Design Impedance Mismatch Physical Unclonable Functions for IoT Security

,


Introduction
The Internet of Things is a dynamic living entity, which enables things to exchange information and communication through the networking of physical terminal devices, humans, intelligent buildings, and others [1,2].The IoT improves efficiency, accuracy, and economic benefit but is also potentially a huge security risk.Some reports predict that it will spend $547 million on IoT security in 2018 and will involve more than 25% of identified attacks on enterprises by 2020 [3].Some possible IoT threats are outlined in Figure 1.
According to [4], IoT weakness is so ubiquitous that industrial espionages find it easy to get a good target for attacking.And also, privacy is the other important area of concern.The cybercriminals may recover the personal information, which is potentially residing on IoT networks.In addition, as more and more objects interconnect to today's IoT networks, the physical security of each device is greatly reduced.Attackers could add all kinds of risk scenarios to control systems or change functionality, such as reading, intercepting, or changing the data [5].To address these problems, there are some methods to increase security for IoT network with the help of security tools, such as identification (ID) authentication, data encryption/decryption, and code obfuscation.
To build a secure and safe IoT, it is very important that the identity of each thing is authenticated.That is a massive challenge, but fortunately there is a way to take full advantage of each thing's unique identifier through Physically Unclonable Function (PUF) technology [6,7].PUF generates a unique identifier by exploiting random physical factors introduced in the semiconductor manufacturing process.PUF circuit has the properties of uniqueness, randomness, and unclonability [8][9][10][11][12].The above features make the PUF circuit an effective defense against intrusion attacks, including a variety of attack patterns.Printed circuit board (PCB) is one of the important hardware carriers of IoT.In the supply chain of PCB, malicious users may make counterfeit PCB come from a variety of sources, such as direct cloning, overproduction, and recycling.In fact, the quality of imitation PCB is poor, such as reliability and performance problems.With the proliferation of fake PCBs and the increase in accidental reports, the problems of the board-level feature recognition technique are becoming more and more important.In this work, we propose an impedance mismatch PUF, which has been exploited to generate a security unique private key to authenticate each thing in an IoT network.According to the characteristic of transmission line and signal transmission theory, the impedance mismatch will cause the transmission signal to   reflect, especially in high-frequency scenarios.The proposed PUF circuit will improve the board-level security of IoT.
This paper is organized as follows: The existing Physically Unclonable Functions circuits are summarized in Section 2. The impedance mismatch effect of transmission line is detailed in Section 3. The designed method of PUF for IoT security is proposed in Section 4. Some experimental results are analyzed in Section 5.This work is concluded in Section 6.

Physically Unclonable Functions
SRAM PUF [8,9] and Arbiter PUF [11-13, 15, 16] are two kinds of typical PUF circuit.SRAM-PUF circuits are produced through the manufacturing process, which introduces a biased digital signal in an integrated circuit.As shown in Figure 2, the SRAM-PUF cell consists of cross coupled inverters and T1 and T2 transmission transistors.SRAM-PUF circuit cells generate a logic level, which is determined by random process deviation threshold  th of the cross coupled inverters.The function relation of SRAM-PUF circuit is easy to affect through the power supply voltage, temperature, aging, and other factors [10].The output value has stability problems.
The arbiter PUF circuit [11-13, 15, 16] is composed of a delay unit and an arbiter circuit, as shown in Figure 2. The delay unit is composed of two delay paths and switch components.When the left input of the circuit experiences a low level to high level signal rise, the input signal will be conveyed along two paths, each after a data selector signal making two kinds of path selection, as dictated by the control signal   .If there are  data selectors, this is a signal with 2  different transmission modes.If the differences in signal transmission to the arbiter through the two delay paths have a time difference, the upper end of the output signal end of a data selector first will output a signal arbiter "1."Otherwise, the output signal of the arbiter is "0."Therefore, the output signal of the arbitrator is determined by the priority arrived signal.The arbiter PUF circuit recognizes model attacks [17,18].

Impedance Mismatch Effect
The definition of characteristic impedance is the ratio of voltage amplitudes and current value on the transmission line.The most important physical factors of characteristic impedance are geometry and materials of the transmission line.It is not dependent on length of transmission line.Under the condition of matching with the load impedance, the signal on transmission line transmits long distant without reflection [19].If the impedance of transmission line mismatches with the load impedance, it will transmit loss and produce reflection.Impedance mismatch phenomenon means that the impedance of transmission line is different from the characteristic impedance, and transmission signal will be reflected to the opposite direction [20].If the impedance of transmission line matches with the load impedance, the voltage signal generates positive reflection, and current signal generates negative reflection [21].On the other hand, when the load impedance is smaller than the characteristic impedance, the voltage signal generates negative reflection, and the current signal generates positive reflection.There are two types of transmission lines on the PCB board, Microstrip and Stripline (as shown in Figure 3).The impedance calculation formula of Microstrip is shown as follows [22]: Among them,  is the characteristic impedance,   is the relative permittivity, ℎ is the medium wire thickness (mil),  is the wire width (mil), and  is the thickness of the wire (1 oz = 1.5 mil).In (1), relative permittivity   is between 1 and 15; ratio of /ℎ is between 1 and 15; the width of the ground wire is more than 7 times the width of the signal line.The impedance calculation formula of Stripline is shown as follows [23]: In ( 2),  ≈ ℎ < 0.35; relative permittivity   is between 1 and 15; the width of the ground wire is more than 7 times the width of the signal line.From formulas (1) and ( 2), it is known that the width, thickness, and dielectric constant determine the impedance.Reference [24] shows that the length of the wire, the thickness of the pad, the path of the ground wire, and other nearby wires will also affect the characteristic impedance of the transmission line, especially in high-speed data transmission.
The cut-off frequency calculation formula is shown as follows [25]: where  and  represent the PCB's equivalent resistance and capacitance, respectively.According to (3), the cut-off frequency does not relate to input signal and power supply.
On transmission line of PCB, reflection caused by impedance mismatch may happen.The more the transmission signal reflects, the weaker the output signal is [26].In experimental testing, the cut-off frequency is described as specific operational frequency that causes the output signal amplitude to reduce 0.707-fold [25].So, the characteristic impedance  and  0 influence the cut-off frequency of PCB.

Proposed Impedance Mismatch PUF Circuit
Comparing the deviation signals present in the same structure, a PUF circuit generates random output response.In PCB circuit, there are random physical factors that affect output signal amplitude, frequency, and bandwidth [27].The random physical factors can be divided into two categories.The first category is in the integrated circuit, which is produced by the chip fabrication process, such as the ratio of channel width to length, and the threshold voltage.The second is the PCB layout of the processing device, such as the length and the width of wires, capacitors, resistors, and other factors [28].Thus, the intrinsic characteristics of the PCB may establish a unique and robust fingerprint in these scenarios.[29].In Figure 6, the class current conveyors are  1 ∼

Digital Sample Circuit and Output Circuit.
As shown in Figure 7, the digital sample circuit consists of a frequency divider, a  flip-flop, two AND gates, two counters, and a comparator.Two input signal frequencies  1 and  2 serve as the upper cut-off of the output of two transmission lines, respectively.The frequency  1 , though frequency divider, generates a gate control signal TC.During the clock pulse width (named ),  1 and  2 behave as two counter clock frequencies.Counter 1 counts the number of  1 , and Counter 2 counts the number of  2 .Comparing  1 and  2 , if  1 >  2 , the output is "0"; otherwise the output is "1."The output circuit comprises  output units.Each output unit comprises a latch and First Input First Output (FIFO) circuit, as shown in Figure 7.

Experimental Results and Analysis
We used many pieces of IM-PUF PCB as designed to measure the upper cut-off frequency in different situations.Figure 8 shows the experiment setup for the IM-PUF measurements.
The test platform mainly includes tested PCB board, two MOTECH LPS-305 DC Power Supplies (5 V), SP1461 Type II 300 M Signal Generator, Tektronix MDO3022 200 MHz Oscilloscope, and some wires.The flow of the experimental measurement is summarized as follows.Four steps are needed in total.
Step 1.Under the peak-to-peak value of 20 mV of the sine wave, measure the voltage amplification values on the original PCB with different frequencies.Step 2. If the frequency is less than 60 MHz, the output of RMS voltage is about 130 mV.
Step 3. As input frequency increases, voltage values begin to decay.
Step 4. Determine the upper cut-off frequency voltage value as 0.707 times the middle frequency, namely, 91.91 mV; the upper cut-off frequency is 85.6 MHz.
After that, change the length and width of the PUF circuit transmission line, with 7 cm thin wire, 14 cm thin wire, 7 cm thick wire, and 14 cm thick wire in the original circuit on a transmission line.The deviation of 5% more or less than the component's performance shall be allowed, and the fluctuation range of 1 V more or less than power supply shall be allowed.Measure the upper cut-off frequency at 85.5 MHz, 80.4 MHz, 86.5 MHz, and 80.9 MHz.Experimental measurement data is shown in Figure 9.The frequency curve of PUF obviously changed after changing its transmission line.After changing length and width of the transmission line, its frequency changed accordingly.Given the 6 V and 5 V power supply, the cut-off frequencies have nearly equal values with values lower than 100 MHz, as shown in Figure 10.The frequency of the output signal serves as a trigger for a counter.Then, comparing the outputs of counters, the IM-PUF produces a value of 0 or 1.
In statistics, autocorrelation is defined as the correlation among values of random process [30].In this work, the hypothesis behind calculation of the autocorrelation is that IM-PUF is a random process.Because IM-PUF is designed according to random variation during PCB manufacturing process, the proposed hypothesis is ok.In other words, the autocorrelation can be used to characterize the performance of antianalysis attack.In the experiment, the sample data of 1# PCB is set as a reference.Figure 11 shows the autocorrelation rates of the IM-PUF circuit.As can be seen, the autocorrelation of the proposed PUF circuit fluctuates between −0.3 and 0.3.The low autocorrelation rates mean that the PUF is resistant to correlation analysis.
The output data of IM-PUF is measured with 60 samples PCB.Recording this data, we use a hamming distance of the IM-PUF output to demonstrate the randomness characteristic.Figure 12 shows the hamming distance of the IM-PUF circuit.As can be seen, the distribution of hamming distance is consistent with standard normal distribution.The Normalized Standard Deviation () of IM-PUF is 0.0611, while the Normalized Standard Deviation of [31,32] is 0.0818 and 0.0627, respectively.This means the proposed PUF circuit has better randomness characteristic.1.Our design is the first reported in board-level PUFs that can read out an ID at each PCB.Because the variation of transmission line will lead to impedance mismatch and signal reflection, the high-frequency signal processing is very hard in board-level.The 100 M frequency of IM-PUF is closed to the best circuit about arbiter-based PUFs.The total number of possible IM-PUF data depends on the number of the transmission lines (2  ).There are so much possible transmission lines in PCB that it is feasible for an adversary to guess the output.And also, under a fixed input, the output data varies across different PCBs, because the IM-PUF responses are designed to be sensitive to circuit delays which are determined by process variation in wires.Since process variation is beyond the manufacturers' control, no one can physically clone the IM-PUF.So the impedance mismatch Physical Unclonable Functions eliminate the problems of a board-level physical feature recognition technique.

Conclusion
We proposed a new kind of PUF circuit design based on PCB.Imposing the impedance matching characteristic of highfrequency PCB circuit, changing length and width of the transmission line, causes the output of the upper cut-off frequency to be different.With this frequency as a counter clock frequency, the output produced by the deviation frequency circuit is different, and with the same time , the count value is also different.Due to the difference in count value, the comparison circuit would output a binary response signal.The function of this PUF on a PCB is unpredictable, so the security of the IoT will be improved.

4. 1 .
Impedance Mismatch PUF Model.According to the impedance mismatch theory and the PUF design method, we presented an impedance mismatch PUF (IM-PUF) model, as shown in Figure4.The model is composed of input

4. 2 .
Input Circuit and Deviation Generating Circuit.The input circuit and deviation generating circuit are shown in Figure5.The input circuit is composed of  flip-flops (DFF), NAND gates, and inverters, while the deviation generation circuit is composed of an operational amplifier (OPA847), transmission lines, and current feedback amplifier (CFA).The diagram of a current feedback amplifier is shown in Figure6

Figure 7 :
Figure 7: Digital sample circuit and output circuit.

Figure 8 :
Figure 8: The experiment setup for measuring IM-PUF.
8, the amplifier is  9 , the bias circuit is  11 and  12 , and the voltage follower is  13 and  14 .In Figure6,  3 is a 750-ohm OPA847 feedback resistor,  1 ,  2 ,  3 , and  4 are the decoupling capacitors of OPA847.R6 is a 560-ohm CFA feedback resistance;  5 ,  6 ,  7 , and  8 are the decoupling capacitors of CFA. 3 and  6 are used to set the amplification of the output signal. 1 ,  4 ,  7 , and  8 are used in the impedance matching.The amplitude and frequency of the output signal are determined by the process parameters.In this experiment, the deviation of the characteristic impedance of the transmission line makes the upper cut-off frequency of the output signal changed.The amplifier works as follows equation  =  × ( + Δ).It means that the deviation signal Δ is amplified  times.

Table 1 :
The comparison with other works.
Key characteristics of implemented PUFs are summarized in Table