Yu Zhuang

Yu Zhuang, Gaoxiang Li

Lightweight authentication is essential for resource-constrained Internet-of-Things (IoT). Implementable with low resource and operable with low power, Physical Unclonable Functions (PUFs) have the potential as hardware primitives for implementing lightweight authentication protocols. The arbiter PUF (APUF) is probably the most lightweight strong PUF capable of generating exponentially many challenge-response pairs (CRPs), a desirable property for authentication protocols, but APUF is severely weak against modeling attacks. Efforts on PUF design have led to many PUFs of higher resistance to modeling attacks and also higher area overhead. There are also substantial efforts on protocol development, some leverage PUFs' strength in fighting modeling attacks, and some others employ carefully designed protocol techniques to obfuscate either the challenges or the responses with modest increase of area overhead for some or increased operations for some others. To attain both low resource footprint and high modeling attack resistance, in this paper we propose a co-design of PUF and protocol, where the PUF consists of an APUF and a zero-transistor interface that obfuscates the true challenge bits fed to the PUF. The obfuscated PUF possesses rigorously proven potential and experimentally supported performance against modeling attacks when a condition is met, and the protocol provides the condition required by the PUF and leverages the PUF's modeling resistance to arrive at low resource overhead and high operational simplicity, enabling lightweight authentications while resisting modeling attacks.

Yu Zhuang, Khalid T. Mursi, Li Gaoxiang

Security is of critical importance for the Internet of Things (IoT). Many IoT devices are resource-constrained, calling for lightweight security protocols. Physical unclonable functions (PUFs) leverage integrated circuits' variations to produce responses unique for individual devices, and hence are not reproducible even by the manufacturers. Implementable with simplistic circuits of thousands of transistors and operable with low energy, Physical unclonable functions are promising candidates as security primitives for resource-constrained IoT devices. Arbiter PUFs (APUFs) are a group of delay-based PUFs which are highly lightweight in resource requirements but suffer from high susceptibility to machine learning attacks. To defend APUF variants against machine learning attacks, we introduce challenge input interface, which incurs low resource overhead. With the interface, experimental attack study shows that all tested PUFs have substantially improved their resistance against machine learning attacks, rendering interfaced APUF variants promising candidates for security critical applications.