![Page 1: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/1.jpg)
September 11th, 2007
FPGA Intrinsic PUFs and Their Use in IP Protection
Jorge Guajardo*,Sandeep S. Kumar*, Geert-Jan Schrijen**, and Pim Tuyls**
* Philips Research Europe, Eindhoven, The Netherlands** Business Line Intrinsic-ID, Philips Research, Eindhoven, The Netherlands
![Page 2: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/2.jpg)
September 11th, 2007 2CHES 2007
Contents
Relevance
FPGAs
Intrinsic PUFs
Protocols for IP Protection
Conclusions
![Page 3: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/3.jpg)
September 11th, 2007 3CHES 2007
Intellectual Property Theft
• Annual value of trade in fake goods: $400 Billion– Spare parts– Clothing– Perfumes– Medicines– Audio & video– Software • IC designs
• Electronic circuitry• Configuration data of
programmable devices
– Electronic Designs
10% of all High Tech Products sold are Counterfeit!
![Page 4: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/4.jpg)
September 11th, 2007 4CHES 2007
Is this relevant in the real world?
![Page 5: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/5.jpg)
September 11th, 2007 5CHES 2007
Contents
Relevance
FPGAs
Intrinsic PUFs
Protocols for IP Protection
Conclusions
![Page 6: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/6.jpg)
September 11th, 2007 6CHES 2007
SRAM based FPGA: configuration
Configuration
Controller
FPGA 1
IP
BLOCK
Configuration
EEPROM
IP
BLOCK
COPY
![Page 7: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/7.jpg)
September 11th, 2007 7CHES 2007
Available Solutions
Option 1• Encrypted IP configuration file• External battery to store Key
Option 2
• Use flash based FPGA
• Cannot be updated in the field
Option 3• Use a PUF• Need two components:
– Randomness source– Fuzzy extractor
![Page 8: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/8.jpg)
September 11th, 2007 8CHES 2007
Contents
Relevance
FPGAs
Intrinsic PUFs
Protocols for IP Protection
Conclusions
![Page 9: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/9.jpg)
September 11th, 2007 9CHES 2007
Physical Unclonable Function
� PUF = Physical Unclonable Function: Derive strings from a complex physical system that is inherently unclonable
– Easy to evaluate (by probing the physical system)– Inherently tamper resistant– Manufacturer not-reproducible – PUFs can be used as a source of a large amount of unclonable
secret key material
� Unclonable– Hard to make a physical clone– Hard to make a mathematical model that simulates the behavior of
the physical structure
� Practicality Requirements– Easy to challenge the source– Cheap and easy integrable on an IC– Excellent mechanical and chemical properties
![Page 10: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/10.jpg)
September 11th, 2007 10CHES 2007
Modern FPGA Floorplan
M512
Block
M4K
Block
I/O
Channels
MRAM
Blocks
Digital Signal
Processing
(DSP) Blocks
Phase- Locked
Loops (PLL)
60,440 Equivalent Logic Elements
2,544,192 Memory Bits
Stratix II
EP2S60
![Page 11: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/11.jpg)
September 11th, 2007 11CHES 2007
Examples
IC with SRAM PUF
Combinatorial Circuit
Challengec-bits
Responsen-bits
IC with Delay PUF
M1M1M1M1M2M2M2M2
M3M3M3M3
M4M4M4M4M5M5M5M5
transistorstransistorstransistorstransistors
passivationpassivationpassivationpassivation
CoatingCoatingCoatingCoating----PUFPUFPUFPUF
On chip demo
IC with Coating PUF
Intrinsic Identifier
![Page 12: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/12.jpg)
September 11th, 2007 12CHES 2007
S-RAM PUFword word
bit not bit
1/2 1/2
![Page 13: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/13.jpg)
September 11th, 2007 13CHES 2007
Histogram of Inter-class and Intra-class differences
![Page 14: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/14.jpg)
September 11th, 2007 14CHES 2007
Properties
• Randomness
• Noise
0 5 10 15 20 25 300
0.02
0.04
0.06
0.08
0.1
0.12
Measurement Nr.E
rror
Fra
ctio
n
E rrors in M RA M s tartup values over tem perature
T= -20oCT= 0oC
T= 20oC T=40oC T= 60oC T=80oC| | | | | | |
Properties:• Entropy: 95%• Secrecy Rate: 76%
Fuzzy Extractor Needed:• Error Correction• Randomness Extraction
![Page 15: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/15.jpg)
September 11th, 2007 15CHES 2007
Contents
Relevance
FPGAs
Intrinsic PUFs
Protocols for IP Protection
Conclusions
![Page 16: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/16.jpg)
September 11th, 2007 16CHES 2007
How do we put everything together?Notation:
• TTP (Trusted Third Party), SYS (System Integrator), IPP (IP Provider), HWM (Hardware Manufacturer)
Assumptions:• Semantically secure encryption scheme
• Honest but curious model
• In the symmetric-key setting, possible constructions for encryption+authentication:• EncK1(M)||MACK2(M), MAC-then-Encrypt, Encrypt-then-MAC
• PUF and encryption modules assumed to be on the FPGA
• PUF responses are only available inside the FPGA
• Secure and authenticated channels SYS-TTP and TTP-IPP during enrollment and online phase
![Page 17: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/17.jpg)
September 11th, 2007 17CHES 2007
Protocol for IP Protection on FPGAs
HWM TTP IPP{{C1,R1}, … {Cn,Rn}}
Enrollment Phase
SW
Online Phase
SYS TTP IPPIDSW || IDHW
IDSW
D <- EncR1(SW||IDSW)
Offline Phase
C1||C2||D||MACR2(C1||C2||D)
![Page 18: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/18.jpg)
September 11th, 2007 18CHES 2007
PUF based Solution
• Intrinsic PUF
• Helper Data dependent on the specific FPGA chip
![Page 19: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/19.jpg)
September 11th, 2007 19CHES 2007
A Bit of History
• 2001 Pappu et al. - Physical Random Functions (Optical PUFs) MIT Ph.D. Thesis, and Science 2002
• 2002 Gassend et al., Su et al. – IC PUFs (Delay PUF)
CCS 2002, ACSAC 2002
• 2002 Kean, Encryption for IP Protection on FPGAs, FPGA 2002
• 2006 Simpson and Schaumont (Protocols for IP Protection based on the usage of PUFs) CHES 2006
• 2006 Tuyls et al. (Coating PUF), CHES 2006
• 2007 Guajardo et al. PK-based protocols for IP Protection based on intrinsic PUFs, FPL 2007
• 2007 This work
![Page 20: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/20.jpg)
September 11th, 2007 20CHES 2007
Contents
Relevance
FPGAs
Intrinsic PUFs
Protocols for IP Protection
Conclusions
![Page 21: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/21.jpg)
September 11th, 2007 21CHES 2007
Conclusions
• New PUF intrinsic to the FPGA with good statistical properties and robustness to environmental conditions.
• New protocol(s) for IP protection on FPGAs
• In the future, – Other Intrinsic PUFs– Complexity of fuzzy extractors– Limit the use of FPGA resources.– Reliability: Guaranteeing a low failure rate under all
kinds of circumstances.
![Page 22: FPGA Intrinsic PUFs and Their Use in IP Protection · Intellectual Property Theft • Annual value of trade in fake goods: $400 Billion – Spare parts – Clothing – Perfumes –](https://reader034.vdocuments.net/reader034/viewer/2022052004/60180dc80915dc5bfc1d752c/html5/thumbnails/22.jpg)