Semi-invasive EM attack on FPGA RO PUFs and countermeasures

It is often argued that Physical Unclonable Functions (PUFs) are resistant against invasive and semi-invasive attacks since these attacks would damage the underlying PUF structure resulting in a different PUF response. In this paper, we demonstrate exemplarily that this assumption does not hold for a Ring Oscillator (RO) PUF implemented on a Xilinx Spartan 3 FPGA, where we were able to perform a semi-invasive attack. We present analysis methods to identify ring oscillator frequencies and to map them to their corresponding oscillators. We practically prove that it is possible to recover the generated RO PUF response bits with this approach. To harden RO PUFs against side-channel analysis, we also propose a RO PUF concept not leaking useful information through the side-channel of electro-magnetic radiation.