Physical Unclonable Functions (PUFs) have emerged as a suitable implementation of hardware-based trust anchors, enabling secure key storage, device authentication, and software protection. Continuing research and developments have led to elevated technology readiness and highlight the potential of carbon nanotube fieldefect transistors (CNTFETs) as the foundation for next-generation PUF architectures due to their high entropy, robustness, and thermal stability. In this work, we investigate 12×12 crossbar arrays composed of CNTFETs fabricated by scalable wafer-level manufacturing. We describe the measurement setup used to characterize the transistors and present the resulting electrical data. We analyze the impact of parasitic currents introduced by the interconnection of transistors' terminals, assessing their influence on the stability and reliability of the PUF response. Finally, we outline the design considerations and implementation constraints for interfacing the CNTFET matrix with an FPGA for digital readout, including an analysis of potential vulnerabilities introduced through this integration.
CEUR Workshop ISSN1613-0073
GND
A ID,agg VDS A ID,col VDS A I G VGS
To ease the measurement process by reducing the number of required contact pads, we embedded the
CNTFETs in an 12 × 12 on-wafer crossbar array, as illustrated in Figure 1. The CNTFETs are arranged
into 12 rows, where the source terminals are connected horizontally and the drain terminals vertically.
Further, the gate terminals of all CNTFETs are interconnected. The configuration shown on the left
in Figure 1 illustrates the selective measurement of a single CNTFET: one source pad is connected to
ground (GND), all other source and drain pads are biased to . Then, the current ,
the drain pad connected to the drain of the selected transistor is measured using an ammeter (A). To
lfowing into
derive a binary PUF response, a threshold is then chosen that uniformly groups the CNTFETs into a
lower-current (non-conducting) and higher-current (conducting) set [
In an ideal scenario, the gate terminal of a CNTFET would be perfectly electrically isolated from
its source and drain terminals. In practice, however, leakage currents can flow between the gate and
the source or drain. In the crossbar configuration, such leakage afects the measurement of
currents are drawn from, or flow into, the measured drain column. As a result, the separation between
conducting and non-conducting states in the individual CNTFETs becomes less distinct. While gate
leakage also occurs in isolated CNTFETs, in that case, the efect is confined to the probed transistor
and does not propagate through the array. In the interconnected crossbar, by contrast, the leakage
influences multiple measurement paths, complicating the design of a universal quantization scheme
when
based on a single threshold [
In this work, we evaluate leakage efects in the crossbar through comprehensive electrical measurements, outline how to derive an equivalent resistive circuit model to analyse parasitic currents, and present the future steps to improve the read-out architecture, including FPGA-based interfacing. The main contributions of this work are as follows: • Electrical characterization of CNTFETs implemented in a 12×12 on-wafer crossbar array, including measurement of individual cell transfer characteristics and analysis of their behaviour within an interconnected structure. • Suggestion of a method to identify and localize parasitic currents in the crossbar interconnect network, enabling diferentiation between leakage paths and intrinsic cell behaviour. • Proposal of an FPGA-based read-out architecture employing a voltage-readout active switch matrix, as outlined in the research plan, to facilitate scalable PUF evaluation and eventual integration into dedicated ICs.
Hu et al. [
Practical system integration, such as into an FPGA-based platform, is still missing. We try to close this gap by analyzing a readout concept that can be interfaced with standard analog-to-digital converters (ADCs), enabling a more direct path toward integration into resource-constrained systems. While the progress to date was obtained from passive crossbar arrays using precision source-measure units (SMUs), the research plan outlines an active voltage-readout architecture currently in fabrication, designed to mitigate leakage efects, simplify measurement circuitry, and support scalable on-chip evaluation.
biased with .
To evaluate the electrical behaviour of the CNTFETs, we experimentally approximate their transfer characteristics, i.e., the relationship between their intrinsic drain current and the gate-source voltage
at a constant drain-source voltage . As the CNTFETs in the crossbar are not electrically isolated, cannot be measured directly; instead, we approximate it by the current , lfowing into the corresponding drain column. For each of the 144 CNTFETs in the 12 × 12 crossbar array, we record the following quantities: 1. The electrical current ,
measured at the drain pad connected to the drain terminal of the selected CNTFET including periphery when biased with . 2. The aggregate drain-source current , agg measured at all other source and drain pads when 3. The current measured at the gate pads when biased with .
The transfer curve of the selected CNTFET derived from , enables the assessment of its behaviour under various quantization models, by picking the required values from the curve. The additional two measurements provide insight into leakage currents propagated by the interconnected structure.
Measurements are performed directly on on-wafer crossbar structures using a wafer probing station
equipped with a dedicated 28-needle probe card. All input/output lines are routed to a custom-built
switch matrix [
over To date, we have characterized CNTFETs in more than 100 diferent crossbar arrays using = ±0.5 V ∈ {2.0 V, 1.8 V, … , −2.0 V}, with a general current limit of 10 μA. The evaluated crossbars are categorized according to their fabrication parameters; in the following, we present results obtained from the arrays fabricated with the most promising parameter sets and that exhibit aforementioned leakage efects in their crossbar. the left-side plots corresponds to the , row represents the .
Figure 2 summarizes the results for the configuration = −0.5 V and
= ±2.0 V. Each row in
values measured for one crossbar, where each bar within a
measurement for one CNTFET. The measured currents predominantly range
from −200 nA to −0.1 nA. These results confirm the problem outlined in Section 1.1: while individually
probed CNTFETs exhibited a clear separation between the two states in our previous work [
currents for selected crossbars that exhibit leakage. In the left-hand scatter plots, each row corresponds to one crossbar, and each bar within a row represents the , value measured for a selected CNTFET. A small number of currents lie outside of the displayed region (towards 0). The right-hand heatmaps visualize the same measurements as color maps, enabling analysis of spatial correlations within each crossbar. The upper plots show results for = −2.0 V, while the lower plots show results for = 2.0 V. to the aforementioned leakage paths, which are assumed to scale with crossbar array size, complicating distinctive response for the used 12x12 crossbars.
Nonetheless, two distinct clusters can be observed for each structure, enabling the definition of a threshold for almost stable quantization. Table 1 lists the percentage of CNTFETs classified as conducting under various ,
thresholds, derived from the transfer characteristics shown in Figure 2. Among the presented crossbars, the most stable quantization occurs at a threshold of approximately −6 nA to −5 nA, where the change in the proportion between conducting versus non-conducting is minimal. Crossbars A-C exhibit a strong bias toward non-conducting CNTFETs, while crossbar H is biased toward conducting transistors. The remaining crossbars achieve an acceptable uniformity of around 45% conducting cells. Still, error-correcting measures such as cell selection would be required to achieve perfect uniformity, thereby reducing the available PUF response width.
In order to analyse the leakage behaviour observed during measurements, the recorded current values are used to mathematically derive an equivalent resistive circuit of the crossbar array for a given (
, ) configuration. The resistances are approximated iteratively such that the simulated network reproduces the experimentally measured currents. The equivalent circuit model provides a spatial map of the array, highlighting cells that exhibit excessive gate leakage or short circuits between their terminals. This could be an perspective standard proccess during enrollment of the PUF in order to support cell selection for initial trimming and entropy improvement.
As an illustrative example, Figure 3 shows a proof-of-concept simulation performed on a 2 × 2 subsection of the array. In this preliminary model, resistance values were adjusted manually to qualitatively reflect leakage phenomena observed during measurements. It demonstrates how the equivalent circuit approach can reveal abnormal leakage paths and localize them to specific cells and terminals. In the minimal-leakage case (left), current flows through the measured CNTFET as well as through the other CNTFETs in the grounded source row. In the leakage case (right), additional current from the gate flows into the drain column, reversing the sign of ,
. Depending on the location of the gate leakage relative to the measured CNTFET and the corresponding recorded values, these leakage paths can reliably be identified.
To enable crosstalk-free addressing of individual PUF cells, the passive crossbar structure will be extended to an active matrix. In this design, the PUF circuitry is placed inside a cell activated by thin-film FETs, allowing selective activation of individual CNTFETs. Further, it includes an adjustable potentiometer that enables read out of voltages instead of currents. The goal is to distinguish an additional state from the fully conducting and fully insulating states. This enables ternary response extraction, which can increase the entropy per cell and provide a richer feature set for PUF evaluation. The layout for this structure has already been finalized, and the corresponding wafers are currently in fabrication.
Building upon the voltage-readout active switch matrix described in the previous section, the analog output voltages of the selected CNTFET cells will be digitized using an FPGA with integrated multichannel ADCs. Within the FPGA, the digitized outputs will be processed to perform binary or ternary GND , , into the measured drain column. Yellow dotted arrows indicate the dominant current paths. quantization. For binary quantization, a single threshold voltage will be applied to the digitized value. For ternary quantization, the same CNTFET will be measured twice—once in the gate-on state and once in the gate-of state and the resulting digitized valus compared. The FPGA-based approach serves as an intermediate prototyping step toward eventual integration of the PUF into a dedicated IC.
In the final stage, the integrated PUF system will be subjected to a comprehensive security evaluation.
First, potential vulnerabilities to power analysis will be investigated. In particular, the efect of
electromagnetic (EM) emanations [
Beyond electrical side-channel analysis, optical probing via photon emission microscopy [
Fabrication delays, electrotechnical faults or lack of precise equipment may conflict with the desired goals of the research. The voltage-readout active switch matrix may exhibit electrotechnical limitations, such as leakage through the thin-film transistors. Further, the diferential between the output voltage of conductive and non-conducting cells may be too minor to accurately be distinguished by the ADCs in customer-grade FPGAs. Should this occur, an FPGA interface can still be designed and validated under the assumption of a theoretical PUF that produces idealized output values. Similarly, the security evaluation can be carried out on the readout circuitry in isolation, without requiring a fully functional PUF.
This work addresses the challenge of reliably extracting PUF responses from CNTFETs integrated in an 12x12 interconnected crossbar array. While individually probed CNTFETs exhibit a clear distinction between conducting and non-conducting states, measurements in the crossbar configuration revealed reduced separation due to parasitic currents propagating through the shared wirings. In particular, gate leakage in a single CNTFET can influence multiple measurement paths, altering the transfer characteristics of neighbouring cells and degrading the quality of the derived PUF responses. In response, we derived a new measurement procedure that additionally records the aggregate currents lfowing to the non-selected drain and source pads of the crossbar array. This aids in identifying the points of leakage inside the structures.
The next intermediate milestone in this project is the implementation of a leakage-localization method based on equivalent resistive circuit modelling, in parallel to the preparation of a measurement setup for the voltage-readout active switch matrix currently in fabrication. These steps will provide the foundation for evaluating improved read-out architectures and their integration with FPGA-based processing in cyber-physical systems.
During the preparation of this work, the authors used Grammarly and Chat-GPT4 and Chat-GPT5 for sentence polishing. After using these tools, the authors reviewed and edited the content as needed and take full responsibility for the publication’s content.