POCA: First Power-on Chip Authentication and Key Exchange for Secure Provisioning in System-on-Chip

In a horizontal business model, the manufacturing and testing of system-on-chip (SoC) design at offshore facilities has proven to be a cost-effective strategy for fabless design houses. This, however, has led to growing concerns about the security and reliability of chips manufactured by outsourced semiconductor foundries, assembly, and test entities. As such, untrusted entities have access to the entire chip design; they may exploit opportunities for IP piracy, overproduction, cloning, shipping defective or out-of-specification chips, and insecure boot. Design houses must address these concerns by securing the die/packaged chips and their assets in such an untrusted environment. Unfortunately, this cannot be accomplished by any of the current security primitives [e.g., physical unclonable functions (PUFs)] due to their inherent limitations at this stage. Furthermore, provisioning the security assets requires a secure key exchange protocol, which is difficult to accomplish with untrusted entities (tester and software proxies) existing between the die/chip under test and the secure cloud server. This article introduces a novel security primitive and a power-on chip authentication protocol called POCA, which enables the secure provisioning of security assets during wafer sort. POCA incurs a low area overhead and is resilient to any attacks known today.