Physical Unclonable Function Design Research Articles

Memristor Array Based on Wafer-Scale 2D HfS2 for Dual-Mode Physically Unclonable Functions.

Conventional Si-based physically unclonable functions (PUFs) take advantage of the unique variations in the fabrication processes. However, these PUFs are hindered by limited entropy sources and susceptibility to noise interference. Here we present a memristive device based on wafer-scale (2-in.) two-dimensional (2D) hafnium disulfide (HfS2) grown by molecular beam epitaxy (MBE). The polycrystalline HfS2 thin film can offer enhanced entropy sources for PUF applications, such as lattice defects, which can facilitate the random formation of conductive filaments and result in significant device-to-device (D2D) variations. Our proposed PUF design seamlessly integrates two distinct operating modes within a single circuit module. First, a reconfigurable and highly secure mode 1, and second, an ultrareliable mode 2, both with near-ideal Entropy (∼1.0), normalized Hamming distance (∼0.5) and correlation coefficient (∼0.0). Additionally, a predictive Fourier regression model further confirms the unpredictable nature of our dual-mode PUF, with an average prediction accuracy of ∼50%.

A lightweight reversible multi-mode physical unclonable function

Physical Unclonable Function (PUF), a hardware security primitive capable of generating unique fingerprints for chips, is crucial for Internet of Things (IoT) security. However, substantial hardware overhead, low reliability, and high power consumption have hindered the broad application of PUFs in lightweight IoT devices. This paper proposes a solution by leveraging the reversible logic paradigm in PUF design. Specifically, a Multi-Mode (M2) PUF is introduced and is based on configurable ring oscillators and transient effect rings. By configuring signal paths and internal delays, the M2 PUF efficiently generates numerous Challenge-Response Pairs (CRPs) with minimal hardware resources. Implemented on Xilinx Spartan-6 and Xilinx Virtex-7 FPGA platforms, it requires only 1.6 % of the hardware resources to generate a 1-bit response, significantly lower than existing state-of-the-art PUF solutions. The performance metrics for uniqueness, average native reliability, and reliability under different voltage conditions are impressive, registering at 48.23 %, 98.44 %, and 96.08 %, respectively. This structure represents an ideal solution for lightweight PUF design.

Enhancing the SRAM PUF with an XOR Gate

This study focuses on designing enhanced Physically Unclonable Functions (PUFs) based on SRAM devices and improving the security of cryptographic systems. Most SRAM PUFs are limited in their number of CRPs, which makes them vulnerable to enrollment attacks. In this research, we present an SRAM-based PUF design that greatly increases the number of CRPs and the entropy of the generated bits by performing exclusive-or (XOR) on the responses of two SRAM devices. This was implemented using a readily available development board, SRAM devices, and a user-friendly custom circuit board for cryptographic key generation. The cryptographic protocol was implemented using both C++ and python3. The proposed SRAM PUF design was experimentally demonstrated and showed substantial improvements in the security of various cryptographic applications as a hardware authentication device. It also addresses the specific vulnerabilities of legacy designs.

Anti-machine-learning-attack strong PUF design based on multi-path delay selection strategy

Physical unclonable functions (PUF) have significant potential for application in information security. However, strong PUFs are vulnerable to machine learning (ML) modeling attacks, which severely limit their application in device authentication. Despite a variety of resistance techniques, strong PUFs suffer from hardware cost and stability deficiencies. This study proposes an anti-machine-learning-attack strong PUF based on a multi-path delay selection strategy through research on the entropy source of a strong PUF and the delay signal selection mechanism. First, we constructed a deviation source circuit based on multiplexers to increase the diversity of the delay signal transmission paths. Second, we constructed a delay selection circuit based on the logic gates. This circuit dynamically selects the delay signals with the same transmission path in the deviation source using AND and OR gates. Subsequently, the deviation source and delay selection circuits were utilized to construct the delay module, and the interconnection module was inserted between the delay modules to achieve alternating appearances of different types of logic gates along the delay path. Finally, RS flip-flops were employed to make decisions on the bias signals with the same delay path, and the final response was output through an XOR operation. The proposed PUF was implemented on a Xilinx Artix-7 FPGA, and the prediction accuracy of the four typical ML models was below 59 % (with 500,000 challenge-response pairs as the training set). Moreover, the proposed PUF structure is scalable and exhibits better performance in terms of hardware cost and stability than existing classic structures.

Efficient Attacks on Strong PUFs via Covariance and Boolean Modeling

The physical unclonable function (PUF) is a widely used hardware security primitive. Before hacking into a PUF-protected system, intruders typically initiate attacks on the PUF as the first step. Many strong PUF designs have been proposed to thwart non-invasive attacks that exploit acquired CRPs. In this work, we propose a general framework for efficient attacks on strong PUFs by investigating from two perspectives, namely, statistical covariances in the challenge space and the design dependency among PUF compositions. The framework consists of two novel attack methods against a wide range of PUF families, including XOR APUFs, interpose PUFs, and bistable ring (BR)-PUFs. It can also exploit the knowledge of reliability information to improve attack efficiency with gradient optimization. We evaluate our proposed attacks through extensive experiments, running both software-based simulation and hardware implementations on FPGAs to compare with corresponding SOTA works. Considerable effort has been made in ensuring identical software/hardware conditions for a fair comparison. The results demonstrate that our framework significantly outperforms SOTA results. Moreover, we show that our framework can efficiently attack diverse PUF families built from entirely different types, while almost all existing works solely focused on attacking one or very limited number of PUF designs.

Memristive-Based Physical Unclonable Function Design of Authentication Architectures: A Systematic Review

Memristive-Based Physical Unclonable Function Design of Authentication Architectures: A Systematic Review

Physical unclonable function using photonic spin Hall effect

This study presents a novel method leveraging surface wave-assisted photonic spin Hall effect (PSHE) to construct physical unclonable functions (PUFs). PUFs exploit inherent physical variations to generate unique Challenge–Response pairs, which are critical for hardware security and arise from manufacturing discrepancies, device characteristics, or timing deviations. We explore PSHE generation-based PUF design, expanding existing design possibilities. With recent applications in precise sensing and computing, PSHE offers promising performance metrics for our proposed PUFs, including an inter-Hamming distance of 47.50% , an average proportion of unique responses of 62.5% , and a Pearson correlation coefficient of − 0.198. The PUF token demonstrates robustness to simulated noise. Additionally, we evaluate security using a machine learning-based attack model, employing a multi-layer perceptron (MLP) regression model with a randomized search method. The average accuracy of successful attack prediction is 9.70% for the selected dataset. Our novel PUF token exhibits high non-linearity due to the PSHE effect, resilience to MLP-based attacks, and sensitivity to process variation.

Advancing Hardware Security: A Review and Novel Design of Configurable Arbiter PUF with DCM-Induced Metastability for Enhanced Resource Efficiency and Unpredictability

As the Internet of Things (IoT) and Blockchain technologies continue to assert their dominance in the technical landscape, the demand to enhance security measures becomes foremost. In this context, Physical Unclonable Functions (PUFs) are widely used hardware security primitives that can be used to solve a wide range of security issues. To support hardware security solutions, this paper presents an extensive overview and analysis of the existing Physical Unclonable Functions (PUFs) used as True Random Number Generators (TRNGs). Recognizing the shortcomings of current PUF designs, we propose a configurable Arbiter PUF design employing Digital Clock Manager (DCM)-induced metastability as an entropy source, presenting a robust solution for evolving hardware security. To mitigate the adverse consequences of metastability, the proposed Arbiter PUF includes a Carry Chain primitive with four Flip-Flop clones. Acknowledging the constantly evolving IoT and Blockchain environment, the suggested configurable Arbiter PUF is made to satisfy the highest security standards. By exploiting the inherent variations in FPGA technology, we aim to reduce system resource and area consumption, aligning with the efficiency criteria of modern applications. The system's performance is additionally enhanced by an on-chip post-processing based on DSP. Simulation results demonstrate successful implementation on a Xilinx Basys-3 FPGA board, offering a scalable and efficient solution. The generated sequences of the proposed PUF undergo rigorous testing, including National Institute of Standards and Technology (NIST) statistical tests for uniqueness, reliability, and randomness. This holistic approach aims to improve the PUF's performance and security.

PARLE-G: Provable Automated Representation and Analysis Framework for Learnability Evaluation of Generic PUF Compositions

Besides enormous research efforts in the design of Physically Unclonable Functions (PUFs), its vulnerabilities are still being exploited using machine learning (ML) based model-building attacks. Due to inherent complicacy in exploring and manually converging to a strong PUF composition, the challenge of building ML-attack resistant PUFs continues. Hence, it becomes imperative to develop an automated framework that can formally assess the learnability of different PUF constructions and compositions to guide the designer to explore resilient PUFs. In this work, we present an automated analysis framework (PARLE-G), to formally represent and evaluate the Probably Approximately Correct (PAC) learnability of PUF constructions and their compositions. A high-level specification language PUF-G has been developed to structurally represent any PUF composition comprising a specified set of primitive components and composition operations. The tool takes a PUF design represented in PUF-G language as input and returns its PAC learnability result, identifying a suitable PAC learning algorithm and the PAC model parameters based on the input PUF design. PUF designs proven to be learnable by PARLE-G are segregated into different classes based on the asymptotic complexity of their learnability bounds. Such automated analysis helps a designer to make informed design choices, thereby strengthening a PUF construction from the architectural level.

A novel low hardware configurable ring oscillator (CRO) PUF for lightweight security applications

Physical unclonable function (PUF) is a promising hardware security primitive that can generate a unique secret key peculiar to each chip by extracting the differences of non-reproducible manufacturing variations for the same implementations. Although there are several types of PUF designs and structures, ring oscillator (RO) PUF is one of the most prominent PUFs due to its straightforward implementation and remarkable performance. However, the traditional RO-PUF does not support large sizes of input/output combinations or challenge-response pairs (CRPs), as it is called in the scope of PUFs. Consequently, RO-PUF is more vulnerable to adversary attacks which can reveal the PUFs’ CRPs using a machine learning approach. Increasing the size of RO-PUF's CRPs requires a high increase in the circuit size leading to unacceptable area overhead for lightweight applications. The primary technique used to increase RO-PUF CRPs’ size without increasing the size of the required hardware is to develop a configurable ring oscillator (CRO) PUF. In this paper, we propose a configurable logic unit (CLU) that can be utilized to build a low-hardware CRO-PUF. The proposed CLU consists of a 1-XOR gate and a 1-XNOR gate. Building a CRO-PUF using the proposed CLU dramatically increases the CRPs size while minimizing the required hardware. The proposed CRO-PUF achieves excellent evaluation results, with measured uniqueness of 50.1 %, uniformity of 49.45 %, and reliability of 98.33 %. These values are in close proximity to the ideal targets of 50 % for uniqueness and uniformity, and 100 % for reliability

CalyPSO: An Enhanced Search Optimization based Framework to Model Delay-based PUFs

Delay-based Physically Unclonable Functions (PUFs) are a popular choice for “keyless” cryptography in low-power devices. However, they have been subjected to modeling attacks using Machine Learning (ML) approaches, leading to improved PUF designs that resist ML-based attacks. On the contrary, evolutionary search (ES) based modeling approaches have garnered little attention compared to their ML counterparts due to their limited success. In this work, we revisit the problem of modeling delaybased PUFs using ES algorithms and identify drawbacks in present state-of-the-art genetic algorithms (GA) when applied to PUFs. This leads to the design of a new ES-based algorithm called CalyPSO, inspired by Particle Swarm Optimization (PSO) techniques, which is fundamentally different from classic genetic algorithm design rationale. This allows CalyPSO to avoid the pitfalls of textbook GA and mount successful modeling attacks on a variety of delay-based PUFs, including k-XOR APUF variants. Empirically, we show attacks for the parameter choices of k as high as 20, for which there are no reported ML or ES-based attacks without exploiting additional information like reliability or power/timing side-channels. We further show that CalyPSO can invade PUF designs like interpose-PUFs (i-PUFs) and (previously unattacked) LP-PUFs, which attempt to enhance ML robustness by obfuscating the input challenge. Furthermore, we evolve CalyPSO to CalyPSO++ by observing that the PUF compositions do not alter the input challenge dimensions, allowing the attacker to investigate cross-architecture modeling. This allows us to model a k-XOR APUF using a (k − 1)-XOR APUF as well as perform cross-architectural modeling of BRPUF and i-PUF using k-XOR APUF variants. CalyPSO++ provides the first modeling attack on 4 LP-PUF by reducing it to a 4-XOR APUF. Finally, we demonstrate the potency of CalyPSO and CalyPSO++ by successfully modeling various PUF architectures on noisy simulations as well as real-world hardware implementations.

A robust architecture of ring oscillator PUF: Enhancing cryptographic security with configurability

Physically Unclonable Functions (PUFs) are becoming more widely recognized as tamper-resistant, high-entropy hardware security primitives. Leveraging the intrinsic manufacturing properties of integrated circuits, PUFs provide a lightweight, cost-effective technique for device identification and cryptographic key generation. Despite the existence of various PUF designs and architectures, the ring oscillator (RO) PUF stands out as one of the most notable. This significance is due to its simplicity of implementation and outstanding performance metrics. However, traditional RO-PUFs are often classified as weak PUFs because they support a limited size of input-output combinations. This paper introduces a configurable inversion unit designed to construct a lightweight, robust architecture configurable (RAC) RO-PUF. The proposed unit comprises an XOR gate, an XNOR gate, and a multiplexer. The RACRO-PUF significantly increases the size of generated output bits while efficiently utilizing minimal hardware resources. The performance of the RACRO-PUF stands out in evaluations, recording a uniqueness of 49.78 %, uniformity of 49.42 %, reliability of 97.72 %, and impressive randomness of 98.34 %.

FPGA-Based PUF Designs: A Comprehensive Review and Comparative Analysis

Field-programmable gate arrays (FPGAs) have firmly established themselves as dynamic platforms for the implementation of physical unclonable functions (PUFs). Their intrinsic reconfigurability and profound implications for enhancing hardware security make them an invaluable asset in this realm. This groundbreaking study not only dives deep into the universe of FPGA-based PUF designs but also offers a comprehensive overview coupled with a discerning comparative analysis. PUFs are the bedrock of device authentication and key generation and the fortification of secure cryptographic protocols. Unleashing the potential of FPGA technology expands the horizons of PUF integration across diverse hardware systems. We set out to understand the fundamental ideas behind PUF and how crucially important it is to current security paradigms. Different FPGA-based PUF solutions, including static, dynamic, and hybrid systems, are closely examined. Each design paradigm is painstakingly examined to reveal its special qualities, functional nuances, and weaknesses. We closely assess a variety of performance metrics, including those related to distinctiveness, reliability, and resilience against hostile threats. We compare various FPGA-based PUF systems against one another to expose their unique advantages and disadvantages. This study provides system designers and security professionals with the crucial information they need to choose the best PUF design for their particular applications. Our paper provides a comprehensive view of the functionality, security capabilities, and prospective applications of FPGA-based PUF systems. The depth of knowledge gained from this research advances the field of hardware security, enabling security practitioners, researchers, and designers to make wise decisions when deciding on and implementing FPGA-based PUF solutions.

A 3.02 pJ/Bit 3T-APS-Based In-Sensor Strong PUF Featuring Near-100% Hardware Reuse Ratio and High Resilience to Machine Learning Attacks

In this brief, we present an energy-efficient in-sensor strong physical unclonable function (PUF) based on the static entropy of 3-transistor active pixel sensor (3T-APS) structure that is widely-adopted in the CMOS image sensors (CIS). With ultra-small silicon area overhead of 0.25% dedicated to the added bias circuitries for column line and digital comparator for PUF bit generation, traditional 3T-APS-based CIS can be well-reused to construct the proposed strong PUF for authenticating the recorded images or videos. Taking advantage of the inherent high-resolution pixel array of CIS, the proposed strong PUF significantly extends the challenge-response-pair (CRP) space of the previous implementations. In addition, large CRP nonlinearity can be obtained by biasing the selected 3T-APS pixels at the subthreshold region, which further increases the complexity of the above extended CRP space and its resilience to various machine learning (ML) attacks. Moreover, the proposed strong PUF design is validated by the extensive measurement results of the prototype chips fabricated using a standard 65-nm CMOS process. Featuring a low energy consumption of 3.02 pJ/bit and a high area efficiency of 1.64×1033 bit/F2, prediction error of 49.1% 51.84% can be achieved under various ML attacks based on artificial neural network, logistic regression, support vector machine and covariance matrix adaptation evolution strategy, with the number of adopted CRPs for training up to 10 million.

Machine learning attacks resistant strong PUF design utilizing response obfuscates challenge with lower hardware overhead

Physical unclonable function (PUF) is a hardware security primitive with significant application potential. However, strong PUF is vulnerable to machine learning attacks based on modeling attacks. Although various resistance techniques have been proposed, strong PUF suffers from deficiencies in its resistance to machine learning attacks, hardware overhead, and reliability. This study proposes a highly reliable and secure lightweight PUF that complicates the original challenge using an internal response. Specifically, the internal response is used to determine the odd/even bit flip or left/right cyclic shift of the original challenge to achieve preliminary obfuscation, and byte substitution that exploits an S-box is performed on the preliminary obfuscated challenge to achieve deep nonlinear obfuscation. Experimental results on a Xilinx Artix-7 FPGA show that the proposed PUF is not only highly resistant to machine learning (ML) attacks but also has a low hardware overhead. An arbiter PUF(APUF), which uses the proposed obfuscated scheme with a 64-bit challenge length, was evaluated by three advanced machine learning algorithms with up to 600,000 challenge–response-pairs (CRPs) in the dataset, and the observed prediction accuracy was less than 56 %. Moreover, the PUF is unique, reliable, and has a significantly lower hardware overhead than other prior anti-attack PUFs.

Low-overhead XOR Multi-PUF against machine learning attacks

Physical unclonable functions (PUF) have been a hot research topic in hardware security in recent years. Still, most of the research has not focused on the design of balancing its resistance to machine learning attacks with resources. Therefore, in this paper, a new low-overhead XOR Multi-PUF design is proposed, which achieves the response of outputting different modes of PUFs with configurable bits to change the number of delays and inverters inside the circuit, completing the PUF design with less hardware overhead. It also introduces an input challenge obfuscation mechanism to improve its resistance to machine learning attacks. In this paper, the proposed PUF circuit design is verified on FPGA boards and good performance metrics are obtained. The design has more challenge-response pairs (CRPs) and less hardware overhead than existing PUF low-overhead designs, improving resistance to machine learning attacks.

ANV-PUF: Machine-Learning-Resilient NVM-Based Arbiter PUF

Physical Unclonable Functions (PUFs) have been widely considered an attractive security primitive. They use the deviations in the fabrication process to have unique responses from each device. Due to their nature, they serve as a DNA-like identity of the device. But PUFs have also been targeted for attacks. It has been proven that machine learning (ML) can be used to effectively model a PUF design and predict its behavior, leading to leakage of the internal secrets. To combat such attacks, several designs have been proposed to make it harder to model PUFs. One design direction is to use Non-Volatile Memory (NVM) as the building block of the PUF. NVM typically are multi-level cells, i.e, they have several internal states, which makes it harder to model them. However, the current state of the art of NVM-based PUFs is limited to ‘weak PUFs’, i.e., the number of outputs grows only linearly with the number of inputs, which limits the number of possible secret values that can be stored using the PUF. To overcome this limitation, in this work we design the Arbiter Non-Volatile PUF (ANV-PUF) that is exponential in the number of inputs and that is resilient against ML-based modeling. The concept is based on the famous delay-based Arbiter PUF (which is not resilient against modeling attacks) while using NVM as a building block instead of switches. Hence, we replace the switch delays (which are easy to model via ML) with the multi-level property of NVM (which is hard to model via ML). Consequently, our design has the exponential output characteristics of the Arbiter PUF and the resilience against attacks from the NVM-based PUFs. Our results show that the resilience to ML modeling, uniqueness, and uniformity are all in the ideal range of 50%. Thus, in contrast to the state-of-the-art, ANV-PUF is able to be resilient to attacks, while having an exponential number of outputs.

CBDC-PUF: A Novel Physical Unclonable Function Design Framework Utilizing Configurable Butterfly Delay Chain Against Modeling Attack

Physical unclonable function (PUF) is a promising security-based primitive, which provides an extremely large number of responses for key generation and authentication applications. Various PUFs have been developed as central building blocks in cryptographic protocols and security architectures, however, the existing PUFs and their improvements are still vulnerable to modeling attacks (MA) with refined machine learning algorithms. In this article, a configurable butterfly delay chain-based PUF design framework is proposed to meet the requirements of randomness, reliability, uniqueness, and MA-resistance metrics. A configurable butterfly delay chain is introduced to create multiple pairs of symmetric paths and a strong PUF relying on the intrinsic delay fluctuations of two identical paths is built. Furthermore, a secure hash function is used to insert non-linearities into the PUF, and a BCH-based error correction algorithm is utilized to recover the actual responses under noisy environments. The proposed PUF is implemented on Xilinx FPGAs and three machine learning algorithms are used to evaluate the resistance against MA. Experimental results show that the randomness, reliability, and uniqueness of the proposed PUF are close to the ideal value (49.6%, 99.9%, and 49.9%, respectively), and the prediction accuracy reaches 50% that indicating a desirable resilient to MA.

MLMSA: Multilabel Multiside-Channel-Information Enabled Deep Learning Attacks on APUF Variants

To improve the modeling resilience of silicon strong physical unclonable functions (PUFs), in particular, the APUFs that yield a very large number of challenge response pairs (CRPs), a number of composited APUF variants such as XOR-APUF, interpose-PUF (iPUF), feed-forward APUF (FF-APUF), and OAX-APUF have been devised. When examining their security in terms of modeling resilience, utilizing multiple information sources such as power side channel information (SCI) or/and reliability SCI given a challenge is under-explored, which poses a challenge to their supposed modeling resilience in practice. Building upon multi-label/head deep learning model architecture, this work proposes Multi-Label Multi-Side-channel-information enabled deep learning Attacks (MLMSA) to thoroughly evaluate the modeling resilience of aforementioned APUF variants. Despite its simplicity, MLMSA can successfully break large-scaled APUF variants, which has not previously been achieved. More precisely, the MLMSA breaks 128-stage 30-XOR-APUF, (9,9)-and (2,18)-iPUFs, and (2,2,30)-OAX-APUF when CRPs, power SCI and reliability SCI are concurrently used. It breaks 128-stage 12-XOR-APUF and (2,2,9)-OAX-APUF even when only the easy-to-obtain reliability SCI and CRPs are exploited. The 128-stage six-loop FF-APUF and one-loop 20-XOR-FF-APUF can be broken by simultaneously using reliability SCI and CRPs. All these attacks are normally completed within an hour with a standard personal computer. Therefore, MLMSA is a useful technique for evaluating other existing or any emerging strong PUF designs.

A Theoretical Framework for the Analysis of Physical Unclonable Function Interfaces and Its Relation to the Random Oracle Model

Analysis of advanced physical unclonable function (PUF) applications and protocols relies on assuming that a PUF behaves like a random oracle; that is, upon receiving a challenge, a uniform random response with replacement is selected, measurement noise is added, and the resulting response is returned. In order to justify such an assumption, we need to rely on digital interface computation that to some extent remains confidential—otherwise, information about PUF challenge–response pairs leak with which the adversary can train a prediction model for the PUF. We introduce a theoretical framework that allows the adversary to have a prediction model (with a typical accuracy of 75% for predicting response bits for state-of-the-art silicon PUF designs). We do not require any confidential digital computing or digital secrets, while we can still prove rigorous statements about the bit security of a system that interfaces with the PUF. In particular, we prove the bit security of a PUF-based random oracle construction; this merges the PUF framework with fuzzy extractors.