Physical unclonable function circuit control system based on arbiter
By introducing Markov decision chain state machine jump logic and parallel switch unit design into the arbiter physical unclonable function circuit, the vulnerability of the existing circuit is solved and higher security and stability are achieved.
Patent Information
- Application Number
- CN202510716684.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-30
- Publication Date
- 2025-09-05
AI Technical Summary
Existing physical unclonable function circuits based on arbitrators are vulnerable to reverse engineering and machine learning algorithm modeling attacks, and the stimulus-response pairs are easily accessible to the outside world, resulting in insufficient security.
The state machine jump logic and parallel switch unit design based on Markov decision chain are adopted, combined with D flip-flops, to form a physical unclonable function circuit control system based on arbitrator, which improves the security of hardware primitives through entropy increase and anti-interference capabilities.
Improves the anti-attack capability of hardware primitives, enhances the reliability and stability of output responses, and resists reverse engineering and modeling attacks.
Smart Images
Figure CN120597338A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of digital integrated circuits, and in particular to a physical unclonable function circuit control system based on an arbitrator. Background Art
[0002] With the rapid development of the Internet of Things (IoT), society is entering an information age where everything is connected, reshaping numerous traditional industries. Hundreds of millions of devices are connected to the internet, forming intelligent, efficient information systems across all industries. While the rapid development of the IoT has brought undeniable benefits to society, the presence of a large number of intelligent hardware devices and the imperfect authentication mechanisms within the IoT inevitably pose serious security risks to device hardware. Typically, device data, including but not limited to encryption keys, is stored in hardware's non-volatile memory. This is used to compare the keys between the IoT system server and the device during authentication, ensuring device security. However, the vulnerability of non-volatile memory allows attackers to steal this data through methods such as reverse engineering and side-channel attacks, thereby enabling malicious attacks on IoT systems by forging identities and stealing information. Therefore, research in hardware security has become extremely important. Research on hardware security and identity trust has garnered widespread attention. As a low-cost, highly secure hardware primitive, the physically unclonable function (PUF) circuit utilizes process variations within identical structures during integrated circuit manufacturing as a unique signature, creating a unique hardware fingerprint and making it resistant to attacks, including reverse engineering. For currently mature PUFs, such as the arbiter PUC, device manufacturers must control process variations within a limited range. Circuit noise, including voltage, temperature, and circuit aging, can be susceptible to interference from actual process variations when operating in noisy conditions, making it difficult to achieve a stable and unique response. Furthermore, the arbiter PUC is susceptible to modeling attacks using machine learning algorithms, making the design of a highly reliable PUF primitive a critical challenge.
[0003] Arbiter-based PUC circuits are among the most popular architectures in academia and industry because they are easily implemented on FPGA or ASIC platforms. A classic PUC circuit consists of multiple cascaded switching units. It obtains an entropy source by measuring the delay difference between signals transmitted along the same path along two structural paths. The arbiter then compares the arrival order of the two signals to determine whether the PUC circuit responds to a 0 or 1. However, the space of stimulus-response pairs for an arbiter-based PUC grows exponentially with the number of stimuli, and the accumulated delays of switching units are relatively easy to mathematically model. The resulting stimulus-response pairs can be directly accessed by external devices, making them vulnerable to modeling attacks. Therefore, a PUC circuit control system based on an arbiter is proposed. Summary of the Invention
[0004] In order to solve the technical problems of the shortcomings of traditional circuit architecture, the present invention provides a physical unclonable function circuit control system based on an arbitrator.
[0005] The present invention is implemented using the following technical solution: a physical unclonable function circuit control system based on an arbitrator, comprising a device end and a verification end, wherein the device end comprises an excitation module, an APUF array module, a response receiving module, a register module, a state machine module, and a response register module connected in sequence, wherein the response receiving module is connected to a clock generating module, and the response receiving module is connected to the response register module;
[0006] The verification end includes a Markov decision module, a CRC check module and a response storage module connected in sequence, the Markov decision module is connected to a state jump counting module, the Markov decision module includes a state jump logic unit connected to the storage module and the state jump counting module, the state jump logic unit is connected to a state space unit connected to the state jump counting module and the CRC check module, and the CRC check module is connected to the response storage module.
[0007] As a further improvement of the above solution, the APUF array module includes multiple groups of APUF units arranged in parallel, and the APUF units are connected to the excitation module and the response receiving module.
[0008] As a further improvement of the above scheme, the APUF unit includes multiple groups of switch units connected in sequence, the switch units are connected to D flip-flops, the switch units include two 2-to-1 multiplexers, the multiplexers are connected to the next-level multiplexers cascaded with them through wires, and the control signal of the multiplexers is connected to the excitation segment.
[0009] As a further improvement of the above solution, the excitation module is used to generate an excitation level signal, and the APUF array module generates an intermediate response level signal according to its own entropy source process fluctuation and the delay difference of the excitation signal.
[0010] As a further improvement of the above solution, the response receiving module is used to receive the intermediate response level signal transmitted by the APUF array module and the clock signal sent by the clock generating module, and the register module is used to store the intermediate response level signal received by the response receiving module.
[0011] As a further improvement of the above solution, the state machine module is used to convert the response signal transmitted by the register module into the forward or backward state jump logic of the state machine to obtain the final state signal.
[0012] As a further improvement of the above solution, the response register module is used to store the final state signal formed by the state machine module and the intermediate response level signal received by the response receiving module, and the clock generation module is used to generate a clock signal.
[0013] As a further improvement of the above solution, the state jump logic unit is used to form the intermediate response level signal transmitted by the register module into a state control instruction, the state space unit is used to form the state content, and the state jump counting module is used to measure the number of states.
[0014] As a further improvement of the above solution, the CRC check module is used to check the status, and the response storage module is used to store the check information.
[0015] Compared with the prior art, the present invention has the following beneficial effects:
[0016] 1. The present invention uses the state machine jump logic of the Markov decision chain to increase entropy for the arbiter's physically unclonable function, a hardware primitive, thereby providing a basis for improving the hardware primitive's anti-attack capability. When the trusted APUF array on the device receives a stimulus and generates a response to drive the state machine circuit, the state machine circuit completes a handshake with the Markov decision chain, thereby completing the IoT device verification.
[0017] 2. The switch units of the present invention are parallel to each other, and the D flip-flop intercepting the intermediate response is less sensitive to voltage and temperature changes, so that the output response has higher reliability. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] Figure 1 This is a structural diagram of a physical unclonable function circuit control system based on an arbitrator of the present invention;
[0019] Figure 2 is a circuit diagram of the APUF unit of the present invention;
[0020] Figure 3 This is a state jump flow chart based on the Markov decision chain of the present invention. DETAILED DESCRIPTION
[0021] The present invention will be further described below in conjunction with the accompanying drawings and specific implementation methods. It should be noted that, under the premise of no conflict, the various embodiments or technical features described below can be arbitrarily combined to form new embodiments.
[0022] Example 1:
[0023] Please combine Figure 1 The embodiment of the present invention provides an arbiter-based physical unclonable function circuit control system, including a device end and a verification end. The device end includes an excitation module, an APUF array module, a response receiving module, a register module, a state machine module, and a response register module connected in sequence. The response receiving module is connected to a clock generation module, and the response receiving module is connected to the response register module.
[0024] The verification end includes a Markov decision module, a CRC check module and a response storage module connected in sequence, the Markov decision module is connected to a state jump counting module, the Markov decision module includes a state jump logic unit connected to the storage module and the state jump counting module, the state jump logic unit is connected to a state space unit connected to the state jump counting module and the CRC check module, and the CRC check module is connected to the response storage module;
[0025] The excitation module is used to generate an excitation level signal, and the APUF array module generates an intermediate response level signal based on the process fluctuation of its own entropy source and the delay difference of the excitation signal; the response receiving module is used to receive the intermediate response level signal transmitted by the APUF array module and the clock signal sent by the clock generation module, and the register module is used to store the intermediate response level signal received by the response receiving module; the state machine module is used to convert the response signal transmitted by the register module into the forward or backward state jump logic of the state machine to obtain the final state signal; the response register module is used to store the final state signal formed by the state machine module and the intermediate response level signal received by the response receiving module, and the clock generation module is used to generate the clock signal; the state jump logic unit is used to form a state control instruction from the intermediate response level signal transmitted by the register module, the state space unit is used to form the state content, and the state jump counting module is used to measure the number of states; the CRC check module is used to check the state, and the response storage module is used to store the check information;
[0026] The state machine module includes several D flip-flops and combinational logic circuits.
[0027] Example 2:
[0028] The APUF array module includes multiple groups of APUF units arranged in parallel, and the APUF units are connected to the excitation module and the response receiving module;
[0029] like Figure 2 As shown, the APUF unit includes multiple groups of switch units connected in sequence, each of which is connected to a D flip-flop. The switch unit includes two 2-to-1 multiplexers, which are connected to the next-level multiplexer in cascade via wires. The control signal of the multiplexer is connected to the excitation segment. Each input enable signal, Enable, will be applied to the data path of the first-level switch unit to drive the signal transmission of the entire APUF circuit. The excitation signal Challenge is applied to the data selection end of each switch unit to select whether the signal of the data path is transmitted in parallel or cross-transmitted on this switch unit. After the excitation and Enable signals are applied to the switch unit, its two output ends are connected to the two ends of the D flip-flop respectively, outputting the intermediate response signal R mid ,Since the two identical paths of APUF will produce delay deviation due to process fluctuations, R mid The output 0 or 1 of is also determined by the deviation of APUF, and these responses are passed to the response receiving module to drive the state of the state machine module to jump randomly;
[0030] The D flip-flop is connected to an exclusive OR gate circuit, the exclusive OR gate circuit is connected to an arbiter circuit, and the exclusive OR gate circuit is connected to two D flip-flops at the last stage of the cascade switch unit.
[0031] Example 3:
[0032] like Figure 3 As shown, when the state jump logic unit first inputs the i+1-bit intermediate response signal r[i:0], declares the state space unit [k:0], and determines whether the current i-th bit response is 0 or 1. When the bit response is 0, the current state is reduced by 1, and when the bit response is 1, the current state is increased by 1; wherein M represents the number of switch units in the APUF, that is, the level of the APUF, K represents the number of states in the state space unit, i is the counting unit, and the state machine jump logic unit follows the Markov decision chain random walk idea. The jump of the current state in the state space unit is determined by the intermediate response signal R mid control.
[0033] The present invention uses the state machine jump logic of the Markov decision chain to increase entropy for the arbiter's physical unclonable function, a hardware primitive, thereby providing a basis for improving the hardware primitive's anti-attack capability. When the trusted APUF array on the device receives a stimulus and generates a response to drive the state machine circuit, the state machine circuit completes a handshake with the Markov decision chain, thereby completing IoT device verification. The switching units are parallel to each other, and the D flip-flop intercepts the intermediate response, which is less sensitive to voltage and temperature changes, making the output response highly reliable.
[0034] The above embodiments are only preferred embodiments of the present invention and cannot be used to limit the scope of protection of the present invention. Any non-substantial changes and replacements made by technicians in this field on the basis of the present invention fall within the scope of protection required by the present invention.
Claims
1. A physical unclonable function circuit control system based on an arbitrator, characterized in that: The device comprises a device end and a verification end, wherein the device end comprises an excitation module, an APUF array module, a response receiving module, a storage module, a state machine module and a response storage module connected in sequence, the response receiving module is connected to a clock generation module, and the response receiving module is connected to the response storage module; The verification end includes a Markov decision module, a CRC check module and a response storage module connected in sequence, the Markov decision module is connected to a state jump counting module, the Markov decision module includes a state jump logic unit connected to the storage module and the state jump counting module, the state jump logic unit is connected to a state space unit connected to the state jump counting module and the CRC check module, and the CRC check module is connected to the response storage module.
2. The physical unclonable function circuit control system based on an arbitrator according to claim 1, characterized in that: The APUF array module includes multiple groups of APUF units arranged in parallel, and the APUF units are connected to the excitation module and the response receiving module.
3. The physical unclonable function circuit control system based on an arbitrator as claimed in claim 2, characterized in that: The APUF unit includes multiple groups of switch units connected in sequence, each of which is connected to a D flip-flop. The switch unit includes two 2-to-1 multiplexers, and the multiplexer is connected to the next-level multiplexer in cascade with it through a wire. The control signal of the multiplexer is connected to the excitation segment.
4. The physical unclonable function circuit control system based on an arbitrator according to claim 1, characterized in that: The excitation module is used to generate an excitation level signal, and the APUF array module generates an intermediate response level signal according to its own entropy source process fluctuation and the delay difference of the excitation signal.
5. The physical unclonable function circuit control system based on an arbitrator according to claim 1, characterized in that: The response receiving module is used to receive the intermediate response level signal transmitted by the APUF array module and the clock signal sent by the clock generating module, and the register module is used to store the intermediate response level signal received by the response receiving module.
6. The physical unclonable function circuit control system based on an arbitrator according to claim 1, characterized in that: The state machine module is used to convert the response signal transmitted by the register module into the forward or backward state jump logic of the state machine to obtain the final state signal.
7. The physical unclonable function circuit control system based on an arbitrator according to claim 1, characterized in that: The response register module is used to store the final state signal formed by the state machine module and the intermediate response level signal received by the response receiving module, and the clock generating module is used to generate a clock signal.
8. The physical unclonable function circuit control system based on an arbitrator according to claim 1, characterized in that: The state jump logic unit is used to form the intermediate response level signal transmitted by the register module into a state control instruction, the state space unit is used to form the state content, and the state jump counting module is used to measure the number of states.
9. The physical unclonable function circuit control system based on an arbitrator according to claim 1, characterized in that: The CRC check module is used to check the status, and the response storage module is used to store the check information.