research-article

Remanence Decay Side-Channel: The PUF Case

Authors:

Shaza Zeitouni,

Christian Wachsmann,

Patrick Koeberl,

Ahmad-Reza SadeghiAuthors Info & Claims

IEEE Transactions on Information Forensics and Security, Volume 11, Issue 6

Pages 1106 - 1116

https://doi.org/10.1109/TIFS.2015.2512534

Published: 01 June 2016 Publication History

Abstract

We present a side-channel attack based on remanence decay in volatile memory and show how it can be exploited effectively to launch a noninvasive cloning attack against SRAM physically unclonable functions (PUFs)—an important class of PUFs typically proposed as lightweight security primitives, which use existing memory on the underlying device. We validate our approach using SRAM PUFs instantiated on two 65-nm CMOS devices. We discuss countermeasures against our attack and propose the constructive use of remanence decay to improve the cloning resistance of SRAM PUFs. Moreover, as a further contribution of independent interest, we show how to use our evaluation results to significantly improve the performance of the recently proposed TARDIS scheme, which is based on remanence decay in SRAM memory and used as a time-keeping mechanism for low-power clockless devices.

References

[1]

J. Guajardo, S. S. Kumar, G.-J. Schrijen, and P. Tuyls, “Physical unclonable functions and public-key crypto for FPGA IP protection,” in Proc. Int. Field Program. Logic Appl. (FPL), 2007, pp. 189–195.

[2]

R. Maes, P. Tuyls, and I. Verbauwhede, “Intrinsic PUFs from flip-flops on reconfigurable devices,” in Proc. 3rd Benelux Workshop Inf. Syst. Secur., 2008, pp. 1–17.

[3]

Y. Su, J. Holleman, and B. P. Otis, “A digital 1.6 pJ/bit chip identification circuit using process variations,” IEEE J. Solid-State Circuits, vol. 43, no. 1, pp. 69–77, Jan. 2008.

[4]

S. S. Kumar, J. Guajardo, R. Maes, G.-J. Schrijen, and P. Tuyls, “Extended abstract: The butterfly PUF protecting IP on every FPGA,” in Proc. IEEE Int. Workshop Hardw.-Oriented Secur. Trust (HOST), Jun. 2008, pp. 67–70.

[5]

D. E. Holcomb, W. P. Burleson, and K. Fu, “Power-up SRAM state as an identifying fingerprint and source of true random numbers,” IEEE Trans. Comput., vol. 58, no. 9, pp. 1198–1210, Sep. 2009.

Digital Library

[6]

V. van der Leest, G.-J. Schrijen, H. Handschuh, and P. Tuyls, “Hardware intrinsic security from D flip-flops,” in Proc. 5th ACM Workshop Scalable Trusted Comput. (ACM STC), 2010, pp. 53–62.

[7]

P. Tuyls and L. Batina, “RFID-tags for anti-counterfeiting,” in Topics in Cryptology (Lecture Notes in Computer Science), vol. 3860. Springer, 2006, pp. 115–131.

[8]

J. Guajardo, S. S. Kumar, G.-J. Schrijen, and P. Tuyls, “Brand and IP protection with physical unclonable functions,” in Proc. IEEE Int. Symp. Circuits Syst. (ISCAS), May 2008, pp. 3186–3189.

[9]

J. A. Roy, F. Koushanfar, and I. L. Markov, “Ending piracy of integrated circuits,” Computer, vol. 43, no. 10, pp. 30–38, 2010.

Digital Library

[10]

A.-R. Sadeghi, I. Visconti, and C. Wachsmann, “Enhancing RFID security and privacy by physically unclonable functions,” in Towards Hardware-Intrinsic Security (Information Security and Cryptography). Springer, 2010, pp. 281–305.

[11]

I. Eichhorn, P. Koeberl, and V. van der Leest, “Logically reconfigurable PUFs: Memory-based secure key storage,” in Proc. 6th ACM Workshop Scalable Trusted Comput. (ACM STC), 2011, pp. 59–64.

[12]

Intrinsic ID. (2013). Product Webpage. [Online]. Available: http://www.intrinsic-id.com/products.htm

[13]

NXP Strengthens SmartMX2 Security Chips With PUF Anti-Cloning Technology, NXP Semiconductors, Eindhoven, The Netherlands, 2013.

[14]

J. Guajardo, M. Asim, and M. Petković, “Towards reliable remote healthcare applications using combined fuzzy extraction,” in Towards Hardware-Intrinsic Security (Information Security and Cryptography). Springer, 2010, pp. 387–407.

[15]

S. Kardaş, M. S. Kiraz, M. A. Bingöl, and H. Demirci, “A novel RFID distance bounding protocol based on physically unclonable functions,” in RFID. Security and Privacy (Lecture Notes in Computer Science). Springer, Jun. 2011.

[16]

P. Koeberl, J. Li, A. Rajan, C. Vishik, and W. Wu, “A practical device authentication scheme using SRAM PUFs,” in Trust and Trustworthy Computing (Lecture Notes in Computer Science), vol. 6740. Springer, Jun. 2011, pp. 63–77.

[17]

P. Koeberl, J. Li, R. Maes, A. Rajan, C. Vishik, and M. Wójcik, “Evaluation of a PUF device authentication scheme on a discrete 0.13 $\mu $ m SRAM,” in Proc. 3rd Int. Conf. Trusted Syst. (INTRUST), vol. 7222. 2012, pp. 271–288.

[18]

J. A. Halderman et al., “Lest we remember: Cold-boot attacks on encryption keys,” Commun. ACM, vol. 52, no. 5, pp. 91–98, May 2009.

Digital Library

[19]

A. Rahmati, M. Salajegheh, D. Holcomb, J. Sorber, W. P. Burleson, and K. Fu, “TARDIS: Time and remanence decay in SRAM to implement secure protocols on embedded devices without clocks,” in Proc. USENIX Secur. Symp. 2012, pp. 221–236.

[20]

N. Saxena and J. Voris. (Jul. 2009). “We can remember it for you wholesale: Implications of data remanence on the use of RAM for true random number generation on RFID tags (RFIDSec 2009).” [Online]. Available: http://arxiv.org/abs/0907.1256

[21]

D. E. Holcomb, A. Rahmati, M. Salajegheh, W. P. Burleson, and K. Fu, “DRV-fingerprinting: Using data retention voltage of SRAM cells for chip identification,” in Radio Frequency Identification. Security and Privacy Issues (Lecture Notes in Computer Science), vol. 7739, J.-H. Hoepman and I. Verbauwhede, Eds. Springer, 2013, pp. 165–179.

Digital Library

[22]

Y. Oren, A.-R. Sadeghi, and C. Wachsmann, “On the effectiveness of the remanence decay side-channel to clone memory-based PUFs,” in Cryptographic Hardware and Embedded Systems (Lecture Notes in Computer Science), vol. 8086. Springer, 2013, pp. 107–125.

[23]

E. Biham and A. Shamir, “Differential fault analysis of secret key cryptosystems,” in Advances in Cryptology (Lecture Notes in Computer Science), vol. 1294. Springer, 1997, pp. 513–525.

[24]

D. E. Holcomb, W. P. Burleson, and K. Fu, “Initial SRAM state as a fingerprint and source of true random numbers for RFID tags,” in Proc. Conf. Workshop RFID Secur. (RFIDSec), Jul. 2007, pp. 1–12.

[25]

M. Bhargava, C. Cakir, and K. Mai, “Comparison of bi-stable and delay-based physical unclonable functions from measurements in 65 nm bulk CMOS,” in Proc. IEEE Custom Integr. Circuits Conf. (CICC), Sep. 2012, pp. 1–4.

[26]

S. Katzenbeisser, Ü. Kocabaş, V. Rozić, A.-R. Sadeghi, I. Verbauwhede, and C. Wachsmann, “PUFs: Myth, fact or busted? A security evaluation of physically unclonable functions (PUFs) cast in silicon,” in Cryptographic Hardware and Embedded Systems (Lecture Notes in Computer Science), vol. 7428. Springer, 2012, pp. 283–301.

[27]

H. Qin, Y. Cao, D. Markovic, A. Vladimirescu, and J. Rabaey, “SRAM leakage suppression by minimizing standby supply voltage,” in Proc. 5th Int. Symp. Quality Electronic Design (ISQED), 2004, pp. 55–60.

[28]

C. Bösch, J. Guajardo, A.-R. Sadeghi, J. Shokrollahi, and P. Tuyls, “Efficient helper data key extractor on FPGAs,” in Cryptographic Hardware and Embedded Systems (Lecture Notes in Computer Science), vol. 5154. Berlin, Germany: Springer, Jul. 2008, pp. 181–197.

[29]

Calomel.org. AES-NI SSL Performance Study. [Online]. Available: https://calomel.org/aesni_ssl_performance.html, accessed 2015.

[30]

Intel. AES-NI Performance Enhancements: Hytrust Datacontrol Case Study. [Online]. Available: https://software.intel.com/en-us/articles/intel-aes-ni-performance-enhancements-hytrust-datacontrol-case-study, accessed 2015.

[31]

Y. Dodis, L. Reyzin, and A. Smith, “Fuzzy extractors: How to generate strong keys from biometrics and other noisy data,” in Advances in Cryptology (Lecture Notes in Computer Science), vol. 3027. Springer, May 2004, pp. 523–540.

[32]

Y. Oren, M. Renauld, F.-X. Standaert, and A. Wool, “Algebraic side-channel attacks beyond the hamming weight leakage model,” in Cryptographic Hardware and Embedded Systems (Lecture Notes in Computer Science), vol. 7428, E. Prouff and P. Schaumont, Eds. Springer, 2012, pp. 140–154.

[33]

D. Karakoyunlu and B. Sunar, “Differential template attacks on PUF enabled cryptographic devices,” in Proc. IEEE Int. Workshop Inf. Forensics Secur. (WIFS), Dec. 2010, pp. 1–6.

[34]

D. Merli, D. Schuster, F. Stumpf, and G. Sigl, “Side-channel analysis of PUFs and fuzzy extractors,” in Trust and Trustworthy Computing (Lecture Notes in Computer Science), vol. 6740. Springer, Jun. 2011, pp. 33–47.

[35]

A. Mahmoud, U. Rührmair, M. Majzoobi, and F. Koushanfar. Combined Modeling and Side Channel Attacks on Strong PUFs. [Online]. Available: http://eprint.iacr.org/2013/632, accessed 2013.

[36]

U. Rührmair et al., “Efficient power and timing side channels for physical unclonable functions,” in Cryptographic Hardware and Embedded Systems, vol. 8731. Berlin, Germany: Springer, 2014, pp. 476–492.

[37]

G. T. Becker and R. Kumar, Active and Passive Side-Channel Attacks on Delay Based PUF Designs. [Online]. Available: http://eprint.iacr.org/2014/287, accessed 2014.

[38]

J. Delvaux and I. Verbauwhede, “Fault injection modeling attacks on 65 nm arbiter and RO sum PUFs via environmental changes,” IEEE Trans. Circuits Syst. I, Reg. Papers, vol. 61, no. 6, pp. 1701–1713, Jun. 2014.

[39]

R. Kumar and W. Burleson, “Hybrid modeling attacks on current-based PUFs,” in Proc. 32nd IEEE Int. Conf. Comput. Design (ICCD), Oct. 2014, pp. 493–496.

[40]

D. Nedospasov, J.-P. Seifert, C. Helfmeier, and C. Boit, “Invasive PUF analysis,” in Proc. Fault Diagnosis Tolerance Cryptogr. (FDTC), Aug. 2013, pp. 30–38.

[41]

C. Helfmeier, C. Boit, D. Nedospasov, and J.-P. Seifert, “Cloning physically unclonable functions,” in Proc. IEEE Int. Symp. Hardw.-Oriented Secur. Trust (HOST), Jun. 2013, pp. 1–6.

Cited By

Kietzmann PSchmidt TWählisch M(2024)PUF for the Commons: Enhancing Embedded Security on the OS LevelIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2023.330036821:4(2194-2210)Online publication date: 1-Jul-2024
https://dl.acm.org/doi/10.1109/TDSC.2023.3300368
Duan SSai G(2023)BTI aging-based physical cloning attack on SRAM PUF and the countermeasureAnalog Integrated Circuits and Signal Processing10.1007/s10470-023-02168-6117:1-3(45-55)Online publication date: 1-Dec-2023
https://dl.acm.org/doi/10.1007/s10470-023-02168-6
Moukarzel MHicks M(2021)RingRAM: A Unified Hardware SecurityPrimitive for IoT Devices that Gets Better with AgeProceedings of the 37th Annual Computer Security Applications Conference10.1145/3485832.3485905(660-674)Online publication date: 6-Dec-2021
https://dl.acm.org/doi/10.1145/3485832.3485905
Show More Cited By

Index Terms

Remanence Decay Side-Channel: The PUF Case
1. Hardware
2. Security and privacy
  1. Security in hardware
    1. Hardware attacks and countermeasures
    2. Hardware security implementation

Index terms have been assigned to the content through auto-classification.

Recommendations

On the Effectiveness of the Remanence Decay Side-Channel to Clone Memory-Based PUFs
Cryptographic Hardware and Embedded Systems - CHES 2013
Abstract
We present a side-channel attack based on remanence decay in volatile memory and show how it can be exploited effectively to launch a non-invasive cloning attack against SRAM PUFs — an important class of PUFs typically proposed as lightweight ...
Prefetch Side-Channel Attacks: Bypassing SMAP and Kernel ASLR
CCS '16: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

Modern operating systems use hardware support to protect against control-flow hijacking attacks such as code-injection attacks. Typically, write access to executable pages is prevented and kernel mode execution is restricted to kernel code pages only. ...
Side-Channel Analysis of the TERO PUF
Constructive Side-Channel Analysis and Secure Design
Abstract
Physical Unclonable Functions (PUFs) have the potential to provide a higher level of security for key storage than traditional Non-Volatile Memory (NVM). However, the susceptibility of the PUF primitives to non-invasive Side-Channel Analysis (SCA) ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image IEEE Transactions on Information Forensics and Security

IEEE Transactions on Information Forensics and Security Volume 11, Issue 6

June 2016

283 pages

ISSN:1556-6013

Issue’s Table of Contents

Copyright © 2015.

Publisher

IEEE Press

Publication History

Published: 01 June 2016

Qualifiers

Research-article

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

9
Total Citations
View Citations
0
Total Downloads

Downloads (Last 12 months)0
Downloads (Last 6 weeks)0

Reflects downloads up to 27 Nov 2024

Other Metrics

View Author Metrics

Citations

Cited By

Kietzmann PSchmidt TWählisch M(2024)PUF for the Commons: Enhancing Embedded Security on the OS LevelIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2023.330036821:4(2194-2210)Online publication date: 1-Jul-2024
https://dl.acm.org/doi/10.1109/TDSC.2023.3300368
Duan SSai G(2023)BTI aging-based physical cloning attack on SRAM PUF and the countermeasureAnalog Integrated Circuits and Signal Processing10.1007/s10470-023-02168-6117:1-3(45-55)Online publication date: 1-Dec-2023
https://dl.acm.org/doi/10.1007/s10470-023-02168-6
Moukarzel MHicks M(2021)RingRAM: A Unified Hardware SecurityPrimitive for IoT Devices that Gets Better with AgeProceedings of the 37th Annual Computer Security Applications Conference10.1145/3485832.3485905(660-674)Online publication date: 6-Dec-2021
https://dl.acm.org/doi/10.1145/3485832.3485905
Anagnostopoulos NAhmad SArul TSteinmetzer DHollick MKatzenbeisser S(2020)Low-cost Security for Next-generation IoT NetworksACM Transactions on Internet Technology10.1145/340628020:3(1-31)Online publication date: 5-Sep-2020
https://dl.acm.org/doi/10.1145/3406280
Rincón AFarias CMelo WCarmo L(2020)Controlling Smart Meters Integrity via Identity Management of its Components2020 IEEE International Instrumentation and Measurement Technology Conference (I2MTC)10.1109/I2MTC43012.2020.9129574(1-6)Online publication date: 25-May-2020
https://dl.acm.org/doi/10.1109/I2MTC43012.2020.9129574
Tebelmann LDanger JPehl M(2020)Self-secured PUF: Protecting the Loop PUF by MaskingConstructive Side-Channel Analysis and Secure Design10.1007/978-3-030-68773-1_14(293-314)Online publication date: 1-Apr-2020
https://dl.acm.org/doi/10.1007/978-3-030-68773-1_14
Sugawara TOnuma TLi Y(2020)(Short Paper) Signal Injection Attack on Time-to-Digital Converter and Its Application to Physically Unclonable FunctionAdvances in Information and Computer Security10.1007/978-3-030-58208-1_7(117-127)Online publication date: 2-Sep-2020
https://dl.acm.org/doi/10.1007/978-3-030-58208-1_7
Li YShen JLiu WZou W(2020)A Survey on Side-Channel Attacks of Strong PUFArtificial Intelligence and Security10.1007/978-3-030-57881-7_7(74-85)Online publication date: 17-Jul-2020
https://dl.acm.org/doi/10.1007/978-3-030-57881-7_7
Anagnostopoulos NArul TRosenstihl MSchaller AGabmeyer SKatzenbeisser S(2019)Attacking SRAM PUFs using very-low-temperature data remanenceMicroprocessors & Microsystems10.1016/j.micpro.2019.10286471:COnline publication date: 1-Nov-2019
https://dl.acm.org/doi/10.1016/j.micpro.2019.102864

View Options

View options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

Media

Figures

Other

Tables

View Issue’s Table of Contents