# Design Impedance Mismatch Physical Unclonable Functions for IoT Security

Authors: Xiaomin Zheng; Yuejun Zhang; Jiaweng Zhang; Wenqi Hu
Journal: Active and Passive Electronic Components
 (2017)

---

## Abstract

We propose a new design, Physical Unclonable Function (PUF) scheme, for the Internet of Things (IoT), which has been suffering from multiple-level security threats. As more and more objects interconnect on IoT networks, the identity of each thing is very important. To authenticate each object, we design an impedance mismatch PUF, which exploits random physical factors of the transmission line to generate a security unique private key. The characteristic impedance of the transmission line and signal transmission theory of the printed circuit board (PCB) are also analyzed in detail. To improve the reliability, current feedback amplifier (CFA) method is applied on the PUF. Finally, the proposed scheme is implemented and tested. The measure results show that impedance mismatch PUF provides better unpredictability and randomness.


---

## Body

## 1. Introduction

The Internet of Things is a dynamic living entity, which enables things to exchange information and communication through the networking of physical terminal devices, humans, intelligent buildings, and others [1, 2]. The IoT improves efficiency, accuracy, and economic benefit but is also potentially a huge security risk. Some reports predict that it will spend $547 million on IoT security in 2018 and will involve more than 25% of identified attacks on enterprises by 2020 [3]. Some possible IoT threats are outlined in Figure 1.Figure 1
The IoT threats model.According to [4], IoT weakness is so ubiquitous that industrial espionages find it easy to get a good target for attacking. And also, privacy is the other important area of concern. The cybercriminals may recover the personal information, which is potentially residing on IoT networks. In addition, as more and more objects interconnect to today’s IoT networks, the physical security of each device is greatly reduced. Attackers could add all kinds of risk scenarios to control systems or change functionality, such as reading, intercepting, or changing the data [5]. To address these problems, there are some methods to increase security for IoT network with the help of security tools, such as identification (ID) authentication, data encryption/decryption, and code obfuscation.To build a secure and safe IoT, it is very important that the identity of each thing is authenticated. That is a massive challenge, but fortunately there is a way to take full advantage of each thing’s unique identifier through Physically Unclonable Function (PUF) technology [6, 7]. PUF generates a unique identifier by exploiting random physical factors introduced in the semiconductor manufacturing process. PUF circuit has the properties of uniqueness, randomness, and unclonability [8–12]. The above features make the PUF circuit an effective defense against intrusion attacks, including a variety of attack patterns. Printed circuit board (PCB) is one of the important hardware carriers of IoT. In the supply chain of PCB, malicious users may make counterfeit PCB come from a variety of sources, such as direct cloning, overproduction, and recycling. In fact, the quality of imitation PCB is poor, such as reliability and performance problems. With the proliferation of fake PCBs and the increase in accidental reports, the problems of the board-level feature recognition technique are becoming more and more important. In this work, we propose an impedance mismatch PUF, which has been exploited to generate a security unique private key to authenticate each thing in an IoT network. According to the characteristic of transmission line and signal transmission theory, the impedance mismatch will cause the transmission signal to reflect, especially in high-frequency scenarios. The proposed PUF circuit will improve the board-level security of IoT.This paper is organized as follows: The existing Physically Unclonable Functions circuits are summarized in Section2. The impedance mismatch effect of transmission line is detailed in Section 3. The designed method of PUF for IoT security is proposed in Section 4. Some experimental results are analyzed in Section 5. This work is concluded in Section 6.


## 2. Physically Unclonable Functions

SRAM PUF [8, 9] and Arbiter PUF [11–13, 15, 16] are two kinds of typical PUF circuit. SRAM-PUF circuits are produced through the manufacturing process, which introduces a biased digital signal in an integrated circuit. As shown in Figure 2, the SRAM-PUF cell consists of cross coupled inverters and T1 and T2 transmission transistors. SRAM-PUF circuit cells generate a logic level, which is determined by random process deviation threshold Vth of the cross coupled inverters. The function relation of SRAM-PUF circuit is easy to affect through the power supply voltage, temperature, aging, and other factors [10]. The output value has stability problems.Figure 2
Physical Unclonable Functions circuit.The arbiter PUF circuit [11–13, 15, 16] is composed of a delay unit and an arbiter circuit, as shown in Figure 2. The delay unit is composed of two delay paths and switch components. When the left input of the circuit experiences a low level to high level signal rise, the input signal will be conveyed along two paths, each after a data selector signal making two kinds of path selection, as dictated by the control signal bi. If there are m data selectors, this is a signal with 2m different transmission modes. If the differences in signal transmission to the arbiter through the two delay paths have a time difference, the upper end of the output signal end of a data selector first will output a signal arbiter “1.” Otherwise, the output signal of the arbiter is “0.” Therefore, the output signal of the arbitrator is determined by the priority arrived signal. The arbiter PUF circuit recognizes model attacks [17, 18].


## 3. Impedance Mismatch Effect

The definition of characteristic impedance is the ratio of voltage amplitudes and current value on the transmission line. The most important physical factors of characteristic impedance are geometry and materials of the transmission line. It is not dependent on length of transmission line. Under the condition of matching with the load impedance, the signal on transmission line transmits long distant without reflection [19]. If the impedance of transmission line mismatches with the load impedance, it will transmit loss and produce reflection. Impedance mismatch phenomenon means that the impedance of transmission line is different from the characteristic impedance, and transmission signal will be reflected to the opposite direction [20]. If the impedance of transmission line matches with the load impedance, the voltage signal generates positive reflection, and current signal generates negative reflection [21]. On the other hand, when the load impedance is smaller than the characteristic impedance, the voltage signal generates negative reflection, and the current signal generates positive reflection.There are two types of transmission lines on the PCB board, Microstrip and Stripline (as shown in Figure3). The impedance calculation formula of Microstrip is shown as follows [22]:(1)Z=87.0εr+1.41ln⁡5.98h0.8w+t.Among them, Z is the characteristic impedance, εr is the relative permittivity, h is the medium wire thickness (mil), w is the wire width (mil), and t is the thickness of the wire (1 oz = 1.5 mil). In (1), relative permittivity εr is between 1 and 15; ratio of w/h is between 1 and 15; the width of the ground wire is more than 7 times the width of the signal line. The impedance calculation formula of Stripline is shown as follows [23]:(2)Z0=87εrln⁡4h067π0.8w+t.In (2), w≈h<0.35; relative permittivity εr is between 1 and 15; the width of the ground wire is more than 7 times the width of the signal line. From formulas (1) and (2), it is known that the width, thickness, and dielectric constant determine the impedance. Reference [24] shows that the length of the wire, the thickness of the pad, the path of the ground wire, and other nearby wires will also affect the characteristic impedance of the transmission line, especially in high-speed data transmission.Figure 3
Microstrip and Stripline.The cut-off frequency calculation formula is shown as follows [25]:(3)fcut-off=12πRC,where R and C represent the PCB’s equivalent resistance and capacitance, respectively. According to (3), the cut-off frequency does not relate to input signal and power supply. On transmission line of PCB, reflection caused by impedance mismatch may happen. The more the transmission signal reflects, the weaker the output signal is [26]. In experimental testing, the cut-off frequency is described as specific operational frequency that causes the output signal amplitude to reduce 0.707-fold [25]. So, the characteristic impedance Z and Z0 influence the cut-off frequency of PCB.


## 4. Proposed Impedance Mismatch PUF Circuit

Comparing the deviation signals present in the same structure, a PUF circuit generates random output response. In PCB circuit, there are random physical factors that affect output signal amplitude, frequency, and bandwidth [27]. The random physical factors can be divided into two categories. The first category is in the integrated circuit, which is produced by the chip fabrication process, such as the ratio of channel width to length, and the threshold voltage. The second is the PCB layout of the processing device, such as the length and the width of wires, capacitors, resistors, and other factors [28]. Thus, the intrinsic characteristics of the PCB may establish a unique and robust fingerprint in these scenarios.


### 4.1. Impedance Mismatch PUF Model

According to the impedance mismatch theory and the PUF design method, we presented an impedance mismatch PUF (IM-PUF) model, as shown in Figure4. The model is composed of input circuit, deviation generating circuit, digital sample circuit, and output circuit. The deviation generating circuit is the core of the PUF circuit, which generates the upper cut-off frequency with the deviation. The upper cut-off frequency is the clock frequency of the digital sample circuit. During the T time, the circuit compares the two signals and generates a “0” or “1” as the response of PUF circuit.Figure 4
IM-PUF circuit model.


### 4.2. Input Circuit and Deviation Generating Circuit

The input circuit and deviation generating circuit are shown in Figure5. The input circuit is composed of D flip-flops (DFF), NAND gates, and inverters, while the deviation generation circuit is composed of an operational amplifier (OPA847), transmission lines, and current feedback amplifier (CFA). The diagram of a current feedback amplifier is shown in Figure 6 [29]. In Figure 6, the class current conveyors are T1~T8, the amplifier is T9, the bias circuit is T11 and T12, and the voltage follower is T13 and T14. In Figure 6, R3 is a 750-ohm OPA847 feedback resistor, C1, C2, C3, and C4 are the decoupling capacitors of OPA847. R6 is a 560-ohm CFA feedback resistance; C5, C6, C7, and C8 are the decoupling capacitors of CFA. R3 and R6 are used to set the amplification of the output signal. R1, R4, R7, and R8 are used in the impedance matching. The amplitude and frequency of the output signal are determined by the process parameters. In this experiment, the deviation of the characteristic impedance of the transmission line makes the upper cut-off frequency of the output signal changed. The amplifier works as follows equation β=λ×(S+ΔS). It means that the deviation signal ΔS is amplified λ times.Figure 5
Input circuit and deviation generating circuit.Figure 6
CFA circuit structure.


### 4.3. Digital Sample Circuit and Output Circuit

As shown in Figure7, the digital sample circuit consists of a frequency divider, a D flip-flop, two AND gates, two counters, and a comparator. Two input signal frequencies f1 and f2 serve as the upper cut-off of the output of two transmission lines, respectively. The frequency f1, though frequency divider, generates a gate control signal TC. During the clock pulse width (named T), f1 and f2 behave as two counter clock frequencies. Counter 1 counts the number of N1, and Counter 2 counts the number of N2. Comparing N1 and N2, if N1>N2, the output is “0”; otherwise the output is “1.” The output circuit comprises M output units. Each output unit comprises a latch and First Input First Output (FIFO) circuit, as shown in Figure 7.Figure 7
Digital sample circuit and output circuit.


## 4.1. Impedance Mismatch PUF Model

According to the impedance mismatch theory and the PUF design method, we presented an impedance mismatch PUF (IM-PUF) model, as shown in Figure4. The model is composed of input circuit, deviation generating circuit, digital sample circuit, and output circuit. The deviation generating circuit is the core of the PUF circuit, which generates the upper cut-off frequency with the deviation. The upper cut-off frequency is the clock frequency of the digital sample circuit. During the T time, the circuit compares the two signals and generates a “0” or “1” as the response of PUF circuit.Figure 4
IM-PUF circuit model.


## 4.2. Input Circuit and Deviation Generating Circuit

The input circuit and deviation generating circuit are shown in Figure5. The input circuit is composed of D flip-flops (DFF), NAND gates, and inverters, while the deviation generation circuit is composed of an operational amplifier (OPA847), transmission lines, and current feedback amplifier (CFA). The diagram of a current feedback amplifier is shown in Figure 6 [29]. In Figure 6, the class current conveyors are T1~T8, the amplifier is T9, the bias circuit is T11 and T12, and the voltage follower is T13 and T14. In Figure 6, R3 is a 750-ohm OPA847 feedback resistor, C1, C2, C3, and C4 are the decoupling capacitors of OPA847. R6 is a 560-ohm CFA feedback resistance; C5, C6, C7, and C8 are the decoupling capacitors of CFA. R3 and R6 are used to set the amplification of the output signal. R1, R4, R7, and R8 are used in the impedance matching. The amplitude and frequency of the output signal are determined by the process parameters. In this experiment, the deviation of the characteristic impedance of the transmission line makes the upper cut-off frequency of the output signal changed. The amplifier works as follows equation β=λ×(S+ΔS). It means that the deviation signal ΔS is amplified λ times.Figure 5
Input circuit and deviation generating circuit.Figure 6
CFA circuit structure.


## 4.3. Digital Sample Circuit and Output Circuit

As shown in Figure7, the digital sample circuit consists of a frequency divider, a D flip-flop, two AND gates, two counters, and a comparator. Two input signal frequencies f1 and f2 serve as the upper cut-off of the output of two transmission lines, respectively. The frequency f1, though frequency divider, generates a gate control signal TC. During the clock pulse width (named T), f1 and f2 behave as two counter clock frequencies. Counter 1 counts the number of N1, and Counter 2 counts the number of N2. Comparing N1 and N2, if N1>N2, the output is “0”; otherwise the output is “1.” The output circuit comprises M output units. Each output unit comprises a latch and First Input First Output (FIFO) circuit, as shown in Figure 7.Figure 7
Digital sample circuit and output circuit.


## 5. Experimental Results and Analysis

We used many pieces of IM-PUF PCB as designed to measure the upper cut-off frequency in different situations. Figure8 shows the experiment setup for the IM-PUF measurements. The test platform mainly includes tested PCB board, two MOTECH LPS-305 DC Power Supplies (5 V), SP1461 Type II 300 M Signal Generator, Tektronix MDO3022 200 MHz Oscilloscope, and some wires.Figure 8
The experiment setup for measuring IM-PUF.The flow of the experimental measurement is summarized as follows. Four steps are needed in total.Step  1. Under the peak-to-peak value of 20 mV of the sine wave, measure the voltage amplification values on the original PCB with different frequencies.Step  2. If the frequency is less than 60 MHz, the output of RMS voltage is about 130 mV.Step  3. As input frequency increases, voltage values begin to decay.Step  4. Determine the upper cut-off frequency voltage value as 0.707 times the middle frequency, namely, 91.91 mV; the upper cut-off frequency is 85.6 MHz.After that, change the length and width of the PUF circuit transmission line, with 7 cm thin wire, 14 cm thin wire, 7 cm thick wire, and 14 cm thick wire in the original circuit on a transmission line. The deviation of 5% more or less than the component’s performance shall be allowed, and the fluctuation range of 1 V more or less than power supply shall be allowed. Measure the upper cut-off frequency at 85.5 MHz, 80.4 MHz, 86.5 MHz, and 80.9 MHz. Experimental measurement data is shown in Figure9. The frequency curve of PUF obviously changed after changing its transmission line. After changing length and width of the transmission line, its frequency changed accordingly. Given the 6 V and 5 V power supply, the cut-off frequencies have nearly equal values with values lower than 100 MHz, as shown in Figure 10. The frequency of the output signal serves as a trigger for a counter. Then, comparing the outputs of counters, the IM-PUF produces a value of 0 or 1.Figure 9
Frequency curve of PUF circuit.Figure 10
IM-PUF with different power supply.In statistics, autocorrelation is defined as the correlation among values of random process [30]. In this work, the hypothesis behind calculation of the autocorrelation is that IM-PUF is a random process. Because IM-PUF is designed according to random variation during PCB manufacturing process, the proposed hypothesis is ok. In other words, the autocorrelation can be used to characterize the performance of antianalysis attack. In the experiment, the sample data of 1# PCB is set as a reference. Figure 11 shows the autocorrelation rates of the IM-PUF circuit. As can be seen, the autocorrelation of the proposed PUF circuit fluctuates between −0.3 and 0.3. The low autocorrelation rates mean that the PUF is resistant to correlation analysis.Figure 11
Autocorrelation of the IM-PUF output.The output data of IM-PUF is measured with 60 samples PCB. Recording this data, we use a hamming distance of the IM-PUF output to demonstrate the randomness characteristic. Figure12 shows the hamming distance of the IM-PUF circuit. As can be seen, the distribution of hamming distance is consistent with standard normal distribution. The Normalized Standard Deviation (σ) of IM-PUF is 0.0611, while the Normalized Standard Deviation of [31, 32] is 0.0818 and 0.0627, respectively. This means the proposed PUF circuit has better randomness characteristic.Figure 12
Measured hamming distance for IM-PUF.Key characteristics of implemented PUFs are summarized in Table1. Our design is the first reported in board-level PUFs that can read out an ID at each PCB. Because the variation of transmission line will lead to impedance mismatch and signal reflection, the high-frequency signal processing is very hard in board-level. The 100 M frequency of IM-PUF is closed to the best circuit about arbiter-based PUFs. The total number of possible IM-PUF data depends on the number of the transmission lines (2N). There are so much possible transmission lines in PCB that it is feasible for an adversary to guess the output. And also, under a fixed input, the output data varies across different PCBs, because the IM-PUF responses are designed to be sensitive to circuit delays which are determined by process variation in wires. Since process variation is beyond the manufacturers’ control, no one can physically clone the IM-PUF. So the impedance mismatch Physical Unclonable Functions eliminate the problems of a board-level physical feature recognition technique.Table 1
The comparison with other works.
Paper PUFs type Frequency (Hz) Variation source TNANO, 2015 [8] MRAM-PUF — Material-level VLSI, 2005 [11] Arbiter-based PUFs 100 M Circuit-level CHES, 2010 [12] Glitch PUFs 50 M Circuit-level IFS, 2011 [13] Time Bounded 20 M Circuit-level Scientific reports, 2015 [14] mrS-PUFs 25 M Material-level This work IM-PUFs 100 M Board-level


## 6. Conclusion

We proposed a new kind of PUF circuit design based on PCB. Imposing the impedance matching characteristic of high-frequency PCB circuit, changing length and width of the transmission line, causes the output of the upper cut-off frequency to be different. With this frequency as a counter clock frequency, the output produced by the deviation frequency circuit is different, and with the same timeT, the count value is also different. Due to the difference in count value, the comparison circuit would output a binary response signal. The function of this PUF on a PCB is unpredictable, so the security of the IoT will be improved.



---

*Source: 4070589-2017-01-24.xml*