Hardware fingerprint structure based on carry lookahead chain in FPGA
By introducing a carry-lookahead chain hardware fingerprint structure into the FPGA and utilizing process fluctuations to generate random delays and binarization processing, the problems of FPGA hardware vulnerabilities and cloud security threats are resolved, achieving unique hardware fingerprint generation and enhanced security.
Patent Information
- Application Number
- CN202510895473.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-30
- Publication Date
- 2025-10-17
AI Technical Summary
The security of existing FPGAs faces threats from hardware vulnerabilities, especially in cloud resource sharing environments. Attackers can obtain and rewrite the bitstream through side-channel analysis or power interference, resulting in security risks. Existing bitstream encryption technology is complex and fails to effectively defend against security threats in multi-user leasing modes.
A hardware fingerprint structure based on the carry lookahead chain in FPGA is adopted, including a carry chain, a trigger-hold unit, a controllable ring oscillator, an acquisition and control unit, and a binarization processing unit. Process fluctuations are used to generate random delays, and the hardware fingerprint is generated through the controllable ring oscillator. Finally, a unique binary sequence is generated through binarization processing.
It provides an efficient and secure hardware fingerprint generation method that can generate a unique device ID, enhance the security of the FPGA, and prevent illegal acquisition and rewriting of the bitstream. It is suitable for multi-user cloud FPGA environments.
Smart Images
Figure CN120805202A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of hardware security, and in particular to a hardware fingerprint structure based on a carry chain in an FPGA. BACKGROUND
[0002] If an FPGA is used in a security design, any vulnerability in the hardware can have serious consequences, so the security of the FPGA is a vital issue. The FPGA design is coded in the form of a bitstream and stored in an external Flash, which is loaded into the RAM of the FPGA after power-on and runs, so it is essential to ensure the security of the bitstream. Attackers have many motives to obtain and rewrite the bitstream, including design cloning, IP cracking, design manipulation or design deception (such as through a hardware Trojan).
[0003] In view of the fact that the FPGA is usually an important component of a cyber-physical system such as an aviation, medical or industrial device, such attacks can cause personal injury. Therefore, bitstream encryption technology has been developed by the supplier to provide authenticity and confidentiality. Although attacks against bitstream encryption have been proposed in the past, such as side-channel analysis and probing, these attacks require complex equipment and a large amount of professional technical ability.
[0004] The hardware fingerprint of the FPGA is mainly used for security control in the FPGA application process. For example, bitstream encryption for IP authorization and management in the FPGA or encryption measures to prevent illegal acquisition of user data for cloud FPGAs. As the FPGA enters the cloud, in order to use FPGA resources efficiently and securely, people are developing virtualization methods dedicated to FPGAs, and users can rent FPGA resources like cloud computing and cloud storage, i.e. multiple users can share FPGA structures in time and space. However, the multi-user rental method for cloud FPGA resources has not been widely deployed because the related security risks are still being studied. For example, in an intrusion threat around electrical-related parameters, the attacker either injects interference in a shared power delivery network (PDN) with the aim of causing denial of service or erroneous data transmission. Or measure the power side-channel leakage to extract secret data (such as encryption keys). SUMMARY
[0005] The present application aims to provide a hardware fingerprint structure based on a carry chain in an FPGA to solve the problems in the background art.
[0006] To solve the above technical problems, the present application provides a hardware fingerprint structure based on a carry chain in an FPGA, comprising a carry chain, a trigger holding unit, a controllable ring oscillator, an acquisition and control unit, and a binary processing unit.
[0007] The carry chain is composed of multiple carry chain units connected in series, and the signal propagation time through each carry chain unit cannot be predicted due to process fluctuations;
[0008] The trigger holding unit is composed of DFF triggers in a display lookup table;
[0009] The controllable ring oscillator is formed by connecting one input pin and one output pin of the NAND gate in the carry chain.
[0010] The carry chain and the trigger holding unit form a hardware fingerprint generation and holding circuit based on random delay; the controllable ring oscillator generates an input signal for measurement as an excitation unit, there is a DFF trigger between every two carry chain units, the acquisition and control unit is connected to one of the input terminals of the NAND gate in the controllable ring oscillator to control the enablement of the controllable ring oscillator; the acquisition and control unit is interconnected with the trigger holding unit, and after collecting a certain amount, statistical processing is performed, and the processed data is sent to the binary processing unit to complete hardware fingerprint extraction.
[0011] In an embodiment, the output terminal OUT of each carry chain unit in the carry chain is connected to the input terminal D of a DFF trigger, and the clock terminal CLK of the DFF trigger is connected to the acquisition and control unit; one input terminal of the NAND gate is connected to the acquisition and control unit, and the other input terminal is connected to the output terminal OUT of the last carry chain unit; the output terminal Q of the DFF trigger is connected to the acquisition and control unit.
[0012] In an embodiment, the signal propagation delay from the input terminal to the output terminal of each carry chain unit in the carry chain is determined by process fluctuations, randomly distributed and unpredictable, and this random propagation delay is represented by a numerical value to obtain a random array, which is converted by an algorithm to generate a hardware fingerprint of the FPGA device.
[0013] In an embodiment, the controllable ring oscillator is an oscillator source generated by the ring oscillator RO or clock module inside the FPGA, which is formed by connecting the carry chain into an inverter to form a ring oscillator RO, for generating a Hit signal randomly distributed on the carry chain.
[0014] In an embodiment, the ring oscillator inside the FPGA generates a large number of edge transitions, which fall into different intervals on the carry chain, and the size of the delay value of the interval is represented by the number of accumulated pulse edges falling into the interval.
[0015] In an embodiment, after the acquisition and control unit collects the array representing the delay values of the carry chain units in the carry chain, a segmentation line is generated by a multi-stage curve fitting or segmentation algorithm to make the data distribution on both sides of the curve uniform.
[0016] In one embodiment, the binarization processing unit binarizes the data distinguished by the segmentation algorithm, the data above the segmentation line is "1", and the data below the segmentation line is "0", thereby forming a binary sequence as a unique ID of the device.
[0017] The application provides a hardware fingerprint structure based on a carry chain in an FPGA, and a generated binary sequence has a large number of bits, and theoretically, one display lookup table has four carry chain units, and four bits of the binary sequence can be generated; selecting a continuous carry chain unit as an original element for actually generating the binary sequence can be used as a design method for confusion, so that a certain functional circuit is added to form a strong PUF (Physical Unclonable Functions), or the PUF generated based on the continuous carry chain unit is only used as a representation of a random array, and a PUF with stronger attack resistance is constructed on the basis. BRIEF DESCRIPTION OF DRAWINGS
[0018] Figure 1 is a schematic diagram of a hardware fingerprint implementation structure based on a carry chain in an FPGA.
[0019] Figure 2 is a construction diagram of a carry chain in an FPGA in the hardware fingerprint structure based on the carry chain in the FPGA. DETAILED DESCRIPTION
[0020] The application provides a hardware fingerprint structure based on a carry chain in an FPGA, and a generated binary sequence has a large number of bits, and theoretically, one display lookup table has four carry chain units, and four bits of the binary sequence can be generated; selecting a continuous carry chain unit as an original element for actually generating the binary sequence can be used as a design method for confusion, so that a certain functional circuit is added to form a strong PUF (Physical Unclonable Functions), or the PUF generated based on the continuous carry chain unit is only used as a representation of a random array, and a PUF with stronger attack resistance is constructed on the basis.
[0021] The application provides a hardware fingerprint structure based on a carry chain in an FPGA, and a generated binary sequence has a large number of bits, and theoretically, one display lookup table has four carry chain units, and four bits of the binary sequence can be generated; selecting a continuous carry chain unit as an original element for actually generating the binary sequence can be used as a design method for confusion, so that a certain functional circuit is added to form a strong PUF (Physical Unclonable Functions), or the PUF generated based on the continuous carry chain unit is only used as a representation of a random array, and a PUF with stronger attack resistance is constructed on the basis. Figure 2 The application provides a hardware fingerprint structure based on a carry chain in an FPGA, and a generated binary sequence has a large number of bits, and theoretically, one display lookup table has four carry chain units, and four bits of the binary sequence can be generated; selecting a continuous carry chain unit as an original element for actually generating the binary sequence can be used as a design method for confusion, so that a certain functional circuit is added to form a strong PUF (Physical Unclonable Functions), or the PUF generated based on the continuous carry chain unit is only used as a representation of a random array, and a PUF with stronger attack resistance is constructed on the basis. Figure 2The carry chain 1 is composed of the IN and OUT of the CARRY4 (carry chain unit) in each LUT (Look-Up-Table) connected head to tail; the trigger holding unit 2 is composed of the DFF trigger in the LUT; the controllable ring oscillator 3 is composed of one input pin and one output pin of the NAND gate in the carry chain 1. The output end OUT of each carry chain unit is connected with the input D end of a DFF trigger respectively, and the clock end CLK of the DFF trigger is connected with the acquisition and control unit 4; one input end of the NAND gate is connected with the acquisition and control unit 4, and the other input end is connected with the output end OUT of the last carry chain unit; the output Q end of the DFF trigger is connected with the acquisition and control unit 4.
[0022] The carry chain 1 and the trigger holding unit 2 naturally constitute the hardware fingerprint generation and holding circuit based on random delay; the controllable ring oscillator 3 generates the input signal for measurement as the excitation unit, and there is a DFF trigger between every two carry chain units, and the acquisition and control unit 4 is connected with one of the input ends of the NAND gate in the controllable ring oscillator 3, thereby controlling the enable of the oscillator; the acquisition and control unit 4 is interconnected with the trigger holding unit 2, and after collecting a certain amount, the data is processed and sent to the binary processing unit 5 to complete the hardware fingerprint extraction.
[0023] In the working process of the present application, the output of the DFF trigger and the data in the memory BRAM are cleared by the acquisition and control unit 4, and then the input of the NAND gate in the controllable ring oscillator 3 as the enable end is set to "1", the controllable ring oscillator 3 starts to oscillate, the acquisition and control unit 4 generates the CLK of the trigger holding unit 2 and avoids forming a multiple relationship with the oscillation frequency of the controllable ring oscillator 3 (actually, since the oscillation frequency of the controllable ring oscillator 3 is also random, the CLK frequency can be adjusted according to the actual measurement results); the controllable ring oscillator 3 generates the input signal for measurement as the excitation unit, and there is a DFF trigger between every two carry chain units, and after the data acquisition and control unit 4 is started, the data in the trigger holding unit 2 collected each time is stored in the BRAM, and after a certain amount is collected, the data is processed and sent to the binary processing unit 5 to complete the hardware fingerprint extraction.
[0024] The foregoing embodiment is the simplest implementation form of the present application, and various structures can be changed based on it. For example, the controllable ring oscillator 3 can not add all the carry chain 1, but only needs to reach the starting condition.
[0025] The foregoing description is only the description of the preferred embodiment of the present application, and does not limit the scope of the present application, and any change and modification of the present application by the ordinary skilled in the art according to the foregoing disclosure is within the protection scope of the claims.
Claims
1. A hardware fingerprint structure based on carry lookahead chaining in FPGA, characterized in that: It includes a carry chain, a trigger-hold unit, a controllable ring oscillator, an acquisition and control unit, and a binarization processing unit; The carry chain is composed of multiple carry chain units connected in series. Due to process fluctuations, the propagation time of the signal through each carry chain unit is unpredictable. The trigger hold unit is composed of a DFF trigger in the display lookup table; The controllable ring oscillator is formed by serially connecting an input pin and an output pin of a NAND gate in a carry chain; The carry chain and the trigger-hold unit constitute a hardware fingerprint generation and holding circuit based on random delay; the controllable ring oscillator serves as an excitation unit to generate an input signal for measurement; a DFF trigger is located between every two carry chain units; the acquisition and control unit is connected to one input terminal of a NAND gate in the controllable ring oscillator to control the enabling of the controllable ring oscillator; The acquisition and control unit is interconnected with the trigger holding unit, and performs statistical processing after collecting a certain amount of data, and sends the processed data to the binarization processing unit to complete the hardware fingerprint extraction.
2. The hardware fingerprint structure based on carry lookahead chaining in FPGA according to claim 1, characterized in that: The output end OUT of each carry chain unit in the carry chain is respectively connected to the input D end of a DFF trigger, and the clock end CLK of the DFF trigger is connected to the acquisition and control unit; one input end of the NAND gate is connected to the acquisition and control unit, and the other input end is connected to the output end OUT of the last carry chain unit; the output Q end of the DFF trigger is connected to the acquisition and control unit.
3. The hardware fingerprint structure based on carry lookahead chaining in FPGA according to claim 1, characterized in that: The signal propagation delay from the input end to the output end of each carry chain unit of the carry chain is determined by process fluctuations, is randomly distributed and unpredictable. This random propagation delay is represented by a numerical value to obtain a random array, which is converted into a hardware fingerprint of the FPGA device through an algorithm.
4. The hardware fingerprint structure based on carry lookahead chaining in FPGA according to claim 1, characterized in that: The controllable ring oscillator is the ring oscillator RO inside the FPGA or the oscillation source generated by the clock module. The ring oscillator RO is formed by the carry chain connected in series with the inverter and is used to generate the Hit signal randomly distributed on the carry chain.
5. The hardware fingerprint structure based on carry lookahead chaining in FPGA according to claim 4, characterized in that: The ring oscillator inside the FPGA generates a large number of edge transitions that fall into different intervals on the carry chain. The delay value of the interval is represented by accumulating the number of pulse edges that fall into the interval.
6. The hardware fingerprint structure based on carry lookahead chaining in FPGA according to claim 5, characterized in that: After the acquisition and control unit collects the array representing the delay values of the carry chain units in the carry chain, it generates a segmentation line that evenly distributes the data on the upper and lower sides of the curve through a multi-order curve fitting or segmentation algorithm.
7. The hardware fingerprint structure based on carry lookahead chaining in FPGA according to claim 6, characterized in that: The binarization processing unit performs binarization processing on the data differentiated by the segmentation algorithm, where the data above the segmentation line is "1" and the data below the segmentation line is "0", thereby forming a binary sequence that serves as a unique ID for the device.