KR20180129193A - Noise coupled physical unclonable functions system - Google Patents

Abstract

The present invention relates to a physical unclonable function (PUF) system with noise inserted thereinto, in which processed noise is intentionally inserted into the output of PUF to raise up difficulty of challenge/response analysis. According to the present invention, the PUF system with noise inserted thereinto comprises: a device including a PUF circuit and a noise insertion unit and generating and outputting a secondary response signal including the processed noise when a challenge signal is received; a helper data storage unit storing the challenge signal for the PUF circuit of the device and helper data according to a response signal corresponding to the challenge signal; an authentication unit receiving the secondary response signal from the device and eliminating processed noise to generate a final response signal and perform authentication.

Description

Noise coupled physical unclonable functions system < RTI ID = 0.0 >

The present invention relates to a physically non-reproducible function system in which noise is inserted to intentionally insert machining noise into an output of a physical non-reproducible function to increase the difficulty of challenge / response analysis.

Physical Unclonable Functions (PUFs) have been attracting attention as technologies for device authentication or identification [1-5]. Due to the minute difference occurring in the device manufacturing process, each device has inherent characteristics, and the output of the PUF circuit can be generated differently for each device.

As shown in Figure 1, we input some input to pull out the output of the PUF unique to each device. The input value is referred to as a challenge (CH) and the output as a response (RP).

At the time of shipment of devices with embedded PUF, it generates a CH and RP pairs (PUFs) for each device's PUF and then registers them in the server. After selecting one of the CRPs stored in the server and inputting the CH into the PUF of the corresponding device, the output RP is transmitted to the authenticator and is compared with the RP stored in the server to perform authentication of the corresponding device, .

The types of PUF can be classified into weak-PUF and strong-PUF [6]. The biggest difference between weak-PUF and strong-PUF is the amount of CRP used for authentication. In the case of weak-PUF, one or a few CRPs are used to generate security data that should not be exposed to the outside world. Strong-PUF stores many CRPs and each CRP is used directly to authenticate or identify the device. CRPs used in strong-PUF-based authentication are generally exposed to the outside world. Therefore, it is necessary to have many CRPs for each device, and the CRP used for authentication is not used again because it is exposed to the outside.

The advantage of the PUF is that it is virtually impossible to produce exactly the same PUF circuit to the fine variations of the circuit, and it is difficult to predict CRPs that have not yet been used for authentication using exposed CRPs.

However, in recent years, as techniques for analyzing based on a large amount of data such as machine learning have been developed, an attack that models exposed PUFs by collecting exposed CRPs has become possible [10, 11].

Direct and indirect exposure of CRPs can not be avoided in exchanging CHs and RPs for authentication between the authentication target device and the authenticator.

[1] B. Gassend, D. Clarke, M. van Dijk, and S. Devadas, "Silicon physical random functions," in Proc. Computer Communication Security Conference, pp. 148-160, Nov. 2002. [2] C. Brzuska, M. Fischlin, H. Schr, and S. Katzenbeisser, "Physical unclonable functions in the universal composition framework," in Proc. CRYPTO, pp. 5170, 2011. [3] G. E. Suh and S. Devadas, "Physical unclonable functions for device authentication and secret key generation," Design Automation Conference, pp. 9-14, 2007. [4] K-H. Lee, S-Y. Kim, K. Cho, and Y. You, "Implementation of Physical Unclonable Function (PUF) using Transmission Line Crosstalks," Journal of The Institute of Electronics Engineers of Korea, vol. 50, no. 5, pp. 75-82, May 2013. [5] J. Lee and D. Kim, "Offline User Authentication Method of Smart Card using PUF," 2011 IEIE Summer Conference, pp. 1600-1602, Jun. 2011. [6] U. Ruhrmair, D. E. Holcomb, "PUFs at a Glance," Design, Automation and Test in Europe Conference and Exhibition (DATE), pp. 1-6, 2014. [7] S Tajik, E Dietz, S Frohmann, J-P Seifert, D Nedospasov, C Helfmeier, C Boit, and H Dittrich, "Physical Characterization of Arbiter PUFs," CHES, pp. 493-509, 2014. [8] D. Lim, J. W. Lee, B. Gassend, G. E. Suh, M. van Dijk, and S. Devadas, "Extracting secret keys from integrated circuits," IEEE Trans. on Very Large Scale Integration (VLSI) Systems, vol. 13 no. 10, pp. 1200-1205, Oct. 2005. [9] J.-W. Lee, D. Lim, B. Gassend, GE Suh, M. van Dijk, and S. Devadas, "A Technique to Build a Secret Key in Integrated Circuits with Identification and Authentication Applications," In Proceedings of IEEE VLSI Circuits Symposium, Jun. 2004. [10] U. R. F. Sehnke, Jan S, G. Dror, S. Devadas, and J. Schmidhuber, "Modeling attacks on physical unclonable functions," ACM conference on Computer and Communications Security, pp. 237-249, 2010. [11] U. Ruhrmair and J. Solter, "PUF Modeling Attacks: An Introduction and Overview," Design, Automation and Test in Europe Conference and Exhibition, pp. 1-6, 2014. [12] Y. Dodis, M. Reyzin, and A. Smith, "Fuzzy extractors: How to generate strong keys from biometrics and other noisy data," in Advances in Cryptology (EUROCRYPT), vol. 3027 of LNCS, pp. 523-540, 2004. [13] J. Delvaux, D. Gu, D. Schellekens, and I. Verbauwhede, "Helper data algorithms for PUF-based key generation: Overview and analysis," IEEE Trans. Comput.-Aided Design Integr. Circuits Syst., Vol. 34, no. 6, pp. 889-902, Jun. 2015. [14] A. Van Herrewege et al., "Reverse fuzzy extractors: Enabling lightweight mutual authentication for PUF-enabled RFIDs," in Financial Cryptography and Data Security (LNCS 7397), pp. 374-389, Feb. 2012. [15] B. Gassend, D. Clarke, M. van Dijk, and S. Devadas, "Controlled physical random functions," in Computer Security Applications Conference, 2002. Proceedings. 18th Annual, pp. 149160, 2002. [16] S. Katzenbeisser, Kocabas, V. van der Leest, A.-R. Sadeghi, G. J. Schrijen, C. Wachsmann, "Recyclable PUFs: Logically Reconfigurable PUFs," Journal of Cryptographic Engineering, vol. 1, no. 3, pp. 177-186, Nov. 2011. [17] R. G. Gallager, "Low-density parity-check codes," IRE Trans. Inform. Theory, vol. IT-8, pp. 21-28, Jan. 1968. [18] R. M. Tanner, D. Sridhara, A. Sridharan, T. E. Fuja, and D. J. Costello, Jr., "LDPC block and convolutional codes based on circulant matrices," IEEE Trans. Inf. Theory, vol. 50, no. 12, pp. 29662984, Dec. 2004. [19] M. P. C. Fossorier, M. Mihaljevic, and H. Imai, "Reduced complexity iterative decoding of low density parity check codes based on belief propagation," IEEE Trans. Commun., Vol. 47, no. 5, pp. 673680, May 1999. S. Morozov, A. Maiti, and P. Schaumont, "An Analysis of Delay Based PUF Implementations on FPGA," in Reconfigurable Computing: Architectures, Tools and Applications, P. Sirisuk, F. Morgan, Ghazawi, and H. Amano, Eds., Vol. 5992, pp. 382-387, 2010. [21] Helion Technology, "Fast Hash Core Family for Altera FPGA. Data Sheet," pp. 1-3, 2012.

In order to solve the above-described problems, the present invention provides an arbiter-PUF (arbiter-PUF) that uses a plurality of CRPs and uses signal propagation delays, inserts processing noise into RP bit strings among CRPs exposed to the outside, And to provide a physically non-reproducible function system in which noise is inserted to make data analysis of an attack difficult.

The present invention is characterized in that processing noise is inserted into a secondary response signal (RP ") bit stream among CRPs exposed to the outside of an arbiter-PUF, which is an exemplary PUF using a plurality of CRPs and using a delay of signal propagation This paper presents a method to make data analysis of modeling attack difficult.

The present invention also provides an arbiter-PUF (arbiter-PUF) which intentionally inserts processing noise before the secondary response signal RP "outputted from the PUF is exposed to the outside, using the inherent characteristic of the arbiter- -PUF) circuit structure.

The present invention utilizes error correction codes (ECC) to stabilize the output of the PUF, and a low-density parity-check (LDPC) code, which has recently attracted attention as a high error correction rate, (FRP) is formed by applying the special structure of the FRP, excluding the inserted noise, and the final response signal (FRP) is finally used for authentication.

In the proposed authentication system architecture, the hardware overhead of the device part can be reduced in a system composed of a plurality of devices and a small number of authenticators.

In the present invention, processing noise is additionally deliberately inserted into a response signal (RP) exposed in a system for performing authentication of a device using a PUF, thereby making it difficult for an external attacker to analyze CRPs.

In the present invention, the arbiter-PUF and FF arbiter-PUF are mixed and a random value is separately generated to generate a secondary response signal RP " Increasing the difference in the signal RP makes it difficult to predict the CRPs that have not yet been used.

In addition, in the present invention, the redundancy size to be decoded independently in the LDPC decoder can be increased or the number of regions can be increased to increase the amount of noise, thereby further improving the difficulty of analysis.

Further, in the present invention, more arbitrary random noise patterns can be generated by increasing the number of FF arbiters and the number of switches receiving the FF arbiters in the arbiter-PUF structure.

In the present invention, an arbiter-PUF (arbiter-PUF) structure and an authentication system structure using the arbiter-PUF make it difficult to analyze CRPs. In addition, in an authentication system including a small number of authenticator and a plurality of devices, The hardware overhead can be reduced because the ECC decoder module is placed in the authenticator instead of the device, and the function of inserting the intended noise is a structure that uses the arbiter-PUF itself.

1 is a diagram showing input and output of a PUF.
2 is a structural view of an arbiter PUF used in the present invention.
3 is a structural diagram of a feedforward PUF used in the present invention.
4 is a diagram for explaining the stabilization of the output of the PUF.
5 is a conventional general system structure for authenticating a device using a PUF.
FIG. 6 is a block diagram of a physically non-reproducible function system in which noise is inserted according to a preferred embodiment of the present invention.
7 is a diagram showing one embodiment of the PUF circuit of Fig.
Fig. 8 is a diagram of a second order response signal (RP ") bit string that can be generated in the PUF circuit according to the present invention and forms of processed noise to be inserted.
9 is a diagram illustrating a parity check matrix for partial redundancy use used by the error correction decoder of the present invention.
10 is a variable-node updater module structure for partial redundancy use.
11 is a circuit diagram for calculating the signal propagation delay time of the switch.
12 is a graph showing the difference between the bit sequence of the response signal in the registration step and the response signal in the regenerating step.
13 is a diagram showing a bit string difference between response signals by the same challenge input.

Various aspects are now described with reference to the drawings. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of one or more aspects. It may be evident, however, that such aspects may be practiced without these specific details.

1. Arbiter-PUF (Arbiter-PUF)

2 is a structural view of an arbiter PUF used in the present invention.

The Arbiter-PUF is generally a strong-PUF (strong-PUF) using multiple challenge / response pairs (CRPs) and is a delay-based PUF using the signal propagation delay difference [7,8 ].

As shown in FIG. 2, a plurality of switches S1 to Sn formed of two multiplexers are connected, and the switches S1 to Sn change connection states according to input values. An electric signal is given to the first switch S1 and is transmitted to the flip-flop, which is called an arbiter A located at the end of the switches S1 to Sn via the path of each switch, A value of '1' or '0' is determined according to the signal. Here, the input of the switches S1 to Sn becomes CH, and the data output from the arbiter A becomes the response signal RP. (RP) bit string by repeatedly inputting while changing the pattern of the input CH.

Figure 3 shows a feedforward arbiter-PUF (PUF) used in the present invention [9].

The input of the minority switch (here Sn) is to use the result of the feed forward arbiter (FFA) output to the previous switches S1 instead of CH. It is a structure to reduce direct correlation between exposed CH and RP.

Since the input of a particular switch is determined by the characteristics of the internal circuit, characterization of the PUF becomes more difficult. In the arbiter-PUF structure proposed in the present invention, in the registration step, two arbiters as described above are mixed, and CRPs are generated using an existing arbiter-PUF (arbiter-PUF) Then, when generating the RP for the CH selected in the regeneration step, the intended processing noise is generated by using the FF arbiter-PUF and inserted into the RP, and then transmitted to the authenticator.

2. PUF modeling attack

The advantage of a PUF authentication scheme using multiple CRPs is that it is difficult to replicate a particular PUF circuit. Since the PUF utilizes the fine variations that occur in the process of each element constituting the circuit rather than the intended circuit structure, it is very difficult to directly reconstruct the circuit containing the specific variation or to predict the output to the input.

In recent years, however, a modeling attack has been made that collects CRPs exposed to the outside in a PUF authentication structure using a plurality of CRPs and analyzes characteristics of specific PUFs to predict CRPs that have not been used yet.

[10] deals with modeling attacks by analyzing CRPs exposed in a strong-PUF (strong-PUF) based on machine learning.

Experiments with general arbiter-PUF, FF arbiter-PUF and arbiter-PUF with additional security factors showed that some CRPs and training When the time is given, the prediction rate of the output of the PUF is high. That is, given the time to collect and train exposed CRPs, it is possible to predict the CRPs that have not yet been used, and it is possible to model the finer variations of the PUF.

One of the more remarkable points in the above study is the prediction rate of the PUF output according to the degree of noise. As the degree of noise increases, it means that the PUF output, that is, the RP has a lot of errors. Experimental results show that the prediction rate decreases as the RP contains more errors. In other words, the greater the difference between the RP used for actual authentication and the RP exposed by the attacker, the lower the predictability. In the structure proposed in the present invention, processing noise is generated in the RP exposed to the outside, which makes analysis through CRPs difficult.

3. ECC for stabilizing the RP

Since the PUF utilizes the fine variations of the circuit, the output RP may not be constant even if the same CH is repeatedly input due to environmental variables such as temperature or voltage. That is, there may be a difference between the RP at the registration stage and the RP at the regeneration stage, which is usually referred to as intra-chip variation. In an authentication system using a PUF, it is ideal to make the intra-chip variation 0%, but the inherent variation of the PUF is minute and it is difficult to suppress the noise naturally generated by the environmental element. Therefore, in order to converge the RP of the PUF to a specific expected value (RP in the registration step), a process of noise removal, that is, stabilization of the RP, is required.

[12] proposed a concept of a fuzzy extractor as a function for using biometric information data including noise in authentication, and this function can be used for stabilizing the output of the PUF as shown in FIG. Fuzzy extractors are basically based on Error Correction Codes (ECC) [12, 13]. The ECC is divided into an encoder 10 and a decoder 20. The encoder 10 generates redundancy from a message which is actual data to produce a codeword, If an error is included in decoding the codewords, the error is corrected.

In the PUF (1), code word data including redundancy or redundancy generated in order to correct an error included in the RP with respect to the ECC function is referred to as helper data (HD). In the registration step of the device, HD is generated together with the generated CRP and stored in a separate storage. In the regeneration step, the RP associated with the selected CRP is stabilized.

The method of making the CRP analysis difficult in the present invention is to further insert the intended processing noise into the RP which contains the natural noise output from the PUF 1 of the device. When transmitting the CH from the authenticator to the device, and when transmitting the RP output from the PUF (1) of the device to the authenticator, a pair of CH and RP, i.e., CRP, is exposed. At this time, the processing noise is transmitted to the RP exposed to the authenticator, that is, the random value is partially inserted to make a difference from the RP used for the actual authentication. However, the noise that can be removed by using the ECC decoder 20 is limited. Therefore, in the proposed structure, the ECC decoder 20 decodes the RP except for the intended processing noise and is used to remove only the natural noise generated by the environment variables. The intended machining noise is generated by utilizing the PUF (1) of the device part itself, and its position and value are random. Therefore, in order to recover the RP without the intended processing noise, a different ECC structure is required. In the proposed authentication scheme, it is possible to remove the natural noise while excluding the intended noise from the decoding process by using a special structure LDPC code capable of recovering data by utilizing only partial redundancy among codewords.

4. Overall authentication structure

5 is a conventional general system structure for authenticating a device using a PUF.

The system structure can be broadly divided into a device 50 and an authenticator 60. The authenticator 60 has the CRPs generated in the registration step of the devices, and when the device requests the authentication, selects one of the CRPs of the device 50 and transmits the CH to the device.

The device 50 generates an RP 'that may contain natural noise using the CH transmitted from the PUF. The device 50 stabilizes the RP 'with the RP using the ECC module and transmits it to the authenticator 60. The authenticator 60 compares the RP received from the device 50 with the RP of the selected CRP to complete authentication. A security module such as a hash function can be used to protect the CRP exposed by the system [15, 16].

FIG. 6 is a block diagram of a physically non-reproducible function system in which noise is inserted according to a preferred embodiment of the present invention.

Referring to FIG. 6, a physical non-reproducible function system having processed noise according to a preferred embodiment of the present invention includes a device 100, an authenticator 200, and a helper data storage unit 300.

The device 100 includes a PUF circuit 110 and a noise insertion unit 120. The authenticator 200 includes a challenge response pair storage unit 210, an error correction decoder 220, a comparison unit 230, And a noise position analyzer 240.

Here, the challenge-response pair storage unit 210 stores a challenge signal CH for each device 100 and a corresponding response signal RP corresponding thereto.

The corresponding response signal RP is inputted to the PUF circuit 110 as an output by inputting the challenge signal CH at the registration step (before the device is shipped) and stored in the challenge response pair storage unit 210 of the authenticator 200 , And data used to determine whether or not to finally authenticate.

The corresponding response signal RP is not exposed (not exposed) in the regenerating step (after device shipment), and the intended processing noise transmitted from the device 100 in the regenerating step is inserted into the inserted secondary response signal RP ' 'Are finally compared with the final response signal FRP produced by removing the error signal through the error correction decoder 220.

The helper data storage unit 300 stores helper data HD corresponding to the challenge signal CH for each device 100 and the corresponding response signal RP corresponding thereto. The helper data storage unit 300 is located on the device 100 side and may be on the authenticator 200 side.

The length of the HD corresponding to each CRP is equal to the codeword length of the corresponding LDPC code. HD is generated and stored by XOR operation between the codeword obtained from the coding process of the randomly selected message and the corresponding RP in the registration step.

Then, the random code word generated in the registration step is obtained by XOR operation of HD with the RP "received from the device in the regeneration step, and the error is corrected by decoding the code word. Create the removed RP.

In this configuration, the challenge-response pair storage unit 210 of the authenticator 200 transmits a challenge signal corresponding to the device 100 to the device 100.

Accordingly, the PUF circuit 110 of the device 100 receives the challenge signal CH from the authenticator 200 and generates the primary response signal RP '.

 At this time, the primary response signal RP generated by the PUF circuit 110 of the device 100 includes natural natural noise.

The primary response signal RP 'is transmitted to the noise inserting unit 120 and the noise inserting unit 120 utilizes natural natural noise included in the primary response signal RP' And transmits the generated information to the PUF circuit 110.

At this time, the PUF circuit 110 of the device 100 inserts an intended noise in addition to natural natural noise to generate a secondary response signal RP " And transmits the difference response signal RP "to the authenticator 200.

Here, the secondary response signal RP '' is the response signal into which the intended processing noise output from the PUF circuit 110 is inserted and is data transmitted to the authenticator 200. Finally, RP "contains the intended processing noise and natural natural noise.

At this time, the secondary response signal RP "is transmitted to the authenticator 200 without being stabilized, and the authenticator 200 uses the error correction decoder 220 to remove natural natural noise and intended processing noise Thereby generating a final response signal FRP.

At this time, the noise position analyzer 240 analyzes the noise insertion position and the processed noise pattern in the secondary response signal RP ", and provides the analysis result to the error correction decoder 220.

At this time, the error correction decoder 220 obtains the helper data HD from the helper data storage unit 300.

Then, the comparing unit 230 finally determines whether or not the device 100 is authenticated with the final response signal FRP. That is, the comparator 230 receives the response signal RP corresponding to the challenge signal transmitted from the challenge-response pair storage unit 210 to the device 100, and outputs the final response signal RP output from the error- (FRP).

Herein, the method of inserting and analyzing the processed noise can operate a unique method for each manufacturer. Before the response signal is transmitted from the device to the authenticator, the noise inserting unit 120 and the noise position analyzing unit 240 It is difficult to analyze the position of the intended machining noise with the secondary response signal RP '' that is exposed because the information about the position where the machining noise is inserted is determined in advance.

The present invention is significantly different from the conventional structure in that natural natural noise and intentional noise are inserted into the secondary response signal RP "transmitted from the device 100 to the authenticator 200, It is difficult to analyze it.

In the present invention, no separate security module is used. Since the method of inserting the intended machining noise utilizes the PUF circuit 110 by itself, the added hardware overhead is not so large. And an error correction decoder 220 for stabilizing the secondary response signal RP "may be disposed in the authenticator 200 portion to lighten the hardware elements of the device 100 [14].

7 is a diagram showing one embodiment of the PUF circuit of Fig.

6, the PUF circuit of FIG. 6 includes a plurality of switches S1 to Sn, a plurality of feedforward arithmetic units FFA1 to FFAm, a plurality of multiplexers MUX1 to MUXk, a linear feedback shifter register LSPR, A signal generator SEL and a response arbiter RPA.

The plurality of switches S1 to Sn are connected in series, and each of the switches S1 to Sn is composed of two multiplexers, and the connection state is changed according to the input value. Here, n is an arbitrary natural number, and the case of 16 in Fig. 7 is shown.

Each of the plurality of feedforward arithmetic units FFA1 to FFAm is constituted by a flip flop and receives the output of one of the switches S1 to Sn among the plurality of switches S1 to Sn, The output value of '1' or '0' is determined according to a signal output first among the output signals S 1 to Sn. Here, m is an arbitrary natural number smaller than n, and the case of 3 in Fig. 7 is shown.

The outputs of the plurality of feedforward arbiters FFA1 to FFAm are used as inputs of the multiplexers MUX1 to MUXk. Here, k is an arbitrary natural number and is smaller than n, and the case of 3 in Fig. 7 is shown.

At this time, all the outputs of the plurality of feedforward arbiters FFA1 to FFAm may be used as inputs to each of the plurality of multiplexers MUX1 to MUXk.

Alternatively, the outputs of several feedforward arbiters FFA1 to FFAm may be used as inputs to each of the plurality of multiplexers MUX1 to MUXk.

Of course, one corresponding multiplexer (MUX1 to MUXk) may be determined for each of a plurality of feedforward arithmetic units FFA1 to FFAm, and the output of corresponding feedforward arithmetic units FFA1 to FFAm may be used as an input.

Meanwhile, the linear feedback shifter register LSPR receives the challenge signal CH transmitted from the authenticator 200 and generates an n-bit pseudo-random number sequence, and generates a 16-bit pseudo-random number sequence in FIG. .

Such a linear feedback shifter register (LFSR) is a type of shift register, and has a structure in which a value input to a register is calculated as a linear function of previous state values. The linear function used in this case is mainly exclusive OR (XOR). The initial bit value of the LFSR is called the seed.

Since the operation of the LFSR is deterministic, the pseudo-random number sequence of values generated by the LFSR is determined by the previous value. Also, since the number of values that a register can have is finite, the pseudo-random number sequence is repeated by a specified period. However, if you choose a linear function, you can generate a pseudorandom sequence that looks like a long, random sequence.

Thus, the n-bit pseudo-random number sequence of the linear feedback shifter LSPR is directly input to the n-k of the switches S1 to Sn, and the remaining k are used as inputs to the multiplexers MUX1 to MUXk.

The selection signal generator SEL provides a selection signal to each of the plurality of multiplexers MUX1 to MUXk to output any one of the inputs of the multiplexers MUX1 to MUXk, Sn).

A selection signal may be predetermined for each of the plurality of multiplexers MUX1 to MUXk of the selection signal generator SEL.

The response arbiter RPA is located at the end of each of the switches S1 to Sn and an output value of '1' or '0' is determined according to a signal arriving at the path of each of the switches S1 to Sn first.

The PUF circuit used in the present invention is a mixed form of a general arbiter-PUF and a feed arbiter-PUF, and a value of a feed forward arbiter (FFA1 to FFAm) The switches S1 to Sn receiving the outputs of the feedforward arithmetic units MUX1 to MUXk output one of the feedforward arithmetic units FFA1 to FFAm or the linear feedback shifter register LFSR by the selection signals of the added multiplexers MUX1 to MUXk The output value of the pseudo-random number sequence can be selected and received as an input value.

Each bit of the response signal RP can be obtained for each input of one switch S1 to Sn. In order to obtain the entire bit string of the response signal RP in the registering step, the input of the switches S1 to Sn is determined by using the output value of the pseudo-random number sequence of the linear feedback shifter register (LFSR) using the inputted challenge signal CH It must be injected repeatedly as much as the bit string length.

As described above, when generating the response signal RP in the registering step, each of the switches S1 to Sn receives only the pseudo-random number sequence, which is the output value from the linear feedback shift register (LFSR), as the input value.

On the other hand, when the secondary response signal RP "is obtained in the regeneration step, the multiplexers MUX1 to MUXk are basically set so that the respective switches S1 to Sn receive a value from the linear feedback shifter register LFSR And is connected to feedforward arbiters (FFA1 to FFAm) via multiplexers (MUX1 to MUXk) when generating the RP bits of the portion of the RP bit stream that will produce the intended machining noise.

When the input values of the specific switches S1 to Sn are connected to the outputs of the FF arbiters FFA1 to FFAm through the multiplexers MUX1 to MUXk, RP bits which are more difficult to predict are generated, And the corresponding response signal RP of the CRP selected in the device 200.

In the PUF circuit structure of the present invention, the number of switches S1 to Sn receiving the values of the feed forward arbiters FF1 to FFAm and the FF arbiters FF1 to FFAm, , It is possible to generate more random values, that is, an intended machining noise pattern.

5. Secondary response signal (RP ") bit sequence structure with intended processing noise inserted

The bit stream of the secondary response signal RP "may be divided into a message part and a redundancy part in relation to an error correction code (ECC) function of the error correction decoder 220. [

The intended machining noise is inserted only in the redundancy portion, and the size and the number of the portions into which the intended machining noise can be inserted are determined according to the design of the error correction code.

Fig. 8 is a diagram of a second order response signal (RP ") bit string that can be generated in the PUF circuit according to the present invention and forms of processed noise to be inserted.

Referring to FIG. 8, a portion capable of inserting machining noise intended for redundancy is divided into three regions, and machining noise can be inserted in one of the regions.

FIG. 8A shows a corresponding response signal RP generated in the registration step, and since this bit string is used for authentication, it can be said that there is no noise.

Fig. 8B shows a secondary response signal RP "outputted in the regenerating step. Basically, the entire bit string includes natural noise, and includes intended processing noise.

The intended machining noise is inserted in the second part, and the inserted position can be determined at random using the bit string of the previously outputted message part.

For example, it is possible to randomly determine the insertion position of the intended machining noise by counting '1' of the bit string. Since the message portion also includes natural noise and this can vary from generation to generation of the secondary response signal RP ", the location where the intended processing noise is inserted may always be random.

The secondary response signal RP "including the intended processing noise as shown in Fig. 8 (b) is transmitted to the authenticator 200. [

8 (c) shows a state of the natural response canceled by the error correction decoder 220, that is, the stabilized first response signal RP '.

The authenticator 200 decodes the final response signal FRP because the initial response signal RP 'includes many errors in the portion including the intended processing noise.

The authenticator 200 determines whether or not the device 100 is authenticated using the final response signal FRP except for the portion including the intended processing noise.

6. Error correction decoder structure

The conventional error correcting code (ECC) decoder and the decoding process using it can not perform decoding except for the intended processing noise inserted in the device 100. [ FIG. 9 is an example of a parity-check matrix of a low density parity check (LDPC) code that can be decoded in a state where partial redundancy used by the error correction decoder 220 of the present invention is excluded.

The low-density parity-check (LDPC) code used in the error correction decoder 220 according to the present invention is based on a quasi-cyclic LDPC code, and a parity-check matrix is constructed on a block basis [17-19 ].

In the parity check matrix proposed in the present invention, the portion corresponding to the redundancy is divided into three parts, and each parity-check matrix part is constructed so as not to affect the other parts. That is, the three regions can be independently decoded, and error correction can be performed in the state where any redundancy portion of the three portions is excluded.

As described above, the decoding process of the low-density parity-check code (LDPC) code decoder used in the error correction decoder 220 according to the present invention is composed of four kinds of information initialization, check-node update, variable-node update and parity-check.

The decoding order initializes the information of the codeword to be decoded first, and then it is repeated in the order of check-node update, variable-node update, and parity-check.

This sequence repeats until all errors in the codeword have been corrected or the maximum number of iterations has been reached.

A decoding process that can perform decoding except for a specific redundancy part is as follows.

The internal information value and the external information value corresponding to the redundancy to be excluded in the information initialization step are set to '0' at the start of decoding. It should be designed so as not to affect other external information in subsequent decoding operations. In the variable-node update module, the value to be ignored should always be set to '0' so as not to affect the determination of each bit of the code word.

In the variable-node update module designed in the present invention, the adder is divided into a unit in which the intended processing noise is inserted as shown in FIG. 10, and a result of the adder in which the intended processing noise is inserted is output as a '0' value by the multiplexer selection signal .

7. Delay time modeling for experiments

This experiment is to measure the difference between the response (RP) stored in the authenticator and the final response signal (FRP) output from actual use by inserting the intended processing noise and the difference between the repeated final output signals (RP) to be.

This experiment is based on the PUF circuit and low density parity check code decoder.

[20] basically set fixed delay time difference and random delay time difference of signal propagation delay time for PUF delay time modeling.

In this experiment, the delay time of the circuit is also divided by the fixed delay time due to the fine variation and the random delay time which can be changed by the environmental variable.

There are four paths through which a signal passes in one switch, as shown in Figure 11, and the path through which the signal passes is determined by the switch input. T represents the signal propagation time for each channel is determined by two factors. One is the fixed delay time, t _s , due to the effect of the variations in the process, and the other is the delay time, t _r , which can be different due to ambient temperature or voltage. t is expressed by the following equation (1).

(1)

That is, a fixed delay time due to process variation and a random delay time due to noise that may occur differently each time a response signal RP is generated.

d represents the difference in propagation delay time between two paths selected from one switch, and the equation obtained according to the switch input c is expressed by the following equation (2).

(2)

The cumulative delay time, s , to the k switch is calculated as: < EMI ID = 3.0 >

(3)

,

,

A bit value of the RP, b, is calculated by summing up the d values of the respective switches, as shown in the following equation (4).

(4)

In the registration step, the LFSR value generated by the challenge (CH) input is input to the switch to extract CRP pairs. In the regeneration process, the position of insertion of the intended processing noise and the selection of the feed forward arbiter (FF Arbiter) of the switch receiving the value of the feed forward arbiter (FF Arbiter) are set to the number of '1' Is determined.

8. Experimental results

Figure 12 compares the correspondence response signal (RP) of the CRP stored in the registration step with the final response signal (FRP) generated from the device in the regeneration step and graphs the difference therebetween. ①, ②, and ③ show the difference due to the natural noise generated in the PUF circuit itself and can be called intra-chip variation in the existing PUF circuit. ④, ⑤, and ⑥ show the difference including natural noise and intended processing noise. The number of feed arbiters (FF arbiters) for generating the intended machining noise is set to eight.

Table 1 summarizes the random delay time range ( t _r ) applied to each experiment and the bit stream average difference.

(Table 1)

The number of noise that can stabilize the secondary response signal (RP ") using error correction codes (ECCs) is limited. The insertion of the intended processing noise through the graphs and tables can result in much more noise than natural noise Is inserted.

However, the applied low density parity check code decoder (LDPC Codes decoder) can perform decoding with the exception of the intended processing noise.

This indicates that the secondary response signal RP "outputted from the device performs authentication while increasing the difference from the corresponding response signal RP stored in the authenticator, and indicates that the attack using the exposed secondary response signal RP" It is expected that the security can be increased from the attack of modeling the PUF circuit by collecting a plurality of challenge signals (CH) and secondary response signals (RP ").

FIG. 13 is a graph showing the difference between the secondary response signals RP "outputted when the same challenge signal CH is repeatedly input according to the number of feed arbiters (FF arbiters).

We design arbiter-PUF (arbiter-PUF) by assigning 1, 2, 4, and 8 FF arbiters to each arbiter-PUF. The experiment was performed 100 times randomly.

Whenever the propagation delay time of the switches is changed, one representative RP containing the intended noise is output, and then the same CH is input 1,000 times repeatedly to output the representative RP, and RP "is outputted and compared.

(a) shows experimental results when the random propagation delay time of the switch is maximum 1.00% and (b) is maximum 3.00%.

It can be seen that the difference distribution diagram is largely divided into three parts. If the ⓐ or ⓑ part appears to be high, the part where the intended noise is inserted between the RPs to be compared is the same, the area of the part of ⓐ and ⓑ relative to the number of FF arbiters is relatively shown, The lower the area, the wider the area of the ⓐ part is, because the signal propagation delay time of the PUF circuit switches receiving the value of the FF arbiter is hardly affected, the difference in the intended noise between RPs is reduced. On the contrary, as the number of FF arbiters increases, even if the intended noise is inserted in the same area, various signal propagation delay times are changed and the noise pattern is diversified so that the bit string difference between the RPs increases. This is the part that appears when the intended noise is generated in different regions. It can be seen that as the number of FF arbiters increases, the bit string difference increases finer.

9. Hardware area comparison

It is important to reduce the hardware overhead associated with device authentication in an authentication system, which typically consists of multiple devices and a small number of authenticators. In the proposed authentication scheme, since an error correction decoder (ECC decoder) is disposed in the authenticator without using a separate security module, it is possible to reduce hardware costs.

Here, the measurement of the hardware area introduced was based on ALTERA's Cyclone IV FPGA.

A typical error correcting code (ECC) used for error correction of data is a BCH code. Table 2 shows the fms logic elements (LEs) according to the error-correctable bit (T) based on the length of 1280 bits of the RP designed in the experiment.

Depending on the type of ECC and the parameters of the PUF structure, LEs can be different, but it can be seen that many LEs are required along with memory to stabilize the RP. It can be seen that by not placing the ECC module in the device portion, a lot of hardware overhead can be reduced.

(Table 2)

(Table 3)

The way to protect the exposed CRP is through the security module before sending or receiving CH or RP. In systems using PUF, a hash function is generally used. Table 3 shows the number of LEs according to the version of the fast hash function, and it is found that a large amount of hardware resources are required together with the ECC module [21].

Table 4 compares the hardware area, LEs and Logic Register (LRs) of the existing arbiter-PUF, the proposed arbiter-PUF, based on the modeling model for the experiment. It is. Each of the switches is 64, and in the proposed arbiter-PUF, eight feed arbitrators (FF arbiters) and multiplexers are added. It can be confirmed that the result of the measurement in the state excluding the controller and the hardware overhead caused by the addition of the function for inserting the intended machining noise can vary depending on the authentication system to be applied.

(Table 4)

10. Conclusion

In the present invention, an attacker deliberately inserts noise into the RP exposed in the system for performing authentication of the device using the PUF, making it difficult for the attacker of the outside to analyze the CRPs.

Also, in the present invention, by mixing the arbiter-PUF and the FF arbiter-PUF and generating a random value separately, it is possible to increase the difference between the RP used for authentication and the RP used, Which makes it difficult to predict which CRPs are not.

Further, in the present invention, the redundancy size to be decoded independently from the decoder of the LDPC code can be increased or the number of regions can be increased to increase the amount of noise, thereby further improving the difficulty of analysis.

Further, in the present invention, it is possible to generate more random noise patterns by increasing the number of feed arbiter (FF arbiter) in the arbiter-PUF structure and the number of switches receiving the input values.

In the present invention, an arbiter-PUF (arbiter-PUF) structure and an authentication system structure using the arbiter-PUF make it difficult to analyze CRPs. In addition, in an authentication system including a small number of authenticator and a plurality of devices, The hardware overhead can be reduced because the ECC decoder module is placed in the authenticator instead of the device, and the function of inserting the intended noise is a structure that uses the arbiter-PUF itself.

100: Device 110: PUF circuit
120: noise inserting unit 200: authenticator
210: Challenge response pair storage unit 220: Error correction decoder
230: comparator 240: noise position analyzer
300: Helper data storage unit

Claims (9)

A device including a PUF circuit and a noise insertion unit to generate and output a secondary response signal including a processed noise upon receiving a challenge signal;
A helper data storage unit storing helper data corresponding to a challenge signal for the PUF circuit of the device and a corresponding response signal corresponding thereto; And
And an authenticator which receives the secondary response signal from the device and removes processing noise to generate a final response signal to perform authentication. The method according to claim 1,
The PUF circuit of the device
A linear feedback shifter register for receiving a challenge signal to generate and output a pseudo-random number sequence;
A plurality of internal multiplexers connected in series and changing connection states of the two internal multiplexers included in the internal input according to the input value and a plurality of internal multiplexers each using a corresponding bit of the pseudo random number sequence generated in the linear feedback shifter register switch;
A plurality of feedforward arithmetic units each of which is composed of a flip-flop and which receives an output of one of the plurality of switches and generates an output value;
A selector for selecting one of the plurality of feedforward arbiters and a corresponding one of the plurality of switches according to a selection signal in response to the corresponding bit signal from the output value of the feedforward arbiter and the pseudo-random number sequence provided in the linear shifter register, A plurality of multiplexers for providing an input value to the multiplexer;
A response arbiter located at a terminal of the plurality of switches and outputting an output value according to a signal arriving first among two paths transmitted through the paths of the switches of the plurality of switches; And
And a selection signal generator for generating a selection signal for each of the plurality of multiplexers and providing the selection signal to each of the plurality of multiplexers. The method according to claim 2,
Wherein the selection signal generator provides a selection signal to the plurality of multiplexers to output a pseudo-random number sequence as an output value from the linear feedback shift register in a registering step, and the plurality of switches output pseudo-random numbers A non-physically replicable function system with noise inserted to use a sequence as input. The method according to claim 2,
Wherein the selection signal generator provides selection signals to the plurality of multiplexers so that the plurality of switches receive the pseudo-random number sequence of the linear feedback shifter register when the secondary response signal is generated in the regeneration step, Wherein a noise is inserted to provide a selection signal such that an output of the feedforward arbiter is selected through a plurality of multiplexers when generating bits of a portion to be generated in an intended processing noise. The method according to claim 1,
Wherein the device includes noise inserted to insert processing noise into a redundancy portion in a secondary response signal comprising a message portion and a redundancy portion. The method according to claim 1,
The device
A noise inserting section for providing information on a position where the machining noise pattern and the machining noise are to be inserted; And
And generates a first response signal including a natural noise and provides the first response signal to the noise inserter. The noise inserter receives information on a position at which the machining noise pattern and machining noise are to be inserted in the noise inserter, And a PUF circuit for generating and outputting a quadrature response signal. The method according to claim 1,
The authenticator
A challenge response pair storage for storing a challenge signal for the device and a corresponding response signal corresponding thereto, the challenge response pair storing device providing a stored challenge signal to the device;
A noise position analyzer receiving the secondary response signal and providing insertion noise information of the processing noise pattern and processing noise;
The second noise removing unit may receive the second response signal using the processed noise pattern and insertion position information of the processing noise provided by the noise position analyzing unit to remove the natural noise to form a first response signal, An error correction decoder for generating an error correction code; And
And a comparison unit comparing the corresponding response signal stored in the challenge response storage unit and the final response signal output from the error correction decoder to perform authentication. The method of claim 7,
The error correction decoder
A non-physically replicable function system with embedded noise, which is a low-density parity-check code decoder based on quasi-cyclic LDPC (Quasi-Cyclic LDPC) codes and which uses block-by-block parity-check matrices. The method of claim 8,
The part corresponding to the redundancy in the parity-check matrix is divided into a total of three parts, and each parity-check matrix part is constructed so as not to affect the other part, A non-physically replicable function system with noise inserted to enable error correction in the state where any redundancy part of three parts is excluded.

Images