One-time Programmable Memory Research Articles

DICEguard: enhancing DICE security for IoT devices with periodic memory forensics

The number of Internet-of-Things (IoT) devices has been increasing rapidly every year. Most of these devices have access to important personal data such as health, daily activities, location, and finance. However, these devices have security problems since they have limited processing power and memory to implement complex security measures. Therefore, they possess weak authentication mechanisms and a lack of encryption. Additionally, there are no widely accepted standards for IoT security. Device Identifier Composition Engine (DICE) was proposed as a standard that enables adding a security layer to low-cost microcontrollers with minimal silicon overhead. However, previous studies show that DICE-based attestation is vulnerable to some remote attacks. In this study, we present a novel method called DICEguard to address the security problems of DICE. One of the key innovations of DICEguard is its incorporation of periodic memory forensics (PMF) technique, leveraging a hardware-based hash engine to detect and mitigate potential security breaches resulting from firmware vulnerabilities. DICEguard enhances the overall resilience of IoT devices against attacks by swiftly detecting alterations indicative of malicious activity through periodic calculation and comparison of firmware digests. Furthermore, DICEguard introduces a one-time programmable (OTP) memory component to safeguard critical security parameters, such as public keys used for signature verification, against tampering by adversaries. This ensures the integrity of essential security measures even in the face of sophisticated attacks. We implemented the enhanced DICE architecture using the open-source RISC-V platform Ibex and the mbedTLS library for cryptographic operations. We performed the hash operations required by DICE in a hardware-based manner on a commercial Field Programmable Gate Array (FPGA) platform rather than firmware, which is more vulnerable to attacks. Our test results show that with negligible area overhead to a standard microcontroller system, the proposed method can detect the simulated attacks.

Self-Selective Dielectric-Fuse Effect with Ambient Factors in Oxide-Based Memory

A dual-function memory with CMOS compatibility has been presented with the feasibility of future embedded applications. The self-selective memory composed of bilayer oxide stacks is presented with the immunity of sneak-path current (SPC) and improved thermal stability for the high storage class memory array application. Meanwhile, the one-time programmable (OTP) memory is realized by the identical bilayer structure which has improved the yield of dielectric-fuse phenomena by increasing the operating temperature up to 423 K. The physical mechanisms and modeling are investigated with experimental and simulated results. Our results provide pathfinding of high density, CMOS back-end-of-line (BEOL) integration capability, land ow power multi-functionality in the future embedded applications.

Method of solving single-event upset for heterogeneous dual field programmable logic gate array for infrared remote sensing camera in orbit

On-orbit reconstruction is a hotspot technology in the field of space infrared remote sensing cameras technology. Since the space infrared remote sensing cameras perform detection work under the space radiation environment, the core part of its image processing unit, which is a static random-access memory type field programmable logic gate array (FPGA), is susceptible to the impact of high-energy particles, especially during single-event upset events. The occurrence of point-like granular noise in remote sensing images will affect the normal imaging detection performance of the system, and even lead to abnormal timing of infrared detectors in severe cases, thereby affecting the normal operation of infrared remote sensing cameras. Aiming at the reliability requirements of the normal operation of space infrared remote sensing cameras in the space radiation environment, we propose a modular architecture of heterogeneous dual FPGA for XilinxVirtex-5 series FPGA, which carries out periodic refresh, reconstruction, and uploading of Virtex-5 series FPGA through antifuse FPGA. The antifuse FPGA periodically refreshes and reconstructs the Virtex-5 series FPGA from a one-time programmable read-only memory and injects the program into the program storage NOR flash device, and periodically refreshes and reconstructs the Virtex-5 series FPGA from NOR flash. This method can refresh and reconstruct the space infrared remote sensing camera in orbit. The in-orbit flight data verification shows that this method can effectively solve the impact of single-particle turnover event and improve the reliability of the infrared remote sensing camera in orbit operation.

BEOL-Compatible Bilayer Reprogrammable One-Time Programmable Memory for Low-Voltage Operation

In this work, an engineered submicrometer-scale bilayer stacking in via-type one-time programmable (OTP) memory and self-rectified resistive switching memory [resistive random access memory (ReRAM)] is demonstrated. The current development has achieved that co-existing memory functionality (OTP and ReRAM) with mitigating scaling requirement (fuse voltage trending with via size scaling), low fabrication complexity [via-fuse vs. gate-dielectric anti-fuse (AF)], and match with the current metal fuse technology ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$&gt;$ </tex-math></inline-formula> 2 V). In addition, an electrode engineered has been proposed to realize low programming voltage ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\sim $ </tex-math></inline-formula> 1.9 V) in via-fuse OTP featuring by metal–insulator–metal advanced back-end-of-line (BEOL) process with ruthenium materials. The impact of via-size, programming window, stacked structures, and integration capability has been extensively studied. Our results provide a pathfinding of high density, integration capability, low programming voltage, multifunctionality between programmable read-only memory (PROM), and resistive switching memory co-existing in future embedded applications.

Bifunctional HfOx-based Resistive Memory: Reprogrammable and One-Time Programmable (OTP) Memory

The dual functions in HfOx-based ReRAM and 2V-programmable via-fuse technology featuring in simple metal-insulator-metal BEOL process are presented, which can integrate with the current metal fuse technology. The impact of via-size, ReRAM, and via-fusing programming windows, stacked structures, and integration capability has been extensively studied. The performance and reliability risk assessments show that the ReRAM and via fuse can sustain at 438 K for 500 h without any degradation. Our results provide pathfinding of high density, integration capability, low programing voltage, multi-functionality between programmable read-only memory (PROM) and ReRAM co-existing in embedded applications.

PUF Implementation Using Competing OTPM Devices in Novel 5T-2OTPM Differential Configuration

Physical unclonable function (PUF) is an important circuit component for realizing cyber-physical security of data and electronic systems. In this work, we present a low-cost PUF implementation using metal-insulator-metal (MIM)-type PECVD SiO₂-based one-time programmable memory (OTPM) devices. We present a custom Verilog-A compact model of OTPM devices for complete PUF hardware implementation in the 180-nm CMOS technology. The implementation of PUF scheme based on a novel differential bit cell using OTPM devices shows strong performance in terms of uniqueness, reliability, and uniformity without additional overheads in terms of bit error correction and postprocessing.

A differential OTP memory based highly unique and reliable PUF at 180 nm technology node

A random binary code-based unique chip identity is essential for the security of Internet-of-Things devices. Physically Unclonable Function (PUF) exploits intrinsic physical randomness in devices to generate an unbiased random binary code. Earlier, a PUF was demonstrated using a large area (10 µm × 10 µm) HfO2-based OTPM (One-Time Programmable Memory) where perfectly unbiased random bit generation was shown using differential breakdown operation. However, the use of conventional materials (e.g. PECVD SiO2) and scalability across mature nodes (10 μm–0.18 μm) are attractive for the IoT application of PUF. In this paper, we present a highly scalable PECVD SiO2 breakdown based differential OTPM PUF implemented in a 180 nm CMOS foundry. The experimental results on approximately 1700 tested differential OTPM PUF show that the random string generated is unique. i.e. mean Inter-Hamming distance of 50%. The generated string has excellent reproducibility i.e. ideal Intra-Hamming distance of 0% and no bit flip, even at 250 °C for 6 h. Excellent scalability (from area 26 µm × 26 µm to 0.26 µm × 0.26 µm) is observed. The PUF passes a variety of NIST tests successfully.

Investigation of Two Bits With Multistate Antifuse on nMOS Poly-Silicon Junctionless GAA OTP

One-time programmable (OTP) memory is essential to the security and gaming industries because of its ``write once, read many'' capability. This device supports N-metal-oxide-semiconductor polycrystalline-silicon junctionless gate-all-around (GAA) nanowire transistor technology and can perform multistate antifuse. It is capable of functioning in four states instead of in the standard two states (open/short). Furthermore, the states can be read as fully open (0, 0), drain-gate breakdown (0, 1), source-gate breakdown (1, 0), and full breakdown (1, 1) states. The antifuse is formed from the oxide breakdown between the gate and the source or drain (S/D). Moreover, because multiple samples have been successfully produced, its information can be displayed as a chart or table to instantly convey information about the current device's state to programmers by reading the S/D current.

An ESD-Protected, One-Time Programmable Memory Front-End Circuit for High-Voltage, Silicon-on-Insulator Technology

An electrostatic discharge (ESD)-protected one-time-programmable (OTP) memory front-end circuit, for high-voltage (HV) applications, designed and manufactured in silicon-on-insulator (SOI) technology, is presented. The SOI technology meets HV functional-isolation and level-shifting requirements but is not suitable for advanced analog circuits. The presented OTP memory is discussed as an introduction to digital programmability in the considered technology. The memory element consists of an antifuse type structure and is implemented using a 5-V nMOS with L=1 μm and W=1.2 μm. The cell memory allows for significant area and power savings in the adopted HV technology. Conditions for this require that an efficient ESD protection will guarantee safe operation, even in the presence of a small and fragile on-chip element whose undesired burning would compromise the programming mechanism, and consequently the reliability, of the circuit. Details about the circuit design implementation of the front-end circuit for both read and write circuits and ESD protection are described with experimental results validating the proposed implementation.

SOTPM: Software One-Time Programmable Memory to Protect Shared Memory on ARM Trustzone

In ARM TrustZone-based architecture, shared memory is one of the most useful schemes to enable isolated execution environments supported by TrustZone to communicate between environments. However, it is already known that shared memory is vulnerable to man-in-the-middle attacks since mechanisms to check integrity or authenticate callers for the shared memory payload are not supported in TrustZone. While an encryption-based method that resolves this limitation does exist, there are some architectural limitations. Indeed, even with key protection countermeasures applied, there is a risk that encryption keys may be leaked, as they are placed in insecure user memory during communication. Moreover, countermeasures for key leakage cause system performance overhead. In this paper, we propose a lightweight and secure scheme for shared memory, called Software One-Time Programmable Memory (SOTPM). SOTPM is a software-implemented, one-time programmable shared memory. It is based on the idea that payload encryption in the shared memory layer is unnecessary because sensitive data is already encrypted in the application layer before being written to the shared memory. SOTPM is set to read-only after data is written into SOTPM due to the one-time programmable characteristic. Therefore, attackers are unable to manipulate content in SOTPM during communication. Since it is not necessary for SOTPM to encrypt the payload in order to prevent malicious payload manipulation, it is possible to remove the risk of key leakage posed in previous studies. Additionally, in contrast with the existing method, our method can dramatically reduce system performance overhead. We implemented our prototype on an open-source hardware board with an Armv8-A processor and performed a security analysis and performance evaluation. The results show that SOTPM provides a sufficient level of security and less than 1% performance overhead, implying that SOTPM is a reasonable solution for current commercial products.

Ultra-thin oxide breakdown for OTP development in power technologies

OTP (One Time Programmable) memory in power technology enables electrical performance optimization together with area occupation reduction. In this paper, the aspects relative to the oxide breakdown (which is the key mechanism for memory programmability) are studied and applied to the development of an antifuse OTP cell in a 350 nm-CMOS power technology. The physical analysis of the degradation phases of an oxide layer is presented together with the physical models, exploited to foresee the device time-to-breakdown depending on applied voltage, oxide thickness etc. The achieved results are used in the development and reliable implementation of OTP cells in the target 350 nm-CMOS node.

Application of the Clustering Model to Time-Correlated Oxide Breakdown Events in Multilevel Antifuse Memory Cells

Time statistics for successive breakdown (BD) events in Al <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> O <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">3</sub> /HfO <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> -based nanolaminates aimed to the development of multilevel one-time programmable (OTP) memory cells is investigated. The clustering model is shown to account for the departure of the experimental data from the standard Weibull model attributed to the initial leakage current dispersion. An equivalent electrical circuit model is used to represent the stepwise current increase triggered by the appearance of multiple BD sites. Correlation effects in the order statistics are ascribed to a reduction of the effective stress voltage caused by the presence of a series resistance. It is shown that the E-model acceleration law for dielectric BD is consistent with the data obtained from our antifuse cells.

Origami for Tight Spaces - 3D 250C PCB Assemblies for Control Systems

Printed circuit board (PCB) assemblies must fit into unusual spaces for many real-life, high temperature applications such as sensors and actuators. This paper details the design and manufacture of a complex control circuit for a jet engine fuel flow valve. “Origami” was needed to fit this control circuitry into the tight space in the valve, this was achieved using a high temperature flex rigid PCB assembly. The valve was mounted on a hot section of the engine, and the assembly was tested for its capability to operate at 178°C and withstand multiple thermal cycles of −55°C and 175°C during its operational life. Various component joining media were investigated to extend the life of the assembly. The project also developed a one-time programmable (OTP) memory aimed at up to 300°C operation for on board memory to provide calibration data or boot memory for high temperature microcontrollers or processors. The device was based on Micro-Electro-Mechanical Systems (MEMS) technology.

Antifuse OTP Cell in a Cross-Point Array by Advanced CMOS FinFET Process

A new antifuse one-time programmable (OTP) memory array by the 16-nm FinFET high- $\pmb \kappa $ metal gate process is proposed and demonstrated. The OTP cells are programed by gate dielectric breakdown. The asymmetric ${I}$ – ${V}$ characteristics can be achieved by controlling the current compliance level during its programing operation. Based on the diode-like postbreakdown ${I}$ – ${V}$ characteristics, a high-density cross-point array without cell selectors is demonstrated, by the advanced FinFET CMOS technology.

14-nm FinFET 1.5 Mb Embedded High-K Charge Trap Transistor One Time Programmable Memory Using Differential Current Sensing

An 8Kx192b charge trap transistor one time programmable memory (OTPM) is designed and manufactured in GLOBALFOUNDRIES 14-nm bulk FinFET technology without process adders or additional masks. A write timer state machine issues multicycle 192b parallel programming with per bit overwrite protection to minimize stress conditions during a write. On-chip generated voltages are temperature dependent, enabling writes and reads at military grade temperatures. A differential current sense amplifier with self-biased margining circuitry enables programming the OTPM twin cell with known repeatable margin across process–voltage–temperature. Hardware qualification certifies the OTPM to a 10-year 105 °C data retention specification and <3 PPM end of life bit error rate pre-ECC.

A Highly Reliable and Unbiased PUF Based on Differential OTP Memory

Physically unclonable functions (PUF) are essential for hardware identity and security for IoT devices. The PUF consists of a multi-bit string that requires unbiased randomness. A one-time programmable memory (OTPM) uses insulator breakdown in metal-insulator-metal device to switch between insulating (“0”) and conducting (“1”) state. An OTPM based PUF produces an unbiased bit-string if exactly median breakdown voltage(VBD) and time are used. The exact application of median VBD is challenging in an integrated circuit as a conventional-voltage supply-tolerance specification is 10%. In this letter, we propose a differential OTPM-based PUF with a parallel circuit of two OTPM in series with a resistance. A high voltage stochastically produces a breakdown in one of the two OTPM first, which then reduces the voltage drop across the parallel OTPM circuit to prevent further breakdown events. The experimental results of differential OTPM PUF binary string generation show essentially unbiased randomness to demonstrate excellent resistance to supply voltage variation. Ideal uniqueness and reproducibility are observed. Thus, our approach enables PUF implementation with standard voltage supply tolerance and negligible post-processing.

Role of Ti Electrode on the Electrical Characterization of Filament within Al2O3 Based Antifuse

In this paper, we investigated the properties of conductive filament within Al2O3 dielectric for metal-insulator-metal (MIM) antifuse structure used for one-time programmable memory. The initial formed filament after breakdown is found to exhibit metallic behavior. The antifuse on-state resistance increases and transforms to a semiconducting-like filament when a negative voltage ranges from 0 V to −1 V is applied to the top Ti electrode. Consequently, the initial formed filament would grow larger resulting in resistance decrease if the positive sweep voltage is applied on top Ti. This opposite transition is found to be related with reactive material metal Ti, which can extract a large number of oxygen ions and produce oxygen vacancies at the Ti/Al2O3 interface. Furthermore, the oxygen vacancy density near the Ti electrode dominates the properties of the filament.

A High Reliable High-κ Antifuse Programmed by Intrinsic Overshoot Current

In this paper, we fabricated a W/Al2O3/Ti metal-insulator-metal (MIM) antifuse one-time programmable memory. A large current overshoot was observed during the dielectric breakdown, which generated a strong conductive filament and resulted in extremely low on-state resistance. The performance of this Al2O3-based antifuse has been demonstrated with an ultra large ON/OFF window on the order of 1012. Both breakdown voltage and on-state resistance exhibit excellent uniformity, the off-state lifetime is projected to be 1591 years at 2 V, and the on-state exhibits a reliable filament that is difficult to rupture.

A Battery-Assisted Passive EPC Gen-2 RFID Sensor Tag IC With Efficient Battery Power Management and RF Energy Harvesting

Herein, we present a fully integrated electronic product code (EPC) Gen-2 compatible battery-assisted passive (BAP) radio-frequency identification sensor tag integrated circuit (IC) with efficient power management. The key components of the tag IC include an adaptive radio-frequency (RF) energy harvester, a battery access controller (BAC), a storage capacitor charger, and a power-gated sensor block. External RF energy is efficiently harvested using dynamically controlled rectifying stages and a threshold-compensation technique. The BAC tightly controls the power path, cutting off leakage current from the battery. The power-gated sensor block supports multiplexed sensing operations in a power efficient manner. The sensor interface includes a chopper amplifier, a programmable gain amplifier, multiplexers, and an 8-bit ADC. For sensing data logging, custom designed nonvolatile memory is employed via one-time programmable memory. The digital control block is based on an EPCglobal Gen-2 standard that is modified to support the sensing operation. The tag chip was fabricated in a 1-poly 6-metal standard 0.18-μm standard CMOS process. The tag IC consumes ${\mathrm{1\;\mu A}}$ for leakage and active operation (0.1% duty), and the estimated lifespan of the BAP tag IC is about 0.2 year/mA·h.

Logic eFuse OTP 메모리 IP 설계

ABSTRACT In this paper, a logic eFuse (electrical Fuse) OTP (One-Time Programmable) memory IP (Intellectual Property) using only logic transistors to reduce the development cost and period of OTP memory IPs is designed. To secure the reliability of other IPs than the OTP memory IP, a higher voltage of 2,4V than VDD (=1.5V) is supplied to only eFuse links of eFuse OTP memory cells directly through an external pad FSOURCE coming from test equipment in testing wafers. Also, an eFuse OTP memory cell of which power is supplied through FSOURCE and hence the program power is increased in a two-dimensional memory array of 128 rows by 8 columns being also able to make the decoding logic implemented in small area. The layout size of the designed 1kb eFuse OTP memory IP with the Dongbu HiTek’s 110nm CIS process is 295.59㎛5 × 455.873㎛ (=0.134㎟). 키워드 : 로직 eFuse, OTP, 외부 프로그램 전압, 저면적 Key word : Logic eFuse, OTP, external program volta, small areaJournal of the Korea Institute of Information andCommunication Engineering