- Email: [email protected]
Improving uniformity and reliability of SRAM PUFs utilizing device aging phenomenon for unique identifier generation
Microelectronics Journal 90 (2019) 29–38
Contents lists available at ScienceDirect
Microelectronics Journal journal homepage: www.elsevier.com/locate/mejo
Improving uniformity and reliability of SRAM PUFs utilizing device aging phenomenon for unique identifier generation Achiranshu Garg, Zhao Chuan Lee, Lu Lu, Tony Tae-Hyoung Kim * School of Electrical and Electronic Engineering, Nanyang Technological University, 50 Nanyang Avenue, Singapore 639798, Singapore
A R T I C L E I N F O
A B S T R A C T
Keywords: Static random access memory (SRAM) Physical Unclonable Function (PUF) Device aging
SRAM Physical Unclonable Functions (PUFs) utilize start-up values generated by random variations in the fabrication process. However, the random variations can generate biased power-up data, which can degrade the uniformity below the target. In addition, very small mismatches can prevent power-up data from being repeated, deteriorating the reliability. This paper presents a post-fabrication technique that can improve the uniformity and the reliability of SRAM PUFs by utilizing device aging phenomenon through two functional steps. In the first step, the proposed technique controls the polarity of the device aging in each SRAM cell using the power-up value for uniformity improvement. Once a target uniformity is achieved from an SRAM array, we inject device aging into each SRAM cell in a way of increasing the mismatches between two cross-coupled inverters. An SRAM PUF test chip fabricated in 65 nm CMOS technology validated the effectiveness of device aging in enhancing the uniformity and the reliability of the SRAM PUF.
1. Introduction Digital systems such as mobile phones, appliances, and security systems are becoming ubiquitous in everyday life. These devices handle personalized data and private information that must be protected from any unauthenticated access. In addition, semiconductor vendors outsource IPs to other System-on-Chip (SoC) vendors to reduce the productcycle time, which creates critical design security issues and eventually leads to tremendous loss of revenue [1]. Therefore, robust security mechanisms without significant overheads in power and silicon area are required to provide secure computing under any operating conditions. Conventional security systems (e.g. RFID tags, smart cards) store binary encrypted keys in memory like electrically erasable programmable read-only memory (EEPROM) and static random access memory (SRAM) [2]. They need additional hardware for cryptographic operations, which increases the power and the circuit area. However, various advanced (invasive & non-invasive) tampering techniques have been introduced to steal the encrypted binary keys. They include micro-probing, laser cutting, glitch attacks, and power analysis. To prevent such physical attacks, researchers have developed various tamper sensing methods where any tempers on the designs are detected by multiple tamper sensors. The limitation of the tamper sensing is that the hardwired information can be easily stolen when the circuit is off [3].
To address the above issue, researchers have investigated various hardware-intrinsic characteristics that can improve hardware security [4, 5]. Physical Unclonable Functions (PUFs) are considered as promising hardware security solutions since they can generate unique binary keys without memories and cryptographic operations. Gassend et al. utilized the concept of random variations in silicon to realize PUFs (classified as weak PUFs) [4]. Here, random variations during manufacturing PUFs produce fingerprints of physical objects. Even if the same designs are fabricated, we cannot obtain identical chips. Therefore, the binary keys generated by the random variations are extremely difficult to be duplicated by hardware. In addition, the amount of random variations in silicon increases as the semiconductor technology scales. This is desirable for PUFs implementation since it further decreases the possibility of manufacturing identical chips. Fig. 1 explains a sample application of PUF where activation codes and keys are generated by the PUF. Since the output of the PUF is random and untraceable, the activation codes and the keys can be protected. Various types of PUFs have been introduced such as optical PUF, delay-based PUF, butterfly PUF, and SRAM PUF. In Refs. [6–8], SRAM PUF demonstrated better stability and reliability when compared to other PUF types. SRAM PUF uses variations in the power-up patterns to generate identifiers with low overhead. In addition, temperature variations in SRAM PUF are common to all SRAM cells, thus their impacts on
* Corresponding author. E-mail address: [email protected] (T.T.-H. Kim). https://doi.org/10.1016/j.mejo.2019.05.013 Received 23 October 2018; Received in revised form 9 April 2019; Accepted 16 May 2019 Available online 20 May 2019 0026-2692/© 2019 Elsevier Ltd. All rights reserved.
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
algorithm for producing stable bits [16]. Since the generated bits are stable, it can minimize the circuit overhead for error correction. However, this technique only excludes partially skewed cells and neutral-skewed cells, which requires relatively large process variations to secure enough stable cells. In Ref. [17], the authors investigated the effects of data-dependent silicon aging on the reliability of SRAM PUF. The study explained that the reliability of the SRAM PUF could be improved in some scenarios because of anti-aging effects. However, it is difficult to identify the scenarios and use them in actual security systems. Neale et al., analyzed the sensitivity of static noise margin (SNM) to SRAM cell design parameters [18]. It was observed that the cell size heavily affects the difference (ΔSNM) between two SNM values (SNMs for data ‘1’ and ‘0’). Even though logic-rule-based SRAM PUF showed better reliability, it is not practical to intentionally increase the SRAM cell size in many applications due to the significantly increased area overhead. In Ref. [19], the authors proposed an attacking method on an SRAM PUF to analyze how the device wearout causes substantial changes in the power-up patterns of an SRAM PUF. By using higher supply voltage and higher temperature for wearout acceleration, it was presented that only 15% of the SRAM cells stored uniform values after three days of the wearout acceleration. This makes the SRAM PUF unusable and leads to security system failures. Jeloka et al., developed an SRAM PUF in 28 nm CMOS technology with a sequence dependent behaviour [20]. Here, the authors increased the challenge-response space by initializing two cells with complementary data through states fighting. This method increases the number of row selection choices from ‘n’ to ‘~n2’ when ‘n’ is the number of rows. The enhanced challenge-response space make it more difficult for a machine to learn. The tested attacks with the sequence length of 5 improved the resistance of a 64-bit arbiter more than 30 times. To solve the noisy data issue from random bits of SRAM PUF, Bosch et al. proposed the Helper Data Algorithm (HDA) key extractor [21]. This work is focused mainly on the implementation of fuzzy extractors on FPGA without considering the hardware overhead. Krishna et al., proposed a PUF utilizing different word line (WL) pulse widths for generating unique signatures from an SRAM array [22]. The combination of WL pulse width and the SRAM array increases the challenge-response space. However, the reliability of the WL pulse width control and the area overhead can limit the effectiveness of this technique. Holocomb et al., introduced the concept of DRV-Fingerprinting, i.e. generating silicon fingerprints at Data Retention Voltage [23]. This increased the number of reliable SRAM cells by 28% compared to the normal power-up. However, characterizing DRV is not trivial and requires a large amount of time. An SRAM reliability technique utilizing device aging was introduced in Ref. [24], which is similar to the proposed work. However, it does not discuss other aspects such as uniformity, hardware implementation, and how to merge uniformity improvement and reliability improvement. Even though various SRAM PUF design techniques have been developed above, the uniformity and the reliability of SRAM PUF are still relying on the natural process variations that are uncontrollable. Therefore, modern PUFs need to employ error correction techniques to make the PUFs more reliable at the cost of additional hardware. In this work, we will address the above issues through device aging injection through the proposed methodology. This paper is an extended version of the conference version [25].
Fig. 1. Activation code and key generation using PUF.
the SRAM power-up patterns are insignificant [9]. In an ideal SRAM cell, two cross-coupled inverters are symmetrical and should be in the meta-stable state during power-up. However, it is impossible to manufacture perfectly symmetrical cross-coupled inverters due to the device mismatches coming from the manufacturing variations. Any inherent local mismatches in the cross-coupled inverters will be amplified through the positive feedback until strong logic ‘1’ or logic ‘0’ is generated. Since no biased design is employed, each SRAM cell will produce logic ‘1’ and logic ‘0’ randomly with the probability of 0.5. The random power-up patterns prevent unique binary keys from being revealed during operation. However, if random process variations occur, the logic value of each SRAM cell can be random or the number of logic ‘1’ or ‘0’ can be biased after power-up. If device mismatches coming from random process variations are insignificant, the power-up data patterns measured from an SRAM PUF can vary largely. The SRAM cells whose power-up data changes under various environmental noises during power-up deteriorate the reliability of the SRAM PUF. In addition, biased power-up data patterns from an SRAM PUF degrade the uniformity, which can reveal keys with a relatively smaller number of attacks. This degrades the reliability of the SRAM PUF. In this work, we propose a post-fabrication technique for improving the uniformity and the reliability of SRAM PUF simultaneously. The above goals are achieved by using the effects of device aging phenomenon like negative-bias-temperature-instability (NBTI) on transistors [10, 11]. The proposed technique injects device aging SRAM PUFs through two process steps, one for uniformity improvement and the other for reliability improvement. In the uniformity improvement step, the injected device aging will balance the number of ‘1's and that of ‘0's in the SRAM PUF. In the subsequent reliability improvement step, the device aging will be injected in a way of expanding the mismatches in the SRAM PUF. To validate the proposed technique, an SRAM PUF test chip was fabricated in 65 nm CMOS technology. Measured results demonstrated that the uniformity and the reliability of the SRAM PUF are improved by injecting device aging through the proposed methodology. The remainder of this paper is organized as follows. Section 2 discusses various state-of-the-art works on SRAM PUFs. In Section 3, we will explain the proposed post-fabrication techniques for improving the uniformity and the reliability of SRAM PUFs. Section 4 will presents test chip implementation and several measurement results, which is followed by conclusions in Section 5.
3. Proposed SRAM PUF design methodology 2. Relevant works on SRAM PUFs In ideal SRAMs, the number of ‘1's is equal to that of ‘0’. In addition, an SRAM randomly generates a power-up data pattern because of random process variations. The generated power-up pattern recurs whenever the SRAM is powered up. However, the randomness in the SRAM fabrication process make the aforementioned features difficult to achieve at the same time. This work proposes a post-fabrication methodology for improving the uniformity (distribution of 1's & 0's in the power-up patterns) and the reliability (generation of the same power-up pattern regardless of environmental variations) of SRAM PUFs. The proposed methodology injects
In recent years, SRAM PUFs have attracted more interests because of their superiority in stability and reliability compared to other types of PUFs. Several SRAM PUF designs demonstrated that an SRAM array generated random power-up values due to threshold voltage mismatches [12,13]. They showed that the fabricated SRAM cells produced a roughly normal distribution and more than 90% of the cells were stable. Other works verified that the SRAM power-up data patterns can be used as unique fingerprints [14,15]. Xiao et al., presented a bit selection 30
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
total aging is the additive combination of NBTI and PBTI. In this work, only NBTI will be considered since the designed SRAM PUF is implemented in 65 nm CMOS technology. The proposed methodology is also applicable to high-k/metal-gate process technology without any changes. 3.2. Uniformity improvement In SRAM PUF, uniformity represents the generated distribution of data 1's and 0's. The ideal uniformity of SRAM PUF is 50%, which indicates that 50% of the data is ‘1’ and the rest is data ‘0’. This ensures a strong security key since it is the most difficult condition to be replicated by other PUF chips. However, actual uniformity of SRAM PUF can vary due to many random parameters such as random dopant fluctuation, environmental noises during power-up, etc. Poor uniformity decreases the number of SRAM PUF cells to be replicated, which makes it vulnerable to hacking. Any systematic variations will impact the uniformity. Fig. 3 illustrates the concept of the proposed uniformity improvement technique. In general, mismatches in an SRAM tend to generate normal distribution, coming from random variations as shown in Fig. 3(b). This provides good uniformity. However, when SRAM PUF has systematic variations, the distribution of 1's and 0's can deviate from the normal distribution. In Fig. 3(a), the power-up data pattern will include a substantially increased number of ‘0's. Since the strong ‘0’ cells will generate mostly data ‘0’ after power-up, the number of SRAM cells that can be used for security key generation will decrease largely. To avoid this, we need a technique that can maintain the uniformity of SRAM PUF close to 50%. This work achieves this by injecting aging (NBTI) through a control flow. Fig. 4 shows two cross-coupled inverters in a typical SRAM cell. The mismatches in the inverters formed by P1, N1, P2, and N2 will determine the initial power-up value of the SRAM cell. In general, we expect an SRAM cell has the power-up data of ‘1’ and ‘0’ with the same probability under random process variations. However, the probability can deviate from the desirable range due to uncontrollable random variations. This deteriorates the uniformity of the SRAM-PUF and can lead to easier guessing. To tackle this issue, this work utilizes post-fabrication NBTI injection to maintain the uniformity within a target range. Note that only one PMOS device (either P1 or P2) is affected by NBTI at a time depending on the stored value. Therefore, changing the stored value and the duration of NBTI in an SRAM cell can control the polarity and the amount of the mismatches in the cross-coupled inverters. If we assume P1 is weaker than P2 (i.e. jVtp1j > jVtp2j) as illustrated in Fig. 4(a), the eye opening of Q ¼ ‘0’ becomes larger than that of Q ¼ ‘1’. Therefore, it is more likely that Q will be ‘0’ after power-up without considering other non-ideal factors. If NBTI injection occurs in the same SRAM cell (using high voltage and high temperature), jVtp2j of P2 (Vgs ¼ -Vdd) will increase, and the mismatches between P1 and P2 will decrease. If the NBTI injection is large enough to make P2 weaker than P1, the power-up data will change from ‘0’ to ‘1’ as depicted in Fig. 4(b). This indicates that we can control the power-up data of an SRAM cell through the proper injection of NBTI. Fig. 5 shows the simulated results of the change (from Q ¼ ‘0’ to Q ¼ ‘1’) in the power-up data after the aforementioned NBTI injection. The proposed SRAM PUF utilizes the above principle for uniformity improvement. Assume that 70% of the total cells in SRAM PUF have the power-up data of ‘1’ while 30% of the cells have the power-up data of ‘0’. To improve uniformity, we inject NBTI stress to the SRAM PUF so that the mismatches in the cross-coupled inverters diminish. After applying the 1st round of the NBTI injection, the SRAM PUF will be powered off to stop NBTI injection. After that, the SRAM PUF will be powered on and generate a new power-up data pattern after the NBTI injection. The power-up data of some cells may change from data ‘1’ to data ‘0’, which reduces the difference between the number of 1's and that of 0's. The above NBTI injection steps are repeated until the uniformity is close to the target value (ideally 50%). Fig. 6 presents a sample simulated result demonstrating the effect of the proposed technique on the uniformity of
Fig. 2. 6 T SRAM cell for SRAM-PUF implementation.
Fig. 3. Concept of the proposed uniformity improvement technique: (a) without uniformity improvement and (b) with uniformity improvement. Note that X and Y axes represent the amount of mismatch and the cell count, respectively.
an aging mechanism called negative-bias-temperature-instability (NBTI) in PMOS devices through two different steps, one for uniformity improvement and the other for reliability improvement. This section will explain the proposed methodology in detail. 3.1. Negative bias temperature instability NBTI is a primary aging mechanism gradually degrading the PMOS device performance in advanced CMOS technology. NBTI occurs when a PMOS device undergoes negative bias (i.e. Vgs ¼ Vdd) on the gate. This condition generates hole trapping at the gate dielectric interface or into the gate dielectric. To compensate for this, the gate needs more negative bias. Using larger negative bias voltage and higher temperature accelerates NBTI. The main impact of NBTI is the increase of the device threshold voltage. When the negative bias is removed, the increased threshold voltage is partially recovered. This work utilizes this partially recovered NBTI in the proposed uniformity and reliability improvement. Positive-bias-temperature-instability (PBTI) is a similar aging mechanism occurring in NMOS devices. PBTI is prominent in the high-k/metal-gate process technology. Fig. 2 illustrate the conventional 6 T SRAM cell storing ‘1’ at ‘Q’. Note that P1 is under NBTI while N2 is under PBTI. The 31
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
Fig. 4. Cell Flip in power-up due to aging (NBTI) injection. jVtP1j and jVtP2 j represents the threshold voltage of P1 and P2 respectively before ageing. Also, jV'tP1j and jV'tP2j represents threshold voltage of P1 and P2 after aging.
Fig. 5. (a) Initial power-up behaviour of SRAM cell (b) flipped cell after aging injection.
It is possible that the proposed uniformity improvement technique cannot achieve the uniformity of ~50% when the systematic process variations are larger than the threshold voltage range that can be controlled by the NBTI injection. However, the proposed technique will always improve the uniformity compared to the initial uniformity obtained right after the fabrication, which is not the case in other state-ofthe-art works that simply reply on natural process variations.
SRAM PUF. Monte-Carlo simulation with 10 k points was conducted for checking the power-up patterns. SRAM PUF with a skewed initial powerup data pattern was designed and simulated. Initially, the number of SRAM cells with the power-up data ‘1’ is 7255 out of 10 k. As the amount of the NBTI injection increases, the number of 1's decreases while that of 0's increases. The NBTI injection is applied until the difference between the number of ‘1's and that of ‘0's lies within the acceptable range. The simulation result in Fig. 6 shows that the NBTI injection of 46 mV achieves the uniformity of 50.43% (or 49.57%).
32
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
propose reliability improvement methodology also utilizes NBTI injection. Fig. 7 explains the concept of the proposed reliability improvement methodology. Fig. 7(a) shows a normal distribution of data 1's and data 0's with good uniformity, which can be obtained by the proposed improvement methodology. However, the reliability of the distribution in Fig. 7(a) is poor due to many symmetric cells. The mismatches between the cross-coupled inverters need to be large so that multiple power-up operations can generate same data patterns with very low error rates (Fig. 7(b)). Note that the number of symmetric cells is substantially small in Fig. 7(b). Therefore, the power-up data pattern will not vary significantly. However, the distributions in Fig. 7(b) cannot occur naturally through the SRAM PUF fabrication process, which requires a postfabrication technique for transforming the distribution in Fig. 7(a) into that in Fig. 7(b). Fig. 8 illustrates the effect of the proposed reliability improvement method on the mismatch of the cross-coupled inverters. If jVtp1j is similar to jVtp2j, the power-up data will be random, which is not desirable for good PUF reliability. NBTI injection to a relatively weaker device will enhance the mismatch, and will achieve better reliability. For example, if P2 is slightly weaker than P1, NBTI injection should be applied to P2 so that P2 becomes much weaker than P1 as shown in Fig. 8(bottom left). Similarly, if P1 is marginally weaker than P2 during power-up, P1 will undergo NBTI injection as shown in Fig. 8(bottom right). This requires cell data flipping before applying NBTI. Note that if NBTI injection is applied right after power-up, a stronger device is under NBTI injection and the mismatch decreases initially. To achieve the above requirements, this work proposes a reliability improvement methodology that can save the processing time and the hardware requirements. The proposed methodology follows the next steps. First, the initial power-up data pattern is flipped before injecting NBTI. Flip-flops can execute the flipping operation. We read the initial power-up data row by row and store them in the flip-flops. In the next cycle, the complements of the stored data are written back to the same row. This operation will end after flipping all the data stored in the SRAM PUF. After the flipping, we inject NBTI by raising supply voltage to a higher level (2 V in this work) for mismatch enhancement. This makes weaker devices undergo NBTI, and the mismatches will be larger. After each NBTI injection into the SRAM PUF, the power-up pattern is read multiple times for reliability checking. The number of checking can vary depending upon the target reliability. In general, higher reliability requires a larger number of power-up data checking. The above steps recur until the target reliability is achieved. Fig. 9 shows a MonteCarlo simulation result of the proposed reliability enhancement technique using 10 k points. After the initial power-up, the numbers of data 0's and 1's are 4624 and 5376, respectively. The random process variations create the difference in the number of 0's and 1's. As the NBTI injection increases the mismatch in the cross-coupled inverters by weakening P2 in Fig. 8, the probability of power-up data ‘1’ increases as shown in Fig. 9. The NBTI injection can affect the power-up data significantly at the earlier stage since the initial mismatch is small enough to generate almost random power-up data. Once the NBTI injection increases the mismatch large enough, it is very unlikely that environmental noises during power-up affect the power-up data. Fig. 10 shows the sensitivity of power-up data to supply voltage and temperature changes with and without the proposed NBTI injection. Without NBTI injection, the probability of data ‘1’ is around 0.5. It is slightly affected by the supply voltage and the temperature. As the amount of the injected NBTI increases, the probability of data ‘1’ decreases as expected. In addition, no significant sensitivity to supply voltage and temperature variations is observed.
Fig. 6. Uniformity improvement due to NBTI.
Fig. 7. Concept of the proposed reliability improvement technique: (a) without reliability improvement and (b) with reliability improvement. Note that X and Y axes represent the amount of mismatch and the cell count, respectively.
3.3. Reliability improvement After achieving the target uniformity, the reliability of SRAM PUF is investigated for improved security. The reliability of SRAM PUF represents the capability whether the SRAM PUF can repeatedly generate a same power-up data pattern among repeated power-up sequences. However, as explained in the previous section, a power-up data pattern of SRAM PUF relies on the mismatches in the cross-coupled inverters. If the mismatch in an SRAM cell is small, the power-up value of the cell will be highly sensitive to various environmental noises, and be random. This is desirable in achieving good uniformity and randomness in the SRAM PUF. However, the small mismatches will deteriorate the reliability of the SRAM PUF since the power-up patterns does not recur. The proposed uniformity improvement technique reduces the mismatches of the crosscoupled inverters in the SRAM PUF, which worsens the reliability. Therefore, in addition to the uniformity improvement technique, we also need to investigate reliability improvement. Like the proposed uniformity improvement methodology, the
3.4. Merged uniformity and reliability improvement flow This section will explain how to merge the proposed uniformity improvement technique with the proposed reliability improvement technique for SRAM PUF. Fig. 11 depicts the overall flow of the proposed methodology. It consists of two flows, one for uniformity improvement 33
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
Fig. 8. Utilization of NBTI for mismatch enhancement. The small initial mismatch will be expanded by injecting NBTI in either P1 or P2.
meets the target uniformity, the proposed uniformity improvement steps will be skipped. Note that skewed SRAM PUFs will require a larger number of stress cycles to overcome the initial mismatches and flip the cell data through NBTI injection. After achieving the target uniformity, the reliability improvement flow starts by generating power-up data patterns and estimating them multiple times (N times in Fig. 11). If the estimated variation is larger than the target, it is necessary to improve the reliability by expanding the mismatches in the cross-coupled inverters. It starts by flipping the data in the SRAM PUF row by row followed by NBTI injection. After the NBTI injection, we estimate the reliability through multiple power-ups and counting the number of 1's. The above steps are repeated until the variation in the power-up data patterns is within the target range. The flow in Fig. 11 can be executed using higher temperature and higher supply voltage for aging acceleration. In addition, it can be applied to high-k/metal-gate process technology where PBTI is also prominent. The combination of NBTI and PBTI will increase the overall amount of injected aging that can be controlled by the proposed flows. This will allow us to further improve the uniformity and reliability without any change in the proposed flows. Fig. 12 depicts how the proposed methodology improves the uniformity and the reliability of SRAM PUF through the NBTI injection. We assume that the initial power-up data pattern is biased to data ‘1’ (dark color) as depicted in Fig. 12(i). After injecting NBTI without data flipping, the updated data pattern becomes less biased (Fig. 12(ii)). Since the number of data 1's in Fig. 12(ii) is still larger than that of data 0's, additional NBTI is injected until the number of 1's is similar to that of 0's (Fig. 12(iii)). Note that the contrast in Fig. 12(iii) is small, indicating poor reliability. The proposed reliability improvement methodology augments the contrast of the data pattern as illustrated in Fig. 12(iii) and achieves Fig. 12(iv). Note that no SRAM cell or only a small number of SRAM cells will have different power-up data after the proposed reliability improvement.
Fig. 9. Reliability improvement due to NBTI.
and the other for reliability improvement. First, the proposed uniformity flow starts by powering up SRAM PUF. After that, the numbers of data 1's and that of 0's are counted for checking the uniformity. If the distribution of data 1's and 0's is not within the target range, NBTI will be injected into the SRAM array by raising the supply voltage for acceleration. In this work, we utilized 2 V as the stress voltage. Higher temperature can be also employed for further NBTI acceleration. After the NBTI injection step, the power-up data pattern of the SRAM PUF using nominal supply voltage (i.e. 1.2 V in this work) will be generated again, followed by the uniformity checking. The target uniformity can be achieved after repeating the above steps multiple times. If the very first power-up data 34
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
Fig. 10. Sensitivity of power-up data on supply voltage and temperature after NBTI injection: (a) without NBTI injection, (b) NBTI injection of 10 mV, (c) NBTI injection of 25 mV, and (d) NBTI injection of 50 mV. The above figures show the probability of data ‘1’.
Fig. 11. Proposed methodology for robust SRAM-PUF. ‘N’ ¼ 10 in this work.
4. Test chip implementation and measurement results
and inverters for the proposed uniformity and reliability improvement technique. The SRAM PUF has two main data paths, one for uniformity and reliability checking and the other for data control for reliability improvement. The uniformity and reliability checking is conducted through a read operation. While the reliability improvement path includes write operation after flipping. During testing, the uniformity and
The architecture of the proposed SRAM PUF is illustrated in Fig. 13. It consists of basic SRAM functional blocks such as an SRAM array, an address decoder, sense amplifiers, write drivers, multiplexers, and a memory controller, and additional blocks such as a counter, flip-flops, 35
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
Fig. 12. Uniformity and Reliability improvement methodology on SRAM-PUF.
array data, NBTI aging needs to be injected in the direction of increasing the mismatches in each SRAM cell. This can be achieved by flipping the stored data before injecting NBTI. Flipping the data of the SRAM PUF is conducted through the flip-flops and the inverters. The read data are stored in the flip-flops during read operation. The stored data are written back to the SRAM array after flipping in the subsequent cycle. Once the array data are flipped, NBTI is injected by raising the supply voltage. The power-up data are read multiple times for checking the reliability. The above reliability improvement steps are repeated until the power-up data after the NBTI injection meet the target reliability. Note that the injected NBTI will be partially recovered during the testing. Fig. 14 shows sample data patterns measured over repeated NBTI stress following the proposed uniformity improvement flow. The number of SRAM cells producing the power-up data of ‘1’ was 13 out of 16 at the beginning. It becomes 9 after applying NBTI stress (stress voltage ¼ 2 V) three times. As expected, SRAM cells with large mismatches (Strong ‘1's and Strong ‘0's) do not change the power-up data throughout the uniformity improvement flow. Only the power-up data of the balanced SRAM cells fluctuate during the uniformity improvement flow. We also measured the change of the power-up pattern in a 16-kb test chip while applying the proposed uniformity improvement technique (Fig. 15). To clearly observe the benefit of the proposed technique, a test chip with a relatively biased initial power-up pattern is selected for testing. It is obvious that the proposed technique improves the uniformity by decreasing the number of data ‘0's and increasing that of data ‘1’. The numbers of ‘1's and ‘0's can fluctuate since the uniformity improvement technique reduces the mismatches in the SRAM cells. Therefore, the power-up data of a larger number of SRAM cells will be affected by various noise components during power-up as indicated by the dotted box in Fig. 15. Fig. 16 summarizes the proposed uniformity improvement technique measured from multiple test chips. Note that the number of ‘1’ moves toward the ideal bit count after applying the proposed uniformity improvement technique. However, it is observed that the uniformity of one chip (Chip ID ¼ 1) is still relatively poor due to the large initial mismatches in the SRAM array. The large initial mismatches limit the number of SRAM cells whose power-up data can be changed through NBTI injection. Once the number of data ‘0's becomes similar to that of data ‘1's within the target range, we can stop the uniformity improvement flow
Fig. 13. Circuit implementation of the proposed SRAM PUF.
reliability checking paths are activated. The counter calculates the number of 1's in the SRAM array after power-up. After reading all the array data, the counter output is read to determine whether the target uniformity is satisfied. If not, NBTI is injected into the SRAM array by raising the supply voltage for a pre-defined time. The uniformity is checked again through read and count operation. These steps are repeated until the measured uniformity lies in the target range. Once the uniformity improvement is over, the proposed reliability improvement starts by reading the array data after power-up multiple times (e.g. 10 times in this work). If each reading after power-up produces different 36
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
Fig. 14. Sample measured data patterns from a small part of the implemented array over the proposed uniformity improvement.
Fig. 17. Measured result of the fluctuations in the power-up pattern. This result shows that reliability improvement is required. The bit counts are measured 10 times in each measurement point to obtain the maximum and the minimum values.
Fig. 15. Measured result of the proposed uniformity improvement over NBTI stress.
Fig. 16. Measured uniformity improvement from multiple test chips. The graph depicts the change in the number of ‘1's. Fig. 18. Measured result of the proposed reliability improvement over NBTI stress.
and start the proposed reliability improvement technique. This is necessary to minimize the fluctuations in the power-up patterns after the proposed uniformity improvement technique. The measurement results in Fig. 17 depicts the fluctuations of the power-up patterns after the uniformity improvement flow. It can be observed that as the uniformity
improves, the fluctuations become larger, which deteriorates the reliability below the target value. Therefore, the proposed reliability 37
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
Acknowledgement The authors would like to thank GLOBALFOUNDRIES Singapore for test chip fabrication.
16-kb SRAM PUF
References [1] J. Guajardo, S.S. Kumar, G.-J. Schrijen, P. Tuyls, Brand and IP protection with physical unclonable functions, IEEE Int. Symp. Circ. Syst. (2008) 3186–3189. [2] P. Schaumont, D.D. Hwang, Turning liabilities into assets: exploiting deep submicron CMOS technology to design secure embedded circuits, IEEE Int. Symp. Circ. Syst. (2008) 3178–3182. [3] D. Lim, J.W. Lee, B. Gassend, G.E. Suh, M. van Dijk, S. Devadas, Extracting secret keys from integrated circuits, IEEE Trans. Very Large Scale Integr. Syst. 13 (Oct. 2005) 1200–1205. [4] S. Devadas and B. Gassend, "Integrated Circuit that Uses a Dynamic Characteristic of the Circuit." U.S. Patent, No. 7,757,083. 13 Jul. 2010. [5] R.S. Pappu, Physical One-Way Functions, Ph.D. thesis, Massachusetts Institute of Technology, 2001. [6] R. Maes, P. Tuyls, I. Verbauwhede, A soft decision helper data algorithm for SRAM PUFs, IEEE Int. Symp. Inf. Theor. (2009) 2101–2105. [7] M. Hofer, C. Boehm, An alternative to error correction for sram-like pufs, in: Int. Workshop on Cryptographic Hardware and Embedded Systems, 2010, pp. 335–350. [8] G. Selimis, M. Konijenburg, M. Ashouei, J. Huisken, H. de Groot, V. van der Leest, G.-J. Schrijen, M. van Hulst, P. Tuyls, Evaluation of 90nm 6T-SRAM as Physical Unclonable Function for secure key generation in wireless sensor nodes, IEEE Int. Symp. Circ. Syst. (2011) 567–570. [9] D.E. Holcomb, W.P. Burleson, K. Fu, Power-up SRAM state as an identifying fingerprint and source of true random numbers, IEEE Trans. Comput. 58 (Sept. 2009) 1198–1210. [10] L. Wang, Q. Ye, R. Wong, M. Liehr, Product burn-in stress impacts on SRAM array performance, in: IEEE Int. Reliability Physics Symp., 2007, pp. 666–667. [11] S.V. Kumar, C.H. Kim, S.S. Sapatnekar, An analytical model for negative bias temperature instability, in: IEEE/ACM Int. Conf. on Computer-Aided Design, 2006, pp. 493–496. [12] P. Layman, S. Chaudhry, J. Norman, and J. Thomson, "Electronic Fingerprinting of Semiconductor Integrated Circuits," U.S. Patent, 6 738 294, Sep. 2002. [13] Y. Su, J. Holleman, B. Otis, A 1.6 pJ/bit 96 (percent) stable chip ID generating circuit using process variations, in: IEEE Int. Solid-State Circuits Conf., 2007, pp. 200–201. [14] D. Holcomb, W. Burleson, K. Fu, Initial SRAM state as a fingerprint and source of true random numbers for RFID tags, in: Conf. on RFID Security, 2007, pp. 11–13. [15] D. Holcomb, W. Burleson, K. Fu, Power-up SRAM state as an identifying fingerprint and source of true random numbers, IEEE Trans. Comput. 58 (Sep. 2009) 1198–1210. [16] K. Xiao, M.T. Rahman, D. Forte, Y. Huang, M. Su, Bit selection algorithm suitable for high-volume production of SRAM-PUF, in: IEEE Int. Symp. on Hardware-Oriented Security and Trust, 2014, pp. 101–106. [17] R. Maes, V. Leest, Countering the effects of silicon aging on SRAM PUFs, in: IEEE Int. Symp. on Hardware-Oriented Security and Trust, 2014, pp. 148–153. [18] A. Neale, M. Sachdev, A low energy SRAM-based physically unclonable function primitive in 28 nm CMOS, IEEE Custom Integrated Circuits Conf., 2015, pp. 1–4. [19] A. Roelke, M.R. Stan, Attacking an SRAM-based PUF through wearout, in: IEEE Computer Society Annual Symp. on VLSI, 2016, pp. 206–211. [20] S. Jeloca, K. Yang, M. Orshansky, D. Sylvester, D. Blaauw, A sequence dependent challenge-response PUF using 28nm SRAM 6T bit cell, in: Symp. on VLSI Circuits, 2017, pp. C270–C271. [21] C. B€ osch, J. Guajardo, A.-R. Sadeghi, J. Shokrollahi, P. Tuyls, Efficient helper data key extractor on FPGAs, in: Int. Workshop on Cryptographic Hardware and Embedded Systems, 2008, pp. 181–197. [22] A.R. Krishna, S. Narasimhan, X. Wang, S. Bhunia, MECCA: a robust low-overhead PUF using embedded memory array, in: Int. Workshop on Cryptographic Hardware and Embedded Systems, 2011, pp. 407–420. [23] D.E. Holcomb, A. Rahmati, M. Salajegheh, W.P. Burleson, K. Fu, DRVFingerprinting: using data retention voltage of SRAM cells for chip identification, in: Int. Workshop on Radio Frequency Identification: Security and Privacy Issues, 2012, pp. 165–179. [24] M. Bhargava, C. Cakir, K. Mai, Reliability enhancement of Bi-stable PUFs in 65nm bulk CMOS, in: IEEE Int. Symp. on Hardware-Oriented Security and Trust, 2012, pp. 25–30. [25] A. Garg, T. Kim, Design of SRAM PUF with improved uniformity and reliability utilizing device aging effect, in: IEEE Int. Symp. on Circuits and Systems, June 2014, pp. 1941–1944.
Fig. 19. Test chip microphotography.
improvement technique needs to be executed after the uniformity improvement. Fig. 18 demonstrates the reliability improvement of the proposed technique. The number of cells whose power-up data change over repeated power-up operations decreases over stress time, which indicates reliability improvement. This comes from enlarged mismatches in the SRAM cells. Therefore, longer stress time can be applied for better reliability. Note that Chip ‘A’ shows higher BER at the beginning (i.e. after uniformity improvement) because of the relatively smaller mismatches in the SRAM cells. Therefore, the power-up data of more cells changes over repeated power-up sequences. In actual PUF design, the amount of aging in the reliability improvement flow needs to be carefully determined particularly when an SRAM is used as both PUF and a normal memory. If the SRAM stores data leading to NBTI effects in the opposite direction for such a long time, the mismatches in the SRAM cells can diminish. This can increase errors in the PUF, which requires stronger aging injection during the reliability improvement flow. Fig. 19 shows the test chip die photo implemented in 65 nm CMOS technology. It occupies the area of 335 428 μm2. 5. Conclusion SRAM PUFs are commonly used for generating chip identifications (IDs) by using random fluctuations during the fabrication process. Good SRAM PUFs require high degrees of uniformity and reliability. Poor uniformity reduces the number of SRAM cells that can be used for ID generation. This makes the SRAM PUF vulnerable to attacks. Similarly, poor reliability leads to significant fluctuations in the generated ID, which makes it difficult to be used as a valid ID. To address these issues, this work proposes a post-fabrication technique for uniformity and reliability improvements by utilizing device aging. The proposed technique consists of two flows, one for uniformity improvement and the other for reliability improvement. The proposed uniformity improvement flow utilizes the device aging to reduce the mismatches of SRAM cells. However, the proposed reliability improvement flow increases the device mismatches by also using the device aging. This can be achieved by flipping the data stored in the SRAM PUF at the end of the uniformity improvement flow. Test chip measurement results demonstrated that the proposed technique can improve both uniformity and reliability at the same time. The proposed technique can be applied to general SRAM PUFs fabricated in advanced CMOS technology where device aging is prominent.
38
Contents lists available at ScienceDirect
Microelectronics Journal journal homepage: www.elsevier.com/locate/mejo
Improving uniformity and reliability of SRAM PUFs utilizing device aging phenomenon for unique identifier generation Achiranshu Garg, Zhao Chuan Lee, Lu Lu, Tony Tae-Hyoung Kim * School of Electrical and Electronic Engineering, Nanyang Technological University, 50 Nanyang Avenue, Singapore 639798, Singapore
A R T I C L E I N F O
A B S T R A C T
Keywords: Static random access memory (SRAM) Physical Unclonable Function (PUF) Device aging
SRAM Physical Unclonable Functions (PUFs) utilize start-up values generated by random variations in the fabrication process. However, the random variations can generate biased power-up data, which can degrade the uniformity below the target. In addition, very small mismatches can prevent power-up data from being repeated, deteriorating the reliability. This paper presents a post-fabrication technique that can improve the uniformity and the reliability of SRAM PUFs by utilizing device aging phenomenon through two functional steps. In the first step, the proposed technique controls the polarity of the device aging in each SRAM cell using the power-up value for uniformity improvement. Once a target uniformity is achieved from an SRAM array, we inject device aging into each SRAM cell in a way of increasing the mismatches between two cross-coupled inverters. An SRAM PUF test chip fabricated in 65 nm CMOS technology validated the effectiveness of device aging in enhancing the uniformity and the reliability of the SRAM PUF.
1. Introduction Digital systems such as mobile phones, appliances, and security systems are becoming ubiquitous in everyday life. These devices handle personalized data and private information that must be protected from any unauthenticated access. In addition, semiconductor vendors outsource IPs to other System-on-Chip (SoC) vendors to reduce the productcycle time, which creates critical design security issues and eventually leads to tremendous loss of revenue [1]. Therefore, robust security mechanisms without significant overheads in power and silicon area are required to provide secure computing under any operating conditions. Conventional security systems (e.g. RFID tags, smart cards) store binary encrypted keys in memory like electrically erasable programmable read-only memory (EEPROM) and static random access memory (SRAM) [2]. They need additional hardware for cryptographic operations, which increases the power and the circuit area. However, various advanced (invasive & non-invasive) tampering techniques have been introduced to steal the encrypted binary keys. They include micro-probing, laser cutting, glitch attacks, and power analysis. To prevent such physical attacks, researchers have developed various tamper sensing methods where any tempers on the designs are detected by multiple tamper sensors. The limitation of the tamper sensing is that the hardwired information can be easily stolen when the circuit is off [3].
To address the above issue, researchers have investigated various hardware-intrinsic characteristics that can improve hardware security [4, 5]. Physical Unclonable Functions (PUFs) are considered as promising hardware security solutions since they can generate unique binary keys without memories and cryptographic operations. Gassend et al. utilized the concept of random variations in silicon to realize PUFs (classified as weak PUFs) [4]. Here, random variations during manufacturing PUFs produce fingerprints of physical objects. Even if the same designs are fabricated, we cannot obtain identical chips. Therefore, the binary keys generated by the random variations are extremely difficult to be duplicated by hardware. In addition, the amount of random variations in silicon increases as the semiconductor technology scales. This is desirable for PUFs implementation since it further decreases the possibility of manufacturing identical chips. Fig. 1 explains a sample application of PUF where activation codes and keys are generated by the PUF. Since the output of the PUF is random and untraceable, the activation codes and the keys can be protected. Various types of PUFs have been introduced such as optical PUF, delay-based PUF, butterfly PUF, and SRAM PUF. In Refs. [6–8], SRAM PUF demonstrated better stability and reliability when compared to other PUF types. SRAM PUF uses variations in the power-up patterns to generate identifiers with low overhead. In addition, temperature variations in SRAM PUF are common to all SRAM cells, thus their impacts on
* Corresponding author. E-mail address: [email protected] (T.T.-H. Kim). https://doi.org/10.1016/j.mejo.2019.05.013 Received 23 October 2018; Received in revised form 9 April 2019; Accepted 16 May 2019 Available online 20 May 2019 0026-2692/© 2019 Elsevier Ltd. All rights reserved.
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
algorithm for producing stable bits [16]. Since the generated bits are stable, it can minimize the circuit overhead for error correction. However, this technique only excludes partially skewed cells and neutral-skewed cells, which requires relatively large process variations to secure enough stable cells. In Ref. [17], the authors investigated the effects of data-dependent silicon aging on the reliability of SRAM PUF. The study explained that the reliability of the SRAM PUF could be improved in some scenarios because of anti-aging effects. However, it is difficult to identify the scenarios and use them in actual security systems. Neale et al., analyzed the sensitivity of static noise margin (SNM) to SRAM cell design parameters [18]. It was observed that the cell size heavily affects the difference (ΔSNM) between two SNM values (SNMs for data ‘1’ and ‘0’). Even though logic-rule-based SRAM PUF showed better reliability, it is not practical to intentionally increase the SRAM cell size in many applications due to the significantly increased area overhead. In Ref. [19], the authors proposed an attacking method on an SRAM PUF to analyze how the device wearout causes substantial changes in the power-up patterns of an SRAM PUF. By using higher supply voltage and higher temperature for wearout acceleration, it was presented that only 15% of the SRAM cells stored uniform values after three days of the wearout acceleration. This makes the SRAM PUF unusable and leads to security system failures. Jeloka et al., developed an SRAM PUF in 28 nm CMOS technology with a sequence dependent behaviour [20]. Here, the authors increased the challenge-response space by initializing two cells with complementary data through states fighting. This method increases the number of row selection choices from ‘n’ to ‘~n2’ when ‘n’ is the number of rows. The enhanced challenge-response space make it more difficult for a machine to learn. The tested attacks with the sequence length of 5 improved the resistance of a 64-bit arbiter more than 30 times. To solve the noisy data issue from random bits of SRAM PUF, Bosch et al. proposed the Helper Data Algorithm (HDA) key extractor [21]. This work is focused mainly on the implementation of fuzzy extractors on FPGA without considering the hardware overhead. Krishna et al., proposed a PUF utilizing different word line (WL) pulse widths for generating unique signatures from an SRAM array [22]. The combination of WL pulse width and the SRAM array increases the challenge-response space. However, the reliability of the WL pulse width control and the area overhead can limit the effectiveness of this technique. Holocomb et al., introduced the concept of DRV-Fingerprinting, i.e. generating silicon fingerprints at Data Retention Voltage [23]. This increased the number of reliable SRAM cells by 28% compared to the normal power-up. However, characterizing DRV is not trivial and requires a large amount of time. An SRAM reliability technique utilizing device aging was introduced in Ref. [24], which is similar to the proposed work. However, it does not discuss other aspects such as uniformity, hardware implementation, and how to merge uniformity improvement and reliability improvement. Even though various SRAM PUF design techniques have been developed above, the uniformity and the reliability of SRAM PUF are still relying on the natural process variations that are uncontrollable. Therefore, modern PUFs need to employ error correction techniques to make the PUFs more reliable at the cost of additional hardware. In this work, we will address the above issues through device aging injection through the proposed methodology. This paper is an extended version of the conference version [25].
Fig. 1. Activation code and key generation using PUF.
the SRAM power-up patterns are insignificant [9]. In an ideal SRAM cell, two cross-coupled inverters are symmetrical and should be in the meta-stable state during power-up. However, it is impossible to manufacture perfectly symmetrical cross-coupled inverters due to the device mismatches coming from the manufacturing variations. Any inherent local mismatches in the cross-coupled inverters will be amplified through the positive feedback until strong logic ‘1’ or logic ‘0’ is generated. Since no biased design is employed, each SRAM cell will produce logic ‘1’ and logic ‘0’ randomly with the probability of 0.5. The random power-up patterns prevent unique binary keys from being revealed during operation. However, if random process variations occur, the logic value of each SRAM cell can be random or the number of logic ‘1’ or ‘0’ can be biased after power-up. If device mismatches coming from random process variations are insignificant, the power-up data patterns measured from an SRAM PUF can vary largely. The SRAM cells whose power-up data changes under various environmental noises during power-up deteriorate the reliability of the SRAM PUF. In addition, biased power-up data patterns from an SRAM PUF degrade the uniformity, which can reveal keys with a relatively smaller number of attacks. This degrades the reliability of the SRAM PUF. In this work, we propose a post-fabrication technique for improving the uniformity and the reliability of SRAM PUF simultaneously. The above goals are achieved by using the effects of device aging phenomenon like negative-bias-temperature-instability (NBTI) on transistors [10, 11]. The proposed technique injects device aging SRAM PUFs through two process steps, one for uniformity improvement and the other for reliability improvement. In the uniformity improvement step, the injected device aging will balance the number of ‘1's and that of ‘0's in the SRAM PUF. In the subsequent reliability improvement step, the device aging will be injected in a way of expanding the mismatches in the SRAM PUF. To validate the proposed technique, an SRAM PUF test chip was fabricated in 65 nm CMOS technology. Measured results demonstrated that the uniformity and the reliability of the SRAM PUF are improved by injecting device aging through the proposed methodology. The remainder of this paper is organized as follows. Section 2 discusses various state-of-the-art works on SRAM PUFs. In Section 3, we will explain the proposed post-fabrication techniques for improving the uniformity and the reliability of SRAM PUFs. Section 4 will presents test chip implementation and several measurement results, which is followed by conclusions in Section 5.
3. Proposed SRAM PUF design methodology 2. Relevant works on SRAM PUFs In ideal SRAMs, the number of ‘1's is equal to that of ‘0’. In addition, an SRAM randomly generates a power-up data pattern because of random process variations. The generated power-up pattern recurs whenever the SRAM is powered up. However, the randomness in the SRAM fabrication process make the aforementioned features difficult to achieve at the same time. This work proposes a post-fabrication methodology for improving the uniformity (distribution of 1's & 0's in the power-up patterns) and the reliability (generation of the same power-up pattern regardless of environmental variations) of SRAM PUFs. The proposed methodology injects
In recent years, SRAM PUFs have attracted more interests because of their superiority in stability and reliability compared to other types of PUFs. Several SRAM PUF designs demonstrated that an SRAM array generated random power-up values due to threshold voltage mismatches [12,13]. They showed that the fabricated SRAM cells produced a roughly normal distribution and more than 90% of the cells were stable. Other works verified that the SRAM power-up data patterns can be used as unique fingerprints [14,15]. Xiao et al., presented a bit selection 30
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
total aging is the additive combination of NBTI and PBTI. In this work, only NBTI will be considered since the designed SRAM PUF is implemented in 65 nm CMOS technology. The proposed methodology is also applicable to high-k/metal-gate process technology without any changes. 3.2. Uniformity improvement In SRAM PUF, uniformity represents the generated distribution of data 1's and 0's. The ideal uniformity of SRAM PUF is 50%, which indicates that 50% of the data is ‘1’ and the rest is data ‘0’. This ensures a strong security key since it is the most difficult condition to be replicated by other PUF chips. However, actual uniformity of SRAM PUF can vary due to many random parameters such as random dopant fluctuation, environmental noises during power-up, etc. Poor uniformity decreases the number of SRAM PUF cells to be replicated, which makes it vulnerable to hacking. Any systematic variations will impact the uniformity. Fig. 3 illustrates the concept of the proposed uniformity improvement technique. In general, mismatches in an SRAM tend to generate normal distribution, coming from random variations as shown in Fig. 3(b). This provides good uniformity. However, when SRAM PUF has systematic variations, the distribution of 1's and 0's can deviate from the normal distribution. In Fig. 3(a), the power-up data pattern will include a substantially increased number of ‘0's. Since the strong ‘0’ cells will generate mostly data ‘0’ after power-up, the number of SRAM cells that can be used for security key generation will decrease largely. To avoid this, we need a technique that can maintain the uniformity of SRAM PUF close to 50%. This work achieves this by injecting aging (NBTI) through a control flow. Fig. 4 shows two cross-coupled inverters in a typical SRAM cell. The mismatches in the inverters formed by P1, N1, P2, and N2 will determine the initial power-up value of the SRAM cell. In general, we expect an SRAM cell has the power-up data of ‘1’ and ‘0’ with the same probability under random process variations. However, the probability can deviate from the desirable range due to uncontrollable random variations. This deteriorates the uniformity of the SRAM-PUF and can lead to easier guessing. To tackle this issue, this work utilizes post-fabrication NBTI injection to maintain the uniformity within a target range. Note that only one PMOS device (either P1 or P2) is affected by NBTI at a time depending on the stored value. Therefore, changing the stored value and the duration of NBTI in an SRAM cell can control the polarity and the amount of the mismatches in the cross-coupled inverters. If we assume P1 is weaker than P2 (i.e. jVtp1j > jVtp2j) as illustrated in Fig. 4(a), the eye opening of Q ¼ ‘0’ becomes larger than that of Q ¼ ‘1’. Therefore, it is more likely that Q will be ‘0’ after power-up without considering other non-ideal factors. If NBTI injection occurs in the same SRAM cell (using high voltage and high temperature), jVtp2j of P2 (Vgs ¼ -Vdd) will increase, and the mismatches between P1 and P2 will decrease. If the NBTI injection is large enough to make P2 weaker than P1, the power-up data will change from ‘0’ to ‘1’ as depicted in Fig. 4(b). This indicates that we can control the power-up data of an SRAM cell through the proper injection of NBTI. Fig. 5 shows the simulated results of the change (from Q ¼ ‘0’ to Q ¼ ‘1’) in the power-up data after the aforementioned NBTI injection. The proposed SRAM PUF utilizes the above principle for uniformity improvement. Assume that 70% of the total cells in SRAM PUF have the power-up data of ‘1’ while 30% of the cells have the power-up data of ‘0’. To improve uniformity, we inject NBTI stress to the SRAM PUF so that the mismatches in the cross-coupled inverters diminish. After applying the 1st round of the NBTI injection, the SRAM PUF will be powered off to stop NBTI injection. After that, the SRAM PUF will be powered on and generate a new power-up data pattern after the NBTI injection. The power-up data of some cells may change from data ‘1’ to data ‘0’, which reduces the difference between the number of 1's and that of 0's. The above NBTI injection steps are repeated until the uniformity is close to the target value (ideally 50%). Fig. 6 presents a sample simulated result demonstrating the effect of the proposed technique on the uniformity of
Fig. 2. 6 T SRAM cell for SRAM-PUF implementation.
Fig. 3. Concept of the proposed uniformity improvement technique: (a) without uniformity improvement and (b) with uniformity improvement. Note that X and Y axes represent the amount of mismatch and the cell count, respectively.
an aging mechanism called negative-bias-temperature-instability (NBTI) in PMOS devices through two different steps, one for uniformity improvement and the other for reliability improvement. This section will explain the proposed methodology in detail. 3.1. Negative bias temperature instability NBTI is a primary aging mechanism gradually degrading the PMOS device performance in advanced CMOS technology. NBTI occurs when a PMOS device undergoes negative bias (i.e. Vgs ¼ Vdd) on the gate. This condition generates hole trapping at the gate dielectric interface or into the gate dielectric. To compensate for this, the gate needs more negative bias. Using larger negative bias voltage and higher temperature accelerates NBTI. The main impact of NBTI is the increase of the device threshold voltage. When the negative bias is removed, the increased threshold voltage is partially recovered. This work utilizes this partially recovered NBTI in the proposed uniformity and reliability improvement. Positive-bias-temperature-instability (PBTI) is a similar aging mechanism occurring in NMOS devices. PBTI is prominent in the high-k/metal-gate process technology. Fig. 2 illustrate the conventional 6 T SRAM cell storing ‘1’ at ‘Q’. Note that P1 is under NBTI while N2 is under PBTI. The 31
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
Fig. 4. Cell Flip in power-up due to aging (NBTI) injection. jVtP1j and jVtP2 j represents the threshold voltage of P1 and P2 respectively before ageing. Also, jV'tP1j and jV'tP2j represents threshold voltage of P1 and P2 after aging.
Fig. 5. (a) Initial power-up behaviour of SRAM cell (b) flipped cell after aging injection.
It is possible that the proposed uniformity improvement technique cannot achieve the uniformity of ~50% when the systematic process variations are larger than the threshold voltage range that can be controlled by the NBTI injection. However, the proposed technique will always improve the uniformity compared to the initial uniformity obtained right after the fabrication, which is not the case in other state-ofthe-art works that simply reply on natural process variations.
SRAM PUF. Monte-Carlo simulation with 10 k points was conducted for checking the power-up patterns. SRAM PUF with a skewed initial powerup data pattern was designed and simulated. Initially, the number of SRAM cells with the power-up data ‘1’ is 7255 out of 10 k. As the amount of the NBTI injection increases, the number of 1's decreases while that of 0's increases. The NBTI injection is applied until the difference between the number of ‘1's and that of ‘0's lies within the acceptable range. The simulation result in Fig. 6 shows that the NBTI injection of 46 mV achieves the uniformity of 50.43% (or 49.57%).
32
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
propose reliability improvement methodology also utilizes NBTI injection. Fig. 7 explains the concept of the proposed reliability improvement methodology. Fig. 7(a) shows a normal distribution of data 1's and data 0's with good uniformity, which can be obtained by the proposed improvement methodology. However, the reliability of the distribution in Fig. 7(a) is poor due to many symmetric cells. The mismatches between the cross-coupled inverters need to be large so that multiple power-up operations can generate same data patterns with very low error rates (Fig. 7(b)). Note that the number of symmetric cells is substantially small in Fig. 7(b). Therefore, the power-up data pattern will not vary significantly. However, the distributions in Fig. 7(b) cannot occur naturally through the SRAM PUF fabrication process, which requires a postfabrication technique for transforming the distribution in Fig. 7(a) into that in Fig. 7(b). Fig. 8 illustrates the effect of the proposed reliability improvement method on the mismatch of the cross-coupled inverters. If jVtp1j is similar to jVtp2j, the power-up data will be random, which is not desirable for good PUF reliability. NBTI injection to a relatively weaker device will enhance the mismatch, and will achieve better reliability. For example, if P2 is slightly weaker than P1, NBTI injection should be applied to P2 so that P2 becomes much weaker than P1 as shown in Fig. 8(bottom left). Similarly, if P1 is marginally weaker than P2 during power-up, P1 will undergo NBTI injection as shown in Fig. 8(bottom right). This requires cell data flipping before applying NBTI. Note that if NBTI injection is applied right after power-up, a stronger device is under NBTI injection and the mismatch decreases initially. To achieve the above requirements, this work proposes a reliability improvement methodology that can save the processing time and the hardware requirements. The proposed methodology follows the next steps. First, the initial power-up data pattern is flipped before injecting NBTI. Flip-flops can execute the flipping operation. We read the initial power-up data row by row and store them in the flip-flops. In the next cycle, the complements of the stored data are written back to the same row. This operation will end after flipping all the data stored in the SRAM PUF. After the flipping, we inject NBTI by raising supply voltage to a higher level (2 V in this work) for mismatch enhancement. This makes weaker devices undergo NBTI, and the mismatches will be larger. After each NBTI injection into the SRAM PUF, the power-up pattern is read multiple times for reliability checking. The number of checking can vary depending upon the target reliability. In general, higher reliability requires a larger number of power-up data checking. The above steps recur until the target reliability is achieved. Fig. 9 shows a MonteCarlo simulation result of the proposed reliability enhancement technique using 10 k points. After the initial power-up, the numbers of data 0's and 1's are 4624 and 5376, respectively. The random process variations create the difference in the number of 0's and 1's. As the NBTI injection increases the mismatch in the cross-coupled inverters by weakening P2 in Fig. 8, the probability of power-up data ‘1’ increases as shown in Fig. 9. The NBTI injection can affect the power-up data significantly at the earlier stage since the initial mismatch is small enough to generate almost random power-up data. Once the NBTI injection increases the mismatch large enough, it is very unlikely that environmental noises during power-up affect the power-up data. Fig. 10 shows the sensitivity of power-up data to supply voltage and temperature changes with and without the proposed NBTI injection. Without NBTI injection, the probability of data ‘1’ is around 0.5. It is slightly affected by the supply voltage and the temperature. As the amount of the injected NBTI increases, the probability of data ‘1’ decreases as expected. In addition, no significant sensitivity to supply voltage and temperature variations is observed.
Fig. 6. Uniformity improvement due to NBTI.
Fig. 7. Concept of the proposed reliability improvement technique: (a) without reliability improvement and (b) with reliability improvement. Note that X and Y axes represent the amount of mismatch and the cell count, respectively.
3.3. Reliability improvement After achieving the target uniformity, the reliability of SRAM PUF is investigated for improved security. The reliability of SRAM PUF represents the capability whether the SRAM PUF can repeatedly generate a same power-up data pattern among repeated power-up sequences. However, as explained in the previous section, a power-up data pattern of SRAM PUF relies on the mismatches in the cross-coupled inverters. If the mismatch in an SRAM cell is small, the power-up value of the cell will be highly sensitive to various environmental noises, and be random. This is desirable in achieving good uniformity and randomness in the SRAM PUF. However, the small mismatches will deteriorate the reliability of the SRAM PUF since the power-up patterns does not recur. The proposed uniformity improvement technique reduces the mismatches of the crosscoupled inverters in the SRAM PUF, which worsens the reliability. Therefore, in addition to the uniformity improvement technique, we also need to investigate reliability improvement. Like the proposed uniformity improvement methodology, the
3.4. Merged uniformity and reliability improvement flow This section will explain how to merge the proposed uniformity improvement technique with the proposed reliability improvement technique for SRAM PUF. Fig. 11 depicts the overall flow of the proposed methodology. It consists of two flows, one for uniformity improvement 33
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
Fig. 8. Utilization of NBTI for mismatch enhancement. The small initial mismatch will be expanded by injecting NBTI in either P1 or P2.
meets the target uniformity, the proposed uniformity improvement steps will be skipped. Note that skewed SRAM PUFs will require a larger number of stress cycles to overcome the initial mismatches and flip the cell data through NBTI injection. After achieving the target uniformity, the reliability improvement flow starts by generating power-up data patterns and estimating them multiple times (N times in Fig. 11). If the estimated variation is larger than the target, it is necessary to improve the reliability by expanding the mismatches in the cross-coupled inverters. It starts by flipping the data in the SRAM PUF row by row followed by NBTI injection. After the NBTI injection, we estimate the reliability through multiple power-ups and counting the number of 1's. The above steps are repeated until the variation in the power-up data patterns is within the target range. The flow in Fig. 11 can be executed using higher temperature and higher supply voltage for aging acceleration. In addition, it can be applied to high-k/metal-gate process technology where PBTI is also prominent. The combination of NBTI and PBTI will increase the overall amount of injected aging that can be controlled by the proposed flows. This will allow us to further improve the uniformity and reliability without any change in the proposed flows. Fig. 12 depicts how the proposed methodology improves the uniformity and the reliability of SRAM PUF through the NBTI injection. We assume that the initial power-up data pattern is biased to data ‘1’ (dark color) as depicted in Fig. 12(i). After injecting NBTI without data flipping, the updated data pattern becomes less biased (Fig. 12(ii)). Since the number of data 1's in Fig. 12(ii) is still larger than that of data 0's, additional NBTI is injected until the number of 1's is similar to that of 0's (Fig. 12(iii)). Note that the contrast in Fig. 12(iii) is small, indicating poor reliability. The proposed reliability improvement methodology augments the contrast of the data pattern as illustrated in Fig. 12(iii) and achieves Fig. 12(iv). Note that no SRAM cell or only a small number of SRAM cells will have different power-up data after the proposed reliability improvement.
Fig. 9. Reliability improvement due to NBTI.
and the other for reliability improvement. First, the proposed uniformity flow starts by powering up SRAM PUF. After that, the numbers of data 1's and that of 0's are counted for checking the uniformity. If the distribution of data 1's and 0's is not within the target range, NBTI will be injected into the SRAM array by raising the supply voltage for acceleration. In this work, we utilized 2 V as the stress voltage. Higher temperature can be also employed for further NBTI acceleration. After the NBTI injection step, the power-up data pattern of the SRAM PUF using nominal supply voltage (i.e. 1.2 V in this work) will be generated again, followed by the uniformity checking. The target uniformity can be achieved after repeating the above steps multiple times. If the very first power-up data 34
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
Fig. 10. Sensitivity of power-up data on supply voltage and temperature after NBTI injection: (a) without NBTI injection, (b) NBTI injection of 10 mV, (c) NBTI injection of 25 mV, and (d) NBTI injection of 50 mV. The above figures show the probability of data ‘1’.
Fig. 11. Proposed methodology for robust SRAM-PUF. ‘N’ ¼ 10 in this work.
4. Test chip implementation and measurement results
and inverters for the proposed uniformity and reliability improvement technique. The SRAM PUF has two main data paths, one for uniformity and reliability checking and the other for data control for reliability improvement. The uniformity and reliability checking is conducted through a read operation. While the reliability improvement path includes write operation after flipping. During testing, the uniformity and
The architecture of the proposed SRAM PUF is illustrated in Fig. 13. It consists of basic SRAM functional blocks such as an SRAM array, an address decoder, sense amplifiers, write drivers, multiplexers, and a memory controller, and additional blocks such as a counter, flip-flops, 35
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
Fig. 12. Uniformity and Reliability improvement methodology on SRAM-PUF.
array data, NBTI aging needs to be injected in the direction of increasing the mismatches in each SRAM cell. This can be achieved by flipping the stored data before injecting NBTI. Flipping the data of the SRAM PUF is conducted through the flip-flops and the inverters. The read data are stored in the flip-flops during read operation. The stored data are written back to the SRAM array after flipping in the subsequent cycle. Once the array data are flipped, NBTI is injected by raising the supply voltage. The power-up data are read multiple times for checking the reliability. The above reliability improvement steps are repeated until the power-up data after the NBTI injection meet the target reliability. Note that the injected NBTI will be partially recovered during the testing. Fig. 14 shows sample data patterns measured over repeated NBTI stress following the proposed uniformity improvement flow. The number of SRAM cells producing the power-up data of ‘1’ was 13 out of 16 at the beginning. It becomes 9 after applying NBTI stress (stress voltage ¼ 2 V) three times. As expected, SRAM cells with large mismatches (Strong ‘1's and Strong ‘0's) do not change the power-up data throughout the uniformity improvement flow. Only the power-up data of the balanced SRAM cells fluctuate during the uniformity improvement flow. We also measured the change of the power-up pattern in a 16-kb test chip while applying the proposed uniformity improvement technique (Fig. 15). To clearly observe the benefit of the proposed technique, a test chip with a relatively biased initial power-up pattern is selected for testing. It is obvious that the proposed technique improves the uniformity by decreasing the number of data ‘0's and increasing that of data ‘1’. The numbers of ‘1's and ‘0's can fluctuate since the uniformity improvement technique reduces the mismatches in the SRAM cells. Therefore, the power-up data of a larger number of SRAM cells will be affected by various noise components during power-up as indicated by the dotted box in Fig. 15. Fig. 16 summarizes the proposed uniformity improvement technique measured from multiple test chips. Note that the number of ‘1’ moves toward the ideal bit count after applying the proposed uniformity improvement technique. However, it is observed that the uniformity of one chip (Chip ID ¼ 1) is still relatively poor due to the large initial mismatches in the SRAM array. The large initial mismatches limit the number of SRAM cells whose power-up data can be changed through NBTI injection. Once the number of data ‘0's becomes similar to that of data ‘1's within the target range, we can stop the uniformity improvement flow
Fig. 13. Circuit implementation of the proposed SRAM PUF.
reliability checking paths are activated. The counter calculates the number of 1's in the SRAM array after power-up. After reading all the array data, the counter output is read to determine whether the target uniformity is satisfied. If not, NBTI is injected into the SRAM array by raising the supply voltage for a pre-defined time. The uniformity is checked again through read and count operation. These steps are repeated until the measured uniformity lies in the target range. Once the uniformity improvement is over, the proposed reliability improvement starts by reading the array data after power-up multiple times (e.g. 10 times in this work). If each reading after power-up produces different 36
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
Fig. 14. Sample measured data patterns from a small part of the implemented array over the proposed uniformity improvement.
Fig. 17. Measured result of the fluctuations in the power-up pattern. This result shows that reliability improvement is required. The bit counts are measured 10 times in each measurement point to obtain the maximum and the minimum values.
Fig. 15. Measured result of the proposed uniformity improvement over NBTI stress.
Fig. 16. Measured uniformity improvement from multiple test chips. The graph depicts the change in the number of ‘1's. Fig. 18. Measured result of the proposed reliability improvement over NBTI stress.
and start the proposed reliability improvement technique. This is necessary to minimize the fluctuations in the power-up patterns after the proposed uniformity improvement technique. The measurement results in Fig. 17 depicts the fluctuations of the power-up patterns after the uniformity improvement flow. It can be observed that as the uniformity
improves, the fluctuations become larger, which deteriorates the reliability below the target value. Therefore, the proposed reliability 37
A. Garg et al.
Microelectronics Journal 90 (2019) 29–38
Acknowledgement The authors would like to thank GLOBALFOUNDRIES Singapore for test chip fabrication.
16-kb SRAM PUF
References [1] J. Guajardo, S.S. Kumar, G.-J. Schrijen, P. Tuyls, Brand and IP protection with physical unclonable functions, IEEE Int. Symp. Circ. Syst. (2008) 3186–3189. [2] P. Schaumont, D.D. Hwang, Turning liabilities into assets: exploiting deep submicron CMOS technology to design secure embedded circuits, IEEE Int. Symp. Circ. Syst. (2008) 3178–3182. [3] D. Lim, J.W. Lee, B. Gassend, G.E. Suh, M. van Dijk, S. Devadas, Extracting secret keys from integrated circuits, IEEE Trans. Very Large Scale Integr. Syst. 13 (Oct. 2005) 1200–1205. [4] S. Devadas and B. Gassend, "Integrated Circuit that Uses a Dynamic Characteristic of the Circuit." U.S. Patent, No. 7,757,083. 13 Jul. 2010. [5] R.S. Pappu, Physical One-Way Functions, Ph.D. thesis, Massachusetts Institute of Technology, 2001. [6] R. Maes, P. Tuyls, I. Verbauwhede, A soft decision helper data algorithm for SRAM PUFs, IEEE Int. Symp. Inf. Theor. (2009) 2101–2105. [7] M. Hofer, C. Boehm, An alternative to error correction for sram-like pufs, in: Int. Workshop on Cryptographic Hardware and Embedded Systems, 2010, pp. 335–350. [8] G. Selimis, M. Konijenburg, M. Ashouei, J. Huisken, H. de Groot, V. van der Leest, G.-J. Schrijen, M. van Hulst, P. Tuyls, Evaluation of 90nm 6T-SRAM as Physical Unclonable Function for secure key generation in wireless sensor nodes, IEEE Int. Symp. Circ. Syst. (2011) 567–570. [9] D.E. Holcomb, W.P. Burleson, K. Fu, Power-up SRAM state as an identifying fingerprint and source of true random numbers, IEEE Trans. Comput. 58 (Sept. 2009) 1198–1210. [10] L. Wang, Q. Ye, R. Wong, M. Liehr, Product burn-in stress impacts on SRAM array performance, in: IEEE Int. Reliability Physics Symp., 2007, pp. 666–667. [11] S.V. Kumar, C.H. Kim, S.S. Sapatnekar, An analytical model for negative bias temperature instability, in: IEEE/ACM Int. Conf. on Computer-Aided Design, 2006, pp. 493–496. [12] P. Layman, S. Chaudhry, J. Norman, and J. Thomson, "Electronic Fingerprinting of Semiconductor Integrated Circuits," U.S. Patent, 6 738 294, Sep. 2002. [13] Y. Su, J. Holleman, B. Otis, A 1.6 pJ/bit 96 (percent) stable chip ID generating circuit using process variations, in: IEEE Int. Solid-State Circuits Conf., 2007, pp. 200–201. [14] D. Holcomb, W. Burleson, K. Fu, Initial SRAM state as a fingerprint and source of true random numbers for RFID tags, in: Conf. on RFID Security, 2007, pp. 11–13. [15] D. Holcomb, W. Burleson, K. Fu, Power-up SRAM state as an identifying fingerprint and source of true random numbers, IEEE Trans. Comput. 58 (Sep. 2009) 1198–1210. [16] K. Xiao, M.T. Rahman, D. Forte, Y. Huang, M. Su, Bit selection algorithm suitable for high-volume production of SRAM-PUF, in: IEEE Int. Symp. on Hardware-Oriented Security and Trust, 2014, pp. 101–106. [17] R. Maes, V. Leest, Countering the effects of silicon aging on SRAM PUFs, in: IEEE Int. Symp. on Hardware-Oriented Security and Trust, 2014, pp. 148–153. [18] A. Neale, M. Sachdev, A low energy SRAM-based physically unclonable function primitive in 28 nm CMOS, IEEE Custom Integrated Circuits Conf., 2015, pp. 1–4. [19] A. Roelke, M.R. Stan, Attacking an SRAM-based PUF through wearout, in: IEEE Computer Society Annual Symp. on VLSI, 2016, pp. 206–211. [20] S. Jeloca, K. Yang, M. Orshansky, D. Sylvester, D. Blaauw, A sequence dependent challenge-response PUF using 28nm SRAM 6T bit cell, in: Symp. on VLSI Circuits, 2017, pp. C270–C271. [21] C. B€ osch, J. Guajardo, A.-R. Sadeghi, J. Shokrollahi, P. Tuyls, Efficient helper data key extractor on FPGAs, in: Int. Workshop on Cryptographic Hardware and Embedded Systems, 2008, pp. 181–197. [22] A.R. Krishna, S. Narasimhan, X. Wang, S. Bhunia, MECCA: a robust low-overhead PUF using embedded memory array, in: Int. Workshop on Cryptographic Hardware and Embedded Systems, 2011, pp. 407–420. [23] D.E. Holcomb, A. Rahmati, M. Salajegheh, W.P. Burleson, K. Fu, DRVFingerprinting: using data retention voltage of SRAM cells for chip identification, in: Int. Workshop on Radio Frequency Identification: Security and Privacy Issues, 2012, pp. 165–179. [24] M. Bhargava, C. Cakir, K. Mai, Reliability enhancement of Bi-stable PUFs in 65nm bulk CMOS, in: IEEE Int. Symp. on Hardware-Oriented Security and Trust, 2012, pp. 25–30. [25] A. Garg, T. Kim, Design of SRAM PUF with improved uniformity and reliability utilizing device aging effect, in: IEEE Int. Symp. on Circuits and Systems, June 2014, pp. 1941–1944.
Fig. 19. Test chip microphotography.
improvement technique needs to be executed after the uniformity improvement. Fig. 18 demonstrates the reliability improvement of the proposed technique. The number of cells whose power-up data change over repeated power-up operations decreases over stress time, which indicates reliability improvement. This comes from enlarged mismatches in the SRAM cells. Therefore, longer stress time can be applied for better reliability. Note that Chip ‘A’ shows higher BER at the beginning (i.e. after uniformity improvement) because of the relatively smaller mismatches in the SRAM cells. Therefore, the power-up data of more cells changes over repeated power-up sequences. In actual PUF design, the amount of aging in the reliability improvement flow needs to be carefully determined particularly when an SRAM is used as both PUF and a normal memory. If the SRAM stores data leading to NBTI effects in the opposite direction for such a long time, the mismatches in the SRAM cells can diminish. This can increase errors in the PUF, which requires stronger aging injection during the reliability improvement flow. Fig. 19 shows the test chip die photo implemented in 65 nm CMOS technology. It occupies the area of 335 428 μm2. 5. Conclusion SRAM PUFs are commonly used for generating chip identifications (IDs) by using random fluctuations during the fabrication process. Good SRAM PUFs require high degrees of uniformity and reliability. Poor uniformity reduces the number of SRAM cells that can be used for ID generation. This makes the SRAM PUF vulnerable to attacks. Similarly, poor reliability leads to significant fluctuations in the generated ID, which makes it difficult to be used as a valid ID. To address these issues, this work proposes a post-fabrication technique for uniformity and reliability improvements by utilizing device aging. The proposed technique consists of two flows, one for uniformity improvement and the other for reliability improvement. The proposed uniformity improvement flow utilizes the device aging to reduce the mismatches of SRAM cells. However, the proposed reliability improvement flow increases the device mismatches by also using the device aging. This can be achieved by flipping the data stored in the SRAM PUF at the end of the uniformity improvement flow. Test chip measurement results demonstrated that the proposed technique can improve both uniformity and reliability at the same time. The proposed technique can be applied to general SRAM PUFs fabricated in advanced CMOS technology where device aging is prominent.
38