Extracting Secret Keys from Integrated Circuits

Transcription

1 Extracting Secret Keys from Integrated Circuits Daihyun Lim April 5, 005 Abstract Modern cryptographic protocols are based on the premise that only authorized participants can obtain secret keys and access to information systems. However, sophisticated tampering methods have been devised to extract secret keys stored in digital integrated circuits (ICs) from conditional access systems such as smartcards and ATMs. Arbiter-based Physical Unclonable Functions (PUFs) is proposed to exploit the statistical delay variation of wires and transistors across ICs in a manufacturing process to build unextractable secret keys. We fabricated arbiterbased PUFs in custom silicon and investigated the identification capability, reliability, and security of this scheme. Experimental results and theoretical studies show that a sufficient amount of inter-chip variation exists to enable each IC to be identified reliably and securely over a practical range of environmental variations such as temperature and power supply voltage. We show that arbiter-based PUFs are realizable and well-suited to build, for example, key-cards that need to be resistant to physical tampering attacks. 1 Introduction For many applications that need to identify and authenticate users, system security is based on the protection of secret keys. In these applications, malicious users can impersonate authorized users when the secret key is uncovered. Thus, secret key storage devices, such as smartcards, provide active logical controls to protect the secret keys against various kinds of logical and physical tampering attacks. However, recently developed invasive and non-invasive physical tampering methods such as micro-probing, laser cutting, glitch attacks, and power analysis have made it possible to extract digitalized secret information from ICs and compromise conditional access systems by using illegal 1

2 copies of the secret information [1]. For example, an adversary can remove a smartcard package and reconstruct the layout of the circuit using chemical and optical methods. Even the data in nonvolatile memories such as EEPROMs and NVRAMs can be revealed by sophisticated tampering methods. To prevent these physical attacks, various kinds of protection mechanisms have been invented. For example, additional metalization layers that form a sensor mesh above an actual circuit can be introduced to provide a tamper-sensing environment. This sensor mesh technique has been used in some commercial smartcard CPUs, such as ST16SF48A and in some battery-buffered SRAM security processors, such as DS500FPM and DS1954 []. Using the sensor mesh, any interruption and short-circuit can be monitored while power is available and a laser cutter or selective etching access to bus lines can be prevented. Though the tamper-sensing environment can cause difficulty for an adversary, the sensor mesh cannot prevent the extraction of hard-wired information when the circuit power is off. As an alternative, pseudo random functions can be used to avoid storing actual bits of secret keys in digital circuits [3]. However, sophisticated reverse engineering still enables an adversary to build illegal copies of the circuits that implement the pseudo random functions. Instead of using the digital circuitry, we propose to build random functions based on the randomness in physical materials. This type of random functions are resistant to the cloning attacks because an adversary is not in control of the heterogeneous materials that hold secret information, and therefore, he cannot physically clone such a random function. Pappu et. al. introduce the concept of Physical One-Way Functions (POWFs) in [4, 5]. They use a transparent optical medium with a 3-dimensional micro-structure as a POWF. The input/challenge of the POWF is an incoming laser beam and the output/response of the POWF is a fixed-length bit vector derived from resulting interference patterns. The interference pattern depends on the angle and frequency of the incoming beam and the speckle pattern in the optical medium. The total number of possible challenge-response pairs (CRPs) depends on the volume of the optical medium and the minimal possible wave length of the laser beam. There are tens of thousands possible CRPs. This means that it is feasible for an adversary to measure and create a complete list of possible CRPs which can be used as a counterfeit of an original POWF. Gassend et. al. introduced the concept of a silicon physical random function, also called silicon

3 Physical Unclonable Functions (PUFs) [6, 7]. Silicon is a good base material to build physical random functions because we can use common CMOS manufacturing processes. Given a fixed challenge, the corresponding response varies across different ICs because the PUF responses are designed to be sensitive to circuit delays which vary across ICs due to process variation in transistors and wires. Since process variation is beyond manufacturers control, even an adversary who has detailed information of the PUF circuit cannot physically clone the silicon PUF of a given IC. Silicon PUFs have an exponential number of possible CRPs such that the software clone based on an exhaustive measurement of possible CRPs is impossible. In silicon PUFs, noise is an important issue because circuit delays are also sensitive to environmental variations such an temperature and power supply voltages. In this paper, we propose a scheme named arbiter-based PUF which improves the reliability of the PUFs against environmentally induced noise by using a differential structure. Instead of measuring absolute delay values for PUF responses, we compare two symmetric delay paths and generate digital information using an arbiter. Arbiter-based PUF test-chips were fabricated using a TSMC 0.18 µm process. From experimental results, we infer the identification capability, reliability, and security of the arbiterbased PUF scheme. Lastly, we propose an alternative architecture to improve the security of the arbiter-based PUFs against software model building attacks by adding unpredictable non-linearity. Arbiter-Based PUF.1 General Description of Arbiter-based PUFs An arbiter-based PUF is composed of reconfigurable delay paths and an arbiter at the end of the delay paths. Figure 1 depicts an arbiter-based PUF circuit. In this scheme, we excite two delay paths simultaneously and make the transitions race against each other. The arbiter at the end of the delay paths determines which rising edge arrives first and sets its output to 0 or 1 depending on the winner. The circuit takes m challenge bits (b i ) as an input to configure the delay paths and generate a one-bit response as an output. Thus, the number of possible configurations of delay paths is m, i.e., exponential in m. In our test-chips, m is 64. At the end of the circuit, the delay difference between top and bottom paths is determined by the configuration of delay paths. The response of the arbiter varies across ICs if the delay change by 3

4 Figure 1: The structure of an arbiter-based PUF (basic arbiter scheme). process variation in the delay paths is greater than the delay difference. For challenges whose delay difference is greater than the maximum process variation, their responses are biased to 0 or 1 and do not change across ICs. Thus, in order to maximize the inter-chip variation of PUF responses, the delay paths must be placed and routed as symmetrically as possible so as to minimize the systematic delay difference between two paths. Figure details a switch component. A switch connects its two input ports (i 0 and i 1 ) to the output ports (o 0 and o 1 ) with different configurations depending on the control bit (b i ); for b i =0 the paths go straight through, while for b i =1 they are crossed. It is implemented with a pair of -to-1 multiplexers and buffers. In our test-chips, the cells are placed and routed symmetrically and the wires in the delay circuit cover the entire chip effectively. This layout technique makes it extremely difficult for an adversary to probe internal nodes to read out a logic value without breaking the PUF, i.e., without changing the delays of wires or transistors. For an arbiter, a simple transparent data latch has been used. Figure 3 shows the operation of the latch as an arbiter. The output Q samples 1 only when the rising edge of a data input D comes earlier than a rising edge of a gate input G by more than the setup time of the latch. Since input signals must satisfy the setup time, the arbiter favors the path to output 0. This property introduces a skew factor in a delay model of arbiter-based PUFs. In result, only 10% of total responses from our test-chips are 1 s on average. To compensate for the skews, we fix (for each 4

5 Figure : Implementation of a switch component. IC separately) some of the most significant challenge bits to effectively lengthen the delay path connected to a gate input. Experimental results show that we need to fix 1 out of 64 challenge bits (b 53,..., b 64 ) to achieve balanced responses. Figure 3: The signal transition of simple transparent data latch for an arbiter.. Characteristics of arbiter-based PUFs To identify individual PUF ICs, we generate Challenge-Response Pairs (CRPs) of each PUF. We define the inter-chip variation τ between two different PUFs as the probability that responses from two PUFs are different from each other for a random challenge. If τ is large enough compared to 5

6 Figure 4: The differential delay measurement using a comparator circuit maximum noise probability, then by generating a sufficient number of CRPs, we can distinguish different ICs with negligible error probability. Environmental variation, meta-stability, and aging cause noise in the measurements of PUF responses. To quantify the effect of noise, we define the noise (µ) as the probability that a newly measured response of a challenge for a given IC is different from the corresponding reference response of the same challenge for the same IC. To estimate the identification capability of the arbiter-based PUF scheme, this noise probability should be precisely measured by experiments. In the arbiter-based PUF scheme, we use a differential delay measurement which can reduce a significant amount of common-mode noise. Figure 4 shows the concept of differential delay measurement. Additionally, this measurement scheme takes only one cycle to finish response generation as opposed to the ring oscillator scheme which takes multiple cycles [6, 7]. We can increase the number of bits by replicating the same circuit up to the desired number of bits..3 Security of arbiter-based PUFs A response of an arbiter-based PUF can be represented as a linear function of a challenge (cf. Appendix A). An adversary can use machine learning algorithms such as a support vector machine to build a software model of a PUF circuit [8, 9]. Using the software model as a virtual counterfeit, the adversary can simulate the original PUF to predict the responses of random challenges. If the model predicts the responses with high accuracy, then the model can be used as a software clone of the PUF circuit. When the modeling attack is a concern, the security of PUFs can be fortified by adding unpredictable nonlinearity (or discontinuity) to the original PUF circuit to make the model building attck more difficult 1. As a hard-to-be-broken example, a feed-forward arbiter scheme is proposed as depicted in Figure 5. In the feed-forward arbiter scheme, multiple internal challenge 1 For PUFs where the response is obfuscated, this attack cannot be carried out successfully [10]. 6

7 Figure 5: Adding unknown challenge bits using feed-forward arbiters (feed-forward arbiter scheme). bits are determined not by external inputs but by the racing result in intermediate stages [9, 11]. Since the internal feed-forward bits are hidden, an adversary cannot obtain sufficient information to train the support vector machine. The other direction of improving the security of arbiter-based PUFs is reducing noise probability in PUF responses. Figure 6 shows that for an adversary s software model to be successful, the response prediction must have less errors than the maximum tolerable noise in CRP measurements. Thus, by reducing the noise in PUF responses, we can increase the difficulty of the software model building attack. In [8], the reliability of PUF responses can be improved by using robust challenges which generate consistent responses in induced environmental changes. Robust challenges are explored in the manufacturing phase of PUFs and used in the generation of CRPs. 3 Experiments In this section, we present the experimental results of the primary characteristics of arbiter-based PUFs such as inter-chip variation, environmental noise, and measurement noise. Environmental noise has been measured over a practical range of environment variation. We also examine an aging effect that can potentially degrade identification capability after prolonged use. To evaluate the characteristics of arbiter-based PUFs, we generated 100,000 CRPs for each PUF in each environmental condition. In order to reduce measurement noise, the majority of 11 repeated measurements has been used as a response for each challenge. We performed the same experiments for feed-forward arbiter circuits, which were fabricated together with the regular arbiter-based PUFs. 7

8 !" #$ + $$ #$#)( * + (, * % &# '#$#)( * + &(, -./01 3* Figure 6: The error probability of a successful software model should be less than the maximum noise probability in PUF response measurement. 3.1 Inter-chip variation Inter-chip variation of arbiter-based PUFs has been tested using 190 different PUF pairs. Figure 7 shows the histogram of evaluated inter-chip variations. The average inter-chip variation is 3% and the minimum inter-chip variation is 17%. For the feed-forward arbiter scheme, we obtained a histogram similar to regular arbiter PUFs, where the average and minimum inter-chip variations have been increased to 38% and 8%, respectively. The increases are caused by the inter-chip variation of the racing result in the intermediate stages in the feed-forward arbiter scheme. Since manufacturing variation consists of die-to-die, wafer-to-wafer, and lot-to-lot variations, inter-chip variation can possibly be dependent on die and wafer locations. Within-die variation does not affect to the PUF responses since each die contains one PUF circuit. We compared the inter-chip variation within a single wafer and across wafers. Figure 8 shows the average, minimum, and maximum inter-chip variation for dies within tested wafers (wafer No. 5 and No. 6) and across the wafers. The inter-chip variation across the wafers is similar to that within a single wafer. Thus, inter-chip variation is not strongly dependent on the wafer-to-wafer variation. 8

9 30 5 # of PUF pairs Inter chip variation (%) Figure 7: The histogram of the inter-chip variation y i,j for 190 PUF pairs. Figure 8: The inter-chip variation of the PUFs from a single wafer and across wafers. 9

10 Noise Probability of Environmental Variations(%) Power supply voltage(v) (reference voltage = 1.8V) Max temperature variation(4.8%) Max voltage variation( 3.74%) :Voltage variations 1 Measurement Noise(0.7%) Difference from reference temperature(7c) (C) Figure 9: The variation of PUF responses subjected to temperature and supply voltage changes. 3. Noise in PUF responses Since PUF responses are based on the delay characteristics in ICs, environmental variations such as temperature and power supply voltage variations are the primary causes of noise in the PUF responses. Even without the environmental variations, a setup time violation for an arbiter or the small fluctuation of junction temperatures and internal voltages can cause measurement noise. Figure 9 shows the amount of environmental noise introduced by temperature (µ t ) and voltage variations (µ v ). The reference responses are measured at 7 C and 1.8 V power supply voltage. When temperature increases more than 40 degrees to 70 C, µ t 4.8%. Also, with ± % power supply voltage variation, µ v 3.74%. This shows that the differential structure of an arbiterbased PUF circuit reduces the environmental variations well below the average inter-chip variation (3%). The measurement noise (µ m ) is approximately 0.7%. For the feed-forward arbiter scheme, we obtained a figure as in Figure 9 showing a similar shape with 9.84% maximum environmental noise and 4.5% measurement noise. Both of them well below the average inter-chip variation (38%). Electro-migration and hot-carrier effects cause the aging of wires and transistors in ICs. To consider the aging effect, Figure 10 shows the result of an aging test for a month. We calculated the percentage of response bit differences from newly generated CRPs to the reference CRPs, 10

11 1.5 noise percentage (%) O.7% measurement noise days Figure 10: An aging effect on an arbiter-based PUF for 5 days. which were generated at the start of the one month period. The percentage varies slightly around µ m 0.7%. We conclude that the aging effect is not significant in a normal operating environment. For applications where a secret key is generated, we require substantially higher reliability. This can be achieved using error correction. A secure error correction scheme for arbiter-based PUFs is described in [10]. 3.3 Performance For a given 64-bit challenge, it takes 50 ns for an input rising edge to transmit across the 64- stage parameterized delay circuit and evaluate an output at an arbiter. It takes about 4.5 µs to generate 490 CRPs, which is sufficient to distinguish 10 9 arbiter-based PUFs reliably (cf. Section 4). To extract a secret key of 160 bits we need 1800 CRPs [10] which takes 90 µs (we need more CRPs because the measurement noise needs to be corrected to extract a secret key. For identification the measurement noise does not have to be corrected precisely). This is sufficiently fast for most applications since a PUF is evaluated infrequently to obtain a secret key. We can boost the performance by replicating multiple delay paths and arbiters to evaluate responses in parallel. 11

12 4 Discussion 4.1 Delay Model of arbiter-based PUF circuits We number PUF ICs from 1 to n. For a fixed PUF i and fixed challenge c, the difference between the delays of the top and bottom paths consists of three quantities: an average delay difference (c) which is determined by the delay path configuration, the process variation p i (c), and the remaining uncompensated skew s i. The distribution of (c) and p i (c) over random challenges c can be assumed to be Gaussian, (c) N(0, σ ) and p i (c) N(0, σ p ), according to the central limit theorem [1]. We assume that (c) and p i (c) are statistically independent of each other. Hence, = (c) + p i (c) + s i N(s i, σ), where σ = σ + σ p. The response corresponding to c measured by PUF i is determined by the sign of. In this delay model, the ratio σ P = σ /σ p is an important parameter to estimate the amount of process variation in a given process technology. In [8], σ P is represented as a function of the probability p i that a reference response of PUF i is equal to 1, the probability p j that a reference response of PUF j is equal to 1, and the probability p i,j that both the reference responses of PUF i and PUF j corresponding to a same challenge are equal to 1. The maximum likelihood estimation method can be used to estimate σ P from the experimental results of p i, p j, and p i,j [13]. This method also leads to the confidence intervals with which the correctness of the model assumptions can be verified and the modeling noise can be computed. To estimate σ P, 10 independent pairs of two different PUFs were used. For each pair, we generated 0,000 CRPs to estimate p i, p j, and p i,j. Figure 11 shows the estimates of σ P in 10 independent experiments and their confidence intervals. Each confidence interval has an error probablity less than Notice that on average, σ P This means that the delay variation by configuration changes is only 1.75 times larger than the delay variation by process variation. An overlap region exists between the confidence intervals, which means that σ P consistently in 10 independent experiments. has been estimated We notice that σ can be calculated by extracting wire delay information of a given circuit layout using sophisticated field solvers. Together with the estimated σ P, we can measure the amount of process variation σ p. Thus, we can implement the same arbiter circuit in different manufacturing The normalized skews s i/σ, where σ = σ + σp, have been analyzed in [8]. 1

13 .4. Overlap region σ P Number of experiments Figure 11: Estimated σ P and the confidence intervals in 10 independent experiments. technologies to compare their process variations by estimating σ P. 4. Identification/Authentication Capability Assume that a server has a database with CRP profiles of N = 10 9 PUFs. Suppose that a PUF wants to authenticate itself as Alice. Then the server asks the PUF to generate a list of CRPs corresponding to the CRP profile of Alice in the server s database. If the PUF is indeed Alice, then each generated response bit differs from the corresponding profile s response bit with probability µ, which is the maximum noise. If the PUF is not who it claims to be, then this probability is equal to the inter-chip variation τ (> µ). Suppose that the server authenticates the PUF as Alice only if the number of response bit differences is less than or equal to some threshold t. This leads to two kinds of error probabilities; the false alarm rate (FAR) corresponds to Alice not being authenticated and recognized as Alice and the false detection rate (FDR) corresponds to a PUF different from Alice being authenticated as Alice. The authentication capability is measured by FAR and FDR; the more CRPs are used for authentication, the smaller these error probabilities will be. Let each CRP profile have k CRPs. 13

14 Then, and F AR = F DR = k i=t+1 t i=0 ( ) k µ i (1 µ) k i i ( ) k τ i (1 τ) k i. i We are interested in the minimal k (number of CRPs needed per authentication) such that there exists an appropriate t for which the average (F AR + F DR)/ 1/N. For arbiter-based PUFs we take τ = 0.30 and µ = 0.048, which yield k = 470 and t = 56. For the feed-forward arbiter scheme, τ = 0.380, µ = 0.098, k = 304 and t = 65. If a server wants to identify a PUF, then it asks the PUF to generate a list of CRPs. The server compares the CRPs to each of the CRP profiles in its database. The CRP profile with the least number of differences identifies the PUF. The identification probability (IP) is the probability that a PUF is identified as a correct PUF with the noise probability µ, which can be represented as follows. IP = k j=0 ( ) k µ j (1 µ) k j (1 F DR t=j ) N 1. j For arbiter-based PUFs the minimal k for which 1 IP 1/N is equal to 490. For the feed-forward arbiter scheme, k = Conclusion We proposed a candidate PUF implementation, fabricated it, and investigated its security and reliability. The test chip was built in TSMC s 0.18 µm, single-poly, 6-level metal process with standard cells, whose die photo is shown in Figure 1. It contains 8 sets of the arbiter circuit generating an 8-bit response for a challenge and a JTAG-like serial interface, and measures a total area of 11 µm x 11 µm. Experimental results show that there exists significant delay variation of wires and transistors across ICs implementing this circuit and that the idea of leveraging this variation to reliably identify and authenticate each IC is promising. Advanced non-linear configurations of PUF circuits can prevent model building attacks from adversaries. 14

15 Figure 1: A die photo of the fabricated chip Appendix A Additive Linear Delay Model of a PUF Circuit In this section, we show the derivation of the linear equation of PUF delays. We denote δ top (n) as a signal delay from the starting point to the top path at the end of the n th stage. Figure 13 shows the notations of the delay segments p n, q n, r n, and s n in each stage. Similarly, δ bottom (n) denotes the delay of the bottom path. We can derive δ top (i + 1) as a function of δ top (i), δ bottom (i), and the delay segments of the (i + 1) th stage as follows. δ top (i + 1) = 1 + C i+1 (p i+1 + δ top (i)) + 1 C i+1 (s i+1 + δ bottom (i)), (1) δ bottom (i + 1) = 1 + C i+1 where C i { 1, 1} is a challenge bit of the i th stage. (q i+1 + δ bottom (i)) + 1 C i+1 (r i+1 + δ top (i)), () 15

16 Figure 13: The notations of delay segments in each stage. Then, we denote (n) as the difference between δ top (n) and δ bottom (n). By subtracting Eqn. () from Eqn. (1), we can derive where α n = pn qn+rn sn and β n = pn qn rn+sn. We define the parity of challenge bits p k as (i + 1) = C i+1 (i) + α i+1 C i+1 + β i+1, (3) p k = n i=k+1 where p n = 1. From Eqn. (3), we can represent (n) as a function of α i, β i, and C i for 1 i n, and simplify it using the parity p i such that, (0) = 0 C i, (1) = C 1 (0) + α 1 C 1 + β 1 = α 1 C 1 + β 1 () = C (α 1 C 1 + β 1 ) + α C + β = α 1 C 1 C + α C + β 1 C + β (3) = C 3 (α 1 C 1 C + α C + β 1 C + β ) + α 3 C 3 + β 3 = α 1 C 1 C C 3 + α C C 3 + α 3 C 3 + β 1 C C 3 + β C 3 + β 3 (n) = α 1 p 0 + α p α n p n 1 + β 1 p 1 + β p β n p n = α 1 p 0 + (α + β 1 )p 1 + (α 3 + β )p (α n + β n 1 )p n 1 + β n p n = p, d 16

17 where p = (p 0, p 1,..., p n ) and d = (α 1, α + β 1,..., α n + β n 1, β n ) In conclusion, (n) can be represented as an inner product of the parity vector p and the constant delay vector d. References [1] Oliver Kommerling and Markus G. Kuhn, Design principles for tamper-resistant smartcard processors, in USENIX Workshop on Smartcard Techonlogy, [] R. Anderson and M. Kuhn, Tamper Resistance - a Cautionary Note, in Proceedings of the Second Usenix Workshop on Electronic Commerce, Nov. 1996, pp [3] Oded Goldreich, Shafi Goldwasser, and Silvio Micali, On the Cryptographic Applications of Random Functions, in Proceedings of Crypto 84 on Advanceds in cryptology, 1985, pp [4] Pappu S. Ravikanth, Physical One-Way Functions, Ph.D. thesis, Massachusetts Institute of Technology, 001. [5] Ravikanth Pappu, Ben Recht, Jason Taylor, and Neil Gershenfeld, Physical One-Way Functions, Science, vol. 97, pp , 00. [6] Blaise Gassend, Physical Random Functions, M.S. thesis, Massachusetts Institute of Technology, Jan [7] Blaise Gassend, Dwaine Clarke, Marten van Dijk, and Srinivas Devadas, Silicon Physical Random Functions, in Proceedings of the Computer and Communication Security Conference, November 00. [8] Daihyun Lim, Extracting Secret Keys from Integrated Circuits, M.S. thesis, Massachusetts Institute of Technology, May 004. [9] B. Gassend, D. Lim, D. Clarke, M. van Dijk, and S. Devadas, Identification and Authentication of Integrated Circuits, Concurrency and Computation: Practice and Experience, vol. 16, pp ,

18 [10] Marten van Dijk, Daihyun Lim, and Srinivas Devadas, Reliable secret sharing with physical random functions, Tech. Rep., MIT Computation Structures Group MEMO-475, May 004, [11] Jae W. Lee, Daihyun Lim, Blaise Gassend, Edward G. Suh, Marten van Dijk, and Srinivas Devadas, Building a Secret Key in Integrated Circuits for Identification and Authentication Applications, in 004 Symposium on VLSI circuits, 004, pp [1] James A. Power, Brian Donnellan, Alan Mathewson, and William A. Lane, Relating statistical MOSFET model parameter variabilities to IC manufactuing process fluctuations enabling realistic worst case design, IEEE Trans. on Semiconductor Manufacturing, vol. 7, no. 3, [13] Annette J. Dobson, An Introduction to Generalized Linear Models, Chapman and Hall/CRC,