PUF-film and method for producing the same
11586780 · 2023-02-21
Assignee
Inventors
- Johannes Obermaier (Garching b. Muenchen, DE)
- Vincent Immler (Garching b. Muenchen, DE)
- Robert Hesselbarth (Garching b. Muenchen, DE)
Cpc classification
H01L23/57
ELECTRICITY
G06F21/73
PHYSICS
G06V20/80
PHYSICS
H04L9/0894
ELECTRICITY
International classification
H04L9/32
ELECTRICITY
G06V20/80
PHYSICS
H04L9/08
ELECTRICITY
Abstract
A PUF-film includes a circuit structure having a plurality of circuit elements, wherein the circuit structure is evaluable with respect to a plurality of electric capacitance values being arranged between the plurality of circuit elements, and is evaluable with respect to a plurality of electric resistance values of the plurality of circuit components.
Claims
1. A physical unclonable function film (PUF-film) comprising: a circuit structure comprising a plurality of conductive traces, wherein the circuit structure is evaluable with respect to a plurality of electric capacitance values being arranged between the plurality of conductive traces, and is evaluable with respect to a plurality of electric resistance values of the plurality of conductive traces; wherein the plurality of conductive traces comprises a first multitude of conductive traces being arranged in a first trace layer of the PUF-film, and comprises a second multitude of conductive traces being arranged in a second trace layer, wherein the first multitude of conductive traces and the second multitude of conductive traces overlap in a plurality of overlap regions in which first multitude of conductive traces is separated from the second multitude of conductive traces by a dielectric so as to form a corresponding plurality of capacitor structures in the overlap regions; wherein the first plurality of conductive traces is meandered and covers a first film region; wherein the second plurality of conductive traces is meandered and covers a second film region, wherein the first film region and the second film region overlap and provide for a plurality of combinations of capacitive coupling between the first multitude and the second multitude, each capacitive coupling individually contributing to a total variation capacitance.
2. The PUF-film of claim 1, wherein the plurality of electric resistance values is arranged between ends of the conductive traces; or between different conductive traces.
3. The PUF-film of claim 1, wherein each conductive trace of the plurality of conductive traces comprises a first section and a second section being spaced from the first section, wherein the first section and the second section are accessible for a measurement of an electric resistance value of the conductive trace between the first section and the second section.
4. The PUF-film of claim 1, wherein the dielectric material comprises a granule material being arranged in a stochastic distribution in the dielectric material influencing the plurality of electric capacitance values.
5. The PUF-film of claim 1, wherein the first multitude of conductive traces are arranged in an interleaved arrangement such that in the overlap regions a conductive trace of the plurality of conductive traces is only neighbored by a different conductive trace in the first trace layer.
6. The PUF-film of claim 1, wherein each electric capacitance value is based on at least a first and a second capacitor structure.
Description
BRIEF DESCRIPTION OF THE DRAWINGS
(1) Embodiments of the present invention will be detailed subsequently referring to the appended drawings, in which:
(2)
(3)
(4)
(5)
(6)
(7)
(8)
(9)
(10)
(11)
(12)
(13)
(14)
(15)
(16)
(17)
(18)
(19)
(20)
(21)
(22)
(23)
(24)
(25)
(26)
(27)
(28)
(29)
(30)
(31)
(32)
(33)
(34)
(35)
(36)
(37)
(38)
(39)
(40)
(41)
(42)
(43)
(44)
(45)
(46)
(47)
(48)
DETAILED DESCRIPTION OF THE INVENTION
(49) Equal or equivalent elements or elements with equal or equivalent functionality are denoted in the following description by equal or equivalent reference numerals even if occurring in different figures.
(50) In the following description, a plurality of details is set forth to provide a more thorough explanation of embodiments of the present invention. However, it will be apparent to those skilled in the art that embodiments of the present invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form rather than in detail in order to avoid obscuring embodiments of the present invention. In addition, features of the different embodiments described hereinafter may be combined with each other, unless specifically noted otherwise.
(51) In the following, reference is made to Physically Unclonable Functions (PUFs). In connection with the embodiments described hereinafter, PUFs are understood as electrically evaluable parameters such as resistances, complex impedances, capacitances, inductances and/or impedances being suitable, as a single parameter or as a combination of parameters, e.g., as a pattern, for identifying the device carrying the PUFs and/or for evaluating, monitoring/surveying the intactness or integrity of the device.
(52) Some of the embodiments described hereinafter relate to PUF-films. A PUF-film may also be understood as PUF-foil, i.e., as a comparatively thin structure along a thickness direction (z) when compared to dimensions of the structure along other possibly lateral or axial directions such as a length and/or a width, simply directions x and y. Although some of the embodiments described hereinafter are configured and/or suitable for being bended or folded, the embodiments described herein are not limited hereto. In particular, the term PUF-film does not necessarily imply that the film is repeatedly foldable or bendable. For example, a PUF-film may comprise a metallic substrate and/or a semiconductor substrate having a high stiffness and/or not being configured to be bendable. Thus, embodiments also refer to PUF-films being rigid structures.
(53)
(54) The printing 1010 may be implemented as an additive process in which materials are added onto the film substrate. Although it is also possible to use subtractive processes comprising depositing the dielectric material and then removing parts of the material, e.g., using laser oblation, additive processes provide for the advantage that contaminations caused by subtractive processes may be avoided. The printing 1010 may be performed, for example, by a silkscreen process, a rotary printing process, an offset printing process, a pad printing process and/or a spin coating process. In the following, reference will be made to implementation of a silkscreen process which is suitable for implementing the method 1000 as a real-to-real process allowing for a high productivity and a high repeatability. The step 1010 may be combined with a photolithographic process in which the printed dielectric material may be exposed to an exposing radiation such as ultraviolet radiation so as to define regions of the dielectric material to be removed and/or retained. The photolithographic process may allow for obtaining a higher resolution when compared to a resolution of the process for generating/printing the dielectric layer.
(55) The printing 1010 may be combined with further processes. For example, a further variation in the thickness of the dielectric layer and thus of the respective electric property may be obtained by subtractive processes such as laser ablation. This does not require reducing a thickness of the complete layer. As an alternative solution, for example, lines or patterns, e.g., checkerboard-patterns or the like may be generated in the dielectric layer 28 so as to enable a variation of the layer thickness in some regions so as to amplify the variation of the capacitance value. Further, as a dielectric material, so-called block-copolymer materials may be used. Such materials may comprise two faces which continue to exist after drying or curing. Although a dielectric constant of the material may vary between both faces, such variation may vary across all of the capacitance values and therefore allow for maintaining same relative or differential values.
(56) The dielectric material may be printed, for example, as a paste or a fluid having a high viscosity. The dielectric material may comprise particles, for example, ceramic particles which may be varied with respect to their size and/or a degree of filling they provide in the dielectric material. For example, for obtaining different thicknesses of the dielectric material on the film substrate, different viscosities and/or different degrees of filling and/or different sizes of the ceramic particles may be used.
(57) Different parameters of the printing process implemented in the step 1010 may be used for obtaining the variable thickness of the layer. For example, the particles contained in the dielectric material may provide for a topography on the surface of the dielectric layer. An example diameter of ceramic particles may be at least 0.5 μm and at most 10 μm, at least 1 μm and at most 5 μm and at least 1.5 μm and at most 5 μm, e.g., 2 μm or any other suitable value. Taking a diameter of 2 μm as an example value and a comparatively high degree of filling, e.g., at least 30%, at least 40% or at least 50% or even more, the particles may exceed or protrude from the (plane) surface of the dielectric material with e.g., ¼ of their diameter, i.e., approximately 500 nm. Although protruding from the virtual plane surface, the particles may still be covered by a thin layer of a dielectric material or paste. The paste may be or may comprise, for example, a polymer matrix for linking the particles. Thereby, a topography according to a wave crest and a wave through maybe obtained. A variation within the topography between wave crests and wave throughs may be at least 100 nm, at least 300 nm or at least 400 nm, e.g., 500 nm or even more. Based on a (at least approximate) plane surface of the film substrate and/or based on a topography of the substrate, a variable thickness of the dielectric layer may be obtained. Thus, the printed material itself may provide for a variable thickness. Alternatively or in addition, the topography of the film substrate may provide for a variation within the thickness of the dielectric layer, e.g., when performing the process so as to generate a (approximated) plane surface on a rough or uneven film substrate. By non-limiting example only, electrodes of the film substrate may comprise a roughness of approximately 500 nm, e.g., in a worst case, which may influence or even add up in the total variation of the thickness.
(58) As a further parameter of generating a variable thickness, the printing process itself may be used. For example, when implementing a silkscreen process, small dots or small towers of dielectric material may be arranged one beside the other. Based, influenced or even depending on the thixotropy or viscosity, the dots or towers combine or meld with each other. This process may allow for obtaining a remaining variation in the topography and therefore a further variation within the thickness.
(59) A total variation of the thickness of the layer may comprise a value of, for example, at least 200 nm and at most 10 μm, at least 500 nm and at most 8 μm or at least 700 nm and at most 5 μm, e.g., in a range between 1 μm and 3 μm.
(60) The method 1000 comprises a step 1020 in which a structured electrode layer is arranged on the dielectric material such that the structured electrode layer is influenced with respect to an electric measurement value due to the variable thickness of the dielectric layer. The electric measurement value may comprise at least one of an electric capacitance value, an electric impedance value, an electric resistance value and an electric inductance value. Combinations thereof lie within the embodiments of the present invention. In the following, reference will be made to electric capacitance values as the dielectric material may be arranged between a structured electrode layer arranged on the film substrate and the structured electrode layer arranged on the dielectric material allowing a formation of capacitive elements. According to further embodiments, opposing electrodes may further allow for a variation in electric resistance values, electric impedance values or electric inductance values, depending on the dielectric material. In particular, with respect to the electric inductance value, the dielectric material may also comprise conductive and/or inductive materials.
(61) The variation of the thickness of the dielectric layer in combination with variances achieved by the printing process allow for a randomization of the thickness and therefore for a randomization of the electric measurement value. This measurement value may this be used as a Physical Unclonable Function (PUF).
(62) Arranging the structured electrode layer on the dielectric layer 28 and/or arranging conductive traces on the film substrate 24 may comprise a deposition process, a printing process and/or a photolithographic process. A printing process may allow for a simple and repeatable deposition, wherein a photolithographic process may allow for a high resolution or precision.
(63) In other words, in microsystems technology and in particular when forming capacitances, it is known to produce advantageously homogenous, continuous and reproducible layers. Security films or security foils are known to be based on resistive networks/arrays. In known concepts, capacitances are produced in printed circuit technology with single layers of the printed circuit board, using surface mounted devices (SMD) components, respectively. No printed circuit boards or foil materials are used that comprise no or even low variation in the electric capacity. In the printed circuit board industry it is known to connect a front side of a substrate and a second conductor path layer on the backside of the substrate such as a PCB-board or a flexible foil over vias, which involves drilling and/or lasering through the substrate material. In contrast, method 1000 enables producing a capacitive foil array having the property that capacitances vary with respect to their electric values. The capacitive array can be used for generating a cryptographic key which is derived from the variations of the capacitive values. In one simple case, the capacitive array is formed by lines and columns being separated from each other by a dielectric.
(64)
(65) The layer stack 22 further comprises a structured electrode layer 32 being arranged at the dielectric layer 28 such that the dielectric layer 28 is arranged at least between parts of the circuit structure comprising the conductive traces 26.sub.1 to 26.sub.7 and the structured electrode layer 32. Between conductive traces 26 and the structured electrode layer 32, an electric property 34 may be obtained. The type of the electric property 34 may be based or may depend on properties of the dielectric material arranged in the dielectric layer 28 and/or an interconnection of parts of the structured electrode layer 32 and/or of the conductive traces 26.sub.1 to 26.sub.7. Although the PUF-film 20 is described as forming electric capacitance values as electric properties 34.sub.1 to 34.sub.5, also further or different electric properties such as impedance values and/or resistance values and/or inductance values may be obtained.
(66) The dielectric layer 28 may comprise a varying and/or different thickness d.sub.1 to d.sub.5 at locations where conductive traces 26.sub.2 to 26.sub.6 oppose the structured electrode layer 32 so as to form the electric capacitance values 34.sub.1 to 34.sub.5. The thickness may be understood as an extension along a direction being parallel to a surface normal 38 of the film substrate 24. Based on the varying thickness, i.e., differences between thickness d.sub.1, d.sub.2, d.sub.3, d.sub.4 and/or d.sub.5, varying electric capacitance values 34.sub.1, 34.sub.2, 34.sub.3, 34.sub.4 and/or 34.sub.5 may be obtained.
(67) The number of conductive traces 26 being 7 in
(68) Although the structured electrode layer 32 is illustrated as one single conductive trace, also a higher number of conductive elements or traces may be implemented. Alternatively or in addition, different electronic components may be arranged, for example, capacitor elements, inductance elements such as coils or the like.
(69) As described in connection with
(70) The dielectric material used for printing the dielectric layer 28 may also comprise at least one granule material having a dielectric constant being different from a dielectric constant of a polymer matrix and/or the ceramic particles so as to allow for a further randomization of the electric properties 34. Furthermore, as a size, position and/or property of the granule material may vary along a lateral position and/or along a thickness direction within the dielectric material and/or may vary between different PUF-films, a further level of security may be obtained. In case of an attack such as a drilling attack leading to defects or damages in the PUF-film, a reparation is hampered because the property of the granule material would also be need to be repaired. According to an embodiment, different types of granule materials may be arranged in the dielectric material 28, e.g., two types, three types, four types or even more. Example materials which may be used for generating ceramic based capacitances and that may be used as a granule material include, amongst others, MgNb.sub.2O.sub.6, ZnNb.sub.2O.sub.6, MgTa.sub.2O.sub.6, ZnTa.sub.2O.sub.6, (ZnMg)TiO.sub.3, (ZrSn)TiO.sub.4 and/or Ba.sub.2Ti.sub.9O.sub.20. Further example materials include Al.sub.2O.sub.3; SiO2; Cr.sub.2O.sub.3; Si.sub.2O.sub.3; SiC, ZrO.sub.2, TiO.sub.2. Alternatively or in addition, the granule material may comprise, for example, dielectric materials such as TiO.sub.2, TiN or the like.
(71) When referring again to the step 1010, the dielectric material may be printed such that the dielectric layer 28 covers a first region 42 which may be continuous or discontinuous. The dielectric layer 28 may be printed so as to not cover a second region 42 of the film substrate 24 and/or the circuit structure comprising the conductive traces 26.sub.1 to 26.sub.7. The conductive traces 26.sub.1 to 26.sub.7 may form a further structured electrode layer 32.sub.2. Between the first region 42 and the second region 44, one or more material edges 46.sub.1 to 46.sub.3 may be arranged so as to separate the regions 42 and 44. The structured electrode layer 32.sub.1 may be arranged on the dielectric layer 28 so as to extend between the first region 42 and the second region 44 by extending over one or more of the material edges 46.sub.1 to 46.sub.3. Thereby, it is possible to contact the structured electrode layers 32.sub.1 and 32.sub.2 in the second region 44. Thereby, a generation, implementation or arrangement of vias may be avoided as the arrangement of vias is difficult. For example, the first and second structured electrode layers 32.sub.1 and 32.sub.2 may be galvanically connected or coupled with each other, e.g., by a soldering process. Alternatively or in addition, at least parts of first and second structured electrode layers 32.sub.1 and 32.sub.2 may be arranged in a common plane without galvanic connection with the second structured electrode layer, for example, for forming lines or pins of a connector.
(72) A method for producing the PUF-film 20 may further comprise arranging an electric shield so as to shield the structured electrode layer 32.sub.1 and/or 32.sub.2. For example, a shielding layer, i.e., a layer of a conductive material, may be arranged on a surface of the film substrate 24 opposing the dielectric material 28.
(73) Alternatively or in addition, the shielding may be arranged adjacent to the structured electrode layer 32.sub.1, for example, on a surface thereof opposing the film substrate 24. An insulating and/or dielectric material may be arranged between the structured electrode layer 32.sub.1 and the electric shield so as to allow shielding of the structured electrode layer 32.sub.1 from external influences. In one example, a further dielectric material is arranged on the surface of the structured electrode layer 32.sub.1 opposing the film substrate 24 so as to obtain a possibly homogenous surface. The electric shield may be arranged on that dielectric material.
(74) In other words, embodiments of the first aspect provide for a solution of interconnecting different layers at which no vias have to be drilled or lasered (subtractive processes). Both electric conductive layers are separated from each other by the used dielectric material, for example, the same material used for producing the capacitive array. The dielectric material provides for a galvanic separation. An interconnection of both layers may be formed at the edge or in holes of the dielectric layer. Connections and crossings may be used for interconnecting lines and/or rows of conductive traces with external electronics and/or with electronics being contained in the evaluating chip. This allows for arranging all layers or contacts thereof one side, e.g., the front side or the back side of the substrate. At the same time, inhomogeneities of the layer thickness of the dielectric layer may be used for obtaining a variation of the capacitive behavior between both layers of conductive traces.
(75) In further other words, conductor path layers 1 and 2 meet at the edge of the dielectric layer. At the edge, conductive traces may be combined, interconnected or galvanically coupled with each other, for example, for increasing capacitive values and/or for continuing the conductive trace, e.g., for connecting the conductive trace with an evaluation unit.
(76)
(77)
(78) For defining the first and second regions 42 and 44, the printing process may be adapted accordingly, for example, by defining the respective regions in the screen of a screen printing/silkscreen process. Alternatively or in addition, the dielectric material may be a photosensitive material. A method according to an embodiment may comprise a step of exposing the photosensitive material in an exposer region so as to develop the dielectric material in the exposing region and so as to define a mask of the dielectric material. According to a simplified example, the dielectric material may be printed onto the complete surface of the film substrate. By exposing parts or regions of the dielectric material, regions in which the dielectric material remains and/or regions in which the dielectric material is removed afterwards may be defined, e.g., by hardening or softening the dielectric material based on the exposing.
(79)
(80) A capacitance value of the capacitive elements 34 may vary stochastically based on the variation of the thickness of the dielectric layer due to the printing of the dielectric material. For example, this may allow for obtaining or generating cryptographic keys from the electric capacitance values, wherein tampering or modification of the PUF-film destroys the source of the key and therefore disables regeneration of the key and thus allows for detection of the tampering.
(81)
(82) At the crossing points of the lines and columns, there is arranged the capacitive value which may be described with the width of the conductive trace in the line and column on the one hand side and by the thickness of the dielectricum at the region of the crossing on the other hand. A proper selection of the dielectricum and of the method for producing the PUF-film, the homogeneity of the dielectric layer may be influenced over the complete area, leading again to a random variation of the electric values of the capacitances. For example, the silkscreen process may provide for an inhomogeneity in the layer thickness of the dielectric layer. At the same time, differences in the layer thickness may be obtained by the topography of the substrate surface, the conductive traces being already arranged thereon respectively and before the dielectricum is arranged. Further, surface forces may influence the wetting behavior of the interface being formed by the substrate foil, the conductive traces, the dielectricum and thus results in a local variation of the layer thickness and in a random local variation of the single capacitances with respect to adjacent capacitances in different lines or columns. Further, typical symmetry effects may occur, for example, being axially symmetrical based on the lines of the screen and/or being rotational symmetric based on the rotation of the spin-coating process.
(83) In other words, by selecting the method for producing the PUF-film, openings in the dielectric layer may be produced for enabling an electric connection between conductor path layer 1 and 2. A size of the opening or edge, a steepness of the edge and a quality of the opening and/or edge and a homogeneity of the thickness of the dielectric layer can be influenced with the selection of the printing process. For producing the dielectric layer, there may be used exclusively additive processes in a simple embodiment such as a silkscreen process, a rotary printing process, an offset printing process, a pad printing process and a spin coating process or the like. Further, a combination with a photolithographic process is possible at which the previously described processes are used to deposit a photosensitive layer and for exposing the layer in regions, for example, in regions where the photosensitive dielectric is defined to remain. It is possible to use photosensitive permanent resists which may be deposited prior to exposing them with a laminator. According to one embodiment, a dielectric layer is produced using a silkscreen process. By using a structured screen, it is possible to generate openings in addition to an outer edge of the dielectric layer. This allows for generating additional electrical connections between the conductive path layers 1 and 2, the structured electrode layers 32.sub.1 and 32.sub.2 respectively. Silkscreen processes may comprise resolution limits being around 100 μm. For generating holes or openings having a lower pitch, i.e., smaller than 100 μm, i.e., less than 10 μm, there may be used a photolithographic process. For example, a typical screen may comprise 400 lines per inch providing for a respective resolution.
(84) Further, there are permanent photoactive resist materials which may be used and which may be laminated over the complete area using a laminator, for example, onto the structured electrode layer 32.sub.2. Alternatively, a different additive process may be used, e.g., a silkscreen process, an inkjet process, a pad printing process and/or a Gravure printing process. This allows for applying the layer over the complete area or pre-structured. In a following step, holes may be defined, for example, using ultraviolet exposure as known in the microsystems technology. For example, using a glass mask, it is possible to define those areas of the photoactive material that are interconnected/developed by the ultraviolet radiation and therefore remain afterwards and/or for defining regions which are removed afterwards and therefore allow for a through-connection so as to connect conductor path layers 1 and 2. Such through-connections are sometimes needed, for generating or connecting complex circuit structures being arranged in different layers.
(85) Embodiments provide for the advantage that based on the inhomogeneity of the layer thickness of the dielectric layer, the behavior of the grid of electrode structures is influenced. This grid-like electrode structure may be used generating cryptographic keys. The network of capacitances may be evaluated, for example, line-wise and/or column-wise, by using evaluation electronics, for example, a microcontroller, a central processing unit, a field programmable gate array (FPGA) or the like. Differences or variations in capacitance values between lines and/or columns may be transformed so as to allow derivation of cryptographic keys by use of mathematic processes and/or software. Such a cryptographic key may be used for encrypting data.
(86) Further, implementing evaluation concepts, an un-allowed attempt for spying on and/or for tampering may be detected. An attempt for spying on may include a mechanical variation of the foil array, e.g., due to scratching, drilling, piercing or the like. The mechanic damage results in a change of the electric values of the capacitances and therefore results in a detectable event that may be detected by the evaluation electronic. As with the capacitance array, the through-contacts may be produced in an additive way, a cost-efficient possibility is generated for increasing the integration density of the circuit structures. It is possible to generate wiring layers for electric components such as microcontrollers or ICs in a same process step as the capacitance array.
(87)
(88) As was described in connection with the first aspect, the circuit elements of the circuit structure 54 may be embedded in dielectric material, wherein the dielectric material may also comprise conductive granule and/or contamination leading to defects in the circuit structure 54, e.g., short circuits or open circuits. Further, when compared to evaluation of capacitance values, evaluation of resistance values may provide for additional information which respect to an attack on the PUF-film 60.
(89)
(90) In connection with the first aspect, the first and/or second structured electrode layers 32.sub.1 and/or 32.sub.2 may be already arranged when providing the film substrate 24 and/or may be generated or deposited after providing the film substrate 24, wherein in both cases prior to the printing at least the first structured electrode layer 32.sub.1, advantageously both structured electrode layers 32.sub.1 and 32.sub.2 are present. A method according to an embodiment may comprise providing the film substrate 24 for the printing 1010 so as to have the two opposing main sides 24a and 24b and having the first structured electrode layer 32.sub.1 on the first main side 24a and the second structured electrode layer 32.sub.2 on the second main side 24b. The film substrate 24 may provide a dielectric layer with respect to the first and second structured electrode layers and may thus allow for generating and obtaining the capacitance values to be measured. The dielectric material being printed thereon may allow for diversification or falsification or manipulation of the capacitance values. The printing 1010 may be performed on the first structured electrode layer 32.sub.1 and/or on the second structured electrode layer 32.sub.2.
(91)
(92)
(93) As will be shown in the following, by applying a specific evaluation concept, a focus may be put on the capacitance values 34.sub.1,1 to 34.sub.2,2 which carry a high amount of information in view of tampering or the like. In particular, the capacitance values 34.sub.1,1 to 34.sub.2,2 may be very sensitive to tampering attempts. In other words, the circuit structure 54 and/or the circuit structure 54a in connection with the PUF-foil 60 may be regarded as well-tailored measurement circuit that is suited for PUF-based capacitive enclosures. A cryptographic key may be derived from the PUF and used to encrypt the underlying system. Any penetration destroys the key and thus prevents tampering with the powered-off system. This represents a concept for combined enclosure integrity verification and PUF evaluation. The circuit structure comprises conductive traces on two (or more) layers which are separated by a non-conducting dielectric such as polyimide. To prevent interference and fringing fields, the enclosure may be covered by a grounded shield such as the shield 62 on the top and/or the bottom. The trace structure on both layers may be orthogonal to each other. In order not to generate any unprotected spots, the mesh may span across the entire surface of a device to be protected. A spacing between traces may be a fixed parameter which may be set to 300 μm, 200 μm, 100 μm or even less, e.g., 50 μm or the like.
(94) The PUF-film 60 may be used to cover an enclosure of a module under protection. Although
(95) Alternatively, N≠M, allowing for a different configuration of e.g., 32.Math.16, 32.Math.8, wherein for both, N and M any suitable number of at least 1 may be applied, e.g., 2, 3, 4, 6, 8, 10 or more such as more than 15, more than 30 or even higher.
(96) Each capacitor is built from hundreds up to thousands of tiny trace overlaps connected in parallel, each individually contributing to the total variation capacitance. When considering a simplified 2×2 enclosure model as illustrated in
(97) Statistical analyses may show that using absolute capacitance variation, directly taken from the coupling between two electrodes, is unsuited. Trace thickness and width variations usually show a circular pattern due to the manufacturing process [13]. This causes correlation between the location of the electrodes on the enclosure and their PUF property. As this contradicts the PUF's unpredictability, embodiments employ differential capacitance measurements which cancel global effects. This may reduce the number of independent combinations to N.sup.2/2.
(98) The relevant capacitances for this embodiment are illustrated in
(99)
(100) The conducting traces 26.sub.1 to 26.sub.4 are arranged in a first trace layer of the PUF-film and are arranged in a second trace layer of the PUF-film. For example, the conductive traces 26.sub.1 and 26.sub.2 are arranged in layer 1, wherein the conductive traces 26.sub.3 and 26.sub.4 are arranged in layer 2. Each of the conductive traces 26.sub.1 and 26.sub.2 overlaps with at least one, a plurality or alternatively each of the conductive traces 26.sub.3 and 26.sub.4 of the respective other layer in a plurality of overlap regions 48 so as to form a corresponding plurality of capacitor structures in the overlap regions 48. Each electric capacitance value evaluable by evaluating the respective conductive trace 26 is based on at least a first and a second capacitor structure 34 when providing for a plurality of overlaps between each of the conductive traces. The resistance value may be present and measurable between the ends of the circuit elements. The plurality of conductive traces in layer 1 and the plurality of conductive traces in layer 2 may each be meandered, wherein the conductive traces 26.sub.1 and 26.sub.2 span a film region 66.sub.1 in which they are meandered. A film region 66.sub.2 is spanned by a region in which the conductive traces 26.sub.3 and 26.sub.4 are meandered. A region in which the film regions 66.sub.1 and 66.sub.2 overlap with each other, i.e., in which the conductive traces of both layers are meandered, may be referred to as a sensoric region. The sensoric region may be a region in which the PUF-film is adapted for securely covering a device to be protected such as an enclosure. In the sensoric region, the plurality of overlaps 48 may be arranged. By way of example, the conductive traces 26 may meet each other orthogonally in the overlap regions 48.
(101) In the following, an example is given on how to obtain connections or ends of the conductive traces 26 in a common plane in a connector region 68 whilst arranging the conductive traces 26 in different layers in the sensor region. The conductive layer 28 may be arranged such that a portion 72.sub.1 of the conductive trace 26.sub.1, a portion 72.sub.2 of the conductive trace 26.sub.2, a portion 72.sub.3 of the conductive trace 26.sub.3 and/or a portion 72.sub.4 of the conductive trace 26.sub.4 extends over the material edge 46 of the dielectric layer 28 so as to extend in a different layer whilst avoiding an implementation of vias. This may be of advantage in view of manufacturing costs and manufacturing efforts. It may be in particular of advantage when arranging the conductive traces of a common layer such as the conductive traces 26.sub.1 and 26.sub.2, 26.sub.3 and 26.sub.4 respectively in a way such that each conductive trace in the first layer and the second layer is exclusively neighbored by a different conductive trace along an axial course of the trace by arranging the conductive traces in an interleaved manner. When examining the conductive traces 26.sub.1 and 26.sub.2 in their course from TX1/TX2 to TX1 R, TX2R respectively, the interleaved arrangement is preformed such that the conductive trace 26.sub.1 is only neighbored by a different conductive trace, i.e., the conductive trace 26.sub.2 in the same plane. This allows for detecting short circuits by monitoring resistance values and/or capacitance values between different conductive traces.
(102)
(103)
(104) A width 76 of the traces may be individual or may be globally set and may comprise, for example, a value of approximately 100 μm. Further, a spacing between two adjacent conductive traces may also be 100 μm. This allows for a configuration in which a drill attack with a drilling tool having a diameter of 300 μm damages at least two conductive traces, which is easily detectable.
(105) As described in connection with the first aspect, the PUF-film may comprise the dielectric material so as to comprise at least one granule material being arranged in a stochastic distribution in the dielectric material so as to influence the plurality of electric capacitance values.
(106)
(107) Evaluating the electric capacitance value differentially may refer to comparing absolute values of capacitance values which are, at least by means of a system layout, equal. Each of the two capacitance values may comprise an absolute capacitance value, e.g., a first absolute capacitance value between a first and a second trace and a second absolute capacitance value between a third trace and the first, second or a fourth trace.
(108) By comparing the first and second absolute capacitance value, a differential capacitance value may be obtained.
(109) For example, when referring again to
(110) When making reference again to
(111) According to an embodiment, the plurality of circuit elements comprise at least a first conductive trace, a second conductive trace and a third conductive trace, which are, for example, conductive traces 26.sub.1, 26.sub.2 and 26.sub.3. The conductive traces 26.sub.1 and 26.sub.2 both overlap with the conductive trace 26.sub.3. Thereby, a first electric capacitance value 34.sub.1,1 is arranged between the conductive traces 26.sub.1 and 26.sub.3, wherein a second electric capacitance value 34.sub.2,1 is arranged between the conductive traces 26.sub.2 and 26.sub.3. The electric capacitance values 34.sub.1,1 to 34.sub.2,2 may be referred to as absolute capacitance values. The evaluation unit 78 may be configured for applying a first excitation signal to the first conductive trace, e.g., at the terminal TX1, and for simultaneously applying a second excitation signal to the second conductive trace 26.sub.2, e.g., at the terminal TX2. The evaluation unit 78 may further be configured for receiving a response signal from the third conductive trace 26.sub.3, e.g., at the terminal RX1 so as for differentially evaluate the electric capacitance value between the first and the second trace 26.sub.1 and 26.sub.2. By applying the first and second excitation signal to the traces 26.sub.1 and 26.sub.2 and by receiving a resulting signal from a different trace, global effects acting on both traces 26.sub.1 and 26.sub.2 may be compensated. This may be obtained in a high quality in an embodiment according to which the evaluation unit is configured for providing the first and second excitation signal in antiphase with respect to each other, i.e., having a phase of approximately 180° whilst having a same amplitude, wherein the evaluation unit may also be configured for provide antiphasic signals within a tolerance range of at most 10°, at most 5° or at most 2° and an amplitude matching of at least 20 dB, at least 40 dB or more, advantageously at least 60 dB. An amplitude matching of 60 dB is to be understood as both amplitudes have a mismatch of at most 0.1% (10.sup.−3). In addition to the first and second signal, further lines may be excited using at least a third and a fourth signal.
(112) As may be seen from
(113) The evaluation unit may be configured for measuring changes, i.e., deviations from one another and/or changes over time, in the (absolute) electric capacitance values 34.sub.1,1 to 34.sub.2,2 with a resolution being smaller by a factor of at least 100 (at least 2 orders of magnitude) when compared to the capacitance values 34.sub.1,1 to 34.sub.2,2. Those capacitance values 34.sub.1,1 to 34.sub.2,2 may be smaller by a factor of at least 100 when compared to the electric capacitance values of each of the conductive traces in relation to a common reference electrode, e.g., a common shielding, being referenced as Cs in
(114) In connection with embodiments, three different capacitance values may be of interest. A first capacitance may refer to a capacitance value of a conductive trace with respect to a reference electrode and may be referred to as parasitic capacitance. A so-called absolute capacitance may be the total capacitance of a conductive trace of a first layer with respect to a conductive trace on a second layer. The differential and third capacitance may be the difference between the two absolute capacitances.
(115) The evaluation unit 78 may be configured for compensating the first evaluation result and/or the second evaluation result for an environmental parameter such as a temperature, a humidity, ageing effects, a measure for electromagnetic radiation, a pressure or the like. Those environmental parameters may influence resistance values and/or the electric capacitance values in a known way and may thus be compensated for. For such purpose, the evaluation unit 78 may comprise respective sensor elements, may be connected to such sensor elements and/or may extract such information from the first, second, or an additional evaluation result and/or may receive information containing information about the environmental parameter. For example, the effect of temperature, humidity or the like may be pre-known to the evaluation unit so as to allow a feed-forward compensation. Alternatively or in addition, the evaluation unit may be configured for determining additional values such as the absolute capacitance value of one or more pair of traces. This may be obtained without significant additional effort because differential measurement of the capacitance values may be performed in a similar way. When compared to a differential capacitance value, an absolute capacitance value may be obtained using only one instead of at least two excitation signals.
(116) The evaluation unit may apply an excitation signal that may comprise a same or different, advantageously lower signal amplitude for exciting the traces and for determining the absolute capacitance values. Those absolute capacitance values may also vary over time or affected by the parameters to be compensated such that by measuring the absolute capacitance values a precise compensation of the environmental parameter may be obtained. For compensation, an absolute capacitance value related to the differential capacitance value may be used. Alternatively or in addition an unrelated or different absolute capacitance value may be used based on assumptions such as a comparable influence of the external parameter on all absolute and thereby differential capacitance values.
(117) Alternatively or in addition to receiving a respective environmental information from a sensor element, the evaluation unit 78 may be configured for using absolute capacitance values and/or measurements for compensating an environmental parameter or effect. As described, the absolute capacitance value such as one or more of the capacitance values 34.sub.1,1 to 34.sub.2,2 may be obtained by the evaluation unit by evaluating same between a pair of traces 26 of the circuit structure such as the circuit structure 32, 54 or 54a or a different circuit structure. This may be done at a first instance of time, e.g., during regular intervals of some seconds, minutes, hours or days but also only once, e.g., during manufacturing or the like. The evaluation unit 78 may further be configured obtaining the absolute capacitance value at a second instance of time, e.g., in regular intervals, at specific events such as power-up or the like or after time interval subsequent to the first evaluation. Signals used for exciting the pair of traces 26 may not be required to be antiphasic because of the time difference between the measurements and the independency of both measurements. Any two different traces 26 may be used as pair of traces, wherein in PUF-films having a corresponding circuit structure, it is advantageous to use traces 26 having an overlap with each other so as to allow a comparatively high absolute capacitance value.
(118) The evaluation result 78 may be configured for comparing the absolute capacitance value evaluated at the first instance of time and the absolute capacitance value evaluated at the second instance of time so as to obtain an absolute capacitance evaluation result, e.g., a relative or absolute difference or variation, probably set in relation with the time having expired between the first and second instance of time. Based thereon, the evaluation unit 78 may derive information related to the environmental parameter, e.g., the temperature and/or may derive a correction parameter for correcting a result of the differential measurement, so as to compensate the first evaluation result for the environmental effect.
(119) For example, the evaluation unit 78 may have access to a memory having stored thereon the information related to the environmental parameter, e.g., in a look-up table, and/or as a function or the like. From the absolute capacitance evaluation result, by way of example, a relative deviation such as 1%, 5% or 10%, the evaluation unit may derive information that a temperature to which the device is exposed has fallen by a specific relative or absolute value such as X° C., X being any applicable value. With this temperature information or an information derived thereof, the differential measurement or result thereof may be corrected or compensated, e.g., using a function or look-up table.
(120) Alternatively or in addition, the absolute capacitance value evaluated at the first and/or second instance of time and/or the absolute capacitance evaluation result may be used by the evaluation unit 78 for detecting an attack on the PUF-film, e.g., when determining a too fast change of the absolute capacitance value and/or a deviation exceeding the changes expected in the specified temperature range.
(121) Based on the first and/or the second evaluation result, the evaluation unit may be configured for determining an attack on the PUF-film. The first and second evaluation result may be obtained in parallel and/or cyclically during a runtime or powered time of the apparatus. Alternatively, the first and second evaluation result may be determined during different time instances such as verifying the second evaluation result during or after a power-up of the apparatus in combination with a cyclic monitoring of the first evaluation result thereafter and during runtime.
(122) When determining an attack, for example, when determining changes in the electric capacitance values and/or the electric resistance values exceeding a predefined threshold, then the evaluation unit may perform counter measures such as a zeroing, i.e., deleting data from a storage. In particular, decrypted data and/or unencrypted may be deleted from a storage.
(123) This may be performed, for example, by performing a re-boot and thereby resetting volatile memories and/or by actively overwriting the data. Zeroing may also comprise the deletion of a key including additional data such as raw measurement data derived from the electric capacitance values.
(124) A further way of protecting an apparatus according to an embodiment is that the evaluation unit 78 may be configured for determining a cryptographic key based on the plurality of electric capacitance values 34 at a first instance of time. The cryptographic key may be determined or derived from the electric capacitance values with any public or secret algorithm or scheme and may be used to encrypt data used for operating the apparatus to be protected. Such encrypted data obtained by encrypting may be stored, for example, in a memory of the apparatus or in an outsourced memory. Afterwards, the derived cryptographic key may be deleted. At a second instance of time when the encrypted data is needed for operation, for example, after a power-on or re-boot, the evaluation unit 78 may, again, derive the cryptographic key from the electric capacitance values 34. The second cryptographic key will only be equal to the first cryptographic key in a case when the electric capacitance values are (within the tolerance range) unchanged. Only the unchanged cryptographic key may allow for reading and decrypting the encrypted data. Thus, when reading the encrypted data and having determined a modified or wrong cryptographic key, decryption of the encrypted data will fail. Thereby, protection of the apparatus may be performed battery-less. Although referring to encrypting and decrypting, embodiments cover alternatively or in addition other concepts of using a key such as signing and verifying data using cryptographic keys. Further, the data to be encrypted may be a key itself, e.g., a private key for RSA encryption. Using the kay obtained from the PUF-film, data may be encrypted and decrypted, wherein the decrypted data may comprise or be further keys for different encryption purpose such as signatures.
(125) A configuration of the evaluation unit 78 may be adapted to application specific requirements.
(126) Such requirements may include, without limitation, that the system needs to perform differential measurement of capacitive nodes and has to verify the integrity of the enclosure, combined in one single circuit. Such a task may need to be carried out targeting a reasonable time frame of, by way of non-limiting example, less than 1 s, e.g., less than 400 ms, less than 200 ms or less than 100 ms for measurement and detection of an intrusion so as to enable a quick countermeasure. To be able to exploit the variation of the electric properties, which may be in the range of ±20 fF, ±10 fF or ±8 fF or even less, a capacitive measurement performed by the evaluation unit may be carried out with a precision/resolution of 1 fF or higher, i.e., smaller values to be measured. Other values may be implemented without limitation. Advantageously, the resolution is high enough, e.g., 1/20 with respect to an example variation range of 20 fF this results in a resolution of 1 fF or more. Other values are at most 1/25 or at most 1/30. With respect to cooling and system integration, the system circuit's power dissipation may be limited so as to not exceed, for example, 5 watts, 2 watts or 1 watt or even less. The deployment in a security product may implicitly need the measurement concept to not be side-channel prone, i.e., the measurement may need to be leakage-reduced and time-constant. In addition, the chosen concept may need to be scalable to adapt the enclosure to be protected to different typical form factors of embedded systems. The circuit may support performance-optimized as well as area-optimized implementations. The explained differential evaluation may have advantages over several concepts for capacitive sensing [14] of which the following were ruled out for the application. 1) Constant current charging: A constant current is applied to the capacitor and the rise in voltage is observed. This method is unsuited for C.sub.m and ΔC measurement while the large shielding capacitance C.sub.s is present, as the measurement result will primarily show C.sub.s. 2) RC/LC oscillator: The capacitor in an RC or LC oscillator sets its frequency. By measuring its period, the capacitance can be derived. This concept does not scale well, as it can measure only a single TX-RX pair at a time. Furthermore, capacitance-dependent oscillations can leak information to the outside [15]. 3) TX pulse excitation, RX charge subtraction: A pulse on a single TX electrode pushes charge onto all RX electrodes. Each transferred charge is converted to a voltage and subtracted from each other in order to acquire differential measurements. Despite this method being scalable and constant-time, it showed to be infeasible. The minuscule ΔC becomes submerged in the circuit's unavoidable gain-mismatches, biases, and offsets as the circuit subtracts two similar and large mutual capacitances to obtain their small difference.
(127) To overcome the drawbacks, the DFT-based in-enclosure differential capacitance measurement concept may be used. The basic idea is as follows: The measurement is moved from the time domain into the frequency domain. Additionally, the capacitance subtraction may be shifted into the enclosure, instead of struggling with subtraction afterwards in the analog or digital circuit. Wherever possible, analog circuitry may be replaced with digital signal processing to counteract external influences, component imperfections, and aging.
(128)
(129) Some embodiments are directed to measure a variation in differential capacitances, it may be of an advantage to implement both capacitances (per design) as equal. A difference therebetween corresponds to deviation during manufacturing and thus is a PUF. A balanced electrode layout thus is directed to a capacity of both electrodes being the same, for example, by designing the areas of both electrodes as equal. A balanced electrode layout as described in connection with
(130) To excite two neighboring electrodes, the digital-to-analog converter 82 and the subsequent amplifier 92 which receive versions of the signals 84.sub.1 and 84.sub.2 being filtered with a low-pass filter 94 may create a sinusoidal signal of amplitudes V.sub.TX and frequency f.sub.TX, whereas ω=2 πf.sub.TX. A phase shift of 180° is applied to the signal at the, e.g., even-numbered electrode, thereby inverting the signal. Thereby, signals 96.sub.1 and 96.sub.2 applied to different conductive traces 26.sub.1 and 26.sub.2 may be antiphasic. This may generate two currents proportional to the mutual capacitance, flowing from two TX electrodes to one RX electrode. Both currents have a 180° phase shift relative to each other. They merge on the RX electrode, resulting in the complex current.
I.sub.RX=jωV.sub.TX.Math.C.sub.m+jω−V.sub.TX).Math.(C.sub.m+ΔC) (1)
(131) If both mutual capacitances were exactly matched (ΔC=0), the capacitances and thereby the currents would completely cancel each other out. However, due to manufacturing variations, i.e., ΔC≠0, a tiny residual current will remain, described by
I.sub.RX=jωV.sub.TX.Math.C.sub.m−ΔC)=−jωV.sub.TX.Math.ΔC). (2)
(132) Equation (2) shows that the complex current I.sub.RX is directly proportional to the variation in capacitance ΔC. The equation is independent from C.sub.m and C.sub.s, thus, neither the mutual capacitance nor the shield capacitance influences I.sub.RX.
(133) The RX current ranges from sub-nanoampere up to few nanoamperes. A JFET-based (junction gate field-effect transistor) transimpedance amplifier (TIA), which is a current-to-voltage converter, translates the current I.sub.RX into a voltage. Subsequently, the voltage is processed by high-pass (HP) and low-pass (LP) filtering and amplification stages to remove any offsets prior to amplification. Finally, the signal is digitized by an analog-to-digital converter (ADC). According to an embodiment, the evaluation unit comprises a transimpedance amplifier such as TIA 98 being configured for providing a voltage signal based on a current signal received from a circuit element.
(134) After digitizing the signal, ΔC is reconstructed by determining the RX signal's amplitude and phase. Instead of solving this issue in the time domain the signal is transformed into the frequency domain using a digital dual-phase lock-in amplifier approach. Therefore, the system performs a frequency analysis by applying a Discrete Fourier Transform (DFT) on the digitized RX time domain signal. This filter bank splits the signal into its frequency components, thus, separating most of the noise from the signal. The amplitude of the DFT bin at f.sub.RX=f.sub.TX is directly proportional to |ΔC|. Since this returns only the absolute value |ΔC|, the sign may be recovered from the phase information. A negative ΔC has a phase shift of 180° relative to a positive |ΔC|. Hence, two decision regions are defined representing a negative and positive capacitance difference, respectively. This method may profit from a strict synchronization of the signal generation with the ADC data acquisition in order to preserve this phase information. In the last step, an algorithm rescales the data relative to the (arbitrarily chosen) full-scale value of ±10000. This completes the measurement circuit's data handling, as the raw PUF data is available in a usable format. As described, the evaluation unit 78 may comprise a transimpedance amplifier being configured for providing a voltage signal based on a current signal received from a circuit element, i.e., the conductive trace 26.sub.3.
(135) Embodiments allow for an integrity verification method executed by the evaluation unit and directed to the electrodes, e.g., the conductive traces. Integrity may be verified during assembly of the envelope. Later in the field, the integrity verification detects tamper events. The system checks whether an electrode is interrupted or if shorts to other electrodes exist. As it is impractical to disconnect one or the other circuit, the integrity verification is combined with the capacitance measurement circuit and components are shared. This is implemented as follows. 1) TX electrodes: Integrity is verified by applying a voltage to each electrode. First, the DAC and the TX amplifier apply a constant voltage to a single TX electrode, e.g., TX1. A comparator verifies that the signal is present on the output of the electrode, named TX1 R (see
(136) Using
(137) The system may be designed to run on a single supply V.sub.DD of 3.3 V, as this voltage is available in most systems. Therefore, the analog circuitry is arranged around a center voltage of V.sub.DD/2=1.65V.
(138) The example measurement system is controlled by a STM32F303 microcontroller. It features an ARM Cortex-M4 core including a floating-point-unit (FPU) and signal processing extensions. Additionally, the microcontroller provides all needed peripherals, such as DACs, ADCs, direct memory access (DMA), and zero-waitstate core-coupled-memory (CCMRAM). The system is well suited for our measurement, as DAC signal generation and ADC signal acquisition can be configured to run in hardware, freeing the CPU from load.
(139) For the example and therefore not limiting measurement, an excitation signal of 1 V RMS is applied with a frequency of f.sub.TX=33.3 kHz. The frequency has shown to be an adequate trade-off between several optimization goals and limits. Nine periods of the excitation signal are generated, whereas one period is for circuit startup and eight periods are for measurement, resulting in only 270 μs per node. The signal acquisition operates with 12 bit resolution at 5.14 MS/s to oversample the signal for noise reduction.
(140) 1) TX Excitation: For obtaining ideal antiphasic signals, both signals may be matched in amplitude and show a relative phase shift of 180°. An amplitude imbalance or phase error would otherwise create an offset in the extracted PUF data, as the enclosure-internal current cancelation would no longer work correctly. As a rule of thumb, the TX signal imbalance should be at least an order of magnitude smaller than ΔC/C.sub.m≈ 1/1000=−60 dB.
(141) For signal generation, the circuit uses three stages. First, two amplitude-matched and inversely phased 33.3 kHz signals are generated by the microcontroller's DAC. A second-order low-pass filter follows in the signal-processing chain to remove the 1 MHz DAC sampling frequency. As the DAC itself does not provide sufficient amplitude-matching, the signal is fed to a fully differential amplifier. It improves the signal quality by guaranteeing the phase shift and amplitude matching. The THS4551's output balance is specified to 85 dB, providing sufficient signal quality for our measurement [16].
(142) 2) RX Current Amplification: The RX current in the nanoampere range needs an amplifier with high gain and low noise. Furthermore, the RX node has high capacitive load, caused by the shielding capacitance C.sub.s, which is present at the amplifier's input and reduces its bandwidth. Additionally, the amplifier's input bias current advantageously does not exceed a certain level, otherwise the TIA will be overdriven by the bias current, rendering RX current measurement impossible. Therefore, a design showing low noise, high gain bandwidth product (GBW), and low bias current is needed, which cannot be provided by a single operational amplifier.
(143) To overcome this issue, the basic idea of a JFET-based TIA setup is adapted, which is often used in optics to amplify a tiny photodiode current at a node of high capacitance [17]. Our adjusted circuit is depicted in
(144) The circuit implements a control loop that maintains 1.65 V at the RX electrode by varying the output voltage V.sub.OUT. The RX electrode current I.sub.RX causes a slight increase in RX voltage, causing the JFET to open and carry more current via its drain-source channel. This decreases the voltage at the non-inverting input of the operational amplifier. It leads to a decrease in output voltage V.sub.OUT that pulls current through the feedback network R1∥C1. This reduces the RX voltage to its original level. The equilibrium is reached when the current through the feedback network is equal to the RX electrode's current. The impedance of the feedback network controls the relation between I.sub.RX and V.sub.OUT i.e., it sets the TIA's gain.
(145) With this configuration, the TIA has a gain magnitude of 0.8.Math.10.sup.6V/A at an excitation frequency of 33.3 kHz and
1.0.Math.10.sup.6V/A at DC.
(146) After the JFET-TIA has converted the RX current into a voltage, a high-pass filter 108 strips its DC component. To further amplify the signal, it is fed to an inverting amplifier 112 with a gain of −100≙40 dB which scales the signal to the ADC's dynamic range. This amplifier is implemented as active first order low-pass filter 114 to prevent aliasing during digitization. The low output impedance of the active filter allows the signal to be directly connected to the ADC 116 (Analog-to-Digital Converter) without a buffer.
(147) 3) TXR Integrity: The TX electrode integrity verification pulls a single electrode to a higher voltage and checks whether this increase is seen at TXR. The DAC and TX amplifier are already able to perform this. Thus, no additional circuitry is added at the TX side. On the TXR side, a LT1719 comparator senses whether the voltage exceeds the threshold of 1.87 V.
(148) 4) RXR Integrity: The RX electrode integrity verification injects a current into RXR and measures the resulting signal at RX. Since the integrity verification is an open/short test, the requirements on the accuracy of the current are relaxed. To implement a coarse current source, each RXR input is connected in series to a diode, a 3 MΩ resistor, and a digital output. During RX integrity verification, a single digital output is set to 1 (3.3 V) while all others remain at 0 (0 V). The RX electrode has a fixed voltage of V.sub.DD/2=1.65 V and the diode's forward voltage is about 0.4 V, which results in a current of approximately 0.4 μA flowing into the RX electrode. All outputs set to 0 do not carry current, since the diodes at the RXR electrode are reverse-biased. The RX TIA converts the 0.4 μA current to a voltage of V.sub.DD/2−0.4 V=1.25 V. The subsequent comparator, set to a threshold of 1.45 V, senses this voltage and reports an intact electrode on success.
(149) For an example implementation, an LT1719 comparator is used, BAS516 diodes, and 74HC595 shift registers as digital outputs, controlled via SPI.
(150) The signal processing extracts the amplitude and phase from the RX signal using a dual-phase lock-in amplifier. The ADC sampling may be strictly synchronized with the DAC excitation since the internal DAC signal serves as lock-in reference signal. This is achieved by interconnecting microcontroller peripherals such as timers, DMA, ADC, and DAC, providing a fixed phase relation for acquisition.
(151) Next, a windowing function is applied to the data. Since the frequency of interest is known, a rectangular window covering eight full periods of the signal is used. By choosing an integer number of periods for the window length, most information is preserved and spectral leakage at this frequency is not observed.
(152) Computing a dual-phase lock-in amplifier in software is computationally expensive, as it involves two multiplications, two additions and two sine-table lookups per sample. The same result can be obtained by applying a DFT 118 on the digitized signal and evaluating the bin, corresponding to the reference frequency. A performance-optimized algorithm may be used according to an embodiment. Such an algorithm is available to compute a single bin DFT, named Goertzel-Algorithm [18]. It involves a single multiplication, addition, and subtraction per sample, but no table lookups.
(153) The algorithm runs on the FPU which delivers single-cycle multiplication, addition, and subtraction. All intermediate values are kept in FPU registers continuously, speeding up computation. Performance is further increased by moving the algorithm from flash memory into CCMRAM. This reduces the computation time for one node by 25% down to 258 μs.
(154) When referring now to
(155) c. Scaling the Circuit
(156) In order to scale the circuit to an example N×M enclosure, analog multiplexers are introduced, as shown in
(157) Depending on the desired speed-to-area trade-off, the circuit can also be scaled by parallelization by adding further comparators and signal-processing chains. However, the example circuit is area-optimized.
(158) An example circuit may be implemented for a 16×16 enclosure. The experimental setup is shown in
(159) The measurement circuit supports a full-scale range of ±73 fF (±10,000 points) at a theoretical digital resolution of 7.3 aF. However, precision is limited by the circuit's measurement noise of 0.3 fF (≈41 points) in the current setup. The analog measurement needs 270 μs, the DFT signal processing takes 258 μs, resulting in a measurement time of less than 0.6 ms per capacitive node.
(160) Prototypes of the enclosure were manufactured in a four layer thin-film technology. Within an area of 144 mm×70 mm, they contain 16 TX and 16 RX electrodes, whereas each TX-RX combination has 990 track overlaps. Due to the differential readout this yields 128 differential PUF nodes.
(161) Different foils may be used. The integrity verification detects shorted and interrupted electrodes correctly. The PUF measurement circuit extracts the differential capacitance variation from the enclosure foil. Exemplary results for the extracted ΔC after early preprocessing are depicted in
(162) Extracted PUF data from several foil enclosures using the same measurement circuit shows no characteristic patterns visible across the measured data of different foils. Furthermore, when measuring the same foil using two measurement circuit boards, the resulting data is highly similar with a correlation coefficient of 0.998. Thus, the vast majority of entropy is extracted from the foil with negligible influence of the measurement system. All in all, this measurement circuit implementation verifies that our circuit concept for differential capacitive PUF readout is valid and may be practically feasible.
(163) Combining both properties has the advantage of protecting a system during operation by integrity measurements and during non-operating phases, like storage or transport, by a key derived from a PUF at runtime. This has a significant impact on the usability of such tamper protected products: It relaxes storage and transport requirements and also extends their lifetime. These advantages are accompanied with the challenge to measure capacitance variation that is several orders of magnitude smaller than the nominal values while fulfilling strict timing constraints defined by the security requirements. Some embodiments solve all of these challenges in one circuit. The concept is practically feasible by implementing and testing a prototype, which successfully evaluates a 128 node differential capacitive PUF enclosure. Despite the variation is only a few femtofarads and is hidden behind large parasitic capacitances, this PUF property was successfully extracted by our circuit in the specified time and precision. Since the concept can be scaled by two parameters, i.e., enclosure electrode count as well as speed vs. area, it becomes a flexible building block for secure PUF-based enclosures.
(164) Embodiments of the second aspect refer to a differential measurement concept for capacitive PUF-based security enclosures whose parasitic capacitances are orders of magnitude larger than the PUF variation. The embodiments refer to a scalable circuit design enabling enclosure integrity verification as well as capacitive PUF measurement in the range of milliseconds. Further, embodiments refer to a proof-of-concept implementation of the proposed circuit and practical verification using an enclosure prototype. Due to the high complexity of the overall system, example descriptions are sometimes limited in view of a number of measurement components, wherein other components such as key generation and enclosure design are not included in detail. According to embodiments, a differential capacitive measurement inside the enclosure is performed by applying stimulus signals with 180° phase-shift that isolate the local manufacturing variation in the femtofarads range. The analog circuitry an corresponding digital signal-processing chain, using a microcontroller-based digital lock-in amplifier, perform precise PUF digitalization. The system's measurement range may be approximately ±73 fF in embodiments, wherein this shall not limit the invention described herein. The conversion time per PUF node may be less than 0.6 ms and the raw data may show a measured noise of 0.3 fF. This may be a base for a high-entropy key generation while enabling a short system's data time. The circuit is scalable to the enclosure size and may experimentally verify to extract information from 128 PUF nodes, using a circuit prototype. A two-layered mesh may contain orthogonally routed electrodes (conductive traces). They may serve as dual-purpose, as they are checked for integrity and are evaluated as PUF at the same time. The PUF behavior may be contained in the variation of capacitive coupling between electrodes in the enclosure. PUF property extraction may be challenging since the capacitance variation lies within the range of only several femtofarads while parasitic capacitances of hundreds of pico-farads are present. This may be solved by differentially evaluating the electric capacitances. Furthermore, the influence of the measurement circuit on the PUF may be minimized in embodiments. Therefore, the system may use a specialized measurement circuit which can extract the PUF property precisely and may also verify the mesh integrity. Both measurements may be interlocked to obtain a secure system. The PUF may prevent simple jumper attacks, as additional wiring will have non-negligible impact on the PUF property. In return, the integrity verification prevents an attacker from splitting off regions of the capacitive PUF. While there are concepts for integrity verification as well as for capacitive PUF sensing in known concepts, embodiments provide for a combination thereof.
(165) The third aspect of the present invention is directed to obtaining a reliable measurement and to protect devices with PUF films and apparatus according to embodiments. Known tamper-resistant enclosures and envelopes are battery-backed envelopes that enclose the system and thereby protect it from tampering [2].
(166) The aforementioned battery-backed envelope is made of a flexible polymer with a printed conductive mesh. Additionally, it is potted using an opaque resin with the following properties: difficult to penetrate and to remove, either mechanically or using solvents. The mesh serves as a resistive sensor which is continuously evaluated. The mesh tracks are routed on multiple layers in a serpentine pattern with no visible gaps such that penetrating the mesh very likely causes a detectable change which triggers the zeroization, i.e., countermeasures of the apparatus which may include a deletion of memory content. Due to the wrapping of the envelope, this mesh obstructs any possible angle of an attack. Additionally, its tracks are invisible to optical inspection or x-rays and a device-specific layout randomization further increases the difficulty of attacks.
(167) This mechanism ensures security assuming that sensitive data is kept only in volatile memory and a continuous power supply is available for the BBRAM and monitoring circuit, even when the device itself is powered off. Therefore, the monitoring circuit is advantageously armed at the factory and supplied by the battery throughout the product lifetime including its shipping. This is unfavorable since environmental conditions during transport often exceed those of the intended operating environment in terms of peak temperature, vibration, etc. The actively running battery-backed monitoring circuit is subject to these conditions and as a result is more likely to cause false alarms. After arrival, the battery need to be maintained [8]. Another approach measures the difference in fringe-effect capacitances of the enclosure due to intruding objects [3].
(168) It also relies on a battery-backed mechanism and therefore suffers from similar limitations.
(169) The aforementioned issues could be solved if the device did not require a battery. This can partially be achieved by PUFs which offer a hardware-intrinsic key storage without a dedicated memory for the key [19], [10]. They make use of random variations of manufactured structures to derive an individual behavior for each device. In order to harness the PUF properties, these variations have to be extracted. They are similar for each read-out of the same device but subject to noise and also affected by environmental changes.
(170) Secure key derivation with PUFs is a common use case [20]. During PUF enrollment at the factory, the key is derived for the first time and discarded after helper data is created and stored, to enable later error-correction. During reconstruction in the field, helper data and the noisy PUF response are combined to derive the initial secret. PUFs can be integrated into IC designs, but they typically only offer limited tamper-resistance [12], especially for other system components. Therefore, it is focused on non-silicon PUFs in the following.
(171) One such example is the Coating PUF [21] that protects an IC by covering its top with a randomized coating material, which is measured to extract its unique properties and derive a secret key. Reconstructing this key is infeasible if the coating has been damaged due to an attack. A similar approach using an optical PUF is presented in [22]. Both approaches do not address attacks during runtime. Furthermore, covering every IC of an embedded device with a coating involves a costly, fully customized sourcing of its components. Moreover, access to the PCB would still be possible and therefore simplify various attacks, e.g., voltage glitch or side-channel attacks.
(172) Based on the requirement to protect a system as a whole, Vai et al. present an optical waveguide coating PUF [23] with a corresponding system architecture in [24]. As the waveguide only covers the top of a PCB, its edges and bottom remain unprotected. Moreover, such a system can be attacked during runtime to extract keys in volatile memory. Therefore, implementing a runtime tamper detection that monitors the system after power-on is vital to detect possible tampering attempts. This is not mentioned in [24].
(173) The enclosure traces may be manufactured from a material of non-zero ohmic resistance that may influence the result of the differential or non-differential capacitance measurement. Therefore it may be advisable for the system not only to use the capacitive measurement result for key derivation but the measured complex impedance, also containing information about the resistive properties of the enclosure.
(174) For performing a measurement of the absolute capacitance values, the evaluation unit may be able to conduct a third measurement that yields the mutual/absolute capacitance of a TX to RX combination. This is not a differential measurement, thus, the resulting capacitance is, for example, C.sub.11 in
(175) For the aforementioned measurement, the evaluation unit outputs, by way of example, only a single TX signal which is a sine wave of 33.3 kHz but with reduced amplitude. (Since this is a single signal, the phase does not matter and may be arbitrary/uncontrolled and may later be ignored by the evaluation unit during signal processing). (Technical Background: The microcontroller possibly still generates two sine signals, but only one multiplexer is activated, thus, only a single sine signal arrives at the envelope) The remaining signal chain is unchanged, amplifies and converts the signal. The digital signal processing chain processes the acquired signal and may use the same algorithms as for the differential measurement. The absolute measurement result may be used to compensate effects such as ageing, humidity, and temperature.
(176)
(177) Features of the first and/or second aspect may be combined with features of the third aspect. For example, the dielectric layer 28 may cover the conductive trace layer, the structured electrode layer 32 partially so as to leave the region 44 uncovered from the dielectric layer 28. Conductive traces of the trace layers 32.sub.1 and 32.sub.2 may be galvanically connected or coupled in the region 44 due to the traces of the structured electrode layer 32.sub.1 extending beyond the edge of the dielectric layer 28.
(178) The circuit structure 154 being a flat circuit structure may be understood as comprising a flat or aerial extension, for example, an extension along directions x and directions y being at least 10 times or at least 100 times larger when compared to the thickness direction, indicated as z. By way of non-limiting example, the flat circuit structure 154 may be formed as the circuit structure 54, 54a, 54b or 54c. The PUF-film 150 further comprises the shield 62 being formed as a flat electric shield. The shield 62 formed as a flat shield is understood as covering an area of the flat circuit structure 154, i.e., being flat a same was as described for the flat circuit structure 154. Being flat may refer to as being arranged in one layer, wherein the layer is not limited to be only two-dimensional but may also bend.
(179) The circuit structure is evaluable with respect to the plurality of electric capacitance values 34.sub.1,2 and/or 34.sub.2,3 being arranged between the plurality of circuit elements 152.sub.1 to 152.sub.3 that may be formed as the conductive traces 26. The electric shield 62 at least partially covers the circuit structure 154, advantageously in a large area and more advantageously at least in a sensoric region and provides for a common reference electrode of the plurality of electric capacitance values. As an optional feature in the third aspect, the plurality of circuit elements 152 may further be evaluable with respect to a resistance value as described in connection with
(180) The shield 62 may be arranged at the PUF-carrier 52 prior to attaching the PUF-film 150 to a device to be protected. For example, the shield 62 may be formed as a metallic layer, e.g., as a film or foil or the like. According to an embodiment, the shield 62 is at least partially formed as a metallic mesh allowing for a high flexibility when wrapping the PUF-film 150 around a housing or case of a device to be protected.
(181) Alternatively to arranging the shield 62 prior to combining the PUF-film 150 with a device to be protected, the shield 62 may also be arranged afterwards. For example, the conductive foil or conductive mesh may be arranged after having wrapped the foil around the housing. Alternatively, the shield 62 may be a sprayed conductive layer, i.e., may be formed by spraying or vaporizing, i.e., generating, the conductive layer 62 after having wrapped the PUF-film around the housing. I.e., one or more of the shielding layers, in particular an outer shield may be generated after having wrapped the PUF-film around a device to be protected, e.g., a housing.
(182) Alternatively, embodiments cover both, i.e., a PUF-film 150 having already the shield 62 and being extended by a sprayed layer.
(183)
(184) The dielectric layer 28 comprises a first granule material 156 and a second granule material 158, wherein the granule materials 156 and 158 may vary when compared to a dielectric constant, a temperature coefficient, a resistance value and/or a density or the like. The granule materials 156 and/or 158 may be arranged in a stochastic distribution so as to influence the plurality of electric capacitance values. On a side 162 of the structured electrode layer 32.sub.1 opposing the conductive traces 26.sub.1 to 26.sub.7 a filling layer 164 may be arranged, for example, using a printing process. The filling layer 164 may comprise dielectric material which may be, for example, a same material as the dielectric layer with or without the granule material or may be a different material. The filling layer 164 allows for obtaining a plane surface of the layer stack. On a side 164A of the filling layer 164, the side 164A opposing the structured electrode layer 32.sub.1, a further film substrate layer 24.sub.2 may be arranged. The film substrate layer 24.sub.2 may be a same or a different material when compared to the film substrate 24.sub.1 and may serve as a spacer between a further shielding layer 62.sub.2 arranged on a side 24.sub.2A of the film substrate 24.sub.2 opposing the filling layer 164. The filling layer 164 in combination with the substrate 24.sub.2 may allow for generating a distance h.sub.1 between the structured electrode layer 32.sub.1 and the shielding layer 62.sub.2 being, within a tolerance range of at most 30%, at most 20% or at most 10%, equal to a distance h.sub.2 between the conductive traces, e.g., 26.sub.1 and the shielding layer 62.sub.1. The rough or uneven structure of the structured electrode layer 32.sub.1 may prevent a complete equilibrium between the distances h.sub.1 and h.sub.2 by approximating such a condition with the filling layer 164 being as thin as possible whilst generating an even surface and the film substrates 24.sub.1 and 24.sub.2 comprising a same thickness may allow for almost symmetrically shielding the capacitance values of the PUF-film.
(185) According to an embodiment, the circuit elements, i.e., the structured electrode layer 32.sub.1 and/or the structured electrode layer 32.sub.2 may be covered at least partially with a material being opaque in a visible wavelength range and/or in an x-ray wavelength range. Such a material may be directly deposited on the respective structured electrode layer 32.sub.1 and/or 32.sub.2 on one or both sides thereof but may also be different and possibly contactless with respect to the structured electrode 32.sub.1 and/or 32.sub.2 layer within the layer stack. An example material may be an opaque polymer material, an opaque glass material, a semiconductor material or the like. Alternatively or in addition, a polymer material such as a carbon material such as a carbon paste may be arranged in the PUF-film and forming one or more layers thereof. Carbon material may be opaque as well in the visible wavelength range of, for example, 380 nm to 780 nm and the x-ray wavelength range ranging from, for example, 1 μm to 10 nm. Alternatively, a conductive material may be used, for example, a silver paste or the like. Silver paste may allow for an opaqueness but may be formed conductive based on the degree of filling of the silver in the paste. Alternatively, the opaque material may comprise PEDOT/PSS, inks comprising carbon nanotubes or the like as well as thin metal layers
(186) According to a further embodiment, the material being referred to as opaque material may be alternatively or in addition be formed so as to comprise a within a tolerance range of 10%, 5% or 2% a same absorption coefficient when compared to the conductive traces and/or the shield at least in the relevant optical regions such as X-ray and/or visible wavelength. This generates a kind of opaqueness as the traces, shielding and the rest may form a homogenous area hampering diversification of structures. The traces thus become invisible.
(187) When referring to the structure illustrated in
(188) As illustrated in
(189) As described in connection with the first and the second aspect, the plurality of capacitance values may be arranged at least partially in an overlap area of conductive traces arranged in different conductive trace layers and overlapping with each other. As described in connection with
(190) Further layers possibly having at least one additional granule material may be arranged between the conductive trace and the adjacent or juxtaposed shield or outside the overlapping regions so as to further adapt the capacitance measured between the structured electrode layers.
(191)
(192)
(193) For example, a metallic housing to be covered with a PUF-film of the described embodiments may allow for use thereof as one of the shields such that a use of only one shielding layer allows a shielding from both sides.
(194)
(195) While making reference to a layout according to
(196)
(197) According to an embodiment, the interconnecting circuit may be adaptable or programmable for, at least between different PUF-film, variably generate a series of conductive traces such that by identifying, bypassing or corrupting one of the traces, e.g., at the controller PIN, a location or position of the trace in the PUF-film is still unknown.
(198) The interconnecting circuit 168 may allow for a further randomization and/or for an increased security, i.e., for a layout randomization. For example, the interconnecting circuit 168 may connect the connecting lines 172.sub.1 to 172.sub.A 1:1 to a subset of the circuit elements 152.sub.1 to 152.sub.B so as to operate only the connected subset of circuit elements 152. Based on randomness, it may be unknown to the attacker, which lines are operated and which are not operated so as to allow for a high security. Alternatively, the interconnecting circuit 168 may connect one of the interconnecting lines 172 to two or more of the circuit elements with a ratio of 1:n so as operate the n circuit elements 152 in parallel. Alternatively or in addition, the interconnecting circuit 168 may interconnect two or more of the circuit elements 152 so as to form a single operated circuit element, e.g., by operating a plurality of n circuit elements 152 serially with one interconnecting line 172. This may allow for increasing a number of traces 152 when compared to a number of pins used for connecting the PUF-film. For example, the evaluation unit/processor may use 16 pins, i.e., A=16, wherein the interconnecting circuit may be configured for increasing this number by a number of 16, i.e., B=16×A=256.
(199) The interconnecting circuit 168 may also be referred to as a security sensor enhancing security of the PUF-film. The interconnecting circuit 168 may alternatively or in addition to providing for the aforementioned layout randomization and according to an embodiment, provide for one or more functionalities of an evaluation unit described in connection with present embodiments. The interconnecting circuit 168 may comprise an integrated circuit structure and may allow for embedding functionality into the PUF-film by embedding the interconnecting circuit 168 into the PUF-film. For example, the interconnecting circuit may be configured for monitoring the circuit structures and may receive, from a device, electrical power and may provide for alarm signals. Alternatively, the interconnecting circuit providing for the layout randomization and an additional embedded chip providing for at least a part of a functionality of the evaluation unit may be embedded into the PUF-film, probably outside the sensoric region, as two distinct components.
(200)
(201) The apparatus 190 comprises an evaluation unit 174 configured for differentially evaluating the plurality of electric capacitance values based on antiphasic excitation of neighbored circuit elements as well as the verification of trace integrity and an optional absolute capacitance measurement. The antiphasic excitation and/or different features may be implemented as described in connection with the second aspect. Thus, according to an embodiment, the evaluation unit 174 is the evaluation unit 78.
(202) According to an embodiment of the third aspect, the evaluation unit 174 is configured for antiphasically exciting a first circuit element such as the circuit element 152.sub.1 and a second circuit element such as the circuit element 152.sub.2 of the plurality of circuit elements 152 at an instance of time and for not exciting a third circuit element such as the circuit element 152.sub.3 of the plurality of circuit elements at the instance of time. When making reference again to
(203)
(204) The interconnecting circuit 168 may comprise for a variable, i.e., at least once adjustable, interconnection between the contact ports 175 and the conductive traces 152. In the shown first configuration, the contact port 175.sub.1 may be electrically connected to the end 1, the contact port 175.sub.2 may be electrically connected to the end 2, the contact port 175.sub.3 may be electrically connected to the end 3R and the contact port 175.sub.4 may be electrically connected to the end 4R. Additionally, the interconnecting circuit 168 may provide for a variable, i.e., at least once adjustable, interconnection between the ends. In the shown first configuration, ends 1R and 3 and ends 2R and 4 may be interconnected.
(205)
(206) The interconnecting circuit 168 may be a component distinct from the evaluation unit 174. Alternatively, the evaluation unit 174 may at least partially be implemented by the interconnecting circuit 168 and be embedded in the PUF-film.
(207)
(208) The apparatus 200 comprises, for example, the PUF-film 40 having a sensoric region 176 being defined by the overlaps of the conductive traces as described in connection with
(209) The apparatus 200 comprises an evaluation unit 182 which may implement, amongst other things, the functionality of the evaluation unit 78 and/or 174.
(210) The PUF-film 40 may be connectable to the evaluation unit 182 by use of a connector 184. The connector 184 may comprise the lines of the PUF-film 40 having the conductive traces arranged as a fine mesh in the sensoric region in a common plane as described in connection with
(211) Capacitive measurement 186 and integrity detection 188 may be performed, for example, in the analog domain 88, wherein the subsequent processing may be performed, at least partially, in the digital domain 86. Conversion from the analog domain 88 to the digital domain 86 may be obtained by use of the ADC 116. The evaluation unit 182 may be configured for performing a signal processing 192 being a basis for a subsequent key generating 194, e.g., by processing the results of the capacitance measurement 186. Signal processing 192 may further be a basis for a tamper detection 196, for example, by evaluating changes in the capacitances obtained by the capacitance measurement 186 and/or by results obtained by the integrity detection 188.
(212) A key 195 derived in the key generation 194 and/or a result 197 of the tamper detection 196 may be evaluated in a unit 198 for generating an alarm, heartbeat and/or instructing a zeroization. The unit 198 may be, for example, a watchdog transmitting, for example, a heartbeat-signal 202 to the host system 178, wherein the heartbeat-signal 202 may signalize that everything is ok or may signalize that an alarm is generated, i.e., that tampering is detected.
(213) For implementing such a variation, zero-dead or zero-alive signals may be used and may be interpreted as the signal is transmitted when everything is ok or that the signal is transmitted when tampering is detected. Alternatively or in addition, the key 195 may be supplied to the host system 178, for example, for firmware decryption or decrypting other data stored in a memory of the host system 178. The host system 178 may also monitor one or more Critical Security Parameters (CSPs) 206 and/or may actively or passively perform zeroization 208, i.e., may delete at least unencrypted data and/or other, possibly encrypted data. As indicated by line 212, the sensoric region 176 may enclose both, the evaluation unit 182 and the host system 178. For example, the evaluation unit 182 may be arranged in the same housing as the host system 178 and/or may be implemented in the same processing unit.
(214) In other words, when focusing on attempts to physically penetrate the envelope (PUF-film), it may be assumed, by way of non-limiting example only, that penetrations of the PUF-film are performed with at least 300 mm in diameter (drilling attack). This is a reasonable choice based on readily-available tools, e.g., the shaft diameter of micro-probing needles and common drill sizes. As a result of such an attack, the system needs to be able to ensure that it becomes immediately inoperable and recovery of its sensitive data is advantageously infeasible. To protect a host system such as a Hardware Security Module (HSM), two building blocks may be used, the PUF-film with capacitive sensors enclosing the system and its corresponding evaluation unit. According to the present embodiment, the capacitive sensors of the envelope act as a PUF and provide the basis for a cryptographic key. For example, during each device start-up, the same key can only be extracted if the envelope has not been tampered with. While manufacturing the device, this key is used as key-encryption-key (KEK) to encrypt and authenticate CSPs or other sensitive data of the enclosed device. The thusly protected data is stored in non-volatile memory, since an attacker can neither gain information from it nor change it in a useful way without damaging the envelope, thereby destroying its key.
(215) Upon power-on, the system self-authenticates and is decrypted. Once the device is running, the same sensors that extracted the PUF properties from the envelope now continuously monitor it. In case of an attack during runtime, an alarm is raised to trigger the zeroization of sensitive data which is temporarily stored in volatile memory for processing it. Alternatively or in addition, the alarm may be used for deactivating specific parts or functions of the device, such as parts for operating on data to be secured. I.e., the evaluation unit may be configured for deleting data or for deactivating a function of the device in case of detecting altering of the circuit structure and/or the PUF-film.
(216) According to an embodiment, the evaluation unit may be configured for providing at least a first alarm signal and a second alarm signal in case of having detected a tampering. The first alarm signal and the second alarm signal may comprise the same information, i.e., allowing for distinguishing between a first case in which no tampering is detected and a second case in which tampering is detected but may encode this information differently so as to hamper and attempt for imitating a respective signal, e.g., by overwriting the original signal on the signal lines. For example, the first alarm signal may provide for a first sequence or continuous amplitude, e.g., a specific voltage on a pin of the controller in the first case and may switch to a different amplitude (including zero voltage) in the second case thereby indicating the alarm. The second alarm signal may provide for a probably random sequence of potentials in the first case and may change the sequence or may deactivate the sequence in the second case, thereby indicating the alarm. A change in one of both signals may indicate the second case and may therefore cause the device and/or evaluation unit to trigger countermeasures.
(217) Using two alarm signals, in particular at least one dynamic and/or one static may thus allow for a high security, in particular when, as in accordance with embodiments, the apparatus determines a duty cycle and/or a different parameter of at least one of the signals being thus a priori unknown to an attacker. The parameter may be determined, for example, during each start up differently.
(218) To enhance zeroization, the device may be configured, for example, to deactivate one or more functional blocks, elements, circuitries or other power consuming parts at least temporarily so as to save electrical energy. The saved electrical energy may be used for extending or to lengthen a runtime of the device, e.g., when power supply lines are attacked. For example, analogue components including components for measuring the integrity of the PUF film may be deactivated. The saved energy may be used for a probably digital deletion/zeroization such that a high amount of data may be erased based on deactivation of power consuming functional blocks. I.e., the device and/or evaluation unit may be configured for unpowering/deactivating at least functional block or circuitry, advantageously an analogue circuitry so as to save electrical power and to use the saved electrical power for zeroization, i.e., for deleting data.
(219) The envelope (PUF-film) is comprised of a foil containing a mesh of fine conductive tracks. The mesh represents the PUF to derive a cryptographic key by evaluating the capacitance measurements over the entire sensoric region. It also acts as an opaque barrier around the fully enclosed device. The envelope's sensoric region contains overlapping tracks that represent the electrodes which work as capacitive sensors. These tracks are subject to manufacturing variations in terms of surface roughness and physical dimension due to etching. As a result, each overlap between the electrodes represents a capacitance that cannot be accurately predetermined.
(220) The evaluation unit connects the envelope to the host system and comprises the following domains and units: Analog domain: distinct measurement concepts for the capacitance measurement and integrity detection Digital domain: signal processing, key generation, and runtime tamper detection unit including zeroization Data interface: to pass the key to the host system. Please note that this interface is within the physical security boundary, i.e., enclosed and protected by the envelope Heartbeat interface: with two distinct alarm signals that are monitored by the host system during runtime
(221) After each power-on, the host decrypts the firmware or additional CSPs using the key derived from the envelope. Once running, direct access to the key is denied to prevent software-based extraction. If the alarm signals indicate a tampering attempt, a zeroization is carried out. Following this generic approach, it is possible to implement a wide range of applications that may be unaware of their physically protected execution environment.
(222)
(223) Apparatus 210 may comprise a potting resin 218 covering the PUF-film, wherein the potting resin 218 may also be a part of the PUF-film, for example, one of the outer layers or the outermost layer. The potting resin may be, for example, a carbon paste. As described, the shielding 62.sub.2 may also cover the potting layer 218.
(224) A supply and/or communication cable 222 may allow for communicating with the host system and/or for powering it externally. In case of a communication, the host system may comprise a secure communication interface preventing an exchange unencrypted data.
(225) Advantageously, the sensor region completely covers the housing 216 so as to avoid any regions suited for an attack.
(226) When selecting an envelope-based design, as illustrated in
(227) Moreover, wrapping it around a case has the least impact on the design of the enclosed PCB. Please note that unwrapping the envelope in real-world designs is prevented by potting it.
(228) Layer Stack-Up of the Envelope
(229) Thus far, meshes with fine tracks have been primarily evaluated as resistive sensors. However, this has several dis-advantages when compared to capacitive sensors. First of all, the resistance of a track can be measured and replaced with a matched resistor, such that this bypass would be difficult to detect. Moreover, resistive sensors only detect changes within their own tracks. Sensing of nearby objects and layers is not possible. In contrast, capacitive sensoric regions are conceptually less prone to bypassing their tracks due to the small capacitances in the range of femtofarads. Furthermore, parasitic capacitances towards surrounding objects influence the measurement. Hence, not only is the track considered part of the measurement but so are the nearby layers and objects.
(230) A self-contained capacitive sensor is comprised of two electrodes, “Tx” and “RX” This terminology is borrowed from the domain of capacitive touch technology. Generally speaking, the “Tx” electrodes are driven by an excitation signal and the “RX” electrodes act as receivers. This is quantified as the “mutual capacitance” between Tx and RX (as illustrated in table 1). From a functional point of view, the capacitive measurement is to be protected against interference from inside the device and its environment. Therefore, the two layers of electrodes are enclosed with a grounded shield on top and bottom to provide a well-defined boundary condition. Since the parasitic capacitance towards the shield will be rather large compared to the mutual capacitance, partially removing the shield already significantly degrades the measurement.
(231) Sensor Design (Physical Layout)
(232) The following requirements were considered in order to design a suitable sensor layout:
(233) (i) The layers comprising the electrodes are advantageously covered completely with the intended sensor structure thereby avoiding blind spots where attacks would go undetected.
(234) (ii) If the envelope is damaged in one spot, this should result in more than one destroyed sensor, i.e., to make this attack more easily detectible, e.g., by realizing an interconnected sensor arrangement.
(235) (iii) The sensor structure of “track-space-track” (or vice-versa) need to be smaller than the diameter of expected attacks.
(236) To address these, a sensor layout may be manufactured with a structure size of 100 μm line and space as shown in
(237) To detect open circuits, the layout in
(238) To determine the physical parameters of the sensor layout, the capacitance C.sub.s of a single sensor node (as illustrated in
(239) In the following, C.sub.c,i˜(μ.sub.c,σ.sub.c.sup.2) is assumed. Recall that adding two Gaussian random variables results in a Gaussian distribution with the sum of means and sum of variances. Therefore, C.sub.s˜
(n.Math.μ.sub.c,n.Math.σ.sub.c.sup.2), i.e., μ.sub.s=n.Math.μ.sub.c and σ.sub.s.sup.2=n.Math.σ.sub.c.sup.2. According to the weak lay of large numbers, the respective means of the sensor cell
(240)
may be computed so as to obtain an equation that depends on n which is the number of parallel cells combined to a sensor node, i.e., C.sub.s=n.Math.
(241) Validating the Assumptions: Independence of variables: Other publications such as [5] and [13] show that besides of local variation there is also global variation across manufacturing panels of PCBs. This results in a capacitance gradient and therefore a global bias. This applies to the technology selected, too. To counteract this effect, a differential measurement as detailed later on is used. Measuring the difference between two pairs of nodes in close vicinity isolates the local variation and minimizes the global effects. With regard to having normally distributed variables, it is referred to the central limit theorem, i.e., the sum of many independent cells combined to a node tends towards a normal distribution.
(242) Estimating the Entropy: To estimate the entropy of the thus far continuous Probability Distribution Function (PDF) of a sensor node, the resolution Δ.sub.M of measurement circuit.
(243) As security objective, Δ.sub.M≤
(244)
(245) To achieve H.sup.Δ=5 bit for the given Δ.sup.M, for σ.sub.s is solved which is 7.7 fF. This value can be verified empirically once a statistically relevant number of samples is available. Using Equation 1, the minimum sensor cell count for a design is
(246)
However, this can only be calculated if σ.sub.c is known, i.e., empirical data is already available. Alternatively, the cell capacitance may be determined using a simulation tool. Additionally, a reasonable assumption for the expected variation needs to be made. In embodiments:
(247) In the following, focus is put on the capacitance measurement that incorporates C.sub.s and its PDF as illustrated in
(248) The lower bound of ΔC.sub.min is then defined as
(249)
Subsequently, ENOB is assumed to be the constant and C.sub.max may be analyzed in more detail. Let C.sub.i,j.sup.M=C.sup.N+C.sub.i,j.sup.V be the mutual capacitances between Tx.sub.i and RX.sub.j and
(250)
(251) As C.sup.V is small compared to C.sup.N, this causes C.sub.max≈C.sup.N. As a consequence, ΔC.sub.min primarily depends on C.sup.N which leads to ΔC.sub.min>C.sup.V for even a small number of sensor cells, as C.sup.N increases linearly in the n, while the variation increases by √{square root over (n)}.Math.σ.sub.c. Thus no variation could be measured. This may be solved by using a differential measurement. For an even I, the electrodes TX.sub.i-1 and TX.sub.i are routed differentially. They form the TX pair (TX.sub.2k-1, TX.sub.2k), for k∈{1, 2 . . . , N.sub.TX/2}. All RX are used as single electrodes with (RX.sub.j), for j∈{1, 2 . . . , N.sub.RX}. Hence, the differential capacitances is γ.sub.k,j=C.sub.(2k-1),j.sup.M−C.sub.(2k),j.sup.M=C.sub.(2k-1),j.sup.V−C.sub.(2k),j.sup.V. Accordingly, the resolution no longer depends on C.sup.N which ensures an improved sensitivity where also the dynamic range is well-adjusted to C.sup.V. Extracting only C.sup.V coincides with the assumption that C.sup.N is the same for neighboring differentially-routed electrodes, i.e., global variations causing different C.sup.N over larger distances are ignored. Improving the sensitivity comes at the price of halving the number of measured capacitances to extract information from, i.e.,
(252)
However, the resulting PDF of the differential capacitance γ is .sub.γ(0, √{square root over (2)}.Math.σ.sub.s) and therefore Equation 2 can be written as
(253)
(254) Hence, the maximum theoretical entropy of the overall envelope in our case is 128.Math.5.5 bit=704 bit.
(255) Since the system's boot process is its most critical aspect in terms of security, its mechanisms are briefly outlined as depicted in
(256) By successfully generating the PUF key, the proper initialization of the TD mechanisms is ensured. This key can then be used to decrypt the firmware of the host or some of its CSPs. If either during power-up or runtime any of these checks fail, a tamper-event is caused that triggers the zeroization and stops the heartbeat signals. All mechanisms have been designed in an intertwined way to have a layered approach to security.
(257) Thus, in case of an attack 224, the heartbeat 202 may be interrupted (or alternatively generated).
(258)
(259) Manufacturing Process: The mesh is based on lithographic patterning to have a scalable technology that allows even smaller structures in the future. Using a reel-to-reel process with an infinite-length substrate, copper (Cu) may be deposited on the first electrode layer by sputtering on a polyimide (PI) substrate. Subsequently, this layer with Rx electrodes is reinforced by an additional semi-additive galvanic process, resulting in a Cu layer of 7 μm. This is done to have a defined stop interface while processing the blind vias in the PI substrate by laser ablation. Afterwards, the Tx layer is only sputtered, resulting in a Cu thickness of just 500 nm, while at the same time creating the conductive interconnection between the electrodes on both sides of the PI. The carrier substrate with electrodes is enclosed in a shield on both sides. The resulting height of the layer stack-up is approx. 200 μm, which is important for the flexibility when mounting the envelope.
(260) Measurement Circuit: Custom discrete measurement circuit is used for testing [27]. Its basic operating principle is to use two antiphasic excitation signals for each Tx pair while the other Tx electrodes remain inactive, thereby creating an in-situ differential capacitance inside the envelope. The resulting current on the Rx electrodes is then further processed by analog circuitry before being sampled, filtered, and evaluated by an STM32 microcontroller. The resulting full-scale range is ±73 fF at a theoretical digital resolution of Δ.sub.M=7.3 aF which is however limited by circuit noise of σ.sub.N=0.19 fF when the envelope is connected. Performing a single differential measurement can be done in 0.6 ms. Since it can be parallelized on the Rx side for each TX pair, this results in (16/2).Math.0.6 ms=4.8 ms for the overall envelope.
(261) Practical Results
(262) A total of 50 envelopes have been manufactured to confirm our design rationale. Since all measurements were performed with the same circuit, the variation observed in the data is only rooted in the variation of the envelopes. To evaluate the statistical properties, 200 samples are exemplarily over time for each sensor node to compute its noise-free mean. To ensure conservative results, the envelopes were measured laying straight, such that only the variation inside the electrodes is captured. This leads to the following preliminary results: Nominal mutual capacitance of sensor node: C.sup.N≈18 pF PDF.sup.1 of γ: μ.sub.s=0.13 fF, σ.sub.s=6.25 fF, σ.sub.N=0.19 fF ΔQ≈1.25 fF=2.Math.y.Math.σ.sub.N (y=3.29) Cell c
(263) Entropy and Key Generation:
(264) Uniqueness and Reliability: Thus far, uniqueness has not been considered for higher-order alphabets. Hence, to compute the uniqueness based on previous definitions, the aforementioned quantization and bit mapping of symbols may be carried out. The obtained variable-length bit strings are then truncated to the shortest output and the uniqueness computed which results in the plot as shown in
(265) Drilling Attack
(266) To verify the tamper-evident properties of our enclosure, one of the envelopes was attacked using a 0.3 mm drill as shown in
(267) When taking 16 TX-electrodes and 16 RX-electrodes as an example configuration for a PUF-film, such a capacitive structure may allow for a secure detection of a drilling attack. When taking into account a width of conductive traces of 100 micrometer and a spacing therebetween of 100 micrometer, a drilling attack in the sensoric region leads to the fact that a row/column out of the capacitive matrix is destroyed, as at least one TX-electrode and at least one RX-electrode will be cut. Thus, not only the single overlap region in the matrix will be destroyed but a complete row or column will be destroyed leading to a destruction of in total 23 overlapping regions. 23 is the number resulting from 16 TX-electrodes being differentially evaluated and leading to 8 groups of differentially evaluated TX-groups used to excite 16 RX-electrodes. 31 is, thus, the result of 8 groups plus 16 RX-electrodes-1, wherein −1 considers the overlapping region of column and row so as to avoid double-counting. Larger diameters of drillings lead to more defects allowing for a more easy detection.
(268) c. Thwarting Additional Attacks on a Conceptual Level
(269) The present description at least briefly considers a selection of other attacks and how they have been considered in the design. Hence, some embodiments do not claim full protection against these attacks, instead, they indicate that practically carrying them out would be challenging. Some attacks involve additional countermeasures which are outside the scope of the envelope, e.g., having a sufficiently internally buffered supply to enable zeroization even if an attacker pulls the power during runtime.
(270) Bypassing Tracks: After drilling a hole, an attacker might attempt to repair open circuits. This is impractical for the Tx layer due to its miniscule height and while the Rx layer is more robust, it is covered by the Tx layer which obstructs miniature repairs. Even if broken electrodes could be reconnected, restoring the previous capacitive behavior is hardly feasible due to the small-scale differential capacitance.
(271) Probing Electrodes: An attacker might try to probe electrodes directly to measure their capacitance. This involves access to all electrodes, as properly connecting unused ones is mandatory for the measurement. At the same time, the shield needs to be partially removed at multiple spots, causing the surrounding field to change, thereby falsifying the results.
(272) Moreover, even state-of-the-art micro probes [29] add a capacitive load of >20 fF which exceeds the observed variation.
(273) Side-Channel Attacks: Emanations are prevented by the case, shielding, and the supply lines are additionally protected. Moreover, the Tx layer carries only insensitive excitation signals. In contrast, the Rx layer carries sensitive signals in the lower nanoampere range, making it difficult to eavesdrop on them. The measurement itself is otherwise time-constant.
(274) Embodiments of the third aspect present a battery-less tamper-resistant envelope, which contains a fine mesh of electrodes, and its complementary security concept. An evaluation unit checks the integrity of the sensor mesh by detecting short and/or open circuits. Additionally, it measures the capacitances of the mesh. Once its preliminary integrity is confirmed, a cryptographic key may be derived from the capacitive measurements that represent a PUF, to decrypt and authenticate the firmware of the enclosed host system. The battery-less tamper-resistant envelope verifies its integrity, for example, after powering-up similar to a tamper-evident PUF. If the system has not been tampered with, the correct key is derived from the envelope, the system's data is decrypted, and multiple tamper detection (TD) mechanisms start to ensure continuous protection while running. This exceeds known concepts and is a solution towards meeting security standards, such as FIPS 140-2 level 4, without a battery for the security mechanism. To achieve this, embodiments contain an advanced mesh concept to not only detect short and open circuits, but also to measure the capacitances between traces. This may be regarded as a basis to implement the tamper evident PUF and allows for a dual approach with more sensitive integrity checks and secret key derivation. Hence, recovery of the key is only possible from inside the system as long as the envelope as not been tampered with. The challenge in successfully implementing this is, enclosing the PCB in a large-scale physical object while only using small scale intrinsic variations of the PUF-based key derivation to make their extraction by an attacker improbable. Furthermore, a wider range of physical attacks may be taken into account that previously have been outside the scope of battery-backed approaches, as their security mechanism is never powered off. Embodiments provide for several conceptual and practical considerations of such a design, its various components and demonstrate the feasibility thereof. Embodiments of the first, second and third aspect therefore relate to a security architecture based on a hybrid envelope which combines properties of traditional tamper-responding envelopes with PUFs and extends their concept. Furthermore, embodiments relate to a stochastic model of the contained PUF to estimate its entropy and support its design process.
(275) Beside a concept for a PUF-film, the third aspect also relates to protecting a case with a hull. This may include wrapping of a suitable foil, i.e., a PUF-film. Alternatively or in addition the structure described in connection with the second aspect and the third aspect may also be included into the housing of a host system, i.e., according to an embodiment, a housing may comprise the structured circuit layers having the dielectric material there between. In other words, the PUF-film may be a side or a plurality of sides of a housing or may be the complete housing.
(276) Such a case of a host system may comprise a flexible cover or a respective housing construction, having an integrated capacitive matrix of conductive traces. The embodiments may refer to the section of physically securing embedded systems following diverse security standards such as FIPS 140-2, PCI-HSM, common criteria or the like. When compared to known systems involving a battery buffering for their surveillance circuits, the present embodiments relate to cases with PUF-structures enabling a battery-less operation of the device.
(277) Embodiments refer to a variation or change of capacitive properties by uncontrollable behavior with respect to their local value and location variations of a composition of the dielectric layer and/or a thickness thereof, e.g., by inserting particles into the dielectric material, because due to manufacturing deviations, sometimes only low variations occur. Embodiments enable to evaluate the variations and to hamper reparability of a damaged structure which would negatively affect the level of protection because, in known systems, the dominant part of the measurement value is a constant value being independent from manufacturing deviations. A property being distinguishable from a capacitive property and which may allow for a unique (one or zero) integrity check is provided. This allows for an unambiguous determination during the manufacturing if the measured variation is based on the manufacturing deviation or if a manufacturing defect occurred. Values to be measured and methods for measuring those values include, in particular a differential capacitive measurement, wherein alternatively or in addition a complex impedance may also be measured as well as other values. Furthermore, the absolute capacitive value may be measured. Known resistance-based foils involve a randomization of the layout so as to allow for a suitable level of protection. Such concepts are known for Physical Unclonable Functions.
(278) Embodiments provide for a capacitive foil matrix being coactively evaluable and allowing for an additional detection of short-circuits or cuts of the traces so as to allow for an integrity check. The conductive traces are formed so as to comprise a number of overlaps, wherein the number of overlaps or the equivalent of their overlapping areas and adjacent edges is balanced in the sense of a differential evaluation. Alternatively or in addition, a PUF-foil may comprise a shielding. Materials of the shielding may be metallic or non-metallic, for example, a carbon paste. Alternatively or in addition, embodiments may provide for PUF-films having a layer stack which has, at least in parts, printed materials such as the printed dielectric layer 28. So as to allow for a high variation, different dielectric materials may be included, e.g., granule materials, for example, one, two or more, so as to obtain a high capacitive variation between TX electrodes and RX electrodes. This may be increased by a local varying mixing ratio of the two or more granule materials. I.e., according to embodiments, the dielectric layer comprises at least a first and a second granule material, wherein an average mixing ratio of the first and the second granule material in the dielectric material varies along a lateral direction of the dielectric layer. This positively influences the key generation out of the Physical Unclonable Function by increasing the entropy and further hampers the reparability because an attacker may re-connect electrodes but is unable to re-construct the capacitive behavior of the granule materials dispersed in the dielectric layer.
(279) Embodiments referred to an electrode layout, wherein at the beginning and at the end of an electrode, a further capacitive coupling may be generated, for example by inserting discrete capacitor elements. This allows for a behavior that a disruption of a conductive trace leads to significant differences in the capacitive portion of a measured complex impedance or in the capacitive value itself, because the electrode capacity is no longer balanced.
(280) Even if layouts according to
(281) Embodiments allow implementation of a battery-less technique providing for an effective protection against attackers so as to substitute battery-buffered techniques.
(282) Embodiments of the second and third aspect thus refer to a carrier having circuit structures with a complex impedance and/or an electric capacitance value being evaluable with respect to an integrity in view of short-circuit and/or an open-circuit. PUF-foils according to embodiments may comprise two or more layers of electrodes and/or shielding layers.
(283) A design rule according to embodiments is that traces of a same electrode (conductive trace) are separated from each other by at least different electrode. The PUF-foil wrapped around a casing or the casing carrying the protective concept may be implemented such that the sensoric region covers the device to be protected completely at least once.
(284) According to other embodiments, the device is covered on two sides, for example, an upper side and a lower side or any other different sides, completely.
(285) According to an embodiment, unprotected surfaces may be covered with an additional structure having a complex impedance and/or electrically connecting the sides protected.
(286) A system according to an embodiment may be configured for evaluating or monitoring a correct and untampered blocking or sealing at edges of the apparatus.
(287) Although embodiments described herein refer to electrodes which are accessible at two regions/areas, according to other embodiments, electrodes may be accessible on a more than two regions so as to allow for a higher number of measurement values.
(288) According to embodiments, an apparatus is configured and/or a method is adapted so as to excite a group of electrodes (conductive traces) and analysis a system response on one or more electrodes of a different (disjunctive) group of electrodes. The measurement system for evaluating the structured electrode layers may be part of the protective concept of the housing or may at least be fixedly connected therewith. According to an embodiment, the measurement system, i.e., an apparatus and/or a PUF-film may comprise a configurable interconnecting matrix such that conductive traces may be measured one with another in a random and/or configurable arrangement. Such embodiments are described in connection with the interconnecting circuit 168.
(289) Some embodiments refer to a shielding using a conductive non-metal such as a carbon paste. After wrapping the case with the PUF-film, the shielding layer 62, 62.sub.1 and/or 62.sub.2 may be covered with a non-metal. A fine mesh of conductive material such as copper may be arranged outside the stack. Alternatively, the obtained stack may be covered by spraying a conductive varnish/lacquer. An order of layers may be changeable, for example the carbon paste and then the conductive material may be arranged or first the shielding may be implemented by the conductive material and afterwards the carbon paste may be arranged. In other words, the shielding may comprise, at least partially, the carbon paste. As carbon paste may comprise a local activity, the conductivity may be enhanced by using a mesh or the like.
(290) A connection of the inner shielding with the housing of the HSM may be obtained by a flexible metal mesh or metal pillow/pad as known from EMC-sealings (electromagnetic compatibility). This may allow for an increased interconnection between the housing and the shielding by use of a low resistance.
(291)
(292)
(293) Following such a concept, the enclosure 216 may completely be protected.
(294)
(295)
(296) Although some aspects have been described in the context of an apparatus, it is clear that these aspects also represent a description of the corresponding method, where a block or device corresponds to a method step or a feature of a method step. Analogously, aspects described in the context of a method step also represent a description of a corresponding block or item or feature of a corresponding apparatus.
(297) A further embodiment comprises a processing means, for example a computer, or a programmable logic device, configured to or adapted to perform one of the methods described herein.
(298) A further embodiment comprises a computer having installed thereon the computer program for performing one of the methods described herein.
(299) In some embodiments, a programmable logic device (for example a field programmable gate array) may be used to perform some or all of the functionalities of the methods described herein. In some embodiments, a field programmable gate array may cooperate with a microprocessor in order to perform one of the methods described herein. Generally, the methods are advantageously performed by any hardware apparatus.
(300) While this invention has been described in terms of several embodiments, there are alterations, permutations, and equivalents which fall within the scope of this invention. It should also be noted that there are many alternative ways of implementing the methods and compositions of the present invention. It is therefore intended that the following appended claims be interpreted as including all such alterations, permutations and equivalents as fall within the true spirit and scope of the present invention.
REFERENCES
(301) [1] M. Vai, B. Nahill, J. Kramer, M. Geis, D. Utin, D. Whelihan, and R. Khazan, “Secure architecture for embedded systems,” in IEEE High Performance Extreme Computing Conference (HPEC), 2015. [2] P. Isaacs, T. Morris Jr, M. J. Fisher, and K. Cuthbert, “Tamper Proof, Tamper Evident Encryption Technology.” SMTA, 2013. [3] H. Eren and L. Sandor, “Fringe-Effect Capacitive Proximity Sensors for Tamper Proof Enclosures,” in Sensors for Industry Conference, 2005, pp. 22-26. [4] P. Tuyls, G.-J. Schrijen, B. Skoric, J. Van Geloven, N. Verhaegh, and R. Wolters, “Read-proof hardware from protective coatings,” in International Workshop on Cryptographic Hardware and Embedded Systems. Springer, 2006, pp. 369-383. [5] L. Wei, C. Song, Y. Liu, J. Zhang, F. Yuan, and Q. Xu, “BoardPUF: Physical unclonable functions for printed circuit board authentication,” in IEEF/ACM International Conference on Computer-Aided Design (ICCAD), 2015, pp. 152-158. [6] S. P. Skorobogatov, “Semi-invasive attacks—A new approach to hardware security analysis,” Tech. Rep. UCAM-CL-TR-630, 2005. [7] S. H. Weingart, “Physical Security Devices for Computer Subsystems: A Survey of Attacks and Defenses,” in CHES, 2000. [8] IBM, “IBM 4765 Cryptographic Coprocessor Security Module,” 2012. [9] D. Samyde, S. Skorobogatov, R. Anderson, and J. J. Quisquater, “On a new way to read data from memory,” in First International IEEE Security in Storage Workshop, 2002. Proceedings., 2002. [10] C. Herder, M. Yu, F. Koushanfar, and S. Devadas, “Physical Unclonable Functions and Applications,” Proceedings of the IEEE, vol. 102, 2014. [11] R. Maes and I. Verbauwhede, “A discussion on the Properties of Physically Unclonable Functions,” in TRUST, 2010. [12] C. Helfmeier, D. Nedospasov, C. Tarnovsky, J. S. Krissler, C. Boit, and J.-P. Seifert, “Breaking and entering through the silicon,” in ACM Conference on Computer and Communications Security (CCS), 2013. [13] G. A. Brist, “Design Optimization of Single-Ended and Differential Impedance PCB Transmission Lines,” in PCB West Conference Proceedings, 2004. [14] L. K. Baxter, “Capacitive sensors,” Ann Arbor, vol. 1001, p. 48109, 2000. [15] D. Merli, D. Schuster, F. Stumpf, and G. Sigi, “Semi-invasive em attack on fpga ro pufs and countermeasures,” in Proceedings of the Workshop on Embedded Systems Security. ACM, 2011, p. 2. [16] THS455J datasheet, Texas Instruments, 2017. [17] LTC6252/LTC6253/LTC6254 datasheet, Linear Technology Corporation, 2012. [18] G. Goertzel, “An algorithm for the evaluation of finite trigonometric series,” The American Mathematical Monthly, vol. 65, no. I, pp. 34-35, 1958. [19] B. Gassend, D. Clarke, M. v. Dijk, and S. Devadas, “Silicon Physical Random Functions,” in ACM CCS, 2002. [20] J. Delvaux, D. Gu, D. Schellekens, and I. Verbauwhede, “Helper data algorithms for PUF-based key generation,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 2015. [21] P. Tuyls, G.-J. Schrijen, B. Skoric, J. van Geloven, N. Verhaegh, and R. Wolters, “Read-Proof Hardware from Protective Coatings,” in CHES, ser. LNCS, 2006, vol. 4249. [22] T. Esbach, W. Fumy, O. Kulikovska, D. Merli, D. Schuster, and F. Stumpf, “A New Security Architecture for Smartcards Utilizing PUFs,” in ISSE Conference, 2012. [23] M. Spain, B. Fuller, K. Ingols, and R. Cunningham, “Robust keys from physical unclonable functions,” in IEEE International Symposium on Hardware-Oriented Security and Trust (HOST), 2014, pp. 88-92. [24] M. Vai, B. Nahill, J. Kramer, M. Geis, D. Utin, D. Whelihan, and R. Khazan, “Secure architecture for embedded systems,” in IEEE High Performance Extreme Computing Conference (HPEC), 2015. [25] V. Immler, M. Hennig, L. Kuirzinger, and G. Sigl, “Practical Aspects of Quantization and Tamper-Sensitivity for Physically Obfuscated Keys,” in Cryptography and Security in Computing Systems (CS2), 2016. [26] T. M. Cover and J. A. Thomas, Elements of Information Theory, 2nd ed. New York: John Wiley & Sons, 2006. [27] J. Obermaier, V. Immler, M. Hiller, and G. Sigl, “A Measurement System for Capacitive PUF-Based Security Enclosures,” in 55th ACM/EDAC/IEEE Design Automation Conference (DAC), June 2018. [28] V. Immler, M. Hiller, Q. Liu, A. Lenz, and A. Wachter-Zeh, “Variable-Length Bit Mapping and Error-Correcting Codes for Higher-Order Alphabet PUFs,” in Security, Privacy, and Applied Cryptography Engineering (SPACE), 2017. [29] GGB Industries Inc., “Picoprobe Model 19C,” 2004, available online: www.ggb.com/PdfIndex files/mod18c.pdf, as of Oct. 10, 2016.