VLSI Design of Trusted Virtual Sensors

sensors Article VLSI Design of Trusted Virtual Sensors Macarena C. Martínez-Rodríguez * ID , Miguel A. Prada-Delgado ID , Piedad Brox ID and Iluminada Baturone ID Instituto de Microelectrónica de Sevilla IMSE-CNM, CSIC, Universidad de Sevilla, Américo Vespucio, 41092 Sevilla, Spain; [email protected] (M.A.P.-D.); [email protected] (P.B.); [email protected] (I.B.) *Correspondence: macar[email protected]; Tel.: +34-954-466-666 Received: 30 December 2017; Accepted: 22 January 2018; Published: 25 January 2018 Abstract: This work presents a Very Large Scale Integration (VLSI) design of trusted virtual sensors providing a minimum unitary cost and very good figures of size, speed and power consumption. The sensed variable is estimated by a virtual sensor based on a configurable and programmable PieceWise-Affine hyper-Rectangular (PWAR) model. An algorithm is presented to find the best values of the programmable parameters given a set of (empirical or simulated) input-output data. The VLSI design of the trusted virtual sensor uses the fast authenticated encryption algorithm, AEGIS, to ensure the integrity of the provided virtual measurement and to encrypt it, and a Physical Unclonable Function (PUF) based on a Static Random Access Memory (SRAM) to ensure the integrity of the sensor itself. Implementation results of a prototype designed in a 90-nm Complementary Metal Oxide Semiconductor (CMOS) technology show that the active silicon area of the trusted virtual sensor is 0.86 mm 2 and its power consumption when trusted sensing at 50 MHz is 7.12 mW. The maximum operation frequency is 85 MHz, which allows response times lower than 0.25 µ s. As application example, the designed prototype was programmed to estimate the yaw rate in a vehicle, obtaining root mean square errors lower than 1.1%. Experimental results of the employed PUF show the robustness of the trusted sensing against aging and variations of the operation conditions, namely, temperature and power supply voltage (final value as well as ramp-up time). Keywords: virtual sensors, CMOS integrated circuits; data security; hardware security; Physical Unclonable Function (PUF); piecewise linear approximation 1. State of the Art A virtual sensor estimates the value of a variable that is very difficult or costly to measure physically by modelling the relation between that variable and others that can be measured easily with low-cost commercial sensors. The use of virtual sensors has increased continuously since the early 1980s in a wide number of industrial applications, such as building monitoring [ 1 ], robotics [ 2 ], process control [ 3 , 4 ], or automotive engineering [ 5 ]. In the latter case, for example, virtual sensors are employed to monitor vehicle and driving status as well as road conditions and even communication between vehicles [ 5 – 7 ]. The model that relates input and output variables can be derived from fundamental physical laws using adjustable parameters, from empirical data of the input and output variables without any knowledge of the physical process (usually referred to as black-box models), or a combination of physical and empirical knowledge (a gray-box model). Neural networks and fuzzy logic techniques are used widely to obtain black- and gray-box models [ 6 , 7 ]. PieceWise-Affine (PWA) virtual sensors are also employed to provide black-box models [8–10]. Virtual sensors are usually implemented as software installed in the electronic control units [6–8]. However, faster responses, smaller sizes and lower power consumption are achieved if virtual sensors are implemented in hardware. Solutions that employ PWA Simplicial (PWAS) models implemented in Sensors 2018,18, 347; doi:10.3390/s18020347 www.mdpi.com/journal/sensors Sensors 2018,18, 347 2 of 18 Field Programmable Gate Arrays (FPGAs) were proposed in [ 9 , 10 ]. PWAS-based virtual sensors are simpler to implement in FPGAs than neural-network-based sensors and provide higher computation speed, as shown in [ 10 ]. FPGA implementations of PWA functions based on hyper-rectangular partitions (PWAR-based models) are further simpler than PWAS-based models, as shown in [ 11 ]. Taking into account that the sensor market size is growing (in the automotive industry, for example, approximately 22 billion sensors are estimated to be used per year by 2020 [ 12 ]), a CMOS Integrated Circuit (IC) solution for virtual sensors is very interesting since it can provide a minimum unitary cost with high performance in terms of area, power and speed. This is why this paper focuses on virtual sensor design into ICs. PWAR-based models are selected since they are very suitable to be realized by programmable ICs that can be adjusted to different applications. Considering that virtual sensors are usually part of ubiquitous and distributed networks, security is becoming increasingly important [ 13 , 14 ]. The sensing data must be trusted by the receiver, hence the integrity of the output data must be ensured. However, the data can be authenticated by an impostor sensor. The counterfeit problem is of such magnitude that the Semiconductor Industry Association (SIA) keeps an anti-counterfeiting task force [ 15 ]. The trusted sensing significance has increased up to the point that it is considered not only by the sensors [ 14 , 16 , 17 ] but also by well-established protocols that interconnect them [ 18 ]. To solve the problem of the IC integrity, the key is not stored in the IC. It is recovered by using a Physical Unclonable Function (PUF) inside the sensor hardware [ 19 ]. Consequently, the trusted sensor can recover the cryptographic key, while any impostor sensor is unable to do that. To solve the problem of data integrity, Message Authentication Codes (MACs) are usually employed. MACs can be obtained from block ciphers (such as AES-CMAC) or from hash functions (such as HMAC). In the case of AES-CMAC, the block cipher AES encrypts the data and then AES-CMAC is applied to the resulting ciphertext to generate the authentication tag. Due to the significance of the standardization in any industrial application the standard Keyed-Hash Message Authentication Code (HMAC) was selected in a previous work [ 20 ]. The HMAC standard is essentially a two-pass hash-based MAC [ 21 ]. In [ 20 ], a PHOTON-based HMAC was implemented [ 22 ]. In this paper a new solution based on the authenticated encryption algorithm called AEGIS [ 23 ] is proposed. AEGIS algorithm is one of the third-round candidates of the Competition for Authenticated Encryption: Security, Applicability, and Robustness (CAESAR) [ 24 ]. It is recommended for lightweight solutions, providing small response times because symmetric key encryption and MAC are combined efficiently to share part of the computation. AEGIS not only authenticates the virtual sensor data but also encrypts it, ensuring confidentiality. This paper describes the VLSI design of trusted virtual sensors. The paper is organized as follows. Firstly, the main features of the proposed trusted virtual sensor are described in Section 2. Then, an architectural description of the sensor is provided in Section 3. In Section 4, implementation results of the proposal in a 90-nm CMOS technology are shown and an application example in the automotive domain is described. Finally, conclusions are given in Section 5. 2. Features of the Proposed CMOS Sensor The proposed sensor provides the encrypted value of a variable that is virtually measured. In addition, it provides an authentication code that ensures the integrity, confidentiality, and authenticity of the sensor data. The virtual measurement is estimated from a PWA-based model. Both PWAR and PWAS forms are able to approximate any function and extract any black-box model. The PWAS form has been widely explored for virtual sensors [ 9 , 10 ]. However, the PWAR form is selected herein since its implementation is simpler than PWAS implementation. The algorithm AEGIS is selected to encrypt and authenticate the virtual measurement providing confidentiality and authenticity to the virtual sensor. AEGIS offers a high security since it is not possible to recover the state and the key faster than exhaustive key search provided that a non-reused Sensors 2018,18, 347 3 of 18 nonce is used and assuming that forgery attacks are not successful. The output provided by the proposed trusted virtual sensor are the used nonce, the resulting ciphertext, and the authentication tag. The integrity of the virtual sensor is ensured if the key employed by AEGIS is not stored but recovered whenever needed by using PUFs. The trusted sensor is able to recover the cryptographic key shared with the receiver of the sensing data, while any impostor is unable due to the uniqueness provided by the start-up values of the SRAM in the sensor, which is exploited as a PUF. Non-sensitive Helper Data, H , are stored to recover the key with a Helper Data Algorithm (HDA) based on an Error Correcting Code (ECC) [ 25 ]. Helper Data do not reveal anything about the cryptographic key because the start-up values of SRAM cells obfuscate it. Similarly, Helper Data do not reveal anything about the intrinsic nature of the sensor because the cryptographic key obfuscates it. Hence, two main components are differentiated in the proposed trusted virtual sensor. One part is associated with the generation of the virtual measurement and the other one provides the security of the measurement. They are both detailed in the following. 2.1. Virtual Sensing Based on PWAR approach A black-box model establishes the relation between input variables and the empirical or simulated output. The virtual sensor is obtained using a black-box identification algorithm by assuming that the virtually measured output, y, is set as a PWAR function of the input variables, x={x1, . . . , xn}. A generic PWA function with multiple inputs and one output y(x):D⊂Rn→R is represented as y(x)= n ∑ j=1 fij ·xj+fi0∀x∈Pi(i=1, . . . , P)(1) where fi= [fi0· · · fin]∈Rn+1 , and Pi⊂D are P non-overlapping regions ( Pi∩Pj=∅∀i6=j ), called polytopes, which form a polyhedral partition of the domain, D, so that Sp i=1Pi=D. In the case of regular PWAR functions, the domain is partitioned into hyper-rectangular polytopes by dividing each k dimension of the domain into Lk= 2 pk intervals with the same amplitude, thus resulting P=∏n k=1Lk=∏n k=12pk= 2 ∑n k=1pk polytopes. Hence, a PWAR function is defined by its partition, L={p1 , . . . , pn} , and the coefficients and the offset of each affine function, F={f1 , . . . , fP} with P= 2 ∑n k=1pk . Figure 1shows a bi-dimensional example of a regular PWAR function with its domain partitioned into 32 =16 ×2=24×21rectangles, that is L={4, 1}. Figure 1. Vehicle yaw rate estimation by a PWAR-based virtual sensor. Sensors 2018,18, 347 4 of 18 The partition and affine functions of a PWAR function can be adjusted conveniently to approximate the relation between input variables and sensing variable to estimate. An algorithm has been developed to find the parameters {L , F} that minimize the mean square error (MSE) between the PWAR function output (variable to sense, y ) and the empirical or simulated output data, yµ. The algorithm takes into account the constraints imposed by digital implementations, which are the following. • Maximum number of input variables: n. • Maximum number of hyper-rectangles: P=2p. • Maximum number of intervals per input: Q= 2 q , being Lk= 2 pk the number of intervals per input, so that, q≥pk∀k. The algorithm determines the hyper-rectangular partition of the input domain , L={p1 , . . . , pn} , and the value of the affine functions, F={f1, . . . , fP}. First, the partition is established, and then an off-line optimization algorithm extracts the F parameters using a set of simulated or empirical values of the output and its corresponding input data. All input data should belong to the domain D . At least, a given percentage, C , of the hyper-rectangles in a partition should be covered by the data in order to proceed with optimization. Otherwise, such high resolution is not required and the partition is not considered. The result of the approximation algorithm for a given partition, L , is not only the value of the F parameters but also the MSE between the simulated or empirical output data and the output of the PWAR function (the MSE taking into account training and testing data). Then, the MSE of all possible partitions are compared, and the partition with the lowest MSE (with the MSE that allows the best trade-off taking into account training and testing data) is selected. The algorithm steps are detailed in the pseudo-code of Algorithm 1. Its inputs are a set, B, of output data, yµ , with µ= 1, ..., M , corresponding to the input data {x1µ , ..., xnµ} ; the value of p that fixes the maximum number of hyper-rectangles; the value q that fixes the maximum number of intervals per input; and the minimum percentage, C , of hyper-rectangles that should be covered by input data. Data set B is divided into two subsets, one used as training file and the other as test (validation) file. The partitions with high resolution, that is, which verify that p=∑m k=1pk , are firstly explored with the function TryPartition (line 1.17) because they have higher capability of providing a lower approximation error (and they can be implemented in the proposed IC sensor as well as partitions with lower resolution). The function TryPartition( A , B , C ) evaluates if the partition, A , meets or not the condition to be included in the partition list, Pool . The condition is that the data set, B, should belong to no less than the C in percentage of the hyper-rectangles of the partition, A . Otherwise, such high resolution model has too many undefined affine functions. Finally, the partition list is explored (with the function Optimization) to determine the partition that provides the lowest approximation error. The function Optimization(i,B) (line 1.34) applies Levenberg-Marquardt algorithm to find the parameters F that achieve the minimum MSE (and, hence, the Root Mean Square Error, RMSE) for each partition candidate, i , considering the data set B [ 26 ]. Since the partition candidate (hyper-rectangle) is fixed, this optimization finds the best linear (affine) regression for the data. The F parameters of hyper-rectangles not covered by data are fixed as the arithmetic mean of the F in the neighbourhood. Once the algorithm finishes, if all the coefficients, fij , associated with the input xj(i= 1, . . . , P) , are zero, that input can be removed, thus resulting x={x1, . . . , xm}with m≤n. The proposed sensor can be configured to provide several PWAR functions depending on the application. Therefore, it can be used to sense different variables. The configuration data are the number of input variables, and the number of intervals in which each dimension is divided that is, the hyper-rectangular partition is configurable. The sensor is also configurable in the affine functions of each hyper-rectangle by changing the value of the parameters associated with each hyper-rectangle. Sensors 2018,18, 347 5 of 18 The input variables can be a same variable measured at several sampling times as well as the output measured at previous instants, for example, x={α[k]α[k−1]β[k]y[k−1]}. Algorithm 1 Pseudo-code of PWAR virtual sensor algorithm. Require: B=[x11,· · · ,xm1,y1,· · · ,x1M,· · · ,xmM,yM],p,q,C p1=q;p2=· · · =pm=0; part =¬SUCCESS;Pool =[];Emax =1; while p1≥0do p2=p−∑m j=1 & j6=2pj; 5: if p2>qthen p2=q; end if while p2≥0do . . . 10: while pm−1≥0do pm=p−∑m j=1 & j6=mpj; if pm>qthen pm=q; end if 15: while pm≥0 & part =¬SUCCESS do A={p1,· · · ,pm}; part=TryPartition(A, B, C); if part==SUCCESS then Pool = [Pool || A]; 20: end if pm=pm−1; end while pm=0; pm−1=pm−1−1; 25: end while . . . p3=0; p2=p2−1; end while 30: p2=0; p1=p1−1; end while for i∈Pool do [RMSE, F]=Optimization(i, B); 35: if RMSE <Emax then Emax =RMSE; L=i; end if end for 40: return L,F 2.2. Trusted Sensing Based on AEGIS and PUF The virtual measurement, y , is encrypted and authenticated by using the AEGIS algorithm, which is a dedicated authentication encryption algorithm. AEGIS is based on the AES encryption round function, providing the advantage of a computational cost about half that of AES [ 23 ]. If the nonce is not reused (which should be the case for a true nonce), AEGIS provides a high security since state and key can only be recovered by exhaustive search. Sensors 2018,18, 347 6 of 18 AEGIS algorithm takes the cryptographic key, key , a number used only once, nonce , and a plaintex, in this case the virtual measurement, y, and provides a ciphertext, Ct, and an authentication tag, tag. [Ct,tag] = AEGIS(key,nonce,y)(2) An interesting feature of the proposed sensor is that the secret key, is not stored in the IC but it is recovered whenever needed. From a security point of view, a secret that is not stored is much more difficult to discover. Among the wide number of PUFs proposed in the literature, SRAM-based PUFs [ 27 ] are selected in this work since the proposed IC sensor requires SRAMs for its virtual sensing functionality. Since an SRAM cell is composed of two cross-coupled inverters, as shown in Figure 2, the start-up value is imposed by the inverter which begins to conduct. The conditions that make one inverter be the winner can be intrinsic or external. Intrinsic conditions are related to mismatching between the inverters, while external conditions are aging, ambient temperature, power supply voltage value ( Vdd ) or ramp-up time (i.e., the time to reach Vdd after power-on) [ 27 – 29 ]. As discussed in [ 27 ], there are SRAM cells whose intrinsic conditions dominate over the external conditions. Hence, although the external conditions change, their start-up values are mostly the same. This type of cells will be named herein as ID cells. There are also SRAM cells whose external conditions dominate over the intrinsic conditions so that they are able to extract the noise of the external conditions as a source of entropy. They will be named herein as RND cells. Bit line Bit line Figure 2. Schematic of a SRAM cell. SRAM ID cells are used in the proposed IC sensor to recover the cryptographic key. The reliability of these stable cells is measured by the maximum fractional Hamming distance, maxID,HD , between pairs of responses, R, generated by the same ncells at mdifferent times: maxID,HD =max i=1, ..., m−1 j=i+1, ..., m (HD Ri,Rj n)(3) Ideally, maxID,HD is zero but some bit flipping of the start-up values is unavoidable. The SRAM cells are classified by using Algorithm 2to obtain an ID_mask and a RND_mask. The SRAM is powered-up and down several times under different operating conditions. HDA is used to obfuscate and to recover the key [ 25 ]. It is based on an error correcting repetition code whose correction capability should to be able to correct the maximum bit flipping probability of maxID,HD in (3). Algorithm 3describes how Helper Data, H , are generated from a secret key and the start-up values of the SRAM. Sensors 2018,18, 347 7 of 18 Algorithm 2 Pseudo-code of Masks Extraction algorithm. Require: Number, J, of conditions to evaluate. Number of measurements, K, per condition for i=1 to J do for j=1 to K do power down and up the SRAM if j=1 then save the start-up values else compare the start-up values with the stored ones end if for all the cells of SRAM do if cell value does not change then add cell to ID_maski else add cell to RND_maski end if end for end for end for for all the cells of SRAM do if cell belongs to all {ID_mask1, . . . , ID_maskJ}then add cell to ID_mask else if cell belongs to all {RND_mask1, . . . , RND_maskJ}then add cell to RND_mask end if end for return ID_mask, RND_mask Algorithm 3 Pseudo-code of Helper Data Generation algorithm. Require: key =[k1, ..., ka], start-up values of SRAM Each bit of the key is repeated rtimes =⇒keyr=[k11, ..., k1r, ..., ka1, ..., kar]. R=concatenation of the a·rSRAM ID cells start-up values at Helper Data generation step. H=keyr⊕R. return H The secret key is recovered as described in Algorithm 4. A response, R0 , slightly different to R , since even ID cells may provide some bit flipping, is obtained by concatenating the new start-up values of the a·r SRAM ID cells used to generate the Helper Data. The key is recovered by using an ECC with codeword length r, employed to correct up to r 2errors. Algorithm 4 Pseudo-code of Key Recovering algorithm. Require: H, start-up values of SRAM R0= concatenation of the a·rSRAM ID cells start-up values at key recovering step. key0=H⊕R0=keyr⊕R⊕R0 key =ECC(key0). return key Helper Data do not reveal anything about the cryptographic key because the start-up values of SRAM ID cells obfuscate it. Similarly, Helper Data do not reveal anything about the intrinsic nature of the IC sensor because the cryptographic key obfuscates it. A way to measure the non-sensitiveness of Helper Data is to evaluate the average fractional Hamming distance, avgInterHD , between all the possible pairs of Helper Data of pdifferent sensors that use the same key, as follows: Sensors 2018,18, 347 8 of 18 avgInterHD =2 p(p−1) p−1 ∑ i=1 p ∑ j=i+1 HD Ri,Rj n(4) This way, instead of storing the key, only Helper Data are stored and the integrity of the sensor is ensured. If the sensor is copied, its SRAM ID cells will have other intrinsic features and they will not be able to recover the key. The start-up values of the SRAM cells are also exploited to generate the nonce required by AEGIS. The nonce is initialized by the start-up values of SRAM RND cells and then updated by a counter. A way to measure the change of the nonce seed is to evaluate the minimum fractional Hamming distance, minRND,HD , between pairs of responses, R , generated by the same n RND cells at mdifferent times: minRND,HD =min i=1, ..., m−1 j=i+1, ..., m (HD Ri,Rj n)(5) A value of minRND,HD strictly greater than zero ensures that the nonce seed is time variant, as required. AEGIS is based on the AES round function [ 23 ]. There are three variations. AEGIS-128 processes a 16-byte message block with five AES round functions in parallel. It consumes the least resources, but it is the slowest for large messages. AEGIS-128L processes a 32-byte message block with eight AES round functions in parallel. In terms of resource consumption, it is the biggest version, but it is also the fastest. Finally, AEGIS-256 processes a 32-byte message block with six AES round functions. Then, it offers an intermediate performance in terms of resource consumption and time response. Since the virtual measurement is smaller or equal to 128-bits, only one 16-byte state has to be processed. Hence, AEGIS-128 is more adequate in this application, since it is as fast as AEGIS-128L, using less resources. AEGIS-128 uses a 128-bit key and a 128-bit nonce. The algorithm is based on the function Si+1=StateUpdate(Si , mi) described in Algorithm 5where the function AESRound(A) is the AES encryption round function being A the state. The main operations in the AES round are SubBytes operation, ShiftRows and AES-MixColumns. Algorithm 5 State Update function. 1: function STATEUPDATE(Si,mi) 2: Si+1,0 =AESRound(Si,4)⊕Si,0 ⊕mi 3: Si+1,1 =AESRound(Si,0)⊕Si,1 4: Si+1,2 =AESRound(Si,1)⊕Si,2 5: Si+1,3 =AESRound(Si,2)⊕Si,3 6: Si+1,4 =AESRound(Si,3)⊕Si,4 7: return Si+1 8: end function The pseudo-code of the AEGIS-128 applied to the virtual measurement is described in Algorithm 6. The main steps of the algorithm are to initialize the state (line 6.1), process the nonce (line 6.6), process the measurement and generate the ciphertext (line 6.14), and generate the authentication tag (line 6.20). constant1 and constant2 are two 128-bit constants fixed by the algorithm. Sensors 2018,18, 347 9 of 18 Algorithm 6 Pseudo-code of AEGIS algorithm. Require: key, nonce, y 1: S−10,0 =key ⊕nonce 2: S−10,1 =constant1 3: S−10,2 =constant2 4: S−10,3 =key ⊕constant1 5: S−10,4 =key ⊕constant2 6: for i=−10 : −1do 7: if iis odd then 8: mi=key ⊕nonce 9: else 10: mi=key 11: end if 12: Si+1=StateUpdate(Si,mi) 13: end for 14: Ct=y⊕S0,1 ⊕S0,4 ⊕(S0,2&S0,3) 15: S1=StateUpdate(S0,y) 16: tmp =S1,3 ⊕128 17: for i=1 : 6 do 18: Si+1=StateUpdate(Si,tmp) 19: end for 20: tag =S7,0 ⊕S7,1 ⊕S7,2 ⊕S7,3 ⊕S7,3 21: return Ct, tag 3. Architectural Description of the Sensor The proposed sensor has two main behavioural modes. The configuration mode is carried out whenever the sensor is powered up. It recovers the key, generates a seed for the nonces, and establishes the relation between the input data and the data to estimate, that is, the PWAR model. The trusted sensing mode is set once the configuration mode is finished. It generates a PWAR virtual measurement which is encrypted and authenticated. The proposed sensor is composed of three main units: the PWAR, the Cryptographic, and the Control units. Figure 3illustrates the block diagram of the sensor architecture, including the main signals and buses that interconnect the blocks. Note that the SRAM is shared by two units, thus saving resources since it is not used simultaneously by both units. The non-volatile memory (NVM) should be programmed by the sensor manufacturers or their authorized distributed channels prior to use the sensor. The NVM stores the information required by the sensor: (a) the partition L and the parameters F that fix the PWAR model to implement (obtained by applying Algorithm 1); (b) the RND and ID masks (obtained by classifying the SRAM cells as exposed in Algorithm 2); and (c) the Helper Data needed to recover the cryptographic key (generated as in Algorithm 3). The whole design prioritizes a short response time, using parallel processing, and a low power consumption, enabling the blocks only whenever needed. 3.1. PWAR Unit The architecture of this unit, based on the one exposed in [ 30 ], is composed of the SRAM, the Address Generator, and the Arithmetic blocks. Each word in the SRAM stores the coefficients of the input and the offset of the affine function associated with an hyper-rectangle, fi∈F . Therefore, the width of the memory is (n+ 1 )·nin bits and the depth is the maximum number of hyper-rectangles, P , being nin the number of bits used to represent each coefficient of the input and the offset. During the trusted sensing mode, one word of the SRAM is read providing in parallel the parameters needed to compute the affine function related Sensors 2018,18, 347 16 of 18 (c) after accelerated aging the ICs with the SRAM continuously during 171 h at high temperature of 75 ◦C (and nominal Vdd); and (d) decreasing the Vdd ramp-up time to 2.32 ms. The first row of Table 3shows the average of maximum intra HD (3) between responses of SRAM ID cells taken at operation conditions with changes in Vdd , T , ramp-up time, and aging (before and after aging). Reliability is mostly affected by changes in ramp-up time and temperature. Since the start-up values of different SRAM ID cells of the same SRAM were proved to be independent, the probability that a string of 29 bits contains more than 14 errors (and, hence, it is not correctly decoded to extract the original key bit) is calculated with the following formula: Pbit-error =1− 14 ∑ i=029 ipi·(1−p)29−i(6) Table 3. Features of the SRAM PUF in the IC sensor. Changes in Vdd Changes in TChanges in Ramp-Up Time Changes in Aging maxID,HD (ID) 0.66 ±0.04% 2.75 ±0.07% 9.64 ±0.24% 0.29 ±0.01% minRND,HD (RND) 34.31 ±0.29% 41.49 ±0.51% 39.02 ±0.49% 33.74 ±0.31% Assuming the worst-case bit flipping probability in the first row of Table 3, p= 9.64%, the Pbit-error is 1.19 × 10 −8 . Similarly, assuming 1.19 × 10 −8 as the worst-case bit-error probability in the key, the probability that the 128-bit key is not correctly decoded by the authentic sensor is 1.53 × 10 −6 , which is quite low. The average inter HD (4) between responses of ID cells of 10 different SRAMs (corresponding to different sensors) was measured as 0.50 ± 0.01 in nominal conditions. As commented in Section 2.2, this result shows that Helper Data do not reveal information about the cryptographic key. Taking such average inter HD as bit flipping probability between a false sensor and a genuine one, the probability of correctly decoding one bit of the cryptographic key is 0.5, and, hence, the probability of regenerating the correct key by a false sensor is 2 × 10 −128 , which is completely infeasible. The second row of Table 3shows the average of minimum inter HD (5) between responses of RND cells taken at the different operation conditions. In any case, it is ensured that the nonce seed is always different, as required. 5. Conclusions The VLSI design of trusted virtual sensors is very suitable for industrial applications where security is becoming increasingly important since it offers privacy, authenticity and integrity of the virtually sensed measurement and the circuit itself. The implementation of the design into a 90-nm CMOS technology occupies 0.86 mm 2 and consumes 7.12 mW when trusted sensing at 50 MHz. Working at maximum frequency, the trusted virtual sensor allows sampling times lower than 0.25 µ s. The inclusion of security to the virtual sensor needs 17.1% of active area and 14.8% of power consumption. Acknowledgments: This work was supported in part by TEC2014-57971-R project from Ministerio de Economía, Industria y Competitividad of the Spanish Government (with support from the P.O. FEDER of European Union) and 201750E010 (HW-SEEDS) project from CSIC. M.C. Martínez-Rodríguez is supported by FPI fellowship program for Students from Spanish Government. The work of M.A. Prada-Delgado and P. Brox was supported by V Plan Propio de Investigación through the University of Seville, Seville, Spain. Author Contributions: Macarena C. Martínez-Rodríguez designed the trusted virtual sensor prototype. Macarena C. Martínez-Rodríguez and Piedad Brox designed, simulated and tested the fabricated PWAR Unit. Miguel A. Prada-Delgado tested and analyzed the fabricated SRAM PUF. Iluminada Baturone contributed to the design of the prototype, the selection of the algorithms and the experiments. All authors contributed to writing the paper. Conflicts of Interest: The authors declare no conflict of interest. Sensors 2018,18, 347 17 of 18 References 1. Li, H.; Yu, D.; Braun, J.E. A review of virtual sensing technology and application in building systems. HVAC R Res. 2011,17, 619–645. 2. Heredia, G.; Ollero, A. Virtual Sensor for Failure Detection, Identification and Recovery in the Transition Phase of a Morphing Aircraft. Sensors 2010,10, 2188–2201. 3. Sánchez, J.A.; Rodríguez, F.; Guzmán, J.L.; Arahal, M.R. Virtual Sensors for Designing Irrigation Controllers in Greenhouses. Sensors 2012,12, 15244–15266. 4. Bustillo, A.; Correa, M.; Reñones, A. A Virtual Sensor for Online Fault Detection of Multitooth-Tools. Sensors 2011,11, 2773–2795. 5. Stephant, J.; Charara, A.; Meizel, D. Virtual sensor: Application to vehicle sideslip angle and transversal forces. IEEE Trans. Ind. Electron. 2004,51, 278–289. 6. Novara, C.; Ruiz, F.; Milanese, M. Direct Identification of Optimal SM-LPV Filters and Application to Vehicle Yaw Rate Estimation. IEEE Trans. Control Syst. Technol. 2011,19, 5–17. 7. Zhang, B.; Du, H.; Lam, J.; Zhang, N.; Li, W. A Novel Observer Design for Simultaneous Estimation of Vehicle Steering Angle and Sideslip Angle. IEEE Trans. Industr. Electron. 2016,63, 4357–4366. 8. Rubagotti, M.; Poggi, T.; Oliveri, A.; Pascucci, C.A.; Bemporad, A.; Storace, M. Low-complexity piecewise-affine virtual sensors: theory and design. Int. J. Control 2014,87, 622–632. 9. Poggi, T.; Rubagotti, M.; Bemporad, A.; Storace, M. High-speed piecewise affine virtual sensors. IEEE Trans. Ind. Electron. 2012,59, 1228–1237. 10. Oliveri, A.; Cassottana, L.; Laudani, A.; Fulginei, F.R.; Lozito, G.; Salvini, A.; Storace, M. Two FPGA-Oriented High Speed Irradiance Virtual Sensors for Photovoltaic Plants. IEEE Trans. Ind. Inform. 2017,13, 157–165. 11. Comashi, F.; Genuit, B.A.G.; Oliveri, A.; Heemels, W.P.M.H.; Storace, M. FPGA implementations of piecewise affine functions based on multi-resolution hyperrectangular partitions. IEEE Trans. Circuits Syst. I 2012 , 59, 2920–2933. 12. Pinelis, M. Automotive sensors and electronics: trends and developments in 2013. In Proceedings of the Automotive Sensors and Electronics Expo, Detroit, MI, USA, 9 October 2013. 13. Kim, J.; Lee, D.; Jeon, W.; Lee, Y.; Won, D. Security Analysis and Improvements of Two-Factor Mutual Authentication with Key Agreement in Wireless Sensor Networks. Sensors 2014,14, 6443–6462. 14. Sampangi, R.V.; Sampalli, S. Butterfly Encryption Scheme for Resource-Constrained Wireless Networks. Sensors 2015,15, 23145–23167. 15. Semiconductor Industry Association. Available online: https://www.semiconductors.org/issues/ anticounterfeiting/anti_counterfeiting/ (accessed on 1 August 2013). 16. Meguerdichian, S.; Potkonjak, M. Security primitives and protocols for ultra low power sensor systems. In Proceedings of the 2011 IEEE SENSORS, Limerick, Ireland, 28–31 October 2011; pp. 1225–1227. 17. Kanuparthi, A.; Karri, R.; Addepalli, S. Hardware and Embedded Security in the Context of Internet of Things. In Proceedings of the 2013 ACM Workshop on Security, Privacy & Dependability for Cyber Vehicles, Berlin, Germany, 4 November 2013; pp. 61–64. 18. Pfeiffer, O. Implementing Scalable CAN Security with CANcrypt: Authentication and Encryption for CANopen, J1939 and Other Controller Area Network or CAN FD Protocols; Embedded Systems Academy Inc.: Hanover, Germany, 2017. 19. Liu, W.; Zhang, Z.; Li, M.; Liu, Z. A Trustworthy Key Generation Prototype Based on DDR3 PUF for Wireless Sensor Networks. Sensors 2014,14, 11542–11556. 20. Martínez-Rodríguez, M.C.; Prada, M.; Brox, P.; Baturone, I. CMOS digital design of a trusted virtual sensor. In Proceedings of the 2017 IEEE Nordic Circuits and Systems Conference (NORCAS): NORCHIP and International Symposium of System-on-Chip (SoC), Linkoping, Sweden, 23–25 October 2017. 21. National Institute of Standards and Technology (NIST). The Keyed-Hash Message Authentication Code (HMAC). Available online: http://nvlpubs.nist.gov/nistpubs/fips/nist.fips.198-1.pdf (accessed on 20 April 2013). 22. Eiroa, S.; Baturone, I. FPGA implementation and DPA resistance analysis of a lightweight HMAC construction based on PHOTON hash family. In Proceedings of the 23rd International Conference on Field programmable Logic and Applications, Porto, Portugal, 2–4 September 2013; pp. 1–4. Sensors 2018,18, 347 18 of 18 23. Wu, H.; Preneel, B. AEGIS: A Fast Authenticated Encryption Algorithm. In Proceedings of the Selected Areas in Cryptography—SAC 2013: 20th International Conference, Burnaby, BC, Canada, 14–16 August 2013 ; pp. 185–201. 24. CAESAR: Competition for Authenticated Encryption: Security, Applicability, and Robustness. Available online: https://competitions.cr.yp.to/caesar.html (accessed on 26 April 2014). 25. Guajardo, J.; Kumar, S.S.; Schrijen, G.; Tuyls, P. FPGA Intrinsic PUFs and Their Use for IP Protection. In Cryptographic Hardware and Embedded Systems-CHES 2007; Paillier, P., Verbauwhede, I., Eds.; Springer: Berlin, Heidelberg, 2007; pp. 63–80. 26. Fletcher, R. Practical Methods of Optimization; John Wiley & Sons: Hoboken, NJ, USA, 2000. 27. Baturone, I.; Prada-Delgado, M.A.; Eiroa, S. Improved generation of identifiers, secret keys, and random numbers From SRAMs. IEEE Trans. Inf. Forensics Secur. 2015,10, 2653–2668. 28. Gebara, F.; Kim, J.; Schaub, J.; Strumpen, V. Temperature-Profiled Device Fingerprint Generation and Authentication from Power-Up States of Static Cells. US Patent 8,495,431, 23 July 2013. 29. Cortez, M.; Hamdioui, S.; Kaichouhi, A.; van der Leest, V.; Maes, R.; Schrijen, G.J. Intelligent Voltage Ramp-Up Time Adaptation for Temperature Noise Reduction on Memory-Based PUF Systems. IEEE Trans. Comput. Aided Des. Integr. Circuits Syst. 2015,34, 1162–1175. 30. Brox, P.; Martínez-Rodríguez, M.C.; Tena-Sánchez, E.; Baturone, I.; Acosta, A.J. Application specific integrated circuit solution for multi-input multi-output piecewise-affine functions. Int. J. Circuit Theory Appl. 2016,44, 4–20. 31. Lutz, M.; Golderer, W.; Gerstenmeier, J.; Marek, J.; Maihofer, B.; Mahler, S.; Munzel, H.; Bischof, U. A precision yaw rate sensor in silicon micromachining. In Proceedings of the International Conference on Solid State Sensors and Actuators, TRANSDUCERS ’97 Chicago, Chicago, IL, USA, 19 June 1997; Volume 2, pp. 847–850. 32. Kim, D.; Park, Y.; Lee, H. Sensor offset compensation for a vehicle yaw rate sensor using fuzzy logic. In Proceedings of the International Conference on Control, Automation and Systems, Seoul, Korea, 17–20 October 2007; pp. 362–366. © 2018 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).