# 1

Hardware security Final presentation

RRAM PUF design

Speaker: 邱硯晟、洪哲民、王子瑜、魏胤皓

Date: 2020/01/13

# 2

Outline

❑ Introduction

• NVM & PUF

❑ Proposed NVM PUF scheme

• Reference paper

• High level mechanism

• Circuit & simulation environment

❑ Simulation result

❑ Discuss and conclusion

# 3

Non Volatile Memory

❑ Using different resistance

❑ Giving Vread to sense I (Current type sensing)

Top

Electrode

Bottom

Electrode

# 4

Non Volatile Memory

# 5

Non Volatile Memory - RRAM

# 6

Non Volatile Memory - RRAM

# 7

PUF

❑ Intra Hamming Distance(Robust):同一晶片，同溫同電壓，同Challenge，同Response。

❑ Ideal:0%

❑ Inter Hamming Distance(Uniqueness):不同晶片，同溫同電壓，同challenge，不同Response。

❑ Ideal:50%

# 8

Outline

❑ Introduction

• NVM & PUF

❑ Proposed NVM PUF scheme

• Reference paper

• High level mechanism

• Circuit & simulation environment

❑ Simulation result

❑ Discuss and conclusion

# 9

RRAM Reference paper (1/3): 2016 VLSI

❑ Entropy source: RRAM Sensing time variation (RC discharge)

❑ PUF unit: 1 Transistor and 1 RRAM cell as a unit

# 10

RRAM Reference paper (1/3): 2016 VLSI

❑ Circuit: Amplifier + counter + memory cell

❑ Waveform (2 phase): Pre-charge phase+ sensing phase

CLK count >TH →0, <TH→ 1

# 11

RRAM Reference paper (2/3): 2019 ISSCC❑ Entropy source: RRAM HRS resistance variation

❑ PUF unit: 2 transistor and 2 RRAM cell as a unit

# 12

RRAM Reference paper (2/3): 2019 ISSCC

❑ Circuit: PUF/ Differential Array + Sense amplifier + Control

❑ Flow: Sense 2 HRS first → Split 1 LRS 1 HRS

# 13

RRAM Reference paper (3/3): 2019 ASSCC

❑ Entropy source: RRAM write time variation

❑ PUF unit: 2 transistor and 2 RRAM cell as a unit

# 14

RRAM Reference paper (3/3): 2019 ASSCC

❑ Circuit: RRAM array + write termination

❑ Waveform: Write first→ Detect → Terminate if write success

# 15

RRAM cell PUF

❑ Compare the cell resistance of RRAM cell

❑ Entropy source : resistance variation in RRAM cell

PUF

WL WL

SL1SL0

BL1BL0

PUF PUF_B

# 16

RRAM cell PUF

❑ ReRAM cell resistance distribution

[33]

# 17

RRAM cell PUF

WL

driver

Time

Ctrl

YMUX

I/O

WL WL

SL1SL0

BL1BL0

PUF PUF_B

WL WL

SL1SL0

BL1BL0

PUF PUF_B

WL WL

SL1SL0

BL1BL0

PUF PUF_B

Memory Array

…

PUF code

Sense Amplifier to

read out PUF code

# 18

RRAM Sense amplifier

PRE PRE

SAEN

P1

N1 N2

P2

Q QB

Icell Iref

VCLP VCLP

VDD

N3 N4N5 N6

BL RBL

YSEL YSEL

DOUT

❑ Conventional current type sense amplifier

# 19

Sense amplifier & PUF code

❑ Use Sense amplifier to read out PUF code

WL WL

SL1SL0

BL1BL0

PUF PUF_B

PRE PRE

SAEN

P1

N1 N2

P2

Q QB

Icell Iref

VCLP VCLP

VDD

N3 N4N5 N6

BL RBL

YSEL YSEL

DOUT

# 20

Outline

❑ Introduction

• NVM & PUF

❑ Proposed NVM PUF scheme

• Reference paper

• High level mechanism

• Circuit & simulation environment

❑ Simulation result

❑ Discuss and conclusion

# 21

Circuit description

❑ Comparison the LRS of both memory cell to generate

1b PUF code.

# 22

Circuit description- Why HRS cell ?

❑ Compared to LRS cell resistance, HRS cell resistance

has wider resistance distribution

# 23

Circuit description- Block diagram

# 24

Circuit description- RRAM cell

# 25

Circuit description- Critical path

❑ We use 3𝜋 model simulate the BL loading (512 rows)

R Loading : 1500 ohm

C Loading : 78fF

# 26

Circuit description- CLSA❑ We use current type sense amplifier to transfer resistance

difference to digital value

# 27

Circuit description- CLSACore SA

NMOS clamping

# 28

Variation only applied on cell resistanceTemperature HW

-40 0.483398

-30 0.484375

-20 0.484375

-10 0.484375

0 0.485352

10 0.482422

20 0.484375

30 0.485352

40 0.484375

50 0.484375

60 0.484375

70 0.484375

80 0.484375

90 0.484375

100 0.484375

1024 case, TT corner

0.4

0.45

0.5

0.55

0.6

-40 -30 -20 -10 0 10 20 30 40 50 60 70 80 90 100

Hamming weight v.s. temperature (TT corner, 1024 case)

Hamming weight (HW) TT

# 29

Variation applied on cell resistance and NMOSTemperature HW

-40 0.520508

-30 0.521484

-20 0.520508

-10 0.521484

0 0.518555

10 0.520508

20 0.521484

30 0.521484

40 0.519531

50 0.519531

60 0.520508

70 0.521484

80 0.518555

90 0.519531

100 0.518555

1024 case, TT corner

0.4

0.45

0.5

0.55

0.6

-40 -30 -20 -10 0 10 20 30 40 50 60 70 80 90 100

Hamming weight v.s. temperature (TT corner, 1024 case)

Hamming weight (HW) TT

# 30

Variation applied on cell resistance and NMOS

0.4

0.45

0.5

0.55

0.6

FF_25 FF_-40 FF_125 FS_25 FS_-40 FS_125 SF_25 SF_-40 SF_125 SS_25 SS_-40 SS_125

Hamming weight v.s. Corner & Temperature (1024 case)

Hamming weight (HW)

# 31

0.4

0.45

0.5

0.55

0.6

FF_25 FF_-40 FF_125 FS_25 FS_-40 FS_125 SF_25 SF_-40 SF_125 SS_25 SS_-40 SS_125

Hamming weight v.s. Corner & Temperature (1024 case)

Hamming weight (HW)

Variation only applied on cell resistance

# 32

1bit

PUF1bit

PUF1bit

PUF

Hamming distance (HD)

1bit

PUF 1bit

PUF

X128

PUF key

Key length = 128bit

I use 128 same mechanism to generate a 128bit PUF key

# 33

(TT corner_25°C)

We generate 128 pairs of key (128 bits for each) → 1000 samples

Variation applied on cell resistance and NMOS

0

10

20

30

40

50

60

70

80

43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83

Hamming distance (HD)

# 34

We think that the large variation of RRAM resistance dominates the

PUF property, so all the corners and temperature looks the same.

0

10

20

30

40

50

60

70

80

43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83

Hamming distance (HD)(TT corner_25°C)

# 35

0

10

20

30

40

50

60

70

80

45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79

Hamming distance (HD)(TT corner_-40°C)

# 36

0

10

20

30

40

50

60

70

80

39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85

Hamming distance (HD)(TT corner_125°C)

# 37

Hamming distance (HD)

0

10

20

30

40

50

60

70

80

39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85

TT_125 °C

TT_25 °C

TT_-40 °C

# 38

Discuss and conclusion

❑ Implement PUF by comparing 2T2R RRAM resistance

❑ Cell variation dominates the performance in this case

❑ Corner and temperature impact small, we think that:

• The circuit is too simple

• We use ideal RRAM model, which ignoring some non-ideal

feature

• Maybe corner and temperature impact HD,HW less, BER and

stability more.

# 39

Reference

❑ http://www.ndl.org.tw/docs/publication/22_4/pdf/D2.pdf

❑ http://www.ndl.org.tw/docs/publication/22_4/pdf/D1.pdf

❑ https://zhuanlan.zhihu.com/p/35152668