A large-scale comprehensive evaluation of single-slice ring oscillator and PicoPUF bit cells on 28-nm Xilinx FPGAs

Due to its reconfigurability and fast design turnaround time, FPGA has become an attractive target platform for developing hardware security primitives such as PUF and TRNG. A PUF is a security primitive that exploits the imperfect manufacturing process variations to generate a unique digital fingerprint for a monolithically integrated electronic device or system. Since the physical disorder properties introduced by process variations among different nanoscale devices on the same die and across dies are outside the control of the manufacturer, PUFs are inherently difficult to clone. Accordingly, a PUF circuit has a number of desirable features for security applications, such as the ability to provide low-cost unclonable identity of an (IC) or to return a device-specific response to an input challenge for chip authentication. These unique device intrinsic properties can be utilized in a number of different use cases, such as key generation, lightweight authentication protocols, anticounterfeiting and supply chain security. Some PUFs can also be used as TRNGs. A TRNG is another widely used hardware security primitive that makes use of noise and non-systematic variations in physical processes [1, 2] to support security-critical tasks such as secret or public key generation, seeds for cryptographic primitives and nonces.

The major difference between (ASIC) and FPGA-based PUFs is that individual devices of an ASIC PUF are not manufactured until the design has been physically placed and routed, whereas the hardware resources of an FPGA PUF have already been manufactured prior to physical design. Consequently, the maximum and minimum entropies that can be extracted from an FPGA chip for PUF become more dependent on the size and locality of its bit cells even though every bit cell is identically designed. Specifically, the entropy of a logic slice, which is the minimum reconfigurable unit of an FPGA, is an essential factor that contributes to the quality of these security primitives. Investigating and evaluating the entropy contributed by each slice of an FPGA will therefore provide invaluable insight into single bit cell response of FPGA-based PUF and TRNG designs independent of the routing delay between slices. Unfortunately, the bit cell of most known PUFs that are suitable for FPGA implementation cannot be configured into a single slice of an FPGA, which introduces inaccuracy and inconsistency in evaluation due to the routing constraint between slices at different localities. In this paper, we consider two PUF designs, namely RO and identity-based PUF (referred to in this paper as PicoPUF) [3, 4], whose repetitively used core elements can be implemented on a single FPGA slice. The oscillation frequency generated by the same smallest 3-stage ROs is different from slice to slice and from device to device. ROs are the fundamental component of glitter-based TRNGs which has been widely considered for FPGA implementation. The frequencies generated by two ROs are also usually compared to produce an output bit of a PUF. A number of different PUF structures based on ROs have been proposed in the literature, such as the original RO PUF design [5] and the SUM-PUF [6]. In contrast, PicoPUF generates a random bit based on the difference in timing between two delay paths on the same slice of an FPGA. Previous research [7] has shown that PUF metrics are affected by the number of devices used to evaluate the PUF designs. The larger the number of devices, the more accurate the inference about the evaluated metrics. Hence, a testbed is built to provide a large-scale analysis of the core bit cells of these two designs.

This paper is an invited extension of our preliminary work reported in [8] for this special issue. A comprehensive evaluation of two single-slice-based designs is investigated. More specifically, our research contributions are summarized as follows.The rest of the paper is organized as follows: Sect. 2 provides a literature review of previous works on FPGAs. Two single-slice-based designs are utilized and introduced in Sect. 3. Section 4 presents the FPGA implementations of the two designs. A comprehensive experimental evaluation and comparison are provided in Sect. 5. Conclusions are given in Sect. 6. Section 7 provides the links to access the raw data.

A number of previous works have examined ROs on FPGA in the context of PUFs [5, 9‐11], as well as process variations [12, 13]. However, there are only two existing large-scale RO PUF datasets on FPGAs. In [14], the testbed comprises 193 FPGA devices and 512 ROs, which is smaller in size than this work. Moreover, their data are generated from Xilinx Spartan-3 FPGAs, which are somewhat outdated. Recently, another dataset based on 100 Xilinx 28-nm Artix-7 FPGAs is provided by [15] for evaluating three oscillation-based PUFs, including RO PUF, transient effect RO PUF (TERO) and Loop PUF. The number of RO PUF instances per device, \(16 \times 80 = 1280\), is less than this research work. To provide a large dataset, a strategy of instantiating multiple copies of the PUF design on each FPGA device was employed [16]. This is acceptable for some types of analysis, but it is also restrictive for inter-device variation analysis. The UNIQUE project also investigated RO PUFs on a large number of devices (96) [17], but it targeted 65 nm ASICs instead of FPGAs. The impact of floorplan location for RO PUFs was also investigated [18] based on a small-scale testbed of FPGAs. A large-scale RO PUF analysis in terms of slice type, evaluation time and temperature on 28-nm Xilinx FPGAs was recently performed in [19]. In this paper, the same dataset has been employed to further evaluate the entropy of the RO design and investigate the relationship between different metrics. This is the first evaluation of a single-slice delay-based PUF design [3] on a large-scale testbed. The investigation leads to the first comparison of two known single-slice-based PUF cell designs.

PUF metrics are affected by the number of devices used to evaluate the PUF designs, as revealed in [7]. For greater accuracy, it is essential to evaluate a PUF design on large-scale testbeds. Correlation is a statistical relationship between two random variables. In the context of PUFs, it relates the likelihood of predicting the bit response of one device from the response of another device. Correlation reduces the effort for an adversary to predict the secret generated by or protected with the PUF. Several works have been published to evaluate the spatial correlation of PUF designs [20, 21]. A number of other methods have also been proposed to assess the unpredictability of a PUF. In CTW, lossless compression algorithm is utilized to predict the upper bound of entropy (i.e., the best case) of a response [17, 18, 22‐24]. Min-entropy is the most conservative estimate of the response unpredictability, and it represents the lowest bound of entropy (i.e.  the worst case) of a set of PUF responses [16, 22, 24‐26]. The actual entropy is expected to lie somewhere between this and the estimate described in the (NIST) specification 800-90 [27].

Table 1 presents some previously reported results on uniqueness and randomness of various PUF designs [28]. It is reasonable to believe that as the randomness of the PUF response increases, the inter-die HD between responses tends to get nearer to the ideal value of 0.5. However, the reverse may not be true for min-entropy. Although the uniqueness results are very close to or equal to 0.5, the min-entropy results are not as close to their ideal value of 1. The ideal CTW is 100%, implying no data correlation or redundancy can be exploited for compression. Except for the buskeeper PUF evaluated in [25], the results of CTW in Table 1 are only evaluated over the responses of a small number of physical devices.

There are two types of slices on an Xilinx Artix-7 FPGA: SLICEL and SLICEM. All logic components required for a single cell RO implementation are available on both types of slice. Therefore, there is no restriction on the placement of the single cell RO on the FPGA.

As shown in Fig. 2, the slices are paired up in the configurable logic blocks (CLBs) of the Artix-7 FPGA. The RO type is identified as either upper or lower according to its position within a CLB, and as left or right according to the location of its CLB routing channel to the switch box. The numbers of each of the four possible placements of RO and PicoPUF cells implemented on one Artix-7 chip are listed in Table 2. The total numbers of ROs and PicoPUF implemented on one chip are 6592 and 8000, respectively.

The PicoPUF implementations for the four different locations of CLB placement of a Xilinx Artix-7 FPGA are shown in Fig. 3. The routing for any path that contributes directly to the race condition was fixed using the hook script in Vivado design flow. The detailed implementations of both the RO and PicoPUF designs can be found in [3, 19], respectively.

In this work, we presented a large-scale analysis of two single-slice-based bit cells, RO and PicoPUF, for PUF implementation on 217 Xilinx Artix-7 XC7A35T FPGAs. The entire fabric was covered by either 8000 distinct PicoPUF cells or 6592 RO instances. The uniqueness, uniformity, correlation, reliability, bit-aliasing and min-entropy for these two designs in four different types of placement are rigorously evaluated for the first time. The experimental results show that the overall min-entropy, correlation and uniqueness of the PicoPUF are slightly higher than those of the RO, while the other metrics, including uniformity, bit-aliasing and reliability, are slightly lower. Moreover, the experimental results show that the lower the correlation between devices, the higher the min-entropy and uniqueness for both design implementations on FPGA. Finally, it is shown that the physical placement location of the cell for RO has a greater influence than for PicoPUF, specifically in the area adjacent to the clock distribution network. A PicoPUF can independently generate a 1-bit response per slice, whereas the RO-based PUF requires at least two ROs and extra post-processing, e.g., counter, to generate one response bit. From this perspective, PicoPUF is more efficient than RO PUF.

The raw PicoPUF and RO frequency data can be publicly accessible at https://​pure.​qub.​ac.​uk/​portal/​en/​datasets/​picopuf-dataset(522efef3-eeac-4523-9be7-2c3f296d61ef).​htmlQUB-CSIT-Raw-Picopuf-Data and https://​s3.​eu-central-1.​amazonaws.​com/​aisecresearchdat​a/​2018fpga-ro-data/​index.​htmlEU-FP7-SPARKS-RO-DATA, respectively.