## 1 Introduction  
In recent years, the importance of hardware security has significantly grown, raising concerns about vulnerabilities in semiconductor devices and circuits. These vulnerabilities pose risks such as the potential leakage of sensitive information and the compromise of the entire system's reliability and performance [1, 2, 3]. To tackle these vulnerabilities, the concept of the device fingerprint has emerged as a potential solution. In the realm of wireless networks, RF fingerprint, also known as RF distinct native attribute (RF DNA), hasbeen developed to identify and classify authorized devices based on their unique features of the individual devices [4; 5; 6; 7]. Similarly, techniques such as die identification [8; 9; 10; 11] and die authentication [12; 13; 14; 15] have been proposed to enhance the security across the entire life cycle of the global supply chain. Die identification involves assigning a unique serial number to each individual die, while die authentication verifies the device's origin of manufacturing to ensure its authenticity. Physical Unclonable Functions (PUFs) offer a promising approach for chip identification by leveraging inherent manufacturing variations in integrated circuits [8; 9; 10; 11; 16; 17; 18; 19; 20; 21; 22; 23]. PUFs generate unique challenge-response pairs (CRPs) that serve as digital fingerprints, enabling reliable chip identification. Nevertheless, while PUFs excel in die identification, they exhibit shortcomings in die authentication. It is important to note that PUFs' digital output bits lack correlation with the distinct attributes of the original foundry, thus restricting their potential for die authentication. To address this issue, a process characterization function (PCF) has been proposed, leveraging the unique process characteristics of the foundry to enable die authentication [12; 13; 14; 15]. For example, the authors in [12] decompose path delays into the delays incurred by logic gates, extracting threshold voltage and effective channel length as distinct signatures for distinguishing between different foundries. Similarly, ref. [13] adapts the successive-approximation-register (SAR) analog-to-digital converter (ADC) architecture, leveraging the mismatch in the metal-oxide-metal (MOM) capacitor as a means of authentication. Another proposed approach, as outlined in [14], involves reducing the activation time (the time it takes for a row of DRAM cells to become accessible) and then observing the resulting error patterns as distinctive authentication characteristics. Likewise, the author in [15] examines the pattern of the partial erase process of Flash memory to identify the fabrication origin. Another approach proposed in [24], a machine learning-based approach is used to infer the fab-of-origin by analyzing production test data (276 probe-test measurements per die) from RF transceivers fabricated in two separate facilities, offering a scalable solution for origin classification. While these papers have proposed various die authentication methods, they pose challenges in seamless integration into other circuits. This is attributed to the necessity for a designated area for PCF circuits, which not only complicates integration but also introduces susceptibility to targeting by attackers. To address this limitation, we propose the use of an in situ time-based sensor that directly measures the RC time-constants of the back-end-of-line (BEOL) metal routing. This sensor can be seamlessly integrated into the functional routing of any system-on-chip (SoC) to provide robust die authentication, as illustrated in Figure 1. To the authors' best knowledge, this work presents the first in-situ measurement of the RC time-constants of the BEOL metal interconnect. Additionally, in advanced technology nodes, the RC time-constant of the metal traces increases [25; 26], while the time-domain resolution improves, enhancing the sensor authentication accuracy. The remainder of the paper is organized as follows.