Design of hardware-based security solutions for interconnected systems

Design of hardware-based security solutions for interconnected systems Miguel Ángel Prada Delgado Department of Electronics and Electromagnetism Physical Sciences and Technologies (PS&T) Doctoral Programme University of Seville This dissertation is submitted for the degree of Doctor by the University of Seville with international mention Seville Institute of Microelectronics (IMSE-CNM) September 2019 Everything we hear is an opinion, not a fact. Everything we see is a perspective, not the truth. Marco Aurelio Acknowledgements First of all, I would like to acknowledge my advisor, Iluminada Baturone, for always being open to help and guide me throughout every challenge we have encountered. Without her unlimited patience and willingness to always go the extra mile, the results of this thesis would not have been possible. I would also like to thank the Institute of Microelectronics of Seville (IMSE-CNM) for hosting me for so many years. This center has been like my second home, and I have had the pleasure of sharing fantastic experiences with great colleagues. Thanks to Alfredo Vazquez, Javier Arcenegui, Macarena Martínez, Rosario Arjona, and Susana Eiroa, as well as the rest of my group for their invaluable contributions during our joint research. Thanks also to my office mates, Laurentiu Acasandrei, Angela Darie, and James Romaine, for the great moments we have spent together both professional and personal. I could not have had a better working environment. Regarding my doctoral stays, I would like to thank Jose Manuel Martínez who hosted me at the Harvard RCC, and Andreas Kind, Gero Dittmann, and Jens Jelitto, who welcomed me at the IBM Zurich Research Lab, as well as the working groups in both centers. I much appreciate you allowed me to collaborate and work with you. Last but not least, I would like to thank my wife, Anastasia, for her unconditional support, as well as my parents, Ángel and Antonia, my brother, Javier, and the rest of my family for helping me get where I am today. None of these would have been possible without them. Abstract Among all the different research lines related to hardware security, there is a particular topic that strikingly attracts attention. That topic is the research regarding the so-called Physical Unclonable Functions (PUF). The PUFs, as can be seen throughout the Thesis, present the novel idea of connecting digital values uniquely to a physical entity, just as human biometrics does, but with electronic devices. This beautiful idea is not free of obstacles, and is the core of this Thesis. It is studied from different angles in order to better understand, in particular, SRAM PUFs, and to be able to integrate them into complex systems that expand their potential. During Chapter 1, the PUFs, their properties and their main characteristics are defined. In addition, the different types of PUFs, and their main applications in the field of security are also summarized. Once we know what a PUF is, and the types of them we can find, throughout Chapter 2 an exhaustive analysis of the SRAM PUFs is carried out, given the wide availability of SRAMs today in most electronic circuits (which dramatically reduces the cost of deploying any solution). An algorithm is proposed to improve the characteristics of SRAM PUFs, both to generate identifiers and to generate random numbers, simultaneously. The results of this Chapter demonstrates the feasibility of implementing the algorithm, so in the following Chapters it is explored its integration in both hardware and software systems. In Chapter 3 the hardware design and integration of the algorithm introduced in Chapter 2 is described. The design is presented together with some examples of use that demonstrate the possible practical realizations in VLSI designs. In an analogous way, in Chapter 4 the software design and integration of the algorithm introduced in Chapter 2 is described. The design is presented together with some examples of use that demonstrate the possible practical realizations in low-power IoT devices. The algorithm is also described as part of a secure firmware update protocol that has been designed to be resistant to most current attacks, ensuring the integrity and trustworthiness of the updated firmware. viii In Chapter 5, following the integration of PUF-based solutions into protocols, PUFs are used as part of an authentication protocol that uses zero-knowledge proofs. The cryptographic protocol is a Lattice-based post-quantum protocol that guarantees the integrity and anonymity of the identity generated by the PUF. This type of architecture prevents any type of impersonation or virtual copy of the PUF, since this is unknown and never leaves the device. Specifically, this type of design has been carried out with the aim of having traceability of identities without ever knowing the identity behind, which is very interesting for blockchain technologies. Finally, in Chapter 6 a new type of PUF, named as BPUF (Behavioral and Physical Unclonable Function), is proposed and analyzed according to the definitions given in Chapter 1. This new type of PUF significantly changes the metrics and concepts to which we were used to in previous Chapters. A new multi-modal authentication protocol is presented in this Chapter, taking advantage of the challenge-response tuples of BPUFs. An example of BPUFs is illustrated with SRAMs. A proposal to integrate the BPUFs described in Chapter 6 into the protocol of Chapter 5, as well as the final remarks of the Thesis, can be found in Chapter 7. Table of contents List of figures xi List of tables xiii 1 Introduction 1 1.1 Physical unclonable functions (PUFs) . . . . . . . . . . . . . . . . . . . . 1 1.2 TypesofPUFs................................. 3 1.2.1 Non-electronic PUFs . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.2.2 Analog electronic PUFs . . . . . . . . . . . . . . . . . . . . . . . 4 1.2.3 Intrinsic PUFs based on delay . . . . . . . . . . . . . . . . . . . . 5 1.2.4 Memory-based intrinsic PUFs . . . . . . . . . . . . . . . . . . . . 5 1.3 Scenarios for the application of PUFs . . . . . . . . . . . . . . . . . . . . 6 1.3.1 Identification of systems . . . . . . . . . . . . . . . . . . . . . . . 7 1.3.2 Secret key generation . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.4 UseofSRAMsasPUFs............................ 9 1.5 UseofSRAMsasTRNGs .......................... 12 1.6 Conclusions.................................. 16 2 Identifiers, secret keys, and random numbers from SRAMs 17 2.1 Summary ................................... 17 3 Design of a VLSI module based on SRAM PUFs to authenticate things 19 3.1 Summary ................................... 19 4 SRAM PUF-based software solutions to increase security of Bluetooth IoT devices 21 4.1 Summary ................................... 21 2Introduction 4. Unclonable : Given Π , it is difficult to build a procedure Γ=Π such that ∀x∈X: Γ(x)≈Π(x)with a small error. 5. Unpredictable : Given only one set Q= (xi,yi=Π(xi)) , it is difficult to predict yc≈ Π(xc)with a small error, for xca random challenge such that (xc,·)/∈Q. 6. Unique direction: Given only yand Π, it is difficult to find xsuch that Π(x) = y. 7. Obvious alteration : An alteration of the integrated physical entity Π transforms Π into Π′ such that with a great probability ∃x∈X/Π(x) is greatly different from Π′(x) . After this, we will discuss in more detail the seven properties: 1. Whether a PUF is evaluable or not can be interpreted in a very general way. From a theoretical perspective, easy can mean that we want the evaluation to be possible in polynomial time and effort. From a practical point of view, this means that the evaluation that induces the lowest possible overload is desired, for example, given the time, area, power and energy restrictions of an integrated circuit. It should also be noted that if the PUF is evaluable, it is implicit that it should be simple its fabrication. 2. Regarding the description of the property of uniqueness, if a well-defined set or population of PUF instances is considered, the information contained in a response of the PUF Π(x) allows selecting a partition of the population, with the PUF instances able to provide that response. Successive responses allow having smaller and smaller partitions of the population until only a single instantiation of the PUF is optimal, in which case the set of unique responses identifies the PUF in the population. Based on the size of the population and the characteristics of the PUF response, such a unique identification may or may not be possible. A possible measure of the uniqueness that is provided in most experimental results is the Inter-Class Hamming distance histogram, obtained from the Inter-Class Hamming distance histogram, in particular from its average value of avgInterHD. 3. The property of repeatability or reproducibility is clear from its description. The responses to the different evaluations of the same challenge x in the same PUF Π must be close in the considered metric distance. For experimental results, this is measured from the Intra Hamming distance histogram, in particular from its average value avgInterHD . Reproducibility is the characteristic that distinguishes PUFs from true random number generators (TRNGs). 4. As can be expected from its name, unclonability is the main property of a PUF. The description provided is relatively obvious, however, there are many details that 1.2 Types of PUFs 3 should be taken into consideration. First, if it is difficult to reach a physical entity that contains another PUF ΠΓ=Π such that ∀x:ΠΓ(x)≈Π(x) . We say that Π is not physically clonable. The difficulty of producing a physical copy exists even for the manufacturer of the original PUF Π . That is why this property is also called manufacturer resistance. If it is difficult to find a mathematical procedure (abstract) fΓ such that ∀x:fΓ(x)≈Π(x) , we say that Π is not mathematically clonable. The physical and mathematical unclonability have different properties, since the construction can be easy to copy physically but not mathematically, and vice versa. In order to be truly unclonable, Π has to be both physically and mathematically unclonable. Once again, the difficulty of cloning can be considered from a theoretical and a practical point of view. In practice, cloning can be very difficult or unfeasible. On the other side, proving the theoretical unclonability is very difficult. The only known system that can be proved as theoretically unclonable is based on quantum physics. 5. Unpredictability is in fact a relaxed form of unclonability. If you can correctly predict the outcome of a PUF for a random challenge, only from observing a set of responses, it is easy to build a mathematical clone if you have access to the full PUF. Therefore, predictability implies mathematical clonability, and consequently clonability [1]. 6. Unidirectionality is a classic property derived from cryptography. The first definition of PUF describes them as a physical variant of one-way functions. 7. Over time, a number of notions were proposed in the literature in relation to manipulation and security against manipulation. As an alteration or manipulation, we understand the realization of permanent changes to the integrity of the physical entity. We will call evident manipulation of the PUF to the manipulation of the physical entity integrated in the PUF, which with high probability changes the behavior of the PUF response. 1.2 Types of PUFs In this section a list of the possible PUFs by category is presented, distinguished basically by their construction and operating principles. It should be noted that we will not go into detail in PUFs that do not have a direct relationship with this document, but rather we will focus on memory-based PUFs. On the rest of these PUFs you can find information on [3]. 1.2.1 Non-electronic PUFs In this section we will mention some PUFs that are not based on inherently electronic designs. However, electronic and digital techniques are often used to store the response of the PUFs 4Introduction efficiently. Therefore, the common denomination as non-electronic PUFs only indicates that the random nature that makes the PUF unique is not electronic, but does not imply that there is no subsequent measurement, storage and electronic processing. Some of these PUFs are: 1. Optical PUFs : They use a sample with an optical microstructure of refracting glass spheres in a transparent epoxy base. After irradiating the sample with a helium-neon laser, they produce a pattern due to scattering that is captured by a CCD sensor and processed by computer. The pattern obtained depends on the angle of incidence of the laser beam, so the challenge of this PUF is described by a precise laser incidence angle and the output pattern due to scattering. 2. Paper PUFs : We call paper PUFs those that consist in scanning the unique and random fiber structure of a normal or modified paper. The reflection of light from the paper is measured when a laser beam (for example, from a normal scanner) impinges on it to prevent its falsification. 3. CDs PUFs : There is a measurable deviation by a conventional CD player in the expected lengths of the valleys and ridges of the CDs, being unique in each CD. 4. Radiofrequency PUFs : The same sample is used as for the optical PUFs, except that the incident signal is of radio frequency and the pattern of electromagnetic radiation emitted by the dispersion is measured. 5. Magnetic PUFs : Use the uniqueness of particle patterns in magnetic media, such as credit cards. 6. Acoustic PUFs : Acoustic delay lines are used to delay electrical signals. The PUF is based on observing the alteration and the delay produced by these lines in the frequency spectrum. 1.2.2 Analog electronic PUFs This section will list some PUFs that consist of the measurement of some electrical or electronic quantity. Some of them are [3, 4]: 1. VTPUFs : They are based on measuring the charge of a capacitor due to the voltage VT of each transistor, which is partially random due to the manufacturing process. 2. Power distribution PUFs : They are based on the variation of the resistance of the power supply network of a chip. Each power supply network is different and depends on the manufacturing process. 1.2 Types of PUFs 5 3. Layer PUFs : They measure the variation of the capacity of a sensor in the form of a comb in the upper layer of an integrated circuit. Randomness is introduced explicitly by means of a passive dielectric sprayed on the upper layer of the sensors. 4. LC PUFs: The LC PUFs are constructed with a glass plate and two metal plates, one on each side forming a capacitor connected in series with a metal coil. Together they form a passive LC circuit that stores energy inside an RF field. After a frequency scan, the resonance frequency is obtained, which is unique due to the fabrication. 1.2.3 Intrinsic PUFs based on delay They are based in principle on the analogical measurement of a random physical parameter, which is later quantized and used to identify the whole system. To denominate intrinsic to a PUF it must fulfill that the PUF and the elements of measure are integrated in the device, as well as that the PUF construction must consist of procedures and primitives that are available naturally in the manufacturing process of the integrated device. Again, we list some of them [3, 4]: 1. Arbiter PUFs : The main idea is to introduce a digital competition condition by two paths on a chip, and have an arbiter decide which of the two paths wins the race. If the two paths are symmetrical you can not know in advance which will be faster because the difference will depend on the physical parameters of manufacture. The paths must be long enough so that they do not violate the setup and hold time of the arbiter. 2. Ring oscillator PUFs : The ring oscillators work with inverters that feed the output with the input, inverting it asynchronously. The result is an output signal that oscillates at a frequency dependent on the delay of the inverter line. The PUFs based on ring oscillators measure the deviation of this frequency caused by manufacturing variations. 1.2.4 Memory-based intrinsic PUFs In this section we will talk about the PUFs that are most related to this Thesis. A digital memory cell is typically a digital circuit that can be found in more than one stable state. In one of those states, the cell stores information (a binary digit, bit, in case of having two states). However, if it is used in a state of unstability, it is not known with certainty what value it will take when it stabilizes. Some cells have a tendency to always take a concrete state. This is due to variations in the manufacturing process, so we can use this information as a PUF. Based on this principle, we can distinguish some PUFs like the ones listed below [ 3 , 4 ]: 6Introduction 1. SRAM PUFs : SRAMs (or Static Random-Access Memories) are formed by cells, each of which can store a binary digit. As shown in Figure 1.1(a), the cells are formed by two inverters fed back to each other. In conventional CMOS technology, these inverters are implemented with four transistors as shown in the Figure 1.1(b). It is not known with certainty when the SRAM memory is fed the value that each cell will take, since some have a preference to take value ‘0’, others value ‘1’. This information can be used to generate a digital identifier (ID) number. (a) (b) Fig. 1.1 (a) SRAM cell logic circuit and (b) SRAM cell electrical circuit in CMOS technology. 2. “Butterfly” PUFs cells : This type of cells have been tested in FPGAs. The type of cell used is shown in the Figure 1.2(b). These cells can be returned to a state of unstability using the preset and clear signals, which is perfectly comparable to the unstability after being powered up. 3. Latch PUFs : A latch PUF is very similar to SRAM PUFs. The difference is that the latch uses two cross-coupled NORs instead of two inverters. After receiving a reset signal, the latch becomes unstable as it happens with the SRAM memory cells. A diagram of the logical circuit is shown in the Figure 1.2(a). 4. Flip-flops PUFs: They are equivalent to PUFs with SRAM, but using flip-flops. 1.3 Scenarios for the application of PUFs In this section we will summarize the different applications of the PUFs, which are fundamentally: system identification (explained in Section 1.3.1) and secret key generation (Section 1.3.2). 1.3 Scenarios for the application of PUFs 7 (a) (b) Fig. 1.2 (a) Logic circuit of a latch and (b) schematic of a PUF cell “butterfly”. 1.3.1 Identification of systems Due to the unclonability property, using PUFs for identification is very interesting for anticounterfeiting technology. The PUF response can be used directly for identification in a manner very similar to a biometric identification scheme. During an “enrollment” phase, a series of information of all the PUFs of the population are stored in a database, together with the identity of the PUF integrated in the system. During the identification, the identifier chooses a random challenge and requests a response to the PUF. If the response is sufficiently close to the correct one, the system is identified, otherwise an error occurs. In order to avoid repetition attacks, each stored information must be removed from the identifier after identification and used only once. The threshold to accept an identification depends on the distance between the Intra Hamming distance and the Inter Hamming distance. If both histograms do not overlap, the identification can be made by setting a threshold at an intermediate point between them. If they overlap, you have to establish limits to meet a compromise between the false acceptance rate (FAR) and the false rejection rate (FRR). The choice of the optimal decision threshold for the FAR and the FRR is shown in the Figure 1.3. Other types of thresholds may be desirable according to the purpose of application (for example, a threshold that ensures a false null rejection or a false null acceptance). 1.3.2 Secret key generation PUFs intrinsic to integrated circuits have interesting properties for secret key generation and storage. Since the key is generated from an intrinsic randomness introduced by unavoidable 8Introduction Fig. 1.3 Choosing the optimal threshold for FAR and FRR manufacturing variations, an explicit programming step of the key is not necessary, which simplifies its distribution. On the other hand, since this randomness is fixed permanently in the physical (sub-) microscopic details, a non-volatile memory is not necessary for the storage of the key. This also offers additional security against attacks, invasive and semi-invasive attacks, since the key is not stored in digital format, but only stored in volatile memories when it is required to perform operations. In addition, the evidence of manipulation of the PUFs can be used to provide counterfeit-proof key storage. Uniform randomness and reliable keys are necessary for cryptographic algorithms. If the responses of the PUFs are noisy and contain a limited amount of entropy, they can not be used directly as keys. An intermediate processing is necessary to extract the key from the response. This problem is known in information theory as the extraction of nearby secrets and is usually solved by a two-phase algorithm. During the initial phase of generation, the PUF is queried and the algorithm provides a secret key along with some additional information usually called helper data. In the reproduction phase, the verifier delivers the helper data to the algorithm that uses it to extract the same key from the PUF as in the generation phase. In this way, the device contains the PUF and the verifier has a stable secret key. It is possible to build these algorithms in such a way that the key is completely secret, even if the helper data is observed, for example, in the case that the helper data is publicly communicated from the verifier to the device. Instances of these algorithms have been proposed in [ 5 ] and the cost of implementing them is discussed in [6, 7]. 1.4 Use of SRAMs as PUFs 9 1.4 Use of SRAMs as PUFs SRAM PUFs, which were introduced in [ 8 ], and are based on feedback circuits (see Figure 1.4) that have two stable states of operation and one unstable. If the circuit is at the unstable state, the slight differences between the two symmetrical parts make it tend to a stable state. This means that every time the cell is powered, it will give the output value ‘0’ or ‘1’ depending on the relative differences between the inverters. Therefore, the output value of each memory element depends on variations in the manufacturing process and the noise that may affect the element. Fig. 1.4 Basic structure of a SRAM cell The ID obtained from the SRAM PUFs is formed by the concatenation of the output values of different memory locations, ideally, forming a single random sequence. Therefore, the challenges of SRAM PUFs are the memory positions that generate the response. It is also necessary that the PUFs used for IDs or generation of secret keys comply with certain statistical characteristics in order to ensure uniqueness (for security) and repeatability (for reliability). The viability of the SRAM PUFs depends on the sensitivity of the memory cells to the environment, where the circuit will be used at certain values of temperature and supply voltage. The PUF internal characteristics are basically defined by variations in the manufacturing process, but may vary due to stress conditions or aging. Under certain circumstances, some especially sensitive cells can provide different initialization values from one experiment to another when they are excited with the same challenge (in the same memory locations). This is known as a “bit flipping” effect [ 9 , 10 ]. This effect is decisive for the behavior of the PUF and clearly decreases the uniqueness and reliability. In order to characterize the SRAM PUFs completely, and therefore, to analyze the possible impact on the structure of these effects it is important to understand the basic principles of the constituent elements, which usually consist of two crossed inverters and two other access transistors. A typical SRAM 6-T CMOS structure is shown in the Figure 1.5. Ideally, the manufacturer would like to be able to implement the two inverters of the SRAM cell as identical as possible, since this improves the power and speed characteristics of the memory [ 3 ]. However, in reality, due to variations in the manufacturing process, there 10 Introduction Fig. 1.5 Internal structure typical of a SRAM 6-T CMOS cell are small differences (or “mismatching”) in the cells, which means that the inverters will not have exactly the same behavior. In practice, SRAM cells are built with the appropriate width and length dimensions between different transistors [ 11 ], in such a way that these fluctuations do not affect reading or writing in a habitual way. However, during start-up, inverters are not subject to any external input signal. On the other hand, any minimum voltage difference will cause one of the two to start conducting before the other. This will cause the cell to be displaced toward ‘0’ or toward ‘1’ due to the amplifying effect produced by the feedback of the output of each inverter with the input of the other. Holcomb and Cortez in [ 12 , 13 ], already divide the cells depending on their Voltage Transfer Curve (VTC), between those that have a high displacement (“asymmetric cells”) and therefore a greater probability of evolving to a stable state (‘0’ or ‘1’), and those that do not have a strong tendency toward any state and start with any state, either ‘0’ or ‘1’ (“neutral cells”). Figure 1.6 shows a neutral cell not displaced and a cell completely displaced in VTC for both elements. Due to the characteristics of the SRAM PUFs, and like any memory structure, they are susceptible to aging that can deteriorate in a different way the threshold voltage of the transistors, channel length, etc. causing an initially neutral cell to exhibit some displacement. Guajardo in [ 8 ] estudied this effect on the start-up of SRAMs integrated in Xilinx devices, by simulating the use of a normal memory by writing ‘0s’ and ‘1s’ and maintaining the state of memory around 10 minutes per every writing. The results obtained on the SRAM restart values, showed that this affects in a very small way the initial value of the SRAM (less than a 5% variation). Holcomb in [ 13 ] also analyzes the influence of Negative Bias Temperature Instability (“NBTI”) on start-up values. The NBTI study consists in modifying the threshold voltage ( VT h ) of the MOS transistor over time due to stress conditions applied by temperature changes. This effect has more influence on PMOS transistors than on NMOS [ 14 ]. After 1.4 Use of SRAMs as PUFs 11 (a) (b) Fig. 1.6 (a) VTC for neutral cell and (b) VTC for asymmetric cell. the stress situation ceases, the devices begin to recover. If used in a normal manner, the devices operating intermittently at low temperatures, NBTI should not be of concern as most cells can recover their neutral state. However, if the state of high temperature remains, the recovery is not fully realized, so the cells remain asymmetric permanently because of this effect, as in the case of aging or asymmetry due to the manufacturing process. The effect of temperature on CMOS is well studied in the literature, as well as its threshold voltage ( VT h ) and the electron-hole mobility ( µ ) both dependent on the increase in thermal noise. The temperature thus influences the inclination of the VTC curves of the cells and therefore their final value. Nevertheless, as already presented in [ 13 ], those parameters that counteract this effect, such as the threshold voltage or mobility, have the same dependence on temperature but the opposite impact due to the sub-threshold current. This effect, together with the increase in the noise present with the temperature, makes the SRAM start-up values difficult to model. In addition, the influence of each MOS transistor in the start-up value of an SRAM cell is difficult to model since they are cross-coupled. Therefore, the only way to characterize SRAM is to measure the probability of a cell to be initialized at a certain value. There is a difference between the impact of temperature variation on the displacement of the cell and the mismatch, aging or NBTI, which is that the temperature does not permanently affect the displacement as do the other parameters. Therefore, a high increase in temperature can convert an asymmetric cell into a neutral or vice versa, but as soon as the temperature is restored, the cell will behave as initially did due to the other parameters. Compared to the previous effects, the variations in the power supply do not affect the displacement of the cells, but they influence the “Static Noise Margin” (SNM) of the cells that quantifies the immunity of the SRAM cells against noise. The SNM of a given cell at a 18 Identifiers, secret keys, and random numbers from SRAMs a module for implementing the method in an ASIC designed in the 90-nm TSMC technology occupies an active area of 42,025 µm2. Chapter 3 Design of a VLSI module based on SRAM PUFs to authenticate things 3.1 Summary The algorithm proposed in Chapter 2 is lightweight enough to be carried out as a module and implemented in a VLSI system. Throughout this Chapter, details about the hardware implementation of this module have been shown, including its operating modes and architecture. The control block of the module was explained in detail, since it is in charge of the management of the other blocks, such as the read and write of a SRAM acting as a PUF. With this module, it is possible to guarantee that a unique circuit generates the information sent and that the integrity of that information is not compromised. For that purpose, the Part of the content of this Chapter was patented as “Method and device for generating truly random numbers and identifiers” on July 2016, with patent number ES2548792 B1. An FPGA demo of prototype presented in Subsection 3.5 was published as “Robust unclonable identifiers and true random numbers from off-the-shelf SRAMs” in the Proceedings of the 2014 Conference on Design and Architectures for Signal and Image Processing (DASIP) on June 2015, with DOI: 10.1109/DASIP.2014.7115613. A detailed version of the VLSI design presented in Subsection 3.6 was published as “A VLSI module to authenticate unclonable things” in the 2015 International Symposium on Consumer Electronics (ISCE) on June 2015, with DOI: 10.1109/ISCE.2015.7177831. Adapted versions of this design were published as “CMOS digital design of a trusted virtual sensor” in the IEEE Nordic Circuits and Systems Conference (NORCAS): NORCHIP and International Symposium of System-on-Chip (SoC) on October 2017, with DOI: 10.1109/NORCHIP.2017.8124948, and as “VLSI Design of Trusted Virtual Sensors” in Sensors Journal on January 2018, with DOI: 10.3390/s18020347. 20 Design of a VLSI module based on SRAM PUFs to authenticate things module can be used to reconstruct de key and to generate the nonces required by an authentication protocol. This has been illustrated with a lightweight protocol based on symmetric cryptography. The following Chapter shows how the algorithm is so lightweight that it can be integrated not only in hardware but also in software in low-power and resources-constrained IoT devices. Chapter 4 SRAM PUF-based software solutions to increase security of Bluetooth IoT devices 4.1 Summary The use of SRAM start-up values to reconstruct the secret shared keys between different IoT devices adds another security layer to current systems, such as key fobs and smart locks, sensors nodes, or connected cameras. The use of PUFs inside the BLE hardware of IoT devices improves the security of firmware updates because the devices can be uniquely identified at low cost. In particular, using the entropy generated by their SRAM, the devices Part of the content of this Chapter was published as “Physical unclonable keys for smart lock systems using Bluetooth Low Energy” on October 2016, with DOI: 10.1109/IECON.2016.7792955, as a complete version of the smart locks example presented in Subsection 4.3.6. A detailed version of the nodes example presented in Subsection 4.3.6 was published as “A PUF- and Biometric- Based Lightweight Hardware Solution to Increase Security at Sensor Nodes” in Sensors Journal on July 2018, with DOI: 10.3390/s18082429. A detailed version of the camera example presented in Subsection 4.3.6 was published as “Trusted Cameras on Mobile Devices Based on SRAM Physically Unclonable Functions” in Sensors Journal on October 2018, with DOI: 10.3390/s18103352, and as “Using Physical Unclonable Functions for Internet-of-Thing Security Cameras” in the SaSeIoT 2017: Interoperability, Safety and Security in IoT Conference on July 2018, with DOI: 10.1007/978-3-319- 93797-7_16. A detailed version of the protocol presented in Section 4.4 was published as “Trustworthy firmware update for Internet-of-Thing Devices using physical unclonable functions” in the 2017 Global Internet of Things Summit (GIoTS on August 2017, with DOI: 10.1109/GIOTS.2017.8016282. 22 SRAM PUF-based software solutions to increase security of Bluetooth IoT devices can store all the secret keys obfuscated instead of in clear, and they can derive new fresh keys from the previous ones. Besides, since SRAMs are available in BLE chips, security is increased with no additional cost in hardware. A registration process is required to generate the public data that are stored in the nonvolatile memory of the physical key. In the case of key fobs based on the CC2541 BLE system on chip from Texas Instruments, a firmware was developed to reconstruct the secret key using the mask and helper/debiasing data and a repetition decoder without previous information about the secret key. The firmware was tested successfully in real scenarios that contain a CC2541 SoC and connected devices. Experimental results with BLE chips of IoT devices confirm that the obfuscated data do not reveal sensitive information and that the keys needed by the proposed algorithms are successfully reconstructed by only the original device. In addition, the nonces generated by the SRAM device are adequate to be used in Key Derivation Functions according to NIST. These results show how the security in BLE devices can be improved without any hardware modification but exploiting the existing hardware in the BLE chips. This opens the way to many other interesting security applications in industrial control systems and factory automation. After demonstrating the integration possibilities in simple protocols for applications such as the secure firmware update, the next natural step is to think about integrating PUFs into cryptographically secure protocols. Therefore, throughout the next Chapter, the integration and implementation of a zero-knowledge protocol in a microcontroller will be developed, making use of the algorithm for extracting PUFs widely studied in previous Chapters. This new design will allow having a completely closed system, which is connected to the physical identity of the device and which in turn cryptographically guarantees the integrity and anonymity of the device’s identity. Chapter 5 PUF-derived IoT identities in a zero-knowledge protocol for blockchain 5.1 Summary and future work We have described a novel anti-counterfeiting approach for IoT devices exploiting unique characteristics of memory chips for deriving a cryptographic secret combined with a blockchain for trusted and reliable verification of device identities. We have evaluated the approach with a microcontroller from Texas Instruments under different operating conditions. The results demonstrate the robustness of the approach in a wide range of temperatures, reducing the noise in the PUF responses by up to 90% compared to unprocessed responses. These results together with the implementation of the ZK-proof protocol go beyond related work by [ 23 ] in that the secret key is never known by the manufacturer and never leaves the device, facilitating both the authentication and the traceability of products by third parties. We see a number of areas for future work. First, the results obtained for the Texas Instruments microcontroller need to be reproduced with a variety of memory types and The content of this Chapter was published as “PUF-derived IoT identities in a zero-knowledge protocol for blockchain” in the Elsevier Internet of Things Journal on May 2019, with DOI: 10.1016/j.iot.2019.100057. A summary of the content of this Chapter was published in a joint colaboration paper called “Crypto anchors” in the IBM Journal of Research & Development on February 2019, with DOI: 10.1147/JRD.2019.2900651. 24 PUF-derived IoT identities in a zero-knowledge protocol for blockchain microcontrollers. It would be important to pick configurations that are expected to be used in IoT deployments. For instance, wearable electronics and automation use cases are emerging in the coming years – many of them related to safety-critical functions that require protection from counterfeiting. A second area for future work is to increase the accuracy and robustness of the fuzzy extractor, particularly under varying operating conditions, as well as implementing a computational fuzzy extractor. We have already investigated the influence of temperature. The impact of other operating conditions in empirical investigations needs to be understood. In this context, a framework and best practice to handle false-positive and false-negative identifications should be developed. A third area is to investigate possible attack vectors and develop a threat model for attacking the approach. This model would include deliberately making a device not identify correctly, either in a denial-of-service attack or for staying unnoticed, as well as making a cloned device identify as an original device. Such attacks can be extended from identification into monitoring and control functions. On the other hand, more invasive attacks such as DPA should be considered which depend very much on the particular implementation. Moreover, during the next Chapter, a new type of PUF will be presented that could be integrated into the zero-knowledge protocol explored throughout this Chapter. The integration between the PUF that will be proposed and the design described above will not be carried out in this Thesis, but it is also recommended as future work. Chapter 6 Behavioral and Physical Unclonable Functions (BPUFs): SRAM example 6.1 Summary The BPUFs proposed in this Chapter are tamper resistant, and tamper-evident to the physical attacks reported to current PUFs because those attacks change the behavioral responses of the BPUFs. Physical clones of BPUFs are more challenging to obtain since behavioral responses evaluate dynamic features. Experimental results with SRAM BPUFs show that the highest probability of an attacker to succeed in mathematically cloning the behavioral responses is as low as 1.5·10−34. While Hamming distance is employed to measure the similarity of current PUF responses, this Chapter shows that Jaccard distance is more suitable for evaluating behavioral responses. While the values of the bits are employed to measure the unpredictability of current PUF responses, this Chapter shows that binary-coded positions of the bits are more suitable for evaluating behavioral responses. The content of this Chapter has been patented as “A behavioral and physical unclonable function and a multimodal cryptographic authentication method using the same” on July 2019 with Application Number EP19382623.7, and submitted for publication as “Behavioral and Physical Unclonable Functions (BPUFs): SRAM example” to the IEEE Access Journal on July 2019. 26 Behavioral and Physical Unclonable Functions (BPUFs): SRAM example The multimodal authentication protocol proposed is lightweight since it is based on symmetric cryptography. It obfuscates all the sensitive data (physical responses and cryptographic key with helper data algorithms and behavioral responses with salting techniques) and uses fresh data so that a non-protected communication channel can be employed between the BPUF instance and the verifier. As an example of BPUFs, SRAM BPUFs have been presented and characterized experimentally using low-power dual-port 8-transistor SRAMs fabricated in 90-nm CMOS technology, considering nominal and non-nominal operating conditions (changing power supply voltage and temperature as well as aging the circuits). Chapter 7 Final remarks Throughout this thesis, SRAM PUFs have been analyzed, showing how not only variations in the manufacturing process affect their behavior but also the operating conditions of the circuit. In order to improve the response of the PUFs in Chapter 2, a classification algorithm has been proposed that selects the cells with a more stable behavior, as well as those that have a more unstable behavior. We have shown how the response of the stable cells selected by this algorithm can be used to generate identifiers or reconstruct secret keys, while unstable cells can be used to generate true random numbers. We have also demonstrated how this selection algorithm can be integrated in VLSI hardware designs, as well as in the software of low-power Bluetooth enabled SoC in Chapters 3 and 4. This simplicity makes it ideal for integration into IoT devices, allowing to take advantage of the SRAM PUF of these simple circuits for adding a new security element. In addition, given the improvement in the quality of the identifiers and secret keys generated, it has been shown how they can be introduced into secure protocols. Among them, in this thesis a secure firmware update protocol has been proposed, as well as an authentication based on zero knowledge proofs that use PUFs to generate the secret key of the protocol. Finally, a new type of PUF that we have called BPUF has been proposed based on the dynamic behavior of SRAM cells. This new type of PUF presents, unlike traditional PUFs, the property of liveness, and it showed behavior that has required defining new metrics and analysis methods. Miguel A. Prada Delgado ·Postdoctoral Researcher at IBM ·Zurich, Switzerland ·[email protected] ·+41 77 988 2491 10/2013 - 10/2014 M.Sc. in Micro/Nano Electronics Faculty of Physics (Seville) Highest GPA Award from the University of Seville received in 10/2014 Master Thesis: “Unclonable Identifiers and TRNG from Static Memory Cells” 09/2008 - 09/2013 B.Sc + M.Sc. in Telecommunication Engineering ETSI (Seville) 300 ECTS Degree. Subjects from CS, electronics, telematics, RF comm. and robotics Master Thesis: “Use of PUFs based on Static Memory Cells for Security Applications” Awards and recognitions 09/2017 - 12/2017 Research visit scholarship Harvard University (Boston) Three months scholarship from the Real Colegio Complutense at Harvard University 06/2016 Spinf-off public recognition University of Seville Oclose Inc. was publicly recognized as Spin-off of the University of Seville 09/2014 - 09/2015 1-year acceleration of Oclose Inc. from Telefonica El Cubo (Seville) Oclose Inc. received one year of acceleration from Telefonica startup accelerator 06/2015 Invited speaker in “Coffee with Science” University of Seville Participated as speaker in “Coffee with Science” day in the University of Seville 12/2014 - 12/2018 Ph.D. scholarship University of Seville Received a four-year Ph.D. grant from the V Research Plan of the University of Seville 10/2014 Highest GPA Award University of Seville M.Sc. in “Microelectronics: Design and Applications of Micro/Nanoscale Systems” 06/2014 Best business project. e10,000 award University of Seville Winners of “IX Contest of Business Initiatives” contest against more than 200 projects 06/2014 Best Master Thesis project. e500 award University of Seville Winner of “IX Contest of Business Initiatives” contest of Master Thesis projects Leadership and entrepreneurship 02/2016 - present Co-organizer of Ethereum Meetup Group La Colmena (Seville) Teach free seminars about blockchain and smart contracts programming Organize periodical meetings to work with cryptocurrency miners and testnets 09/2014 - 06/2018 Co-founder and CEO Oclose Inc. (Seville) Lead the team to design and manufacture secure IoT devices for our scalable network Accelerated by Telefonica. Got working MVP and multiple contracts with SME 11/2013 - 09/2014 Project lead Apenkey (Seville) Invented authenticated products using Physical Unclonable Functions as fingeprints Winners of US contest against more than 200 projects. Awarded with e10,000 linkedin.com/in/maprada ·github.com/entropicture