Blog Post
Giving Hardware a Verifiable Identity
RESCALE’s Hardware Fingerprinting Case Study
A Hardware Bill of Materials can describe the type, manufacturer, model, and expected configuration of a physical component. It cannot automatically prove that the specific device installed in a system is the same unit that was originally supplied.A component could be replaced or substituted during transport, integration, maintenance, or repair, while the related documentation remains unchanged.
RESCALE’s hardware fingerprinting case study explores how physical characteristics could provide a stronger connection between a device and its digital supply-chain record. The idea is to create evidence that depends on the physical properties of the component itself, rather than only on a printed serial number or externally assigned identifier.
Using Physical Differences Between Devices
Physical Unclonable Functions, or PUFs, use small manufacturing variations that naturally occur between devices. Two chips may share the same design and model number, but microscopic differences can influence memory startup states, signal delays, or oscillator frequencies. These variations can be measured and used to produce a device-specific response.
The case study reviews several approaches. SRAM PUFs use the preferred power-up states of memory cells. Arbiter PUFs compare the delay of signal paths, while Ring Oscillator PUFs compare the frequencies of oscillators affected by manufacturing variation. Each method has practical limitations. Some require direct physical access to the chip, while others are sensitive to temperature, voltage, routing, and nearby activity. Repeated measurements may also differ slightly, which means that error correction or fuzzy extraction may be needed to reproduce a stable result. A hardware fingerprint is therefore not created simply by taking one measurement and calculating a hash. It requires a controlled enrolment process and a reliable method for comparing later readings with the original reference.
Testing the Idea with GRiSP Hardware
The RESCALE case study examined a scenario in which a third-party processor is supplied as an external coprocessor for a GRiSP board. The goal was to explore whether the receiving organisation could verify that the processor was the same physical unit sent by the manufacturer.
The experimental setup included a GRiSP 2.0 board, a Dell Edge Gateway 5000, and two PIC12F1840 microcontrollers. The microcontroller acted as the external processor, while the Dell gateway collected timing measurements through a USB-to-serial connection. The selected method used variability in the PIC12F1840’s internal oscillator. The device repeatedly measured the number of instruction cycles completed within a one-millisecond window and transmitted the resulting timing values. In principle, a sufficiently stable subset of these measurements could form a fingerprint associated with that individual processor. A later measurement could then be compared with the enrolled reference.
What the Experiment Revealed
The case study identified two important practical challenges.
The first was physical access. Many fingerprinting methods require pin-level access to the component. This may be possible during manufacturing or when working with development boards, but it becomes much harder after a chip has been soldered into a finished product. The integrated memory on the GRiSP board was not suitable for the intended experiment, so the scenario was adapted to use an external processor.
The second challenge was measurement noise. The timing readings collected from the PIC12F1840 were not stable enough to create a functioning PUF. The variation between measurements made it impossible to isolate a sufficient number of repeatable values. Addressing this issue would require further work on temperature and voltage control, noise reduction, repeated enrolment measurements, threshold selection, and error-tolerant processing.
The case study is clear about this limitation. It did not produce a validated production-ready hardware fingerprint for the selected setup. Placeholder hashes were used to complete the wider design and demonstrate how the evidence could be represented within RESCALE.
Representing Fingerprints as Supply-Chain Evidence
One of the main outcomes of the work is a proposed way to represent hardware fingerprint information through CycloneDX.
The example structures include the target component, fingerprinting method, measurement configuration, raw sample sets, environmental conditions, statistical results, reliability information, and the processing steps used to derive the stable fingerprint. The relationships between these elements can also be recorded. For example, a stable fingerprint may depend on several raw sample sets and on the quantisation profile used to process them. The complete fingerprint document can remain off-chain under organisational control. Its canonicalised hash can then be registered through the RESCALE permissioned ledger and linked to the relevant TBOM or hardware-fingerprint record. Keeping fingerprint information separate from the general HBOM may also be useful. Several devices of the same model can share one component description while requiring a different fingerprint for each physical unit.
A Realistic Step Toward Stronger Hardware Assurance
Hardware fingerprinting could eventually help manufacturers, integrators, and operators verify that a component has not been substituted. It may be particularly useful for removable modules, accelerators, specialised processors, and other high-value components.
The RESCALE case study does not claim to have solved every practical challenge. Instead, it documents what is required, where the selected experiment encountered limitations, and how fingerprint evidence could fit into the wider trust architecture. This provides a realistic foundation for future work on linking physical device identity with machine-readable and verifiable supply-chain records.