SYSTEM AND METHOD FOR NON-BYPASSABLE AND UNCLONABLE MICROELECTRONIC DEVICE FINGERPRINTING

A method for provisioning a microelectronic (ME) component or device for non-bypassable, unclonable electronic device fingerprinting includes receiving an initialization vector from a provisioning device. A physically unclonable function (PUF) incorporated into the ME device (and unique to that ME device) provides a unique device bitstream. The device bitstream and initialization vector are cryptographically hashed to generate an electronic device fingerprint recordable to non-volatile memory onboard the ME device, which can be used for subsequent verification that the ME device is not counterfeited or compromised.

BACKGROUND

Securing the ME supply chain without increased shipping and management costs to suppliers and purchasers requires a method to automate the detection of counterfeit or modified electronic components. Conventionally, unique identifier information (e.g., an electronic fingerprint uniquely identifying a part or component) must be sent for each individual part or device shipped. Transmission of a unique device fingerprint for correlation to its corresponding part of device adds cost and additional risk of error.

SUMMARY

In a first aspect, a method of provisioning a microelectronics (ME) component or device for verifiable, unclonable, non-bypassable electronic device fingerprinting is disclosed. In embodiments, the method includes receiving an initialization vector from a provisioning system or device. The method includes obtaining a unique device bitstream via a physically unclonable function (PUF) incorporated into the ME device. The method includes generating a non-bypassable, unclonable device fingerprint unique to the ME device by cryptographically hashing the initialization vector and the device bitstream.

In some embodiments, the method further includes recording the electronic device fingerprint to non-volatile memory of the ME device for subsequent verification.

In some embodiments, the ME device includes multiple physically unclonable functions or PUF, and the initialization vector specifies a set of PUF, which may include all PUF of the ME device or may include some and exclude others (e.g., a subset of all PUF). For example, the initialization vector provides input data for the set of specified PUF. The cryptographic hash function combines the initialization vector with a combination of device bitstreams obtained from each specified PUF.

In some embodiments, the initialization vector specifies an ordered sequence of PUF. For example, the ME device obtains an ordered sequence of device bitstreams from the ordered sequence of PUF specified by the initialization vector, and the ordered sequence of device bitstreams is cryptographically hashed with the initialization vector.

In some embodiments, the method includes receiving input data parsed among the set of specified PUF such that each specified PUF receives a unique input.

In some embodiments, the method includes receiving input data including a challenge for each specified PUF, such that the resulting PUF bitstream output by each specified PUF is a response to the received challenge.

In a further aspect, a method of provisioning a microelectronics (ME) component or device for unclonable, non-bypassable, verifiable electronic device fingerprinting is also disclosed. In embodiments, the method includes receiving a first initialization vector from a provisioning device or system via the ME device. The method includes obtaining a device bitstream via a physically unclonable function (PUF) of the ME device. The method involves generating a hash output via the ME device by cryptographically hashing the device bitstream and the first initialization vector. The method includes sending the hash output to the provisioning system. The method includes obtaining a second initialization vector via the provisioning system. The method includes generating an electronic device fingerprint via the provisioning system by cryptographically hashing the second initialization vector and the received hash output. The method includes sending the electronic device fingerprint to the ME device.

In some embodiments, the method includes recording the device fingerprint to non-volatile memory of the ME device (e.g., for subsequent verification of device integrity).

In some embodiments, the ME device incorporates multiple PUF, and the first initialization vector specifies a set of PUF (e.g., all PUF of the ME device, or including some PUF and excluding others) and including input data for the set of specified PUF. The method includes obtaining a composite device bitstream including device bitstreams from each PUF specified by the first initialization vector. The method includes generating a hash output by cryptographically hashing the first initialization vector and the composite hash output.

In some embodiments, the first initialization vector input data specifies an ordered sequence of PUF of the ME device. The method includes obtaining a sequential device bitstream comprising an ordered sequence of device bitstreams obtained from the specified PUF. The method includes generating a hash output by cryptographically hashing the sequential device bitstream and the first initialization vector.

In some embodiments, the method includes receiving input data parsed among the set of specified PUF such that each specified PUF receives a unique input.

In some embodiments, the method includes receiving input data including a challenge for each specified PUF, such that the resulting PUF bitstream output by each specified PUF is a response to the received challenge.

In some embodiments, the first and second initialization vectors are substantially equivalent.

In a further aspect, a method for provisioning a lot or set of multiple microelectronics (ME) components or devices (e.g., for mass shipping) is disclosed. In embodiments, the method includes providing a set of N ME devices or components (e.g., where N is a positive integer, two or greater). The method includes sending, via a provisioning device or system, a first initialization vector to each of the N ME devices. The method includes receiving, via the provisioning device, a hash output from each of the N ME devices, where each received hash output is the product of a cryptographic hash of the first initialization vector and a unique device bitstream obtained from a physically unclonable function (PUF) incorporated into and unique to each ME device. The method includes generating a device fingerprint for each of the N ME devices via the provisioning device by cryptographically hashing a second initialization vector and the hash output generated by and received from that ME device. The method includes sending each generated electronic device fingerprint to its respective ME device for recording to non-volatile memory.

In some embodiments, the method includes collecting, via the provisioning device, the hash outputs received from each of the N ME devices into a composite or common lot hash output. The method includes generating a common lot device fingerprint corresponding to the entire lot of N ME devices by cryptographically hashing the common lot hash output and the second initialization vector.

In some embodiments, the method includes sending the common lot device fingerprint to each of the N ME devices, e.g., for recording to non-volatile memory.

In some embodiments, at least one of the N ME devices incorporates multiple PUF, and the first initialization vector specifies a set of PUF with respect to that ME device (e.g., all PUF of the ME device, or including some PUF and excluding others). The method includes obtaining a composite device bitstream including device bitstreams from each PUF specified by the first initialization vector. The method includes generating a hash output by cryptographically hashing the first initialization vector and the composite hash output.

In some embodiments, the first initialization vector specifies an ordered sequence of PUF of one or more of the N ME devices. The method includes obtaining a sequential device bitstream comprising an ordered sequence of device bitstreams obtained from the specified PUF. The method includes generating a hash output by cryptographically hashing the sequential device bitstream and the first initialization vector.

In some embodiments, the first and second initialization vectors are substantially equivalent.

DETAILED DESCRIPTION

Broadly speaking, embodiments of the inventive concepts disclosed herein are directed to methods for automated provisioning and verification of multi-chip modules (MCM), application specific integrated circuits (ASIC), microprocessors, and other ME (ME) devices by leveraging physically unclonable functions (PUF) with robust cryptographic properties to create non-bypassable and unclonable electronic device fingerprints uniquely identifying each device. For example, verification information applicable across a set or family of different ME devices may be provided to a manufacturer (or other point in the supply chain), who may thereby verify each individual device fingerprint and detect any modified or counterfeit ME components. However, the PUF characteristics unique to each ME component and used by device integrators for fingerprinting are not transmitted, reducing the risk of compromise.

Referring now toFIG.1, an ME device100is shown. The ME device100may be a microprocessor, application specific integrated circuit (ASIC), field programmable gate array (FPGA), multi-chip module (MCM), system in package (SiP), or any other ME component or component assembly.

In embodiments, each ME device100may incorporate a physically unclonable function102(PUF) unique to that device. For example, the PUF102may produce a unique bitstream104repeatable each time the PUF is queried. In embodiments, for the ME device100to be uniquely verifiable as described below, the ME device must first be provisioned with a unique non-bypassable, unclonable electronic device fingerprint106. For example, the ME device100may receive an initialization vector108, e.g., generated by, and provided to the ME device by, a provisioning system110and stored to a hash input register112of the ME device. The initialization vector108may include, but is not limited to, a bitstream generated by a random number generator and having sufficient length (e.g., 256 bits or greater) and entropy as to be resistant to cryptographic attack. In embodiments, the provisioning system110may include, but is not limited to, any computing device (e.g., personal computer, black box) having one or more processors capable of generating the IV108and communicating with the ME device100.

In embodiments, the ME device100may incorporate one or more cryptographic hash functions114. For example, the cryptographic hash functions114may be one-way functions (e.g., asymmetric algorithms, AES encryption algorithms) configured to cryptographically combine the received initialization vector108and the PUF bitstream104into a single cryptographically generated output116. In some embodiments, the hash output116may be recorded to non-volatile memory118onboard the ME device100as a unique device fingerprint106. For example, the hash output116may be recorded to non-volatile memory118for the full lifecycle of the ME device100(although the ME device may in some embodiments still be reprovisioned).

In embodiments, the ME device may further include a device fingerprint check mechanism120stored to non-volatile memory118for subsequent verification of the device fingerprint106. For example, at some point subsequent to the recording of the hash output116to the non-volatile memory118as the device fingerprint106, the initialization vector108may be re-transmitted or otherwise re-introduced to the ME device100. In embodiments, the hash function114may subsequently re-hash the PUF bitstream104and the initialization vector108, generating a subsequent hash output122(e.g., replica hash output). For example, the stored device fingerprint check mechanism120may compare the subsequent hash output122to the recorded device fingerprint106. If the subsequent hash output122and the recorded device fingerprint106are identical, the integrity of the ME device100is verified; if not, counterfeiting or other like compromise of the ME device is indicated.

In embodiments, due to the one-way nature of the cryptographic hash functions114, neither the PUF bitstream104nor the initialization vector108may be recoverable from the hash output116. Further, as each PUF102is unique to its embodying ME device100, a single initialization vector108may be applied to an entire set or class of ME devices. For example, each hash output116based on the initialization vector will uniquely identify its ME device100and guard against tampering or counterfeiting of the ME device.

Referring now toFIG.2A, the ME device200may be implemented and may function similarly to the ME device100ofFIG.1, except that the ME device200may be verified via a more robust verification process.

In embodiments, the ME device200may receive an initial or first initialization vector108from a provisioning system110, store the initialization vector to a hash input register112, and combine, via cryptographic hash function/s114, the initialization vector with a PUF bitstream104output by the unique PUF102of the ME device, generating a cryptographic hash output116(e.g., device hash) as described above and as shown byFIG.1.

In embodiments, the ME device200may transmit the device hash116to the provisioning system110. For example, the provisioning system110may generate and/or provide an additional initialization vector202. In embodiments, the provisioning system110may combine the device hash116and the additional initialization vector202via one or more additional or second cryptographic hash functions204. For example, the second cryptographic hash function/s204may output a more robust device fingerprint206which may be transmitted back to the ME device200and recorded to non-volatile memory118. In embodiments, the second cryptographic hash function/s204may be one-way function/s similarly to the cryptographic hash function/s114, such that neither the two initialization vectors108,202nor the PUF bitstream104may be recoverable from the device fingerprint206. In some embodiments, the second or additional initialization vector202may be identical to the first initialization vector108.

Referring also toFIG.2B, a lot208of n ME devices200a,200b, . . .200nis shown (e.g., where n is a positive integer). In some embodiments, the lot208may be shipped to a recipient who wishes to verify that the full lot of n ME devices200a-200nhas been received, and that no device is missing. For example, as shown above byFIGS.1and2A, each ME device200a-200nmay include a PUF102a-102nproducing a unique bitstream104a-104nwhen queried. Further, each ME device200a-200nmay hash (112) the initialization vector108with its respective PUF bitstream104a-104nto generate a unique device hash116a-116ncombined by the provisioning system110with the initialization vector202via the second cryptographic hash function/s204to produce unique device fingerprints206a-206nrespectively recorded to the non-volatile memory118of each ME device.

In embodiments, the provisioning system110may further collect the device hash outputs116a-116nfrom each ME device200a-200ninto a common lot hash210, e.g., a sequence or set of all device hash outputs from the lot208. For example, the provisioning system110may similarly combine the common lot hash210with the initialization vector202via the second cryptographic hash function/s204to generate a common lot device fingerprint212. In embodiments, each ME device200a-200nmay likewise record the common lot device fingerprint212to non-volatile memory. For example, to verify the presence and integrity of each ME device200a-200nof the lot208, the device hashes116a-116nof each ME device must be evaluated to recalculate the common lot fingerprint, which may then be compared to the common lot device fingerprint212recorded to the non-volatile memory118of any ME device of the lot. Further, if any ME device200a-200nis missing from the lot208, the resulting recalculated common lot fingerprint may not match the recorded common lot device fingerprint212and may thereby indicate a missing ME device from the lot208.

Referring now toFIG.2C, the ME device220may be implemented and may function similarly to the ME devices100,200ofFIGS.1and2A, except that the ME device220may incorporate multiple PUF222a,222b,222c. . .222n. In embodiments, the PUF222a-222nmay be implemented and may function similarly to the PUF102,102a-102nofFIGS.1through2B, each PUF generating a unique bitstream224a,224b,224c. . .224n.

In embodiments, the provisioning system110may present to the ME device220an initialization vector226which may be implemented and may function similarly to the initialization vectors108,202ofFIGS.1through2B, except that the initialization vector226may further specify which PUF bitstreams224a-224nare to be included in and/or excluded from the cryptographic hash function/s114. For example, the initialization vector226may specify a set of PUF bitstreams {224a,224c,224n} to include in the cryptographic hash function/s114(e.g., excluding PUF bitstream224b), or the initialization vector may further specify the exact sequence {224a→224n→224c} in which the PUF bitstreams should be incorporated into the cryptographic hash function/s. In embodiments, the initialization vector226may include input data226a,226c,226nfor each of the specified PUF. For example, the input data226a-226nmay be identical for each specified PUF, or the input data may be parsed among the set of PUF, such that each PUF224a,224c,224nincluded in the set receives a unique input226a,226c,226n. In some embodiments, some or all of the PUF222a-222nare challenge/response PUF. For example, a challenge/response PUF may output a fixed response when a fixed challenge is received. or the challenge/response PUF may have a challenge space or input space capable of varying responses, e.g., based on the portion of the input space challenged.

In embodiments, and as shown above byFIG.2A, the set or sequence of PUF bitstreams224a,224c,224nmay be combined with the initialization vector226to generate a device hash228, which may in turn be combined with second/additional cryptographic hash function/s204to generate an electronic device fingerprint230recordable to the non-volatile memory118of the ME device220.

Referring now toFIG.3, the ME device200is shown.

In embodiments, once the ME device200has been provisioned with an electronic device fingerprint (206,FIG.2) and transported via supply chain to an end user, distributor, or other recipient, said recipient may verify the integrity and/or authenticity of the ME device and that the device has not been modified, tampered with, or counterfeited in any way.

In embodiments, the ME device200may be verified by a verification system300via a two-step process. For example, the verification system300may first receive the initialization vectors108a,202afrom the provisioning system110via a one-time secure transmission302(e.g., a secure communications channel separate from the channel via which the microelectronic device200was provisioned, as shown byFIG.2). Only the initialization vectors108,202need be communicated to the verification system300via the secure transmission302(and not, e.g., the device fingerprint206). In embodiments, the verification system300may include one or more processors.

In embodiments, when the verification system300has received copies108a,202aof the initialization vectors108,202, the verification of the ME device200may continue. For example, as noted above the ME device200may be provisioned (as shown byFIG.2above) with a non-bypassable, unclonable electronic device fingerprint206. Any attempt to counterfeit the ME device200may alter its unique PUF102, which in turn may affect the PUF bitstream104, the device hash116, and the device fingerprint206. Further, as a potential counterfeiter would not have access to the initialization vectors108,202, they would be unable to generate the device fingerprint206independently.

In embodiments, the verification system300may attempt to replicate (206a) the device fingerprint206via the same process as described above with respect to the provisioning system110, except based on the initialization vectors108a,202areceived via secure channel302from the provisioning system. For example, the verification system300may provide a device fingerprint check mechanism120for comparing the recorded device fingerprint206to the replica device fingerprint206aproduced by the second/additional cryptographic hash function/s204(e.g., by combining the received second initialization vector copy202aand the replica device hash122derived via cryptographically hashing (114) the received first initialization vector copy108aand the PUF bitstream104).

In embodiments, if the replica device fingerprint206amatches the recorded device fingerprint206, the authenticity and integrity of the ME device200is verified (PASS,304). If the replica device fingerprint206adoes not match the recorded device fingerprint206, however, the microelectronic device200is compromised or counterfeit (FAIL,306).

Referring now toFIG.4, the method400may be implemented by the ME device100and the provisioning system110and may include the following steps.

At a step402, the ME device receives an initialization vector from the provisioning device. For example, the ME device may be a microprocessor, ASIC, MCM, FPGA, SiP, or any appropriate like ME component or ME component assembly incorporating a unique physically unclonable function (PUF) and cryptographic hashing capacity. Further, the initialization vector may be generated by the provisioning system for use across a set, family, or group of components including the ME device. In some embodiments, the ME device includes multiple PUF (all unique to that ME device), and the initialization vector specifies a set of PUF from that ME device that will contribute PUF bitstreams, providing input data for the specified PUF. For example, all PUF may be included, or some PUF may be included and others excluded. In some embodiments, the input data is parsed among the set of PUF, such that each PUF included in the set receives a unique input. In some embodiments, the initialization vector specifies an ordered sequence in which the PUF will contribute. In some embodiments, the input data provides a challenge input to each specified PUF, such that the resulting PUF bitstream output is a response to the challenge.

At a step404, the ME device obtains a device bitstream output by a physically unclonable function (PUF) unique to the ME device.

At a step406, the ME device generates a device fingerprint by hashing the device bitstream and the initialization vector via cryptographic hash function/s.

The method400may include an additional step408. At the step408, the ME device records the device fingerprint (e.g., the cryptographic hash output of step406) to non-volatile memory.

Referring now toFIG.5, the method500may be implemented by the microelectronic device200and the provisioning system110.

At a step502, the ME device receives a first initialization vector from the provisioning device. For example, the ME device may be a microprocessor, microprocessor, ASIC, MCM, FPGA, SiP, or any appropriate like ME component or ME component assembly incorporating a unique physically unclonable function (PUF) and cryptographic hashing capacity. For example, the first initialization vector may be generated by the provisioning system for use across a set, family, or group of components including the ME device. In some embodiments, the ME device includes multiple PUF (all unique to that ME device), and the first initialization vector specifies a set of PUF from that ME device that will contribute PUF bitstreams and includes input data for the specified PUF. For example, all PUF may be included, or some PUF may be included and others excluded. In some embodiments, the first initialization vector is parsed among the set of specified PUF, such that each specified PUF receives a unique input. In some embodiments, the first initialization vector specifies an ordered sequence in which the PUF will contribute. In some embodiments, the input data includes a challenge for the specified PUF, such that the resulting PUF bitstream output is a response to the challenge.

At a step504, the ME device obtains a device bitstream output by a physically unclonable function (PUF) unique to the ME device. For example, if the first initialization vector specifies a set of PUF that will contribute, the ME device will obtain device bitstreams from those specified PUF. Similarly, if the first initialization vector specifies an ordered sequence, the ME device will obtain an ordered sequence of device bitstreams from the specified PUF.

At a step506, the ME device generates a device hash output by hashing the device bitstream and the first initialization vector via cryptographic hash function/s. In some embodiments, the cryptographic hash function/s will combine the first initialization vector and the set (e.g., or ordered sequence) of device bitstreams from the specified PUF.

At a step508, the ME device transmits the device hash output to the provisioning system.

At a step510, the provisioning system obtains a second initialization vector. For example, the second initialization vector may be generated by the provisioning system for use across a set, family, or group of components including the ME device. In some embodiments, the first and second initialization vectors are substantially equivalent.

At a step512, the provisioning device generates a unique device fingerprint by hashing the device hash output received from the ME device with the second initialization vector via additional or second cryptographic hash function/s (e.g., different from the first cryptographic hash function/s of step506).

At a step514, the provisioning device transmits the device fingerprint to the ME device.

The method500may include an additional step516. At the step516, the ME device records the device fingerprint to non-volatile memory.

Referring now toFIG.6A, the method600may be implemented by the provisioning system110and may include the following steps.

At a step602, a lot of N ME devices for non-bypassable, unclonable device fingerprinting is provided (e.g., where N is a positive integer). For example, the lot of N ME devices may be intended for mass shipment to an end user who may need to verify subsequent to delivery that all N devices are present.

At a step604, the provisioning system sends a first initialization vector to each of the N ME devices. In some embodiments, one or more ME devices incorporates multiple PUF (all unique to that ME device), and the first initialization vector specifies a set of PUF from that ME device that will contribute PUF bitstreams, providing input data for the set of specified PUF. For example, all PUF may be included, or some PUF may be included and others excluded. In some embodiments, the input data is parsed among the set of PUF, such that each PUF included in the set receives a unique input. In some embodiments, the first initialization vector specifies an ordered sequence in which the PUF will contribute. In some embodiments, the input data provides a challenge for each PUF, such that the resulting PUF bitstream output by the PUF is a response to the challenge.

At a step606, the provisioning device receives a hash output from each of the N ME devices. For example, the hash output received from each ME device corresponds to a combination, via cryptographic hash functions onboard that ME device, of the first initialization vector and a device bitstream obtained from the unique PUF of that ME device. In some embodiments, the hash output is based on a set of multiple device bitstreams obtained from multiple PUF of the ME device as specified by the first initialization vector, or on an ordered sequence of device bitstreams obtained from the specified PUF.

At a step608, the provisioning system generates a unique unclonable device fingerprint for each of the N ME devices. For each ME device, the provisioning system combines, via cryptographic hash functions, a second initialization vector and the hash output received from that ME device. In some embodiments, the second initialization vector is equivalent to the first initialization vector.

At a step610, the provisioning device sends each generated device fingerprint to its respective ME device, e.g., for recording to non-volatile memory onboard that ME device.

Referring also toFIG.6B, the method600may include additional steps612and614. At the step612, the provisioning device collects the N hash outputs received from each of the N ME devices into a common lot hash output.

At the step614, the provisioning device generates a common lot device fingerprint for the set of N ME devices by combining, via cryptographic hash functions, the common lot device fingerprint and the second initialization vector.

In some embodiments, the method600may include an additional step616. At the step616, the provisioning device sends the common lot device fingerprint to each of the N ME devices for recording to non-volatile memory onboard each ME device.

Embodiments of the inventive concepts disclosed herein may provide unique verification of trusted microelectronic component integrity and authenticity throughout the lifecycle of the component and at any point along the supply chain (e.g., shippers, receivers, installers, end users), while eliminating the need to communicate unique device identification data on a per-component basis, which can be both logistically complex and expensive. Further, verification may now be possible without the requirement to store unique device identification data on the device itself over the lifecycle of the device.

CONCLUSION