Tamper-Respondent PUF Enclosures

The Idea

A Physical Unclonable Function (PUF) integrated into a tamper-evident enclosure, such that any physical intrusion changes the PUF output. The PUF output is used as a cryptographic key for decrypting firmware, authenticating the device, or protecting sensitive data. If the enclosure is breached, the key changes, and the protected data becomes permanently inaccessible.

Unlike battery-backed tamper detection (which fails when the battery dies), PUF-based protection works passively—it doesn’t matter if the device is powered or not. The physical integrity of the enclosure is cryptographically verifiable.

Why It Matters

AI accelerators will often be in the physical possession of potentially adversarial actors. Traditional tamper-evident seals can be inspected but don’t actively protect secrets. Battery-backed tamper detection can be defeated by waiting for battery exhaustion. PUF enclosures provide:

• Passive protection: Works without power
• Cryptographic binding: Physical integrity tied to key material
• Unclonability: Can’t manufacture a duplicate enclosure with the same PUF
• Tamper evidence: Changes are detectable and irreversible

PUF Enclosure Mechanism

┌─────────────────────────────────────────────────────────┐
│              PUF ENCLOSURE BOUNDARY                     │
│  ┌───────────────────────────────────────────────────┐ │
│  │           SERPENTINE CONDUCTOR PATTERN            │ │
│  │  ╔═══════════════════════════════════════════╗   │ │
│  │  ║  Unique capacitance/resistance pattern    ║   │ │
│  │  ║  determined by manufacturing variation    ║   │ │
│  │  ╚═══════════════════════════════════════════╝   │ │
│  └───────────────────────────────────────────────────┘ │
│                          │                              │
│              ┌───────────▼───────────┐                 │
│              │   PUF MEASUREMENT     │                 │
│              │                       │                 │
│              │  Challenge → Response │                 │
│              │  K = f(PUF response)  │                 │
│              └───────────┬───────────┘                 │
│                          │                              │
│              ┌───────────▼───────────┐                 │
│              │   PROTECTED ZONE      │                 │
│              │                       │                 │
│              │  • Encrypted firmware │                 │
│              │  • Device secrets     │                 │
│              │  • Calibration data   │                 │
│              │                       │                 │
│              │  All encrypted with K │                 │
│              └───────────────────────┘                 │
└─────────────────────────────────────────────────────────┘

How Tampering Destroys Keys

Intrusion Type	Effect on PUF	Result
Drilling through enclosure	Breaks conductor traces, changes capacitance	Key changes; firmware unreadable
Chemical dissolution	Alters conductor geometry	Key changes
Delamination	Separates enclosure layers, changes field patterns	Key changes
X-ray imaging	May alter material properties with high doses	Potential key drift
Mechanical probing	Physical contact changes local properties	Key changes

The key isn’t “erased”—it becomes a different key that doesn’t decrypt the protected data.

PUF Types for Enclosures

PUF Type	Mechanism	Suitability
Coating PUF	Random particles in coating; capacitance measurement	Good for enclosure integration
Optical PUF	Random light scattering patterns	Good for one-time verification
SRAM PUF	Power-up state of memory cells	Not suitable (doesn’t detect enclosure breach)
Delay PUF	Path delay variations	Not suitable for enclosure
RF PUF	RF response of enclosure cavity	Good for detecting metallic intrusions

For enclosure protection, coating PUFs or RF PUFs are most appropriate.

Integration with Secure Boot

POWER-ON SEQUENCE:

1. Measure PUF response → derive key K

2. Attempt to decrypt bootloader with K
   - Success: bootloader intact, enclosure untampered
   - Failure: enclosure breached OR first boot

3. (First boot only) Encrypt bootloader with K, store

4. Execute bootloader

5. Bootloader verifies firmware signatures

6. System operational

If the enclosure is ever opened, step 2 fails permanently—the device becomes a brick.

Active Monitoring Mode

While powered, the PUF can be continuously monitored:

RUNTIME MONITORING:

1. Periodically re-measure PUF

2. Compare to expected response (with tolerance for noise)

3. If deviation exceeds threshold:
   - Zeroize secrets in RAM
   - Log tamper event
   - Optionally: trigger destructive response

This catches tampering that occurs while the device is operational.

Thermal/Mechanical Challenges for GPUs

AI accelerators dissipate 700-1200W and undergo significant thermal cycling. The PUF enclosure must:

Challenge	Solution
High heat flux	Thermally conductive enclosure materials (ceramic, AlN)
Thermal expansion	Design PUF patterns tolerant to predictable expansion
Liquid cooling compatibility	Enclosure compatible with cold plate mounting
Vibration	Mechanically robust conductor patterns
Long-term drift	Calibration and tolerance bands; periodic re-enrollment

The RAND paper acknowledges this is technically challenging but points to existing FIPS 140-4 certified devices as proof of feasibility.

Destructive Tamper Response Options

For high-security applications, PUF breach can trigger active destruction:

Method	Mechanism	Considerations
Capacitor discharge	High voltage destroys chip circuitry	Requires charged capacitors; safety concerns
Nanothermite	Exothermic reaction destroys chip	Experimental; regulatory issues
Antifuse activation	Blow fuses throughout chip	Requires design-time integration
Encryption key destruction	Zeroize keys, data becomes inaccessible	Non-destructive to hardware; data recovery impossible

For most governance applications, key destruction (making data inaccessible) is sufficient without physical destruction.

Open Questions

• Can PUF enclosures maintain stability over 5-10 year chip lifetimes with thermal cycling?
• What’s the manufacturing cost premium for PUF-integrated enclosures?
• How to handle legitimate repair/RMA without enabling tamper reset?
• Can PUF responses be made quantum-resistant?
• What’s the false positive rate for tamper detection under normal operation?
• Can enclosures be designed for the unique form factors of GPU modules (SXM, etc.)?

References

• RAND WR-A3056-1, Chapter 5: Protection Against Invasive Physical Attacks
• Immler et al., “B-TREPID: Batteryless Tamper-Resistant Envelope with a PUF and Integrity Detection”
• Obermaier & Immler 2018, PUF survey
• FIPS 140-4 physical security requirements