Physical Characterization of Arbiter PUFs

As intended by its name, Physically Unclonable Functions (PUFs) are considered as an ultimate solution to deal with insecure stor- age, hardware counterfeiting, and many other security problems. How- ever, many different successful attacks have already revealed vulnera- bilities of certain digital intrinsic PUFs. Although settling-state-based PUFs, such as SRAM PUFs, can be physically cloned by semi-invasive and fully-invasive attacks, successful attacks on timing-based PUFs were so far limited to modeling attacks. Such modeling requires a large sub- set of challenge-response-pairs (CRP) to successfully model the targeted PUF. In order to provide a final security answer, this paper proves that all arbiter-based (i.e. controlled and XOR-enhanced) PUFs can be com- pletely and linearly characterized by means of photonic emission analy- sis. Our experimental setup is capable of measuring every PUF-internal delay with a resolution of 6 picoseconds. Due to this resolution we in- deed require only the theoretical minimum number of linear independent equations (i.e. physical measurements) to directly solve the underlying inhomogeneous linear system. Moreover, we neither require to know the actual PUF challenges nor the corresponding PUF responses for our physical delay extraction. On top of that devastating result, we are also able to further simplify our setup for easier physical measurement han- dling. We present our practical results for a real arbiter PUF implemen- tation on a Complex Programmable Logic Device (CPLD) from Altera manufactured in a 180 nanometer process

Verbesserte Empfindlichkeit bei der Analyse integrierter Schaltungen durch Ladungsmessung

Die vorliegende Arbeit analysiert besonders niedrige Stromstärken mithilfe von Ladungen. Die Konstruktion einer Ladungsmessschaltung mit Femtocoulomb Empfindlichkeit wird für die Verwendung in einem CMOS (complementary metal oxide semiconductor) integrierten Schaltkreis (IC) gezeigt. Durch die Messbarkeit kleiner Ladungsmengen ergeben sich weitreichende Möglichkeiten in der Fehleranalyse und Sicherheit von ICs, die an Beispielen analysiert werden: 1. Charakterisierung von Dielektrika, 2. Aufladung durch Ionenbestrahlung (FIB) von isolierenden Proben, sowie 3. Schutz und Angriff von Sicherheitsschaltkreisen auf Grundlage von Ladungen. Die Charakterisierung von Dielektrika wird konventionell mit Stress-, Leck- und Durchbruch-Verhaltensanalyse durch den Strom ausgedrückt und nur auf Basis von Modellbildungen auf Ladungsmengen übertragen. In dieser Arbeit wird das Verhalten von zwei verschiedenen Dielektrika bei Strömen im Bereich von 1 aA analysiert. Die Ladungsmessung ist gegenüber konventionellen Methoden etwa 1000x empfindlicher. Die Aufladung der isolierenden IC-Oberfläche durch die Bestrahlung mit einem FIB wird ermittelt. Ein Sekundärelektronenemissionskoeffizient von 2.2 Elektronen pro initial eintreffendem Ion, sowie von 0.8 Elektronen pro eintreffendem Ion für kontinuierliche Bestrahlung wird bestimmt. Nebeneffekte des FIB Systems im Bereich von 0.01 fA bis 10 fA äquivalentem Strom können beobachtet werden. Durch die Aufladungserscheinungen im FIB kann ein FIB Angriff durch die Zielschaltung erkannt werden. Eine entsprechende Schaltung wird konstruiert und Aspekte für die Implementierung in einen Sicherheitsschaltkreis werden diskutiert. Anhand dieser Ergebnisse können neue Erkenntnisse über die Implementierung und Verwundbarkeit von Sicherheitsschaltkreisen gewonnen werden. Die Zusammenhänge verschiedener Analyseaspekte von PUF (physically unclonable function) Schaltungen werden dargestellt. Ladungsmessung und -analyse erlauben bisher unerreichte Empfindlichkeit in unterschiedlichen Bereichen der integrierten Schaltungen.This work analyzes very low currents by investigation of charge amounts. A system capable of measuring charges down to femto-coulomb range (1E-15 C) is discussed and implemented in an IC technology (charge sensor). The system is fully compliant with CMOS technology, and can be applied to a wide range of IC related investigations. With the capability of measuring charge, impacts on many different areas of electronic circuits are identified, including FA and security ICs. These exemplary situations are part of the impact assessment: 1. dielectric leakage behavior characterization of different kinds of dielectrics, 2. analysis of charging from FIB irradiation during CE tasks in FA, and 3. security evaluation of IC hardware by consideration of charge. Dielectric characterization is conventionally done by stress-, breakdown- or leakage current analysis and possibly integration of the current for modeling based on charge dependent behavior. This work extends the dielectric characterization to charge measurements. Measurement results from two different dielectrics are presented. The characterization of the leakage behavior is possible with noise currents below 1 aA. This sensitivity is not achievable with conventional current measurement systems. FIB irradiation of insulating IC surfaces is analyzed using the charge sensor. Measurements show that 2.2 SEs are emitted per incident ion from the neutral insulating IC surface. Charging of the IC surface reduces this to 0.8 SEs during continuous irradiation. The electronically blanked ion beam causes the observation of a parameter-dependent charging current of 0.01 fA to 10 fA. A FIB detector circuit is implemented by using the charge sensor to identify the surface charging of the ion beam. The aspects for integrating the charge sensor into a security IC are discussed. Commonalities and differences to current suggestions for PUF circuits are identified. An implementation of fuse bits is analyzed with the FIB showing severe vulnerabilities of this security feature due to charge investigations. Different aspects of IC hardware, wiretapping of on-die signals and semi-invasive analysis techniques are discussed. Results show that consideration of charge is an important factor when new PUF implementations are suggested. Charge analysis allows for matched and to date unrivaled sensitivity in IC analysis

Photonic Side-Channel Analysis of Arbiter PUFs

As intended by its name, Physically Unclonable Functions (PUFs) are considered as an ultimate solution to deal with insecure storage, hardware counterfeiting, and many other security problems. However, many different successful attacks have already revealed vulnerabilities of certain digital intrinsic PUFs. This paper demonstrates that legacy arbiter PUF and its popular extended versions (i.e., Feed-forward and XOR-enhanced) can be completely and linearly characterized by means of photonic emission analysis. Our experimental setup is capable of measuring every PUF-internal delay with a resolution of 6 picoseconds. Due to this resolution we indeed require only the theoretical minimum number of linear independent equations (i.e., physical measurements) to directly solve the underlying inhomogeneous linear system. Moreover, it is not required to know the actual PUF responses for our physical delay extraction. We present our practical results for an arbiter PUF implementation on a Complex Programmable Logic Device (CPLD) manufactured with a 180 nanometer process. Finally, we give an insight into photonic emission analysis of arbiter PUF on smaller chip architectures by performing experiments on a Field Programmable Gate Array (FPGA) manufactured with a 60 nanometer process