Chip authentication using multi-domain intrinsic identifiers
Embodiments of the present invention provide a chip authentication system using multi-domain intrinsic identifiers. Multiple intrinsic identifiers taken from multiple domains (areas or sections of the chip) are compared against the intrinsic identifiers collected during the manufacture of the chip. If at least one intrinsic identifier matches those collected during manufacture, the chip may be designated as authentic.
1. A method for authenticating an integrated circuit chip, comprising:
establishing multiple domains for the chip;
recording at least one identification string from each of a first subset of domains from the multiple domains of the chip during manufacture of the chip, wherein the first subset comprises at least two domains;
receiving a second subset of identification strings from at least two domains of the chip during an authentication attempt, wherein the second subset of the identification strings is a subset of the first subset of identification strings;
comparing the second subset of the received identification strings with the recorded identification strings; and
designating the chip as authentic in response to a third subset of the received identification strings matching recorded identification strings, wherein the third subset of the identification strings is a subset of the second subset of identification strings.
2. The method of claim 1 , wherein recording at least one identification string from each domain of the chip during manufacture of the chip comprises recording identification strings derived from an intrinsic physical property of the chip.
3. The method of claim 2 , wherein recording identification strings derived from an intrinsic physical property of the chip comprises recording identification strings derived from a retention bitmap.
4. The method of claim 3 , wherein recording identification strings derived from a retention bitmap comprises inverting logical values of the retention bitmap.
5. The method of claim 3 wherein recording identification strings derived from a retention bitmap comprises recording a lower bound retention bitmap and an upper bound retention bitmap for each domain.
6. The method of claim 3 , wherein recording identification strings derived from a retention bitmap comprises recording an encrypted identification string.
7. The method of claim 1 , wherein establishing multiple domains for the chip comprises establishing multiple domains of at least two different sizes.
8. The method of claim 3 , wherein recording identification strings derived from a retention bitmap comprises:
processing each of the identification strings with a one-way hash function to derive a hash value for each of the identification strings; and
recording each hash value.
9. The method of claim 1 , wherein designating the chip as authentic comprises matching exactly one received identification string with a recorded identification string.
10. The method of claim 1 , wherein designating the chip as authentic comprises matching two to ten received identification strings with recorded identification strings.
11. The method of claim 1 , further comprising designating the chip as inauthentic in response to receiving the same set of identification strings in two consecutive authentication attempts.
12. A method for generating authentication information for a chip, comprising:
generating at least one retention bitmap for a plurality of domains of the chip; and
creating an identification string for each generated retention bitmap.
13. The method of claim 12 , further comprising:
generating a lower bound retention bitmap and an upper bound retention bitmap for each domain.
14. The method of claim 12 , wherein establishing multiple domains for the chip comprises storing a location designator for each domain.
15. The method of claim 12 , wherein creating an identification string for each generated retention bitmap comprises inverting logical values of the generated retention bitmap.
16. The method of claim 12 , further comprising transmitting at least one identification string for at least two domains, wherein the at least two domains are selected randomly.
17. The method of claim 12 , further comprising:
sending an authentication request to a manufacturing authenticating system;
receiving a challenge response from the manufacturing authenticating system, wherein the challenge response contains an error count range;
selecting domains that correspond to retention bitmaps having error counts within the error count range; and
transmitting identification strings corresponding to the retention bitmaps of the selected domains.
18. A chip authentication system, comprising:
a chip, the chip comprising a testing interface;
a chip tester, the chip tester configured and disposed to communicate with the chip via the testing interface, wherein the chip tester further comprises a network interface;
a manufacturing authenticating system, wherein the manufacturing authenticating system comprises a network interface;
a processor;
a non-transitory memory, wherein the processor is configured to access the non-transitory memory, wherein the non-transitory memory contains instructions, and that when executed by the processor, perform the steps of:
establishing multiple domains for the chip;
recording at least one identification string from each of a first subset of domains from the multiple domains of the chip during manufacture of the chip, wherein the first subset comprises at least two domains;
receiving a second subset of identification strings from at least tow domains of the chip during an authentication attempt, wherein the second subset of the identification strings is a subset of the first subset of identification strings;
comparing the second subset of the received identification strings with the recorded identification strings; and
designating the chip as authentic in response to a third subset of the received identification strings matching recorded identification strings, wherein the third subset of the identification strings is a subset of the second subset of identification strings.
19. The system of claim 18 , wherein the testing interface comprises a JTAG interface.
20. The system of claim 18 , wherein the chip tester and the manufacturing authenticating system are configured and disposed to communicate with each other via the Internet.