Chip Fingerprinting

February 28, 2011

Counterfeiting applies to more than just currency. Products are counterfeited, also. The downside of a counterfeited handbag is small. The purchaser may have a less useful life from the product, the company that manufactures the genuine handbag losses money on the sale, and it may get a slightly tarnished reputation. When the product is something like an automotive airbag, counterfeiting can have more severe consequences. Automotive airbags are expensive replacement items, so it's no wonder that counterfeits have appeared on the replacement market. I was once involved in an effort to develop a security device that would detect whether the airbag in a system was genuine. I had some ideas for inexpensive sensors, but a development program wasn't funded.

The downside of a counterfeit integrated circuit can be quite significant. Electronic circuitry are built into myriad medical devices, military systems, aircraft and automobiles, not to mention billion dollar communications satellites. IC counterfeiting is typically an easy process. The silicon chip is always buried in its molded epoxy package, so the only identification is the external package marking. The counterfeiter just needs to remove the marking from a similarly shaped package and apply a new marking.

The remarking might make it appear that the chip functions at a higher speed or over a wider temperature range. The package might contain a similar chip from a different vendor remarked with another vendor's trademark. In the case of digital circuitry, this is a problem when the designer has relied on timing specifications for the originally specified chip. It might be that the package is empty inside and completely non-functional. This is actually not the worst-case scenario, because then the problem is detected before the product is in use.[1-2]

The Semiconductor Industry Association, the trade association representing the US semiconductor industry, has been working against chip counterfeiting for many years along with the World Semiconductor Council (WSC), of which it is a part. A WSC statement in 2008 revealed that a three week enforcement effort had seized 360,000 counterfeit ICs bearing over 40 different trademarks.[1] It would be nice if those hidden pieces of silicon could contain a tamper-proof identification code; a fingerprint, so to speak.

Fingerprint image by Wilfredo Rodríguez via Wikimedia Commons. IC photograph by author.

That's precisely what a team at the Fraunhofer Institute for Secure Information Technology, Garching, Germany, has done by using a component's particular material properties to construct a digital key. The chip fingerprinting method relies on a correspondence between the digital key and a material property of the silicon circuit that is not easily copied. Fraunhofer researchers will be presenting a prototype of their fingerprinting concept at the Embedded World Exhibition & Conference (Nuremberg, Germany), March 1-3, 2011.

Although process engineers try to make every integrated circuit chip the same, there are inevitable small differences from chip-to-chip for things like metalization widths and thickness, the dimensions of other feature sizes, and local dopant levels. These deviations translate into slight differences in transistor gain and frequency response. The Fraunhofer Institute researchers add a small additional circuit to each chip that they call a physically unclonable function (PUF); for example, a ring oscillator. The frequency of a ring oscillator is very sensitive to the properties of its transistors, so what you get is a different frequency for each chip. You have a fingerprint for the chip that would be extremely hard to set to another value.

A ring oscillator built from three inverters (via Wikimedia Commons).

The Fraunhofer Institute group also developed a "butterfly" physically unclonable function, but there's no description of this implementation.

To my knowledge, I've never been plagued by a counterfeit integrated circuit, but even hobbyists should beware. Last year, SparkFun Electronics, a popular internet component source for electronic and computer hobbyists, had an experience with a counterfeit batch of microcontrollers. The chips contained in the epoxy packages weren't even microcontrollers! They were controllers for use in buck converters, a type of DC power supply. SparkFun Electronics has posted on the internet its detective work on these counterfeit ICs, and it makes interesting reading.[4]

References:

1. Semiconductor Industry Association, "Anticounterfeiting."
2. Daryl Hatano, "Stopping Semiconductor Counterfeiting," SEMICON West (San Francisco, California), July 15, 2009 (0.5 MB PDF File).
3. Fingerprint makes chips counterfeit-proof, Fraunhofer Institute Press Release, February 4, 2011.
4. Emcee Grady, "Revisiting the Counterfeit ATMega328s," SparkFun Electronics, May 17, 2010; follow up here.