Strong PUF Research Articles

Key space estimation and security analysis of superlattice physical unclonable function

The key space, a crucial metric in discerning the strength of PUFs, holds significant importance for their security. However, there is insufficient research on superlattice PUFs. This paper integrates superlattice into the PUF theory framework, exploring its physical mechanisms and properties. The focus is on estimating the key space of superlattice PUFs and conducting a security analysis, encompassing resistance to brute force cracking, birthday attacks, and cloning attacks. The results show that its key space can be up to 24,500×50, with a huge number of Challenge-Response Pairs (CRP) set, belonging to strong PUF. It has significant advantages over conventional PUFs, making it applicable in the domains of cryptography and information security.

PN-APUF: A MOSFET threshold loss based strong arbiter PUF with double-edge sampling

PN-APUF: A MOSFET threshold loss based strong arbiter PUF with double-edge sampling

Lightweight Strong PUF for Resource-Constrained Devices

Physical Unclonable Functions are security primitives that exploit the variation in integrated circuits’ manufacturing process, and, as a result, each instance processes applied stimuli differently. This feature can be used to provide a unique fingerprint of the electronic device, or as an interesting alternative to classic key storage methods. Due to their nature, they are often considered an element of the Internet of Things nodes. However, their application heavily depends on resource consumption. Lightweight architectures are proposed in the literature but are technology-dependent or still introduce significant hardware overhead. This paper presents a lightweight, Strong PUF based on ring oscillator architecture, which offers small hardware overhead and sufficient security levels for resource-constrained Internet of Things devices. The PUF design utilizes a Linear Feedback Shift Register-based scramble module to generate many challenge–response pairs from a small number of ring oscillators and a control module to manage the response generation process. The proposed PUF can be used as a Weak PUF for key generation or a Strong PUF for device authentication.

Data Remanence Based Approach towards Stable Key Generation from Physically Unclonable Function Response of Embedded SRAMs using Binary Search

Today’s device authentications in IoT devices use public and private key cryptography. Nevertheless, they are still vulnerable to threats because keys or device IDs digitally stored in IoT devices can be stolen or cloned. In contrast, SRAM PUFs utilize physical variations in memory cells of embedded SRAM in microcontrollers or standalone SRAM chips. These inherent physical characteristics are unpredictable and practically impossible to duplicate. They are negligible to affect regular SRAM operation but large enough to be used for authentication purposes in SRAM PUFs operation. However, SRAM PUFs have poor stability and a relatively high bit error rate (BER). Temporal Majority Voting (TMV) and other error correction codes (ECCs) have improved SRAM PUFs performance, but they require a lot of processing time and hardware resources. The data remanence nature of SRAM cells can be utilized to select SRAM PUFs bits with much lower BER and more stable bits, but a suitable algorithm is required to find the best possible power-off time for each type of chip. This paper proposes using the data remanence method and binary search algorithm to obtain the strong SRAM PUFs characteristics of the selected SRAMs at the optimal power-off time. These SRAMs include embedded SRAMs of AtMega328P, STM32F108C, ESP8266 microcontrollers, and an off-the-shelf SRAM chip 23LC1024-I/P, which are being used in various IoT applications. The strong SRAM PUF has more stable characteristics that reduce BER to 0% and increase stability to 99.999%. This proposed method can be utilized on any IoT platform which deals with essential data and requires less resource-hungry security and authentication protocols.

FOM-CDS PUF: A Novel Configurable Dual State Strong PUF Based on Feedback Obfuscation Mechanism against Modeling Attacks

The configurable Ring oscillator Physical unclonable function (CRO PUF) is the newly proposed strong PUF based on classic RO PUF, which can generate exponential Challenge-Response Pairs (CRPs) and has good uniqueness and reliability. However, existing proposals have low hardware utilization and vulnerability to modeling attacks. In this paper, we propose a Novel Configurable Dual State (CDS) PUF with lower overhead and higher resistance to modeling attacks. This structure can be flexibly transformed into RO PUF and TERO PUF in the same topology according to the parity of the Hamming Weight (HW) of the challenge, which can achieve 100% utilization of the inverters and improve the efficiency of hardware utilization. A feedback obfuscation mechanism (FOM) is also proposed, which uses the stable count value of the ring oscillator in the PUF as the updated mask to confuse and hide the original challenge, significantly improving the effect of resisting modeling attacks. The proposed FOM-CDS PUF is analyzed by building a mathematical model and finally implemented on Xilinx Artix-7 FPGA, the test results show that the FOM-CDS PUF can effectively resist several popular modeling attack methods and the prediction accuracy is below 60%. Meanwhile it shows that the FOM-CDS PUF has good performance with uniformity, Bit Error Rate at different temperatures, Bit Error Rate at different voltages and uniqueness of 53.68%, 7.91%, 5.64% and 50.33% respectively.

Modeling-Attack-Resistant Strong PUF Exploiting Stagewise Obfuscated Interconnections With Improved Reliability

This article presents an obfuscated-interconnection physical unclonable function (OIPUF) to resist modeling attacks. By introducing nonlinear operations through exploiting the random interconnections of delay stages, the proposed OIPUF can theoretically improve the PUF security while consuming the same hardware resources as the conventional XOR Arbiter PUF (XOR APUF). We further propose the metastability-detection (MD) arbiter to effectively improve the PUF reliability. Implemented on Xilinx Artix-7 FPGA, both the proposed (64,4)-and (64,8)-OIPUF demonstrate a good reliability and uniformity, with the proposed (64,8)-OIPUF showing a better uniqueness and strict avalanche criterion (SAC) performance. Measurement results also show that the proposed MD arbiter can reduce the bit error rate (BER) of the (64,4)-and (64,8)-OIPUF by.68 and.48 at up to 100.C, respectively. Evaluated using the Logistic Regression (LR), Artificial Neural Network (ANN), and Covariance Matrix Adaptation-Evolution Strategy (CMAES) machine learning (ML) algorithms, the proposed (64,4)-and (64,8)-OIPUF can achieve a worst case prediction accuracy of 61.47% and 50.59% with up to 10M CRPs as training set, respectively, demonstrating a significant improvement over similar prior arts.

An Entropy-Source-Preselection-Based Strong PUF With Strong Resilience to Machine Learning Attacks and High Energy Efficiency

This paper presents an entropy-source-preselection-based strong PUF (ESP-PUF). Through the presented entropy-source-preselection scheme, we will convert first the input challenge bits of the ESP-PUF into the entropy selection signals through the front-end selection network, realized based on an XOR tree. Then the entropy selection signals serve as the power-on indicator to randomly select the back-end entropy sources to generate the raw responses. Utilizing this preselection scheme, we can fulfill both ultra-low power and strong resilience to machine learning (ML) attacks. An effective randomness-enhancement block amplifies the randomness of the raw responses thus alleviating their bias. Moreover, we propose an obfuscation-based protection mechanism to further protect the root challenge-response pairs (CRPs) of the entropy sources and enhance the resilience to ML attacks. Fabricated in 65nm CMOS LP technology, the proposed ESP-PUF shows a high energy efficiency of 0.46pJ/bit. Meanwhile, it demonstrates an average bit-error rate (BER) of 5.83% in the worst-case for the temperature range of −20°C to 120°C and a supply voltage variation of ±10%. The proposed CRPs filtering method can suppress the worst-case BER to a value <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$&lt; 6.7\times 10 ^{-6}$ </tex-math></inline-formula> , presenting high stability. The proposed ESP-PUF occupies an active area of 0.0122 mm2. After training for 1M CRPs samples, the prediction accuracy of the adopted ML algorithms is still ~50%, confirming a strong resilience of the proposed ESP-PUF.

A Weak PUF-Assisted Strong PUF With Inherent Immunity to Modeling Attacks and Ultra-Low BER

This paper presents a weak PUF-assisted strong PUF that combines the metrics between weak and strong PUFs. Unlike the conventional strong PUFs that rely on the nonlinear combination of a large number of entropy cells for high modeling attacks resilience, the presented strong PUF utilizes unique key streams to bitwise encrypt the raw responses from the conventional strong PUF to facilitate an inherent immunity to modeling attacks thus fulfilling high-level security. A device-specific pseudo-random number generator (P-RNG) configured by a dedicated weak PUF array generates a unique key stream (K). Since the weak PUFs are inherently immune to machine learning or deep learning-based modeling attacks, the final encrypted responses of the proposed strong PUF are also inherently immune to modeling attacks. Moreover, we propose a two-to-one (2-to-1) selection scheme and the digitally-controlled-delay-line (DCDL)-based stability checker to suppress the bit-error-rate (BER) of the weak PUF array and improve the efficiency of the spatial majority voting (SMV)-based error correction scheme, thus achieving high stability for our proposed strong PUF. Fabricated in 65nm CMOS GP technology, the proposed weak PUF-assisted strong PUF shows a high energy efficiency of 3.05 pJ/bit at a 2M bit rate. Meanwhile, it demonstrates an ultra-low average worst-case BER of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$8.9 \times 10^{-11}$ </tex-math></inline-formula> for the temperature range of −20°C to 120°C and a supply voltage variation of ±10% with the proposed stabilization schemes. The proposed strong PUF occupies a core area of 0.075mm2.

A Machine Learning Attack-Resilient Strong PUF Leveraging the Process Variation of MRAM

This brief presents a parallel magnetoresistive random access memory (MRAM)-based strong physical unclonable function (MPUF). The proposed MPUF leverages fabrication-induced process variations of magnetic tunnel junction (MTJ) and compares the resistance of MRAM cells to obtain a 1-bit response value. Contrary to arbiter PUF, the proposed MPUF achieves maximum security by satisfying strict avalanche criterion (SAC) property, and its secrecy capacity increases linearly with CRPs. Moreover, an array selection circuit (ASC) is proposed, which injects strong non-linearity into the PUF response and improves the robustness against machine learning (ML)- based modeling attacks. The proposed MPUF demonstrates high reliability, uniqueness, and uniformity with mean intra and inter-hamming distance (HD) of 0.447% and 49.76%, respectively. The robustness evaluation of the proposed MPUF against ML attacks, such as multilayer perceptron (MLP), linear regression (LR), and support vector machine (SVM), shows that it is resistant to these attacks, with ML-attack prediction accuracy of less than 79.7% for the basic two-array MPUF and less than 53.8% for the four-array MPUF with ASC. Moreover, compared to existing PUFs, the proposed MPUF has a large CRP space, high energy efficiency, and low area occupancy.

Research on security architecture of strong PUF by adversarial learning

Research on security architecture of strong PUF by adversarial learning

Novel hybrid strong and weak PUF design based on FPGA

Novel hybrid strong and weak PUF design based on FPGA

A Lightweight PUF-Based Authentication Protocol Using Secret Pattern Recognition for Constrained IoT Devices

PUFs, or physical unclonable functions, are hardware security primitives that can offer lightweight security solutions for constrained devices through challenge-response authentication protocols. However, the lightweight PUF-based security solutions that have been presented often lack security features such as mutual authentication or message encryption, which could be vital for many applications. Other protocols suffer from vulnerabilities to denial of service attacks that make them impractical to use. This work introduces a lightweight PUF-based protocol that uses secret pattern recognition to offer mutual authentication and authenticated secret message exchange for constrained devices on the Internet of Things. The protocol utilizes several techniques to introduce nonlinearity, and it can employ any strong PUF circuit for which a soft model can be generated. The authentication process requires simple bitwise operations along with a PUF circuit and a true random number generator (TRNG). By avoiding the use of any cryptographic or hash functions, the protocol's lightweight nature is preserved. The security of the proposed protocol against modeling attacks is tested to showcase its resilience. Similar PUF-based protocols are investigated and found to lack some essential security features.

A 0.04% BER Strong PUF With Cell-Bias-Based CRPs Filtering and Background Offset Calibration

This paper presents a low bit error rate (BER) strong PUF based on the dynamically amplified subthreshold current array (DA-SCA) with cell-bias-based challenge-response-pairs (CRPs) filtering method. The highly nonlinear subthreshold characteristic of the DA-SCA ensures a strong resilience to machine learning (ML) attacks and it simultaneously achieves low power and compact area. The current difference of two SCAs originated by the manufacturing process is amplified and converted into a voltage difference which is further digitized by the background offset-calibrated oscillator collapse-based comparator. Fabricated in 65 nm CMOS LP technology, the 64-bit DA-SCA PUF shows an average BER of 4.7% in the worst case for the temperature range of −20 to 80° and a supply variation of ±10%. Moreover, the proposed cell-bias-based CRPs filtering method dramatically suppresses the BER to 0.04% while discarding only 9.5% CRPs. The power consumption of the proposed PUF is merely $2.4~\mu \text{W}$ at 125 Kb/s and it occupies 0.024 mm2, including the on-chip calibration circuit. The proposed PUF demonstrates resistance against machine learning (ML) attacks across 100K training samples, limiting the prediction accuracy to ~50%.

TI-PUF: Toward Side-Channel Resistant Physical Unclonable Functions

One of the main motivations behind introducing PUFs was their ability to resist physical attacks. Among them, cloning was the major concern of related scientific literature. Several primitive PUF designs have been introduced to the community, and several machine learning attacks have been shown capable of modeling such constructions. Although a few works have expressed how to make use of Side-Channel Analysis (SCA) leakage of PUF constructions to significantly improve the modeling attacks, little attention has been paid to provide corresponding countermeasures. In this paper, we present a generic technique to operate any PUF primitive in an SCA-secure fashion. We, for the first time, make it possible to apply a provably-secure masking countermeasure – Threshold Implementation (TI) – on a strong PUF design. As a case study, we concentrate on the Interpose PUF and based on practical experiments on an FPGA prototype, we demonstrate the ability of our construction to prevent the recovery of intermediate values through SCA measurements.

A lightweight and secure-enhanced Strong PUF design on FPGA

A lightweight and secure-enhanced Strong PUF design on FPGA

Fast and reliable PUF response evaluation from unsettled bistable rings

Bistable ring (BR) based strong PUFs are promising candidates for lightweight authentication applications. It has been observed that a good ‘0’/‘1’-balance of their responses correlates with longer settling times. This is problematic, since the state-of-the-art evaluation method requires the BR to be settled in order to generate a reliable PUF response. We show that settling times can easily extend beyond 100 ms for 70 percent of the responses in the TBR PUF, which is a BR-based PUF with good ‘0’/‘1’-balance characteristics. Hence, it is practically impossible to wait for all BRs to settle, which results in a reliability penalty. In order to solve this problem, we present three new methods, which allow the evaluation of unsettled BRs with increased reliability compared to the state-of-the-art method. We were able to improve response reliability from 81 percent to up to 98.5 percent and achieve response reliabilities of 97 percent at an evaluation time of 320 ns. This enables the fast and reliable use of BR-based PUFs in strong PUF applications.

A Lockdown Technique to Prevent Machine Learning on PUFs for Lightweight Authentication

We present a lightweight PUF-based authentication approach that is practical in settings where a server authenticates a device, and for use cases where the number of authentications is limited over a device's lifetime. Our scheme uses a server-managed challenge/response pair (CRP) lockdown protocol: unlike prior approaches, an adaptive chosen-challenge adversary with machine learning capabilities cannot obtain new CRPs without the server's implicit permission. The adversary is faced with the problem of deriving a PUF model with a limited amount of machine learning training data. Our system-level approach allows a so-called strong PUF to be used for lightweight authentication in a manner that is heuristically secure against today's best machine learning methods through a worst-case CRP exposure algorithmic validation. We also present a degenerate instantiation using a weak PUF that is secure against computationally unrestricted adversaries, which includes any learning adversary, for practical device lifetimes and read-out rates. We validate our approach using silicon PUF data, and demonstrate the feasibility of supporting 10, 1,000, and 1M authentications, including practical configurations that are not learnable with polynomial resources, e.g., the number of CRPs and the attack runtime, using recent results based on the probably-approximately-correct (PAC) complexity-theoretic framework.

Memristive crypto primitive for building highly secure physical unclonable functions.

Physical unclonable functions (PUFs) exploit the intrinsic complexity and irreproducibility of physical systems to generate secret information. The advantage is that PUFs have the potential to provide fundamentally higher security than traditional cryptographic methods by preventing the cloning of devices and the extraction of secret keys. Most PUF designs focus on exploiting process variations in Complementary Metal Oxide Semiconductor (CMOS) technology. In recent years, progress in nanoelectronic devices such as memristors has demonstrated the prevalence of process variations in scaling electronics down to the nano region. In this paper, we exploit the extremely large information density available in nanocrossbar architectures and the significant resistance variations of memristors to develop an on-chip memristive device based strong PUF (mrSPUF). Our novel architecture demonstrates desirable characteristics of PUFs, including uniqueness, reliability, and large number of challenge-response pairs (CRPs) and desirable characteristics of strong PUFs. More significantly, in contrast to most existing PUFs, our PUF can act as a reconfigurable PUF (rPUF) without additional hardware and is of benefit to applications needing revocation or update of secure key information.

PHYSICAL UNCLONABLE FUNCTION HARDWARE KEYS UTILIZING KIRCHHOFF-LAW-JOHNSON-NOISE SECURE KEY EXCHANGE AND NOISE-BASED LOGIC

Weak unclonable function (PUF) encryption key means that the manufacturer of the hardware can clone the key but not anybody else. Strong unclonable function (PUF) encryption key means that even the manufacturer of the hardware is unable to clone the key. In this paper, first we introduce an "ultra" strong PUF with intrinsic dynamical randomness, which is not only unclonable but also gets renewed to an independent key (with fresh randomness) during each use via the unconditionally secure key exchange. The solution utilizes the Kirchhoff-law-Johnson-noise (KLJN) method for dynamical key renewal and a one-time-pad secure key for the challenge/response process. The secure key is stored in a flash memory on the chip to provide tamper-resistance and nonvolatile storage with zero power requirements in standby mode. Simplified PUF keys are shown: a strong PUF utilizing KLJN protocol during the first run and noise-based logic (NBL) hyperspace vector string verification method for the challenge/response during the rest of its life or until it is re-initialized. Finally, the simplest PUF utilizes NBL without KLJN thus it can be cloned by the manufacturer but not by anybody else.