SYSTEMS AND METHODS FOR PROVIDING RELIABLE PHYSICALLY UNCLONABLE FUNCTIONS

Abstract

Method for determining the reliability of a PUF cell (402), PUF: physically unclonable function, of a device comprising the following steps: Providing (1402) a first signal (WL1a) for a first branch (406) of a PUF cell (402) and a second signal (WL1b) for a second branch (408) of the PUF cell (402), wherein the first (WL1a) and the second signal (WL1b) are provided synchronously; Determine (1404) a PUF cell base value based on an output signal of the PUF cell (402) generated by the first signal (WL1a) and the second signal (WL1b); Providing (1406) a third signal for the first branch (406) and a fourth signal for the second branch (408), wherein the third and fourth signals are provided asynchronously; Determine (1408) a loaded PUF cell value based on an output signal of the PUF cell (402) generated by the third and fourth signals; and Determine (1410) that the PUF cell (402) is unusable, based on a difference between the PUF cell baseline value and the stressed PUF cell value, wherein the PUF cell has two essentially similar transistors (1106, 1108), one (1106) being associated with the first branch (406) and another (1108) being associated with the second branch (408), each transistor (1106, 1108) controlling a voltage of a signal line (BL, BL#), and the gate of one transistor (1106) is controlled by the first signal (WL1a) and the gate of the other transistor (1108) by the second signal (WL1b), and Determining the PUF cell base value involves amplifying a difference between the signal lines (BL, BL#), wherein the difference between the signal lines (BL, BL#) is generated by a synchronous change in the level of the first signal (WL1a) and the second signal (WL1b).

Description

background

[0001] A physically unclonable function (PUF) refers to a physical structure embodied in a physical device. Today, PUFs are mostly implemented in integrated circuits and are typically used in applications with safety requirements. Although integrated circuits (ICs) are mass-produced, each IC is unique due to physical randomness, despite the same manufacturing process and materials. This inherent variation can be extracted and used as a unique identifier for the IC.

[0002] US Patent 2019 / 0378575 A1 discloses a method and a device for characterizing physically unclonable functions implemented in semiconductor devices. US Patent 2019 / 0058603 A1 describes a device for generating physically unclonable functions using an amplifier, wherein the amplifier is configured to receive the signal from a memory cell. Brief description of the drawings

[0003] Aspects of the present invention are best understood with reference to the detailed description below in conjunction with the accompanying drawings. It should be noted that, in accordance with common industry practice, various elements are not drawn to scale. Rather, for the sake of clarity of discussion, the dimensions of the various elements may be arbitrarily enlarged or reduced. Fig. Figure 1 is a block diagram showing a verifiable PUF signature module for generating a PUF signature that identifies an integrated circuit according to an exemplary embodiment. Fig. Figure 2 is a diagram showing a PUF cell mask according to one embodiment. Fig. Figure 3 is a circuit diagram showing a control signal generator which, according to one embodiment, sends control signals to cells of a PUF matrix. Fig. Figure 4 is a circuit diagram showing an exemplary structure of a column of PUF cells according to an exemplary embodiment. Fig. Figure 5 is a timing diagram showing signals received and generated by a PUF cell when its input signals are provided synchronously according to an exemplary embodiment. Fig. Figure 6 is a timing diagram showing signals received and generated by a PUF cell when its input signals are provided asynchronously according to an exemplary embodiment. Fig. Figure 7 is a diagram showing exemplary PUF cell outputs based on different simulated load conditions in an exemplary embodiment. Fig. Figure 8 is a block diagram showing a first control signal generation circuit according to an exemplary embodiment. Fig. Figure 9 shows a first circuit for generating control signals WLa / WLb from a WL selection signal according to one embodiment. Fig. Figure 10 shows a second circuit for generating control signals WLa / WLb, which includes precharging, according to embodiments. Fig. Figure 11 is a diagram showing an exemplary structure of a column of PMOS-based PUF cells according to an exemplary embodiment. Fig. Figure 12 shows a circuit for generating active low control signals WLa / WLb from a WL selection signal according to embodiments. Fig. Figure 13 is a diagram showing a PUF matrix with different PUF cell structures across columns according to embodiments. Fig. Figure 14 is a flowchart showing the steps of a procedure for determining the reliability of a PUF cell of a device according to embodiments. Detailed description

[0004] The following description provides many different embodiments or examples for implementing various features of the provided subject matter. Specific examples of components and arrangements are described below. For example, the fabrication of a first element over or on top of a second element in the following description may include embodiments in which the first and second elements are fabricated in direct contact, and it may also include embodiments in which additional elements can be fabricated between the first and second elements such that the first and second elements are not in direct contact. Furthermore, reference numerals and / or letters may be repeated in the various examples in the present invention.This repetition serves the purpose of simplicity and clarity and does not in itself prescribe any relationship between the various designs and / or configurations discussed.

[0005] Furthermore, spatially relative terms, such as "located below," "under," "lower," "located above," "upper," and the like, can be used here to simply describe the relationship of an element or structure to one or more other elements or structures depicted in the figures. These spatially relative terms are intended to encompass orientations of the device in use or operation beyond the orientation shown in the figures. The device may be oriented differently (rotated by 90 degrees or in a different orientation), and the spatially relative descriptors used here can be interpreted accordingly.

[0006] A PUF is a physically defined "digital fingerprint" that serves as a unique identifier for a semiconductor device, such as a microprocessor. PUFs are based on unique, usually random, physical variations that naturally occur during semiconductor manufacturing. A PUF value can take the form of a bit sequence that can be used as a unique or nearly unique value to identify a particular device, for example, during transmission from an IoT (Internet of Things) device; as an encryption code to protect the content of a transmitted message; or as a digital signature that confirms the identity of a device transmitting data, as will be explained in more detail later.

[0007] Because a PUF value relies on the randomness of a manufacturing process (e.g., different PUF cells providing different bit values ​​based on slight variations between two transistors with similar structures), the behavior and reliability of PUF cells are only known after the device has been manufactured. In some cases, a PUF cell may exhibit anomalous or unreliable behavior. For example, if the output of a PUF cell is determined by very small differences between manufactured transistors, then, in cases where these transistors are identical or nearly identical, the output of that PUF cell may not be reliably the same during each read operation, as required by a unique identifier. A PUF cell that outputs a value of 1 in some cases and a value of 0 in others (a "weak bit" or a "dark bit") is usually undesirable.The operating environment (e.g., thermal conditions, supply voltage fluctuations) can create conditions that make such undesirable fluctuations more likely to occur. Systems and methods described here by way of embodiment provide mechanisms for testing the reliability of PUF cells in order to identify PUF cells whose bit values ​​are unlikely to change even under high loads in the operating environment ("strong bits").

[0008] Fig. Figure 1 is a block diagram showing a testable PUF signature module 102 for generating a PUF signature that identifies an integrated circuit according to an exemplary embodiment. The PUF signature module 102 has a PUF matrix 104, which in embodiments is a matrix of PUF cells, wherein the value of each PUF cell depends on manufacturing process variations, such that PUF matrices from different PUF signature modules 102 generate different signatures. The PUF matrix 104 can have different sizes (e.g., 8 x 8, 16 x 16, 16 x 32, 64 x 64), with larger matrices enabling longer signatures that are more likely to be unique and are more difficult to replicate (e.g., crack).

[0009] The PUF signature module 102 includes certain components for checking the reliability of cells of the PUF matrix 104. In the example of Fig. In Figure 1, a control signal generator 106 is configured to provide activation signals for PUF cells in the PUF matrix 104. In embodiments, the control signal generator 106 is configured to provide these control signals in different modes. In one mode (e.g., an operating mode), the control signal generator 106 provides control signals for inputs of a PUF cell simultaneously or substantially simultaneously (i.e., synchronously). In a second mode (e.g., a test mode), the control signal generator 106 provides control signals for inputs of the PUF cell at different times (e.g., for an input of the PUF cell shortly after an input of another PUF cell) (i.e., asynchronously) to simulate a load on the PUF cell.In embodiments, a PUF strength analyzer 108 can instruct the control signal generator 106 to provide control signals for the PUF matrix 104 and can evaluate the outputs of the PUF cells based on control signals from the control signal generator 106. If the PUF cell provides conflicting output values ​​in the different control modes provided by the control signal generator 106, the PUF strength analyzer 108 can consider the PUF cell to be a weak bit that is not sufficiently reliable for use in the unique signature generated by the PUF matrix 104.

[0010] The PUF signature module 102 can operate in various modes. In a first test mode, the PUF signature module 102 checks the cells of the PUF matrix 104 to determine a number of PUF cells that are sufficiently reliable for use as a device identifier. In this test mode, which is controlled by the PUF strength analyzer 108, the control signal generator 106 can provide input signals for a PUF cell with different timing (e.g., synchronous, asynchronous). The PUF strength analyzer 108 monitors the output of the PUF cell to determine whether it changes based on simulated load conditions. Changes in output may lead the PUF strength analyzer 108 to classify the PUF cell as weak. The PUF strength analyzer 108 tracks a number of weak (or strong) PUF cells and outputs a usable PUF bit count of 110.

[0011] The usable PUF bit count of 110 can be used as a suitability or classification value for the PUF signature module 102. For example, the PUF signature module 102 can be considered faulty if the usable PUF bit count of 110 is less than a threshold number. Alternatively, the PUF signature module 102 can be assigned to a class based on the usable PUF bit count of 110. For example, for a PUF matrix 104 with 1024 (32 x 32) bits, the module 102 can be considered approved for high-security applications (where, for example, sensitive data is to be transmitted using encryption, and confirmation of the identity of the module 102 is critical, e.g., in military applications) if the usable PUF bit count of 110 is greater than 999. In this example, module 102 can be used for operations with lower safety (e.g.,Module 102 can be considered approved for an IoT application (such as a refrigerator or other device, e.g., a TV) if the usable PUF bit count is greater than 799 but less than 1000. Module 102 can be identified as faulty if the usable PUF bit count is less than 800.

[0012] In a second mode, an initialization mode, the control signal generator 106 again provides control signals for the PUF matrix 104 synchronously and asynchronously upon command of the PUF strength analyzer 108, whereby the PUF strength analyzer 108 monitors the PUF matrix 104 to identify weak PUF cells (e.g., PUF cells whose output changes under simulated load conditions) in order to generate a mask that is stored in a mask memory 112 and identifies PUF cells that are considered too unreliable for use in generating the unique identifier of the module 102.

[0013] Fig. Figure 2 is a diagram showing a PUF cell mask 202 according to one embodiment. The mask 202 is used for a 64-bit (8 x 8) PUF matrix. A first iteration of the mask 202 is provided by controlling the PUF cells in an operation-like mode (where, for example, inputs to the PUF cells are provided synchronously) to identify PUF cell values ​​(low "L" or high "H") for each PUF cell. PUF cell output values ​​that change when operation-like control signals are provided multiple times are likely to be very weak and are marked as unreliable with an "X" in the mask 202. The control signal generator 106 then provides control signals in a load mode (for example, slightly asynchronous) to identify further PUF cells whose output changes under load.PUF cells whose values ​​change under simulated load can be considered unreliable and are marked in a mask 204 (with an “X”) which is stored in the mask memory 112.

[0014] Let's return to Fig. 1. After the masks are generated and stored in the mask memory 112, the PUF signature module 102 is ready to output its unique identifier (e.g., via a secure channel 114). Specifically, the control signal generator 106 activates the PUF matrix 104 using operating-mode control signals (e.g., signals that are synchronous), providing the resulting PUF cell values ​​to a signature generator 116. The signature generator 116 accesses the mask from the mask memory 112 and ignores PUF cell values ​​of bits identified as unreliable by the mask. The signature generator 116 sends the resulting signature to a receiver, which then associates the signature with the special PUF signature module 102. The signature transmission can occur in various ways, such as via one or more secure ports that are deactivated after the signature is output (e.g.,by triggering a security measure), or in encrypted form using a public key of the receiving device. In some lower-security examples, the signature may be issued in plain text form over an insecure channel.

[0015] Once the signature of module 102 has been associated with the module, it can be used in operating mode. In operating mode, the PUF signature module 102 regenerates its signature (e.g., once when the integrated circuit is switched on, when an external communication of each integrated circuit is initiated), with the control signal generator 106 providing operating control signals (e.g., synchronously) for the PUF matrix 104, and the signature generator 116 generating the signature from the output of the PUF matrix 104, ignoring unreliable PUF cells identified by the mask accessed by the mask memory 112.

[0016] The signature is then used to transmit data from the integrated circuit. In one example, the signature of module 102 is appended by signature generator 116 (e.g., in a header) to output data 118 from the integrated circuit, which is sent at 120 by the integrated circuit to identify the source of the data just transmitted. In another example, the data is signed by signature generator 116 using the signature, so that the recipient of the signed data can verify the source of this data. In yet another example, signature generator 116 encrypts the output data 118 using the signature, so that the encrypted data can be decrypted by a recipient who previously received the signature and associated it with the integrated circuit on which the PUF signature module 102 resides.

[0017] Fig. Figure 3 is a circuit diagram showing a control signal generator 106 which, in one embodiment, sends control signals to cells of a PUF matrix. The PUF matrix comprises a plurality of PUF cells 1.1, ..., nm, arranged in n rows and m columns. Each PUF cell receives two input signals (e.g., WL1a and WL1b are received by PUF cells 1.1, 1.2, ..., 1.m) and provides an output signal over two bit lines (e.g., 302 and 304). The control signal generator 106 provides control signals to activate PUF cells of a row of the PUF matrix 104 simultaneously. The m columns of PUF cells are each associated with a read amplifier SA1, SA2, ..., SAm. Each read amplifier is configured to sample which of the two bit lines it responds to (e.g., 302 and 304 for read amplifier SA1) is at a higher level, determining a value for a PUF cell accordingly [if, for example,WL2a and WL2b PUF cells of the second row of the matrix are activated by the read amplifier SA1, which determines that PUF cell 2.1 has a high value (1) when it is sampled that bit line 302 is at a higher level than bit line 304, and that PUF cell 2.1 has a low value (0) when it is sampled that bit line 302 is at a lower level than bit line 304.

[0018] To generate a signature for the PUF signature module 102, the control signal generator 106 activates the PUF cells of the matrix 104 row by row, with the read amplifiers determining whether the PUF cells of that row have high or low values. The signature generator 116 detects the high / low read amplifier outputs and can ignore PUF cell bits when instructed by the mask accessed by the mask memory 112 to determine the signature of the integrated circuit.

[0019] PUF cells, whose value changes based on manufacturing process variations, can take on different forms. Fig. Figure 4 is a circuit diagram showing an exemplary structure of a column of PUF cells according to an exemplary embodiment. Each PUF cell (e.g., 402 and 404, which, for example, represent PUF cells 1.1 and 2.1 of Fig. 3) has two similarly structured transistors (e.g., NMOS transistors 406 and 408 for the PUF cell 402). The PUF cell 402 receives two input signals WL1a and WL1b, where input signal WL1a controls the gate of transistor 406 and input signal WL1b controls the gate of transistor 408. One terminal of each transistor 406 and 408 is connected to a bit line, i.e., transistor 406 is connected to bit line 1 (BL#), and transistor 408 is connected to bit line 2 (BL), with the other terminal connected to a common ground node.

[0020] Fig. Figure 5 is a timing diagram showing signals received and generated by PUF cell 402 when its input signals are provided synchronously according to an exemplary embodiment. As explained above, control signals (WL1a and WL1b) for the inputs of the PUF cell (e.g., the gates of transistors 406 and 408) are provided synchronously (i.e., simultaneously or substantially simultaneously) to determine a PUF cell base value in a test mode or to determine a PUF cell value in an operating mode. A pre-charge signal (PreCh#) goes low, so that the two bit lines BL and BL# are charged to a high level. The control signals WL1a and WL1b are simultaneously pulled high, so that transistors 406 and 408 are activated. The now active transistors 406 and 408 pull the bit lines low. Process fluctuations (e.g.,However, slight differences in the manufactured structure between transistors 406 and 408 cause transistors 406 and 408 to pull the bit lines BL and BL# low at slightly different speeds (e.g., transistor 408 pulls the bit line BL low faster than transistor 406 pulls the bit line BL# low). During the transition of the bit lines BL and BL#, a read amplifier 410 (e.g., SA1 of 406) is used. Fig. 3) activated via a read amplifier activation signal SAEN. The read amplifier 410 is configured to detect a difference between signal levels on the bit lines BL and BL# upon activation and to activate the bit line that is at a higher level (i.e., BL# in the example of Fig. 5), pulls up to a high level and the bit line that is at a lower level (i.e., BL in the example of Fig. 5) pulls to a low level. The read amplifier 410 outputs a corresponding data value (output) for the PUF cell, based on which one of the bit lines BL and BL# was pulled to a high level; for example, it outputs a high value (1) when BL is pulled high, and it outputs a low value (0) when BL# is pulled high. After sampling a PUF cell value for PUF cell 402, the control signal generator 106 can reload the bit lines and activate PUF cell 404 via control lines WL2a and WL2b in a similar manner, the PUF cell value for PUF cell 404 being determined together with the read amplifier 410, with subsequent rows of PUF cells being activated and detected in a similar manner.

[0021] As explained above, the control signal generator 106 can simulate a load on PUF cells by asynchronously providing control signals. Fig. Figure 6 is a timing diagram showing signals received and generated by PUF cell 402 when its input signals (WL1a and WL1b) are provided asynchronously according to an exemplary embodiment. As in the example of Fig. In step 5, a pre-charge signal (PreCH#) is activated to low in order to charge the bit lines BL / BL# to a high level. The control signal generator 106 also activates the PUF cell 402 by setting the input signals WL1a and WL1b high. However, in this example, the control signal generator 106 activates the control signal WL1b, which controls transistor 408, a short time (e.g., 1 ms, 2 ms, 1 µs, 2 µs, 1 ns, tenths of a ps) later than the control signal WL1a is activated. After receiving their respective activation signals, transistors 406 and 408 begin to pull their respective bit lines low via the common ground node. In the example of Fig. 6. When the read amplifier 410 is activated, transistor 408 pulls bit line 2 BL lower than transistor 406 pulls bit line 1 BL#, even though transistor 408 is activated later than transistor 406. Thus, it is detected that the PUF cell 404 provides the same output, even though the simulated load is achieved by asynchronously activating transistors 408 and 406. This consistent output indicates a more powerful and reliable PUF cell.

[0022] During a test mode to generate a usable PUF bit count 110 or during an initialization mode when a PUF cell mask is generated for the mask memory 112, the control signal generator 106 can test the PUF cells under various simulated load conditions. Fig. Figure 7 is a diagram showing exemplary PUF cell outputs based on different simulated load conditions in an exemplary embodiment. The control signal generator 106 is configured to delay each of the control signals (e.g., WL1a and WL1b) by 10 ps, ​​1 µs, 20 ps, ​​and 30 ps in each of the tables shown, for a total of 16 combinations of load simulation delays. PUF cell outputs are tracked across these sixteen tests (4 tests synchronously, in which the control signals are provided simultaneously at the diagonal inputs; 6 tests in which the first control signal, WL1a, is activated first; and 6 tests in which the second control signal, WL1b, is activated first), with these outputs indicated in the tables. In a first table 702, the PUF cell outputs a low value (0) in all 16 tests. This is an indication of a strong PUF cell.Similarly, in a second table, 704, the PUF cell outputs a high value (1) in all 16 tests, again indicating a strong PUF cell. In a third table, 706, the PUF cell provides different outputs, even when receiving control signals synchronously (i.e., a 0 is output when both input signals are delayed by 0 ps, ​​10 ps, ​​and 30 ps, ​​but a 1 is output when both input signals are delayed by 20 ps). This table indicates a weak PUF cell bit, which should be ignored when generating a device identifier. A fourth table, 708, represents a PUF cell that provides a low output value (0) in all cases except when control line WL1a is delayed by 30 ps relative to control line WL1b.In some implementations, this may be a sufficiently significant anomaly to identify the PUF cell as weak and integrate it into a mask of bits to be ignored. In some cases, this anomaly may be considered by the PUF Strength Analyzer 108 as an anomaly of insufficient significance (e.g., based on a combination of predefined criteria) for identifying an unreliable cell. In another example, the anomaly in Table 708 may cause the PUF Signature Module 102 and its corresponding integrated circuit to be classified as a module / circuit with a lower quality level, which may affect pricing or permissible deployment scenarios.

[0023] Various circuits can be used to implement a control signal generator 106. Fig. Figure 8 is a block diagram showing a first control signal generation circuit according to an exemplary embodiment for the synchronous and asynchronous generation of control line signals (e.g., on WL1a / WL1b) for implementing the exemplary systems and methods described above. Each pair of control lines (e.g., WL1a / WL1b and WL2a / WL2b) can be connected to the circuit of Fig. The system comprises 8 components. A first group of inputs to an adjustable delay line (STa[0], STa[1], STa[2]; STb[0], STb[1], STb[2]) enables or disables groups of 1, 2, or 4 delay buffers. Cycle multiplexers are then controlled by a second group of inputs (SMa[1], SMa[2]; SMb[1], SMb[2]) such that different delays are applied to respective control signals WL1a and WL1b, with each pair of control signals being selected based on a word line decode signal (e.g., a decode signal that cycles stepwise through each row of the PUF matrix 104). A circuit arrangement associated with the word line selection input (e.g., a signal indicating that the PUF cells associated with control lines WL1a and WL1b should be operated with different delays) is configured to be accessed by multiplexer inputs 00, 01, 10, 11 on each of the sub-lines of the pair of control lines (e.g.,WL1a / WL1b, WL2a / WL2b) cycled.

[0024] If the control signal generation circuit of Fig. With 8 adjustable delays activated via their control lines STa / b, delays can also be generated directly from a PUF cell row selection signal. Fig. Figure 9 shows a first circuit for generating WLa / WLb control signals from a WL selection signal according to some embodiments. The left circuit provides control signals for the WLa control line, and the right circuit provides control signals for the WLb control line. When a row of PUF cells connected to the circuit of Fig. 9 are associated, and when a high-level selection signal is used during WL selection, a lower NMOS transistor is switched off, enabling selective loading of the WLa / WLb lines via the multiplexers. The buffer array at the multiplexer input is configured to cycle through the possible multiplexer input values ​​(i.e., 00, 01, 10, 11) based on receiving the single selection signal during WL selection. The multiplexers are configured to select one of four delay lengths to be applied before loading (e.g., 0, 2, 4, or 6 delay units). The WLa / WLb lines are loaded when the selected delay is applied via an upper PMOS transistor (i.e., a low output from the multiplexer indicates that the delay is complete and the control line (e.g.,WLa, WLb) should be switched on] as well as the PUF cell row being selected via the lower PMOS transistor [i.e., the low signal on WL selection switches on the lower PMOS transistor, thus providing a path from the source to the control line (WLa / WLb) when the upper PMOS transistor is switched on]. By selection signals for the two multiplexers, signals WLa / WLb can be selected with different time differences between them (e.g., from 0 ps to 30 ps, ​​as in . Fig. 7 is shown) will be sent.

[0025] Fig. Figure 10 shows a second circuit for generating control signals WLa / WLb, which in some embodiments includes pre-charging. The circuit of Fig. 10 works similarly to the one from Fig. 9, but it differs in that respect from Fig. 9 specifies which PMOS transistors receive the PUF cell row selection signal and the delayed signal from the multiplexer. In the example of Fig. 10. The upper PMOS transistors are activated when the PUF cell row is selected, thus enabling a precharge of the node between the PMOS transistors. This precharge is then applied to the control signal line WLa / WLb as the selected delay, commanded by the multiplexer's output signal, elapses. The circuit of Fig. 10 can enable a shorter rise time of the signals WLa / WLb when passing through the selected delay duration by precharging between the PMOS transistors.

[0026] As explained above, PUF cells can take on various forms. Fig. Figure 11 is a diagram showing an exemplary structure of a column of PMOS-based PUF cells according to an exemplary embodiment. Each PUF cell (e.g., 1102 and 1104) has two similarly structured transistors (e.g., PMOS transistors 1106 and 1108 for PUF cell 1102). PUF cell 1102 receives two input signals WL1a and WL1b, where input signal WL1a controls the gate of transistor 1106 and input signal WL1b controls the gate of transistor 1108. One terminal of each transistor 1106 and 1108 is connected to a bit line, i.e., transistor 1106 is connected to bit line 1 (BL#), and transistor 1108 is connected to bit line 2 (BL), with the other terminal connected to a common source node.

[0027] A timing diagram 1120 shows signals received and generated via the PUF cell 1102 when its input signals are supplied synchronously. As explained above, control signals (WL1a and WL1b) for the inputs of the PUF cell (e.g., the gates of transistors 1106 and 1108) are supplied synchronously (i.e., simultaneously or substantially simultaneously) to establish a PUF cell base value in a test mode or to establish a PUF cell value in an operating mode. (Signals WL1a / WL1b supplied synchronously are shown in Fig. (11 represented as a single signal WL.) A pre-charge signal (PreCh#) goes high, so the two bit lines BL and BL# are loaded to a low level. The control signals WL1a and WL1b are simultaneously pulled low, activating transistors 1106 and 1108. The now active transistors 1106 and 1108 pull the bit lines high via the common source node between transistors 1106 and 1108. However, process variations (e.g., slight differences in the manufactured structure between transistors 1106 and 1108) cause transistors 1106 and 1108 to pull the bit lines BL and BL# high at slightly different rates (e.g., transistor 1108 pulls the bit line BL high faster than transistor 1106 pulls the bit line BL# high). During the transition of the bit lines BL and BL#, a read amplifier 1110 is activated via a read amplifier activation signal SAEN.The reading amplifier 1110 is configured to detect a difference between signal levels on the bit lines BL and BL# upon activation and to select the bit line that is at a higher level (i.e., BL in the example of ). Fig. 11), pulls to a high level and the bit line that is at a lower level (i.e., BL# in the example of Fig. 11), pulls to a low level. The read amplifier 1110 outputs a corresponding data value (output) for the PUF cell, based on which one of the bit lines BL and BL# was pulled to a high level [e.g., it outputs a high value (1) when BL is pulled high, and it outputs a low value (0) when BL# is pulled high]. After sampling a PUF cell value for PUF cell 1102, the control signal generator 106 can reload the bit lines and can activate PUF cell 1104 via control lines WL2a and WL2b in a similar manner, the PUF cell value for PUF cell 1104 being determined together with the read amplifier 1110, with subsequent rows of PUF cells being activated and detected in a similar manner. In the example of Fig. 11. Control signals WL1a / WL1b are provided synchronously, but PUF cell load conditions can also be simulated in other ways, as shown in other examples here, for example by asynchronously providing these control signals to the PUF cell.

[0028] Fig. Figure 12 shows a circuit for generating active-low control signals WLa / WLb from a WL selection signal according to some embodiments. When a row of PUF cells is connected to the circuit of Fig. When the 12 associated lines are selected via a low-level signal, a lower NMOS transistor is turned on, enabling selective discharge of the WLa / WLb lines through the multiplexers. The multiplexers are configured to select one of four delay lengths to be applied before charging (e.g., 0, 2, 4, or 6 delay units). The WLa / WLb lines are discharged when both the selected delay is applied via an upper NMOS transistor and the PUF cell row is selected via the lower NMOS transistor. These lines are charged via the upper PMOS transistor when the PUF cell row is not selected. Selection signals for the two multiplexers allow WLa / WLb signals to be sent with different time differences between them, enabling synchronous transmission during both operational and near-operational modes.

[0029] Examples of a PUF cell at the transistor level show structures of a single column of a PUF matrix 104. In some embodiments, the individual columns of a PUF matrix 104 are structured essentially identically (i.e., each column of the PUF matrix 104 is structured in the same way as the exemplary column of Fig. 4) In some embodiments, different columns of a PUF matrix 104 can be structured differently. For example, Fig. Figure 13 shows a circuit diagram illustrating a PUF matrix 104 with different PUF cell structures across columns according to some embodiments. In the example of Fig. 13 is a first column 1302 (or odd-numbered columns or even-numbered columns) of the PUF matrix 104, essentially identical to the column of the PUF matrix of Fig. 11 structured, where a left PMOS transistor is controlled by a first control line (e.g., WL1a) and a right PMOS transistor is controlled by a second control line (e.g., WL2a). In the next column 1304, the left PMOS transistor is controlled by the second control line (e.g., WL2a), and the right PMOS transistor is controlled by the first control line (e.g., WL1a). The structure of Fig. The pattern 13 can be repeated for other groups of two columns in the PUF matrix 104. Such structural arrangements, which change across rows or columns of a PUF matrix, can increase the probability of generating a unique identifier for integrated circuits.

[0030] Fig. Figure 14 is a flowchart showing the steps of a method for determining the reliability of a PUF cell of a device according to embodiments. For clarity, the steps are described below for structures discussed above, but the steps can also be used for numerous other structures. In step 1402, a first signal (WL1a) is provided for a first branch 406 of a PUF cell, and a second signal (WL1b) is provided for a second branch 408 of the PUF cell, the first and second signals being provided synchronously (see, for example, Figure 1402). Fig. 5) In step 1404, a PUF cell base value is determined based on an output signal of the PUF cell generated by the first and second signals. In step 1406, a third signal is provided for the first branch 406, and a fourth signal is provided for the second branch 408, with the third and fourth signals being provided asynchronously (see, for example, Fig. 6) In step 1408, a loaded PUF cell value is determined based on an output signal of the PUF cell generated by the third and fourth signals. In step 1410, the PUF cell is determined to be unusable based on a difference between the PUF cell base value and the loaded PUF cell value (see, for example, Fig. 7).

[0031] According to some embodiments, a method is provided for determining the reliability of a PUF cell (PUF: physically unclonable function) of a device. A first signal is provided for a first branch of a PUF cell, and a second signal is provided for a second branch of the PUF cell, the first and second signals being provided synchronously. A PUF cell baseline value is determined based on an output signal of the PUF cell generated by the first and second signals. A third signal is provided for the first branch, and a fourth signal is provided for the second branch, the third and fourth signals being provided asynchronously. A loaded PUF cell value is determined based on an output signal of the PUF cell generated by the third and fourth signals.The PUF cell is determined to be unusable based on a difference between the PUF cell baseline value and the stressed PUF cell value.

[0032] According to embodiments, a device configured to provide a PUF value (PUF: Physically Unclonable Function) has a plurality of PUF cells, each configured to make a PUF contribution to the PUF value. Each of the PUF cells has the following: a first transistor having a gate controlled by a first control line, a first terminal connected to a first signal line, and a second terminal connected to a common node; and a second transistor having a gate controlled by a second control line, a first terminal connected to a second signal line, and a second terminal connected to the common node.A read amplifier is configured to detect a signal level difference between the first and second signal lines to determine a PUF cell value, and a control signal generator is configured to provide signals for the first and second control lines both synchronously and asynchronously to identify unusable cells based on changes in the PUF cell value.

[0033] In a further embodiment, a device with a cell configured to provide a PUF value (PUF: Physically Unclonable Function) comprises: a first transistor having a gate controlled by a first control line, a first terminal connected to a first signal line, and a second terminal connected to a common node; and a second transistor having a gate controlled by a second control line, a first terminal connected to a second signal line, and a second terminal connected to the common node, wherein a read amplifier is configured to detect a signal level difference between the first and second signal lines in order to determine a PUF cell value.

Claims

[1] Method for determining the reliability of a PUF cell (402), PUF: physically unclonable function, of a device comprising the following steps: Providing (1402) a first signal (WL1a) for a first branch (406) of a PUF cell (402) and a second signal (WL1b) for a second branch (408) of the PUF cell (402), wherein the first (WL1a) and the second signal (WL1b) are provided synchronously; Determine (1404) a PUF cell base value based on an output signal of the PUF cell (402) generated by the first signal (WL1a) and the second signal (WL1b); Providing (1406) a third signal for the first branch (406) and a fourth signal for the second branch (408), wherein the third and fourth signals are provided asynchronously; Determine (1408) a loaded PUF cell value based on an output signal of the PUF cell (402) generated by the third and fourth signals; and Determine (1410) that the PUF cell (402) is unusable, based on a difference between the PUF cell baseline value and the stressed PUF cell value, wherein the PUF cell has two essentially similar transistors (1106, 1108), one (1106) being associated with the first branch (406) and another (1108) being associated with the second branch (408), each transistor (1106, 1108) controlling a voltage of a signal line (BL, BL#), and the gate of one transistor (1106) is controlled by the first signal (WL1a) and the gate of the other transistor (1108) by the second signal (WL1b), and Determining the PUF cell base value involves amplifying a difference between the signal lines (BL, BL#), wherein the difference between the signal lines (BL, BL#) is generated by a synchronous change in the level of the first signal (WL1a) and the second signal (WL1b). [2] The method of claim 1, wherein the third and fourth signals are spaced apart in time by a fixed amount, the method further comprising: Providing a fifth signal for the first branch (406) and a sixth signal for the second branch (408), wherein the fifth and sixth signals are separated in time by a second fixed amount; and Determining a second loaded PUF cell value based on an output signal of the PUF cell (402) generated by the fifth and sixth signals. [3] The method of claim 2, further comprising: Determine that the PUF cell (402) is unusable, based on a difference between the PUF cell baseline value and the second stressed PUF cell value. [4] A method according to any of the preceding claims, further comprising: Repeating the provision of a first (WL1a) and a second signal (WL1b), the determination of a PUF cell baseline value, the provision of a third and a fourth signal, and the determination of a stressed PUF cell value for a plurality of further PUF cells (404, 1102, 1104) in order to determine further unusable PUF cells (404, 1102, 1104). [5] A method according to any of the preceding claims, further comprising: Storing a mask (202) in a machine-readable memory (112) which, based on reliability requirements, identifies PUF cells (402, 404, 1102, 1104) of the device that are unusable. [6] The method of claim 5, further comprising: Determining a device signature based on usable PUF cells (402, 404, 1102, 1104) using the mask (112); and Sending the device signature from the device using a secure channel (114). [7] A method according to any of the preceding claims, further comprising: Providing a first operating signal for the first branch (406) of the PUF cell (402) and a second operating signal for the second branch (408) of the PUF cell (402), wherein the first and second signals are provided synchronously; and Determining an operational PUF cell value based on an output signal of the PUF cell (402) generated by the first and second operating signals, wherein the operational PUF cell value is used as a component of a signature of the device during operation. [8] Method according to claim 1, wherein a terminal of each of the transistors (1106, 1108) is connected to a ground node or a source node. [9] Method according to any one of claims 1 to 8, further comprising pre-charging or pre-discharging the signal lines (BL, BL#) prior to providing the first (WL1a) and second signal (WL1b). [10] A method according to any of the preceding claims, further comprising: Determining a number of unusable PUF cells (402, 404, 1102, 1104) associated with the device, wherein the device is classified or discarded based on the number of unusable PUF cells (402, 404, 1102, 1104). [11] Device configured to provide a PUF value, PUF: Physically Unclonable Function, with: a plurality of PUF cells (402, 404, 1102, 1104) each configured to make a PUF contribution to the PUF value, each of the PUF cells (402, 404, 1102, 1104) having the following: a first transistor (1106) comprising a gate controlled by a first control line (WL1a), a first terminal connected to a first signal line (BL#), and a second terminal connected to a common node; and a second transistor (1108) which has a gate controlled by a second control line (WL1b), a first terminal connected to a second signal line (BL), and a second terminal connected to the common node; a read amplifier (410) configured to detect a signal level difference between the first (BL#) and the second signal line (BL) to determine a PUF cell value, wherein the signal level difference is generated by a synchronous change in the level of the first control line (WL1a) and the second control line (WL1b); and a control signal generator (106) configured to provide signals for the first (WL1a) and second control lines (WL1b) both synchronously and asynchronously to identify unusable cells (402, 404, 1102, 1104) based on changes in the PUF cell value. [12] Device according to claim 11, wherein the first (WL1a) and the second control line (WL1b) are connected to a plurality of PUF cells (402, 404, 1102, 1104) for simultaneously controlling the plurality of PUF cells (402, 404, 1102, 1104). [13] Device according to claim 11 or 12, wherein the control signal generator (106) comprises a first multiplexer for selecting a delay for a signal on the first control line (WL1a) and a second multiplexer for selecting a delay for a signal on the second control line (WL1b). [14] Device according to one of claims 11 to 13, wherein the control signal generator (106) is configured to control the PUF cells (402, 404, 1102, 1104) in such a way as to determine whether PUF cell values ​​change when signals for the first (WL1a) and the second control line (WL1b) are provided with different sizes of an asynchronous time interval. [15] Device according to any one of claims 11 to 14, wherein the first (1106) and second transistor (1108) are NMOS transistors, the common node is an earth node, and the device further comprises a pre-charge circuit, wherein the pre-charge circuit is configured to charge the first (BL#) and second signal lines (BL) before the control signal generator (106) provides signals for the first (WL1a) and second control lines (WL1b) to begin discharging the first (BL#) and second signal lines (BL) via the NMOS transistors. [16] Device according to any one of claims 11 to 14, wherein the first (1106) and second transistor (1108) are PMOS transistors, the common node is a source node, and the device further comprises a pre-discharge circuit, wherein the pre-discharge circuit is configured to discharge the first (BL#) and second signal lines (BL) before the control signal generator (106) provides signals for the first (WL1a) and second control lines (WL1b) to begin charging the first (BL#) and second signal lines (BL) via the PMOS transistors. [17] Device with a cell (402) configured to have a PUF value, PUF: Provides a physically unclonable function with: a first transistor (1106) having a gate controlled by a first control line (WL1a), a first terminal connected to a first signal line (BL#), and a second terminal connected to a common node; and a second transistor (1108) which has a gate controlled by a second control line (WL1b), a first terminal connected to a second signal line (BL), and a second terminal connected to the common node, wherein a read amplifier (410) is configured to detect a signal level difference between the first (BL#) and the second signal line (BL) in order to determine a PUF cell value, wherein the signal level difference is generated by a synchronous change of the level of the first control line (WL1a) and the second control line (WL1b). [18] Device according to claim 17, wherein the cell (402) is a cell (402) of a first type, wherein the device further comprises a cell of a second type, wherein the cell of the second type comprises: a third transistor having a gate controlled by the second control line (WL1b), a first terminal connected to the first signal line (BL#), and a second terminal connected to the common node; and a fourth transistor which has a gate controlled by the first control line (WL1a), a first terminal connected to the second signal line (BL), and a second terminal connected to the common node.

Images