Multiple research projects are proposed that utilize low-level knowledge of Field Programmable Gate Array (FPGA) and Application Specific Integrated Circuit (ASIC) design processes to enable additional research avenues. In order to accomplish these projects, Tools for Open Reconfigurable Computing (TORC) is utilized to provide a robust environment for circuit analysis and modifications. These projects rely on looking at the low-level constructs of the internals of these microchips. Through this knowledge, techniques for performing supply chain evaluations are proposed utilizing a non-binary comparison of multiple characteristic vectors between different FPGA manufacturing lots, and FPGAs that have been exposed to different environmental conditions. Second, techniques are proposed that look at design recovery by performing fuzzy segmentation and fuzzy matching algorithms to a problem area that has traditionally focused on exact graph sub-isomorphism solutions. Through these projects, additional research vectors are opened to protect and analyze the engineering efforts that are exerted in the design of FPGA and ASIC projects. / Ph. D.

Physical Unclonable Functions (PUFs) provide a secure, power efficient and non-volatile means of chip identification. These are analogous to one-way functions that are easy to create but impossible to duplicate. They offer solutions to many of the FPGA (Field Programmable Gate Array) issues like intellectual property, chip authentication, cryptographic key generation and trusted computing. Moreover, FPGA evolving as an important platform for flexible logic circuit, present an attractive medium for PUF implementation to ensure its security. In this thesis, we explore the behavior of RO-PUF (Ring Oscillator Physical Unclonable Functions) on FPGA when subjected to low voltages. We investigate its stability by applying environmental variations, such as temperature changes to characterize its effectiveness. It is shown with the help of experiment results that the spread of frequencies of ROs widens with lowering of voltage and stability is expected. However, due to inherent circuit challenges of FPGA at low voltage, RO-PUF fails to generate a stable response. It is observed that more number of RO frequency crossover and counter value fluctuation at low voltage, lead to instability in PUF. We also explore different architectural components of FPGA to explain the unstable nature of RO-PUF. It is reasoned out that FPGA does not sustain data at low voltage giving out unreliable data. Thus a low voltage FPGA is required to verify the stability of RO-PUF. To emphasize our case, we look into the low power applications research being done on FPGA. We conclude that FPGA, though flexible, being power inefficient, requires optimization on architectural and circuit level to generate stable responses at low voltages. / Master of Science

This project focus to desing an on-chip oscillator in function as a clock generator. Frequency stability of the oscillator is affected by supply voltage, temperature and process variations. The aim is to propose a clock generator with sufficient frequency stability, low power consumption and a small chip area. This work deals with the types of oscillators and their basic building blocks suitable for our application. It also deals with the study and design options of temperature and process compensation circuit generating the current control, which provides the frequency stabilization of the output signal.

<p>Random numbers are required for cryptographic applications such as IT security products, smart cards etc. Hardwarebased random number generators are widely employed. Cryptographic algorithms are implemented on FieldProgrammable Gate Arrays (FPGAs). In this work a True Random Number Generator (TRNG) employed for spaceapplication was designed, investigated and evaluated. Several cryptographic requirements has to be satisfied for therandom numbers. Two different noise sources was designed and implemented on the FPGA. The first design wasbased on ring oscillators as a noise source. The second design was based on astable oscillators developed on a separatehardware board and interfaced with the FPGA as another noise source. The main aim of the project was to analyse theimportant requirement of independent noise source on a physical level. Jitter from the oscillators being the source forthe randomness, was analysed on both the noise sources. The generated random sequences was finally subjected tostatistical tests.</p>

Random numbers are required for cryptographic applications such as IT security products, smart cards etc. Hardwarebased random number generators are widely employed. Cryptographic algorithms are implemented on FieldProgrammable Gate Arrays (FPGAs). In this work a True Random Number Generator (TRNG) employed for spaceapplication was designed, investigated and evaluated. Several cryptographic requirements has to be satisfied for therandom numbers. Two different noise sources was designed and implemented on the FPGA. The first design wasbased on ring oscillators as a noise source. The second design was based on astable oscillators developed on a separatehardware board and interfaced with the FPGA as another noise source. The main aim of the project was to analyse theimportant requirement of independent noise source on a physical level. Jitter from the oscillators being the source forthe randomness, was analysed on both the noise sources. The generated random sequences was finally subjected tostatistical tests.

A Voltage Controlled Oscillator (VCO) based pixel and array architecture is reported using amorphous silicon (a-Si) technology for large area digital imaging applications. The objectives of this research are to (a) demonstrate photon quantum noise limited pixel operation of less than 30 input referred noise electrons, (b) theoretically explore the use of the proposed VCO pixel architecture for photon quantum noise limited large area imaging applications, more specifically protein crystallography using a-Si, (c) to implement and demonstrate experimentally a quantum noise limited (VCO) pixel, a small prototype of quantum noise limited (VCO) pixelated array and a quantum noise limited (VCO) pixel integrated with direct detection selenium for energies compatible with a protein crystallography application. Electronic noise (phase noise) and metastability performance of VCO pixels in low cost, widely available a-Si technology will be theoretically calculated and measured for the first time in this research. The application of a VCO pixel architecture in thin film technologies to large area imaging modalities will be examined and a small prototype a-Si array integrated with an overlying selenium X-ray converter will be demonstrated for the first time. A-Si and poly-Si transistor technologies are traditionally considered inferior in performance to crystalline silicon, the dominant semiconductor technology today. This work v aims to extend the reach of low cost, thin film transistor a-Si technology to high performance analog applications (i.e. very low input referred noise) previously considered only the domain of crystalline silicon type semiconductor. The proposed VCO pixel architecture can enable large area arrays with quantum noise limited pixels using low cost thin film transistor technologies.

A Voltage Controlled Oscillator (VCO) based pixel and array architecture is reported using amorphous silicon (a-Si) technology for large area digital imaging applications. The objectives of this research are to (a) demonstrate photon quantum noise limited pixel operation of less than 30 input referred noise electrons, (b) theoretically explore the use of the proposed VCO pixel architecture for photon quantum noise limited large area imaging applications, more specifically protein crystallography using a-Si, (c) to implement and demonstrate experimentally a quantum noise limited (VCO) pixel, a small prototype of quantum noise limited (VCO) pixelated array and a quantum noise limited (VCO) pixel integrated with direct detection selenium for energies compatible with a protein crystallography application. Electronic noise (phase noise) and metastability performance of VCO pixels in low cost, widely available a-Si technology will be theoretically calculated and measured for the first time in this research. The application of a VCO pixel architecture in thin film technologies to large area imaging modalities will be examined and a small prototype a-Si array integrated with an overlying selenium X-ray converter will be demonstrated for the first time. A-Si and poly-Si transistor technologies are traditionally considered inferior in performance to crystalline silicon, the dominant semiconductor technology today. This work v aims to extend the reach of low cost, thin film transistor a-Si technology to high performance analog applications (i.e. very low input referred noise) previously considered only the domain of crystalline silicon type semiconductor. The proposed VCO pixel architecture can enable large area arrays with quantum noise limited pixels using low cost thin film transistor technologies.

Abstract The aim of this work was to develop time-to-digital converters(TDC) with a wide measurement range of several hundred microseconds and with a measurement precision of a few picoseconds. Because of these requirements, the focus of this work was mainly on TDC architectures based on the Nutt interpolation method, which has several advantages when a long measurement range is a requirement. Compared to conventional data converters the characteristics of a Nutt TDC differ significantly when, for example, quantization errors and linearity errors are considered. In this thesis, the operating principle of a Nutt TDC is analysed and, in particular, the effects of reference clock instabilities are studied giving new insight how the different phase noise processes can be reliably translated into time interval jitter, and how these affect the measurement precision when very long time intervals are measured. Furthermore, these analytical results are confirmed by measurements conducted with a long-range TDC designed as part of this work. Two long-range TDCs have been designed, each based on different interpolator architectures. The first TDC utilises discrete component time-to-voltage converters(TVC) as interpolators. Other key functionality is implemented on an FPGA. The interpolators use Miller integrators to improve the linearity and the single-shot precision of the converter. The TDC has a nominal measurement range of 84ms and it achieves a single-shot precision of 2ps for time intervals shorter than 2ms, after which the precision starts to deteriorate due to the phase noise of the reference clock. In addition to the discrete TDC, an integrated long-range CMOS TDC has been designed with 0.35μm technology. Instead of TVCs, this TDC features cyclic/algorithmic interpolators, which are based on switched-frequency ring oscillators(SRO). The frequency switching is used as a mechanism to amplify quantization error, a key functionality required by any cyclic or a pipeline converter. The interpolators are combined with a 16-bit main counter giving a total range of 327μs. The RMS single-shot precision of the TDC is 4.2ps without any nonlinearity compensation. Furthermore, a calibration functionality implemented partially on-chip ensures that the accuracy of the TDC varies only ±2.5ps in a temperature range of -30C to 70C. Although implemented with fairly old technology, the interpolators’ effective linear range and precision represent state-of-the-art performance. / Tiivistelmä Tämän työn tavoitteena oli kehittää aika-digitaalimuuntia (TDC), joilla on laaja satojen mikrosekuntien mittausalue ja muutaman pikosekunnin kertamittaustarkkuus. Näistä vaatimuksista johtuen tässä työssä keskitytään pääasiassa Nuttin interpolointimenetelmään perustuviin TDC-arkkitehtuureihin. Verrattuna tavanomaisiin datamuuntimiin, Nutt TDC:n toiminta poikkeaa merkittävästi, kun tarkastellaan kvantisointi- ja lineaarisuusvirhettä. Tässä väitöskirjatyössä Nuttin menetelmään perustavan TDC:n toiminta analysoidaan, jonka yhteydessä tutkitaan erityisesti referenssioskillaattorin epästabiilisuuksien vaikutusta mittausepävarmuuteen. Tämän pohjalta vaihekohinan eri kohinaprosessit voidaan luotettavasti muuntaa taajuustason kohinatiheysmittauksista aika-tasossa kuvattavaksi aikavälijitteriksi. Nämä teoreettiset tulokset ovat varmistettu yhdellä osana tätä työtä suunnitellulla pitkän kantaman TDC:llä. Teoreettisen tarkastelun lisäksi kaksi pitkän kantaman TDC:tä on suunniteltu, toteutettu ja testattu. Ensimmäinen näistä perustuu erilliskomponenteilla toteutettuun aika-jännitemuunnokseen (TVC) pohjautuvaan interpolointimenetelmään. Analogisten interpolaattoreiden ohella muu olennainen toiminnallisuus toteutettiin FPGA:lle. Interpolaattorit käyttävät Miller-integraattoreita lineaarisuuden ja kertamittaustarkkuuden parantamiseksi. TDC:n nimellinen mittausalue on 84ms ja sillä saavutetaan 2ps:n kertamittaustarkkuus, kun mitattava aikaväli on lyhyempi kuin 2ms, minkä jälkeen mittaustarkkuus heikkenee referenssioskillaattorin vaihekohinan vaikutuksesta. Toinen pitkän kantaman TDC perustuu 0.35μm:n CMOS teknologialla totetutettuun integroituun piiriin. Aika-jännitemuunnoksen sijasta tämä TDC perustuu sykliseen/algoritmiseen interpolointitekniikkaan, jossa taajuusmoduloitua rengasoskillaattoria(SRO) käytetään kvantisointivirheen vahvistamiseksi. Interpolaattorit ovat yhdistetty 16-bittiseen referenssioskillaattorin laskuriin, jolloin TDC:n mittausalue on noin 327μs. Tämän TDC:n RMS kertamittaustarkkuus on 4.2ps, joka saavutetaan ilman epälineaarisuuden kompensointia. Samalle piirille on lisäksi toteutettu kalibrointitoiminnallisuus, jolla varmistetaan TDC:n hyvä mittaustarkkuus kaikissa olosuhteissa. Mittaustarkkuus poikkeaa maksimissaan vain ±2.5ps, kun lämpötila on välillä -30C-70C. Vaikka TDC on toteutettu kohtalaisen vanhalla CMOS teknologialla, interpolaattoreiden efektiivinen lineaarinen alue ja mittaustarkkuus edustavat alansa huippua.

Avec la mondialisation du marché des semi-conducteurs, l'intégrité des circuits intégrés (CI) est devenue préoccupante... On distingue deux menaces principales : les chevaux de Troie matériel (CTM) et les contrefaçons. La principale limite des méthodes de vérification de l’intégrité proposées jusqu'à maintenant est le biais induit par les variations des procédés de fabrication. Cette thèse a pour but de proposer une méthode de détection embarquée de détection de CTM et de contrefaçons. À cette fin, une caractérisation de l'impact des modifications malveillantes sur un réseau de capteurs embarqué a été effectuée. L'addition malicieuse de portes logiques (CTM) ou la modification de l'implémentation du circuit (contrefaçons) modifie la distribution de la tension à la l'intérieur du circuit. Une nouvelle approche est proposée afin d'éliminer l'influence des variations des procédés. Nous posons que pour des raisons de cout et de faisabilité, une infection est faite à l'échelle d'un lot de production. Un nouveau modèle de variation de performance temporelle des structures CMOS en condition de design réel est introduit. Ce modèle est utilisé pour créer des signatures de lots indépendantes des variations de procédé et utilisé pour définir une méthode permettant de détecter les CTMs et les contrefaçons.Enfin nous proposons un nouveau distingueur permettant de déterminer, avec un taux de succès de 100%, si un CI est infecté ou non. Ce distingueur permet de placer automatiquement un seuil de décision adapté à la qualité des mesures et aux variations de procédés. Les résultats ont été expérimentalement validés sur un lot de cartes de prototypage FPGA. / Due to the trend to outsourcing semiconductor manufacturing, the integrity of integrated circuits (ICs) became a hot topic. The two mains threats are hardware Trojan (HT) and counterfeits. The main limit of the integrity verification techniques proposed so far is that the bias, induced by the process variations, restricts their efficiency and practicality. In this thesis we aim to detect HTs and counterfeits in a fully embedded way. To that end we first characterize the impact of malicious insertions on a network of sensors. The measurements are done using a network of Ring oscillators. The malicious adding of logic gates (Hardware Trojan) or the modification of the implementation of a different design (counterfeits) will modify the voltage distribution within the IC.Based on these results we present an on-chip detection method for verifying the integrity of ICs. We propose a novel approach which in practice eliminates this limit of process variation bias by making the assumption that IC infection is done at a lot level. We introduce a new variation model for the performance of CMOS structures. This model is used to create signatures of lots which are independent of the process variations. A new distinguisher has been proposed to evaluate whether an IC is infected. This distinguisher allows automatically setting a decision making threshold that is adapted to the measurement quality and the process variation. The goal of this distinguisher is to reach a 100\% success rate within the set of covered HTs family. All the results have been experientially validated and characterized on a set of FPGA prototyping boards.

Aujourd'hui, nous utilisons de plus en plus d'appareils "connectés" (téléphone portable, badge d'accès ou de transport, carte bancaire NFC, ...), et cette tendance ne va pas s'inverser. Ces appareils requièrent l'utilisation de primitives cryptographiques, embarquées dans des composants électroniques, dans le but de protéger les communications. Cependant, des techniques d'attaques permettent d'extraire de l'information du composant électronique ou fauter délibérément son fonctionnement. Un nouveau médium d'attaque, exploitant les ondes électromagnétiques est en pleine expansion. Ce médium, par rapport à des techniques de fautes à base de perturbations par faisceau LASER, propose l'avantage d’être à relativement faible coût. Nous présentons dans cette thèse la résistance d'un type de bloc cryptographique, à savoir les générateurs de nombres réellement aléatoires, aux ondes électromagnétiques. Nous montrons qu'il est possible d'extraire de l'information sensible du champ électromagnétique produit par le composant électronique, et qu'il est également possible de perturber un générateur en le soumettant à un fort champ électromagnétique harmonique / Nowadays, our society is using more and more connected devices (cellphones, transport or access card NFC debit card, etc.), and this trend is not going to reverse. These devices require the use of cryptographic primitives, embedded in electronic circuits, in order to protect communications. However, some attacks can allow an attacker to extract information from the electronic circuit or to modify its behavior. A new channel of attack, using electromagnetic waves is skyrocketing. This channel, compared to attacks based on LASER beam, is relatively inexpensive. We will, in this thesis, present a new attack, using electromagnetic waves, of a certain type of cryptographic primitive: the true random number generator. We will show that it is possible to extract sensitive information from the electromagnetic radiation coming from the electronic device. We will also show that it is possible to completly modify the behavior of the true random number generator using a strong electromagnetic field