A SRAM PUF key extraction method based on correlation judgment

Abstract

The present invention provides an SRAM PUF key extraction method based on correlation judgment, comprising: an initial registration phase: powering on the SRAM, configuring and initializing variables; calculating the exclusive OR of a data block and its cyclic shifts of different points to obtain the number of cyclic shift points and the number of negatively correlated bits when the maximum negative correlation occurs; selecting N valid data blocks whose maximum negatively correlated bit numbers are greater than a set threshold; using N bits of hidden random numbers to control whether the valid data blocks are cyclically shifted according to the number of their maximum negatively correlated cyclic shift points; linearly encoding a randomly generated PUF output random number; performing an exclusive OR operation on the encoding result and the hidden random number to obtain auxiliary data; a reconstruction phase: powering on the SRAM, initializing variables, and obtaining a valid data block based on the auxiliary data selection; restoring an approximate random number of the hidden random number using the valid data block and the auxiliary data; performing an exclusive OR operation on the approximate random number and the auxiliary data to obtain a codeword before error correction; and performing linear encoding on the codeword to correct errors and restore the PUF output random number.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to an SRAM PUF key extraction method based on correlation judgment. Background Art

[0002] With the widespread adoption of IoT devices in fields such as biomedicine, automotive electronics, aerospace, and mobile infrastructure, information security has become a focus of attention. Physically Unclonable Functions (PUFs) leverage the physical deviations and unclonability inherent in device manufacturing for key generation and secure authentication, meeting the security requirements of lightweight cryptographic devices.

[0003] Due to process variations, the initial data of different static random access memories (SRAMs) after power-up is randomly distributed. However, the initial data of the same individual after multiple power-ups has a certain degree of stability, similar to human fingerprint information, which can be used to implement SRAM PUF. The SRAM PUF output (also called response) is often used in information security applications such as key generation and key protection.

[0004] The initial data in SRAM after power-on is susceptible to factors such as voltage and temperature, leading to instability and drift due to aging. Information security applications require sufficiently stable SRAM PUF output; otherwise, subsequent cryptographic functions cannot be performed, impacting the normal operation of the system. To achieve stable PUF output, an error correction mechanism is required, such as the commonly used SRAM PUF generation structures based on code-offset or synthrome. To generate error correction data, the SRAM PUF must be registered before application. Registration must be performed in a controlled environment. Based on error correction coding technology, publicly storable auxiliary data is generated from the SRAM initial data and PUF output. During application, the auxiliary data is used to correct noise in the SRAM initial data and restore the PUF output.

[0005] Key to the secure application of PUF lightweight cryptographic devices is how to quickly register, achieve long-term stability of SRAM PUF using fewer computing resources, an appropriate amount of SRAM and auxiliary data resources, and simultaneously reduce information leakage caused by auxiliary data during PUF registration or update processes to ensure PUF security. Summary of the Invention

[0006] The present invention provides an SRAM PUF key extraction method based on correlation judgment to solve at least one of the above problems.

[0007] The present invention provides an SRAM PUF key extraction method based on correlation judgment, which includes at least an initial registration phase and a reconstruction phase, wherein:

[0008] Initial registration phase:

[0009] Step 101: Power on the SRAM, configure and initialize PUF variables, where the variables include at least:

[0010] Configure the data block upper limit I, the number of valid data blocks N, the number of data block bits K and the threshold T; initialize the data block number i to 0, all 1-bit auxiliary data HelpDataIndex to 0, and the valid data block temporary sequence number n to 0;

[0011] Step 102, calculating the exclusive OR of an SRAM data block and its cyclic shifts of different points, and searching for the number of cyclic shift points and the number of negatively correlated bits when the data block has the maximum negative correlation;

[0012] Step 103, selecting N data blocks whose maximum number of negatively correlated bits is greater than a set threshold, and using the data blocks as valid data blocks, where the number of the valid data blocks is N;

[0013] Step 104, using N bits to hide random numbers to control whether the N valid data blocks are cyclically shifted according to the number of cyclic shift points at which the N blocks have the maximum negative correlation;

[0014] Step 105: Generate a PUF output random number by the random number generator, perform linear encoding on it, and output the encoding result;

[0015] Step 106, performing XOR operation on the encoding result and the hidden random number to obtain auxiliary data;

[0016] Reconstruction phase:

[0017] Step 201: Power on the SRAM, initialize variables, read the auxiliary data, and select a valid data block based on the auxiliary data.

[0018] Step 202, using the valid data block and the auxiliary data, restore the approximate random number that conceals the random number;

[0019] Step 203, XOR the approximate random number with the auxiliary data to obtain a codeword before error correction;

[0020] Step 204: perform linear coding error correction on the codeword to restore the PUF output random number.

[0021] Furthermore, the step 102 includes:

[0022] The addresses are accumulated sequentially to read K bits of SRAM data. The jth bit of the i-th data block is represented by D-SRAM[i][j], where i∈[0,I-1] and j∈[0,K-1].

[0023] For the i-th data block D-SRAM[i] of K-bit data, in the range of k∈[1,K-1], calculate R[k]=numone(D-SRAM[i] (D-SRAM[i]>>k));

[0024] Among them: “>>” means circular right shift, " indicates bit-wise XOR calculation, and "numone" indicates the number of bits counted as 1;

[0025] Calculate MaxR[n]=max(R[1:K-1]), MaxIndex[n]=maxindex(R[1:K-1]);

[0026] Here, "max" indicates the maximum value among R[1]~R[K-1], and "maxindex" indicates the position of the maximum value. If the same maximum value appears in multiple positions, the value with the smallest index among R[1]~R[K-1] is selected.

[0027] Furthermore, the step 103 includes:

[0028] If MaxR[n]≥T in step 102, then HelpDataIndex[i]=1, and the n-th K-bit valid data block HelpData0[n]=D-SRAM[i] is set, and n is incremented by 1;

[0029] If n≥N-1, go to step 104; otherwise, increment i by 1. If i≥I, return to registration failure; otherwise, go to step 102.

[0030] Furthermore, the step 104 includes:

[0031] Generate an N-bit hidden random number R0, each bit is represented by R0[i], i∈[0,N-1];

[0032] If R0[i]=1, i∈[0,N-1], then circularly shift HelpData0[i] right, that is: HelpData0[i]=HelpData0[i]>>MaxIndex[i], and store the auxiliary data HelpData0, a total of N×K bits, and HelpDataIndex, a total of I bits.

[0033] Furthermore, steps 105 and 106 include:

[0034] Step 105: A random number generator generates an M-bit PUF output random number R1, which is linearly encoded. Get an N-bit codeword W;

[0035] Step 106 , W is XORed with R0 and stored as auxiliary data HelpData1 , which is N bits in total. At the same time, the upper limit I of the configuration data block, the number of valid data blocks N, the number of data block bits K, and the threshold T are stored as auxiliary data.

[0036] Furthermore, the step 201 includes:

[0037] In step 201, the SRAM is powered on, the PUF variables are initialized, and the auxiliary data is read. The SRAM data of I data blocks is read according to the consecutive addresses. According to HelpDataIndex, N K-bit valid data blocks are selected and represented by R-SRAM[i], i∈[0, N-1].

[0038] Furthermore, the step 202 includes:

[0039] Extract the i-th K-bit data HelpData0[i] of the auxiliary data HelpData0, calculate MaxR[i] and MaxIndex[i] corresponding to HelpData0[i] according to step 102, and further calculate:

[0040] G0[i]= numone(R-SRAM[i] HelpData0[i]);

[0041] G1[i]= numone((R-SRAM[i]>>MaxIndex[i]) HelpData0[i]);

[0042] According to the following decision expression, the approximate random number R0'[i] of the hidden random number R0[i] is restored bit by bit, i∈[0,N-1]:

[0043] .

[0044] Furthermore, steps 203 and 204 include:

[0045] Step 203, XOR HelpData1 with R0' to obtain W';

[0046] Step 204, linear encoding , correct W' to get W, and restore the M-bit PUF output random number R1.

[0047] Furthermore, the method further comprises applying process auxiliary data update:

[0048] Step 301, determine whether to update by using a random number to control the update frequency;

[0049] Step 302: Locate the bit with error in the codeword W' before error correction by performing an XOR calculation.

[0050] Step 303: Update the auxiliary data corresponding to the error bit in W' according to steps 102 and 104. Before updating, a random number is used to determine whether to update again to control the update frequency.

[0051] Furthermore, the application process auxiliary data update specifically includes:

[0052] Step 301: Generate a temporary random number and convert it into a probability value AdjIndex0 between [0,1). Compare it with the update probability threshold AdjP0 set in the initial registration phase. If AdjIndex0 ≥ AdjP0, exit; otherwise, execute step 302.

[0053] Step 302, reconstruction phase After step 204, determine whether the random number R1 output by the M-bit PUF is correct. If it is incorrect, exit. If it is correct, XOR W and W' to obtain ER0';

[0054] Step 303, the loop is executed until i∈[0,N-1] is traversed. If ER0'[i]=0, it means that there is no error in the R0'[i] data, and the next loop is executed. Otherwise, a temporary random number is generated and converted into a probability value AdjIndex1 between [0,1). It is compared with the update probability threshold AdjP1 set in the initial registration stage. If AdjIndex1≥AdjP1, the next loop is executed. Otherwise, the R-SRAM[i] data block is processed according to steps 102 and 104. If the corresponding MaxR[i]≥T, the HelpData0[i] data is updated.

[0055] Compared with the prior art, the advantages of the present invention are:

[0056] The present invention designs an SRAM PUF key extraction method based on correlation judgment. Based on two-level error correction, the outer layer encoding uses random cyclic shift to "hide" information and uses correlation judgment to restore the information, thereby ensuring the security of SRAM PUF.

[0057] The present invention "hides" the random number R0 through random cyclic shift, and will not cause a significant decrease in PUF information security due to the increase of outer data. Therefore, during implementation, the error correction performance can be improved by appropriately increasing the length of the outer error correction data.

[0058] The present invention can dynamically and partially update the auxiliary data HelpData0 during long-term use, and can effectively control information leakage caused by the update, greatly reducing maintenance and guarantee requirements and improving long-term reliability.

[0059] It can be seen that compared with the prior art, the present invention has outstanding substantial features and significant progress, and the beneficial effects of its implementation are also obvious. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is a schematic diagram of the dynamic screening and hiding control of SRAM-PUF negative correlation data blocks during the registration phase of an SRAM PUF key extraction method based on correlation judgment according to the present invention;

[0061] Figure 2 This is a schematic diagram of linear encoding and auxiliary data generation during the registration phase of an SRAM PUF key extraction method based on correlation judgment according to the present invention;

[0062] Figure 3 This is a schematic diagram of the reconstruction phase of an SRAM PUF key extraction method based on correlation judgment of the present invention;

[0063] Figure 4 This is a flowchart of auxiliary data update during the application process of an SRAM PUF key extraction method based on correlation judgment of the present invention. DETAILED DESCRIPTION

[0064] In order to make the technical solutions and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0065] The basic concept of this invention is to use a two-level error correction structure as the foundation. The inner error correction layer can use common linear error correction coding, while the outer error correction layer uses random cyclic shifting of block data to "hide" information and restore it through correlation judgment. The outer error correction layer first divides the SRAM data with continuous addresses into data blocks. Next, a random number to be "hidden" is generated with a number of bits equal to the number of SRAM data blocks. Each random number bit corresponds to a data block. The random number bit value determines whether to cyclically shift the data block. To improve error correction performance, the cyclic shift point number is selected to select the position with the maximum negative correlation between the data block and the cyclic shifted data block. The "hidden" random number is output to the inner error correction layer to protect the PUF output random number. The inner error correction layer first linearly encodes the PUF output random number. The encoded data length is the same as the "hidden" random number length. The two are XORed and stored as auxiliary data.

[0066] Figure 1 This is a schematic diagram of the dynamic screening and hiding control of SRAM-PUF negative correlation data blocks in the registration phase of an SRAM PUF key extraction method based on correlation judgment of the present invention.

[0067] Figure 2 This is a schematic diagram of linear encoding and auxiliary data generation in the registration phase of an SRAM PUF key extraction method based on correlation judgment in the present invention.

[0068] Figure 3 This is a schematic diagram of the reconstruction phase of an SRAM PUF key extraction method based on correlation judgment in the present invention.

[0069] like Figure 1-3 As shown, the method of the present invention includes at least an initial registration phase and a reconstruction phase, wherein:

[0070] Initial registration phase:

[0071] Step 101: Power on the SRAM, configure and initialize PUF variables, where the variables include at least:

[0072] Configure the data block upper limit I, the number of valid data blocks N, the number of data block bits K and the threshold T; initialize the data block number i to 0, all 1-bit auxiliary data HelpDataIndex to 0, and the valid data block temporary sequence number n to 0.

[0073] It should be noted that HelpDataIndex[i] represents the i-th bit, and its value indicates whether the i-th data block is available, i∈[0,I-1].

[0074] K represents the number of bits in a data block. For convenience, an integer multiple of 8 is generally selected, and a suitable threshold T is set according to K.

[0075] Step 102 , calculating the exclusive OR of an SRAM data block and its cyclic shifts of different points, and searching for the number of cyclic shift points and the number of negatively correlated bits when the data block has the maximum negative correlation.

[0076] The step 102 includes:

[0077] The addresses are accumulated sequentially to read K bits of SRAM data. The jth bit of the i-th data block is represented by D-SRAM[i][j], where i∈[0,I-1] and j∈[0,K-1].

[0078] For the i-th data block D-SRAM[i] of K-bit data, in the range of k∈[1,K-1], calculate R[k]=numone(D-SRAM[i] (D-SRAM[i]>>k));

[0079] Among them: “>>” means circular right shift, " indicates bit-wise XOR calculation, and "numone" indicates the number of bits counted as 1;

[0080] Calculate MaxR[n]=max(R[1:K-1]), MaxIndex[n]=maxindex(R[1:K-1]);

[0081] "max" indicates the maximum value among R[1] to R[K-1], and "maxindex" indicates the position of the maximum value. If the same maximum value appears at multiple positions, the value with the smallest index among R[1] to R[K-1] is selected. For example, if R[1] and R[3] have the same maximum value, R[1] is selected.

[0082] Step 103 : Select N data blocks whose maximum number of negatively correlated bits is greater than a set threshold, and use the data blocks as valid data blocks. The number of the valid data blocks is N.

[0083] The step 103 includes:

[0084] If MaxR[n]≥T in step 102, then HelpDataIndex[i]=1, and the nth valid data block HelpData0[n]=D-SRAM[i] is set, and n is incremented by 1;

[0085] If n≥N-1, go to step 104; otherwise, increment i by 1. If i≥I, return to registration failure; otherwise, go to step 102.

[0086] Step 104: Use N bits to hide random numbers to control whether the N valid data blocks are cyclically shifted according to the number of cyclic shift points when the N blocks have the maximum negative correlation.

[0087] The step 104 includes:

[0088] Generate an N-bit masked random number R0, which is an intermediate variable and not stored.

[0089] Each bit is represented by R0[i], i∈[0,N-1];

[0090] If R0[i]=1, i∈[0,N-1], then circularly shift HelpData0[i] right, that is: HelpData0[i]=HelpData0[i]>>MaxIndex[i], and store the auxiliary data HelpData0, a total of N×K bits, and HelpDataIndex, a total of I bits.

[0091] Step 105: The random number generator generates a PUF output random number, linearly encodes it, and outputs the encoding result.

[0092] The step 105 includes:

[0093] Step 105: A random number generator generates an M-bit PUF output random number R1, which is linearly encoded. Get the N-bit codeword W.

[0094] Step 106: XOR the linear encoding result with the hidden random number to obtain auxiliary data.

[0095] The step 106 includes:

[0096] Step 106: W and R0 are XORed and stored as auxiliary data HelpData1, which has N bits in total.

[0097] Reconstruction phase:

[0098] In step 201 , the SRAM PUF is powered on, variables are initialized, and the auxiliary data is read, and a valid data block is selected based on the auxiliary data.

[0099] The step 201 includes:

[0100] In step 201, the SRAM is powered on, the PUF variables are initialized, and the auxiliary data is read. The SRAM data of I data blocks is read according to the consecutive addresses. According to HelpDataIndex, N K-bit valid data blocks are selected and represented by R-SRAM[i], i∈[0,N-1].

[0101] Step 202: Use the valid data block and the auxiliary data to restore the approximate random number of the hidden random number.

[0102] The step 202 includes:

[0103] Extract the i-th K-bit data HelpData0[i] of the auxiliary data HelpData0, calculate MaxR[i] and MaxIndex[i] corresponding to HelpData0[i] according to step 102, and further calculate:

[0104] G0[i]= numone(R-SRAM[i] HelpData0[i]);

[0105] G1[i]= numone((R-SRAM[i]>>MaxIndex[i]) HelpData0[i]);

[0106] Restore the approximate random number R0'[i] of the hidden random number R0[i] bit by bit, i∈[0,N-1], and restore R0'[i] according to the following decision expression:

[0107]

[0108] Step 203: XOR the approximate random number with the auxiliary data to obtain a codeword before error correction.

[0109] The step 203 includes:

[0110] Step 203, XOR HelpData1 with R0' to obtain W';

[0111] Step 204: perform linear coding error correction on the codeword to restore the PUF output random number.

[0112] The step 204 includes:

[0113] Step 204, linear encoding , correct W' to get W, and restore the M-bit PUF output random number R1.

[0114] It should be noted that the outer error correction method proposed in the present invention is essentially a repetition code, but the effective repetition code length of each data block is MaxR[i], which is an even number between [T, K]. In step 104, if R0[i]=1, the data block HelpData0[i] is cyclically shifted to the right; if R0[i]=0, the data block remains unchanged. For example, if the data block HelpData0[i]=2'b10111001 is input from step 102, then MaxIndex[i]=2, MaxR[i]=6, if R0[i]=0, the output of step 104 is: 2'b10111001; if R0[i]=1, the output of step 104 is: 2'b01101110. In reconstruction step 202, let the corresponding R-SRAM[i] be represented as 2'b vvzvzvvv, with the number of "v" being MaxR[i] = 6. The corresponding bits are the valid repetition-encoded data of the data block. During the correlation calculation in reconstruction step 202, the bits corresponding to "z" in R-SRAM[i] synchronously change the values of G0[i] and G1[i], regardless of whether there are bit errors, and have no effect on the judgment result. Only the bits corresponding to "v" in R-SRAM[i] have an effect on the judgment result. When HelpData0 and R-SRAM are cyclically shift-matched, the bits corresponding to "v" are positively correlated; otherwise, they are negatively correlated. Therefore, the error correction capability of each data block depends not only on the stability of the SRAM data but also on the MaxR[i] value of each data block. To ensure the error correction capability of each data block, step 102 screens the SRAM data blocks and selects data blocks with MaxR[i] ≥ T. The screening rate can be determined based on the asymptotic uniformity theory under the assumption that each bit of the SRAM data is independently and identically distributed. In practical applications, the effective data block ratio N / I can be selected in the range of 80% to 90%. For example, when K=32 bits, T=12 can be selected.

[0115] The method of step 102 of the present invention can be applied alone to the SRAM data screening of common SRAMPUF generation structures such as Code-offset or Syndrome, and the data screened out is close to uniform distribution, which can ensure the information security of PUF when used for PUF output. In step 102, DataIndex[i]=D-SRAM[i] is calculated. (D-SRAM[i]>>MaxIndex[i]), and based on the K-bit value of DataIndex[i], select D-SRAM[i][j] corresponding to DataIndex[i][j]=1 to generate the PUF. For example, if D-SRAM[i]=2'b10111001, the data after cyclic right shift of 2 bits is 2'b01101110. At this time, DataIndex[i]=2'b 11010111. Based on this, the D-SRAM[i] data is discarded. That is, the bits at the two x positions in 2'b10x1x001 are discarded, and the two 1s are discarded. The remaining data is: 101001, with the 0 and 1 bits being strictly equal. Compared with the common selection method based on "01" or "10", this method maximizes the preservation of the original data points and entropy value. Under the condition that the original data is independent and identically distributed, the information security of the SRAM PUF can be ensured. When resources permit, each data block can randomly select a number from [1, K-1] to replace MaxIndex[i] to filter data. Although this will reduce the effective data rate, it can better ensure the entropy value of the remaining data.

[0116] The basic principle of the method in step 102 of the present invention for data screening is based on the correlation between the original sequence and the cyclic sequence. In applications with higher security requirements, SRAM data screening based on random scrambling can be adopted according to the above method. The specific method is as follows: for the i-th data block D-SRAM[i] of K bits, a method similar to Fisher-Yates Shuffle is used to scramble D-SRAM[i] bit by bit, and it is represented by F-SRAM[i]. The calculation DataIndex[i] = D-SRAM[i] is calculated. F-SRAM[i] is used, and D-SRAM[i][j] corresponding to DataIndex[i][j]=1 is selected based on the K-bit value of DataIndex[i]. The scrambled data block has better randomness. The selected data is equivalent to a random sample of the original data block D-SRAM[i]. For example, D-SRAM[i]=2'b10111001, of which 5 bits are 1 and 3 bits are 0. Assume that after random scrambling, a sequence F-SRAM[i]=2'b01011101 with 5 bits 1 and 3 bits 0 is obtained. At this time, DataIndex[i]=2'b11100100, and the D-SRAM[i] data is discarded, that is, the bits at the positions of the 4 xs in 2'b101xx0xx. The remaining data is: 2'b1010. Compared with the cyclic shift and related judgment method, the remaining data after discarding is relatively small, but the entropy value of the remaining data can be better guaranteed.

[0117] During the random cyclic shift in the registration phase, step 104 does not use the random sequence R0, and directly uses the PUF output random number R1 output after inner encoding W. At this time, there is no need to store HelpData1, and the auxiliary data storage demand is reduced, but the information security is also reduced.

[0118] When storage resources allow, the MaxIndex data calculated in step 102 may be stored as auxiliary data to reduce the computational complexity of the reconstruction process.

[0119] For high-information security and high-reliability application scenarios, SRAM data can be screened first to remove unstable bits after power-on. According to literature data, about 80% of SRAM data has very stable initial values after power-on. Stable data units can be screened out by powering on multiple times. Given the random distribution of unstable bits, the discarding process is similar to random sampling of the original SRAM data, which can effectively reduce the correlation of SRAM data. Therefore, it can effectively improve information security and reliability at the same time. The cost is the need to add an additional set of auxiliary data similar to HelpIndex to indicate whether a certain bit is used.

[0120] Figure 4 This is a flowchart of auxiliary data update during the application process of an SRAM PUF key extraction method based on correlation judgment of the present invention.

[0121] like Figure 4 As shown, the application process auxiliary data update:

[0122] Step 301: Determine whether to update by using the random number to control the update frequency.

[0123] The step 301 specifically includes:

[0124] Step 301: Generate a temporary random number and convert it into a probability value AdjIndex0 between [0, 1). Compare it with the update probability threshold AdjP0 set during the initial registration phase (AdjP0 = 1 means no auxiliary data update, AdjP0 = 0 means update every time). If AdjIndex0 ≥ AdjP0, exit; otherwise, execute step 302.

[0125] Step 302: Locate the bit with error in the codeword W' before error correction by performing an XOR calculation.

[0126] The step 302 specifically includes:

[0127] Step 302, reconstruction phase After step 204, determine whether the random number R1 output by the M-bit PUF is correct. If it is incorrect, exit. If it is correct, XOR W and W' to obtain ER0'.

[0128] Step 303: Update the auxiliary data corresponding to the error bit in W' according to steps 102 and 104. Before updating, a random number is used to determine whether to update again to control the update frequency.

[0129] The step 303 specifically includes:

[0130] Step 303, the loop is executed until i∈[0,N-1] is traversed. If ER0'[i]=0, it means that there is no error in the R0'[i] data, and the next loop is executed. Otherwise, a temporary random number is generated and converted into a probability value AdjIndex1 between [0,1). It is compared with the update probability threshold AdjP1 set in the initial registration stage. If AdjIndex1≥AdjP1, the next loop is executed. Otherwise, the R-SRAM[i] data block is processed according to steps 102 and 104. If the corresponding MaxR[i]≥T, the HelpData0[i] data is updated.

[0131] In the method of the present invention, all auxiliary data can be publicly stored, including: HelpIndex, HelpData0, HelpData1, AdjP0, AdjP1, MaxIndex, T, etc. During application, if the auxiliary data can be easily tampered by an adversary, for example: the auxiliary data is independently stored in a Flash chip and can be directly read and written by an adversary, for the security of the PUF application, part of the R0 data can be selected and hashed together with all the auxiliary data. The hash value is also stored as the auxiliary data. During reconstruction, the hash value is used to determine whether it has been tampered with. If it has been tampered with, the reconstruction process is stopped.

[0132] The same and similar parts between the various embodiments in this specification can be referenced to each other.

[0133] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A SRAM PUF key extraction method based on correlation judgment, characterized in that: The method comprises at least an initial registration phase and a reconstruction phase, wherein: Initial registration phase: Step 101: Power on the SRAM, configure and initialize PUF variables, where the variables include at least: Configure the data block upper limit I, the number of valid data blocks N, the number of data block bits K and the threshold T; initialize the data block number i to 0, all 1-bit auxiliary data HelpDataIndex to 0, and the valid data block temporary sequence number n to 0; Step 102, calculating the exclusive OR of an SRAM data block and its cyclic shifts of different points, and searching for the number of cyclic shift points and the number of negatively correlated bits when the data block has the maximum negative correlation; Step 103, selecting N data blocks whose maximum number of negatively correlated bits is greater than a set threshold, and using the data blocks as valid data blocks, where the number of the valid data blocks is N; Step 104, using N bits to hide random numbers to control whether the N valid data blocks are cyclically shifted according to the number of cyclic shift points at which the N blocks have the maximum negative correlation; Step 105: Generate a PUF output random number by the random number generator, perform linear encoding on it, and output the encoding result; Step 106, performing XOR operation on the encoding result and the hidden random number to obtain auxiliary data; Reconstruction phase: Step 201: Power on the SRAM, initialize variables, read the auxiliary data, and select a valid data block based on the auxiliary data. Step 202, using the valid data block and the auxiliary data, restore the approximate random number that conceals the random number; Step 203, XOR the approximate random number with the auxiliary data to obtain a codeword before error correction; Step 204: perform linear coding error correction on the codeword to restore the PUF output random number.

2. The SRAM PUF key extraction method based on correlation judgment according to claim 1, characterized in that: The step 102 includes: The addresses are accumulated sequentially to read K bits of SRAM data. The jth bit of the i-th data block is represented by D-SRAM[i][j], where i∈[0,I-1] and j∈[0,K-1]. For the i-th data block D-SRAM[i] of K-bit data, in the range of k∈[1,K-1], calculate R[k]=numone(D-SRAM[i] (D-SRAM[i] >> k)); Among them: ">>" means circular right shift, " "" means bit-wise XOR calculation, "numone" means the number of bits counted as 1; Calculate MaxR[n]=max(R[1:K-1]), MaxIndex[n]=maxindex(R[1:K-1]); Among them, "max" means selecting the maximum value in R[1]~R[K-1], and "maxindex" indicates the position of the maximum value. If the same maximum value appears in multiple positions, the value with the smallest index in R[1]~R[K-1] is selected.

3. The SRAM PUF key extraction method based on correlation judgment according to claim 1, characterized in that: The step 103 includes: If MaxR[n]≥T in step 102, then HelpDataIndex[i]=1, and the n-th K-bit valid data block HelpData0[n]=D-SRAM[i] is set, and n is incremented by 1; If n≥N-1, go to step 104; otherwise, increment i by 1. If i≥I, return to registration failure; otherwise, go to step 102.

4. The SRAM PUF key extraction method based on correlation judgment according to claim 1, characterized in that: The step 104 includes: Generate an N-bit hidden random number R0, each bit is represented by R0[i], i∈[0,N-1]; If R0[i]=1, i∈[0,N-1], then circularly shift HelpData0[i] right, that is: HelpData0[i]= HelpData0[i] >> MaxIndex[i], and store the auxiliary data HelpData0, a total of N×K bits, and HelpDataIndex, a total of I bits.

5. The SRAM PUF key extraction method based on correlation judgment according to claim 1, characterized in that: Steps 105 and 106 include: Step 105: A random number generator generates an M-bit PUF output random number R1, which is linearly encoded. Get an N-bit codeword W; Step 106 , W is XORed with R0 and stored as auxiliary data HelpData1 , which is N bits in total. At the same time, the upper limit I of the configuration data block, the number of valid data blocks N, the number of data block bits K, and the threshold T are stored as auxiliary data.

6. The SRAM PUF key extraction method based on correlation judgment according to claim 1, characterized in that: The step 201 includes: In step 201, the SRAM is powered on, the PUF variables are initialized, and the auxiliary data is read. The SRAM data of I data blocks is read according to the consecutive addresses. According to HelpDataIndex, N K-bit valid data blocks are selected and represented by R-SRAM[i], i∈[0, N-1].

7. The SRAM PUF key extraction method based on correlation judgment according to claim 1, characterized in that: The step 202 includes: Extract the i-th K-bit data HelpData0[i] of the auxiliary data HelpData0, calculate MaxR[i] and MaxIndex[i] corresponding to HelpData0[i] according to step 102, and further calculate: G0[i]= numone(R-SRAM[i] HelpData0[i]); G1[i]= numone((R-SRAM[i] >> MaxIndex[i]) HelpData0[i]); According to the following decision expression, the approximate random number R0'[i] of the hidden random number R0[i] is restored bit by bit, i∈[0,N-1]: 。 8. The SRAM PUF key extraction method based on correlation judgment according to claim 1, characterized in that: Steps 203 and 204 include: Step 203, XOR HelpData1 with R0' to obtain W'; Step 204, linear encoding , correct W' to get W, and restore the M-bit PUF output random number R1.

9. The SRAM PUF key extraction method based on correlation judgment according to claim 8, characterized in that: The method further comprises applying process auxiliary data updates: Step 301, determine whether to update by using a random number to control the update frequency; Step 302: Locate the bit with error in the codeword W' before error correction by performing an XOR calculation. Step 303: Update the auxiliary data corresponding to the error bit in W' according to steps 102 and 104. Before updating, a random number is used to determine whether to update again to control the update frequency.

10. The SRAM PUF key extraction method based on correlation judgment according to claim 9, characterized in that: The application process auxiliary data update specifically includes: Step 301: Generate a temporary random number and convert it into a probability value AdjIndex0 between [0,1). Compare it with the update probability threshold AdjP0 set in the initial registration phase. If AdjIndex0 ≥ AdjP0, exit; otherwise, execute step 302. Step 302, reconstruction phase After step 204, determine whether the random number R1 output by the M-bit PUF is correct. If it is incorrect, exit. If it is correct, XOR W and W' to obtain ER0'; Step 303, the loop is executed until i∈[0,N-1] is traversed. If ER0'[i]=0, it means that there is no error in the R0'[i] data, and the next loop is executed. Otherwise, a temporary random number is generated and converted into a probability value AdjIndex1 between [0,1). It is compared with the update probability threshold AdjP1 set in the initial registration stage. If AdjIndex1≥AdjP1, the next loop is executed. Otherwise, the R-SRAM[i] data block is processed according to steps 102 and 104. If the corresponding MaxR[i]≥T, the HelpData0[i] data is updated.

Images