Counterfeit devices are a growing threat to trust in electronic devices, involving the production and distribution of fake components or reselling out-of-spec ones. These pose risks like compromised functionality, security vulnerabilities, and economic losses when purchasing Commercial Off-The-Shelf (COTS) devices like FPGA and microcontrollers. To address this, we introduce VARI-CHECK, a low-overhead method for authenticating COTS devices. VARI-CHECK leverages inherent fabrication process variations to create digital signatures for device authentication. We validate this approach through experiments on FPGA devices, training a machine learning model to identify non-original devices. We test it on 100 oscillating/bistable circuit elements across 40 FPGA devices, achieving 80.4% success with Isolation Forest and 81.25% with One Class SVM.

The Field Programmable Gate Array (FPGA) market has seen significant growth due to the low cost and reduced time to market when compared to ASIC circuits. However, FPGAs’ reconfigurable nature introduces security vulnerabilities that can be exploited by adversaries to obtain sensitive information. Physical Unclonable Functions (PUFs) have shown to be valuable security primitives. By leveraging manufacturing variations in a device one can generate unique signatures that can be used for authentication and generation of secret keys. However, PUF implementation can be costly, taking up FPGA resources and requiring long design times. In this paper, we propose a method which takes advantage of the FPGA Look Up Table (LUT) architecture to embed the PUF into functional logic circuits, reducing the cost and design time. We provide detailed implementation guidelines and evaluate the PUF’s signature quality and stability under different environmental variations using a set of testbench circuits. Our results demonstrate the effectiveness of our method in securing FPGA designs while reducing implementation costs and design time.