36.3 A Modeling Attack Resilient Strong PUF with Feedback-SPN Structure Having <0.73% Bit Error Rate Through In-Cell Hot-Carrier Injection Burn-In

Abstract

Strong physically unclonable functions (Strong PUFs) are expected to meet the low-energy and low-latency authentication requirements of IoT applications, owing to their exponential number of challenge-response pairs (CRPs). However, Strong PUFs suffer from vulnerability to modeling attacks and a high bit-error rate (BER). The first Strong PUF, known as the arbiter PUF, has little tolerance against modeling attacks because of the linear summation of path-delay times in its response [1]. Several studies have been conducted to improve immunity by introducing non-linearity in the response-generation procedure [2] -[6]. Out of these, only look-up-table (LUT)-based solutions [2], [6] achieved a high machine-learning (ML) robustness against more than 0.1M training CRPs. However, the design in [2] requires 112K bits of entropy, and that in [6] uses many AES S-boxes, as well as entropy sources. The complex response procedures cause high native BER in Strong PUFs, although zero error is not essential because cryptography is not needed in the authentication procedure. CRP filtering [3], [5], [6], a popular countermeasure, not only reduces usable CRPs, but it also requires the server to perform additional tasks in both enrollment and authentication. Taking advantage of a LUT, one can apply SRAM-PUF stabilization techniques. Hot-carrier-injection (HCI) burn-in [7] does not reduce the number of usable bitcells. However, conventionally, it requires the inverse data to be written back before HCI burn-in. Although this could be done on-chip, it provides a potential attack point to an adversary.