SUPPLEMENTARY INFORMATION

Transcription

1 Physically unclonable cryptographic primitives using self-assembled carbon nanotubes Zhaoying Hu, Jose Miguel M. Lobez Comeras, Hongsik Park, Jianshi Tang, Ali Afzali, George S. Tulevski, James B. Hannon, Michael Liehr, Shu-Jen Han Simulation The simulation of interaction between CNT and the charged surface was carried out in COMSOL based on a multiphysics model including electrostatics and ionic transport. (1) Poisson equation describes the electric potential based on charge distribution: ϵ ϵ(x) Ψ(x)] =ρ(x) =e N () (S1) In the above equation, Ψ(x) is the electric potential, ρ(x) is the net charge density, ϵ is the vacuum permittivity and ϵ(x) is the dielectric constant of the solution. () and denote the molar concentration and valence of the i th ionic species respectively. (2) Nernst-Planck equation describes the ion motion in the solution: (x) = (x)(x) (x) () Ψ(x) (S2) The diffusion coefficient is related to the mobility μ via Einstein relation, μ = Z /k. (x) is the velocity field of the fluid. The equation is solved under steady state, where we have () =0. Although the interaction between CNT and the substrate surface can be a complicated 3D problem, we can simplify the problem by using 2D simulation by assuming that CNT is always NATURE NANOTECHNOLOGY 1

2 parallel to the elongated direction of the trench. It is a reasonable assumption since the minimum energy state occurs when the nanotube locates near the center of the trench. Therefore, the nanotube will be forced to align along the elongated direction of the trench as long as the trench has a high length-to-width aspect ratio. The structure is shown in Figure 2a,b, in which the out-of-plane length of CNT and pattern is 500 nm. Surface charge density of SDS-CNT, SiO 2 and NMPI on HfO 2 used in the simulation is -0.05, and 0.1 C/cm 2, respectively. The salt concentration is 0.1 mm. The possible combination number In an array with a total device number of, the possible combination number ( ) of connected devices () and open devices ( ) is given by the combination equation S3. In order to evaluate the dependence of ( ) on, we apply Stirling s approximation given by equation S4 and assume = (01]. The simplified form of combination equation can be represented by equation S5. By taking derivative of function (), we can calculate the minimum value of () = when = 0.. And the function ln ( ) is symmetric about axis of = 0., as shown in Supplementary Fig. 1. ( ) = ( ) (3) ln() () () ln ( ) (1 ) ln(1 ) ln()] ()() 2 NATURE NANOTECHNOLOGY

3 SUPPLEMENTARY INFORMATION Supplementary Figure 1. The combination number of binary bits in log e scale as a function of total bits number and the yield of connected bits. Intra-distance and inter-distance For calculating intra-distance, 2560 devices were first acquired as a reference data set. A new data set was acquired from the same devices array after 5 days. Then intra-distance is calculated by measuring the Hamming distance between the bit strings extracted from these two data sets accordingly. The sample mean of ()() ()(). can be calculated to provide an estimation of (() () ) Inter-distance is calculated by measuring the HD between each two strings taken from 2560/n strings. The sample mean of (()()) (()()). can be calculated to provide an estimation of NATURE NANOTECHNOLOGY 3

4 2 () () = (1) The mean and standard deviation of the normalized inter-distance using different key size n is plotted in Supplementary Fig. 2. Supplementary Figure 2. The normalized inter-distances calculated by choosing different key sizes based on the measurements on 2056 devices. The error bar indicates the standard deviation of the normalized inter-distance. If the elements of n bit strings R(i) are random variables, the HDs between two different strings R(i) and R(j) follows a binomial distribution. (() ()) = 1 () (1) 4 NATURE NANOTECHNOLOGY

5 SUPPLEMENTARY INFORMATION = 1 ( 1) 1 ( 1) ( 1) (1 ) = (1 ) () =(+1 ) = () () E = 1 ( ) (1 ) = 1 ( 1) +] ( ) (1 ) = ( 1) + () () () () () () =E = ( 1) + = p(1 p) where k is the number of occurring 1, and p the probability of occurrence of 1. Supplementary Table 1. Encodings and their probabilities for our data Binary code Probability Ternary code Probability Double binary code 0 (Open) a= (Open) a= (Open) 1 (Connected) b= (Semiconducting) b= (Semiconducting) 2 (Metallic) c= (Metallic) Taken 64-bit key for example, for binary code, the mean equals to probability μ = = 2 = 0.000; For ternary code, the probability μ = =2( + + ) = ; For double binary code, the probability μ = = 2 + ( + ) = These calculated values agrees well with the values shown in Supplementary Fig. 2. NATURE NANOTECHNOLOGY 5

6 The number of independent variables N = (). The variance is from Gaussian approximation of inter-distance distribution. Spatial autocorrelation analysis To investigate the effect of CNT bit on the value of its adjacent CNT bits, we carried out spatial autocorrelation analysis by calculating Geary s c univariate correlation coefficient. This correlation coefficient compares the value of the variable at any one location with the values in small neighborhoods, which is sensitive to the local correlation. c = ( 1) 2 ( ) = 1, 0, = where, are the value of the bits at the i th and j th location in the bits map, is the sample mean, n is the number of total bits, is a weight matrix indicating the spatial relationship of bits i and j. In our study, we consider 4 direct neighbors. The coefficient c usually ranges from 0 to 2, with an expected value () of 1 under no autocorrelation. Values from 0 to 1 indicate positive spatial autocorrelation, values above 1 indicates negative spatial autocorrelation. Based on the bits map in Fig. 5b, the coefficient is calculated to be c=0.9572, which is very close to 1, indicating no spatial autocorrelation in the bits map. 6 NATURE NANOTECHNOLOGY

7 SUPPLEMENTARY INFORMATION Since the number of bits (2560) is large, we can assume the random variable is normally distributed. The variance of coefficient c can be estimated as Var(c) = (2 + )( 1) 4 2( +1) = = + The z-score is calculated to be using the following equation, which is very close to the expected value 0. This z-score test further confirms no local spatial correlation in our PUF. () z = () Supplementary Table 2. NIST statistical randomness test performance of CNT random bits with 2560-bit long. For 1% significant level, p-value should be larger than (N/A corresponds to those test which are not applicable due to the requirement of extremely long bit string length >1,000,000) Statistical Test p-value Pass/Fail Frequency Pass Block Frequency Pass Runs Pass Longest Run Pass Rank Pass FFT Pass Non-overlapping Template Pass Overlapping Template Pass Serial Pass Approximate Entropy Pass Cumulative Sums Pass NATURE NANOTECHNOLOGY 7

8 Universal N/A N/A Linear Complexity N/A N/A Random Excursions N/A N/A Random Excursions Variant N/A N/A Supplementary Figure 3. Bridge faults (F 1, F 2 ) introduced by randomly placed CNTs in a full adder. Supplementary Table 3. Output of a full adder in fault-free condition and single fault F 1 or F 2. Input Output(C out /S) A B C in Fault-Free F 1 F Obfuscating the gate layout by the metallic CNTs Besides the basic CNT transistors structure described in the main text, top gates can be fabricated on each transistor, with gate metal leads connected by metallic CNTs using one more 8 NATURE NANOTECHNOLOGY

9 SUPPLEMENTARY INFORMATION CNT deposition process. The layout is shown in Supplementary Fig. 5. Due to the extremely small dimension of CNTs, this design obfuscates the gate layout and greatly increases the tamper resistance of CNT PUF. Supplementary Figure 4. Obfuscating the gate layout of a CNT transitor by inserting a metallic CNT lead within the gate lead. NATURE NANOTECHNOLOGY 9