Selected Bit-Line Current PUF: Implementation of Hardware Security Primitive Based on a Memristor Crossbar Array

In this paper, a physical unclonable function (PUF), a type of hardware security device, is proposed to overcome the limitations of existing security schemes. A <inline-formula> <tex-math notation="LaTeX">$32\times 32$ </tex-math></inline-formula> crossbar array using TiO<sub>x</sub>/Al<sub>2</sub>O<sub>3-</sub> based memristors was fabricated, and electrical characteristics including its set voltage distribution were analyzed. The memristor switching characteristics model is described in a simplified space-charge-limited current (SCLC) regime. Based on this I-V model, selected bit-line current PUFs (SBC-PUFs) were designed with <inline-formula> <tex-math notation="LaTeX">$32\times 32$ </tex-math></inline-formula>, <inline-formula> <tex-math notation="LaTeX">$64\times 64$ </tex-math></inline-formula>, and <inline-formula> <tex-math notation="LaTeX">$128\times 128$ </tex-math></inline-formula> crossbar arrays. The entropy source of these PUFs is the set voltage deviation in the fabricated memristors. Due to these characteristics, the SBC-PUF can exploit the broad resistance distribution near the switching region, including the internal resistance distributions of the high resistance state (HRS) and low resistance state (LRS). The SBC-PUF performance was evaluated for randomness/uniformity, correctness/reliability, and uniqueness by calculating the Hamming weight and intra/inter Hamming distance of challenge-response pairs (CRPs). The designed structure demonstrates high-security performance due to the high value of these indicators and the large number of CRPs. Furthermore, the devised PUF has a higher prediction error rate than arbiter PUF in machine learning attacks. This study verified that the SBC-PUF using the memristor of the crossbar array structure is safe enough to be used for hardware security.


I. INTRODUCTION
As more electronic devices and internet technologies are used in everyday life, the threat of cyber-attacks has increased [1]. Thus, security technology has become significant for people's safety and privacy. Existing security techniques primarily use cryptography implemented in software [2]. This method requires the designated private key to be stored in non-volatile memory (NVM) and assumes that the key is not accessible. However, NVM is vulnerable to physical attacks, such as side-channel attacks [3] and tampering [4], resulting in an exposed key and subsequent security threats.
The associate editor coordinating the review of this manuscript and approving it for publication was Gautam Srivastava .
Consequently, interest has increased in a new strategyhardware-based security. Physical unclonable functions (PUFs) use physical deviations in hardware fabrication processes to generate secret keys [5]. Because process variation is not exposed to the outside and cannot be predicted, PUFs have the advantages of being small, non-replicable, and resistant to physical attacks [6].
The basic concept of a PUF is depicted in Fig. 1. The input is expressed as a ''challenge,'' and the output is expressed as a ''response.'' Because all manufactured devices have different process variations, different outputs are observed for the same input for different PUF instances, as depicted in Fig 1(c). Therefore, challenge-response pairs (CRPs) can be used as authentication for users of a PUF instance. Because the key can be changed several times according to the authentication CRPs as depicted in Fig. 1(b), the higher the number of CRPs, the higher the security performance. When the number of CRPs is exponential in the number of challenge bits, it is considered an ideally strong PUF [7]. Various PUF types, including non-electrical ones, have been devised (optical [8], fiber [9]). Most PUFs are based on CMOS devices because of their efficiency and feasibility (arbiter PUF [10], ring oscillator PUF [11]). However, CMOS-based PUFs have a relatively large area and high power consumption [12]. Moreover, they are vulnerable to modeling attacks based on machine learning because of their linearity [13]. Therefore, next-generation PUFs fabricated from phase change memory [14], magnetic random access memory [15], and memristor [16] nano-electronic devices are being developed. Many memristor-based PUFs have been developed due to their small size and broad distribution in various electrical properties. Most existing memristor-based PUFs mainly use two entropy sources: (1) resistance distribution within a single state [17]- [19], and (2) random distribution of two resistance states determined by the write time variation [16].
In this paper, the structure of SBC-PUF based on the memristor crossbar array and its improved performances are described in detail. The memristor's set voltage distribution is used as an entropy source because of its high randomness. Unlike existing PUFs, the SBC-PUF uses both the analog resistance distribution in the two states of the memristor and the resistance that changes rapidly in the switching region. The SBC-PUF is non-invasive hardware primitive as it shows high performance in various indicators and CRPs are unpredictable. In addition, the designed PUF minimized the area of the CMOS circuit used in the process of generating the response bit. Section II describes the electrical characteristics of the fabricated memristor and its crossbar array using a space-charge limited current (SCLC) model. Section III explains the proposed SBC-PUF architecture and operation via circuit simulation. Section IV evaluates the SBC-PUF, including its defensive performance against machine learning attacks, and Section V presents our conclusion.

II. MEMRISTOR DEVICE AND MODEL
The memristor is a two-terminal electrical component that Chua first proposed in 1971 [20] and HP Labs achieved in 2008 [21]. It has a nonlinear I-V characteristic and a nonvolatile resistance state. Memristors are easy to incorporate into a 4F 2 crossbar array due to their two-terminal structure, benefiting from their compatibility with the CMOS backend-of-line (BEOL) process. They occupy a small area and consume minimal power [22]. Due to the significant randomness in nano-size manufacturing processes (e.g., thickness, cross-sectional area, and doping concentration), memristors can have broadly distributed electrical properties. These variations and a high integration density make the memristor highly suitable for a PUF that produces secret keys.
In this study, a TiO x /Al 2 O 3 -based memristor crossbar array was fabricated with the facilities of the Inter-University Semiconductor Research Center at Seoul National University and BIO-IT Micro FAB Center at Yonsei University. The fabrication process and electrical characteristics of the device are detailed in [23]. A cross-sectional transmission electron microscopy (TEM) image of a single device is depicted in Fig. 2, and a top-view microscopic and TEM image of the fabricated 32 × 32 memristor array are depicted in Fig. 3. Because the memristor devices have varied set voltages and the slopes of their switching steps vary according to their reset voltages, the device states can be randomly distributed if the fixed write voltage is applied to all devices.
As detailed in Section III, the write voltage of the PUF is used in a region close to the set voltage, so it is crucial to implement an accurate current value in the corresponding region. The device model was developed by considering the SCLC [24] as the memristors' conducting mechanism; which enabled the analysis of their switching characteristics for a PUF design with a circuit simulation tool, as depicted in Fig. 4(a). Several experimental results for various memristive devices support switching behavior in terms of the SCLC hypothesis [25]- [29], especially for a thin Al 2 O 3 layer [30], [31].
This mechanism is effective because fabricated memristor devices use a thin Al 2 O 3 insulator film of less than 3 nm with a very low carrier concentration [32]. In contrast to the model used by other PUFs [16], [18], the proposed model can reflect the physical operation before and after the switching region more accurately to illustrate analog-changing broad resistance characteristics and reflect the resistance distribution within each state depicted by actual devices.
In the low injection region under the transition voltage (V < V tr ), the number of thermally generated free electrons is greater than the number of injected carriers in the insulator film. This region's ohmic current density is formulated as in (1), where q is the electronic charge, n is the density of thermally generated electrons, µ is the mobility, and d is the insulator thickness.
As V increases and reaches the transition voltage (V > V tr ), the injected excess carriers exceed the thermally generated free electrons, and shallow traps are filled. The current density obeys (2), the Mott-Gurney law [33], where ε 0 is the permittivity of free space, and ε is the relative permittivity.
When V reaches the trap-filled limit voltage (V = V tfl ), the current increases rapidly because most of the insulator's traps are filled by electrons and charges can freely pass through it. In this case, deep traps caused by the insulator's exponential trap distribution should be considered. Therefore, the current density is given by (3), the Mark-Helfrich equation [34]. V tfl can be written as in (4). N c is the effective density of the charge carrier type, N t is the trap density, and T c is the trap distribution characteristic temperature. Since the set voltage, V tfl , is affected by the thin film thickness shown in Fig. 2 and trap density, memristors have a large process deviation in set voltage characteristics.
After the voltage exceeds V tfl and the memristor switches, current flows via the space charge layer formed inside the material. Thus, the current density follows the Mott-Gurney law again in the V > V tfl region. Finally, all I-V characteristics can be formulated as in (5) and (6) [35]: The Verilog-A model simulation results closely match the experimental results of the fabricated memristors, as depicted in Fig. 4 (b). The model accurately reflects the change in the set voltage (V tfl ) effect and applies equally well to both gradual and abrupt switching. Fig. 5 represents the set voltage distribution in our measurements as gray lines. In the I-V characteristics for a total of 97 devices, the average set voltage is 0.67 V within a 0.2 V switching region, and the set voltages' standard deviation is 0.076 V. The red line represents the simulation result of the model fitted to the mean of the experimental results. If the positive bias voltage applied to the memristor exceeds its set voltage, the memristor is switched to a low resistance state (LRS), and the current value increases. Conversely, if the voltage does not exceed the set voltage, the memristor's high resistance state (HRS) is maintained.
Because the memristors in the crossbar array all have different set voltages, a particular write voltage can be applied so that specific elements in the array are switched to an LRS and the rest of the memristors remain in an HRS. Consequently, the states are determined by random set voltages. As depicted in [23], our PUF uses only the positive bias region because fabricated devices have a much larger threshold voltage distribution in the positive bias region.

III. PUF ARCHITECTURE
32 × 32, 64 × 64, and 128 × 128 memristor crossbar arrays were simulated using HSPICE. Each memristor device was implemented using an SCLC model. The set voltage distribution of the devices followed the experimental results described in Section II. A set voltage distribution in devices was generated using the Monte Carlo method to implement a crossbar array in the simulation, similar to the real array. Fig. 6 compares the set voltage distributions of the fabricated and generated 4096 devices and confirms their similarity.
The random state distributions of 50.1% LRS and 49.9% HRS were derived with a write voltage of 0.68V in  a 64 × 64 array using the HSPICE simulation. The line resistance was set to 0.1 for each device. Fig. 7(a) illustrates the current value of each cell in the 64 × 64 crossbar array for a 0.2 V read voltage applied after the initial write, and Fig. 7(b) illustrates the distribution of the current values. Because voltage is applied from the left side of the word line, the cell current tends to decrease from left to right due to the voltage drop, as depicted in Fig. 7(a). The SBC-PUF applies the write voltage near the set voltage to create a broad resistance distribution for each device. It uses both the resistance distribution that exists inside each state as depicted in Fig. 7(b) and (c), and the resistance distribution created by the abrupt resistance change in the switching region after the write voltage exceeds the set voltage. This feature has greater randomness than the method that uses the resistance distribution within a single state used by existing PUFs [17]- [19]. Furthermore, this method is more difficult to predict and increases randomness because it uses an analog current value instead of the conventional method that divides the two states into 0 and 1 while randomizing the distribution of HRS and LRS [16].
The structure of the SBC-PUF proposed in this paper is depicted in Fig. 8. Initially, the write voltage is determined so the devices have a random state and is applied to all word lines through the control block. Thus, the state of the cells is determined randomly at this stage. The write voltage may vary depending on the size of the crossbar array, device characteristics, and line resistance. Then, at the PUF authentication stage, the read voltage is applied to N word lines according to an N bit challenge so that the memristors of specific word lines are selected. If the kth challenge bit is 1, a read voltage is applied to the kth word line. For example, if the challenge is 1100 . . . 000, the first and second word lines are selected.
Furthermore, bit lines are divided into two groups, odd and even, and one line is determined in each group through its MUX block. At this time, part of the challenge bits of size log 2 (N /2) is reused to select one line out of N/2 lines in each group. In the simulation in the 64 × 64 array, the first five bits of the challenge were reused for the odd number group and the last five bits for the even number group. The number of the selected bit line was calculated by converting the challenge bit from binary to decimal and adding 1. For example, if the challenge is 00001 . . . 00010, the second bit line in the odd number group and the third bit line in the even number group are selected.
The mth challenge bit is represented by C m , the memristor cell corresponding to the mth word line and the nth bit line is represented by X(m,n), and the current value of the cell is represented by I(X(m,n)). By the device of the selected word line, the current value flowing in the nth bit line can be interpreted as in (7) because the devices of the word line with C m = 0 are ignored. The selected bit line number n s is determined by reusing the challenge as described above.
Finally, the sense amplifier compares the current flowing in the two selected bit lines, and the PUF can generate a 1-bit response. The corresponding response affects not only the resistance state of the selected memristor but also the distribution of the current, which varies according to the set voltage within the same state. This design minimizes this tendency according to the array positions and makes prediction difficult through the complex use of challenge bits; which is done by grouping the bit lines by their odd and even positions. The number of CRPs is 2 N , which is large enough to yield a strong PUF. If the K challenge bit for bit line selection is added and used separately, the number of CRPs can be increased to 2 N × (K /2) 2 .2 N is calculated from the number of cases of all word lines that can be selected, K/2 is calculated from the number of cases of one bit line that can be selected in each group, and the squaring operation is added because there are two groups in the SBC-PUF.

IV. PERFORMANCE ANALYSIS A. PUF PERFORMANCE METRICS
Various metrics have been devised to evaluate the performance of PUFs [36]- [38]. The most commonly used methods are by Hori et al. [36] and Maiti et al. [37]. These two methods differ in their mathematical expression and corresponding ideal values, but the evaluation content is identical. We describe and compare the indicators included in each performance evaluation in detail and write about the performance evaluation results for 64 × 64 and 128 × 128 SBCPUFs performed in each method. The parameter notations used for performance evaluation are defined in Table 1.

1) RANDOMNESS/UNIFORMITY
Randomness by Hori and Uniformity by Maiti are indicators to estimate the uniformity of the ratios ''0'' and ''1'' in all responses of PUF.
Randomness by Hori is defined as in (8): Uniformity by Maiti is defined as in (10): Both formulas compute the Hamming Weight of each response. The meaning of the two indicators is the same. However, the most significant difference in Hori's method is that the p n value is converted to set the ideal value of Randomness to 1, unlike the ideal Uniformity of 0.5. Moreover, Hori's method included T , which indicates the number of attempts to generate a response to the same challenge within the same PUF.
The evaluation was performed using 100,000 CRPs created in a 64 × 64 array and a 128 × 128 array, respectively (K = 100,000), and 16 iterations were performed to generate a 16-bit response (L = 16). For the unity of the two indicators, T was set to 1. In the SBC-PUF, the value of Randomness is 0.9890 in the 64×64 array and 0.9912 in the 128×128 array, close to the ideal value of 1. Likewise, the value of Uniformity is 0.5038 / 0.5031 in the 64 × 64/128 × 128 array, close to the ideal value of 0.5. To express high Randomness characteristics intuitively, the distribution of the Hamming weight according to the different response bits (16, 32, 64 bits) in the 64 × 64 PUF is depicted in Fig. 9(a).

2) CORRECTNESS/RELIABILITY
Correctness by Hori and Reliability by Maiti are indicators that mean whether the PUF generates a uniform response to repeated identical challenges.
Correctness by Hori is defined as in (11): (r n,k,l ⊕ r n,k,t,l ) (11) Reliability by Maiti is defined as in (12): (r n,k,l ⊕ r n,k,t,l ) (12) Both formulas compute the intra-chip Hamming distance between responses for t different trials. The evaluation was performed using 100,000 CRPs generated in a 64 × 64 array and a 128 × 128 array, respectively (K = 100,000) and performed 64 iterations to generate a 64-bit response (L = 64). Because the same response is always generated in the circuit simulator, the sensing margin of the current sense amplifier was set to 5 µA and implemented it 100 times (T = 100) in MATLAB so that the response error bit randomly occurs in the corresponding region. In the actual implementation of memristor-based PUF, the reliability can be further degraded by the random telegraph noise (RTN) of the memristor device [39]. The RTN property can induce stochastic read current fluctuations by charge trapping and detrapping, resulting in the increase of bit error rate especially when response bits are generated by comparing read current values. In the SBC-PUF, the value of Correctness is 0.9976 in the 64 × 64 array and 0.9974 in the 128 × 128 array, close to the ideal value of 1. Likewise, the Reliability value is 0.9988/ 0.9987 in the 64×64/128×128 array, close to the ideal value of 1. To express high Correctness characteristics of SBC-PUF intuitively, the distribution of intra-by distance in the 64 × 64 PUF is represented in Fig. 9(b) with black bars.

3) UNIQUENESS
Uniqueness, which is used equally by Hori and Maiti, is an indicator to determine whether different PUF chips generate different responses to the same challenge.
Uniqueness by Hori is defined as in (13): (r i,k,l ⊕ r j,k,l ) (13)  Uniqueness by Maiti is defined as in (14): Both formulas calculate the inter-chip Hamming distance between responses. Because of the difference in the normalization factor between the two equations, when N is large enough, the value of Hori's converges to twice the value of Maiti's, and the ideal values are 1 and 0.5, respectively. 100 different PUF chips were implemented with different set voltage distributions to perform this evaluation (N = 100). 100,000 CRPs created in a 64 × 64 array and a 128 × 128 array were used (K = 100,000) and a 64-bit response was generated by performing 64 iterations (L = 64). In SBC-PUFs, the value of Uniqueness by Hori is 0.9531 in the 64 × 64 array and 0.9892 in the 128 × 128 array, close to the ideal value of 1. Likewise, the value of Uniqueness by Maiti is 0.4813 / 0.4996 in the 64 × 64 /128 × 128 array, close to the ideal value of 0.5. To express the high Uniqueness characteristic of SBC-PUF intuitively, the distribution of inter-Hamming distance in the 64 × 64 PUF is represented in Fig. 9(b) by red bars.
In Tables 2 and 3, the performance of an SBC-PUF with arbiter PUF [36] and other memristor-based PUFs [40], [41], were evaluated for randomness/uniformity, correctness/ reliability, uniqueness, and the number of CRPs. Because the number of CRPs was measured based on the crossbar array size of N × M , only three memristor-based PUFs except for the arbiter PUF were compared. The performance of [41] was compared without bit shuffling because other algorithms outside the PUF should not be considered.

B. PERFORMANCE ANALYSIS ACCORDING TO STATE RATIO DIFFERENCE
By adjusting the write voltage of the SBC-PUF, the ratio of HRS/LRS and the resistance distribution inside the array can be changed. Therefore, the performance was additionally evaluated to optimize the PUF performance and confirm the influence of the method of widening the resistance distribution we selected. The method using only the within-state distribution and the method using a broad distribution were compared to determine which is suitable for the structure of an SBC-PUF.
The write voltage that produces LRS-to-total ratios of 25%, 50%, 75%, and 100% in a 64 × 64 array was determined using the HSPICE simulation. In the second case, the HRS and LRS are randomly distributed and this case is used in the SBC-PUF. In the last case, all devices exceed the set voltage and store LRS. The first and third cases were performed to analyze the effect of the HRS and LRS ratios on the actual performance.
As depicted in Fig. 10, the corresponding write voltages for each case were 0.58, 0.68, 0.80, and 1.30 V. In the performance calculations repeated 10 times for a total of 100,000 CRPs, the randomness was 0.9572, 0.9958, 0.9481, and 0.9237, respectively, exhibiting optimized performance at 50%.
In contrast, high randomness near 0.95 is calculated even for PUFs with nonuniform ratios, suggesting that PUF performance does not deteriorate significantly in various state ratios and that fine set voltage measurement and write voltage adjustment for all PUFs are not required. For the intra-Hamming distance, the number of error bits in all cases was predominantly 0 or 1, like the result depicted in Fig. 8. In contrast, only the case with an LRS of 25% had an average error bit of 3.8 bits-an error occurs when comparing current values because HRS devices have low current values.

C. DEFENSIVE PERFORMANCE AGAINST MACHINE LEARNING ATTACK
The primary purpose of machine learning [42] is to generate a model based on real-world data and predict the output that will occur when different input values are input [43], [44]. Various machine learning attacks on PUFs have recently been attempted to predict the response of a PUF [45]. In this section, the performance of machine learning model attacks against SBC-PUF was measured. The central idea is to train the model on a subset of the CRP data set of the proposed model and predict the response through the challenges of the remainder of the CRP data set.
CRP data sets were generated on 64 × 64 arrays with 64-bit challenges, and the write voltages used were 0.68 V for the highest randomness performance. Other detailed CRP generation principles followed section III. Our implementation used Python 3.8, and the machine learning library used scikit-learn [46] to experiment with the performance of SBC-PUF. Tests using logistic regression (LR) and a support vector machine (SVM) were performed with a different number of training samples to predict the CRPs of PUFs.
For machine learning attacks, 64-bit challenges were assumed, and various training data sets from 50 to 100,000 were used. Each attacking test used 80% CRPs for training and 20% for testing. The prediction error rates of two machine learning attacks are depicted in Fig. 11 and compared with the arbiter PUF [47], the design of which was proposed in [10].
LR is a regression analysis technique that models a linear relationship between a dependent variable y and one or more independent variables x. It predicts a result that is close to the data spread out by drawing a line. The LR prediction error rate for the SBC-PUF on the 10,000 training sets was 25.43%, in contrast to the arbiter PUF with a prediction rate of 1% on the same number of training sets. The 100,000 sets had an error rate of 16.43%.
The second experiment was used to evaluate the proposed SBC-PUF as an SVM attack. SVM is one of the most powerful supervised learning models and can be used for binary classification patterns on a set of training examples. The SVM learns to maximize the margin of the decision boundary that divides the two data sets. A radial basis function (RBF) was used as a nonlinear kernel and parameters C and γ were set FIGURE 11. Prediction error rate for SBC-PUF (red lines) and Arbiter PUF (blue lines) with training sample set sizes between 50 and 100,000. The worst prediction rate of an ideal PUF is 0.5. to 1 and 0.1, respectively. The SVM prediction error rate for the SBC-PUF on the 10,000 training sets was 34.22%, in contrast to the arbiter PUF with a prediction rate of 1% on the same training set. The 100,000 sets had an error rate of 16.91%. Fig. 11 illustrates the prediction error rate for SBC-PUF and arbiter PUF with training sample set sizes between 50 and 100,000. Notably, the SBC-PUF has a significant prediction error rate even on a very large training set, in contrast to the arbiter PUF. Moreover, the PD-CRP Bloom Filter [48] developed in previous research can prevent the exposure of large amounts of CRP. This Bloom Filter screens CPRs used and CRPs which are not stored in the server. It is effective because it can be implemented as hardware with PUF and protected with a small size memory. Therefore, the results with a strong performance near the ideal value of 50% in a small training set are also meaningful.

V. CONCLUSION
This paper proposes an SBC-PUF design using a memristorbased crossbar array as an effective hardware security device. The fabricated memristor was modeled mathematically based on the SCLC mechanism. This model accurately reflects the current characteristics according to the set voltage, especially in the write voltage region we used. The distribution of the set voltages based on the measured value of fabricated devices was verified, and this characteristic was used as the entropy source for the PUF. The SBC-PUF selects one line from the even and odd bit line groups and compares the read currents to generate a 1-bit response. Because this PUF has a broad distribution of resistance values, the simulation results confirm that the values of the three evaluation indicators are close to their ideal values and the number of CRPs is larger than that of the other PUFs. Furthermore, it was confirmed that the SBC-PUF has higher machine learning defensive performance than arbiter PUFs even on more training sets by applying a machine learning attack with LR and SVM algorithms.