Methods and apparatus for leakage-based physical unclonable function

Abstract

A static random-access memory (SRAM) Physical Unclonable Function (PUF) approach can incorporate SRAM-transistors leakage current as a source of randomness. For example, a device can include an array of memory elements. The array of memory elements can include columns. At least one of the columns can be assigned a bit sequence based at least in part on a measured total leakage current for the column. Bit sequences assigned to columns can form a secure key associated with the device. Transistors can be included in the columns. At least one of the transistors in a column can contribute a leakage current different than at least a contribution from another transistor to the measured total leakage current for the column. KILPATRICK TOWNSEND 78736896 1

Description

PATENT Attorney Docket No. 097226-1459746 (007310WO) Client Ref. No.2023-016-02 METHODS AND APPARATUS FOR LEAKAGE-BASED PHYSICAL UNCLONABLE FUNCTION CROSS-REFERENCES TO RELATED APPLICATIONS

[0001] This application claims the benefit of U.S. Provisional Application No.63 / 582,788 filed September 14, 2023, the entire contents of which are hereby incorporated for all purposes in their entirety. BACKGROUND OF THE INVENTION

[0002] Physical Unclonable Functions (PUFs) can be useful in securing electronic devices and digital data. PUFs can be used for various functions such as device identification, device authentication, and secret key generation for cryptographic engines. Hardware-based PUFs may be preferable over software-based PUFs due to having a more robust resistance against cyber-attacks. A popular type of hardware-based PUF can use a static random-access memory (SRAM) cell starting value as a device-specific fingerprint. SRAM-based memory can be a basic building block of memory in almost all electronic devices. Without such SRAM-based memory, devices can have limited or no functionality. BRIEF SUMMARY OF THE INVENTION

[0003] A static random-access memory (SRAM) Physical Unclonable Function (PUF) approach can incorporate SRAM-transistors leakage current as a source of randomness. For example, a device described herein can include an array of memory elements. The array of memory elements can include a plurality of columns. At least one of the columns can be assigned a bit sequence based at least in part on a measured total leakage current for the column. Bit sequences assigned to columns can form a secure key associated with the device. A plurality of transistors can be included in each column. At least one of the transistors in a column can contribute a leakage current different than at least a contribution from another transistor to the measured total leakage current for the column.

[0004] In another example, a method described herein can include measuring, for at least one column of a plurality of columns in an array of memory elements of a device, a total leakage current for the at least one column. Each transistor in a plurality of transistors in the at leastone column can contribute a leakage current different than at least a contribution of another transistor in the plurality of transistors to the total leakage current for the at least one column. The method can further include assigning, for the at least one column, a bit sequence to the at least one column. The bit sequence can be based at least in part on the measured total leakage current for the column. Additionally, the method can include forming a secure key for the device by combining bit sequences of the plurality of columns in the array. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] FIG.1 is a diagram of basic transistor elements for a conventional SRAM-based PUF approach according to some aspects of the present disclosure.

[0006] FIG.2 is a diagram of a memory device system including a two-dimensional array of SRAM cells according to some aspects of the present disclosure.

[0007] FIG. 3 is a diagram of a building block for an SRAM array, a metal-oxide- semiconductor field effect transistor (MOSFET) according to some aspects of the present disclosure.

[0008] FIG.4 is a graph of a logarithm of drain current versus gate voltage according to some aspects of the present disclosure.

[0009] FIG. 5A is a circuit diagram of a 6T cell transistor configuration when a cell holds logic 1 (Q=1, QB=0, WL=0, BL=1, BLB=1) according to some aspects of the present disclosure.

[0010] FIG. 5B is a circuit diagram of a 6T cell transistors configuration when a cell holds logic associated with (Q=0, QB=1, WL=0, BL=1, BLB=1) according to some aspects of the present disclosure.

[0011] FIG.6 is a diagram of a cross section of a CMOS transistor indicating various forms of leakage currents according to some aspects of the present disclosure.

[0012] FIG. 7 is a diagram of a three-input NAND CMOS architecture according to some aspects of the present disclosure.

[0013] FIG. 8 is a diagram of a three-input NAND CMOS architecture with a head switch for use in a NAND PUF implementation according to some aspects of the present disclosure.

[0014] FIG.9 is a diagram of a leakage current-based SRAM PUF implementation according to some aspects of the present disclosure.

[0015] FIG. 10 is a diagram depicting a two-column voltage sense component of a leakage current-based SRAM PUF implementation according to some aspects of the present disclosure.

[0016] FIG. 11 is a flowchart of an example of a process for assigning a bit sequence of a secure key to columns of an SRAM array using a leakage current-based SRAM PUF implementation according to some aspects of the present disclosure.

[0017] FIG. 12 is a simulation graph of SRAM array column voltages versus temperature according to some aspects of the present application.

[0018] FIG.13 is a diagram of multiple SRAM arrays that can be combined to create a secure key by implementing a leakage current-based SRAM PUF according to some aspects of the present application.

[0019] FIG. 14 is a graph depicting a distribution of hamming distances for one-hundred forty-eight keys determined using a leakage current-based SRAM PUF according to some aspects of the present application.

[0020] FIG.15 is a block diagram of an example of a computing device that includes an SRAM array according to some aspects of the present application.

[0021] FIG.16 is a set of graphs showing the probability of logic 1 and probability of logic 0 for 2000 samples of NAND based PUF implementation based on Monte Carlo simulations at an ambient temperature of -10^ according to some aspects of the present application.

[0022] FIG.17 is a set of graphs showing the probability of logic 1 and probability of logic 0 for 2000 samples of NAND based PUF implementation based on Monte Carlo simulations at an ambient temperature of 27^ according to some aspects of the present application.

[0023] FIG.18 is a set of graphs showing the probability of logic 1 and probability of logic 0 for 2000 samples of NAND based PUF implementation based on Monte Carlo simulations at an ambient temperature of 50^ according to some aspects of the present application.

[0024] FIG.19 is a set of graphs showing the probability of logic 1 and probability of logic 0 for 2000 samples of NAND based PUF implementation based on Monte Carlo simulations at an ambient temperature of 80^ according to some aspects of the present application.

[0025] FIG.20 is a set of graphs showing the probability of logic 1 and probability of logic 0 for 2000 samples of NAND based PUF implementation based on Monte Carlo simulations at an ambient temperature of 110^ according to some aspects of the present application.

[0026] FIG.21 is a histogram showing occurrences of various values of sleep to sample entropy (SaEn) for 2000 samples of NAND based PUF implementation based on Monte Carlo simulations at an ambient temperature of 110^ according to some aspects of the present application. DETAILED DESCRIPTION OF THE INVENTION

[0027] A conventional SRAM-based PUF approach can be based on a jam latch of the SRAM that includes a bi-stable condition. A jam latch can be a basic memory element for storing information in a digital system. Each jam latch can store one bit of information. Outputs of a jam latch can constantly change provided that the jam latch is enabled. For example, content of the jam latch can change immediately when inputs change and the jam latch is enabled. When the jam latch is not enabled, the jam latch holds a value that is stored.

[0028] The jam latch can settle to a logic 1 or a logic 0 value during a starting sequence (e.g., during a power-up of a device) depending on a process variation. FIG.1 is a diagram of basic transistor elements in one SRAM-based PUF approach according to some aspects of the present disclosure. The SRAM-based approach can depend on a variation of 2-transistors (PU1 and PU2) shown in FIG. 1. If behaviors of the 2-transistors are closely matched, then a cell startup state may not be reliable and can be random.

[0029] FIG.2 is a diagram of a memory device system including a two-dimensional array of SRAM cells according to some aspects of the present disclosure. Other periphery circuits such as wordline, input-output, and sense amplifier, are all peripheral circuits that can assist in controlling access to the 2-dimensional array. By using random behavior of SRAM cells, PUFs can generate a unique, device-specific signature that can be difficult if not impossible to duplicate or predict.

[0030] Typical steps involved in the SRAM PUF approach of generating a unique sequence of bits from a start-up state shown in FIG.1 can include the following four steps. In a first step, when a device reboots, a bootloader can query the SRAM for start-up values by reading an address from the 2-dimensional array. The start-up values can form a raw SRAM PUF response. In a second step, helper data generated during enrollment for error correction can be acquired either from the device or from a second device. In a third step, the raw SRAM PUF response and the helper data can be combined, using a fuzzy extraction scheme, to generate a secret key. In a final step, the bootloader can overwrite the SRAM cells with a specified logic pattern, which can erase the raw SRAM PUF response from the SRAM module.

[0031] However, there can be two major issues associated with the SRAM PUF approach from FIG.1. The first major issue can be associated with reliability of raw data involved in the SRAM PUF approach described in FIG. 1. Errors for the raw data can add up to 15% due to differing temperatures and voltages. Additionally, the reliability of the raw data can be negatively impacted by negative-bias temperature instability (NBTI) associated with device aging. NBTI can manifest as an increase in threshold voltage and a consequent decrease in drain current and transconductance of transistors in the 2-dimensional array. To resolve the reliability issue associated with the SRAM PUF approach described in FIG. 1, key post- processing can be implemented, such as forward error correction codes or fuzzy extraction. But the key post-processing can add a substantial overhead in terms of power and latency. The key post-processing can also present a vulnerability to attacks.

[0032] A second major issue associated with the SRAM PUF approach described in FIG. 1 can be a vulnerability to a cold attack. A cold attack can involve an attacker choosing a key to forge and obtaining a random bit string to replace the raw SRAM PUF response. The attacker can produce corresponding helper data based on the key and the obtained bit string. The attacker-produced helper data can then replace helper data already stored on the device. Alternatively, or additionally, the attacker can intercept legitimate helper data and send the attacker-produced helper data to the device. The attacker can then write the obtained bit string to the SRAM and ensure that an ambient temperature is kept significantly low until a reboot of the device occurs.

[0033] Another PUF approach can be described as a delay-based PUF approach. A delay- based PUF can use a difference in delays of identical gates to generate a fingerprint for the device. A ring oscillator with different configurable delay stages can be used in the delay-based PUF approach. A difference between physically matched delay paths can create entropy. Delay-based PUF approaches can be described as semi-random and variations associated with delay-based PUF approaches may not be large enough to create clear randomness. The delay- based PUF approach may involve many gates in order to amplify the variations, and, in some cases, an aribot can be used to select one delay path over another. The delay-based PUF approach can involve higher cost compared to other PUF approaches due to a large number of gates included in the approach. Propagation delay for a CMOS architecture can be described as a time delay between a 50% crossing of an input and a corresponding 50% crossing of an output.

[0034] FIG. 3 is a diagram of a building block for an SRAM array, a metal-oxide- semiconductor field effect transistor (MOSFET) 300 according to some aspects of the present disclosure. While the MOSFET 300 depicted in FIG. 3 is an n-channel MOSFET, p channel MOSFETs can be incorporated in SRAM arrays as well. Other types of complementary metal- oxide-semiconductor (CMOS) architectures, such as Fin field effect transistors (FinFETs), fully depleted silicon on insulator (FDSOI) transistors, or multiple input NOT AND (NAND) gates, can be used as the building block of the SRAM array. A FinFET can be a fin-shaped field effect transistor. The different types of CMOS architectures can exhibit different amounts of leakage currents. For example, MOSFETs can exhibit a relatively high amount of leakage relative to other CMOS devices. FinFETs can exhibit less leakage than MOSFETS. FDSOI transistors can exhibit less leakage than both MOSFETs and FinFETs. The n-channel MOSFET 300 can include a p-type doped semiconductor substrate or p-type body 302, two heavily doped n-type semiconductor regions referred to as a source 304 and drain 306, a gate electrode 308, and an insulating layer. Typically, the semiconductor can typically be silicon and the insulating layer can be silicon oxide. A p-channel MOSFET can include an n-type body and heavily doped p-type source and drain regions. Semiconductors that are doped n-type can have an excess of negative mobile charge carriers (electrons) and semiconductors that are doped p-type can have an excess of positive mobile charge carriers (holes).

[0035] A space between the source 304 and drain 306 can define a channel, with the channel length and width denoted by ^ and ^, respectively. Dimensions of MOSFETs can vary even when the dimensions are meant to be the same. For example, due to thermal variations during a fabrication process, MOSFETs on a single wafer can each have different channel lengths and widths.

[0036] Although the source 304 and drain 306 can be designed to be identical, the source 304 can be connected to ground and the drain 306 and gate electrode 308 can be connected to voltage sources. Thus, the MOSFET 300 can be characterized by two applied voltages: a gate voltage ^ and a drain voltage^^^. Both applied voltages can be defined relative to the source 304 or ground. Since, the applied voltages are measured relative to the source, the gate voltage can sometimes be denoted^^^and the drain voltage can be denoted

[0037] For an enhancement mode (normally off) n-channel MOSFET, a small applied positive gate voltage can repel majority carrier holes away from a semiconductor interface of the p-type body 302 below the insulating layer and a depletion layer can form. The depletionlayer can be described as a layer that lacks mobile charge carriers. As the positive gate voltage increases, the depletion layer can grow until a maximum depletion layer thickness is reached at a gate threshold voltage^. For gate voltages above the gate threshold, an inversion layer of minority carriers (electrons) in the p-type body 302 can form at the semiconductor interface, forming an n-channel that links the source 304 and drain 306.

[0038] A response by the MOSFET 300 to a drain voltage can depend on a value for the gate voltage. When the gate voltage is less than the gate threshold, a positive drain voltage may produce negligible drain current (current flowing between the source 304 and drain 306). When the gate voltage is greater than the gate threshold, a positive drain voltage can lead to a measurable drain current, ^ௗ^. The drain current can rise with drain voltage until a saturation current is reached.

[0039] Thus, the enhancement mode MOSFET 300 can be operated with a maintained drain voltage in a saturation region for the drain current. An ‘Off’ state or ‘0’ state for the MOSFET 300 can be maintained by keeping the gate voltage below the gate threshold (e.g., at a gate voltage of zero), leading to (theoretically) zero drain current. An ‘On’ state or ‘1’ state can be maintained by keeping the gate voltage above the gate threshold, leading to a large saturation drain current.

[0040] FIG. 4 is a plot of logarithm of drain current versus gate voltage for a MOSFET according to some aspects of the present disclosure. Starting from a gate voltage of zero in a beginning portion of the plot, as the gate voltage increases, the logarithm of the drain current also increases in a linear fashion. A reciprocal of a constant slope associated with this beginning portion of the plot defines a parameter called a subthreshold swing for a FET. As denoted in the plot, a gate threshold can be reached when a drain current ^ௗ^can be described by the following expression: ^ௗ^ൌ 100 ൈ௪^ ^^^^ (1) where the drain current explicitly can have units of nanoamps (^^), ^ is the channel width, and ^ is the channel length. As the gate voltage increases above the gate threshold, the slope decreases as the drain current approaches saturation.

[0041] The plot also indicates that a drain current (denotedat zero gate voltage can be non-zero. Leakage current can refer to a current that leaks between a drain and source of a MOSFET when the MOSFET is off or when the gate voltage is below the gate threshold. Theleakage current can depend on a number of factors including dimensions of the MOSFET. For example, leakage current can rise when channel length is reduced or can vary with gate threshold.

[0042] Certain aspects of the present disclosure relate to an SRAM PUF approach that incorporates SRAM-transistors leakage current as a source of randomness. Leakage current can be the current associated with an SRAM cell when the cell is in retention mode (not switching). Leakage current can depend strongly on threshold voltages of transistors of the cell. A mathematical relationship of the leakage current of a transistor can be represented mathematically by equation (2), where ȕ is related to transistor geometry, vgsis a gate to source voltage for the transistor, in normal design vdsis equal to vdd, Vtis the gate threshold voltage, n is a constant that depends on technology involved, and vTis thermal voltage KT / q (where K is Boltzmann constant):

[0043] The leakage current can strongly depend on gate threshold voltage and temperature. FIG. 5A is a circuit diagram of a 6T cell transistors configuration when a cell holds logic 1 (Q=1, QB=0, WL=0, BL=1, BLB=1) according to some aspects of the present disclosure. 2- transistors that can exhibit leakage in such a configuration are PD1 and PU2. FIG. 5B is a circuit diagram of a 6T cell transistors configuration when a cell holds logic associated with (Q=0, QB=1, WL=0, BL=1, BLB=1) according to some aspects of the present disclosure. In such a configuration, 2-transistors that can exhibit current leakage are PD2 and PU1. For any temperature, voltage and process corner, total leakage current may not be data dependent and can be the same in multiple cases, such as the cases exhibited in FIGs. 5A and 5B. However, when a variation of Vtoccurs due to an uncontrolled fabrication process, leakage of each cell will be different. The various leakage configurations of SRAM cells can be used to capture “fingerprints” of the chip.

[0044] The SRAM memory array can be designed to amplify differences in leakage configurations and to translate leakage current into a binary bit. Cells in a single column of the array can share a single virtual voltage supply. Normal organization of an SRAM memory array can include a shared n-type doped well for all p channel field effect transistors (pFETs) in a single column. Typical numbers of cells in SRAM memory arrays can include 64, 128, 256, etc. depending on speed involved in performing normal processes. The leakage current basedSRAM PUF approach can work with any organization or cell number for SRAM memory arrays.

[0045] A power switch (e.g., head switch) for the SRAM memory array can enable different power modes such as active, retention, or sleep modes. A single switch can be used to turn off a main supply on the array and to monitor voltages,of individual columns in the SRAM memory array. A voltage level on the column Vvdd as a function of time can be proportional to total leakage current (^^^^^^^^^cells in the column and capacitance (^௩ௗௗ^ on the node:with Vfcorresponding to Vvdd.

[0046] FIG. 6 is a diagram of a cross section of a CMOS MOSFET transistor indicating various forms of leakage currents according to some aspects of the present disclosure. The cross section includes a p-type semiconductor substrate, source (s), drain (d), and gate (g) electrodes, and a source region and a drain region (e.g., heavily doped n-type regions under the source and drain electrodes). The diagram indicates three forms of leakage currents that can arise in CMOS transistors. The three forms of leakage currents include a gate current, a subthreshold current, and a junction current. The gate current can include current that flows through the gate electrode and gate dielectric layer into the substrate, source region, or drain region, and vice versa. The junction current can include current that flows from the source region or drain region into the substrate and vice versa. The subthreshold current can include leakage current that flows from the drain region into the source region and vice versa. A sum of the three forms of leakage current can lead to a total leakage current. Similar leakage currents can occur in FinFET and FDSOI architectures, as well as NAND architectures.

[0046] Scaling down of CMOS technology can result in a smaller separation between the source and drain regions of CMOS transistors. The smaller separation can result in higher leakage current, including the subthreshold current. The issue of higher leakage current due to scaling down can be mitigated by creating transistors with multiple threshold voltages using process technology. For example, CMOS devices with three different threshold voltages can be included in a single device. The three different threshold voltages can be labeled High, Medium, and Low. An impact of threshold voltage on current leakage is shown with an exponential dependency in equation (2) above. Additionally, the threshold voltage can also impact propagation delay. Lowering a threshold voltage of a CMOS transistor can lead to ahigher saturation current and lower cell delay. A relationship between threshold voltage and delay can be almost linear. A mixture of different threshold voltages can lead to a tradeoff between speed and leakage.

[0047] FIG. 7 is a diagram of a three-input NAND CMOS architecture 700 according to some aspects of the present disclosure. The three-input NAND CMOS architecture 700 can include three pMOS transistors: transistor 720, transistor 730, and transistor 740. The three- input NAND CMOS architecture 700 can also include three nMOS transistors labeled N1, N2,and N3. The three pMOS transistors can be connected to a drain voltage line and transistor N3can be electrically connected to a source voltage line. Each pMOS transistor can be written with either a ‘1’ or ‘0’ of Boolean code. For example, when the drain to source current of one of the pMOS transistors exceeds a threshold current value, the state of the pMOS transistor is ‘1’. If the drain to source current is below the threshold current value, the state of the pMOS transistor is ‘0’. The Boolean states of the three pMOS transistors can provide the three inputs (e.g., described as an input state in order ABC of FIG. 7) for the NAND CMOS architecture 700. As an example, transistor 720 can be in the ‘1’ state while transistors 730 and 740 are both in the ‘0’ state. In the example, the input state for the NAND architecture is said to be ‘100’. Conversely, transistor 730 can be in the ‘0’ state while transistors 720 and 740 are both in the state and the input state is said to be ‘101’. Each input can have different device characteristics due to variations in manufacturing of the three pMOS transistors. While the example shown in FIG. 7 includes MOS transistors, the NAND CMOS architecture 700 can also be based on FinFET or FDSOI CMOS architectures. As shown in equation (3) described above, when the NAND CMOS architecture 700 is incorporated as part of a plurality of columns in a device, a voltage level on the column Vvdd as a function of time can be proportional to total leakage current (^^^^^^^^^ from all cells in the column and capacitance (^௩ௗௗ^ on the node. Table 1 characterizes device characteristics of an example NAND architecture according to some aspects of the present disclosure. Input State Isub Igate Itotal Vx Vy 000 0.4 0 0.4 stack effect stack effect 001 0.7 0 0.7 stack effect^ௗെ^010 0.7 1.3 2.0 intermediate intermediate011 3.8 0 3.8^ௗെ^ ^ௗെ^100 0.7 6.3 7.0 0 stack effect 101 3.8 6.3 10.1 0^ௗെ^110 5.6 12.6 18.2 0 0 111 28 18.9 46.9 0 0 Table 1. Characteristic leakage currents and line voltages for an example NAND architecture based on 100 nanometer fabrication technology according to some aspects of the present disclosure.

[0048] FIG. 8 is a diagram of a three-input NAND CMOS architecture 760 with a head switch 750 for use in a NAND PUF implementation according to some aspects of the present disclosure. The three-input NAND CMOS architecture 760 can include three pMOS transistors: transistor 720, transistor 730, and transistor 740. The three-input NAND CMOS architecture 760 can also include three nMOS transistors labeled N1, N2, and N3. The three pMOS transistors can be connected to a drain voltage line and transistor N3can be electrically connected to a source voltage line. Each pMOS transistor can be written with either a ‘1’ or ‘0’ of Boolean code. For example, when the drain to source current of one of the pMOS transistors exceeds a threshold current value, the state of the pMOS transistor isIf the drain to source current is below the threshold current value, the state of the pMOS transistor is ‘0’. The Boolean states of the three pMOS transistors can provide the three inputs (e.g., described as an input state in order ABC of FIG.8) for the NAND CMOS architecture 760.

[0049] The NAND CMOS architecture 760 can also include a head switch 750. The head switch 750 can be a pMOS transistor. The head switch 750 can be controlled by an enable (en) signal. When the en signal causes the head switch 750 to transition to a logic ‘1’ state, the drain voltage supply can be disconnected from the NAND CMOS architecture 760 and node vvdd can start to discharge due to leakage current. The leakage current can be different for each input state of the NAND CMOS architecture 760. The en signal can initiate PUF generation for a device that includes the NAND CMOS architecture. While the example shown in FIG. 8 includes MOS transistors, the NAND CMOS architecture 760 can also be based on FinFET or FDSOI CMOS architectures.

[0050] FIG.9 is a diagram of a leakage current based SRAM PUF implementation according to some aspects of the present disclosure. Power switches can be utilized to turn off a main supply to an SRAM memory array. Each column of the SRAM memory array can have a separate virtual supply. The voltage of a column, Vvdd, will start drooping (reducing) due to leakage of all the cells in the same column. As each cell can have different leakage and as explained in equation (3), the final voltage Vfon Vvddcan be different depending on the total leakage from all cells. A comparison of column voltages between two columns can be unique for each chip and can be a same value at different times as the memory cells can experience similar environmental conditions (such as ambient temperature) and an only difference may be threshold voltages of individual transistors in column cells which can depend on a manufacturing process. A comparison of the two column voltage measurements for each column can yield a value of leakage current to associate with a column pair using equation (3) where ^^^^ can be defined as a voltage sense time or a time from start to stop of the two- column voltage sense.

[0051] FIG. 10 is a diagram depicting a two-column voltage sense component of a leakage current based PUF implementation according to some aspects of the present disclosure. The two-column voltage sense component can include a first column 702 of CMOS architecture elements and a second column of CMOS architecture elements. The CMOS architecture elements can include SRAM elements for SRAM PUF implementation. The SRAM elements can include MOSFET elements, FinFET elements, or transistors formed from a FDSOI fabrication process. The CMOS architecture elements can include NAND architecture elements for a NAND PUF implementation. The NAND architecture elements can include MOSFET elements, FinFET elements, or transistors formed from a FDSOI fabrication process. Each column can include a power switch. The first column 702 and the second column 704 can be electrically connected to a single chip multi-processor (CMP) 706 so that the CMP 706 can monitor and compare voltages associated with the first column 702 and second column 704.

[0052] The CMP 706 can use a voltage sense of the two columns to assign a unique bit or sequence of bits to a two-column arrangement. A start of a voltage sense can be initiated by simultaneously turning off power to each cell by activating the power switch for each column. Due to leakage currents in each column, voltage associated with each column will decay in time and a comparison of the two voltages (e.g., a difference between the two voltages) will also vary in time and will be dependent on both leakage currents. By comparing the two voltages, the leakage currents can be described. Each column can contain transistors thatcontribute to the leakage currents. The contribution to the leakage current can be unique for each transistor due to variations, such as thermal variations, during fabrication of the transistors.

[0053] The CMP 706 can take a measurement of the comparison of the two voltages and based on the measurement, create a bit or bit sequence to associate with the two-column arrangement. The bit or bit sequence can be associated with unique leakage currents of the columns of SRAM elements. The bit or bit sequence can be combined with other bits or bit sequences from other two-column arrangements to form a secure key. The secure key can be used to identify a device associated with the two-column arrangement, authenticate the device, or encode a cryptographic engine. In some examples, the CMP 706 can receive a sense time as an additional input. The sense time can determine when the CMP 706 makes the voltage comparison measurement. For example, the sense time can be three microseconds and the CMP 706 will wait three microseconds after the start of the voltage sense before making the measurement. In some examples, each column can include a set of transistors within a single column of an SRAM array. In other examples, each column can include an entire SRAM array.

[0054] FIG.11 is a flowchart of an example of a process 800 for assigning bit sequences of a secure key to columns of an SRAM array in a device using a leakage current based SRAM PUF implementation according to some aspects of the present disclosure. Operations of processes may be performed by software, firmware, hardware, or a combination thereof. The operations of the process 800 start at block 810.

[0055] At block 810, the process 800 involves measuring, for at least one column of a plurality of columns in an array of memory elements of a device, a total leakage current for the at least one column. The columns in the array of memory elements can include transistors. Each transistor in a column can contribute leakage current to the total leakage current for the column. Due to variations such as thermal variations during fabrication of the transistors, each transistor can produce a unique contribution of leakage current to the total leakage current. The unique contribution can be different than the contributions of any other transistor within the SRAM array. Unique contributions of leakage current from transistors within the column can mean that the total leakage current is also unique. The total leakage current of a column can be different from the total leakage of currents from other columns in the SRAM array or even from other columns in different SRAM arrays.

[0056] The transistors can be silicon-based FETs. FETs in each column can be electrically isolated from FETs in other columns of the SRAM array. Each FET in the colum can share a single well that is electrically isolated from wells of other columns. For example. FETs in a column can be p-channel FETs and the single well can be an n-type well. Alternatively, or additionally, FETs in a column can be n-channel FETs and the single well can be a p-type well. Each transistor can be formed using a Fully Depleted Silicon-On-Insulator (FDSOI) fabrication process. A number of transistors in the SRAM array can be consistent with a 64 bit, 128 bit, 256 bit computer architecture, or etc. Each of the transistors can be in a retention mode when the total leakage current is measured.

[0057] In some examples, the total leakage current for a column can be inferred based on a two-column voltage sense. The two-column voltage sense can involve a comparison of the voltage associated with the column to a voltage associated with another column in the SRAM array. A start of the two-column voltage sense can be initiated by simultaneously turning off power to each column by activating power switches assigned for each column. Due to leakage currents in both columns, voltage associated with each column will decay in time and a comparison of the two voltages (e.g., a difference between the two voltages) will also vary in time and can be dependent on both leakage currents. By comparing the two voltages, the leakage currents of each of the two columns can be described.

[0058] The SRAM array can include a tracking circuit that can include at least one additional column. The additional column can be referred to as a replica column. The tracking circuit can use a single cell of a replica column to monitor a voltage for a column and select a sense time associated with the column. The sense time can be selected based on a threshold voltage of at least one transistor in the column. The sense time can be selected so that the two-column voltage sense is completed before any transistor voltage drops below the threshold voltage associated with the transistor. The two-column voltage sense can be carried out by a CMP, such as CMP 706 from FIG.7.

[0059] At block 820, the process 800 involves assigning, for the at least one column, a bit sequence to the at least one column. The bit sequence can be assigned based on the total leakage current measured for the at least one column. The bit sequence can be based on Boolean code. In some examples, the bit sequence can be assigned to a column when transistors of the column are in a retention mode. Thus, the bit sequence can be assigned to the column at any point in time that the device is in operation, not just during a start-up sequence.

[0060] At block 830, the process 800 involves forming a secure key for the device by combining bit sequences of the plurality of columns in the array. The secure key can be used to perform at least one action. For example, the secure key can be used to identify the device, authenticate the device, encode a cryptographic engine, etc. In some examples, bit sequences of columns in one SRAM array can be combined with bit sequences for columns in at least one other SRAM array to produce the secure key.

[0061] Examples.

[0062] A leakage current based SRAM PUF array similar to the SRAM PUF array described in FIG. 6 but with 32 columns was fabricated along with periphery circuits using a Global Foundry 22nm FDSOI process. FDSOI can be a type of semiconductor technology that can use a thin layer of silicon on an insulating substrate to fabricate transistors. FDSOI can allow for higher performance and lower power consumption than traditional (Complementary Metal- Oxide-Semiconductor) CMOS technology.

[0063] FIG. 12 is a simulation graph of SRAM array column voltages versus temperature according to some aspects of the present application. Leakage current of cell transistors can be exponentially dependent on temperature. The SRAM PUF array can include a tracking circuit that includes at least one replica column. The tracking circuit can use a single cell of a replica column to monitor a voltage droop for at least one assigned column and determine a sense time associated with the assigned column. Voltage droop can be a loss in voltage from a device element as the device element drives a load. In addition, the selected sense time can be a portion of a leakage current based SRAM PUF configuration and can assist in providing robustness against attackers because the sense time can represent an additional parameter unknown to attackers. By monitoring column voltages, stored data on the SRAM array may not be corrupted and the column voltages may not go below the retention voltage of a memory cell under any conditions. The tracking circuit may also be able to detect an attempted cold attack.

[0064] FIG.13 is a diagram of multiple SRAM arrays that can be combined to create a secure key by implementing a leakage current based SRAM PUF according to some aspects of the present application. Leakage data from each array or from each column of each array can be combined to generate a unique secure key. A cost of implementing the leakage current based SRAM PUF can be kept low due to minimal adjustments to currently existing architecture. The minimal adjustments can include adding tracking circuits for voltage monitoring and adding muxes to select between channel voltages and bitlines as inputs for comparators, such as CMP706 described in FIG. 7. The leakage current based SRAM PUF approach can consume less power than alternative approaches and can protect against side channel power attacks since the leakage current based SRAM PUF approach may not involve switching elements. Additionally, sense amplifier power can be sympatric in that there may be no difference in amplifier power whether memory elements of the SRAM array are in an on or off state.

[0065] FIG. 14 is a graph depicting a distribution of hamming distances for one-hundred forty-eight keys determined using a leakage current based SRAM PUF according to some aspects of the present application. To evaluate the randomness performance of the leakage current based SRAM PUF, the hamming distance between 148 keys of 32 bits length was evaluated. Hamming distance between two bit sequences of equal length can represent a number of positions in the sequences where the bit sequences are different. For example, consider the following alphanumeric sequences: KTATHY, KTCNHY, and KTCTMY. The first two sequences have a hamming distance of two because the third and fourth positions are different and the last two sequences have a hamming distance of two as well because the fourth and fifth positions are different. The results for the leakage current based SRAM PUF approach were compared to the same number of keys with the same key length which were generated using Matlab uniform random number generator. As can be noted from the results, the hamming distance distribution of the leakage current based SRAM PUF matches the one obtained using Matlab, which emphasizes the efficiency of the leakage current based SRAM PUF at creating secure, difficult to predict keys.

[0066] FIG. 15 is a block diagram of an example of a computing device 1200 that includes an SRAM array according to some aspects of the present application. As shown, the computing device 1200 includes a processor 1202 communicatively coupled to memory 1204. The processor 1202 can include one processing device or multiple processing devices. Non-limiting examples of the processor 1202 include a Field-Programmable Gate Array (FPGA), an application specific integrated circuit (ASIC), a microprocessor, or any combination of these. The processor 1202 can execute instructions 1210 stored in the memory 1204 to perform operations. In some examples, the instructions 1210 can include processor-specific instructions generated by a compiler or an interpreter from code written in any suitable computer- programming language, such as C, C++, C#, Python, or Java.

[0067] The memory 1204 can include one memory device or multiple memory devices. The memory 1204 can be non-volatile and may include any type of memory device that retainsstored information when powered off. Non-limiting examples of the memory 1204 include electrically erasable and programmable read-only memory (EEPROM), flash memory, or any other type of non-volatile memory. At least some of the memory 1204 can include a non- transitory computer-readable medium from which the processor 1202 can read instructions 1210. The non-transitory computer-readable medium can include electronic, optical, magnetic, or other storage devices capable of providing the processor 1202 with the instructions 1210 or other program code. Non-limiting examples of the non-transitory computer-readable medium include magnetic disk(s), memory chip(s), RAM, an ASIC, or any other medium from which a computer processor can read instructions 1210.

[0068] The memory 1204 can further include an SRAM array 1212. Additionally, the computing device 1200 can include additional components for implementing a leakage current based SRAM PUF for assigning bit sequences to columns of the SRAM array 1212. The memory can also include NAND elements 1214. The computing device 1200 can further include more components for implementing a leakage current based NAND based PUF for assigning bit sequences to columns of the NAND elements 1214. The additional components can include a CMP and tracking circuits. The bit sequences can be used to generate a secure key for performing actions such as authenticating the computing device 1200.

[0069] FIG.16 is a set of graphs showing the probability of logic 1 voltage and probability of logic 0 voltage for 2000 samples of NAND based PUF implementation based on Monte Carlo simulations at an ambient temperature of -10^ according to some aspects of the present application. The four graphs 1610-1640 depict results for various commercial electronics products created using 22 nanometer Global foundry FDSOI process technology. In each case, the simulations show almost 50% probability for logic 1 and 50% probability for logic 0. FIG.17 is a set of graphs showing the probability of logic 1 and probability of logic 0 for 2000 samples of NAND based PUF implementation based on Monte Carlo simulations at an ambient temperature of 27^ according to some aspects of the present application. FIG.18 is a set of graphs showing the probability of logic 1 and probability of logic 0 for 2000 samples of NAND based PUF implementation based on Monte Carlo simulations at an ambient temperature of 50^ according to some aspects of the present application. FIG.19 is a set of graphs showing the probability of logic 1 and probability of logic 0 for 2000 samples of NAND based PUF implementation based on Monte Carlo simulations at an ambient temperature of 80^ according to some aspects of the present application. FIG.20 is a set of graphs showing the probability of logic 1 and probability oflogic 0 for 2000 samples of NAND based PUF implementation based on Monte Carlo simulations at an ambient temperature of 110^ according to some aspects of the present application. FIG.21 is a histogram showing occurrences of various values of sleep to sample entropy (SaEn) for 2000 samples of NAND based PUF implementation based on Monte Carlo simulations at an ambient temperature of 110^ according to some aspects of the present application.

[0070] In the preceding description, various embodiments have been described. For purposes of explanation, specific configurations and details have been set forth in order to provide a thorough understanding of the embodiments. However, it will also be apparent to one skilled in the art that the embodiments may be practiced without the specific details. Furthermore, well-known features may have been omitted or simplified in order not to obscure the embodiment being described.

[0071] Some embodiments of the present disclosure include a system including one or more data processors. In some embodiments, the system includes a non-transitory computer readable storage medium containing instructions which, when executed on the one or more data processors, cause the one or more data processors to perform part or all of one or more methods and / or part or all of one or more processes and workflows disclosed herein. Some embodiments of the present disclosure include a computer-program product tangibly embodied in a non- transitory machine-readable storage medium, including instructions configured to cause one or more data processors to perform part or all of one or more methods and / or part or all of one or more processes disclosed herein.

[0072] The terms and expressions which have been employed are used as terms of description and not of limitation, and there is no intention in the use of such terms and expressions of excluding any equivalents of the features shown and described or portions thereof, but it is recognized that various modifications are possible within the scope of the invention claimed. Thus, it should be understood that although the present invention as claimed has been specifically disclosed by embodiments and optional features, modification and variation of the concepts herein disclosed may be resorted to by those skilled in the art, and that such modifications and variations are considered to be within the scope of this invention as defined by the appended claims.

[0073] The description provides preferred exemplary embodiments only, and is not intended to limit the scope, applicability or configuration of the disclosure. Rather, the ensuingdescription of the preferred exemplary embodiments will provide those skilled in the art with an enabling description for implementing various embodiments. It is understood that various changes may be made in the function and arrangement of elements without departing from the spirit and scope as set forth in the appended claims.

[0074] Specific details are given in the description to provide a thorough understanding of the embodiments. However, it will be understood that the embodiments may be practiced without these specific details. For example, specific computational models, systems, networks, processes, and other components may be shown as components in block diagram form in order not to obscure the embodiments in unnecessary detail. In other instances, well-known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary detail in order to avoid obscuring the embodiments.

Claims

WHAT IS CLAIMED IS:

1. A device comprising: an array of memory elements comprising: a plurality of columns, at least one of the plurality of columns configured to be assigned a bit sequence based at least in part on a measured total leakage current for the column, bit sequences assigned to the plurality of columns forming a secure key associated with the device; and a plurality of transistors included in the at least one of the plurality of columns, at least one of the plurality of transistors contributing a leakage current different than at least a contribution from another transistor in the plurality of transistors to the measured total leakage current for the column.

2. The device of claim 1, wherein each transistor of the plurality of transistors is in a retention mode when the bit sequence is assigned.

3. The device of claim 1, wherein the secure key is configured to identify the device, authenticate the device, or encode a cryptographic engine.

4. The device of claim 1, wherein the plurality of transistors comprises a plurality of field effect transistors (FETs), each FET sharing a single well that is electrically isolated from wells of other columns.

5. The device of claim 4, wherein each FET is a p-channel FET and the single well is an n-type well.

6. The device of claim 4, wherein each FET is a n-channel FET and the single well is a p-type well.

7. The device of claim 1, wherein the total leakage current measurement for the at least one column is based on a potential difference comparison between at least two columns in the plurality of columns, the potential difference comparison determined after completion of a sense time.

8. The device of claim 7, wherein the array of memory elements comprises an additional column, each element of the additional column configured to monitorretention voltages of at least one transistor in an assigned column and to select a value for the sense time associated with a potential difference comparison involving the assigned column.

9. The device of claim 8, wherein the value for the sense time of the assigned column is based at least in part on a threshold voltage for at least one transistor in the assigned column.

10. The device of claim 7, wherein a value for the sense time of each pair of two columns differs from values of sense times of other column pairs in the array.

11. The device of claim 1, wherein the plurality of transistors is formed from a Fully Depleted Silicon-On-Insulator (FDSOI) fabrication process.

12. The device of claim 1, wherein each transistor of the plurality of transistors is a Fin field effect transistor (FinFET).

13. A method comprising: measuring, for at least one column of a plurality of columns in an array of memory elements of a device, a total leakage current for the at least one column, each transistor in a plurality of transistors in the at least one column contributing a leakage current different than at least a contribution of another transistor in the plurality of transistors to the total leakage current for the at least one column; assigning, for the at least one column, a bit sequence to the at least one column, the bit sequence based at least in part on the measured total leakage current for the column; and forming a secure key for the device by combining bit sequences of the plurality of columns in the array.

14. The method of claim 13, wherein each transistor of the plurality of transistors is in a retention mode when the bit sequence is assigned.

15. The method of claim 13, further comprising performing at least one action using the secure key.

16. The method of claim 15, wherein the at least one action comprises identifying the device, authenticating the device, or encoding a cryptographic engine.

17. The method of claim 13, wherein the plurality of transistors comprises a plurality of field effect transistors (FETs), each FET sharing a single well that is electrically isolated from wells of other columns.

18. The method of claim 16, wherein each FET is a p-channel FET and the single well is an n-type well.

19. The method of claim 16, wherein each FET is a n-channel FET and the single well is a p-type well.

20. The method of claim 13, wherein measuring the total leakage current for the at least one column comprises comparing a potential difference between the at least one column and one other column in the plurality of columns, the potential difference comparison determined after completion of a sense time.

21. The method of claim 20, wherein measuring the total leakage current for the at least one column comprises selecting, based at least in part on a threshold voltage for at least one transistor in the at least one column, the sense time.

22. The method of claim 13, wherein the plurality of transistors is formed from a Fully Depleted Silicon-On-Insulator (FDSOI) or Fin field effect transistor (FinFET) fabrication process.

Images