University of Massachusetts Amherst

ScholarWorks@UMass Amherst

Masters Theses Dissertations and Theses

August 2023

Fingerprinting for Chiplet Architectures Using Power Distribution

Network Transients
Matthew G. Burke
University of Massachusetts Amherst

Follow this and additional works at: https://scholarworks.umass.edu/masters_theses_2

Part of the Signal Processing Commons, and the VLSI and Circuits, Embedded and Hardware Systems
Commons

Recommended Citation
Burke, Matthew G., "Fingerprinting for Chiplet Architectures Using Power Distribution Network Transients"
(2023). Masters Theses. 1330.
https://doi.org/10.7275/35660113 https://scholarworks.umass.edu/masters_theses_2/1330

This Open Access Thesis is brought to you for free and open access by the Dissertations and Theses at
ScholarWorks@UMass Amherst. It has been accepted for inclusion in Masters Theses by an authorized
administrator of ScholarWorks@UMass Amherst. For more information, please contact
scholarworks@library.umass.edu.
FINGERPRINTING FOR CHIPLET ARCHITECTURES
USING POWER DISTRIBUTION NETWORK
TRANSIENTS

A Thesis Presented
by
MATTHEW BURKE

Submitted to the Graduate School of the

University of Massachusetts Amherst in partial fulfillment
of the requirements for the degree of

MASTER OF SCIENCE IN ELECTRICAL AND COMPUTER ENGINEERING

May 2023

Electrical and Computer Engineering

 FINGERPRINTING FOR CHIPLET ARCHITECTURES
USING POWER DISTRIBUTION NETWORK
TRANSIENTS

A Thesis Presented
by
MATTHEW BURKE

Approved as to style and content by:

Wayne Burleson, Chair

Daniel Holcomb, Member

Hossein Pishro-Nik, Member

Christopher V. Hollot, Department Head

Electrical and Computer Engineering
 ACKNOWLEDGMENTS

I would first like to thank the MITRE Corporation for funding this project, and

for their oversight and assistance. Second, I want to thank Wayne Burleson for his
long-time role as my advisor and mentor, for pushing me past my limits and for
providing me the opportunity to become an electrical engineer. Additionally, I thank

Dan Hoclomb for the long-term guidance he has provided me on this project, and
my colleagues for their companionship, assistance and inspiration for this work. In
particular, I thank Max Cohen Hoffing for his supporting experiments with hardware

implementations of our work. I thank my parents and the rest of my family for their
life-long support and provision. Everyone here made this work possible.
Above all, I thank the Triune God; with Him I have everything, without Him,

nothing.

iii
 ABSTRACT

FINGERPRINTING FOR CHIPLET ARCHITECTURES

USING POWER DISTRIBUTION NETWORK
TRANSIENTS

MAY 2023

MATTHEW BURKE
B.Sc., UNIVERSITY OF MASSACHUSETTS AMHERST

M.S.E.C.E., UNIVERSITY OF MASSACHUSETTS AMHERST

Directed by: Professor Wayne Burleson

Chiplets have become an increasingly popular technology for extending Moore’s

Law and improving the reliability of integrated circuits. They do this by placing

several small, interacting chips on an interposer rather than the traditional, single
chip used for a device. Like any other type of integrated circuit, chiplets are in need
of a physical layer of security to defend against hardware Trojans, counterfeiting,

probing, and other methods of tampering and physical attacks.

Power distribution networks are ubiquitous across chiplet and monolithic ICs, and
are essential to the function of the device. Thus, we propose a method of fingerprinting

transient signals within the PDN to identify individual chiplet systems and physical-
layer threats against these devices.
In this work, we describe a Python-wrapped HSPICE model we have built to

automate testing of our proposed PDN fingerprinting methods. We also document

the methods of analysis used- wavelet transforms and time-domain measurements-

iv
to identify unique characteristics in the voltage response signals to transient stimuli.
We provide the true positive and false positive rates of these methods for a simu-

lated lineup of chips across varying operating conditions to determine uniqueness and
reliability of our techniques.

Our simulations show that, if characterized at varying supply voltage and tem-
perature conditions in the factory, and the sensors used for identification meet the
sample rates and voltage resolutions used in our tests, our protocol provides sufficient

uniqueness and reliability to be enrolled. We recommend that experimentation be

done to evaluate our methods in hardware and implement sensing techniques to meet
the requirements shown in this work.

v
 TABLE OF CONTENTS

Page

ACKNOWLEDGMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii

ABSTRACT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv

LIST OF TABLES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii

LIST OF FIGURES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

CHAPTER

1. INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

1.1 PUFs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 PDNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.3 Chiplets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.4 Our Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.5 Structure of Thesis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

2. RELATED WORK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2.1 Modeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 Transient Signal Sensing/Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3 Chiplet PUFs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

3. PDN MODEL DESCRIPTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

3.1 HSPICE Single Die Model Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

3.2 Parameter Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.3 Sink Logic and Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.4 HSPICE Multi-Die Model Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

3.4.1 Model Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3.4.2 Interposer and Die Dimensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.4.3 Process Variation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.5 Temperature and Voltage Variations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

vi
4. SIMULATION RESULTS AND SIGNAL PROCESSING . . . . . . . . . 19

4.1 Threat Model and Variation Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

4.2 Uniqueness and Reliability Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
4.3 Sample Rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.4 Voltage Resolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.5 Time Domain Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.6 Wavelet Transforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
4.7 Decision Thresholds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.8 Other Identification Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

4.8.1 AC Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

4.9 Multi-die measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

5. HARDWARE EXPERIMENTATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

5.1 Hardware vs. Simulation Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

5.2 Current Sink and Measurement Logic, Performance . . . . . . . . . . . . . . . . . . 40

6. POSSIBLE FUTURE WORK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

6.1 Modeling Improvements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

6.1.1 Analytic RLC Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

6.1.2 Active Circuits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

6.2 Uniqueness Analysis Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

6.2.1 Machine Learning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

6.2.2 Fourier Transforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

6.3 New Simulation/Experimentation Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

6.3.1 Bayesian Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

6.4 New Threat Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

7. CONCLUSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

BIBLIOGRAPHY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

vii
 LIST OF TABLES

Table Page

3.1 Table of parameters used for our PDN models, taken from [1]. The
values correspond to those in figure 3.4 * nominal capacitance
value is reduced by a factor of 2 to mimic active decap being
disabled. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

4.1 True positive rate/false positive rate of the time domain L1 norm
identification method, given as a function of sample rate and
voltage measurement precision. Rates given as cumulative across
temperature and supply voltage corners. 1.0 indicates a 100%
rate, and 0.0 a 0% rate. *: indicates points where fingerprinting
seems to fail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

4.2 True positive rate/false positive rate for time domain L2 norm. Same
format and method as 4.1. *: indicates points where
fingerprinting seems to fail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

4.3 True positive rate/false positive rate of the CWT L1 norm

identification method, given as a function of sample rate and
voltage measurement precision. Rates given as cumulative across
temperature and supply voltage corners. 1.0 indicates a 100%
rate, and 0.0 a 0% rate. *: indicates points where fingerprinting
seems to fail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

4.4 True positive rate/false positive rate for CWT L2 norm. Same format
and method as 4.3. *: indicates points where fingerprinting seems
to fail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

viii
 LIST OF FIGURES

Figure Page

1.1 Lumped Diagram of an FPGA PDN [2]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

1.2 Three-dimensional diagram of a PDN [3]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

1.3 Diagram of a PDN in chiplet architecture [1]. The grey dielectric

with metal layers is the interposer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

3.1 Diagram of the top-layer grid for the single-die model, with the
interposer connected to its edges. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3.2 Diagram of the bottom-layer grid for the single-die model, with
NMOS sinks. The data here normally assumes these sinks to be
in the center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

3.3 Unit cell model of metal layers in a PDN, with transmission lines
used for wires [4]. Note: this particular model does not include a
conductive component (G) in parallel with the capacitor. . . . . . . . . . . 14

3.4 Diagram of a unit cell, with the ground wire RL values lumped into
those of the the power wires [1]. With explicit power and ground
wires, each would have nominal resistor and inductor values of R
and L. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3.5 Diagram of the RLGC model for a through-silicon via (TSV) used in
[5]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

4.1 Diagram of the dice (sink, suspect, trusted) and interposer (grey)
arrangement used for our simulations [6]. Sinks are placed across
each point of the sink die, and measurements are made on the
edge near the suspect (blue). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

4.2 Waveforms from 4 different chips in response to a trapezoidal current

sink. Response is shown for a sensor node (blue) as well as a node
on the trusted die (green), directly adjacent to the suspect (see
figure 4.1). Current sink varies from 1 mA to 200 mA. . . . . . . . . . . . . . 23

ix
4.3 Zoomed-in view of the response to the current sinks’ rising edge,
shown in figure 4.2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

4.4 Zoomed-in view of the response to the current sinks’ falling edge,
shown in figure 4.2. Notice the variation becomes more noticeable
here; this is where we see most variation in our wavelet
transforms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

4.5 PDN response to the rising edge of the sink, plotted at various
temperature and supply voltage conditions. Gathered from the
single-die model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

4.6 Differential wavelet transform between two chips at nominal T&V,

across varying sample rates. Notice the aliasing that occurs as
sample rate is decreased. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

4.7 Differential wavelet transform between two chips at nominal T&V,

across varying voltage quantization values. Notice the relatively
low change in variation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

4.8 Sum of the L1 differences in wavelet transform coefficients for the

uniqueness (red, inter-chip) tests and reliability (blue,
temperature and supply voltage). On average, the L1 differences
are larger for the reliability tests than the uniqueness tests,
indicating that this is a poor metric on its own to identify one of
our simulated PDNs. The blue box at 0 indicates the result for
the control grid re-simulated at nominal temperature and voltage
during the reliability tests. Data collected from old, single chip
model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

4.9 Sum of L1 wavelet coefficient differences, 30-chip uniqueness tests. . . . . . 33

4.10 Sum of L1 wavelet coefficient differences for a single chip with 30

different noise variations added. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

4.11 Uniqueness (top) and reliability (bottom) performance of the wavelet

transform for nominal T&V conditions, with the chips’ signal
sampled at 20 GHz and measured voltage quantized to 100 µV .
Note that the minumum L1 value from process variation is greater
than the maximum from the noise variation, so this is a unique
and reliable system at these conditions. . . . . . . . . . . . . . . . . . . . . . . . . . . 33

4.12 Results of HSPICE linear sweep of AC frequencies near predicted

resonance frequencies of 100 chips. Gathered from the single-die
model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

x
4.13 Scatter plot of the resonance peaks shown in figure 4.12. . . . . . . . . . . . . . . 36

4.14 AC frequency sweep of a single chip, with temperature and supply

voltage varying on each iteration. As expected, the resonance
frequency remains constant, while the amplitude changes. The
first chip from the tests in figure 4.12 was used for these tests. . . . . . . 37

4.15 Scenario with trusted dice (sink and sensor) on opposite sides of a
potentially hostile die (suspect) [6]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

5.1 The Virtex UltraScale+ FPGA used for the supporting hardware
implementation [7]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

6.1 Lumped model of an IC’s (not chiplet) PDN, with workload [8]. . . . . . . . 43

6.2 Sketch of the droops from the circuit modeled in 6.1 in the time and
frequency domain [8]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

xi
 CHAPTER 1

INTRODUCTION

1.1 PUFs
Physical unclonable functions (PUFs) are hardware-based systems intended to
identify an individual chip apart from any other, and prevent counterfeiting and/or
identify when a chip has been tampered with. Given a physical stimulus (chal-

lenge), they produce a measurable physical response that- if designed and imple-
mented correctly- should be unpredictable to an attacker. Weak PUFs and strong
PUFs are the two broadest classes of PUFs; the former rely upon a single (or

few) challenge-response pair(s) (CRPs), while the latter rely upon a massive set of
challenge-response pairs- ideally ones that exist on an exponential space and contain
many more CRPs than can be exhaustively tested by an attacker [9]. The response-

or series of responses- should be unique to each chip, and any tampering should
change the PUF’s response sufficiently to classify it as hostile. However, it must also
be reliable- that is, produce sufficiently similar responses across a wide variety of

environmental conditions to not be rejected as a hostile chip.

1.2 PDNs
Power Delivery Networks (PDNs) are critical to the function of any modern inte-
grated circuit. As their name implies, they are responsible for distributing sufficient
power for the chip’s operations, as well as regulating power supplies to provide con-

sistent power supply and protect the chip from damage [10]. PDNs are typically
extremely complex, multi-layer grids of wires and nonlinear components to ensure

1
 Figure 1.1: Lumped Diagram of an FPGA PDN [2].

stable power is delivered to the entire chip. Since these structures are ubiquitous and

integral to the entire chip, they make promising candidates for PUFs (or other fin-
gerprinting methods); tampering with a chip would practically necessitate disturbing
its PDN, and using them as a PUF would require little to no additional hardware or

logic.

1.3 Chiplets
Due to the increasing difficulty of shrinking transistor sizes and the area lim-
itations of photolithography, alternative methods for increasing logic density have
become required to continue meeting the predictions of Moore’s Law [11]. Chiplet

architectures bypass this problem by placing multiple small chips on a single die,
usually in a type of ’2.5D’ configuration [11]. Since these chips need to communicate
with each other, they require an elaborate, dense array of wires to carry information

from chip-to-chip; this is done through the interposer. Each of them also requires a
designated PDN, which will be connected to the PDN for the entire package through
its interposer’s PDN.

All of this additional complexity brings additional security concerns, however.

Rather than monitoring a single chip for tampering, we now need to watch for physical
attacks against multiple chips, as well as a subset or single chip from the whole

2
 Figure 1.2: Three-dimensional diagram of a PDN [3].

Figure 1.3: Diagram of a PDN in chiplet architecture [1]. The grey dielectric with
metal layers is the interposer.

3
network. We must also protect the interposer, an asset not present on other ICs.
Moreover, the increased density of busses and power wires means that effects of

localized tampering may be much more damped than in traditional architecture, and
thus much harder to detect.

1.4 Our Work

In this work, we will describe simulation analyses for a novel method of chiplet

PDN fingerprinting. We have designed a Python program that automates HSPICE

simulation of our protocol based on RLGC models of wires. We will describe the
parameters used by this model as well as its overall structure. We will also describe

the methods of transient stimulation and analysis of the resulting signals; we rely upon
both differences in the time domain measurements and differences in the coefficients
of a wavelet transform.

The program we contribute is capable of creating PDN model structures with

arbitrary length/width and, with minor alteration, layers of power/ground wires.
Additionally, it is capable of placing gaps within the grid to mimic real PDNs. These

meshes can be grouped into individual sections resembling the interposer and chiplets
in a chiplet system, as shown in figure 4.1. The chiplets will be connected to the
interposer via micro-bump models, while isolated from each other.

Nearly all parameters of the model are customizable. Furthermore, it is able to

generate multiple types of stimuli signals, and can be modified to produce varying
types of current sink logic. We also provide a complementary program designed to

automatically parse the output SPICE files and analyze the transient data according
to the methods described in this work.
Our ultimate contribution is the chiplet PDN identification method, with a set

of predictive simulation results for evaluating how our design should be expected to

4
perform if implemented in hardware. We propose methods for that implementation,
as well as possible ways to improve upon the techniques we have developed.

1.5 Structure of Thesis

The rest of this thesis is structured as follows: chapter 2 describes relevant work
that formed the basis of this paper; chapter 3 describes the structure of our PDN
models and parameters for the current state of our work; chapter 4 includes the

current results of our simulated data, and the methods of analysis we’ve attempted
so far; chapter 5 summarizes the results of hardware experimentation supporting
our work, and their significance for the results we present; chapter 6 provides the

motivation and details of investigations that can continue and improve upon our
methods; chapter 7 concludes this thesis.

5
 CHAPTER 2

RELATED WORK

2.1 Modeling
Detailed information on modeling PDN structures is given by Pant and Chiprout
in [3]. This work provided much of the basic information needed for writing the

HSPICE models used for our simulations. Among other contributions, this work
shows that dispersive, 3-dimensional models provide more accurate simulation char-
acteristics than lumped and 2-dimensional models, and that inductances can be ne-

glected on lower metal layers. Therefore, we sought to design a program capable of

generating multi-layer models, and- for our early, single-die models- designed it to
only place inductors on the uppermost layer of the grid. Our latest models, however,

placed inductors on each part of the PDN.

Much like our work, PowerScout provides a program capable of wrapping Ngspice
with Python to model PDNs [10]. Unlike ours, however, Zhu et al. designed Pow-

erScout to examine and quantify side-channel vulnerabilities in PDNs, rather than

analyze their capability for fingerprinting. The models for PowerScout provided the
basis for our proof-of-concepts, but our simulations quickly became independent of

Zhu et al.’s work.

An in-depth analysis of silicon and liquid crystal polymer (LCP) interposers is
given by J. Kim et al. in [1]. This includes a simplification of the interposer PDNs into

unit cell structures, with the electrical properties parameterized into RLGC values for
SPICE simulation. Likewise, K. Kim et al. offer unit cell modeling methods for on-
chip PDNs and RLGC modeling for through-silicon vias (TSVs) in 3D architectures

6
[5]. This type of modeling is also used by S. Kim et al. and H. Park to create an on-
interposer active decoupling capacitance (decap) network, and optimize placement of

decap, respectively [4, 12]. These works were critical to the structure and parameter
selection of our latest, multi-die models, and therefore to the overwhelming majority

of data presented here.

2.2 Transient Signal Sensing/Processing

Danev and Capkun introduce the idea of combining time-domain analysis with
Hilbert and Fourier transforms to fingerprint transient signals in [13]. They show that,
while time-domain and Hilbert analyses are insufficient on their own for fingerprinting

signals, they are capable of identifying friendly wireless nodes from adversarial ones
when combined with Fourier analysis. However, their paper only examined such
techniques over a very limited temperature range (6 ◦ C). Our inspiration to combine

frequency domain transforms with time domain analysis on the original signal came
from Danev and Capkun’s paper.
While the signal processing that must be done for our work may be similar to

that done in [13], there remain significant physical differences between fingerprinting
a wireless sensor node and fingerprinting a chip’s PDN. Mosavirik et al. examine the
impedance and reflectivity of incident transient signals on IC PDNs to characterize

individual chips, classes of chips, and identify location of manufacture [14]. Rather
than the hybrid time domain and transform analysis done by Danev and Capkun,
Mosavirik et al. rely upon a Gaussian Mixture machine learning algorithm to distin-

guish between legitimate and counterfeit/tampered chips.

Zhao et al. use sweeps of workload frequencies (approximating sinusoidal signals)
to characterize FPGA PDNs [2]. They rely upon FPGA logic to provide the workload

and measure the voltage response of the PDN, and use the calculated impedance in
the frequency domain to provide the characterization of the PDN. If implemented

7
on FPGA, similar logic would be a good candidate to create and sense the voltage
signals produced in our simulations. While this work is similar to ours in the sense that

it characterizes a PDN with workloads provided by logic, it doesn’t have security in

mind; rather, it determines the impedance response to find the operational frequencies

with optimal performance and minimum risk of damage. Nonetheless, it is also a good
candidate for security purposes, and is similar to both [14] and the work we have done
with AC analysis (see 4.8.1)

Moini et al. evaluate the performance of ring oscillators (ROs) and large-fanout
flip-flops as power wasters (current sinks), as well as the quality of ROs and time-
to-digital converters (TDCs) for use in detecting power wasting attacks [15]. They

show that ROs are capable of producing current sinks far greater than that of flip-
flops, and that TDCs possess much greater time and voltage resolution than ROs.
More importantly, they show that, when detecting a power wasting attack, TDC

sensors can produce artificially high voltage precision and sample rates of the signal
by shifting the phase of the clock while the power wasting attack is repeated. Should
our fingerprinting be implemented in hardware, this method of TDC sensing may

need to be exploited.

2.3 Chiplet PUFs

Deric and Holcomb successfully created a chiplet-specific PUF using delays be-
tween transmitted and received signals [16]. They relied upon the delay across long
wires in the interposer- used for inter-chiplet communication- to fingerprint their de-

vices. Fundamentally, the physics of their PUF is practically identical to that of

our proposed design. However, ours differs in its reliance upon the whole PDN as
the uniqueness source, and the capture and processing of time-varying signals rather

than the single metric of arrival time.

8
 CHAPTER 3

PDN MODEL DESCRIPTION

There are two models that will be shown in this work. The first is the single die

model, which is the older of the two. This consisted of a single RC mesh for the die,
with an interposer modeled as wires along the edges of the uppermost layer. The
second is the chiplet/multi-die model, which has multiple dies/chiplets (3 in the case

of our tests), each connected to an interposer, but isolated from each other. For this
model, each of the dies and the interposer are modeled as a full mesh RLC grid.
While the tests shown in our work were developed first on the single die model,

the multi-die is a much more accurate model a PDN and much more closely resembles
the chiplet architecture. Therefore, unless otherwise stated, all data presented will be
from the multi-die model. Given that the methods for simulating process variation

(uniqueness) and temperature and supply voltage variation (reliability) are practi-
cally identical for both models, they will be covered solely under the multi-die model
section.

3.1 HSPICE Single Die Model Structure

As previously mentioned, our models rely upon multiple simulated metal layers

to provide optimal accuracy [3]. For the single die tests, our transient simulations
typically used a 3-layer grid, each with a length and width of 5 nodes (locations where
resistors connect). Each grid has an additional fourth layer as the uppermost layer,

acting as the interposer for the grid. As opposed to the other layers, the interposer
is not a grid, but a square array of wires; it consists of eight sections, each with a

9
resistor and an inductor, and two of these eight sections are connected at each corner
of the next grid layer. In the middle of each interposer edge, a DC voltage source

and a capacitor are added in parallel. The interposer is assumed to have the same
wire dimensions and sheet resistance as the uppermost grid layer, therefore one edge

of the interposer has equivalent resistance to the top grid layer (barring differences
due to the modeled process variation). Likewise, the capacitance for each edge is
equivalent to one full row/column of the grid it’s connected to, up to the process

variation differences.

3.2 Parameter Values

For the single die grids, we assumed that each layer has its own nominal value
for its resistors: the top layer’s nominal is 1.0 Ω, the middle has resistors with 1.1 Ω,
and the bottom layer’s resistors are centered at 1.2 Ω. The resistors connecting two

layers, resembling vias, assume the nominal resistance of the uppermost of the two
layers they are connecting. Like the resistors, each layer also has its own nominal
capacitor values: the top’s is 1.1 f F , the middle’s is 1.0 f F , and the bottom’s is 0.9

f F . Both the nominal resistance and capacitance values are intended to reflect the
shrinking size of the wires as the layers approach the chip’s logic layer. We assume
each inductor in the interposer has inductance of 1.0 nH.

It is important to note that the values used for this model were not calculated,
but merely assumed values that seemed to be reasonable approximations of the target
PDN’s RLC values. This was fixed when we moved to the multi-die model, where we

used values gathered from literature on PDN modeling.

3.3 Sink Logic and Signals

The data in this paper has been generated using current sinks modeled by large (50
nm long, 50000 nm wide) NMOS transistors. These were chosen as current sources

10
since we are able to change their length and width to produce non-ideal current
sources, similar to what we’d expect to see in a regular chip with logic undergoing

process variation. The drains of the transistors are attached to the desired nodes on
the bottom layer of the grid, the sources are attached to ground, and the sinks are

turned on simply by applying the desired voltage signal to the transistors’ gates.
Our work relies upon two primary signals sent to the NMOS gates: a step pulse-
resembling a workload being turned on and sustained- and a periodic trapezoidal

pulse, resembling a workload being repeatedly turned on, sustained, and turned off.
We assume that the maximum voltage applied to the gate is equal to that supplied
on the interposer.

3.4 HSPICE Multi-Die Model Structure

Since our protocol is intended for use in chiplet architecture, it should be able

to accommodate multiple chiplets connected via an interposer. Additionally, since

we are concerned with the possibility of an attacker swapping individual dies or
creating localized changes to the PDN, our model also needs to be capable of isolating

process variation to components of the PDN system (interposer, single chiplets), and
providing high-variance RLGC components to single nodes in the system. Since we
are also interested in measuring variations on neighboring dice, we must be able to

isolate placement of current sinks and measurements to individual chiplets. Currently,

our model is capable of all of these functions, with the exception of placing localized
high-variance RLGC devices. This, however, would require minor changes to our

scripts.
By default, our model is written to provide distinct power and ground planes for
each section of the PDN, though it can be configured to lump the ground RLGC com-

ponents into the power grid to reduce computation time if necessary. Each connection
between nodes follows the unit cell structure, which is a common and computationally

11
Figure 3.1: Diagram of the top-layer grid for the single-die model, with the interposer
connected to its edges.

12
Figure 3.2: Diagram of the bottom-layer grid for the single-die model, with NMOS
sinks. The data here normally assumes these sinks to be in the center.

13
Figure 3.3: Unit cell model of metal layers in a PDN, with transmission lines used
for wires [4]. Note: this particular model does not include a conductive component
(G) in parallel with the capacitor.

Figure 3.4: Diagram of a unit cell, with the ground wire RL values lumped into those
of the the power wires [1]. With explicit power and ground wires, each would have
nominal resistor and inductor values of R and L.

efficient method of modeling PDNs. If there is an explicit ground plane, the node
connections will follow the pattern shown in 3.3. If the ground plane is lumped, the
node connections will follow the pattern given by 3.4. In either case, the unit cells are

stitched together into a grid pattern until the desired number of nodes in the x, y, and
z direction is reached. Our program is capable of providing holes in this grid as well,
where no RLGC connections will be made. This feature can be used to model either

a non-homogeneous PDN design or local damage done to the PDN by a tampering

attacker.

14
 For the tests shown in this work, the model used consisted of a chiplet system with
3 dice, connected via interposer. As mentioned in 5, our model lacks a grid for the

package; we would recommend that such a grid would be added to improve accuracy.
Voltage and ground connections are made using through silicon vias (TSVs), modeled

at present as resistors; since the interposer is the uppermost layer, they are connected
to the interposer’s nodes. We assume a TSV pitch of 300 µm. The interposer is
connected to the dice via microbumps, currently modeled as inductors; for these,

we assume a pitch of 150 µm. With minor modifications, the model is capable of
accommodating a more complex RLC model for both the TSVs and microbumps,
but is not configured to do so for our tests. Our model is capable of simulating

multiple ground/power planes with minor adjustments, but we only use one power
and ground plane each for the data in this work.

3.4.1 Model Parameters

The RLGC parameters for our unit cells come from [1], which extracted those pa-
rameters from Ansys HFSS simulations of their silicon-based interposer PDNs; those
parameters are summarized in table 3.1. Though [1] doesn’t provide information on

the die-level PDN parameters, we assume that those are the same as the interposer’s
[12]. The unit cell capacitance shown, however, is reduced by a factor of two in our
simulations. This is because it is common for active decap to be used in PDNs [4, 8],

and we expect a reduction in damping to improve uniqueness from the measured re-
sponse to a transient sink. Therefore, we assume that half of the decap in the PDN
could be temporarily disabled until the relevant parts of the identification protocol

are completed. We would, however, recommend that our tests be repeated with the
full decap enabled to ensure that our protocol would be feasible without disabling it.
The TSVs in our model are represented by resistors with a nominal value 40

mΩ, and the micro-bumps by inductors with a nominal value of 1.39 pH [12]. The

15
Figure 3.5: Diagram of the RLGC model for a through-silicon via (TSV) used in [5].

16
TSVs, however, do have significant LC characteristics, resembled by the schematic in
figure 3.5, and we would recommend modifying the simulation to account for these

parameters. We are unaware if there are significant RC characteristics for the micro-
bumps.

3.4.2 Interposer and Die Dimensions

Our interposer is modeled with 13 nodes in the x-dimension, and 35 nodes in the
y-dimension. Each of our dice has 11 nodes in the x- and y-dimensions. The space

between nodes in the x-y plane resembles 300 µm spacing on a physical IC, so the
dice are approximately 3 mm2 , and the interposer approximately 10.2 mm x 3.6 mm.
We only use one power and ground plane for the interposer and each of the dice.

Unit Cell Parameter Nominal Value

R 18.59 mΩ
L 136.13 pH
C 1.61 nF*
G 18.13 mS

Table 3.1: Table of parameters used for our PDN models, taken from [1]. The values
correspond to those in figure 3.4 * nominal capacitance value is reduced by a factor
of 2 to mimic active decap being disabled.

3.4.3 Process Variation

Since our identification methods are reliant upon the process variation intrinsic to
the wires in the PDN, our simulation must be capable of executing Monte Carlo tests.
To do this, we have written our script to generate a unique HSPICE netlist for every

process variation test we wish to run, and have HSPICE run them independently (30
tests/netlist for a single operating corner is typical for our work; the same set of grids
is used at each corner).

Each device in the simulation has its respective values produced from a Gaussian
distribution independently of the other devices in the test using the Python function

17
random.gauss() [17]. However, as we will discuss in section 4.1, we need to be able
to choose which nodes will undergo process variation, and which will remain fixed .

If a node is desired to experience process variation, each resistor, capacitor, in-

ductor and conductor on that node or directly adjacent to it will have a new value

assigned to it for each grid created (30 in our case). Each of these values is assumed
to come from a Gaussian distribution with a standard deviation (1 σ) of 5% relative
to its nominal value. A device that is desired to remain fixed will be drawn randomly

from the same distribution as one that will be varied, but it will be assigned the same
value for each test.

3.5 Temperature and Voltage Variations

In order to ensure that our PDNs can be reliably identified across a wide range
of environmental variations, we need to test our models at various combinations

of temperature and supply (DC interposer) voltage variations, resembling extreme

environments as well as faulty hardware due to wear or age. Our model assumes a
range of 1.0 V ± 0.1 V (1.0V supply being nominal), and a temperature range of 25
◦
C ± 50 ◦ C (with 25 ◦ C nominal.) Our model currently assumes resistors that vary
by ± 20 % relative to the nominal over the temperature range we use, and capacitors
and inductors that are invariant to temperature change [18, 19].

18
 CHAPTER 4

SIMULATION RESULTS AND SIGNAL PROCESSING

The main type of current sink focused on for this work is a single trapezoidal

pulse, resembling an array of power wasters (e.g. ring oscillators) being turned on,
sustained, and then turned off. This type of current sink is easy to produce on and
FPGA, and would require a series of commands that could be executed on the order

of nanoseconds. Therefore, it would be capable of rapidly collecting the challenge-

response data for our protocol (assuming that repetition of the sink signal wasn’t
needed, as described in 2.2). We assume current sink rise/fall time of 7 ns, with the

sink sustained for 10 ns.

Though the data shown in this work is simulated, rather than extracted from
hardware, hardware experimentation- performed on the Virtex UltraScale+ FPGA

[7]- was done in tandem with this project to support its results. Several of the key
parameters used here- namely the aforementioned sink rise, fall and duration times,
and the low sample rate used (1.3 GHz)- come from that work. While we recom-

mend further evaluation of our presented work on hardware, the experimentation

supporting this thesis will need to be presented elsewhere. Instead, we aim to pro-
vide the theoretical groundwork needed for experimental development of PDN-based

fingerprinting.
At this point, we should also note that the earliest concept for an identification
protocol tested in our simulations relied upon DC stimulation of a PDN section. It is

our opinion, however, that this provides too intuitive a problem for an adversary to
solve, yields too little uniqueness and would be too sensitive to voltage and tempera-

19
Figure 4.1: Diagram of the dice (sink, suspect, trusted) and interposer (grey) ar-
rangement used for our simulations [6]. Sinks are placed across each point of the sink
die, and measurements are made on the edge near the suspect (blue).

ture variations to be usable for such purposes. Therefore, we will not focus on these
tests in this thesis.

4.1 Threat Model and Variation Design

For our work, we assume a chiplet system with 3 dice, and an adversary attempting

to swap or otherwise tamper with one of those dice (referred to as ’suspect’). We

assume the following arrangement for our tests: the center of a 3-die system suspected
as an adversarial die, with sink and voltage-sensing logic located on a die adjacent to

it. A diagram of this setup is in 4.1

Since we assume that only one die is adversarial, We’ve written our simulation
to limit process variation to the suspect die, its micro-bumps, and the sections of

interposer directly connected to it (the die ’shadow’, like that in 1.2). For instance,
this resembles the effects of an attacker de-soldering a desired die from the factory,
and replacing it with a hostile one. The remainder of the PDN has RLGC parameters

taken from a fixed array of random variables, each drawn from the same distribution
as the process variation.

4.2 Uniqueness and Reliability Evaluation

Originally, the intent of this project was to create a PUF system whose measured

values had greater variation between chips than across environmental (temperature

20
and supply voltage in our models) variations. Thus, our PUF would be able to operate
independently of sensors used to measure environmental variation. However, as shown

in figure 4.8, simulations of our single-die model showed much greater variability over
temperature and supply voltage variations than between chips.

Therefore, instead of attempting to design a protocol more sensitive to pro-

cess variation than environmental, we decided to characterize uniqueness across fast
(low temperature, high supply voltage), slow (high temperature, low supply voltage)

and nominal T&V conditions independently, and determine how much greater that
uniqueness is than the variation caused by thermal noise in the system. Thus, we
have a uniqueness and reliability metric for each corner in our tests. This kind of

evaluation could be done on a real system by characterizing behavior across a range

of temperature and supply voltage variations in the factory, and then relying upon
sensor use in the field to determine the most similar operating conditions used in

enrollment.
The thermal noise in our experiment is modeled as additive white Gaussian noise
(AWGN) with a root-mean square voltage (RMS) given by the equation [20]:

p
vrms = kB T /C (4.1)

where kB is the Boltzmann constant, T is the temperature of the system, and

C is the capacitance of the system. For the sake of producing conservative (high)

intra-class variation, we assume that only the capacitance of the sink/sense die will
contribute to equation 4.1; assuming that the entire interposer and each die con-
tributes to noise reduction, this reduces the amplitude of noise expected from a real
√
chip by a factor of approximately 5. We estimate the resistance contributing to
4.1 by adding the nominal value of each capacitive element on the sink/sense die in
parallel.

21
4.3 Sample Rate
Since any fingerprinting protocol we develop would be limited by the quality of the
sensing hardware on the target system (a problem virtually nonexistent in simulation),
it’s important for us to predict how that hardware will affect the quality of our

challenge-response data. Sample rate in particular is critical, since it determines the

maximum frequency that can be measured without aliasing. If there are a lot of high
frequency harmonics in our PDN’s response, then a relatively low-frequency sample

method such as a time-to-digital-converter (TDC) may be incapable of detecting

enough uniqueness to distinguish between friendly and hostile signals.
Therefore, we run our identification tests at varying frequencies, resembling vary-

ing qualities of detection devices. We will use sample rates of 100 GHz (resembling
an ultra-high quality flash ADC, practically guaranteeing over-sampling of our data),
20 GHz (low-end frequency for a 5G ADC), 1.5 GHz (effective sample rate of a dual

TDC measurement system) and 750 MHz (sample rate of a single TDC in our tandem
hardware experiments).

4.4 Voltage Resolution

As with the sample rate, the value of our system will be limited by the precision
with which the voltage of the PDN can be measure. Thus, for each sampling frequency

we run our tests at, we will round our simulated data to 3 different quantization values:
500 µV, 100 µV and 10 µV.

4.5 Time Domain Analysis

Since we are interested in characterizing PDNs using transient signals, it’s logical

to first evaluate the possibility of using our signal data in its time domain repre-
sentation to identify our devices. We have two methods of identifying a signal: the
first (L1 metric) is to find magnitude of the difference between the measured signal

22
Figure 4.2: Waveforms from 4 different chips in response to a trapezoidal current
sink. Response is shown for a sensor node (blue) as well as a node on the trusted die
(green), directly adjacent to the suspect (see figure 4.1). Current sink varies from 1
mA to 200 mA.

23
Figure 4.3: Zoomed-in view of the response to the current sinks’ rising edge, shown
in figure 4.2.

24
Figure 4.4: Zoomed-in view of the response to the current sinks’ falling edge, shown
in figure 4.2. Notice the variation becomes more noticeable here; this is where we see
most variation in our wavelet transforms.

25
 Time Domain L1 Norm Performance 100 GHz 20 GHz 1.3 GHz
10 µV 1.0/0.017 0.999/0.013 0.982/0.022
100 µV 0.998/0.019 0.996/0.02 0.956/0.009*
500 µV 0.996/0.018 0.989/0.021 0.339/0.0*

Table 4.1: True positive rate/false positive rate of the time domain L1 norm identifi-
cation method, given as a function of sample rate and voltage measurement precision.
Rates given as cumulative across temperature and supply voltage corners. 1.0 indi-
cates a 100% rate, and 0.0 a 0% rate. *: indicates points where fingerprinting seems
to fail.

Time Domain L2 Norm Performance 100 GHz 20 GHz 1.3 GHz

10 µV 1.0/0.014 0.999/0.017 0.982/0.023
100 µV 0.998/0.016 0.994/0.019 0.955/0.011*
500 µV 0.997/0.017 0.992/0.024 0.339/0.0*

Table 4.2: True positive rate/false positive rate for time domain L2 norm. Same
format and method as 4.1. *: indicates points where fingerprinting seems to fail.

and the factory reference at each point in time the signal is measured, then sum the
differences for all points in time for a single distance metric; the second (L2 metric)
is nearly identical, except that the difference for each time stamp is is squared. The

procedure used for evaluating the L1 and L2 distance metrics for their quality as a
fingerprint is the same as that used for the wavelet transforms, as described in section
4.6.

4.6 Wavelet Transforms

Much like Fourier transforms, wavelet transforms resolve a signal into frequency
components so that its frequency-domain characteristics can be observed. But, they
offer a key advantage over Fourier transforms in that they can localize frequency

characteristics in time [21]. Since the variation in the RLC parameters of the PDN
is expected to change the time domain characteristics of our data- such as delay,
rise/fall time, and overshoot/undershoot- wavelet transforms would appear to be good

26
Figure 4.5: PDN response to the rising edge of the sink, plotted at various temperature
and supply voltage conditions. Gathered from the single-die model.

candidates for identifying unique traits of our signal. The wavelet transforms done

to date are continuous wavelet transforms (CWTs) using first-derivative Gaussian

wavelets from the PyWavelets Python package [22].
A wavelet transform of a time domain signal results in a matrix of projection

coefficients, with each entry corresponding to a particular time and frequency. Our
analyses are made by making comparisons between the CWT matrix of a control
grid and a lineup of other CWT matrices. As mentioned before, each of the chips

in our lineup (including the control grid) is simulated at each of the three tempera-
ture/supply voltage corners. To find uniqueness, we compare the control grid’s signal
to each of the other grids’ at each operating corner. Similarly, to find reliability, we

alter the control grid’s signal with thermal noise from equation 4.1, and compare the
’factory’ measurement (first signal in the lineup) with the other 29 variations of the
friendly signal. Like the uniqueness test, this process is repeated for each tempera-

ture/voltage corner. To ensure that outliers are accounted for and to produce better
convergence of our uniqueness and reliability metrics (true positive/false positive

27
Figure 4.6: Differential wavelet transform between two chips at nominal T&V, across
varying sample rates. Notice the aliasing that occurs as sample rate is decreased.

28
Figure 4.7: Differential wavelet transform between two chips at nominal T&V, across
varying voltage quantization values. Notice the relatively low change in variation.

29
rates), each test (uniqueness and reliability) is repeated for each chip in the 30-chip
sample. That is, each chip will have a friendly signal compared to the remaining 29

chips, as well as 29 variations of itself.

Given two sets of transient data, we perform a CWT across the same time and

frequency axes, then find the difference between the two coefficients at each time-
frequency location. These differences are then summed together to create an L1 sum
of the coefficient differences, which is our uniqueness metric for the wavelet transform.

Based on the variation in L1 sum observed for both the reliability and uniqueness
tests at the given environmental conditions, we set a threshold value for the difference;
an L1 sum greater than the threshold value results in a rejection (hostile), while a

sum less than it results in an acceptance (friendly). The same method is used for the
L2 metric; the only change is that the each difference between coefficients is squared.
Given a spread of time-domain measurements across chips (uniqueness/between-

class tests) and temperature/supply voltage conditions (reliability/within-class tests),

we can create separate histograms for uniqueness and reliability performance. Since
an ideal fingerprint would offer no within-class variation and high between-class vari-

ation, the optimal outcome for one of these histograms would be a within-class L1
distribution centered near 0 and a between class distribution far from 0, with no
overlap. This is similar to what we see in figure 4.11

4.7 Decision Thresholds

As mentioned in section 4.2, we want to evaluate how uniqueness compares to

reliability at each corner of operation (fast, nominal, slow). Likewise, the quality
of the simulated ADC/TDC (i.e. sample rate and voltage resolution) will change
the relative uniqueness and reliability of the fingerprinting. Therefore, the decision

threshold for identifying a chip as within-class (friendly) or between-class (hostile)

changes for each corner and each sample frequency/precision condition.

30
 CWT L1 Norm Performance 100 GHz 20 GHz 1.3 GHz
10 µV 0.999/0.013 0.998/0.021 0.96/0.016*
100 µV 0.999/0.02 0.992/0.013 0.871/0.011*
500 µV 0.995/0.017 0.982/0.017 0.339/0.0*

Table 4.3: True positive rate/false positive rate of the CWT L1 norm identification
method, given as a function of sample rate and voltage measurement precision. Rates
given as cumulative across temperature and supply voltage corners. 1.0 indicates a
100% rate, and 0.0 a 0% rate. *: indicates points where fingerprinting seems to fail.

CWT L2 Norm Performance 100 GHz 20 GHz 1.3 GHz

10 µV 0.999/0.017 0.998/0.027 0.972/0.03*
100 µV 0.999/0.025 0.993/0.023 0.891/0.011*
500 µV 0.996/0.019 0.985/0.019 0.339/0.0*

Table 4.4: True positive rate/false positive rate for CWT L2 norm. Same format and
method as 4.3. *: indicates points where fingerprinting seems to fail.

Since we assume that within-class variation is coming from thermal noise in the
PDN, we assume that a manufacturer would be able to run the identification protocol

multiple times on a single board, and produce a distribution for that chip’s within-
class distance metric. Additionally, since we know that the within-class variation
comes from additive white Gaussian noise, we assume that the within-class variation

will be a Gaussian distribution. Finally, we want to make sure that the vast majority
of within-class signals pass the distance threshold, since we want to avoid disposing
of desired devices. Therefore, we set the threshold as the mean of the within-class

distance plus two standard deviations of the same distance; this should ensure that
roughly 98 % of desired chips pass. Any distance above this threshold is assumed
to be associated with a between-class signal, and anything below with a within-class

signal.

31
Figure 4.8: Sum of the L1 differences in wavelet transform coefficients for the unique-
ness (red, inter-chip) tests and reliability (blue, temperature and supply voltage). On
average, the L1 differences are larger for the reliability tests than the uniqueness tests,
indicating that this is a poor metric on its own to identify one of our simulated PDNs.
The blue box at 0 indicates the result for the control grid re-simulated at nominal
temperature and voltage during the reliability tests. Data collected from old, single
chip model.

32
 Figure 4.9: Sum of L1 wavelet coefficient differences, 30-chip uniqueness tests.

Figure 4.10: Sum of L1 wavelet coefficient differences for a single chip with 30 different
noise variations added.

Figure 4.11: Uniqueness (top) and reliability (bottom) performance of the wavelet
transform for nominal T&V conditions, with the chips’ signal sampled at 20 GHz
and measured voltage quantized to 100 µV . Note that the minumum L1 value from
process variation is greater than the maximum from the noise variation, so this is a
unique and reliable system at these conditions.

33
Figure 4.12: Results of HSPICE linear sweep of AC frequencies near predicted reso-
nance frequencies of 100 chips. Gathered from the single-die model.

34
4.8 Other Identification Techniques
4.8.1 AC Analysis

In addition to the wavelet transforms and time domain measurements described

in sections 4.5 and 4.6, we evaluated the possibility of using the resonance frequency
of a PDN to identify devices. Though this was only done on our single-die models,
and so have no data on how it would perform in the 3-die chiplet system, it showed

high uniqueness and reliability in our simulations. As shown in figures 4.12 and 4.13,
the vast majority of the chips in a 100-chip spread had a unique resonance frequency
and amplitude. Moreover, as figure 4.14 shows, there was no indication of change in

resonance frequency across temperature and voltage conditions, despite the change
in amplitude.
There are at least two reasons why resonance frequency characterization- or AC

analysis in general- would be a good candidate for fingerprinting a chiplet system.

First, resonance frequency is dependent only on inductance and capacitance. So, if
we expect L and C to change much less than resistance across temperature, it is likely

that the resonance frequency will be largely independent of temperature. Second, AC

signals are much more likely to propagate between chiplets than the single square wave
signal used in our simulations. Consider a case where two chiplets sat on opposite

sides of a potentially hostile chiplet, as shown in 4.15: this would open the possibility
of detecting a hostile die by producing a sink on one die, and measuring the response
with a sensor on the other.

Moreover, AC analysis has been used successfully to characterize PDNs in liter-

ature. As mentioned in section 2.2, [14] used the scattering parameters of IC PDNs
to identify counterfeits, location of manufacture, and large-scale changes to the de-

vice. Much like our work, this required frequency-swept AC signals to determine the
frequency-domain scattering behavior.

35
Figure 4.13: Scatter plot of the resonance peaks shown in figure 4.12.

36
Figure 4.14: AC frequency sweep of a single chip, with temperature and supply voltage
varying on each iteration. As expected, the resonance frequency remains constant,
while the amplitude changes. The first chip from the tests in figure 4.12 was used for
these tests.

Figure 4.15: Scenario with trusted dice (sink and sensor) on opposite sides of a
potentially hostile die (suspect) [6].

37
4.9 Multi-die measurements
As well as the arrangement used in our 3-die models- a single die with sink and
sensing logic, depicted in figure 4.1- we attempted to use a single die in the system
for sensing and another for generating current sinks, as shown figure 4.15. Instead of

the wavelet transform and time domain methods described in sections 4.5 and 4.6,
we attempted to identify chips by measuring specific time domain features, namely
50-50 propagation delay. In principle, this is nearly identical to the PUF metric used

in [16], but done across PDN planes rather than individual wires. Additionally, we
examined the possibility of introducing a ranking system for delay paths to improve
statistical robustness and reliability across temperature variations. The delay paths

began at a node on the sink die adjacent to the suspect, and ended on the node on
the same y-axis on the sensing die, also directly adjacent to the suspect.
However, our simulations showed fundamental problems with this type of metric.

As shown in figure 4.2, the sensing die experienced a much lower drop in voltage
than the sink die: about 5 µV maximum. This near-negligible drop resulted in very
low uniqueness, and would be extremely difficult for a sensor to measure. Therefore,

these methods were abandoned for our system.

38
 CHAPTER 5

HARDWARE EXPERIMENTATION

5.1 Hardware vs. Simulation Implementation

As useful a tool as our simulation is for predicting PDN behavior across a wide
range of parameters and learning fundamental principles of our system, it requires

hardware for validation and determining critical parameters. Additionally, the current
iteration of our model has shortcomings not present on an actual board. For example,
as mentioned in section 3.4, our simulations lack a layer for the package, so it is

possible that there are effects on the uniqueness and reliability of our system that
are not observed in our data. It is also possible that the added capacitance and
inductance from the package would lower the frequencies of our PDNs’ harmonics,

which would make our system more effective with lower-sample rate ADCs/TDCs
(see the drop off in performance in tables 4.1, 4.2, 4.3 and 4.4). Hardware, of course,
doesn’t have these shortcomings, and so will give us a more accurate representation

of our proposed methodologies.

Thus, our proposed fingerprinting methods were implemented on hardware to
find the necessary parameters for our simulation and evaluate the performance our

simulated methods on an actual device. This section will be spent discussing Cohen
Hoffing’s findings regarding sink and sensing techniques, and their incorporation into
our models [6].

The board used for evaluating our fingerprinting protocols is the Virtex Ultra-
Scale+ FPGA [7], shown in 5.1. Like our models, this is a 3-die chiplet system.

39
This should ensure that we compare the hardware results to a sufficiently similar
simulation analog.

5.2 Current Sink and Measurement Logic, Performance

To create the current sinks, 20,000 ring oscillators (ROs) are placed on a single die;
this is roughly the maximum density possible while still allowing room for appropriate
sensing logic on the same die. Assuming that each RO draws approximately 1 mA

of current [15], the total current draw for the die will be approximately 20A. These
ROs are turned on sequentially, and it takes about 7 ns for all of them to reach
their maximum current draw, as well as to reach their minimum current draw. These

numbers are assumed for total current draw and rise/fall time in our simulations.
For sensing, a single TDC is placed on the same die as the ROs, at the center of
the edge toward the middle die in the system. The arrangement of the RO sinks and

the TDC is identical to that shown in 4.1. The TDC samples at 600 MHz, which is
approximately the maximum rate for the TDC clock found without producing timing
violations. Experiments have been done with using 2 TDCs with phase-shifted clocks

to measure the PDN response signal and create an artificially higher sample rate, but
have yet to be successful.
Since TDCs produce a thermometer code, with resolution determined by the ham-

ming weight of the measured value from the baseline measurement, we use the max-
imum hamming weight from the hardware tests to determine an approximate lower
bound on the resolution of a TDC. In the experimentation, the maximum hamming

weight observed is about 21 bits. Assuming that the same maximum voltage drop
is observed on the physical board as in our simulated board- about 15 mV- we can
determine the voltage resolution of a TDC to be about 700 µV . This is close to

known resolutions of TDCs [15], as well as the lower bound chosen for our voltage
quantizations. However, we assume a lower bound quantization of 500 µV . In order

40
Figure 5.1: The Virtex UltraScale+ FPGA used for the supporting hardware imple-
mentation [7].

to achieve this, repeated measurements of the signal would need to be made, or a

higher quality ADC would need to be used.

41
 CHAPTER 6

POSSIBLE FUTURE WORK

Our simulations show high uniqueness and reliability for our wavelet transform

and time domain analyses, and successful operation at all but the worst-case sensing
conditions studied. Given this success, the relatively lightweight nature of our iden-
tification method, and the ubiquity of PDNs in chiplet and monolithic ICs, there is

ample reason to test its performance on hardware and evaluate sensing techniques
for their suitability to our system. However, there remain unexplored methods that
could further improve our system’s uniqueness and reliability, as well as options to

improve our modeling techniques. Therefore, we will document these in this section.

6.1 Modeling Improvements

6.1.1 Analytic RLC Models

While the parameters we use for our simulation come from literature ([1, 12]), our

model can be improved by incorporating analytic (and computational where analytic

is not possible [23]) models for the RLGC components of our wires. Though these
would not benefit from being extracted by field-solving simulations, as is the case

in [1], there are several advantages to this: the first is that we would be able to
determine individual resistances for same-layer (x-y) metal connections, and between-
layer (z) metal vias, as the geometries are not necessarily equal; the second is that (if

applicable) we will be able to take thermal expansion and contraction into account
when determining change in resistance, rather than relying upon a fixed percentage
change; the third is that we can model variation in RLGC characteristics with changes

42
 Figure 6.1: Lumped model of an IC’s (not chiplet) PDN, with workload [8].

in geometry; finally, we will be able to accommodate different process technology from

that evaluated in literature.

6.1.2 Active Circuits

While voltage was supplied to our interposer grid with ideal voltage sources, a real

board would use an active regulator to maintain a steady voltage supply. Additionally,
as mentioned in section 3.4.1, active decap is commonly used in PDNs [4, 8]. In order
to make our simulations more accurate, op-amp models for the regulators and decap

can be added.

6.2 Uniqueness Analysis Methods

6.2.1 Machine Learning

As done in [14], Gaussian mixture- or other ML algorithms- may be well suited to

evaluate our PDNs in both the time and wavelet domain. Our models are effectively
networks of coupled differential equations, with each node interacting with its neigh-
bors. Adding a package network and/or additional chiplets to the model will create

additional interaction between the large scale components of the whole device. Fur-

43
Figure 6.2: Sketch of the droops from the circuit modeled in 6.1 in the time and
frequency domain [8].

ther, as mentioned in [14], self-heating will produce time- and space-varying changes
to the measured signals by changing the RLGC characteristics of the PDN. Since

ML tends to be well qualified for predicting interaction at varying scales and com-
plex behaviors, it is worth searching for ML algorithms that could provide sufficient
identification systems for our fingerprinting techniques.

6.2.2 Fourier Transforms

For an IC’s PDN, each layer (motherboard, package, die) is expected to have its
own droop characteristics, depending upon the RLC values for that layer, as shown

in figure 6.2 [8]. One can use a Fourier transform to observe the frequency at which
these droop responses occur. Since the interposer adds an additional layer to the PDN,

we’d expect it to add another harmonic to the droop response as well. Therefore, we
can examine the possibility of using Fourier transforms to fingerprint the chips’ and
interposer’s droops on a chiplet, and by extension the device.

44
6.3 New Simulation/Experimentation Types
6.3.1 Bayesian Statistics

Since both time domain and wavelet transform analyses showed high true positive

and low false positive rates for identifying the chips in our sample, we can potentially
use Bayesian statistics to improve the probability of rejecting between-class signals
and accepting within-class signals. As mentioned in 2.2, Denev and Capkun found

that combining time domain and frequency domain analyses was necessary to finger-
print transient signals for wireless nodes [13]. Given the similarity of our work, it
stands to reason that combining the statistics of both will improve the performance

of our identification methods.

6.4 New Threat Models

For all of the data in this work, we assumed that variation were present through-
out an entire die, as well as each RLGC component directly connected to that die.
However, if we were assuming a highly advanced adversary, this might not be the case.

As mentioned in 4.8.1, such an adversary may be capable of creating highly localized

variations to the PDN by probing, placing Trojans, or performing some other area-
specific tampering. Since our scripts are capable of placing holes within our grids, we

should run our protocol on multiple copies of a single grid, each one with a hole ran-
domly placed within it. Given our current parameters, this would resemble detecting
faults on the order of 600 µm2 , caused by malicious tampering. Alternatively, single

nodes can be altered to have RLGC parameters significantly greater or less than the
nominal, resembling a probe or similar tempering method.

45
 CHAPTER 7

CONCLUSION

In this work, we proposed a method of fingerprinting chiplet architectures with

their distributed PDN system, and described methods of wavelet transforms and time
domain analysis to identify the PDN. Between these, our work shows promising results
for both, with the data typically showing higher uniqueness and reliability for the time

domain. The results we produced give us ample reason to believe that this work ought
to be further evaluated in simulation and experimentation to validate its performance
as a fingerprinting protocol. Developing sensors to operate at the conditions outlined

here will likely be the greatest challenge of implementing our system, though it is
possible that our work overestimates the requirement of its sensors due to the lack
of a package model in our tests. We also suggested additional methods of PDN

fingerprinting and techniques to fine-tune the procedure used for this work.
In the process of this work, we have produced a series of Python scripts capable
of automatically generating and testing the chiplet and interposer PDN structures

for this identification system in HSPICE. We have designed this to provide a thor-
ough, predictive HSPICE model capable of guiding development of such identification
techniques, and changes in efficacy with changes in technology.

Given the success of our system in hardware, we will provide a novel, lightweight
design compatible with virtually any chiplet architecture, and likely monolithic archi-
tectures. Secondarily, hardware experimentation offers the opportunity to verify the

quality of our models. If validated experimentally, our model will have the capability
of serving as a method of automated, rapid testing for chiplet PDN designs.

46
 BIBLIOGRAPHY

[1] J. Kim, V. C. Krishna Chekuri, N. M. Rahman, M. A. Dolatsara, H. Torun,

M. Swaminathan, S. Mukhopadhyay, and S. Kyu Lim, “Silicon vs. Organic
Interposer: PPA and Reliability Tradeoffs in Heterogeneous 2.5D Chiplet
Integration,” in 2020 IEEE 38th International Conference on Computer Design
(ICCD). Hartford, CT, USA: IEEE, Oct. 2020, pp. 80–87. [Online]. Available:
https://ieeexplore.ieee.org/document/9283591/
[2] S. Zhao, I. Ahmed, V. Betz, A. Lotfi, and O. Trescases, “Frequency-
Domain Power Delivery Network Self-Characterization in FPGAs for
Improved System Reliability,” IEEE Transactions on Industrial Electronics,
vol. 65, no. 11, pp. 8915–8924, Nov. 2018. [Online]. Available: https:
//ieeexplore.ieee.org/document/8301526/
[3] S. Pant and E. Chiprout, “Power grid physics and implications for CAD,”
in Proceedings of the 43rd annual conference on Design automation - DAC
’06. San Francisco, CA, USA: ACM Press, 2006, p. 199. [Online]. Available:
http://portal.acm.org/citation.cfm?doid=1146909.1146964
[4] S. Kim, Y. Kim, K. Cho, J. Song, and J. Kim, “Design and
Measurement of a Novel On-Interposer Active Power Distribution Network
for Efficient Simultaneous Switching Noise Suppression in 2.5-D/3-D IC,”
IEEE Transactions on Components, Packaging and Manufacturing Technology,
vol. 9, no. 2, pp. 317–328, Feb. 2019. [Online]. Available: https:
//ieeexplore.ieee.org/document/8392368/
[5] K. Kim, C. Hwang, K. Koo, J. Cho, H. Kim, J. Kim, J. Lee, H.-D. Lee, K.-W.
Park, and J. S. Pak, “Modeling and Analysis of a Power Distribution Network
in TSV-Based 3-D Memory IC Including P/G TSVs, On-Chip Decoupling
Capacitors, and Silicon Substrate Effects,” IEEE Transactions on Components,
Packaging and Manufacturing Technology, vol. 2, no. 12, pp. 2057–2070, Dec.
2012. [Online]. Available: http://ieeexplore.ieee.org/document/6341804/
[6] M. Cohen Hoffing, M. Burke, and W. Burleson, “Power Delivery Network PUF
for Chiplet Architectures (pre-published).”
[7] “AMD Virtex UltraScale+ FPGA VCU118 Evaluation Kit.” [Online]. Available:
https://www.xilinx.com/products/boards-and-kits/vcu118.html
[8] S. Pant, “Design and Analysis of Power Distribution Networks in VLSI Circuits,”
Ph.D. dissertation, University of Michigan, 2008.

47
 [9] U. Ruhrmair and D. E. Holcomb, “PUFs at a glance,” in Design, Automation
& Test in Europe Conference & Exhibition (DATE), 2014. Dresden,
Germany: IEEE Conference Publications, 2014, pp. 1–6. [Online]. Available:
http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=6800561

[10] H. Zhu, X. Guo, Y. Jin, and X. Zhang, “PowerScout: A Security-Oriented

Power Delivery Network Modeling Framework for Cross-Domain Side-Channel
Analysis,” in 2020 Asian Hardware Oriented Security and Trust Symposium
(AsianHOST). Kolkata, India: IEEE, Dec. 2020, pp. 1–6. [Online]. Available:
https://ieeexplore.ieee.org/document/9358263/

[11] “3 Ways 3D Chip Tech is Upending Computing,” Mar. 2022. [Online]. Available:
https://spectrum.ieee.org/amd-3d-stacking-intel-graphcore

[12] H. Park, J. Park, S. Kim, K. Cho, D. Lho, S. Jeong, S. Park, G. Park, B. Sim,
S. Kim, Y. Kim, and J. Kim, “Deep Reinforcement Learning-Based Optimal
Decoupling Capacitor Design Method for Silicon Interposer-Based 2.5-D/3-D
ICs,” IEEE Transactions on Components, Packaging and Manufacturing
Technology, vol. 10, no. 3, pp. 467–478, Mar. 2020. [Online]. Available:
https://ieeexplore.ieee.org/document/8985416/

[13] B. Danev and S. Capkun, “Transient-based identification of wireless sensor

nodes,” in 2009 International Conference on Information Processing in Sensor
Networks, Apr. 2009, pp. 25–36.

[14] T. Mosavirik, F. Ganji, P. Schaumont, and S. Tajik, “ScatterVerif: Verification

of Electronic Boards Using Reflection Response of Power Distribution Network,”
ACM Journal on Emerging Technologies in Computing Systems, p. 3513087,
Feb. 2022. [Online]. Available: https://dl.acm.org/doi/10.1145/3513087

[15] S. Moini, A. Deric, X. Li, G. Provelengios, W. Burleson, R. Tessier,

and D. Holcomb, “Voltage Sensor Implementations for Remote Power
Attacks on FPGAs,” ACM Transactions on Reconfigurable Technology
and Systems, vol. 16, no. 1, pp. 1–21, Mar. 2023. [Online]. Available:
https://dl.acm.org/doi/10.1145/3555048

[16] A. Deric and D. Holcomb, “Know Time to Die – Integrity Checking for
Zero Trust Chiplet-based Systems Using Between-Die Delay PUFs,” IACR
Transactions on Cryptographic Hardware and Embedded Systems, pp. 391–
412, Jun. 2022. [Online]. Available: https://tches.iacr.org/index.php/TCHES/
article/view/9706

[17] “random — Generate pseudo-random numbers — Python 3.10.4 documenta-

tion.” [Online]. Available: https://docs.python.org/3/library/random.html

[18] N. H. E. Weste and D. M. Harris, CMOS VLSI design: a circuits and systems
perspective, 4th ed. Boston: Addison Wesley, 2011, oCLC: ocn473447233.

48
[19] R. Groves, D. Harame, and D. Jadus, “Temperature dependence of Q and
inductance in spiral inductors fabricated in a silicon-germanium/BiCMOS
technology,” IEEE Journal of Solid-State Circuits, vol. 32, no. 9, pp. 1455–1459,
Sep. 1997. [Online]. Available: http://ieeexplore.ieee.org/document/628763/

[20] R. Sarpeshkar, T. Delbruck, and C. Mead, “White noise in MOS transistors and
resistors,” IEEE Circuits and Devices Magazine, vol. 9, no. 6, pp. 23–29, Nov.
1993.

[21] M. Frisch and H. Messer, “The use of the wavelet transform in the
detection of an unknown transient signal,” IEEE Transactions on Information
Theory, vol. 38, no. 2, pp. 892–897, Mar. 1992. [Online]. Available:
http://ieeexplore.ieee.org/document/119748/

[22] “PyWavelets/pywt: PyWavelets 1.3.0,” Mar. 2022. [Online]. Available:

https://zenodo.org/record/1407171

[23] V. T. Morgan, “The Current Distribution, Resistance and Internal Inductance

of Linear Power System Conductors—A Review of Explicit Equations,” IEEE
Transactions on Power Delivery, vol. 28, no. 3, pp. 1252–1262, Jul. 2013.
[Online]. Available: http://ieeexplore.ieee.org/document/6521501/

49