Project Presentation: Physical Unclonable Functions

1. Project Presentation: Physical Unclonable Functions Michelle Dickson

2. Outline • Project Goals • Resource Selection • PUF Architecture • Implementation • Results • Status & Future Work • Conclusion

3. Project Goals • Implement a Physical Unclonable Function • Determine feasibility of an authentication scheme based on the PUF’s unique key generation • Is such an implementation robust enough to withstand environmental variations?

4. Resource Selection • Hardware: Virtex-II Pro™ FF1152 Development Board • 2VP20 FPGA • QTY: 2

5. Resource Selection • Tools • Xilinx ISE Version 9.2i • Project Navigator • iMPACT • FPGA Editor • Constraints Editor • PACE • Modelsim XE III Version 6.2g

6. PUF Architecture • Common PUF Architectures • Arbiter PUF • Ring Oscillator PUF

7. PUF Architecture • Common PUF Architectures (continued) • Butterfly PUF

8. Selected PUF Architecture • Ring Oscillator PUF Implementation • Each RO is comprised of one NAND gate and 40 inverters • 16 ROs implemented on the FPGA • Compare the outputs of 2 ROs • If the result is greater than, output is 1 • If the result is less than or equal, output is 0 • Output is 8-bit signature • Motivation for selecting RO implementation • Fairly simple to implement • Does not require careful routing or layout • Differences in oscillator frequencies will dominate skews in routing • Extensive work published on RO implementations

9. Implementation • Ring Oscillator component implemented in schematic

10. Implementation • Inputs to Ring Oscillator • Feed input: tied to 1 • PUF enable input: enables the counter • Clear input: clears the counter to 0s • Output from Ring Oscillator • Output is 15 bit count value

11. Implementation • The rest of the circuit is implemented in VHDL • Instantiate 16 ROs • Compare the count of two ROs after a certain period of time to produce a bit • If A is greater than B, the bit value is 1 • Else, the bit value is 0 • Oscillation time varied from several thousand clock cycles to 40 seconds • The 8-bit output value is displayed on LEDs on the development board • To verify functionality of the rest of the circuit • Create a testbench with skewed clock inputs for the ROs • Run simulation in Modelsim • Verify that PUF bits accurately reflect the variation in oscillator frequencies

12. Implementation • After verifying the rest of the circuit through simulation, implement the PUF in actual hardware • Synthesize design • Implement • Generate programming file and configure device

13. Implementation • Obstacles • First, I had to set up the development environment and familiarize myself with the board and the tools • Search the internet for board documentation • Verify that I am able to program the FPGA and drive the outputs • Xilinx tool attempts to optimize the circuit and removes the useful components • The result is an empty logic design that cannot be mapped • Limited visibility of internal logic values makes troubleshooting difficult • Sometimes the circuit appeared to be functioning as desired, but in reality it was not • Every time a bit file is created and synthesized in hardware, the results vary • Another troubleshooting hurdle

14. Implementation • Solutions to some obstacles • To prevent the Xilinx tool from removing the circuit • Each net has to be assigned a “KEEP” attribute with a value of TRUE • Disable equivalent register removal • Disable optimization properties • Disable trim unconnected signals • *This allowed me to actually synthesize the design in hardware • To create more consistent results between implementations on the same device • Limit max fanout to 5 • Create area constraints for each Ring Oscillator • *This simplified my troubleshooting efforts

15. Implementation • Placed and routeddesign

16. Results • I tested my PUF implementation on two different development boards • Tests for the reference were completed at ambient temperature with nominal power inputs • Through troubleshooting, I found • Oscillators were indeed oscillating at different frequencies • To verify this, I simply changed the VHDL to check for count equality instead of inequality and verified that each comparison consistently produced a FALSE value • Varying the oscillation time before checking the PUF output did not seem to make a large difference • Whether I waited several thousand clock cycles or 40 seconds, the output seemed to have the same consistency • For this reason, I chose a shorter oscillation period such that the counter would not cycle back to 0x0000 and result in potentially inconsistent comparison results • Results were most consistent when the ring oscillator counter is always enabled and when the ring oscillator feed input is always tied to 1 • The alternative was to only activate these inputs during the oscillation time before checking for inequality

17. Results • Using the same bit file, each board produced a unique 8-bit output; however, they only differed by one bit • Board 1 produced the output 01001101 • Board 2 produced the output 01011101 • The results were not very consistent, even at ambient conditions • Out of 100 trials, Board 1 produced a different output 10 times • Two bits were not consistent • Bit 6 varied 3 times out of 100 • Bit 2 varied 7 times out of 100 • Out of 100 trials, Board 2 produced a different output 40 times • Two bits were not consistent • Bit 6 varied 2 times out of 100 • Bit 4 varied 39 times out of 100 • NOTE: On one trial, both bit 6 and bit 4 varied

18. Status & Future Work • Since I haven’t been able to obtain consistent results at ambient, I have not experimented with any environmental variations • To improve the consistency of the results, future work would include • Calculate the actual frequency produced by each oscillator • Select those oscillators with frequencies that are farther apart for comparison • Pro: Results will be more consistent and presumably less susceptible to environment variations • Con: This means that each time a PUF is implemented in hardware, it requires manual tweaking to ensure consistency

19. Status & Future Work • To improve the randomness of results across different hardware • Implement the Ring Oscillator as a hard macro • Don’t put area constraints on the place and route tool • Pro: This will make the output unique for each piece of hardware in which the PUF is implemented • Con: Can’t guarantee consistency • To improve practicality • Expand the circuit to generate a 128 bit key instead of an 8 bit key • Set up a challenge-response based authentication scheme and use board communication channel • Cascade two boards together to determine feasibility of a system-level signature

20. Conclusion • Although I haven’t been able to obtain consistent results to date, I can see that a Ring Oscillator PUF could be used to generate a unique hardware ID. However, implementation difficulty has been over-simplified by researchers. • From my project experience, I don’t believe consistent results can be obtained without manual intervention and significant testing • This results in added production costs • Environmental variations would only exacerbate the problem • Adding multiplexors to select which oscillators to compare would make a challenge-response authentication scheme possible • Again, manual intervention and testing would be required during production to ensure adequate results

21. Questions? • Please contact Michelle Dickson • michelle.k.dickson@lmco.com • mkdickso@iastate.edu