Applying circuit delay-based physically unclonable functions (PUFs) for masking operation of memory-based PUFs to resist invasive and clone attacks

One feature pertains to generating a unique identifier for an electronic device by combining static random access memory (SRAM) PUFs and circuit delay based PUFs (e.g., ring oscillator (RO) PUFs, arbiter PUFs, etc.). The circuit delay based PUFs may be used to conceal either a challenge to, and/or response from, the SRAM PUFs, thereby inhibiting an attacker from being able to clone a memory device's response.

BACKGROUND

Field

The present disclosure pertains to the use of physically unclonable functions (PUFs) to uniquely identify a memory device or device into which such memory device is integrated.

Background

Physical Unclonable functions (PUFs) provide a mechanism to uniquely identify a hardware device based on intrinsic variations of physical components. When multiple chips are manufactured, the complex semiconductor manufacturing process introduces slight variations that are beyond the control of the designer. For instance, even if two chips are manufactured from the same silicon wafer, electrical paths designed to be the same will probably differ in width by a few nanometers; microscopic differences in the surface of the silicon will induce almost trivial variations in the curvature of lines. As these unique characteristics are uncontrollable and inherent to the physical device, quantifying them can produce an intrinsic identifier. Several different types of PUFs have been proposed based on exploration and analysis of silicon variations in circuit delays, such as ring oscillator based PUFs, arbiter PUFs, and path delay analysis based PUFs.

One PUF makes use of the uninitialized power-up state of a static random access memory (SRAM) to generate an identifying “fingerprint”. However, the SRAM PUFs are susceptible to cloning attacks.

Consequently, there is a need to improve the security of current SRAM PUF designs to resist cloning attacks and invasive attacks in general.

SUMMARY

An electronic device (e.g., processor, processing circuit, memory, programmable logic array, chip, semiconductor, memory, etc.) is provided which can be uniquely identified while being resistant to cloning attack. The electronic device may include a plurality of memory cells within the electronic device serving as a first physically unclonable function (PUF). In one example, the first physically unclonable function may use the uninitialized memory cell states for one or more memory cells as a response to the challenge. Additionally, a plurality of circuit delay based paths within the electronic device may implement a second physically unclonable function. In one example, the plurality of circuit delay based paths may be ring oscillators and the second physically unclonable function may receive a challenge that selects two ring oscillators from the plurality of ring oscillators and responds with a frequency differential between the two ring oscillators.

A communication interface may serve to receive a challenge from an external server. A processing circuit may be coupled to the communication interface, the plurality of memory cells, and the plurality of circuit delay based paths, wherein the processing circuit is adapted to apply the challenge to the first physical unclonable function by using a first response from the second physically unclonable function to either: (a) mask/unmask a challenge input to the first physically unclonable function, (b) generate the challenge input to the first physical unclonable function, or (c) mask a response output from the first physically unclonable function. The communication interface may be adapted to send a second response from the first physically unclonable function to the external server. Additionally, the first response may be sent from the second physically unclonable function to the external server. In one example, the external server may include a first database of challenges and responses for the first physically unclonable function and a second database of challenges and responses for the second physically unclonable function, where the external server sends the challenge to the electronic device and authenticates or identifies the electronic device based on the second response.

In one example, the challenge may include a first challenge for the first physically unclonable function and a second challenge for the second physically unclonable function. In one implementation, the first challenge may be a challenge masked by an expected response to second challenge. In another implementation, the first challenge may be modified by the first response from the second physically unclonable function prior to processing by the first physically unclonable function.

In another example, the received challenge may be used by the second physically unclonable function to generate the first response which is then used as a second challenge by the first physically unclonable function to generate the second response.

In yet another example, the challenge may include a first challenge for the first physically unclonable function and a second challenge for the second physically unclonable function, the second challenge is used by the second physically unclonable function to generate the first response which is used to mask the second response from the first physically unclonable function. The first response from the second physically unclonable function may be hashed to obtain an intermediate response. The second response may then be masked using the intermediate response.

In other instances, the challenge may be received as part of at least one of: an authentication process of the electronic device, an identification process of the electronic device, and/or a key generation process within the electronic device.

In some implementations, the electronic device may have previously received one or more challenges and provided (e.g., to a data collector) one or more corresponding responses during a pre-deployment or manufacturing phase.

Additionally, a pre-stored device identifier may be sent from the electronic device to the external server either: (a) before the challenge is received, or (b) concurrent with sending the second response, wherein the device identifier uniquely identifies the electronic device.

A data collector device is also provided that obtains (e.g., receives or assigns) a device identifier associated with an electronic device during a pre-deployment or manufacturing stage of the electronic device. The data collector device may then generate and send one or more challenges to the electronic device. As a result, the data collector device may receive one or more responses from the electronic device, the one or more responses including characteristic information generated from two or more distinct types of physically unclonable functions in the electronic device. The device identifier, challenges, and corresponding responses are stored for subsequent authentication of the electronic device. This process may be repeated for each of a plurality of electronic devices. Note that the challenges sent to the electronic devices may be the same for all devices, may be randomly generated for each electronic device, and/or may be a subset of possible challenges.

Similarly an authentication device is provided that authenticates an electronic device based on the responses from distinct types of physically unclonable functions. The authentication device receives a device identifier associated with the electronic device. It then sends one or more challenges to the electronic device. In response, the authentication device receives one or more responses from the electronic device, the one or more responses including characteristic information generated from two or more distinct types of physically unclonable functions in the electronic device. The pre-stored responses specific to the electronic device may be identified using the electronic device identifier. The electronic device may then be authenticated by comparing the pre-stored responses and the received one or more responses for the electronic device. The challenges may be selected from a plurality of challenges for which responses where previously obtained from the electronic device. The pre-stored responses may have been obtained at a manufacturing stage or pre-deployment stage of the electronic device. The device identifier may be received prior to sending the one or more challenges. The device identifier may be received along with receiving the one or more responses.

The challenge may include a first challenge for a first physically unclonable function and a second challenge for a second physically unclonable function. The first challenge may be a challenge masked by an expected response to second challenge. The one or more challenges may include a first challenge for a first physically unclonable function and a second challenge for a second physically unclonable function, the one or more responses include a first response from the first physically unclonable function and a second response from the second physically unclonable function, the electronic device is successfully authenticated if the first response matches a first pre-stored response corresponding to the first challenge and the second response matches a second pre-stored response corresponding to the second challenge.

The one or more challenges include a first challenge for a first physically unclonable function and a second challenge for a second physically unclonable function, the one or more responses include a first response from the first physically unclonable function and a second response from the second physically unclonable function. Additionally, an intermediate challenge may be obtained by unmasking the first challenge with the second response. The received first response may be compared to the pre-stored response associated with the intermediate challenge.

In yet another example, the one or more challenges include a first challenge for a second physically unclonable function, the one or more responses include a first response from the first physically unclonable function. An intermediate challenge may be obtained by retrieving a pre-stored intermediate response corresponding to the first challenge. The received first response may be compared to a pre-stored intermediate response corresponding to the intermediate challenge.

In yet another example, the one or more challenges include a first challenge for a first physically unclonable function and a second challenge for a second physically unclonable function, the one or more responses include a first response. An intermediate response may be obtained by unmasking the first response with a pre-stored second response corresponding to the second challenge. The intermediate response is compared to a pre-stored response associated with the first challenge.

DETAILED DESCRIPTION

The word “exemplary” is used herein to mean “serving as an example, instance, or illustration.” Any implementation or aspect described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other aspects of the disclosure. Likewise, the term “aspects” does not require that all aspects of the disclosure include the discussed feature, advantage or mode of operation.

Overview

One feature provides for generating a unique identifier by combining static random access memory (SRAM) PUFs and circuit delay based PUFs (e.g., ring oscillator (RO) PUFs, arbiter PUFs, etc.). SRAM PUFs by themselves may be susceptible to cloning attacks that use failure analysis tools (e.g., a Focused Ion Beam (FIB)). Therefore, circuit delay based PUFs may be used to conceal either a challenge to, and/or response from, the SRAM PUFs, thereby inhibiting an attacker from being able to clone a memory device's response.

Combining SRAM and Circuit Delay Based Physically Unclonable Functions (PUFs)

A Physical Unclonable Function (PUF) is a challenge-response mechanism exploiting manufacturing process variations within circuits to obtain a unique identifier. In one example, the relation between a challenge and the corresponding response is determined by complex, statistical variations in logic components and interconnects in a circuit (e.g., integrated circuit). Two types of PUFs include, for example, an SRAM PUF and a circuit delay PUF (e.g., Ring Oscillator PUF).

An SRAM PUF exploits the uninitialized power-up state of a static random access memory (SRAM) to generate an identifying “fingerprint” for a memory device or an electronic device into which the memory device is integrated. While SRAM cell design is symmetrical, the manufacturing process deviations lead to a small asymmetry between SRAM cells, resulting in a preferred/biased state (0 or 1) during startup. This preference or bias of uninitialized SRAM cells may be used to uniquely identify a memory device.

However, recent advances in failure analysis attacks using a Focused Ion Beam (FIB) threaten the security of memory-based PUFs. A circuit edit attack could produce a hardware clone with identical SRAM PUF response to an original device.

Circuit delay based PUFs exploit systematic variations between oscillation circuits caused by fabrication/manufacturing imperfections. While fabrication/manufacturing processes seek to avoid such variations in circuit delay based PUFs, they are always present to some extent and are actually useful to identify devices/chips. In one example of a circuit delay based PUF, a plurality of ring oscillators may be concurrently used and the outputs of at least two ring oscillators are sent to one or more switches (multiplexers). The challenge may serve as input to the ring oscillators (e.g., challenge serves to select two ring oscillators) and the output from two selected ring oscillators204are represented as a first frequency and a second frequency. Because of differences between the selected ring oscillators, their frequencies will be different (i.e., resulting in a frequency differential). The RO PUF output (response) is created by a pair-wise comparison of the ring oscillator frequencies (e.g., difference between first and second frequency).

However, implementing a sizable circuit delay based PUF takes up much needed space in an integrated circuit.

According to one feature, an SRAM PUF and a circuit delay based PUF are combined within an electronic device (e.g., memory device, semiconductor device, etc.) to enhance the security of the SRAM PUF.

FIG. 1is a block diagram illustrating an exemplary way of generating a unique mapping of responses for a memory device based on a SRAM PUF and a Circuit Delay Based PUF, e.g., Ring Oscillator (RO) PUF. This block diagram illustrates the process of querying and collecting challenge/response characteristics for a memory device102(e.g., chip, semiconductor device, etc.) comprising an SRAM PUF105and a Circuit Delay PUF122(e.g., implemented as a ring oscillator bank).

In one example, the SRAM PUF may be implemented from all or parts of the SRAM cells of the memory device102. In particular, the SRAM PUF105makes use of biasing in uninitialized memory cells104of the SRAM106. For instance, during a manufacturing stage, the uninitialized SRAM106may be queried such that for each challenge110(e.g., memory address), a corresponding response112(e.g., logical 0 or 1) is obtained. For example, for each memory address within the SRAM106the uninitialized value/state for the memory cell104associated with that memory address is obtained. For a plurality of challenges110, a plurality of responses112are obtained. In other approaches, just a subset of the memory addresses may be queried. In this manner, a mapping of uninitialized values to addresses is built for the SRAM106and may be stored in a database114(e.g., as challenges and corresponding responses). That is, a database of SRAM PUF challenges/responses114may be built for each memory device (chip), for example, during a manufacturing or quality control process. For instance, for a Device-A a first set of challenges/responses [C0R0, C1R1, . . . , CiRi] is obtained, for a Device-B a second set of challenges/responses [C0R0, C1Ri, . . . , CiRi] is obtained, and for a Device-C a third set of challenges challenges/responses [C0R0, C1R1, . . . , CiRi] is obtained. Note that in some implementations, the challenges [C0, C1, . . . , Ci] for all devices may be the same, but the responses would be different. In other implementations, the challenges [C0, C1, . . . , Ci] for each device may be randomly selected, so different devices receive different challenges.

In one example, the circuit delay PUF120may be implemented as a Ring Oscillator (RO) PUF122which makes use of a plurality of ring oscillators123and their frequency variations to generate a unique signature/response. For instance, for a given challenge124(e.g., selection of two ring oscillator inputs/outputs) a corresponding response (e.g., a frequency difference between the two selected ring oscillators) is obtained. In this manner, a circuit delay PUF database128of challenges and corresponding responses are obtained.

Because uninitialized memory cell states of the SRAM106are susceptible to being cloned by a focused ion beam (FIB) attack, using just the SRAM PUF105to provide a unique identifier for the memory device102is insecure. However, unlike the SRAM PUF105, the circuit delay PUF120(e.g., RO PUF122) is not susceptible to being cloned, but using a large number of RO PUFs is undesirable as they take up space on a chip. Consequently, a relatively small number of ring oscillators123may be combined with SRAM PUF105on a memory device102(e.g., chip, semiconductor, etc.) to thwart against cloning attacks on the SRAM PUF102.

In order to associate the challenges/responses with each device, a device identifier108(e.g., serial number, ID number, etc.) may be stored at the device102and known to, or stored at, the databases114and128. That is, the device identifier108for each memory device102may be stored and associated with the corresponding challenges and/or responses for that memory device102.

FIG. 2is a block diagram illustrating an exemplary way of verifying or identifying a particular memory device using previously obtained characteristic responses for the memory device which combines a SRAM PUF and a Circuit Delay Based PUF, e.g., Ring Oscillator (RO) PUF. During operation, a device verification module/circuit202(e.g., implemented by a verifier or authentication device/server) may query the memory device102with a challenge204to obtain a response206which can be verified using the combination of SRAM PUF database114and Circuit Delay PUF database128. The response206may serve to verify the identity of the memory device or to authenticate the memory device102. Note that this technique may also serve to generate a unique identifier/signature for the memory device.

Note that, in one example, the memory device102may provide its pre-stored/pre-assigned device identifier108to the device authentication module/circuit/server202. The device authentication module/circuit/server202may then retrieve one or more challenges previously stored for that device identifier108and sends204them to the memory device102. Alternatively, the device identifier108is provided by the electronic device along with any responses to challenges (e.g., where the same challenges are used for all electronic devices). Upon receipt of the response206, the device authentication module/circuit/server202compares the received response206to the corresponding previously stored response(s) in the SRAM PUF114and Circuit Delay PUF128to ascertain whether there is a match.

During this verification stage, the challenge204and response206may be accessed or accessible to an attacker. Therefore, various features provide for protecting challenges204and/or responses206to/from the memory device102in order to inhibit an attacker from cloning the memory device102.

In one example, the circuit delay PUF120(e.g., a delay-based PUF) is tamper-resistant. While a focused ion beam (FIB) attack may expose the responses of memory cells of the SRAM PUF105, it does not provide information about the circuit delay PUF120(e.g., ring oscillators). In fact, the process used to clone/attack the memory device102may be sufficiently invasive that it may change the response of the circuit delay PUF120(e.g., ring oscillators), thereby exposing the attack and causing a failure of authentication/identification of the memory device102.

There are various ways to combine the SRAM PUF105and circuit delay PUF120to inhibit an attacker from cloning of the memory device102even when the challenges204and responses206are accessible to the attacker.

Combining SRAM and RO Physically Unclonable Functions (PUFs) to Mask Challenges

FIG. 3is a block diagram illustrates a first example of how an SRAM PUF326and a Circuit Delay PUF324may be combined to prevent an attacker from being able to clone a memory device307. In this example, an authentication device300may include a device authentication module/circuit/server303, a SRAM PUF database301, and a Circuit Delay PUF database305. The SRAM PUF database301may be generated for a memory cell region of the memory device307during manufacturing by, for example, sending a plurality of challenges (e.g., memory addresses) to the memory cell region and obtaining corresponding responses (e.g., uninitialized memory cell states/values). Similarly, the Circuit Delay PUF database305may be generated for a plurality of ring oscillator within the memory device307during manufacturing by, for example, sending a plurality of challenges (e.g., selection of two ring oscillators) to the ring oscillators and obtaining a corresponding responses (e.g., frequency differential between two selected ring oscillators).

In this example, when the device authentication module/circuit/server303subsequently tries to authenticate the memory device307, it sends a challenge (comprising Challenge A316and Challenge B312) to the memory device307. The challenge A316may comprise an SRAM PUF challenge C0306and a RO PUF response R0310that have been combined by a XOR operation302. Because this Challenge A316may be accessible by an attacker, one aspect obscures the actual SRAM PUF challenge C0306by masking (e.g., XORing) it with a corresponding RO PUF response R0310(obtained from the Circuit Delay PUF database305) to generate the transmitted (exposed) challenge A316. Additionally, challenge B312which includes an RO PUF challenge C0308, corresponding to the RO PUF response R0310, is also sent from the authentication device300to the memory device307.

At the memory device307, the RO PUF challenge C0312is used to generate a RO PUF response R0321from the circuit delay PUF324. Challenge A316is then XORed304with the RO PUF response R0321to obtain the actual (clear) SRAM PUF challenge C0323which may be used as the challenge for the SRAM PUF326. The SRAM PUF326then generates a response SRAM PUF R0325. In this manner, a response from the memory device307to the authentication device300may include SRAM PUF response R0318.

At the authentication device300, the received response SRAM PUF R0322may be used to compare to the stored responses in the SRAM PUF database301and Circuit Delay PUF305and ascertain whether they match. Note that since the RO PUF response R0310is already known or stored in the circuit delay PUF database305, the authentication device300is able to use it to mask the SRAM PUC challenge C0306with it.

FIG. 4is a block diagram illustrates a second example of how a SRAM PUF426and a circuit delay PUF424may be combined to prevent an attacker from being able to clone a memory device407. Unlike the example inFIG. 3, in this example the SRAM PUF challenge C0406and RO PUF challenge C0408are sent on the clear from the device authentication module/circuit/server403to the memory device407. In this example, an authentication device400may include a device authentication module/circuit/server403, a SRAM PUF database401, and a Circuit Delay PUF database405. The SRAM PUF database401may be generated for a memory cell region of the memory device407during manufacturing by, for example, sending a plurality of challenges (e.g., memory addresses) to the memory cell region and obtaining corresponding responses (e.g., uninitialized memory cell states/values). Similarly, the Circuit Delay PUF database405may be generated for a plurality of ring oscillator within the memory device407during manufacturing by, for example, sending a plurality of challenges (e.g., selection of two ring oscillators) to the ring oscillators and obtaining a corresponding responses (e.g., frequency differential between two selected ring oscillators).

In this example, when the device authentication module/circuit/server403subsequently tries to authenticate the memory device407, it sends a challenge (comprising Challenge A416and Challenge B412) to the memory device407. The challenge A416may comprise an SRAM PUF challenge C0406. The challenge B412includes an RO PUF challenge C0408, corresponding to the RO PUF response R0410, is also sent from the authentication device400to the memory device407.

While challenge A416may be accessible by an attacker, one aspect modifies the actual SRAM PUF challenge C0406to a modified SRAM PUF challenge C0′423by a XORing operation404at the memory device407. At the memory device407, the RO PUF challenge C0412is used to generate a RO PUF response R0421from the circuit delay PUF424. Challenge A416(i.e., SRAM PUF challenge C0406) is then XORed404with the RO PUF response R0421to obtain a modified SRAM PUF challenge C0′423which may be used as the challenge for the SRAM PUF426. The SRAM PUF426then generates a SRAM PUF response R0′425that is returned (as response A418) to the authentication device400. In this manner, a response from the memory device407to the authentication device400may include SRAM PUF response R0418.

In this approach, the RO PUF response R0421is used to modify the actual challenge to the memory cell region426. Because an attacker is unable to reproduce the RO PUF response R0421, it does not know the modified SRAM PUF challenge C0′423used to produce the response SRAM PUF response R0′425.

At the authentication device400, the device authentication module/circuit/server403may verify the SRAM PUF response R0′422. This may be done, for example, by XORing402the SRAM PUF challenge C0406with the RO PUF response R0420(obtained from the circuit delay PUF database405) to obtain a local version of the modified SRAM PUF challenge C0′427. The local version of the modified SRAM PUF challenge C0′427can then be used to lookup the corresponding response in the SRAM PUF database401and compare that response to the received response SRAM PUF response R0′422.

FIG. 5is a block diagram illustrates a third example of how an SRAM PUF526and Circuit Delay524PUF may be combined to prevent an attacker from being able to clone a memory device. In this example, a authentication device500may include a device authentication module/circuit/server503, a SRAM PUF database501, and a Circuit Delay PUF database505. The SRAM PUF database501may be generated for a memory cell region of the memory device507during manufacturing by, for example, sending a plurality of challenges (e.g., memory addresses) to the memory cell region and obtaining corresponding responses (e.g., uninitialized memory cell states/values). Similarly, the Circuit Delay PUF database505may be generated for a plurality of ring oscillator within the memory device507during manufacturing by, for example, sending a plurality of challenges (e.g., selection of two ring oscillators) to the ring oscillators and obtaining a corresponding responses (e.g., frequency differential between two selected ring oscillators).

In this example, when the device authentication module/circuit/server503subsequently tries to authenticate the memory device507, it sends a challenge512, comprising an RO PUF challenge C0508, having a corresponding RO PUF response R0.

While RO PUF challenge C0512may be accessible by an attacker, the Circuit Delay PUF524cannot be replicated by the attacker. At the memory device507, the RO PUF challenge C0512is used to generate a RO PUF response R0521from the circuit delay PUF524. This RO PUF response R0521is then used as the SRAM PUF challenge C0523into the SRAM PUF526to obtain the RO PUF response R0525. In an alternative approach, the RO PUF response R0521may be used to generate the challenge SRAM PUF C0523(e.g., by mapping or converting the RO PUF response R0521into a memory address). The SRAM PUF response R0518is sent to the authentication device500

In this approach, the RO PUF response R0521is used to modify the actual challenge to the SRAM PUF526. Because an attacker is unable to reproduce the RO PUF response R0521, it does not know the SRAM PUF challenge C0523used to produce the response SRAM PUF response R0525.

At the authentication device500, the device authentication module/circuit/server503may obtain, from the Circuit Delay PUF505, a RO PUF response R0520corresponding to the sent RO PUF challenge C0508. This RO PUF response R0520may serve as the SRAM PUF challenge C0527. The device authentication module/circuit/server403may verify the SRAM PUF response R0422. The SRAM PUF challenge C0527can then be used to lookup the corresponding response in the SRAM PUF database501and compare that response to the received response SRAM PUF response R0522.

In the approaches illustrated inFIGS. 3, 4, and 5, the device authentication module/circuit/server303,403, and/or503has access to the challenge and response pairs for both the SRAM PUF and RO PUF. Therefore, the device authentication module/circuit/server303,403, and/or503is able to verify the operations performed by the memory device307,407, and507and verify the response(s).

Combining SRAM and RO Physically Unclonable Functions (PUFs) to Mask Responses

In an alternative approach protects the SRAM PUF response from a memory device by use of a RO PUF.

FIG. 6is a block diagram illustrating a fourth example of how SRAM PUF626and RO PUF624may be combined to prevent an attacker from being able to clone a memory device607. In this example, an authentication device600may include a device authentication module/circuit/server603, a SRAM PUF database601, and a RO PUF database605. The SRAM PUF database601may be generated for a memory cell region of the memory device607during manufacturing by, for example, sending a plurality of challenges (e.g., memory addresses) to the memory cell region and obtaining corresponding responses (e.g., uninitialized memory cell states/values). Similarly, the Circuit Delay PUF database605may be generated for a plurality of ring oscillator within the memory device607during manufacturing by, for example, sending a plurality of challenges (e.g., selection of two ring oscillators) to the ring oscillators and obtaining a corresponding responses (e.g., frequency differential between two selected ring oscillators).

In this example, when the device authentication module/circuit/server603subsequently tries to authenticate the memory device607, it sends a challenge (comprising Challenge A616and Challenge B612) to the memory device607. The challenge A616may comprise an SRAM PUF challenge C0606. The challenge B612includes an RO PUF challenge C0608is also sent from the authentication device600to the memory device607.

At the memory device604, the RO PUF challenge C0612is used to generate a RO PUF response R0621from the circuit delay PUF624. The SRAM PUF challenge C0616is processed by the SRAM PUF626to generate a SRAM PUF response R0623. A hash619of the RO PUF response R0621is then obtained as RO PUF response R0′625. The RO PUF response R0′625is then XORed604with the SRAM PUF R0623to obtain a combined response618(e.g., SRAM PUF R0XOR RO PUF response R0′) that is transmitted back to the device authentication module/circuit/server603. In this manner, the SRAM PUF response R0623from the SRAM PUF626the authentication device600can be protected during transmission.

At the authentication device600, the device authentication module/circuit/server603may verify that the response618corresponds to the sent challenges SRAM PUF C0606and RO PUF C0608. For instance, using the circuit delay PUF database605, the RO PUF response R0620corresponding to the sent RO PUF challenge C0608is obtained. Then, the device authentication module/circuit/server603may obtain the SRAM PUF response R0627by hashing617the RO PUF response R0620and XORing602that result with the response618to obtain the SRAM PUF response R0627. The SRAM PUF response R0627can then be used to lookup the corresponding response expected for the SRAM PUF challenge C0606in the SRAM PUF database601. If the responses match, then the memory device607is successfully authenticated or identified.

Exemplary Data Collector Device and Method Operational Therein

FIG. 7is a block diagram illustrating a data collector device according to one example. The data collector device702may be adapted to collect and store information that uniquely characterizes electronic devices (e.g., chips, semiconductors, memory devices, etc.). For example, during a manufacturing stage, quality control stage, and/or pre-deployment stage, the data collector device702may be adapted to send challenges and receive responses to each electronic device and stores the received information for later use in authenticating/identifying each electronic device.

The data collector device702may include a processing circuit704, a storage device706, a communication interface708, and/or a machine-readable medium710. The communication interface708may include a transmitter/receiver circuit718that permits the data collector device702to communicate (e.g., wired or wirelessly) with one or more electronic devices.

The processing circuit704may include a device identifier circuit/module722adapted to obtain a unique identifier for each electronic device and store such unique identifier in a device identifier database716in the storage device706. The processing circuit704may also include a challenge generator circuit/module720adapted to generate and send out one or more challenges to an electronic device. For instance, the challenges may be memory addresses (e.g., for a SRAM PUF) or ring oscillator pairs (e.g., for a RO PUF). The processing circuit704may also include an SRAM PUF collection circuit/module726adapted to collect responses from an SRAM PUF in an electronic device in response to one or more challenges sent. The processing circuit704may also include a circuit delay PUF collection circuit/module726adapted to collect responses from a circuit delay PUF in an electronic device in response to one or more challenges sent.

The machine-readable medium710may include or store device identifier instructions730(e.g., to cause the processing circuit to obtain a device identifier from an electronic device being queried), challenge generator instructions728(e.g., to cause the processing circuit to generate/send random or pre-generated challenges to the SRAM PUF and/or circuit delay PUF of the electronic device being queried), SRAM PUF collection instructions732(e.g., to cause the processing circuit to collect responses from the SRAM PUF of the electronic device being queried), and/or circuit delay PUF collection instructions734(e.g., to cause the processing circuit to collect responses from the circuit delay PUF of the electronic device being queried). Note that, in one example, the circuit delay PUF may be a tamper-resistant PUF. By contrast, the SRAM PUF has been shown to be susceptible to various attacks (e.g., Focused Ion Beam (FIB) attacks, circuit edit attacks, etc.).

The data collector device702may be adapted to perform one or more of the steps or functions illustrated inFIGS. 1-6.

FIG. 8illustrates a method operational in a data collector device for obtaining characteristic information from an electronic device. The data collector device may obtain (e.g., receive or assign) a device identifier associated with an electronic device during a pre-deployment or manufacturing stage802. The data collector device may then generate and send one or more challenges to the electronic device804. As a result, the data collector device may receive one or more responses from the electronic device, the one or more responses including characteristic information generated from two or more distinct types of physically unclonable functions in the electronic device806. The device identifier, challenges, and corresponding responses are stored for subsequent authentication of the electronic device808. This process may be repeated for each of a plurality of electronic devices. Note that the challenges sent to the electronic devices may be the same for all devices, may be randomly generated for each electronic device, and/or may be a subset of possible challenges.

Exemplary Authentication Device and Method Operational Therein

FIG. 9is a block diagram illustrating an exemplary authentication device adapted to authenticate an electronic device based on responses from multiple physically unclonable functions within each electronic device. The authentication device902may be adapted to query an electronic device (e.g., chip, semiconductor, memory devices, etc.) and attempt to identify the electronic device based on a device identifier (e.g., obtained from the electronic device) and authenticate the electronic device by performing a query involving challenges to an SRAM PUF and circuit delay PUF in the electronic device. The authentication device902may include a processing circuit904, a storage device906, a communication interface908, and/or a machine-readable medium910. The communication interface908may include a transmitter/receiver circuit918that permits the authentication device902to communicate (e.g., wired or wirelessly) with one or more electronic devices.

The processing circuit904may include a device identifier circuit/module922adapted to obtain a unique device identifier from an electronic device. Using the obtained device identifier, an authentication circuit/module936may check a device identifier database916(in the storage device906) for the corresponding challenge/response information associated with that device identifier. The authentication circuit/module936in cooperation with a SRAM PUF verification circuit/module924and circuit delay PUF verification circuit/module926may then send one or more of the corresponding challenges to the electronic device and obtains one or more responses to the challenges. Note that, in one example, the circuit delay PUF may be a tamper-resistant PUF. By contrast, the SRAM PUF has been shown to be susceptible to various attacks (e.g., Focused Ion Beam (FIB) attacks, circuit edit attacks, etc.).

The responses, in conjunction with the challenges, may be used by the SRAM PUF verification circuit/module924and circuit delay PUF verification circuit/module926to ascertain, from a SRAM PUF database914(in the storage device906) and a circuit delay PUF database912(in the storage device906), respectively, whether they correctly match the expected response (i.e., match the responses corresponding to the challenges in the databases914and916). If the received responses match the previously stored corresponding responses, the authentication circuit/module936may conclude that the electronic device is successfully authenticated. Such successful authentication may be a probabilistic match, where as long as a threshold percentage or number of responses are correctly matched, a successful match may be concluded.

The machine-readable medium910may include or store device identifier instructions930(e.g., to cause the processing circuit to obtain a device identifier from an electronic device being verified), SRAM PUF verification instructions932(e.g., to cause the processing circuit to verify responses from the SRAM PUF of the electronic device being verified), circuit delay PUF verification instructions934(e.g., to cause the processing circuit to verify responses from the circuit delay PUF of the electronic device being verified), and/or authentication instructions938to ascertain whether both SRAM PUF and circuit delay PUF verification has been successful.

The data collector device902may be adapted to perform one or more of the steps or functions illustrated inFIGS. 1-6.

FIG. 10illustrates a method operational in an authentication device for authenticating an electronic device based on responses from a plurality of physically unclonable functions. The authentication device may obtain (e.g., request or receive) a device identifier associated with an electronic device during a post-deployment stage1002. The authentication device may obtain and send one or more challenges to the electronic device1004. For example, the challenges may be a pre-defined set of challenges utilized for all electronic devices. Alternatively, the challenges may be a specific subset of challenges for the electronic device obtained from a database using the device identifier. As a result of sending the one or more challenges, the authentication device may receive one or more responses from the electronic device, the one or more responses including characteristic information generated from two or more distinct types of physically unclonable functions in the electronic device1006. In various implementations, the authentication device may operate as illustrated and described with reference toFIGS. 1, 2, 3, 4, 5, and/or6.

The device identifier may be used to identify pre-stored challenges and corresponding responses specific to the electronic device1008. The authentication device may then authenticate the electronic device by comparing the pre-stored responses and the received one or more responses for the electronic device1010. Successful authentication occurs when the received one or more responses match the pre-stored responses for the electronic device. Successful authentication may be a probabilistic match, where as long as a threshold percentage or number of responses are correctly matched, a successful match may be concluded. This process may be repeated for each of a plurality of electronic devices. Since physically unclonable functions are used by each electronic device, the one or more responses will be distinct even if the same challenge is used for all devices.

Exemplary Electronic Device and Method Operational Therein

FIG. 11is a block diagram illustrating an exemplary electronic device having multiple physically unclonable functions. The electronic device1102may be a chip, semiconductor, memory devices, etc., and adapted to provide a device identifier and respond to challenges to an SRAM PUF and circuit delay PUF in the electronic device. The electronic device1102may include a processing circuit1104, a device identifier1116(in a storage device), a delay-based PUF circuit1112(e.g., plurality of oscillator ring circuits), a static random access memory1116(which may be used as an SRAM PUF), a communication interface1108, and/or a machine-readable medium1110. The communication interface1108may include a transmitter/receiver circuit1118that permits the electronic device1102to communicate (e.g., wired or wirelessly) with one or more data collector and/or authentication devices.

The processing circuit1104may include a device identifier circuit/module1122adapted to provide its unique device identifier1116to a data collector and/or authentication device. The processing circuit may also include a SRAM PUF Response circuit/module1124and a circuit delay PUF Response circuit/module1126that are adapted to obtain responses to received challenges and send the responses to a data collector device and authentication devices. Note that, in one example, the circuit delay PUF may be a tamper-resistant PUF. By contrast, the SRAM PUF has been shown to be susceptible to various attacks (e.g., Focused Ion Beam (FIB) attacks, circuit edit attacks, etc.).

The SRAM PUF Response circuit/module1124may send received challenges to the static random access memory1114to obtain responses. For example, responses may be the uninitialized states of one or more memory cells of the static random access memory1114. Similarly, the circuit delay PUF Response circuit/module1126may send received challenges to the delay-based PUF circuit1112to obtain responses.

The machine-readable medium1110may include or store device identifier instructions1130(e.g., to cause the processing circuit to obtain the device identifier1116for the electronic device), SRAM PUF response instructions1132(e.g., to cause the processing circuit to obtain responses from the static random access memory1114of the electronic device), and/or circuit delay PUF response instructions1134(e.g., to cause the processing circuit to obtain responses from the circuit delay PUF of the electronic device).

The electronic device1102may be adapted to perform one or more of the steps or functions illustrated inFIGS. 1-6.

FIG. 12illustrates a method operational in an electronic device for authenticating itself with an authentication device based on a response from a plurality of physically unclonable functions. The electronic device may have received one or more challenges and provided one or more corresponding responses during a pre-deployment or manufacturing phase.

The electronic device implements a first physically unclonable function using a plurality of memory cells within the electronic device1204. In one example, the first physically unclonable function may use the uninitialized memory cell states for one or more memory cells as a response to the challenge.

The electronic device may also implement a second physically unclonable function using a plurality of circuit delay based paths within the electronic device1206. In one example, the plurality of circuit delay based paths and/or is otherwise tamper-resistant. The term “tamper-resistant” refers to an implementation or type of a PUF that when an attempt is made to tamper with it to predict, ascertain, and/or read its response or output, this causes the response and/or output to change. For example, an attempt to physically tamper with a ring oscillator or circuit delay path type oscillator would cause the response for the ring oscillator or circuit delay path to be altered (e.g., output frequency changes).

A challenge may be received from an external server1208. The challenge may be applied to the first physical unclonable function by using a first response from the second physically unclonable function to either: (a) mask/unmask a challenge input to the first physically unclonable function, (b) generate the challenge input to the first physical unclonable function, or (c) mask a response output from the first physically unclonable function1210. In one example, the first challenge may identify memory addresses within the plurality of memory cells. In another example, the challenge may select two ring oscillators from the plurality of ring oscillators in the second physically unclonable function and responds with a frequency differential between the two ring oscillators. The challenge may be received as part of at least one of: an authentication process of the electronic device, an identification process of the electronic device, and/or a key generation process within the electronic device.

The first response from the second physically unclonable function and/or a second response from the first physically unclonable function may then be sent to the external server1212. The external server may include a first database of challenges and responses for the first physically unclonable function and a second database of challenges and responses for the second physically unclonable function, where the external server sends the challenge to the electronic device and authenticates or identifies the electronic device based on the second response.

An indicator may be received that the response was successfully verified by the external server1214. For instance, upon successful authentication, the electronic device may receive an indicator that it has gained access to a network and/or data.

In one example, the challenge includes a first challenge for the first physically unclonable function and a second challenge for the second physically unclonable function. For instance, the first challenge may be a challenge masked by an expected response to second challenge (as illustrated inFIG. 3). In another instance, the first challenge may be modified by the first response from the second physically unclonable function prior to processing by the first physically unclonable function (as illustrated inFIG. 4).

In yet another example, the received challenge may be used by the second physically unclonable function to generate the first response which is then used as a second challenge by the first physically unclonable function to generate the second response (as illustrated inFIG. 5).

In another implementation, the challenge may include a first challenge for the first physically unclonable function and a second challenge for the second physically unclonable function, the second challenge may be used by the second physically unclonable function to generate the first response which is used to mask the second response from the first physically unclonable function (as illustrated inFIG. 6). The method may further include: (a) hashing the first response from the second physically unclonable function to obtain an intermediate response; and/or (b) masking the second response using the intermediate response.

In one example, a pre-stored device identifier may also be pre-provisioned within the electronic device1202. It may send the pre-stored device identifier from the electronic device to the external server either: (a) before the challenge is received, or (b) concurrent with sending the second response. The device identifier uniquely identifies the electronic device.

Moreover, in one aspect of the disclosure, the processing circuit704,904and1104illustrated inFIGS. 7, 9 and 11may be specialized processors (e.g., an application specific integrated circuit (e.g., ASIC)) that are specifically designed and/or hard-wired to perform the algorithms, methods, and/or steps described inFIGS. 8, 10, and12, respectively. Thus, such a specialized processor (e.g., ASIC) may be one example of a means for executing the algorithms, methods, and/or steps described inFIGS. 8, 10, and 12.

Moreover, a storage medium may represent one or more devices for storing data, including read-only memory (ROM), random access memory (RAM), magnetic disk storage mediums, optical storage mediums, flash memory devices and/or other machine-readable mediums and, processor-readable mediums, and/or computer-readable mediums for storing information. The terms “machine-readable medium”, “computer-readable medium”, and/or “processor-readable medium” may include, but are not limited to non-transitory mediums such as portable or fixed storage devices, optical storage devices, and various other mediums capable of storing, containing or carrying instruction(s) and/or data. Thus, the various methods described herein may be fully or partially implemented by instructions and/or data that may be stored in a “machine-readable medium”, “computer-readable medium”, and/or “processor-readable medium” and executed by one or more processors, machines and/or devices.

The various features of the invention described herein can be implemented in different systems without departing from the invention. It should be noted that the foregoing aspects of the disclosure are merely examples and are not to be construed as limiting the invention. The description of the aspects of the present disclosure is intended to be illustrative, and not to limit the scope of the claims. As such, the present teachings can be readily applied to other types of apparatuses and many alternatives, modifications, and variations will be apparent to those skilled in the art.