Reflective-Physically Unclonable Function based System for Anti-Counterfeiting Zur Erlangung des akademischen Grades eines DOKTOR-INGENIEURS von der Fakultät für Elektrotechnik und Informationstechnik des Karlsruher Institut für Technologie (KIT) genehmigte DISSERTATION von M.Sc. Harsha Umesh Babu geb. in: Bangalore Tag der mündlichen Prüfung: 10. Dezember 2013 Hauptreferent: Prof. Dr. rer. nat. Wilhelm Stork Korreferent: Prof. Dr. rer. nat. Cornelius Neumann Karlsruhe, den January 20, 2014 To my friends and family. Declaration I hereby declare that I wrote my doctoral dissertation on my own and that I have followed the regulations relating to good scientific practice of the Karlsruhe Institute of Technology (KIT) in its latest form. I have not used any unacknowledged sources or means and I have marked all references I used literally or by content. This work has not previously been presented in an identical or similar form to any other university or examination board. Karlsruhe, 12. November 2013 ——————————— Harsha Umesh Babu i Acknowledgments Although this appears at the beginning of the document, I would like to emphasize that it was written at the very end of this wonderful journey. The simple reason, for why I had put off writing this section is - I do not know how to appropriately express my gratitude to all the people who have helped me reach this stage in life. I do not want to sound obligatory in acknowledging the help and influence while at same time inadvertently forget mentioning names. I would like to express my sincere thanks to Prof. Wilhelm Stork and my master thesis supervisor Prof. K.-D. Müller-Glaser, for giving me the opportunity to pursue graduate studies at Institut für Technik der Informationsverarbeitung (ITIV). The German equivalent of a PhD Supervisor is ’Doktorvater’, and it lit- erally translates into ’Doctoral father’. Prof. Wilhelm Stork or Willy as he is known to everybody, is my ’Doktorvater’. His infectious philosophy towards learning and teaching - Man lernt fürs Leben has been constant source of encouragement over the years. I would like to explicitly thank him for the propitious working relationship, where I had the room for making my own mistakes and learning from them. My thanks to Prof. Cornelius Neumann for agreeing to be the co-referent and encouragement for the successful defence of my dissertation. The impact of colleagues cannot be understated. There have been many a times when work was not bearing fruit but the inspiration to keep going can be solely attributed to it is a joy to work with colleagues. Thanks to all my colleagues at ITIV, for your patience, encouragement and many times, for simply ’putting up’ with cranky me! A special mention to the ITIV-Optics members, for helping me with project reports, technical reviews, checking (and rechecking) my results and brainstorming everything under the sun! A substantial part of the work for my dissertation was done in co-operation with Informium AG, who were our industrial partners. Over the years and many visits to Leverkusen and Bergisch Gladbach, I have come to appreciate the efforts that go into creating a product from a mere technology. I wish acknowledge the help and co-operation that I have received from all the people at Informium. A part of my graduate studies were supported by Karlsruhe School of Optics and Photonics (KSOP). The concept of graduate studies supplemented with management modules and mentor has had a positive influence in my pursuit of PhD. Assistance and advice provided by KSOP is greatly appreciated and ac- knowledged. My parents underwent significant hardships and made sacrifices to their quality of life so as to enable me to receive a good education. This got translated into a me being taught by wonderful teachers throughout my academic life. I wish to thank my parents and all my teachers who have helped me reach this juncture in life. My friends, with whom I have studied, learned, worked, trekked, travelled, engaged in hobbies with, lived with (and currently living with) and shared life, have all endured me and encouraged me to come this far. Thank you all, and I hope I can express my returns in kind. Harsha January 2014 iii Abstract Product security techniques, in particular those targeting counterfeit goods, are under increased focus due to proliferation of supply and distribution chains across the world. Counterfeit goods are not restricted to specific product categories but pose problems across the board. In addition to loss of revenue, the usefulness of the product, functionality and safety are undermined by counterfeit products. A security technique that can be harmoniously applied across product categories as an anti-counterfeiting measure is explored in this dissertation. Physically unclonable functions (PUFs) are physical security mechanisms, which utilize inherent random- ness in processes used to instantiate physical objects. In this dissertation, an extensive overview of both, the state of the art in implementations and the accompanying literature dealing with definition and analysis is provided. Although this is a relatively new domain, one can find established methods and metrics that can be applied in analysis of PUFs. We review these, while presenting our priorities in the framework of anti-counterfeiting application. Focus on experimental verification of unclonability, is a marked difference in our approach when compared with other implementations and analyses in this domain. The concept of the reflective physically unclonable function (r-PUF) is presented as a product security solution. The viability of the concept, while evaluating and defining the requirements of such a system is explored. The evolution process of the system design is elaborated, which allows for understanding of the compromises that were reached. The anti-counterfeiting system is a combination of physical modules –instantiation, registration, verification and software modules –data extraction, algorithms for processing the data and application layers to provide functionality. During the dissertation, end-to-end functionality of an anti-counterfeiting system using r-PUF was verified. The system variables in the r-PUF instantiation process were identified and their influence in the system was studied. Experiments were designed to understand the impact of individual variables and results were analysed. We were able to conclusively prove the unclonability of r-PUFs in an anti-counterfeiting scenario. v Zusammenfassung Methoden zur Produktsicherheit, besonders diejenigen die auf die Unterbindung von Produktfälschungen abzielen werden zunehmend wichtiger, da die Versorgungs- und Verteilungsketten weltweit wachsen. Das Problem der Produktfälschung existiert nicht nur in einigen wenigen Produktkategorien sondern über alle Produktbereiche hinweg. Es gefährdet die unternehmerischen Gewinne, den Produktnutzen und die Sicher- heit für den Anwender. Eine Technik welche einfach für alle Produktgruppen verwendet werden kann um dies zu unterbinden wird im Rahmen dieser Doktorarbeit untersucht. Physically unclonable functions (PUFs) sind physikalische Sicherheitsmechanismen, welche Zufallskomponenten ausnutzen, die prozessin- härent ohnehin auftreten. In Rahmen dieser Dissertation wird ein umfassender Überblick über den Stand der Technik im Bereich der Implementierung und die zugehörigen Definitionen und Analysen gegeben. Obwohl dies ein recht neuer Forschungsbereich ist, gibt es bereits etablierte Methoden und Beurteilungskriterien welche für die PUF Analyse verwendet werden. Diese werden vorgestellt und die relevanten Punkte für das Umfeld der Produktfälschung herausgearbeitet. Der Fokus liegt dabei auf der experimentellen Verifizierung der Nicht- Reproduzierbarkeit, was die vorliegende Arbeit zu anderen Implementierungen und Analysen in diesem Bereich abgrenzt. Das Problem der Produktsicherheit wird dann unter Verwendung einer konkreten Implementierungsop- tion, der reflektierenden PUFs (r-PuFs), gelöst. Dafür wird zuerst die Machbarkeit dieses Konzepts unter- sucht indem die Rahmenbedingungen für ein System festgelegt und Anforderungen abgeleitet werden. Die Systemanforderungen während des Entwicklungsprozesses werden dabei schrittweise beschrieben und die entsprechend resultierenden Designparameter diskutiert. Anschließend wird das Konzept in einen Labo- raufbau umgesetzt. Es besteht dabei aus physikalischen Teilen sowie der zugehörige Software. Ersteres umfasst die Instanziierung, Registrierung und Verifizierung, während letzteres die Datenextraktion, Algo- rithmen zur Datenprozessierung und die Anwendungsschicht umfasst.Innerhalb dieser Arbeit wurde damit die End-to-End Funktionalität eines Systems zur Produktsicherheit unter Verwendung der r-PUFs verifiziert. Die Systemvariablen im r-PUF Instanziierungs-Prozess wurden identifiziert und deren Einfluss auf das System untersucht. Es wurden Experimente geplant und durchgeführt welche den Einfluss der einzelnen Variablen auf die Ergebnisse untersuchen. Außerdem war es möglich die Fälschungssicherheit dieser r- PUFs in tatsächlichen Produktsicherheitsszenarien zu beweisen. vii Contents 1 Introduction ............................................. 1 1.1 Motivation ........................................... 3 1.2 Research objective ...................................... 4 1.3 Layout of the dissertation ................................... 5 2 PUF: Concepts and Denitions .................................. 7 2.1 One way functions ....................................... 7 2.1.1 Algorithmic OWF ..................................