A Thesis Entitled Design of a Hardware Security PUF Immune to Machine Learning Attacks By Nitin K. Pundir Submitted to the Graduate Faculty as partial fulfillment of the requirements for the Master of Science Degree in Electrical Engineering ________________________________________ Dr. Mohammed Niamat, Committee Chair ________________________________________ Dr. Mansoor Alam, Committee Member ________________________________________ Dr. Hong Wang, Committee Member ________________________________________ Dr. Amanda Bryant-Friedrich, Dean College of Graduate Studies The University of Toledo December 2017 Copyright 2017, Nitin K. Pundir This document is copyrighted material. Under copyright law, no parts of this document may be reproduced without the expressed permission of the author. An Abstract of Design of a Hardware Security PUF Immune to Machine Learning Attacks By Nitin K. Pundir Submitted to the Graduate Faculty as partial fulfillment of the requirements for the Master of Science Degree in Electrical Engineering The University of Toledo December 2017 The technology and cyberspace sector is losing billions each year to hardware security threats. The incidents of usage of counterfeiting chips are doubling each year. The Electronic Resellers Association International (ERAI) reported that in the year 2011 more than 1300 counterfeits were reported. The incidents were double of what were reported in 2008. The report from Federal Contracts acknowledges the threats emanating from counterfeit chips and says it threatens the successful operations of US Weapon Systems. Meanwhile, electronic counterfeiting of chips continues to be a very profitable business on the dark web by crooked operatives. Physical Unclonable Functions (PUFs) are emerging as hardware security primitives to deal with security issues such as cloning, hacking, copying, and detection of Trojans. PUFs are one-way physical structures embedded in chips to generate a unique signature for each chip. The well-known silicon-based PUFs are Arbiter PUF (APUF) and Ring Oscillator PUF (ROPUF). The PUF uses timing delays caused by manufacturing process variations to generate challenge-response pairs (CRPs) unique to each chip. APUFs and ROPUFs are observed to be vulnerable to modeling attacks. iii In this research, a novel hybrid PUF is proposed which is a combination of both types of delay based PUFs, to generate strong cryptographic keys. The proposed design uses the CRPs of APUF and ROs of ROPUF to generate an n-bit response corresponding to an n-bit challenge, whereas primitive PUFs generate a 1-bit response for an n-bit challenge. The CRPs produced using the proposed PUF are unique and random and can be considered as cryptographic keys. The experimental results show that the uniqueness of APUF and ROPUF CRPs increase by 23% and 19%, respectively; when applied through the proposed scheme. The average passing rate for randomness is observed to be 97%. The CRPs generated from the delay based PUFs are tested against machine learning attacks. The machine learning attacks are carried out considering different scenarios where the adversary has access to 50%, 70%, 80%, and 90% of the CRPs. The models are trained for four different best-optimizing algorithms: Adagrad, Adadelta, SGD, and NAdam. The results show that even after training for the same number of epochs, the average accuracy for the proposed PUF model is 7% compared to 56% and 72% of APUF and ROPUF, respectively. The lower prediction accuracy of the proposed PUF shows that CRPs generated from the proposed scheme are far more immune to machine learning attacks when compared to other delay based PUFs. iv I would like to dedicate this thesis to my father who always motivated me to succeed whenever I felt low on the journey. Acknowledgements This journey would have been difficult without the support of my family, my advisor, professors, and friends. Firstly, I would like to thank my advisor Dr. Mohammed Niamat for providing me an opportunity to conduct my Master's research under him and for continued support and guidance. My sincere thanks to Dr. Mansoor Alam and Dr. Hong Wang for being a part of my thesis committee. Financial support from the EECS chair head Dr. Mansoor Alam is also greatly acknowledged. I would also like to thank my lab mates for their guidance and help. I would like to thank my parents, my entire family, and friends for their constant love, support, understanding, encouragement, and motivation that made this thesis possible. v Table of Contents Abstract ............................................................................................................................. iii Acknowledgements ........................................................................................................... v Table of Contents ............................................................................................................. vi List of Tables .................................................................................................................... xi List of Figures .................................................................................................................. xii List of Abbreviations ..................................................................................................... xvi List of Symbols ............................................................................................................. xviii 1 Introduction and Research Overview ................................................................. 1 1.1. Introduction ................................................................................................. 1 1.2. Architecture of FPGA ................................................................................. 4 1.2.1. Configurable Logic Blocks ............................................................ 6 1.2.2. Input-Output Blocks ....................................................................... 6 1.2.3. Programmable Interconnect Network ............................................ 6 1.2.4. Architecture of Spartan 3e .............................................................. 7 1.3. Smart Meter ................................................................................................ 8 1.3.1. Evolution of Smart Meters ............................................................. 8 1.3.1.1. Electromechanical Meter ................................................. 8 1.3.1.2. Electronic Meter .............................................................. 9 1.3.1.3. Smart Meter ................................................................... 10 1.4. Security Issues Related to FPGA and Smart Meters ................................ 13 vi 1.4.1. Reverse Engineering .................................................................... 13 1.4.2. Overbuilding ................................................................................. 14 1.4.3. Cloning ......................................................................................... 14 1.4.4. Physical Tampering ...................................................................... 15 1.5. Goals of the Thesis.................................................................................... 15 1.6. Thesis Organization .................................................................................. 16 2 Basic Definitions and Terminologies ................................................................. 17 2.1. Physical Unclonable Functions ................................................................. 17 2.2. Hardware-Oriented Security ..................................................................... 18 2.3. Manufacturing Process Variation ............................................................. 18 2.4. Randomness .............................................................................................. 19 2.5. Uniqueness ................................................................................................ 19 2.6. Hamming Distance .................................................................................... 19 2.7. Random Number Generator ...................................................................... 20 2.8. Pseudo Random Number Generator ......................................................... 21 3 Physical Unclonable Functions .......................................................................... 22 3.1. PUF Classification .................................................................................... 23 3.1.1. Non-Electric PUF ......................................................................... 23 3.1.1.1. Optical PUF ................................................................... 23 3.1.1.2. Paper PUF ..................................................................... 24 3.1.1.3. CD PUF ......................................................................... 25 3.1.1.4. RF DNA PUF ................................................................ 25 3.1.1.5. Magnetic PUF ............................................................... 25 vii 3.1.1.6. Acoustical PUF ............................................................. 25 3.1.2. Analog Electric PUF .................................................................... 26 3.1.2.1. VT PUF .......................................................................... 26 3.1.2.2. Power Distribution PUF ................................................ 26 3.1.2.3. Coating PUF .................................................................. 26