On the Physical Security of Physically Unclonable Functions (eBook)

List of Publications 7
Contents 9
Abbreviations 12
List of Figures 14
List of Tables 16
Abstract 17
1 Introduction 19
1.1 Motivation and Background 19
1.1.1 Reconfigurable Hardware 19
1.1.2 Physical Attacks 20
1.1.3 Physically Unclonable Function 21
1.2 Problem Statement 22
1.3 Scientific Contribution 23
1.4 Thesis Structure 24
2 Background 25
2.1 Physically Unclonable Functions 25
2.1.1 Arbiter PUF 26
2.1.2 Ring-Oscillator PUF 28
2.1.3 Are PUFs Tamper-Evident? 29
2.2 Reconfigurable Hardware 29
2.2.1 Security During Configuration 30
2.2.2 PUF Implementations on FPGAs 32
2.3 Semi-Invasive Attacks 32
2.3.1 Photonic Emission Analysis 32
2.3.2 Laser Fault Injection 33
2.3.3 Optical Contactless Probing 34
2.4 Related Work 35
3 Experimental Setup 36
3.1 Devices Under Test 36
3.1.1 Intel/Altera MAX V CPLD 36
3.1.2 Intel/Altera Cyclone IV FPGA 37
3.2 Hardware Implementations 37
3.2.1 Standalone PUF Implementations 37
3.2.2 Red Key Calculation 39
3.2.3 PUF-Based Sensor 40
3.3 Optical Setup 40
3.3.1 Photonic Emission Analysis Setup 40
3.3.2 Laser Fault Injection Setup 41
3.3.3 Optical Contactless Probing Setup 45
4 Photonic Side-Channel Analysis 47
4.1 Attack Scenario 47
4.1.1 Characterization of Multiplexer-Based Arbiter PUF 48
4.1.2 Characterization of Inverter-Based Arbiter PUF 50
4.2 Results 51
4.3 Discussion and Potential Countermeasures 54
4.3.1 Feasibility of the Attack 54
4.3.2 Photonic-Side Channel Attack Versus Modeling Attack 55
4.3.3 Applicability of the Attack on Smaller Technologies 55
4.3.4 Countermeasures 57
5 Laser Fault Injection 60
5.1 Attack Scenarios 60
5.1.1 LFI Attack Against XOR Arbiter PUFs 60
5.1.2 LFI Attack Against RO PUFs 63
5.2 Results 64
5.3 Discussion and Potential Countermeasures 66
5.3.1 Scalability of the Attack 66
5.3.2 Applicability of the Attack 67
5.3.3 Countermeasures 67
6 Optical Contactless Probing 69
6.1 Attack Scenario 70
6.1.1 Key Extraction 70
6.1.2 RO PUF Characterization 72
6.2 Results 72
6.2.1 Key Extraction 72
6.2.2 RO Characterization 74
6.3 Discussion 76
6.3.1 Locating the Registers and IP Cores on the Chip 76
6.3.2 Feasibility and Scalability of the Attack 77
6.3.3 Tamper Evidence 78
6.4 Potential Countermeasure 78
6.4.1 Requirements for PUFs as Sensors 79
6.4.2 Sensor Candidates 79
6.4.3 Combining RO Sum PUFs and RONs 80
6.4.4 Enrollment and Verification 81
6.4.5 Monitoring of Optical Probing Attempts 82
6.4.6 Strengths and Weaknesses of PUFMon 82
7 Conclusion and Future Work 84
References 87