on NAND gates), a falling edge arbiter (SR latches based on NOR gates), and a response confusion module consisting of three XOR gates. The rising edge arbiter and the falling edge arbiter are used to calculate the rising edge and falling edge delay differences between the symmetric paths (such as P0 and P3, P1 and P2), and the generated response R rise and R fall The final response R is generated by the response obfuscation module out .

[0098] Figure 5 The distribution of the delay difference between symmetric paths (such as P0 and P3, P1 and P2) follows a normal distribution. The ideal arbitrator has no offset. Even when the delay difference (Δt) approaches zero infinitely, the arbitrator can still produce a stable output, that is, However, in reality, the arbitrator has an absolute value of Δt m Offset, only when the absolute value of Δt is greater than the offset Δt m To produce a stable output, when the absolute value of Δt is less than the offset Δt m A metastable output X will be generated, that is, Metastable output will challenge the reliability of PUF.

[0099] In order to optimize the reliability of PUF, FIG6 shows the metastable detector proposed in the present invention, which is composed of two buffers, two D flip-flops and an OR gate. The rising edge metastable detector (shown in FIG6(a)) uses the trigger signal as the enable signal (EN), the negative signal of the trigger signal as the reset signal (Reset) of the D flip-flop, the power supply voltage as the data input (D), the response and the negative signal of the response as the clocks (CLK) of the two D flip-flops, and the buffer to set the detection threshold Δt wThe falling edge metastable detector (as shown in FIG6( b )) uses the negative signal of the trigger signal as the enable signal, the trigger signal as the reset signal of the D flip-flop, the power supply voltage as the data input, the response and the negative signal of the response as the clocks of the two D flip-flops respectively, and the buffer to set the detection threshold.

[0100] Figure 7 The working principle of the falling edge metastable detector is shown. When the trigger signal (Trigger) is set to 0, the D flip-flop is enabled. When the delay difference Δt between the symmetrical paths is less than the detection threshold Δt w , the response will oscillate. When the D flip-flop detects the falling edge of the oscillating response, the metastable flag signal MF is set to 1, indicating that the response is unstable.

[0101] Only when the delay difference between the symmetrical paths is greater than the detection threshold, the response will not oscillate and the metastable flag signal will remain low, indicating that the response is stable. When the trigger signal is set to 1, the D flip-flop is reset so that the metastable flag signal is also reset to 0.

[0102] However, for delay-based PUF, jitter will also affect the reliability of PUF. Due to the randomness of noise, there will be potential unstable responses such as Figure 8 Therefore, it is not possible to determine whether the response is stable through only one detection. Fig. 9 A jitter detection algorithm is proposed, which determines whether the response is stable by setting repeated experiments. When the algorithm is initialized, the number of repetitions RT is set and the counter Count is reset to zero. When the stimulus is given from the outside, the trigger signal is started and the PUF starts to run. After the operation is completed, it is determined whether Mark_T is 0. Mark_T is the result of two rising edge metastable detection signals and two falling edge metastable signals passing through the OR gate. If Mark_T = 0, the counter is incremented by one, and then it is determined whether the value of the counter is the same as the set number of repetitions. If the two are equal, the stable flag signal RF outputs 1, indicating that the CRP is stable. If they are not equal, the above cycle is repeated. If Mark_T = 1, the stable flag signal RF outputs 0, indicating that the CRP is unstable, and jumps out of the cycle to detect the next CRP. Exemplarily, the test results of Figures 10(a), 12(a) and 12(b) also verify the feasibility of reliability optimization in the present invention.

[0103] In order to comprehensively evaluate the security of PUF, the present invention evaluates the three attack methods mentioned above. Figure 11 (a) describes the combination of the mathematical model of PUF and the evolutionary strategy algorithm, extracting the symmetric obfuscation interconnection method based on reverse engineering, and then obtaining the prediction accuracy based on the custom adaptation function based on the mathematical model and the CRP training set, and optimizing the delay parameters through the evolutionary strategy algorithm repeatedly to finally obtain the optimal solution. Figure 11 (c) is based on a deep neural network, and the obtained CRP is trained and iterated in the encapsulated model. Figures 11 (b) and 11 (d) are the results of the present invention's attacks based on mathematical models and deep learning machine learning, respectively. Under a million training sets, the prediction rate of 50% well proves the non-predictability of PUF. Although the side channel attack can successfully attack the XOR PUF by simplifying the nonlinearity brought by the XOR logic by the divide-and-conquer method, the symmetric obfuscation interconnection method is unknown to the attacker. Even if the attacker obtains the symmetric obfuscation interconnection method in combination with the reverse engineering attack, the attacker cannot predict the response of the weak PUF in the key generator array unit because they are not related to the weight of the response. Therefore, the present invention can well resist the side channel attack.

[0104] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0105] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0106] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several programs to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0107] The logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable programs for implementing the logical functions, and may be embodied in any computer-readable medium for use by a program execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch and execute a program from a program execution system, device or apparatus), or in conjunction with such program execution systems, devices or apparatuses. For purposes of this specification, a "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by a program execution system, device or apparatus, or in conjunction with such program execution systems, devices or apparatuses.

[0108] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0109] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable program execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0110] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0111] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0112] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A system with a physical non-copyable function, characterized in that: The system comprises: a key generator array module, a confusion interconnection delay module and a response output module; The key generator array module is used to receive an excitation signal, and encrypt the excitation signal to generate an obfuscated excitation signal; The confusion interconnection delay module includes a plurality of confusion interconnection delay arrays, each of which includes a first buffer and a first multiplexer; the confusion interconnection delay module is used to receive a trigger signal and the confusion excitation signal, determine a delay path according to the confusion excitation signal, and generate a delay output path through the delay path based on the trigger signal; the response output module is used to generate an output response by comparing the delay difference of the signal in the delay output path.

2. The system with physical non-copyability function according to claim 1, characterized in that: The first multiplexer is a two-to-one multiplexer, the target delay array includes a plurality of target buffers and a plurality of target two-to-one multiplexers; the plurality of target buffers are connected one-to-one with the plurality of target two-to-one multiplexers through a first branch, and the plurality of target buffers are connected one-to-one with the plurality of target two-to-one multiplexers through a second branch; each of the target buffers is connected to two of the target two-to-one multiplexers through the first branch and the second branch respectively; If the first target buffer is connected to the third target two-choice multiplexer through the first branch, the fourth target buffer is connected to the second target two-choice multiplexer through the first branch; if the first target buffer is connected to the second target two-choice multiplexer through the second branch, the fourth target buffer is connected to the third target two-choice multiplexer through the second branch; The confusion interconnection delay module is used to determine, according to the confusion excitation signal, that the target buffer is connected to the target two-to-one multiplexer through a first branch, or that the target buffer is connected to the target two-to-one multiplexer through a second branch.

3. The system with physical non-copyability function according to claim 1, characterized in that: The key generator array module includes a plurality of key generator array units, each of which includes a key selector and an XOR logic device; The key selector includes a decoder, a plurality of switches, a plurality of weak PUFs, and a second multiplexer; the decoder is used to generate a switch control signal according to the excitation signal, and the switch is used to select the first weak PUF to be enabled according to the switch control signal; the first weak PUF is used to generate a unit response, and the second multiplexer is used to generate a first signal according to the unit response based on the excitation signal; The XOR logic device is used to receive the first signal, and generate a confused excitation signal based on the excitation signal and the first signal.

4. The system with physical non-copyability function according to claim 3, characterized in that: The second multiplexer is a four-to-one multiplexer, and the decoder is used to generate a switch control signal according to a two-bit excitation signal, and the two-bit excitation signal is selected sequentially from the excitation signal according to the sorting of the key generator array units; the XOR logic device is used to generate a confusion excitation signal based on a four-bit excitation signal and the first signal; the four-bit excitation signal is selected sequentially from the excitation signal at intervals according to the sorting of the key generator array units.

5. The system with physical non-copyability function according to claim 1, characterized in that: The response output module includes two rising edge arbiters, two falling edge arbiters and an XOR tree; The rising edge arbiter is used to determine the rising edge delay difference between the symmetrical paths in the delayed output path, and the falling edge arbiter is used to determine the falling edge delay difference between the symmetrical paths in the delayed output path; the XOR tree is used to generate an output response based on the rising edge delay difference and the falling edge delay difference.

6. The system with physical non-copyability function according to claim 1, characterized in that: The system further comprises: a rising edge metastable detector and a falling edge metastable detector; The rising edge metastable detector and the falling edge metastable detector are used to detect the stability of the output response.

7. The system with physical non-copyability function according to claim 6, characterized in that: The rising edge metastable detector includes a second buffer, a first trigger, a second trigger and an OR gate; The first trigger and the second trigger both use the trigger signal as an enable signal, the negative signal of the trigger signal as a reset signal, the power supply voltage as a data input, and the output response and the negative signal of the output response as a clock; the second buffer is used to set a detection threshold, and the OR gate is used to receive the output states of the first trigger and the second trigger, and generate a metastable flag signal based on the output states.

8. The system with physical non-copyability function according to claim 6, characterized in that: The system is used for determining the stability of CRP through multiple consecutive metastable flag signals of the rising edge metastable detector and the falling edge metastable detector.

9. The system with physical non-copyability function according to claim 2, characterized in that: The aliasing excitation signal is used as the control signal of the two-to-one multiplexer in sequence; If the target delay array is the first delay array among all delay arrays, the input signal of the target buffer is the trigger signal; If the target delay array is the last delay array among all the delay arrays, the outputs of all the target two-to-one multiplexers are delay output paths.

10. The system with physical non-copyability function according to claim 3, characterized in that: The XOR logic device includes a first XOR gate, a second XOR gate, a third XOR gate and a fourth XOR gate; The input signals of the first XOR gate and the second XOR gate are four-bit excitation signals, the input of the third XOR gate is the output signals of the first XOR gate and the second XOR gate, and the input signal of the fourth XOR gate is the output signal of the third XOR gate and the first signal.

Images