A physical unclonable function (PUF) is an embedded integrated circuit (IC) structure that is designed to leverage naturally occurring variations to produce a random bitstring. In this paper, we evaluate a PUF which leverages resistance variations which occur in transmission gates (TGs) of ICs. We also investigate a novel on-chip technique for converting the voltage drops produced by TGs into a digital code, i.e., a voltage-to-digital converter (VDC). The analysis is carried out on data measured from chips subjected to temperature variations over the range of -40°C to +85°C and voltage variations of +/- 10% of the nominal supply voltage. The TG PUF and VDC produce high quality bitstrings that perform exceptionally well under statistical metrics including stability, randomness and uniqueness.

Variations in delay caused by within-die and die-to-die process variations and SOI history effect increase timing margins and reduce performance. In order to develop mitigation techniques to reduce the detrimental effects of delay variations, particularly those that occur within-die, new methods of measuring delay variations within actual products are needed. The data provided by such techniques can also be used for validating models, i.e., can assist with model-to-hardware correlation. In this paper, we propose a flush delay technique for measuring both regional delay variations and SOI history effect and validate the method using a test structure fabricated in a 65 nm SOI process.

With advancing technology nodes, the feature sizes of transistors are scaled down aggressively and the effects of process variations on semiconductor device parameters are becoming worse. Accurate device level statistical models are necessary to understand the composite effect of process variations on IC performance. Statistical models require a large amount of data from measurements made on wafers with test structures and product chips. High precision DC parametric measurements form a key component to understanding the device level process interactions. One important aspect of DC parametric measurements is the ability to accurately measure currents ranging from pico-amperes for leakage characterization to milli-amperes for transistor IV characterization. Sophisticated test equipment that meets the requirements of high accuracy and high throughput are needed for this purpose. In this paper we present a hybrid tester that addresses these requirements. The novel architecture presented here is scalable and truly parallel. The system is capable of measuring currents from pico-amperes to hundreds of milli-amperes and at the same time provide advanced digital test capabilities.

The level of security provided by digital rights management functions and cryptographic protocols depend heavily on the security of an embedded secret key. The current practice of embedding the key as digital data in the integrated circuit (IC) weakens these security protocols because the keys can be learned through attacks. Physical unclonable functions (PUFs) are a recent alternative to storing digital keys on the IC. A PUF leverages the inherent manufacturing variations of an IC to define a random function. Given environmental variations such as temperature and supply noise, PUF quality criteria such as reproducibility and the level of randomness in the responses may be difficult to achieve for a given PUF circuit architecture. In this paper, we evaluate a PUF derived from the power distribution system of an IC with regard to a set of quality metrics including single-bit and collision probability and entropy. The analysis is carried out using data obtained from 36 chips fabricated in IBM's 65 nm SOI technology.

Embedded test structures are increasingly being used to measure and analyze performance and power variations in product chips to better understand the impact of process variations. In this work, we propose a minimally-invasive, low-overhead technique for characterizing within-die and die-to-die leakage variation. The proposed technique leverages existing power control circuitry added by designers to reduce the power consumption of inactive functional units. We manipulate these `sleep islands' to isolate and measure their leakage current contribution to the chip-wide leakage current. The measured set of sleep island leakage currents reflect the leakage current variation across the chip at a coarse level of resolution. In order to improve resolution, we propose a multiple power supply port (MSP) measurement technique to provide `within-island' leakage current measurements. A calibration technique is described that corrects for differences between the sleep island and MSP approaches, effectively enabling the same information to be obtained using either technique. We demonstrate the techniques on a set of test chips fabricated in 65-nm SOI technology. The results show that leakage current variations across a small test structure array have both a locally random and globally deterministic component that can be accurately mapped using the sleep island or MSP approaches.

Hardware Trojans have emerged as a new threat to the security and trust of computing systems. Hardware Trojans are deliberate and malicious modifications to the logic function implemented within digital and mixed signal chips. In contrast to software Trojans, it is not possible to simply "scan the hard drive" to eradicate a hardware Trojan. Hardware Trojans can be designed to shutdown the chip at some predetermined time and/or when some specific signal or data pattern is received. They may also be designed to remain hidden while leaking confidential information covertly to the adversary. Determining whether a hardware Trojan has been inserted into a chip is extremely difficult for a variety of reasons, e.g., nanometer feature sizes and chip design complexity combine to make optical inspection difficult or impossible. This paper presents experimental results demonstrating the effectiveness of a Trojan detection method that is based on the analysis of a chip's Jddqs (steady-state current), which are measured simultaneously from multiple places on the chip. The proposed method also incorporates a technique for virtually eliminating process and test environment variations effects which act to reduce detection sensitivity of traditional testing approaches. Used together, resolution enhancements of up to a 1000 x are possible over conventional single power supply current measurement techniques. A regression-based statistical technique is applied to the data collected from a set of chips fabricated in a 65-nm process to illustrate the detection capabilities and limitations of this type of approach.

For hardware security applications, the availability of secret keys is a critical component for secure activation, IC authentication and for other important applications including encryption of communication channels and IP protection in FPGAs. The vulnerabilities of conventional keys derived from digital data can be mitigated if the keys are instead derived from the inherent statistical manufacturing variations of the IC. Robust silicon-derived keys are implemented using physically unclonable functions (PUFs). A PUF consists of a specialized hardware circuit and a mechanism to retrieve a set of responses under a variety of different challenges. In this paper, we propose a PUF that is based on the measured equivalent resistance variations in the power distribution system (PDS) of an IC. The effectiveness of the PUF is evaluated on twenty-four ICs fabricated in a 65 nm technology.

The importance of within-die process variation and its impact on product yield has increased significantly with scaling. Within-die variation is typically monitored by embedding characterization circuits in product chips. In this work, we propose a minimally-invasive, low-overhead technique for characterizing within-die variation. The proposed technique monitors within-die variation by measuring quiescent (IDDQ) currents at multiple power supply ports during wafer-probe test. We show that the spatially distributed nature of power ports enables spatial observation of process variation. We demonstrate our methodology on an experimental test-chip fabricated in 65-nm technology. The measurement results show that the IDDQ currents drawn by multiple power supply ports correlate very well with the variation trends introduced by state-dependent leakage patterns.

The power supply transient signal (I/sub DDT/) method that we propose for defect detection analyzes regional signal variations introduced by defects at a set of power supply pads on the chip under test (CUT). The method is based on the comparison of the CUT with chips that are known to be defect free. A set of defect free chips are analyzed to establish a statistical metric that distinguishes between defect effects and process variation (defect free) effects. This paper presents hardware results that demonstrate the effectiveness of a novel geometry based defect detection technique using nine copies of a test chip. Eight chips are used as defect free chips to derive the statistical limits. Emulated defects are provoked in the ninth chip to evaluate the defect detection capabilities of the method.