Experimental Study of Locking Phenomena on Oscillating Rings Implemented in Logic Devices

Abstract

Oscillating rings are widely used in CMOS logic devices because they are easy to integrate, require low area and low power. Their main disadvantage is that they tend to lock to each other and/or to an external periodic signal. This locking phenomenon can render a system based on a freely running oscillator non-functional. A detailed study of the causes of the phenomenon and how to avoid it, is therefore of paramount importance. In this paper, we conduct a detailed examination of the locking phenomenon using the most commonly used rings: ring oscillators, transient effect ring oscillators and selftimed rings. We then analyze the consequences of locking on different use cases based on oscillating rings and provide design recommendations to minimize its impact. Our results could help designers better anticipate locking phenomenon in their future designs. To ensure reproducibility of the results, the VHDL code of all the experiments is available and can be downloaded from a dedicated web page. Index Terms-Free running oscillators, ring oscillator, transient effect ring oscillator, self-timed ring oscillator, locking phenomenon I. INTRODUCTION Electronic oscillators are key elements in many data processing applications. They are used in communication systems for radio and television signal modulation and demodulation or channel selection. They are also used in most digital circuits as a time reference for synchronizing operations or for serial data communication [1]. PLL based frequency synthesis and clock signal generation are also based on oscillators [2], [3]. In data security applications, oscillators serve as source of entropy for true random number generators (TRNGs) [4], [5] or physical unclonable functions (PUFs) [6], [7]. Ideally, electronic oscillator produces a perfect time reference (i.e. a periodic signal, often with a sine waveform or a square waveform). In practice, all types of oscillators are affected by perturbations and noises, and their output is not perfectly periodic. Numerous types of oscillator circuitries are available, but the principle of operation, the frequency stability and the robustness against variations in environmental conditions like supply voltage, temperature and electromagnetic interference are specific to each. The most commonly used are harmonic oscillators (i.

Attacking Hardware Random Number Generators in a Multi-Tenant Scenario

“…Locking the TRNG entropy source prevents random jitter from accumulating, thus reducing the entropy of the generated random bits. Mureddu et al previously showed in [16] that different types of oscillating rings, used in TRNGs, can lock to a signal injected by other circuitry in the FPGA fabric. The proposed attack additionally generates the injected signal on-chip, which removes the requirement for any external equipment.…”

“…2) Frequency matching approach: Since the lock-in range for a ring oscillator can be quite small, as was shown in [16], this second approach consists of injecting a signal with a frequency as close as possible to the natural frequency of the TRNG oscillator. The injected signal is generated by an oscillating ring that is identically designed to the targeted ring and placed at a carefully chosen location so that their frequencies are as similar as possible.…”

“…The injected signal is generated by an oscillating ring that is identically designed to the targeted ring and placed at a carefully chosen location so that their frequencies are as similar as possible. Equivalent to the method used in [16], this injected oscillating signal is brought in close to the targeted ring using delay lines, implemented in proximity of the TRNG. This method provides more freedom to choose a suitable location for the attacker ring oscillator to generate the injected signal.…”

Physical Security of Ring-based PUF

“…Recently Mureddu et al proven that the digital oscillating cells, including RO and TERO, are sensitive to the locking phenomenon [6]. The attacker can also use this sensitivity to cause denial-of-service of ring-based PUF.…”

Behavioral Analysis and Immunity Design of the RO-Based TRNG under Electromagnetic Interference

“…ROs in the above papers also were not composed of complementary metal-oxide semiconductors (CMOS). Mureddu et al [16] built RO circuits on an FPGA board and injected interference coupled from a delay line. Detailed experiments were carried out on different series of FPGAs.…”