Method for verifying the integrity and authenticity of a printed circuit board - Patents.com

Abstract

The present invention is directed to a method for verifying the integrity and authenticity of a printed circuit board, including associated components and packaging. The method is based on analyzing the power integrity of a power distribution network of a printed circuit board by measuring S-parameters for the printed circuit board. Any tampering or counterfeiting can be determined by comparing the S-parameter data or signature with a known authentic signature. The method for verifying whether a printed circuit board is authentic includes characterizing the power distribution network of the printed circuit board and producing a signature based on reflected response parameters, and comparing the signature from the characterization with a known signature based on reflected response parameters for a corresponding authentic printed circuit board and identifying differences.

Description

[Technical field]

[0001] FIELD OF THEINVENTION The present invention, including its various embodiments, relates to a method for establishing whether a device under test, such as a printed circuit board, including associated components and packaging on the PCB, is genuine, counterfeit, or tampered with. In particular, the present invention, including its various embodiments, relates to a method for characterizing the power distribution network of a printed circuit board for comparison purposes and determining whether the printed circuit board is genuine or tampered with. [Background technology]

[0002] BACKGROUND OF THEINVENTION Description of Related Art Globalization of the manufacturing of electronic systems is increasing due to high demands for reduced processing costs and shortened time to market. As a result, different steps of design, processing, and packaging can no longer be completed in the same location. Because many global entities are involved in the supply chain, the original intellectual property owners and designers no longer have control over the manufacturing and assembly of such systems. The lack of control of the supply chain leaves some critical systems vulnerable to a range of attacks that can occur during various steps in the overall manufacturing and distribution and packaging process prior to deployment.

[0003] Such attacks may include tampering with electronic printed circuit boards (PCBs), for example by embedding malicious computer chips or spy chips or hardware Trojans to intercept processed / communicated data, gain backdoor access to privileged modes of the system, or provide a kill switch. To carry out such attacks, the design may be tampered with before or after board fabrication. Tampering activities may include drilling holes in the PCB (adding vias to the PCB), adding / removing open / short circuits, modifying the PCB or its components, cutting traces onto the PDN of the PCB, and adding / removing components from the PCB.

[0004] Similarly, the introduction of counterfeit, recycled, lower quality, or aged components into the supply chain can lead to quality and performance degradation of electronic systems, such as shorts or opens.

[0005] As buried electronics continue to be utilized within numerous systems, ranging from smartphones to autonomous vehicles and critical infrastructure, the potential for attacks or the introduction of counterfeit components could lead, for example, to significant financial losses and, in some applications (e.g., medical devices), serious human injury and even death.

[0006] Existing techniques commonly used today to verify hardware are not sufficient to mitigate more advanced cybersecurity threats, such as recent concerns about hardware Trojans and malicious hardware components being embedded in electronic devices during the manufacturing process. Most techniques used today are visually based or rely on proprietary solutions that cannot be verified by the end user. This results in relying on distributors / suppliers to ensure and verify that their products are genuine and have not been tampered with or accessed unauthorizedly.

[0007] Therefore, a need exists for an effective method to verify the integrity and authenticity of a PCB (including components such as capacitors, PCB traces, PCB vias, etc.) down to the IC package level, both prior to installation as well as during runtime deployment. Summary of the Invention [Means for solving the problem]

[0008] (Brief Summary of the Invention) In general, the present invention is directed to a unified physical attestation framework or methodology for attesting the integrity and authenticity of a PCB, including associated components and packaging on the PCB. The framework or methodology is based on analyzing the power integrity of the PCB's power distribution network (PDN), whose overall characteristics are determined by the electrical impedance of the individual components on the PCB. Any tampering or forgery on the PCB will lead to a change in the equivalent impedance of the PDN or PDN characteristics across frequency. Thus, a physical scan or monitoring of the PDN will reveal whether the integrity of the PCB has been compromised, such as through the use of tampered or forged components.

[0009] In one embodiment, a method of the present invention is a method for verifying whether a printed circuit board is authentic, the method comprising: characterizing a power distribution network of the printed circuit board to produce a signature based on reflected response parameters; and comparing the signature from the characterization with a known signature based on the reflected response parameters for a corresponding authentic printed circuit board to identify differences. In some embodiments, the reflected response parameters are amplitude (|S 11 |) and phase (∠S 11 ) and S-parameters or S 11 In some embodiments, S 11 The data is mathematically modeled to provide a modeled set of data for comparison.

[0010] Based on the methods of the present invention, the power distribution network of a device under test, such as a printed circuit board, including associated components and packaging on the PCB, can be characterized by measuring S-parameters and comparing that data or signature to known signatures to determine whether the device under test is authentic or has been tampered with or counterfeited. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 illustrates a setup for characterizing a PDN, in accordance with one embodiment of the present invention.

[0012] [Diagram 2] FIG. 2 illustrates a method for identifying tampered or counterfeit devices according to one embodiment of the present invention.

[0013] [Figure 3A] FIG. 3A shows the Yokogawa EJX110A differential pressure transmitter.

[0014] [Figure 3B] FIG. 3B illustrates a rear view of the transmitter of FIG. 3A.

[0015] [Figure 4] 4A-D illustrate the results of testing the Yokogawa EJX110A differential pressure transmitter of FIG. 3A.

[0016] [Figure 5-1] 5A-B illustrate the Texas Instruments LP-MSP430FR2476 development kit and corresponding schematic.

[0017] [Figure 5-2] 5C-D illustrate the Texas Instruments MSP-EXP432P401R development kit and corresponding schematic.

[0018] [Figure 6] 6A and 6B illustrate the results of S1 1 measurements on ten MSP430FR2476 development kits.

[0019] [Figure 7] 7A and 7B illustrate six different tamper attacks on seven MSP430FR2476 development kits and the resulting S11 measurements within a bandwidth of 100 kHz to 1 GHz.

[0020] [Figure 8] FIG. 8 shows the backside of two different groups of the MSP430FR2476 board.

[0021] [Figure 9] 9A and 9B illustrate the results of S-parameter measurements for two different groups of MSP430FR2476 boards.

[0022] [Figure 10] 10A and 10B illustrate the results of S11 measurements on 12 Texas Instruments MSP432P401R development kits.

[0023] [Figure 11A] FIG. 11A illustrates the results of S11 measurements on 12 Texas Instruments MSP432P401R development kits within a bandwidth of 100 kHz to 200 MHz, based on the gradual removal of electrical components.

[0024] [Figure 11B] FIG. 11B illustrates the clustering results of S11 measurements on 12 Texas Instruments MSP432P401R development kits within a bandwidth of 100 kHz to 200 MHz based on various tampering levels.

[0025] [Figure 12A]FIG. 12A illustrates the results of S11 measurements on 12 Texas Instruments MSP432P401R development kits within a bandwidth of 100 kHz to 1 GHz, based on the gradual removal of electrical components.

[0026] [Figure 12B] FIG. 12B illustrates the clustering results of S11 measurements on 12 Texas Instruments MSP432P401R development kits within a bandwidth of 100 kHz to 1 GHz based on different tampering levels.

[0027] [Figure 13] 13A and 13B illustrate the detection accuracy for labeled PCBs.

[0028] [Figure 14] 14A and 14B illustrate the clustering results of the 12 regular substrates.

[0029] [Figure 15] 15A and 15B illustrate the statistical distances for 12 regular substrates and regular versus tampered substrates. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0030] Detailed Description of the Invention The present invention will be described more fully below with reference to the accompanying drawings. The present invention will be described in conjunction with various embodiments, which should be considered as examples and not as limitations or as revealing the only embodiment of the present invention. Rather, the present invention includes various embodiments or forms, various related aspects or features, and various uses, as well as the foregoing alternatives, modifications, and equivalents, all of which are included within the spirit and scope of the present invention and the claims, whether or not expressly described herein. Furthermore, the use of the terms "invention", "the present invention", "embodiments", and similar terms throughout this description are used broadly and are not intended to imply that the invention requires or is limited to any particular embodiment or aspect described, or that such description is the only manner in which the invention may be made or used.

[0031] In general, the present invention is directed to a unified physical attestation framework or methodology for attesting the integrity and authenticity of a PCB, including the associated components and packaging on the PCB. The framework or methodology is based on analyzing the power integrity of the PCB's power distribution network (PDN), whose overall characteristics are determined by the electrical impedance of the individual components on the PCB.

[0032] A power distribution network (PDN) contains the power delivery from external power regulators to the transistors on a chip. A PDN is usually modeled as an RLC network. The impedance profile of a PDN's RLC network is a function of frequency, and the contribution of each individual component to the impedance of the PDN is distinct at different frequencies. For example, while at lower frequencies, the equivalent impedance of the PDN is dominated by the characteristics of the voltage regulator, and at higher frequencies, off-chip and on-chip components contribute most to the impedance.

[0033] Any tampering or forgery on the PCB will lead to a change in the equivalent impedance of the PDN or PDN characteristics across frequency. Hence, a physical scan or monitoring of the PDN before the boot-up process or before the device is deployed in the field will reveal whether the PCB integrity is compromised. Such a power integrity based scan makes the inventive verification method generic and applicable to virtually all electronic boards. Subsequently, the inventive method for characterizing or measuring the PDN of a PCB and identifying PCB tampering and forgery is described in conjunction with the figures.

[0034] FIG. 1 illustrates a setup for characterizing a PDN, in accordance with one embodiment of the present invention. As shown, a device under test (DUT) 102 is connected to a voltage supply (V DD ) 106 and ground (GND) 108 to the VNA 104. A sample graph 110 illustrates an example result of measurements of the PDN made using the VNA 104.

[0035] To characterize the PDN, power and signal integrity analysis can be performed using measurement equipment such as a Vector Network Analyzer (VNA), as shown in Figure 1. Power integrity analysis deals with the quality of power delivery (i.e., voltage and current) to different components on the PCB. Issues such as voltage drop, voltage ripple, and crosstalk can arise if the board is poorly designed. The main physical parameter that affects the quality of power delivery is the impedance of the PDN. While on the PCB, the resistance of the power plane is the main cause of DC voltage drop between the voltage regulator and the IC, and the decoupling capacitors cause voltage ripple when alternating current (AC) is dissipated by the switching activity of the IC's transistors. Furthermore, the inductance arising from the capacitor parasitics and the bond wires / balls of the IC package creates resonance in the PCB impedance at specific current frequencies.

[0036] Signal integrity analysis checks the quality of the delivery of an electrical signal (e.g., a data signal) between two points on a PCB. Issues such as attenuation, reflection, dissipation, interference, and crosstalk can occur on a poorly designed data path on a PCB. In digital circuits, for high-frequency data streams, the bit period and rise / fall time of the signal play an essential role in designing a PCB. For such high data rates, proper impedance matching needs to be considered to avoid signal rebound / reflection, which causes inter-symbol interference (ISI) and bit errors. Furthermore, the geometry of PCB traces and vias affects the quality of signal propagation on a PCB.

[0037] Because there are different electrical effects on a PCB, such as signal attenuation and signal reflection, and because each component contributes to the impedance of a PDN, the primary method to characterize these effects in a unified manner is to use Z (impedance) and S (scattering) parameters. These parameters are employed in the power / signal integrity analysis of electronic systems to describe the electrical properties of linear electrical networks (e.g., networks consisting of resistors, capacitors, and inductors). These parameters are complex numbers (including voltage amplitude and phase of traveling waves) and are functions of frequency. Based on the number of electrical ports, these parameters are represented in matrices with different sizes. S-parameters directly represent the attenuation and reflection / transmission ratio of the signal at each port of the network. However, Z-parameters can be used to derive the impedance observed at each port of the network. A VNA as shown in FIG. 1 can be used to measure these parameters. Measuring Z-parameters at a port requires that the other port is terminated in an open circuit. However, measuring S-parameters does not require this condition, and instead, a matched load can be used. Depending on the measurement conditions, it may be more convenient to measure one of these parameters and then convert it to the other.

[0038] As described, any tampering and forgery attempts on the PCB will lead to a change in the equivalent impedance of the PDN. It is noted that the contribution of each individual component to the impedance of the PDN is distinctly different at different frequencies. While at lower frequencies, the equivalent impedance of the PDN is dominated by the characteristics of the voltage regulator, while at higher frequencies, the off-chip and on-chip components contribute most to the impedance. As a result, the change in impedance at different frequencies affects both S- and Z-parameters. Since it is more convenient in practice to measure S-parameters using a VNA, they can be used for the characterization of the PDN for the purpose of detecting tampering or forgery. More specifically, the reflection coefficient (S 11 ) parameters can be selected for analysis, which allows the measurement setup to be simplified since only one access point (i.e., an electrical terminal consisting of voltage and ground) is required on the PCB to perform the characterization. In other words, verification can be achieved using a single measurement.

[0039] Returning to FIG. 1, the sample graph 110 shows 11 1 illustrates an exemplary result of the measurement. As shown, S 11 (shown on the y-axis) was measured across a range of frequencies (shown on the x-axis). 11 The changes in can be compared for genuine PCBs in a genuine DUT versus counterfeit PCBs in a counterfeit DUT. This comparison allows for a determination of whether the DUT 102 is genuine or has been tampered with or contains any counterfeit components. S-parameters are a measurement of two components: amplitude (|S 11 |) and phase (∠S 11) and . Thus, either or both can be used for comparison and therefore for purposes of determining whether tampering or forgery has occurred. As explained below, in some cases, either the amplitude or the phase may be more or less sensitive to tampering or forgery occurring.

[0040] FIG. 2 illustrates a method for identifying tampered or counterfeit devices according to an embodiment of the present invention. Generally, a unique scattering or impedance signature 202 for a given PCB or board system is known. Then, in a first step 204, the PDN of the target PCB is characterized, which includes measuring S-parameter data for the given device or DUT, and may also include mathematical modeling of the data. It should be understood that mathematical modeling of the data may or may not be necessary, as described below. In a second step 206, the results from the first step, which may include the results of mathematical modeling, are evaluated to determine whether the PCB is authentic or counterfeit, or has been tampered with. Each of these steps is described in further detail below.

[0041] In a first step 204, the PDN of a target PCB or device is characterized or the PDN signature of the PCB or device is measured. In the first step 204, referring to FIG. 1, a VNA measures the S-parameters of a set of PCBs, specifically the S 11 A network analyzer may be used to measure the parameters. In some embodiments, a linear frequency sweep from 100 kHz to 200 MHz and 100 kHz to 1 GHz with a mid-frequency bandwidth of 100 kHz using 201 measurement points may be used. The output power level of the network analyzer may be set to 0 dBm, with start and stop power levels being -10 dBm and 0 dBm, respectively. It should be appreciated that the data collected in this step represents the S-signature for the device being evaluated.

[0042] As described, the data collected from the PDN can be mathematically modeled using machine learning techniques in preparation for comparison in the second step 206 to determine whether tampering or counterfeiting is present. It should be understood that in some cases, mathematical modeling may or may not be necessary. In some cases, the change in S-signature between the measured S-signature and the known S-signature of the device being evaluated may be large enough or very large for direct comparison. In that case, a direct comparison of the amplitude of the S-signature (e.g., by subtraction) provides sufficient difference to enable a determination of whether the device has been tampered with or is a counterfeit device without the need for mathematical modeling or machine learning techniques. In other cases, such as those in which the tampering may be more advanced and in which the S-signature is relatively small or provides a small footprint or the difference is relatively small, mathematical modeling of the collected data can be used to determine whether tampering or counterfeiting has occurred. Those skilled in the art will appreciate the distinctions to understand when and whether machine learning or mathematical modeling should be used in such cases.

[0043] To detect tampering, machine learning can be used in both supervised (i.e., classification) and unsupervised (i.e., clustering) scenarios. Data collected from S-parameter measurements are noisy and multidimensional because they are collected over a predefined time and frequency range. The sequence of S-parameter data over frequency also exhibits the characteristics of a time series, but is non-temporal. Therefore, classifying / clustering the collected data can be considered as a sequence labeling problem that is addressed by applying time series analysis. Specifically, state space models (SSM) can be used, which is an approach used to analyze sequential, structured time series-like data. In SSM, it is assumed that the sequence of measured data is generated by several hidden state variables, which include the resistance, capacitance, and inductance of the PDN at each frequency, resulting in an overall impedance. It should be understood that these hidden state variables can be affected by environmental noise, device aging, or noise imposed by the measurement. These physical uncertainties are assumed to follow a Gaussian distribution. Therefore, a concise class of SSM, called the linear Gaussian state space model, can be used. Formally, a sequence y of measured data (in vector form), y1, y2, ..., is collected over a range of frequencies. This sequence is generated by a number of hidden state variables x1, x2, ..., with joint probabilities as shown in Equation 1.

number

number

[0044] Another important aspect of the data representation is the dependency of the hidden state variables on each other. Since the persistent electrical current generation at each step of the measurement increases the temperature of the substrate and its components, the measurement at each time / frequency step will be influenced by the previous measurement. As a result, the state variables have a first-order Markovian dynamics.

[0045] It should be understood that based on the availability of golden samples, the verification method can be used for supervised and unsupervised scenarios. In unsupervised scenarios, a widely studied approach to learn the parameters of the linear Gaussian SSM (Equation (1)) is the Expectation Maximization (EM) algorithm. This algorithm is the building block of the Gaussian Mixture Model, which can cluster objects based on the SSM. In this regard, the Gaussian Mixture Model utilizes hidden Gaussian states to assign each measured data y to a cluster. Each cluster corresponds to a Gaussian distribution, with a mean and variance that are cluster-specific and are learned by employing the EM algorithm.

[0046] However, in a supervised scenario, the K-nearest neighbor (KNN) algorithm can be used, which is an approach close to the EM algorithm. The reason behind choosing the KNN algorithm is that examples that exhibit similar properties should be in close proximity to each other in the dataset.

[0047] As an example, in some embodiments, a statistical and machine learning framework in MATLAB® can be used, as described in the examples below. To this end, ready-made algorithms can be used to fit a Gaussian mixture model to the collected data. For these algorithms, it is necessary to define the number of Gaussian distributions contributing to the model (i.e., the number of clusters). In addition to the number of clusters, the parameters required to determine the clusters (i.e., the distance metric and the clustering evaluation criterion) are also automatically adjusted. By doing so, a gap criterion can be selected to evaluate the clusters. In other words, the gap statistic reflects the compactness of the clusters by calculating the total intra-cluster distance variation for different numbers of clusters. Furthermore, a city block distance metric can be chosen to maximize the performance of the clustering. The city block distance (also called Manhattan distance) is used to calculate the distance between two data points in a grid-like path for high-dimensional data, as in the data collected in these tests. As described above, fitting the Gaussian mixture model can be performed by applying the EM algorithm, which is realized by the k-means algorithm in MATLAB®. For supervised machine learning, the KNN algorithm included in the MATLAB software suite can be used. Similar to the approach for unsupervised Gaussian mixture models described above, the KNN algorithm parameters (i.e., the number of neighbors and distance metric) are set in an automatic manner. To assess the performance of the classification algorithm, leave-one-out cross-validation can be used. As a result, the data collected from all PCBs can be fed into the KNN algorithm, i.e., the data collected from each PCB is used only once as test data, while every other case serves as a training set. In general, the advantage of the cross-validation method is that the results are less biased. In particular, for leave-one-out cross-validation, the computational complexity is low.

[0048] As explained above, in a second step 206, results from a characterization of the PDN of the PBC, which may include the results of mathematical modeling, are evaluated or compared. As explained above, S-parameters are a set of two components: amplitude (|S 11 |) and phase (∠S 11 ) Thus, either or both can be used for comparison and in some cases, either the amplitude or the phase may be more or less sensitive to tampering or counterfeiting.

[0049] Generally, there are two scenarios that can be addressed in this second step 206. First, the results can be used to determine whether the PCB has been tampered with or is a counterfeit or contains counterfeit components. In other words, this step 206 can be used to identify or distinguish between genuine versus tampered devices. Second, the results can be used to distinguish between two supposedly genuine devices. Each of these is described below.

[0050] In the first scenario, when determining whether a device is tampered with or counterfeit, in some embodiments, a user or verifier may have a golden sample and can perform the same PDN analysis on the golden sample to provide a characterization of the PDN against which the results for the PCB can be compared. As a result, the verifier can perform measurements and characterize this golden sample. To authenticate all other devices, the verifier needs to perform the same characterization and compare the resulting signature with that of the golden sample. The presence of a difference between these two PDN characterizations will identify the presence of tampering or counterfeiting.

[0051] However, it should be understood that in some cases, the measurements may suffer from noise, for which the mathematical modeling described above should be employed. The first type of noise comes from the uncertainty during the measurement, either due to changes in environmental conditions or even thermal noise in the measurement equipment. The detrimental effects of this kind of noise can be reduced by repeating the same measurement and by better controlling the environmental conditions. The second type of noise is caused by manufacturing process variations. Unlike the first type, process variation noise cannot be mitigated. Even if two devices are genuine, they may still show differences in their physical signatures.

[0052] It should be understood that if the user or verifier only has access to the golden sample, then only unsupervised (i.e., clustering) methods are used to find out whether the signatures of the suspect devices belong to the same cluster. The main advantage of this approach is that it does not require the verifier to have any knowledge of the behavior of the tampered / falsified device, since any signature with sufficient difference to the golden signature will be clustered differently.

[0053] In some embodiments, the user or verifier may also have access to some tampered or forged samples. In this case, the verifier can assign labels to the golden and any other challenged samples and deploy supervised (i.e., classification) techniques. The advantage here is that unseen samples from known challenged categories can be detected with high confidence.

[0054] In the second scenario, aimed at distinguishing between two supposedly authentic devices, the distance between the signatures of the authentic devices can be used as a fingerprint to authenticate each individual sample. Such a fingerprint is useful in an attack scenario where an electronic board can be replaced by a similar one. Both boards can be genuine, but the boards can have different software versions, which cannot be easily detected by physical measurements.

[0055] It should be understood that the method of the present invention can be applied to any electronic board at any time. In some embodiments, the method may be used prior to deployment of a device in the field to authenticate the device prior to use. In some embodiments, the method may be used at various points along the manufacturing or supply chain and can be used to assess various types of tampering or counterfeiting, including, for example, malicious embedding or counterfeiting or the use of reused components on a PCB.

[0056] The following examples provide further explanation regarding the implementation of the methods of the present invention. Specifically, the examples provide further explanation regarding how to measure PDN, how to mathematically model the results, and how to use the results to determine the authenticity of a given device.

[0057] (Example) Evaluations of various devices were conducted to test the methods of the present invention. In one case, genuine and counterfeit Yokogawa EJX110A differential pressure transmitters were evaluated. Specifically, the S 11 The differences in signatures were evaluated. In the second case, the Texas Instruments LP-MSP430FR2476 development kit was used to evaluate the S 11To demonstrate the impact on the signatures, a series of capacitors, resistors, and inductors were desoldered from PCB planes and then soldered to emulate tampering actions or attacks on the Texas Instruments device. 11 The S-parameters were measured. Among the different components on the PCB, tampering with capacitors is more critical for three reasons. First, capacitors play a crucial role in delivering high quality power to the ICs on the PCB. Second, capacitors may be the most counterfeited product in the market. Third, altering any other component on the PCB, such as embedding a spy chip, would cause a change in the overall capacitance (and inevitably the overall impedance) of the PDN, but this type of attack can be emulated by capacitors. It should be appreciated that in a supervised (i.e., classification) scenario, the S-parameter measurements are compared to the genuine PDN signature in the enrollment phase for detection of the attack. However, in an unsupervised scenario, the S-parameters are used for fingerprinting and verification. In the third case, the Texas Instruments MSP-EXP432P401R development kit was used to measure the S-parameters in the light of incremental tampering. 11 The effect on the signature was evaluated to show how the method of the present invention can detect it.

[0058] For the S-parameter measurements, a Keysight ENA network analyzer E5080A was used. Linear frequency sweeps from 100 kHz to 200 MHz and 100 kHz to 1 GHz with a mid-frequency bandwidth of 100 kHz were set using 201 measurement points. The output power level of the network analyzer was set to 0 dBm, and the start and stop power levels were -10 dBm and 0 dBm, respectively. The network analyzer measured the reflection coefficient (S 11) was used only to measure the SMA connectors. Shielded cables were used as adapters between the SMA connections and the pins of the DUT. Since the signal path of the network analyzer can only be calibrated up to the SMA connections, a constant offset was added to the measurements based on using identical connectors. Since the primary objective of the experiment was to detect differences between measurements of genuine and tampered / falsified samples, the presence of this constant offset in all measurements does not affect the results.

[0059] In some cases, a statistical and machine learning framework in MATLAB® was used to analyze the data collected from these studies, but it should be noted that the algorithms can be implemented using any known software suite. To this end, off-the-shelf algorithms were used to fit Gaussian mixture models to the collected data. For these algorithms, it is necessary to define the number of Gaussian distributions contributing to the model (i.e., the number of clusters). In addition to the number of clusters, the parameters required to determine the clusters (i.e., the distance metric and the clustering evaluation criterion) are also automatically adjusted. By doing so, a gap criterion was selected to evaluate the clusters. In other words, the gap statistic reflects the compactness of the clusters by calculating the total intra-cluster distance variation for different numbers of clusters. Furthermore, a city block distance metric was chosen to maximize the performance of the clustering. The city block distance (also called Manhattan distance) is used to calculate the distance between two data points in a grid-like path for high-dimensional data, such as the data collected in these studies. As explained above, fitting the Gaussian mixture model was performed by applying the EM algorithm, which is realized by the k-means algorithm in MATLAB. For supervised machine learning, the KNN algorithm, included in the MATLAB software suite, was used. Similar to the approach for the unsupervised Gaussian mixture model described above, the KNN algorithm parameters (i.e., the number of neighbors and the distance metric) were set in an automatic manner. To assess the performance of the classification algorithm, leave-one-out cross-validation was used. As a result, the data collected from all PCBs was fed into the KNN algorithm, i.e., the data collected from each PCB was used only once as test data, while every other case served as a training set. In general, the advantage of the cross-validation method is that the results are less biased. In particular, for leave-one-out cross-validation, the computational complexity is low.

[0060] FIG. 3A shows a Yokogawa EJX110A differential pressure transmitter. The leftmost transmitter 302 is a counterfeit version and the rightmost transmitter 304 is an original version. These differential pressure transmitters are typically used to measure liquid, gas, or vapor pressure. Specifically, the internal digital sensor simultaneously measures differential pressure, static pressure, and temperature. As a result, pressure and temperature differences can be compensated for in real time.

[0061] Figure 3B illustrates a rear view of the transmitter of Figure 3A. As shown in Figure 3B, four electrical terminals 306, 308, 310, 312, two of which are used to supply DC voltage to the inner PCB, are accessible and can be used to access the inner power rails of the electronics board. Cables 314, 316, 318, 320 are connected to these terminals and are used to measure the reflection coefficient (S 11 ) is measured.

[0062] Figures 4A-D illustrate the results of testing the Yokogawa EJX110A differential pressure transmitter of Figure 3A. PDN characterization was performed within two ranges of frequency: 100 kHz to 200 MHz and 100 kHz to 1 GHz. As shown in Figures 4A and 4B, the S 11 The amplitudes show similar patterns across frequencies except for two frequency time intervals, namely, 45-60 MHz and 400-500 MHz. The results indicate that the PDN characteristics of the inner electronic boards of these two products are different.

[0063] To evaluate the effect of counterfeiting activities on the phase of the pressure sensor's reflection response, the phase of the reflection coefficient of the Yokogawa EJX110A sensor was also measured in two ranges of frequencies (100 kHz to 200 MHz and 100 kHz to 1 GHz). These results are shown in Figures 4C and 4D. By comparing the amplitude and phase changes, the ∠S 11 Instead, |S 11More sensitivity can be observed at |. It should be understood that although some changes in the phase profile are detectable, the pattern of phase response is not significantly altered for the counterfeit sample.

[0064] 5A-B illustrate a Texas Instruments LP-MSP430FR2476 development kit and the corresponding schematic. A Texas Instruments MSP430FR2476 LaunchPad development kit (LP-MSP430FR2476) was used for the different tampering experiments. As shown, the MSP430FR2476 development kit consists of two connected PCBs, namely, an MSP430 target 502 and an eZ-FET 504. The kit contains two separate PDNs. A direct 5V voltage source 506 from a USB port 508 delivers power for potential expansion boards, while a 3.3V PDN 510 is responsible for powering the microcontrollers on both PCBs. This PDN was used since most of the components on the PCB are connected to the 3.3V PDN. The reflection coefficient (S 11 ), direct access to the 3.3V PDN was required. The 3.3V is generated by a low dropout regulator, but is directly accessible for measurement on the jumper / isolation block 512.

[0065] In the enrollment phase for detecting tampering and counterfeiting of samples seen for the first time, S 11 To rely on signatures, S 11 It should be understood that the signature should exhibit consistency between boards from the same family. Similar electronic boards may be manufactured by the same foundry using the same materials, but there will still be manufacturing process variations that lead to differences in the signature. To measure the effect of process variations between boards, S 11 Measurements were performed on ten MSP430FR2476 development kits within a bandwidth of 100kHz to 900MHz.

[0066] Figures 6A and 6B show the S 11 The results of the measurements are shown in the figure. As shown, all 10 substrates have similar S across frequencies. 11 Signature Pattern (S 11 1 shows the results of the present study, including both amplitude and phase profiles of the 100 MHz oscilloscope. However, slight deviations exist due to manufacturing process variations.

[0067] Figures 7A and 7B show six different tamper attacks on seven MSP430FR2476 development kits and the resulting S 11 The measurements are shown in the figure. Seven identical boards from the MSP430FR2476 development kit were used. The S of one of the boards 11 The parameters were measured to keep it as the reference (original) PCB, which is the board shown in the center of Figure 7A. Six different tampering attacks were then performed on the remaining six PCBs, including removing the two short circuits C2 and C1, modifying, removing jumpers, adding vias, and cutting traces, as illustrated in Figure 7A. In attack 1, a trace was cut on the left side of one of the boards to see its effect on the signature of the reflected response. Specifically, the trace connecting R12, R13, and C7 to the P1.1 and P1.0 pins was cut. In attack 2, a solder iron was added to some unsoldered connections on one of the PCBs, and the S 11 The impact of adding a short circuit on the behavior was checked. More specifically, the electrical pads on the PCB reserved for the two resistors R9 (47KΩ) and R10 (47KΩ), which were disconnected by default, were soldered. In attack 3, a part of the PCB was painted using conductive wire glue to check its impact. This paint contains carbon and a non-toxic binder. Wire glue was added on the R9 and R10 resistors and allowed to dry. Afterwards, the S of the modified PCB was 11was measured across frequencies. In attack 4, all jumper blocks on one of the PCBs were removed to check the effect of adding / removing jumpers as well. Note that the center jumper block (J101) was removed in all measurements and had direct access to the 3.3V line and its ground pin using a custom cable (see board in the center of Figure 7A). However, in attack 4, the other jumper blocks (J7, J8, and J9) on the bottom side of the PCB were removed as well. In attack 5, the ground plane of one of the boards was drilled to simulate the addition of vias to the PCB. Note that vias were placed in the ground plane between the J7 and J8 jumper blocks using a drilling machine with a drill diameter of 1.02 mm (see Figure 7A). In attack 6, capacitors C1 (10 μF) and C2 (0.1 μF) were simultaneously removed and S 11 The effect of component removal on the parameters was confirmed.

[0068] FIG. 7B shows the S per board with individual tamper attacks within the bandwidth of 100 kHz to 1 GHz. 11 The results of the parameter measurements are illustrated. It is observed that each tampering activity significantly affects the amplitude of the reflected response of the PCB. Both the amplitude and the resonant frequency are altered after each tampering attack. It is noteworthy that the tampered board functioned properly after the attacks. This observation confirms that functional testing cannot be considered as an effective and accurate technique for detecting such tampering activities.

[0069] It can be seen that for attack 6, the pattern, amplitude, and resonant frequency are significantly altered, and it should be noted that the phase profiles of these tampering experiments were captured as well. Interestingly, in the case of simultaneous removal of the C1 and C2 capacitors, ∠S 11 An observable change in ∠S is also observed. However, this change is 11 It depends on the periodic nature of . Therefore, ∠S 11If a higher level of corruption occurs, where the phase profile reverts to its initial state, such corruption may remain undetected through inspection of the phase profile.

[0070] Additional testing was performed using 20 MSP430FR2476 development kits from different manufacturing facilities. Specifically, the S 11 Experiments were performed on these boards and sorted them. All boards were from the same family and had the exact same design. However, they were assembled in different facilities at Texas Instruments.

[0071] Figure 8 shows the backside of two different families of MSP430FR2476 boards. 11 After characterizing the signatures, ten of them have their first resonance at about 144 MHz (Group 1), and the other half (Group 2) have their first resonance at about 171 MHz. As can be seen in Figure 8, the colors and markings of the substrates in Groups 1 and 2 are different.

[0072] 9A and 9B illustrate the results of S-parameter measurements for two different families of MSP430FR2476 boards. 11 To more clearly demonstrate the changes in signatures, |S 11 | and ∠S 11 The average of S was plotted over frequency. This is the averaged amplitude and phase of the reflected response of these 20 substrates. All 20 substrates are regular samples, but they have different S across frequency. 11 As shown in Figure 9B, the phase of the reflected response of these two groups of the MSP430FR2476 board does not reveal much information about the PCB. However, visible changes are more detectable in the amplitude profile of the reflected response (see Figure 9A). Therefore, again, it is clear that the phase profile is not a reliable measurement to detect high degree of tampering where the sample under test is highly similar to the genuine one.

[0073] Returning to FIG. 5, FIG. 5C-D illustrates the Texas Instruments MSP-EXP432P401R development kit and corresponding schematic. The MSP432P401R kit consists of two connected PCBs, namely, MSP432 target 552 and XDS110-ET 554. The kit also contains two separate PDNs 556, 558. The 3.3V 558 was used because it is responsible for power delivery to the microcontroller and other major components. Meanwhile, the above tampering tests, performed using the MSP430FR2476 board, were intended to separately show the impact of various tampering activities. The tests on the MSP-EXP432P401R board validate the attestation technique through more extensive incremental tampering experiments and the use of machine learning algorithms to distinguish between different levels of incremental tampering. It should be appreciated that there is a larger number of available components in the MSP432P401R kit compared to the LP-MSP430FR2476 of Figures 5A-B, and therefore the machine learning approach described above was only applied to experiments on the MSP432P401R board due to the higher level of tamperability that is a result of the larger number of available components in the MSP432P401R kit.

[0074] Figures 10A and 10B show the S12 on a Texas Instruments MSP432P401R development kit. 11 The results of the measurements are shown in the figure. As shown, all 12 substrates have similar S across frequencies. 11 While a signature pattern was demonstrated, slight deviations are due to manufacturing process variations.

[0075] Figure 11A shows the S12 performance on a Texas Instruments MSP432P401R development kit based on the gradual removal of electrical components within a bandwidth of 100 kHz to 200 MHz. 11The results of the measurements are shown in Figure 12A. Figure 12A shows the S on 12 Texas Instruments MSP432P401R development kits in the bandwidth from 100 kHz to 1 GHz based on the gradual removal of electrical components. 11 The results of the measurements are shown in the figure. 11 To assess the impact of gradual tampering on the signature, one of the MSP432P401R development kits was selected and different components were gradually removed from the board. As can be seen on the MSP432 target board in FIG. 5C, there are several passive electrical components around the main microcontroller that can be considered. According to the kit documentation, some of these components, such as decoupling capacitors C3 (10 μF), C4 (100 nF), and C7 (100 nF), are directly connected to the 3.3 V line and ground. There are also other decoupling capacitors for the analog voltage supply of the chip, such as C1 (100 nF) and C2 (100 nF), which are separated from the 3.3 V power line by resistor R1 (0 Ω). Components that are connected only to ground (e.g., R5 (91 kΩ)) or that do not have a connection to the 3.3 V line and ground (e.g., L1 (4.7 nH)) were also considered.

[0076] In what were called "tamper levels", various components were successively removed from the board. In tamper levels 1-4, the decoupling capacitors (C4, C7, C1, and C2) were removed one by one for the digital and analog power supplies. Tamper levels 5 and 6 involved the removal of components with no direct connection to the 3.3V PDN (i.e., L1 and R5). In tamper level 7, the decoupling capacitor with the largest capacitance (C3) was removed. Finally, in tamper level 8, resistor R1 (see Figure 5C) was removed, which completely disconnects the PDN from the measurement point on the jumper / isolation block. The S of the PCB in the frequency ranges of 100 kHz to 200 MHz and 100 kHz to 1 GHz were removed. 11The effect of the gradual removal of these components on the signature is shown. The different tampering levels are indicated in the legend of each figure.

[0077] One observation to make is that different corruption levels affect different parts of the spectrum. Each level of corruption affects S in a specific frequency range. 11 Although the signature is affected, the pattern remains intact in most of the spectrum. The main difference can be observed by looking at the shift of the resonant points in frequency as well as their amplitude. This is due to the dependency of the resonant frequency on the inductance and capacitance of the overall PDN. Therefore, any removal, addition, or substitution of a component that affects the inductance and capacitance of the PDN will lead to a shift in the resonant frequency. As a result, any local impedance measurement on a PCB for attestation purposes that does not scan a wide range of frequencies will provide inaccurate results and may allow tampering / forgery to go undetected.

[0078] S 11 The maximum effect of removing the decoupling capacitors on the signature can be observed at frequencies greater than 160 MHz. Compared to the decoupling capacitors, removing L1 and R5 has a small effect on the S 11 Finally, as expected, the removal of R1 in the last level of tampering has the highest impact on the S 11 Effect on behavior.

[0079] The phase profile of these tamper experiments on the MSP432P401R board was also captured. Interestingly, the phase profile was not significantly affected up to the maximum level of incremental tampering of 6. This observation confirms that the phase profile is not a suitable measurement to detect advanced tampering, as the tampered DUT resembles the normal sample. As the tampering level increases from 6 to 8 (more components are removed), the phase profile is shifted significantly forward. However, this change is due to the ∠S 11 Therefore, for higher levels of tampering, ∠S 11 returns to its initial state, so that such tampering remains unrevealed through inspection of the phase information.

[0080] As described above, the machine learning techniques described above can be used to analyze the collected S 11 Signatures were applied to automate the process of tamper detection. Two scenarios were evaluated.

[0081] In the first scenario, called "unsupervised learning," the goal was to determine whether an unmodified PCB and each modified version after tampering could be automatically distinguished without the user knowing which is which or having a label for each PCB. In other words, the verifier would learn the S 11 We do not know anything about the signatures and therefore try to cluster devices based on their collected signatures. As explained above, a Gaussian mixture model was used to assign each measurement to a cluster. In fact, each cluster represents a Gaussian distribution, with a mean and variance learned by employing the EM algorithm.

[0082] FIG. 11B shows the S-parameters on 12 Texas Instruments MSP432P401R development kits within a bandwidth of 100 kHz to 200 MHz under different tampering levels. 11Figure 12B illustrates the clustering results of measurements on 12 Texas Instruments MSP432P401R development kits within a bandwidth of 100 kHz to 1 GHz under different tampering levels. 11 Figure 1 illustrates the clustering results of the measurements. These are the results for the first scenario described above.

[0083] Based on the results shown in Figs. 11B and 12B, the unsupervised learning can learn up to 8 clusters in several frequency ranges from 100 kHz to 200 MHz, and all 9 clusters (i.e., genuine and 8 tampered levels) were obtained within the frequency range of 100 kHz to 1 GHz. 11 Based on the signature, it can be successfully learned within a specific frequency range. It should be appreciated that the number of clusters corresponds to the number of Gaussian distributions determined by the algorithm. Furthermore, no limitations were imposed on the number of clusters and, therefore, the number of Gaussian distributions underlying the measured data. It should be appreciated that the statistical and machine learning analysis could detect the removal of the R5 and L1 components since they are not directly connected to the 3.3V PDN. This could possibly be explained by the crosstalk of the components on the PCB and their overall impact on the ground plane.

[0084] In the second scenario, called "supervised learning", the aim was to evaluate the detection accuracy of modified PCBs by providing the learning algorithm with the correct signature in the training phase. In this case, the verifier has already characterized different versions of the modified board and can therefore provide the corresponding signature. This means that at least one genuine and one tampered PCB are available and the verifier can prepare the latter, for example by removing some components from the PCB. In this case, the verifier can learn exactly what type of tamper attack is mounted on the board, instead of only detecting deviations from the genuine PCB. Based on the obtained clustering results, a classification algorithm was launched on the frequency range, in which all tampering levels could be clustered and differentiated. In other words, the frequency range was considered, in which the maximum number of Gaussian distributions (and therefore the maximum number of clusters) could be determined by the algorithm.

[0085] Figures 13A and 13B illustrate the detection accuracy for labeled PCBs. Specifically, Figure 13A illustrates false positive (FP) results, and Figure 13B illustrates non-detection (FN) results. For highly reliable detection, FP and FN ratios close to or equal to zero would be ideal. This was achieved after tampering level 4 (i.e., C4, C7, C1, and C2 are removed), while relatively low FP and FN ratios (i.e., up to 30%) were still achieved for tampering levels 1-3.

[0086] Further to this observation, in Section 6.3.4, we explore the extent to which statistical and machine learning methods can be useful for distinguishing between fingerprints of tampered and genuine PCBs. Specifically, we investigate the S-parameters between genuine (unmodified) boards and between genuine and tampered boards. 11 The statistical distance of the signatures is analyzed to determine the process variation on the normal substrate. 11 It was determined whether the signatures were sufficient to provide a unique signature for each substrate.

[0087] 14A and 14B illustrate the clustering results for the 12 regular substrates. 11 To derive the signature distances, unsupervised learning as described above was applied to 12 authentic (unmodified) TI MSP432P401R development kits. As can be observed in these figures, in the specific frequency range, the process variations provide sufficient deviation between authentic boards. As a result, all authentic boards can be uniquely identified.

[0088] 15A and 15B illustrate the statistical distances for 12 genuine substrates and genuine vs. tampered substrates. Specifically, the statistical distances of the signatures of the genuine substrate between itself and the tampered version of the substrate were also analyzed. The statistical distances were calculated both over the entire frequency range and over the specific frequency range, which corresponds to the maximum number of clusters and, consequently, the maximum variation between the measured data. In both cases, the distances between the signatures of the genuine devices are smaller compared to the distances between the signatures of the genuine and tampered substrates. As expected, by constraining the frequency range, the distances between the tampered version of the substrate and the genuine substrate increase, reaching the maximum inter-distance value (i.e., 50%) for some tampering levels.

[0089] Various embodiments of the present invention are described above. It should be understood, however, that alternative embodiments are possible and that the present invention is not limited to the specific embodiments described above. (Item 1) 1. A method for verifying the authenticity of a printed circuit board, comprising: characterizing a power distribution network of the printed circuit board and producing a signature based on the reflected response parameters; comparing said signature from said characterization with a known signature based on reflected response parameters for a corresponding authentic printed circuit board and identifying differences; A method comprising: (Item 2) 2. The method of claim 1, further comprising characterizing a power distribution network of the corresponding authentic printed circuit board to produce the known signature. (Item 3) The reflection response parameters are the amplitude (|S 11 |) and phase (∠S 11 Item 2. The method of item 1, comprising: (Item 4) The above signature is S 11 Equipped with data, Above S 11 2. The method of claim 1, further comprising mathematically modeling the data. (Item 5) 5. The method of claim 4, wherein the mathematical modeling includes processing data collected from the characterization using a Gaussian mixture model. (Item 4) 1. A method for verifying the authenticity of a printed circuit board, comprising: characterizing a power distribution network of a first printed circuit board to produce a first signature based on the reflected response parameters; characterizing a power distribution network of a second printed circuit board to produce a second signature based on the reflected response parameters; determining a distance between the first signature and the second signature; A method comprising: (Item 5) The reflection response parameters are the amplitude (|S 11 |) and phase (∠S 11 Item 2. The method of item 1, comprising: (Item 6) The above signature is S 11 Equipped with data, Above S 11 2. The method of claim 1, further comprising mathematically modeling the data. (Item 7) 7. The method of claim 6, wherein the mathematical modeling comprises processing data collected from the characterization using a Gaussian mixture model.

Claims

1. 1. A method for verifying the authenticity of a printed circuit board, comprising: characterizing a power distribution network of the printed circuit board and producing a signature based on the reflected response parameters; comparing the signature from the characterization with a known signature based on reflected response parameters for a corresponding authentic printed circuit board and identifying differences; A method comprising:

2. The method of claim 1 , further comprising characterizing a power distribution network of the corresponding authentic printed circuit board to produce the known signature.

3. The reflection response parameter is the amplitude (|S １１ |) and phase (∠S １１ 2. The method of claim 1 , comprising:

4. The signature is S １１ Equipped with data, The S １１ The method of claim 1 , further comprising mathematically modeling the data.

5. The method of claim 4 , wherein the mathematical modeling comprises processing data collected from the characterization using a Gaussian mixture model.

6. 1. A method for verifying the authenticity of a printed circuit board, comprising: characterizing a power distribution network of a first printed circuit board to produce a first signature based on the reflected response parameters; characterizing a power distribution network of a second printed circuit board to produce a second signature based on the reflected response parameters; determining a distance between the first signature and the second signature; A method comprising:

7. The reflection response parameter is the amplitude (|S １１ |) and phase (∠S １１ 7. The method of claim 6, comprising:

8. The signature is S １１ Equipped with data, The S １１ The method of claim 6 further comprising mathematically modeling the data.

9. The method of claim 6 , wherein the mathematical modeling comprises processing data collected from the characterization using a Gaussian mixture model.

Images