## 2 Architecture and Operation of Proposed RO PUF
In the proposed RO PUF, the heat generated by the oscillation of \(RO_{A}\) is too small and can be negligible due to the low power feature of the current starved inverter working in the subthreshold region. It is noted that, with a different \(N_{clk}\) in the LFSR counter, the same input challenge can produce different responses for the same PUF instance. As a result, this structure can be considered as a logically reconfigurable PUF [15], In contrast to the controlled PUF (CPUF) [16], which adds simple hash functions to a PUF to forbid the untrusted user to access the PUF directly, the proposed PUF allows for changing the CRP behavior by varying \(N_{clk}\), without the physical replacement and modification of the underlying PUF. This logical reconfigurability makes the proposed PUF more resilient to SVM based attack, which is a subclass of modeling attacks. Modeling attack assumes that the adversary can create a model of the targeted PUF, given a number of CRPs [8]. The rest CRPs can be predicted with the help of this model. To predict the CRPs with SVM, the attackers need to model the CRP generation accurately. Without considering the reconfigurability, \(N_{clk}\) for the LFSR counter is assumed to be a known constant. The oscillation frequency of each RO in the proposed PUF is reversely proportional to the sum of the delay in each stage. The applied challenge \(C/C^{\prime}\) selects the top or bottom path. Figure 3: Schematic of the MUX in the proposed physical unclonable function (PUF). An additive delay model for the proposed PUF structure can be constructed as follows. The response corresponding to the challenge \(C\) can be expressed as:  
\[R=\left\{ \begin{array}{rcl}1&\text{if}&\delta(n+1)>\delta^{\prime}(n+1)\\ -1&\text{if}&\delta(n+1)<\delta^{\prime}(n+1)\end{array} \right. \tag{4}\]  
where \(\delta(n+1)\) and \(\delta^{\prime}(n+1)\) are the signal delays from the NAND gate input to the output of the RO's last inverter stage (i.e., the \((n+1)\)-th) in Figure 1, upon the application of the challenge \(C\) and the shadow challenge \(C^{\prime}\) after \(N_{clk}\) cycles, respectively. These two delays are then written as:  
\[\delta(i) = \frac{1+C_{i}}{2}p_{i}+\frac{1-C_{i}}{2}q_{i}+\delta(i-1) \tag{5}\] \[\delta^{\prime}(i) = \frac{1+C_{i}^{\prime}}{2}p_{i}+\frac{1-C_{i}^{\prime}}{2}q_{i}+ \delta^{\prime}(i-1) \tag{6}\]  
where \(p_{i}\) and \(q_{i}\) (\(i=1,2,\cdots,n+1\)) are the top and bottom inverter delays at the \(i\)-th inverter stage of the RO, respectively, and \(C_{i},C_{i}^{\prime}\in\{-1,1\}\). In contrast to the arbiter PUF whose two competing-signals are generated at the same time (by the rising edge from the very beginning of the delay chain), the proposed RO PUF generates the two competing-signals at different times (one is generated when Challenge \(C\) is applied, the other one is generated when the shadow Challenge \(C^{\prime}\) is applied). The frequency distance between two selected ROs is then calculated by subtraction with the help of the following bi-directional counter. Let \(\Delta(i)\) denote the difference between \(\delta(i)\) and \(\delta^{\prime}(i)\). By subtracting (5) from (6), we can have:  
\[\Delta(i) = \frac{p_{i}-q_{i}}{2}(C_{i}  
Figure 4: The microphotograph of the proposed RO PUF chip. Figure 5: The probe station for testing the sample chips. Figure 6: The distribution of RO’s oscillation frequency for one sample chip.