The Answer to Non-Volatile Memory Security Issues at Advanced Nodes: Go Volatile!

By Pim Tuyls, Intrinsic ID

As semiconductor technology nodes continue to push into smaller and smaller geometries, a pattern has emerged: the basic semiconductor components that define the new node – gates, flip-flops, SRAM, etc. – are put in place with relative ease. However, below twenty-eight nm there have been serious challenges to scale Non-Volatile Memory (NVM) in the same way and at the same speed as the standard components. In particular, the development of flash memory has become very difficult and expensive if not impossible at advanced nodes, as discussed in an article recently published at semiengineering.com/non-volatile-memory-tradeoffs-intensify/. This is due to the fact that flash memory requires a lot of extra mask steps adding to the cost of the memory and hence the chip. Additionally, extra testing is required, such as baking the chip at high temperature to ensure it is not volatile and to guarantee that it has a sufficiently long lifetime.

No NVM = Security Issues at Advanced Nodes

According to Kerckhoff’s principle, the security of crypto engines, and hence of a chip, depends on the secrecy of the secret key that is used to guard those engines. If one cannot keep the secret key secret, there is no security no matter the sophistication of the encryption algorithm that is being used.

This fact that NVM development lags so far behind basic components in new nodes has a serious impact on the implementation of security in devices built in process nodes smaller than 28nm. NVM has, for some time, been a preferred storage mechanism for secret keys securing the chip and its communications. The reason for this is that the secret keys need to be permanently present on the chip such that the crypto engines, such as encryption, decryption and signing, can carry out their security operations. NVM has seemed to be a natural, on-chip storage mechanism.

However, there are two main problems with the approach of storing secrets in NVM, in particular in the smallest technology nodes. Firstly, as the only available NVM options for any node are relatively large, an attacker can use an electron-scanning microscope to look into the memories and get the secrets out. In this case, one can compare key storage in NVM to hiding the key of your house under the doormat. It could keep out the amateurs for some time, but it doesn’t help against the professionals.

Secondly, as we explained above, there is no high-quality NVM in the smallest nodes. Hence, there is no way to reliably store a secret key on the chip using the traditional NVM approach. No secret key, no security.

The problem of not having NVM available for security at advanced nodes is of particular urgency for companies developing devices for the internet of things (IoT), as IoT devices generally are both targeted at advanced nodes and have high security requirements because of their connectedness. So what is the solution?

A Volatile Solution: SRAM PUFs

Looking beyond general NVM for secret key storage, there are two other options: a special kind of NVM – one-time programmable (OTP) memory – and volatile memory, such as SRAM. OTP is available in small nodes. OTP memory usually refers to fuse or anti-fuse based technology. As far as fuse-based technology is concerned for the small nodes, the fuses being used are relatively large and are more and more difficult to keep reliable over time. On top of that, they require charge pumps, isolation cells and special programming equipment, as pointed out in the article previously cited. Those requirements have a significant impact on the size of fuse-based memory and hence on the cost and flexibility of the chip. Anti-fuse memory cells, on the other hand, are smaller but suffer from similar reliability and silicon-area disadvantages as fuses.

However, SRAM is a basic component of any given technology node, and presents a solid solution for security issues at advanced nodes. Physical Unclonable Functions (PUFs) enable the extraction of secret keys from the unique physical characteristics of a chip. One can think of this as using the biometrics of a chip to generate the secret keys. The most well-known, widespread, and reliable PUFs are volatile-memory-based PUFs such as those built on SRAM. SRAM PUFs have been deployed in the field in hundreds of millions of devices over more than a decade and are especially suited for implementation in the smallest nodes, even in five and seven nm. Since volatile memory PUFs do not require the storage of secret data, they solve the “doormat” problem. Since there are no secret data stored in the memories, there is no secret on the device when it is switched off. No secret data means attackers come up empty-handed.

Every digital chip has volatile memory such as SRAM on board. Therefore, SRAM PUFs can be implemented on virtually every device connected to the Internet. By enabling SRAM PUFs inside chips – which can be initiated through software at any point during the chip lifecycle – and integrating those PUFs with the crypto engines, a basic mechanism is in place to build a secure device. The SRAM PUF can provide the root of trust that forms the basis of several derived keys and can be used to wrap other keys from OEMs and even end-users. The wrapped keys protected by the SRAM PUF can be securely stored in cheap user memory off chip.

Volatile memory elements, such as SRAMs, which are basic components of any technology node, offer the most straight-forward, cost-effective and secure solutions for secret-key storage for chips targeted below 28nm. The flexibility of an SRAM PUF solution is especially valuable for IoT devices, which are connected to the internet and to other IoT devices. Every endpoint can be secured with a unique device key making the whole system more trustworthy.