CMOS digital design of a trusted virtual sensor

Depósito de investigación de la Universidad de Sevilla https://idus.us.es/ This is an Accepted Manuscript of an article published by IEEE in Nordic Circuits and Systems Conference (NORCAS): NORCHIP and International Symposium of System-on-Chip (SoC) on 30 November 2017, available at: https://doi.org/10.1109/NORCHIP.2017.8124948 “© 2021 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other Works” CMOS Digital Design of a Trusted Virtual Sensor Macarena C. Mart´ ınez-Rodr´ ıguez Miguel ´ Angel Prada Piedad Brox Iluminada Baturone Instituto de Microelectr´ onica de Sevilla (IMSE, CSIC, Universidad de Sevilla) Email: {macarena,prada,brox,lumi}@imse-cnm.csic.es Abstract—This work presents the digital design of a trusted virtual sensor. The virtual sensor implements a piecewise-affine (PWA)-based model to estimate the sensed variable. The measurement is authenticated with the keyed-hash message authentication code (HMAC) standard. To ensure the integrity of the sensor, the static random access memory (SRAM) required by the sensor is also used as physical unclonable function (PUF). Implementation results of the design in a 90-nm CMOS technology show that the security blocks occupy 5.1% of the area occupied by the required PWA blocks and consume 15.4% of the power consumed by the required PWA blocks. The sensor is able to provide trusted outputs in 106.3microseconds when working at 100 MHz. I. INTRODUCTION The use of virtual sensors has increased continuously since the early 1980s in a wide number of industrial applications [1]. Integrated circuits (IC) solutions for virtual sensors are very interesting since they can provide a minimum unitary cost with high performance in terms of area, power and speed. Traditionally, a circuit designer has to handle with a tradeoff between area occupation (resources consumption), timing response and power consumption. However, considering that virtual sensors are usually part of ubiquitous and distributed networks such as critical infrastructures, a fourth parameter which is becoming very important is the security [2], [3]. The receiver of the sensing data must trust in the data originated from the sensor. Not only data integrity but also sensor integrity must be ensured. The problem of counterfeit chips is so significant that the Semiconductor Industry Association (SIA) maintains an anti-counterfeiting task force. The significance of trusted sensing is increasing, such not only sensors have included cryptography [3], [4], but well-established protocols have recently included it too [5]. Virtual sensors estimate the value of a variable that is very difficult or costly to measure physically. The estimation is carried out by modeling the relation between that variable and others that can be measured easily with low-cost commercial sensors. The relation between input and output data can be modeled with black- and gray-box models. Neural networks and fuzzy logic approaches are used to obtain black- and gray-box models. Piecewise-affine (PWA) virtual sensors are also employed to provide black-box models. Simplicial PWA functions have been proposed for virtual sensors (PWAS-based model) [6]. Hardware realizations of PWA functions based on hyper-rectangular partitions (PWAR-based models) are further simpler than PWAS-based models, as shown in [7]. Therefore, PWAR-based models are selected herein to implement virtual sensors. Data should be certified to be provided by a trusted sensor, which is not counterfeit. Message authentication codes (MACs) are the usual constructions employed to ensure data integrity [8]. The HMAC standard is an approach to implement MAC using a two-pass hash-based MAC. HMAC is selected since it avoids the weakness of previous constructions [9]. Since HMAC requires a cryptographic key, a way to ensure the integrity of the sensor is to regenerate the key (instead of storing it) by using Physical Unclonable Functions (PUFs) inside the sensor hardware [10]. Among the wide number of PUFs proposed in the literature, SRAM-based PUFs are selected in this paper since the proposed CMOS sensor requires SRAMs (Static Random Access Memories) for its virtual sensing functionality. This paper describes the hardware design of trusted virtual sensors into ICs. To the best of authors knowledge, no other work has addressed the design of such trusted virtual sensors into ICs. The paper is organized as follows. Firstly, the main features of the proposed CMOS sensor related to virtual sensing and security are presented in Section II. Then, the architecture is described in Section III. After that, the implementation results of the trusted virtual sensor are presented in Section IV. Finally, conclusions are given in Section V II. FEATURES OF THE PROPOSED CMOS SENSOR The proposed sensor provides an output variable that is virtually measured as well as an authentication code that ensures the integrity and the authenticity of the sensor data. The virtual measure, y, is estimated from a PWAR-based model. Since the measure can be the same for different measurements, a nonce (a value used only once) is attached to the measure in order to avoid replay attacks. Therefore, the output provided by the proposed sensor is sensorout =nonce kykHMAC (K, nonce ky)(1) where kdenotes concatenation. The trusted sensor is able to regenerate the cryptographic key, K, shared with the receiver of the sensing data while any978-1-5386-2844-7/17//$31.00 c 2017 IEEE Fig. 1. Bi-dimensional example of a PWAR function and its hyper-rectangular partition impostor is unable due to the uniqueness provided by the startup values of the SRAM in the sensor, which is exploited as a PUF. Non-sensitive helper data, H, are stored to regenerate the key with a helper data algorithm (HDA). Helper data do not reveal anything about the cryptographic key because the start-up values of SRAM cells obfuscate it. Similarly, helper data do not reveal anything about the intrinsic nature of the sensor because the cryptographic key obfuscates it. The proposed sensor has two main behavioral modes. The configuration mode is carried out whenever the sensor is powered up. It recovers the key, generates a seed for a nonce, and establishes the relation between the input data and the data to estimate. The trusted sensing mode is set once the configuration mode is finished. It generates a PWAR virtual measure and authenticates it. The building blocks of the proposed CMOS sensor are exposed in the following. A. PWAR approach A generic PWA function with multiple inputs and one output y(x) : D⊂Rn→Ris represented as y(x) = fi·x+gi∀x∈Pi(i= 1, . . . , P )(2) where fi∈Rn,gi∈R, and Pi⊂Dare Pnon overlapped regions ( Pi∩Pj=∅ ∀i6=j), called polytopes, which form a polyhedral partition of the domain D, so that Sp i=1 Pi=D. In the case of regular PWAR functions, the domain is partitioned into hyper-rectangular polytopes by dividing each kdimension of the domain into Lkintervals with the same amplitude, thus resulting P=Qn k=1 Lkpolytopes. Fig. 1 shows a bidimensional example of a regular PWAR function with its domain partitioned into 12 = 4 ×3rectangles. The partition and affine functions of a PWAR function can be adjusted conveniently to provide a black-box model that approximates the relation between input variables and sensing variable to estimate. Therefore, the virtually measured output, y, is a PWA function of the inputs x={x1, .., xn}. The sensor can be configured for different PWAR functions. Therefore, it can be used to sense different variables. The configuration data are the number of input data and the number of intervals in which each dimension is divided, that is, the hyper-rectangular partition is configurable. The sensor is also configurable in the affine functions of each hyper-rectangle by changing the value of the parameters fgi={fi1, .., fin, gi} associated to each hyper-rectangle, Pi. Prior to use the sensor, the sensor manufacturers or their authorized distribution channels program in a non-volatile memory (NVM) the number of inputs of the function, n, the number of intervals, Lk with k= 1..n and the parameters fgiassociated to each hyper-rectangle, Pi,F G = [fg1..fgP]T. In the configuration mode, these data are loaded from the NVM. In the trusted sensing mode, once the input data, x, is received, the hyperrectangle, where the input is located, is determined. After that, the parameters associated to that hyper-rectangle, fgi are extracted. And finally, the affine function is computed y(x) = fi·x+gix∈Pi. B. Security 1) PUF: SRAM is used as PUF. As discussed in [10], there are SRAM cells whose intrinsic conditions dominate over the external conditions. Hence, although the external condition change (such as temperature or power supply voltage), their start-up values are mostly the same. They will be named as ID cells. There are also SRAM cells whose external conditions dominate over the intrinsic conditions so that they are able to extract the noise of the external conditions as a source of entropy. They will be named as RND cells. The non-volatile memory stores which cells of the SRAM are ID cells (an ‘ID mask’ is in charge of such information) and which ones are RND cells (an ‘RND mask’ stores such information). These masks have to be stored in the NVM by the sensor manufacturers or their authorized distribution channels prior to use the sensor. The ID cells are used to recover the key while the RND cells are used to generate a seed for the nonces. In order to classify the SRAM cells, the SRAM is poweredup and down several times under different operating conditions. Each time, the start-up values are compared with the values at the previous time. If the start-up value never changes, the cell is classified as ID (it has not shown bit flipping). If the start-up value changes, the cell is classified as RND. 2) HDA: The helper data algorithm (HDA) is used in order to recover the key. The key is not stored in the NVM, and therefore, the attacks are forced to be done with the sensor powered. Instead of the key, Helper data, H, are stored in the NVM prior to use the sensor. Helper data do not reveal information about the cryptographic key, so that the NVM does not require any special security feature. The way to generate the helper data is as follows. Each bit of the cryptographic key K= [k1, .., ka]is repeated rtimes, so that Kr= [k11, .., k1r, .., ka1, .., kar]. A response, R, is obtained by concatenating a·rvalues resulting from the start-up values of a·rSRAM ID cells. Helper data are obtained by XORing Krand R, H=Kr⊕R. SRAM PUF fgi NVM Address Generator Arithmetic Block PWAR Unit Control Unit X y = fPWA (X) X nonce ││ y ││ HMAC (K, nonce ││ y) y address fgi HMAC Nonce Counter nonce HDA start-up values ID-mask RND mask Helper data SRAM address seedK RND mask ID mask PWAR data Helper data Security Unit RND mask ID mask Helper data HMAC (K, nonce ││y) NVM address Fig. 2. Architectural scheme of the proposed CMOS sensor In the configuration mode, the key is recovered using the ID mask and the helper data, H, as follows. The start-up values are extracted. An ID is generated with the start-up values of those cells that the ID mask indicates as ID cells. A response, R0(slightly different to R, since even ID cells may provide some bit flipping), is obtained by taking a·rvalues of ID. Helper data are XORed with R0:K0=H⊕R0= Kr⊕R⊕R0.Kis recovered by using an error correcting code: K=ECC(K0). Besides, the seed of the nonces is generated with the startup values of those cells that the RND mask indicates as RND cells. 3) HMAC: The HMAC standard provides an authentication code from a message, text, and a cryptographic key, K[9]: (3) HMAC(K, text) = hash [(Ko⊕opad) khash [(Ko⊕ipad)ktext]] where Kois derived from the key, K, to have a multiple of the hash input block size; and ipad and opad are, respectively, the inner and outer pads given by the standard. III. ARCHITECTURAL DESCRIPTION OF THE SENSOR The proposed sensor is composed of three main units: the PWAR, the security, and the control units. Figure 2 illustrates the block diagram of the sensor architecture, including the main signals and buses that interconnect the blocks. Note that the SRAM is shared by two units, thus saving resources since it is not used simultaneously by both units. A. PWAR Unit The architecture of this unit is based on the one exposed in [7]. It is composed of the following blocks. 1) SRAM: In the configuration mode, the PWAR parameters are read from the NVM and stored in the SRAM. Each word of the memory contains a parameter, fgi, associated to to an hyper-rectangle, Pi, of the input domain. The SRAM depth is the number of hyper-rectangles. In the trusted sensing mode, the SRAM provides the parameter fgineeded to compute the affine function. 2) Arithmetic block: In the trusted sensing mode, it computes in parallel the operation in (2) for a given input, x, and for given parameters, fgi. 3) Address generator block: In the trusted sensing mode, it determines the address of the SRAM where the parameters are stored. For that purpose, it concatenates the pkmost significant bits (MSBs) of each input xk. The MSBs determine which of the 2pkintervals the input belongs to, and, hence, p= {p1, . . . , pn}determine the hyper-rectangle, where P= 2p. Therefore, in the trusted sensing mode, the PWAR unit receives the input data, the hyper-rectangle is located and the PWAR function is computed. B. Security Unit Although the ID mask, RND mask and the helper data, H, are stored in the NVM, this fact does not compromise security since the key cannot be recovered without the SRAM start-up values. During the configuration mode, they are loaded from the NVM into the lower part of the SRAM. The security blocks are detailed in the following. 1) SRAM: The upper part of the shared SRAM is used in the security unit to extract the start-up values. The lower part is used to store temporally the ID and the true random number for the HDA block. 2) HDA block: In the configuration mode, it receives the helper data, H, the ID mask, the RND mask and the startup values of the SRAM. Then, it concatenates the start-up values of a·rcells to obtain a response, R0. The noisy key, K0is generated by XORing the helper data and the response, K0=H⊕R0. Finally, the error correcting code recovers the key, K=ECC(K0). Also, the seed of the nonce is generated by taking the start-up values of the SRAM cells indicated by the RND mask. 3) Nonce counter: The nonce counter is initialized with the seed during the configuration mode. During the trusted sensing mode, it increases the count to generate a new nonce. Fig. 3. State diagram of the control unit 4) HMAC Block: Sponge constructions are very popular since the winner of the SHA-3 contest of the National Institute of Standards and Technology, NIST, uses them. They hash a message by the iterative application of a permutation to an internal state into which the input message is inserted during absorbing steps and from which the output digest is obtained after squeezing steps. Specific lightweight hash functions based on sponge constructions have been proposed for hardware implementation into tiny devices, such as the PHOTON family [11]. The HMAC block is implemented with a PHOTON- 80/20/16. The input block size of this hash function is 20 bits. Hence, the message to authenticate must be divided into blocks of 20 bits. During absorbing steps, each 20-bit input block is XORed with 20 bits of the internal state of the hash function. PHOTON-80/20/16 has an internal state of 100 bits (80 out of these 100 bits are never affected by the input blocks and never output the function; they correspond to the capacity of the function). After absorbing a block, a permutation operation is performed to the internal state, represented as a 5×5 matrix of 4-bit cells. The permutation operation is composed of four operations, AddConstant, Sub-Cell, ShiftRows and MixColumnsSerial, which are repeated 12 times, changing the values of the 4-bit cells. In the configuration mode, the HMAC block absorbs and processes the 20-bit input blocks associated to the key and stores the resulting internal state to avoid to repeat that absorption for each measurement. During the trusted sensing mode, the block finishes the absorption steps of the first hash (absorbing and processing the 20-bit input blocks associated to the sensor measurement concatenated with the nonce), it finishes the absorption steps of the second hash (processing 4 blocks associated to the output of the first hash) and it performs squeezing steps of the second hash (processing 4blocks), thus providing the final 80-bit output. C. Control Unit The control unit is a finite state machine (FSM) that enables and disables the blocks depending on the states. The main states are shown in Fig. 3. Two parts are differentiated, the upper part corresponding to the configuration mode and the lower part corresponding to the trusted sensing mode. When the sensor is powered up, the configuration mode starts. 1) Configuration mode: •CONF1: The mask ID, mask RND, helper data and PWAR configuration data and parameters are read from the NVM. •CONF2: Key is recovered. The seed for the nonces is generated. PWAR unit is configured. •CONF3: Key is absorbed by the HMAC block. The nonce counter is initialized with the seed. PWAR parameters are stored in the SRAM. The sensor remains in the state IDLE until it receives new input data. The sensor is set to the state OFF-ON by the FSM whenever it is powered-on, thus achieving the sensor is always configured before entering the trusted sensing mode. This also guarantees correct performance of the sensor under unexpected suspension of power supply. 2) Trusted sensing mode: •TS1: Input data (X) are read. •TS2: The hyper-rectangle where the input data is located (X∈Pi) is determined. •TS3: The parameters (fgi) associated to the hyperrectangle, Piare extracted. •TS4: The PWAR unit output y=fPWA(x)is generated and the nonce counter is updated. •TS5: The message, that is, the concatenation of the nonce and the output of the PWAR unit, nonce ky, is absorbed and processed. •TS6: The trusted virtual sensor output is provided as the concatenation of the message with the HMAC, as follows sensorout =nonce kykHMAC (K, nonce ky) IV. IMPLEMENTATION RESULTS The trusted virtual sensor was synthesized in a 90-nm CMOS technology provided by Taiwan Semiconductor Manufacturing Company (TSMC). A standard low-power dualport SRAM IP module was employed for the SRAM. The register-transfer level specifications of the other blocks were synthesized using Design Vision tool from Synopsys. 1) Features of the design: •Security Unit. The key, K, has 60 bits, a= 60 and the nonce size is 32 bits, d= 32. To recover the key, a binary repetition code with codeword length r= 29 is employed. Therefore, the ID size is 60×29 = 1740 bits. The HMAC block is implemented with a fully serialized architecture of a PHOTON-80/20/16, as described in [12]. •PWAR unit. The maximum number of input variables, n, is 4. The bits of both the input variables x1, , x4and the parameters F G are 12. The bits of the output variable, y, are 26. The maximum number of hyper-rectangles, P= 2p, is 4096 (p= 12), and the maximum number of intervals per input, Lk= 2pk, is 128 (pk= 7). Hence, the SRAM has 4096 ×60 bits. 2) Area, power consumption and timing responses: Table I shows the power consumption during trusted sensing mode and the area and maximum frequency of the main blocks provided by Design Vision tool from Synopsys. The timing responses of the main operations in both behavioral modes are detailed in the following. The read of helper data from the NVM takes 30 clock cycles. Since only 64 ×60 bits of the SRAM are used as PUF, 64 clock cycles are needed to read the ID Mask from the NVM and other 64 clock cycles are needed to read the RND mask from NVM. The key recovering takes 5clock cycles. The seed generation and initialization of the nonce counter takes 2clock cycles. The PHOTON-80/20/16 needs 708 clock cycles to permute a block. Since one block has 20 bits and the key has 60 bits, the three blocks of the key are absorbed in 708 ×3 = 2124 clock cycles. In order to generate the PWA output, the input data are read in 4clock cycles, the address of the SRAM is generated in 1clock cycle, the read of the word fgifrom the SRAM takes 1clock cycle, and the computation of the PWA function takes another one. Then, 7clock cycles are needed. Finally, since the message size is 58 bits (32 bits of the nonce and 26 bits of the PWA output), the HMAC block absorbs 3 20-bit blocks in the first hash and squeezes 420-bit blocks to generate the first 80-bit output. In the second hash, 420-bit blocks are absorbed and squeezed. Hence, the HMAC block takes 708 ×(3 + 4 + 4 + 4) = 10620 clock cycles to provide the message digest. The configuration mode lasts the time that the NVM is being read, since the others operation can be executed in parallel. Then, it lasts at most 30 + 64 + 64 + 4096 = 4254 clock cycles. However, in trusted sensing mode, all the operations has to be executed serially, then it lasts 4+3+10620 = 10627 clock cycles. If the Security Unit is compared with the PWAR Unit (considering that the SRAM is needed by the PWAR Unit), the area occupation of the Security Unit is 5.1% of the area occupied by the PWAR Unit, and the power consumption of the Security Unit (in trusted sensing mode) is 15.4% of the power consumed by the PWAR Unit. Since the maximum operation of the sensor is 119 MHz (mainly due to the SRAM TABLE I POWER CONSUMPTION DURING TRUSTED SENSING MODE, AREA AND MAXIMUM FREQUENCY Power@100MHz Area Max. freq HDA block 0.00014 mW 0.002 mm21.6GHz Nonce counter 0.078 mW 0.001 mm2263MHz HMAC 1.38 mW 0.032 mm2215MHz Arithmetic block 0.48 mW 0.015 mm21.56GHz Address generator 0.033 mW 0.0007 mm22.63GHz SRAM 8.98 mW 0.67 mm2119MHz access time), the sensor can achieve response times lower than 90 microseconds. V. CONCLUSION A trusted virtual sensor integrated into a single CMOS chip that implements programmable PWAR-based models offers high versatility to be employed in different industrial applications. The main blocks in the sensor occupy less than 0.8mm2in a 90-nm CMOS technology and consume less than 11mW when trusted sensing at 100 MHz. Working at that frequency, the sensor allows sampling times of 106.3 microseconds. Its capability to authenticate the sensed data as well as the integrity of the sensor itself makes it very suitable for many applications where security is becoming increasingly important. ACKNOWLEDGMENT This work was supported in part by TEC2014-57971-R project from Ministerio de Econom´ ıa y Competitividad of the Spanish Government (with support from the PO FEDERFSE) and 201750E010 (HW-SEEDS) project from CSIC. M.C. Mart´ ınez-Rodr´ ıguez is supported by FPI fellowship program for Ph.D. Students from Spanish Government. The work of M.A. Prada-Delgado and P. Brox were supported by V Plan Propio de Investigaci´ on, University of Seville, Seville, Spain. REFERENCES [1] H. Li, D. Yu, and J. E. Braun, “A review of virtual sensing technology and application in building systems,” HVAC&R Research, vol. 17, no. 5, pp. 619–645, 2011. [2] R. Santamarta, “Go nuclear: Breaking radiation monitoring devices,” in BlackHat USA 2017, Las Vegas, 7 2017. [3] K. Rosenfeld, E. Gavas, and R. Karri, “Sensor physical unclonable functions,” in IEEE International Symposium on Hardware-Oriented Security and Trust (HOST), 2010, pp. 112–117. [4] S. Meguerdichian and M. Potkonjak, “Security primitives and protocols for ultra low power sensor systems,” in 2011 IEEE SENSORS Proceedings, Oct 2011, pp. 1225–1227. [5] O. Pfeiffer, Implementing Scalable CAN Security with CANcrypt: Authentication and Encryption for CANopen, J1939 and other Controller Area Network or CAN FD Protocols. Embedded Systems Academy Inc., 2017. [6] T. Poggi, M. Rubagotti, A. Bemporad, and M. Storace, “High-speed piecewise affine virtual sensors,” IEEE Trans. on Industrial Electronics, vol. 59, no. 2, pp. 1228 – 1237, 2012. [7] P. Brox, M. C. Mart´ ınez-Rodr´ ıguez, E. Tena-S´ anchez, I. Baturone, and A. J. Acosta, “Application specific integrated circuit solution for multiinput multi-output piecewise-affine functions,” International Journal of Circuit Theory and Applications, vol. 44, no. 1, pp. 4–20, 2016. [8] C. Paar and J. Pelzl, Understanding Cryptography: A Textbook for Students and Practitioners. Springer Berlin Heidelberg, 2009. [9] J. Turner, “The keyed-hash message authentication code (HMAC),” Patent USA, 2008. [10] I. Baturone, M. A. Prada-Delgado, and S. Eiroa, “Improved generation of identifiers, secret keys, and random numbers from SRAMs,” IEEE Transactions on Information Forensics and Security, vol. 10, no. 12, pp. 2653–2668, 12 2015. [11] J. Guo, T. Peyrin, and A. Poschmann, “The PHOTON family of lightweight hash functions,” in Advances in Cryptology-CRYPTO 2011, ser. Lecture Notes in Computer Science (LNCS),, vol. 6841, 2011, pp. 229–239. [12] S. Eiroa and I. Baturone, “FPGA implementation and DPA resistance analysis of a lightweight HMAC construction based on PHOTON hash family,” in 23rd International Conference on Field programmable Logic and Applications, 9 2013, pp. 1–4.