This article discusses a technology called physical unclonable functions (PUFs) and shows how this technology can help chip vendors and device manufacturers to generate and securely store cryptographic keys that will keep their devices, data, IP, and systems safe from attackers.

How Physical Unclonable Functions (PUFs) are Creating Trust

<p><em>The RESCURE consortium, consisting of the companies&nbsp;</em><a href="https://technikon.com/" target="_blank"><em>Technikon</em></a><em>&nbsp;and&nbsp;</em><a href="https://www.intrinsic-id.com/" target="_blank"><em>Intrinsic ID</em></a><em>, along with the&nbsp;</em><a href="https://www.tue.nl/en/" target="_blank"><em>Eindhoven University of Technology (TU/e)</em></a><em>, was created to address the need for a security solution that spans the lifecycle of devices in the Internet of Things (IoT). The solution provided by the consortium resolves security vulnerabilities in this lifecycle using SRAM Physical Unclonable Function (PUF) technology in combination with state-of-the-art cryptography and security protocols.</em></p><p><br></p><p>The IoT is expanding fast, and so are risks to its security. The fact that IoT devices are deployed frequently with failing security implementations becomes clear with even a quick look at <a href="https://nvd.nist.gov/vuln" target="_blank">NIST’s National Vulnerability Database</a>. This database includes instances of devices with <a href="https://nvd.nist.gov/vuln/detail/CVE-2019-17391" target="_blank">poorly hidden</a> or <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-16546" target="_blank">repeated</a> secret keys, <a href="https://nvd.nist.gov/vuln/detail/CVE-2019-13523" target="_blank">improper</a> – or <a href="https://nvd.nist.gov/vuln/detail/CVE-2020-6769" target="_blank">absent</a> – authentication, and <a href="https://nvd.nist.gov/vuln/detail/CVE-2020-9544" target="_blank">unguarded software update conduits</a>, to name just a few security issues known to exist in devices already in the field.</p><p>The consequences of any IoT breach can be severe as IoT devices are often used in safety-critical applications, such as transportation systems, smart electricity grids, and water-supply systems. Compromising a single device, even a seemingly insignificant one, can bring down complete infrastructures, violate the privacy of millions of people, and disclose confidential data. Because IoT devices typically run autonomously across a broad range of untrusted environments, it can be very difficult to detect an attack quickly, and very costly to physically access the devices for repairs.</p><p>Protecting an IoT device is complex. It not only has to be protected in the field, but during its entire complex and far-flung lifecycle. Various phases of the lifecycle of an IoT device involve different parties with a variety of security needs. Often, there is no one party among these varied players that has any incentive, expertise, or even ability to completely take care of security.</p><h1>RESCURE</h1><p>RESCURE is a project funded by the EU and the EUREKA programme <a href="https://www.eurostars-eureka.eu/" target="_blank">Eurostars</a> (Grant: E11897, project duration: February 2018 - April 2020). The goal of the project, consisting of the companies <a href="https://technikon.com/" target="_blank">Technikon</a> and <a href="https://www.intrinsic-id.com/" target="_blank">Intrinsic ID</a>, along with the <a href="https://www.tue.nl/en/" target="_blank">Eindhoven University of Technology (TU/e)</a>, has been to provide a flexible framework that allows IoT device security to be updated throughout the entire lifecycle of the device.</p><p><span class="fr-video fr-deletable fr-fvc fr-dvb fr-draggable" contenteditable="false" draggable="true"><iframe width="640" height="360" src="https://www.youtube.com/embed/MJ7lsTwl2iE?&amp;wmode=opaque" frameborder="0" allowfullscreen="" class="fr-draggable"></iframe></span><br></p><p>RESCURE achieves this by retrofitting security on existing IoT devices using a low-cost solution, based on SRAM PUF technology. Tiny uncontrollable variations in the manufacturing of SRAM transistors lead to SRAM start-up behavior that is unique for every individual chip. SRAM PUF technology uses SRAM start-up data as a “silicon fingerprint” for the microcontroller unit (MCU), turning this unique property of SRAM into an unclonable device identity by deriving a device root key from the silicon fingerprint. This root key is never stored on the device, but instead it is generated only when needed.</p><p>The main advantages gained from this method of key generation and storage are: &nbsp;</p><ul><li>High security, as no root key is programmed externally and it is never stored</li><li>Low cost, as no costly protected memory or other security hardware is required</li><li>High flexibility, as it is even possible to retrofit this security on deployed devices</li></ul><h1>Security for the Complete Device Lifecycle</h1><p>Using this technology, RESCURE has created a working prototype of its security architecture that protects an IoT device throughout its lifecycle:</p><ul><li>Manufacturing – Manufacturers need to make sure each device has a unique identity. This identity is used to connect securely to a cloud service, typically using a Public Key Infrastructure (PKI). The devices also need to have secure storage for sensitive data, such as IoT measurement data and valuable software IP.</li></ul><p>In the RESCURE security architecture, an SRAM PUF is enrolled on the device in the manufacturing stage, allowing it to create device-unique keys. These include public/private keypairs for setting up secure cloud connections, as well as symmetric keys that are used for protecting all valuable data and IP on the device. These secret keys are only available at runtime and are never stored on the device, so they can never be stolen. The silicon fingerprint of each device is unique; and because the secret keys are derived from this unique fingerprint, there is no possibility of secret keys from one device being copied to another device.</p><p><img class="fr-fic fr-dib" src="https://images.wevolver.com/eyJidWNrZXQiOiAid2V2b2x2ZXItcHJvamVjdC1pbWFnZXMiLCAia2V5IjogImZyb2FsYS8xNTk0MTExMjUxMzI4LUxpZmVjeWNsZS5qcGciLCAiZWRpdHMiOiB7InJlc2l6ZSI6IHsid2lkdGgiOiA5NTAsICJmaXQiOiAiY292ZXIifX19" style="width: 786px;"></p><p>After the manufactured devices are sold, typically to Service Providers (such as energy suppliers or railway operators), who place them in the field. These Service Providers handle the next phases of the IoT lifecycle:</p><ul><li>Setup &amp; Pairing – The generated public/private keypairs are used to obtain device unique certificates. With these certificates the devices are authenticated to the cloud and trusted PKI connections between device and cloud are established.</li><li>Operation – If the data is only encrypted while travelling from device to cloud, it can be decrypted in the cloud before it reaches the Service Provider. To guarantee data remains encrypted until it reaches its destination, another keypair is generated to apply end-to-end encryption from the IoT device to the cloud of the Service Provider. Additionally, all sensitive data on the device is encrypted during operation.</li><li>Update – Cryptographic keys are also used to provide encryption and authentication for over-the-air updates, so that attackers can no longer install malicious updates or intercept updates in transmissions.</li><li>End-of-Life – All sensitive key material of the RESCURE prototype can be zeroized, which means the entire identity of a device, including all its rights and authorizations, can be erased.</li><li>Refurbish – After zeroization of a device, it can be re-enrolled with a completely new identity. The old identity and corresponding keys, however, are gone forever. This way, IoT device hardware can safely be re-used for new purposes.</li></ul><p>For more information on RESCURE and its solution for securing IoT devices, have a look at our video above. Also, two papers about the project were recently accepted at scientific conferences and will be published at the <a href="https://www.ares-conference.eu/workshops/wisi-2020/" target="_blank">ARES 2020 workshop WISI</a> and at <a href="https://wisec2020.ins.jku.at/accepted-papers/" target="_blank">WISEC 2020</a>.</p>

A consortium effort to address the need for a security solution that spans the lifecycle of devices in the Internet of Things.

RESCURE: A Security Solution for the IoT Lifecycle

<p>For many years, silicon Physical Unclonable Functions (PUFs) have been seen as a promising and innovative security technology that was making steady progress. Today, Static Random-Access Memory (SRAM-)based PUFs offer a mature and viable security component that is achieving widespread adoption in commercial products. They are found in devices ranging from tiny sensors and microcontrollers to high-performance Field-Programmable Gate Arrays (FPGAs) and secure elements where they protect financial transactions, user privacy, and military secrets.</p><h2>Physical Unclonable Function (PUF)</h2><ul><li>A PUF provides a way to authenticate electronic devices or chips and generate cryptographic keys from their unclonable silicon fingerprint.</li><li>It uses uncontrollable deep-submicron variations from manufacturing to derive a stable, unclonable, and unique device identity.</li></ul><h2>Benefits of SRAM PUF</h2><ul><li>No need to program keys or obtain entropy externally.</li><li>No secrets stored in device when power is off.</li><li>Keys and identifiers based on unclonable silicon structure.</li><li>Uses existing, standard hardware (SRAM) as PUF.</li></ul><h2>Reliability and Certification</h2><ul><li>Advanced error correction.</li><li>Based on years of extensive reliability testing across technology nodes and operating environments.</li><li>Devices using SRAM PUFs have been government vetted and certified EMVCo-Visa and CC EAL6+.</li></ul><h2>Application Markets</h2><ul><li>Smartcard, FPGA</li><li>Sensors, microcontrollers</li><li>Mobile, automotive, IoT</li></ul><h1>The SRAM-based PUF</h1><p>Due to deep submicron manufacturing process variations, every transistor in an Integrated Circuit (IC) has slightly different physical properties. These lead to small but measurable differences in terms of electronic properties, such as transistor threshold voltages and gain factor. Since these process variations are not fully controllable during manufacturing, these physical device properties cannot be copied or cloned.</p><p>Threshold voltages are susceptible to environmental conditions such as temperature, and voltage so their values cannot be used directly as unique secret keys or identifiers.&nbsp;</p><p>The behavior of an SRAM cell, on the other hand, depends on the difference of the threshold voltages of its transistors. Even the smallest differences will be amplified and push the SRAM cell into one of two stable states. Its PUF behavior is therefore much more stable than the underlying threshold voltages, making it the most straightforward and most stable way to use the threshold voltages to build an identifier.</p><h2><span class="fr-img-caption fr-fic fr-dib" style="width: 643px;"><span class="fr-img-wrap"><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1591264573768-SRAM_behavior2.png"><span class="fr-inner">Figure 1: Extracting a strong secret key from SRAM behavior.&nbsp;</span></span></span></h2><h2>SRAM PUF Behavior</h2><p>An SRAM memory consists of a number of SRAM cells. Each SRAM cell consists of two cross-coupled inverters that each are built up by a p- and n-MOS transistor. When power is applied to an SRAM cell, its logical state is determined by the relation between the threshold voltages of the p-MOS transistors in the invertors. The transistor that starts conducting first determines the outcome, a logical &#39;0&#39; or &#39;1&#39;.</p><p>It turns out that every SRAM cell has its own preferred state every time the SRAM is powered resulting from the random differences in the threshold voltages. This preference is independent from the preference of the neighboring cells and independent of the location of the cell on the chip or on the wafer.</p><p>Hence an SRAM region yields a unique and random pattern of 0&#39;s and 1&#39;s. This pattern can be called an SRAM fingerprint since it is unique per SRAM and hence per chip. It can be used as a PUF.</p><p>Keys that are derived from the SRAM PUF are not stored &#39;on the chip&#39; but they are extracted &#39;from the chip&#39;, only when they are needed. In that way they are only present in the chip during a very short time window. When the SRAM is not powered there is no key present on the chip making the solution very secure.</p><h2>PUF Reliability</h2><p>The deep submicron process variations that determine PUF behavior are frozen during manufacturing and do not change afterwards. Hence the preference of the SRAM cells is persistent and stable over time.</p><p>However, there is still a degree of noise. A small number of the cells, close to equilibrium are unstable and display a seemingly random startup preference. So, each time the SRAM starts up, a slightly different pattern emerges. This noise component is dependent on temperature, voltage ramp, and operating conditions.</p><p>The noise of SRAM-based PUF responses has been exhaustively characterized and tested under a wide variety of circumstances and foundry processes:</p><ul><li>Temperatures ranging from -55&deg;C to +150&deg;C (-67&deg;F to 300&deg;F)</li><li>Voltage variation +/-20%</li><li>Humidity up to 80%</li><li>EMC tests at 3V/m (EN55020 0.15&ndash;150 MHz and IEC 61000-4-3 80-1000MHz)</li></ul><p>In particular, the SRAM PUF has been qualified for automotive, industrial and military use in collaboration with customers and partners.</p><p>Millions of measurements have been performed. Under all these circumstances the average noise level of the SRAM-based PUF response was found to be lower than about 15%. Despite this amount of noise, it is possible to reconstruct a high-entropy device unique and reliable key every time the SRAM is powered. This can be done by applying error correction techniques, such as &#39;helper data algorithms&#39;<sup>[1]</sup> or &#39;fuzzy extractors&#39;<sup>[2]</sup>. These algorithms perform two main functions that will be explained below: error correction and privacy amplification.</p><h2>Error Correction</h2><p>Error correction techniques for cryptographic key reconstruction require an enrollment phase and a reconstruction phase. In the enrollment phase (a one-time process) the PUF response is mapped onto a codeword of an error correcting code. Information about the mapping is stored in the Activation Code (AC) or helper data. The AC is constructed such that it does not leak any information about the key. It should be stored in memory that is accessible by the PUF algorithms, but it can be stored off-chip as it is not sensitive. Any change to the AC, malicious or not, will prevent key reconstruction. The AC is only valid for the chip on which it was created.</p><p>Each time the device runs an authentication protocol and needs the secret PUF key, a new noisy PUF measurement is carried out and the PUF key (without noise) is extracted from the AC and this new PUF response. This is called the reconstruction phase. Both enrollment and reconstruction phases are illustrated in Figure 2.</p><p>The error correction algorithms have been designed to reconstruct the key with an average error rate of less than 10<sup>-12</sup> and an error rate of less than 10<sup>-9</sup> under extreme circumstances of 25% average noise.</p><h2><span class="fr-img-caption fr-fic fr-dib" style="width: 707px;"><span class="fr-img-wrap"><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1591264692705-Enroll_reconstruct.png"><span class="fr-inner"><span contenteditable="true">Figure 2: Enrollment and reconstruction phase for the generation of PUF keys. Note that R is the initial PUF response during enrollment while R&#39; is a PUF response in the field with a noise component.</span></span></span></span></h2><h2>Privacy Amplification and Security</h2><p>Secret keys provide security based on the fact that they are completely random and hence unpredictable. Physical measurements, such as PUF responses, have a high degree of randomness, but are usually not completely uniformly random. Privacy amplification is used to generate uniformly random keys.</p><p>By combining error correction and privacy amplification, a 1kByte SRAM PUF response can be turned into a 256-bit uniformly random key and only approximately 0.5 kByte is needed for a 128-bit key with full randomness. A typical SRAM PUF contains so much entropy that only a few dozen bytes are needed to provide a collision-free globally unique identifier that can be used as a unique (but noisy) electronic chip ID (ECID) or as a serial number.</p><p>Dedicated security labs and security teams at customers have analyzed the security of Intrinsic ID&#39;s SRAM PUF against various invasive and non-invasive physical attacks without revealing any weaknesses. Attacks with Scanning Electron Microscopes, Lasers, FIBs and probes have not been successful. Side-channel attacks have not led to any leakage of sensitive information.</p><h2>Aging</h2><p>Accelerated aging tests have been performed on SRAM PUFs to investigate the noise level as a function of time. By using a patented anti-aging technique<sup>[3]</sup> a 25-year lifetime can be guaranteed for SRAM PUF technology.</p><h1>SRAM PUF Implementation &ndash; QuiddiKey &amp; BroadKey</h1><p>Intrinsic ID has bundled the above error correction, randomness extraction, security countermeasures and anti-aging techniques into its products. They extract cryptographic keys from the SRAM PUF in a very secure manner and are available as Hardware IP (netlist) called QuiddiKey&reg;, firmware (ANSI C Code) called BroadKey&trade;, or a combination of these by using BroadKey&#39;s hardware interface. These hybrid solutions combining hardware and software offer great efficiency when already integrated hardware accelerators, such as for (a-)symmetric cryptography, are used in combination with SRAM PUF technology.</p><p>The hardware IP is small and fast &ndash; around 25K gates / 50K cycles &ndash; and connects to common interconnects, such as AMBA&reg; AHB, APB as well as proprietary interfaces. A Built-In Self-Test (BIST), diagnostics, and health checks are included in the logic. A driver is provided to ease integration with software. Since it is pure digital, single clock logic it synthesizes readily to any technology.</p><p>Software reference implementations start from 4KB of code and are available for major platforms, such as ARM&reg;, ARC&reg;, Intel&reg;, MIPS and RISC-V. Software implementations can be used to add PUF technology to existing products by a firmware upgrade. Intrinsic ID also provides versions of BroadKey that are pre-integrated with ARM&reg; TrustZone&reg;.</p><p>Both QuiddiKey hardware and BroadKey software solutions can be optimized for low footprint, low latency or low memory use depending on the application. Re-using or integrating with existing crypto cores and random number generators can further enhance performance and reduce footprint. Intrinsic ID solutions come with comprehensive product specifications and integration guidelines including reference code that illustrates usage of the API offered to the application programmer.</p><h2>Requirements</h2><p>These Intrinsic ID products use uninitialized SRAM. This can be a separate SRAM block or a part of a bigger existing SRAM. Standard SRAM suffices. To store the Activation Code (AC), access to a storage medium is needed. This can be embedded Non-Volatile-Memory (NVM), a separate memory on the board, e.g. flash, or cloud storage. For the firmware version BroadKey, a microcontroller is needed for which a C-compiler exists. The PUF algorithms can be stored in any NVM e.g., flash, ROM.</p><p>Note that SRAM is embedded in almost any microprocessor and SoC, in every technology node and is part of the standard manufacturing process. There is no need for time-consuming qualification and chip testing, as extensive testing by Intrinsic ID and its partners has shown that technology reliably scales down to the smallest technology nodes currently available.</p><div id="ftn1"><h2>Use in the Field</h2><p>SRAM-based PUFs are commercially available from semiconductor companies. They are already deployed in a wide range of microcontrollers, FPGAs and smart card controllers. In other markets, software implementations<sup>[4]</sup> have enabled rapid deployment of this technology even as a retrofit solution. Intrinsic ID has partnered with leading semiconductor companies and developed solutions for protecting embedded systems, sensors, and controllers. More information about our SRAM PUF deployments can be found on our website: <a href="https://www.intrinsic-id.com" target="_blank">https://www.intrinsic-id.com</a>.</p><h1>Conclusion</h1><p>SRAM-based Physical Unclonable Functions have been successfully implemented in commercial products. SRAM PUFs combine high security and reliability with low cost, low footprint designs, and easy implementation. They have been deployed in many devices, from tiny microcontrollers and sensors to high performance FPGAs and secure elements.</p><p>Numerous implementations have consistently demonstrated the reliability and security of the technology. SRAM PUFs are a mature and robust technology, designed for security and based on solid theoretical foundations. SRAM PUFs have gained their credibility in high security markets and are now gaining traction in markets ranging from low-cost IoT applications to high-end security solutions for government, defense, and the payment industry.</p><div id="ftn1"><h2>References</h2></div></div><p>[1] J.-P. Linnartz and P. Tuyls, &quot;New shielding functions to enhance privacy and prevent misuse of biometric templates,&quot; in International Conference on Audio and Video-based Biometric Person Authentication (AVBPA&#39;03), ser. LNCS, J. Kittler and M. S. Nixon, Eds., vol. 2688. Heidelberg: Springer-Verlag, 2003, pp. 393&ndash;402.</p><div id="ftn2"><p>[2] X. Boyen, &quot;Reusable cryptographic fuzzy extractors,&quot; in ACM Conference on Computer and Communications Security (CCS&#39;04). New York, NY, USA: ACM, 2004, pp. 82&ndash;91. AND Y. Dodis, L. Reyzin, and A. Smith, &quot;Fuzzy extractors: How to generate strong keys from biometrics and other noisy data,&quot; in EUROCRYPT&#39;04, ser. LNCS, C. Cachin and J. Camenisch, Eds., vol. 3027. Heidelberg: Springer-Verlag, 2004, pp. 523&ndash;540.</p><p>[3] R. Maes and V. van der Leest, &quot;Countering the effects of silicon aging on SRAM PUFs&quot;, Proc. IEEE Int. Symp. Hardw.-Oriented Secur. Trust (HOST), pp. 148-153 available at <a href="https://www.intrinsic-id.com/wp-content/uploads/2017/05/PUF_aging.pdf" rel="noopener noreferrer" target="_blank">https://www.intrinsic-id.com/wp-content/uploads/2017/05/PUF_aging.pdf</a>&nbsp;</p><p>[4] H.Hodson &ndash; New Scientist, &quot;Silicon fingerprint on chips could make any gadget unhackable&quot; June 6, 2016 <a href="https://www.newscientist.com/article/mg23030771-400-physical-quirks-in-silicon-chips-are-key-to-unhackable-devices/" rel="noopener noreferrer" target="_blank">https://www.newscientist.com/article/mg23030771-400-physical-quirks-in-silicon-chips-are-key-to-unhackable-devices/</a> or &quot;Chip design quirks make our lives more secure&quot; in the June 11 printed issue page 24.</p></div>

cybersecurity

ORGANIZATIONS. SHAPING THE INDUSTRY.

THINC Lab

Latest Posts

How Physical Unclonable Functions (PUFs) are Creating Trust

RESCURE: A Security Solution for the IoT Lifecycle

SRAM PUF: The Secure Silicon Fingerprint