Physical Unclonable Functions (PUFs) serve as lightweight, hardware-intrinsic entropy sources widely deployed in IoT security applications. However, delay-based PUFs are vulnerable to Machine Learning Attacks (MLAs), undermining their assumed unclonability. There are no valid metrics for evaluating PUF MLA resistance, but empirical modelling experiments, which lack theoretical guarantees and are highly sensitive to advances in machine learning techniques. To address the fundamental gap between PUF designs and security qualifications, this work proposes a novel, formal, and unified framework for evaluating PUF security against modelling attacks by providing security lower bounds, independent of specific attack models or learning algorithms. We mathematically characterise the adversary's advantage in predicting responses to unseen challenges based solely on observed challenge-response pairs (CRPs), formulating the problem as a conditional probability estimation over the space of candidate PUFs. We present our analysis on previous "broken" PUFs, e.g., Arbiter PUFs, XOR PUFs, Feed-Forward PUFs, and for the first time compare their MLA resistance in a formal way. In addition, we evaluate the currently "secure" CT PUF, and show its security boundary. We demonstrate that the proposed approach systematically quantifies PUF resilience, captures subtle security differences, and provides actionable, theoretically grounded security guarantees for the practical deployment of PUFs.
The lack of stability is one of the major limitations that constrains PUF from being put in widespread practical use. In this paper, we propose a weak PUF and a strong PUF that are both completely stable with 0% intra-distance. These PUFs are called Locally Enhanced Defectivity (LED)PUF. The source of randomness of a LEDPUF is extracted from locally enhance defectivity without affecting other parts of the chip. A LEDPUF is a pure functional PUF that does not require any kinds of correction schemes as conventional parametric PUFs do. A weak LEDPUF is constructed by forming arrays of Directed Se…
Physically Unclonable Functions (PUFs) have become an important and promising hardware primitive for device fingerprinting, device identification, or key storage. Intrinsic PUFs leverage components already found in existing devices, unlike extrinsic silicon PUFs, which are based on customized circuits that involve modification of hardware. In this work, we present a new type of a memory-based intrinsic PUF, which leverages the Rowhammer effect in DRAM modules; the Rowhammer PUF. Our PUF makes use of bit flips, which occur in DRAM cells due to rapid and repeated access of DRAM rows. Prior resea…
Security is of critical importance for the Internet of Things (IoT). Many IoT devices are resource-constrained, calling for lightweight security protocols. Physical unclonable functions (PUFs) leverage integrated circuits' variations to produce responses unique for individual devices, and hence are not reproducible even by the manufacturers. Implementable with simplistic circuits of thousands of transistors and operable with low energy, Physical unclonable functions are promising candidates as security primitives for resource-constrained IoT devices. Arbiter PUFs (APUFs) are a group of delay-b…
Embedded systems play a crucial role in fueling the growth of the Internet-of-Things (IoT) in application domains such as healthcare, home automation, transportation, etc. However, their increasingly network-connected nature, coupled with their ability to access potentially sensitive/confidential information, has given rise to many security and privacy concerns. An additional challenge is the growing number of counterfeit components in these devices, resulting in serious reliability and financial implications. Physically Unclonable Functions (PUFs) are a promising security primitive to help ad…
Testability of digital ICs rely on the principle of controllability and observability. Adopting conventional techniques like scan-chains open up avenues for attacks, and hence cannot be adopted in a straight-forward manner for security chips. Furthermore, testing becomes incredibly challenging for the promising class of hardware security primitives, called PUFs, which offer unique properties like unclonability, unpredictibility, uniformity, uniqueness, and yet easily computable. However, the definition of PUF itself poses a challenge on test engineers, simply because it has no golden response …
Texas Tech University（德克萨斯理工大学）；University of Jeddah（吉达大学）；Prince Sattam Bin Abdulaziz University（萨塔姆·本·阿卜杜勒阿齐兹亲王大学）
Physical Unclonable Functions (PUFs) are promising security primitives for resource-constrained network nodes. The XOR Arbiter PUF (XOR PUF or XPUF) is an intensively studied PUF invented to improve the security of the Arbiter PUF, probably the most lightweight delay-based PUF. Recently, highly powerful machine learning attack methods were discovered and were able to easily break large-sized XPUFs, which were highly secure against earlier machine learning attack methods. Component-differentially-challenged XPUFs (CDC-XPUFs) are XPUFs with different component PUFs receiving different challenges…
A new definition of "Physical Unclonable Functions" (PUFs), the first one that fully captures its intuitive idea among experts, is presented. A PUF is an information-storage system with a security mechanism that is 1. meant to impede the duplication of a precisely described storage-functionality in another, separate system and 2. remains effective against an attacker with temporary access to the whole original system. A novel classification scheme of the security objectives and mechanisms of PUFs is proposed and its usefulness to aid future research and security evaluation is demonstrated. One…
The vast areas of applications for IoTs in future smart cities, smart transportation systems, and so on represent a thriving surface for several security attacks with economic, environmental and societal impacts. This survey paper presents a review of the security challenges of emerging IoT networks and discusses some of the attacks and their countermeasures based on different domains in IoT networks. Most conventional solutions for IoT networks are adopted from communication networks while noting the particular characteristics of IoT networks such as the nodes quantity, heterogeneity, and the…
A physical unclonable function (PUF) generates hardware intrinsic volatile secrets by exploiting uncontrollable manufacturing randomness. Although PUFs provide the potential for lightweight and secure authentication for increasing numbers of low-end Internet of Things devices, practical and secure mechanisms remain elusive. We aim to explore simulatable PUFs (SimPUFs) that are physically unclonable but efficiently modeled mathematically through privileged one-time PUF access to address the above problem. Given a challenge, a securely stored SimPUF in possession of a trusted server computes the…
The exponentially increasing number of ubiquitous wireless devices connected to the Internet in Internet of Things (IoT) networks highlights the need for a new paradigm of data flow management in such large-scale networks under software defined wireless networking (SDWN). The limited power and computation capability available at IoT devices as well as the centralized management and decision-making approach in SDWN introduce a whole new set of security threats to the networks. In particular, the authentication mechanism between the controllers and the forwarding devices in SDWNs is a key challe…
Information security is of great importance for modern society with all things connected. Physical unclonable function (PUF) as a promising hardware primitive has been intensively studied for information security. However, the widely investigated silicon PUF with low entropy is vulnerable to various attacks. Herein, we introduce a concept of bionic optical PUFs inspired from unique biological architectures, and fabricate four types of bionic PUFs by molding the surface micro-nano structures of natural plant tissues with a simple, low-cost, green and environmentally friendly manufacturing proce…
This paper contributes to the study of PUFs vulnerability against modeling attacks by evaluating the security of XOR BR PUFs, XOR TBR PUFs, and obfuscated architectures of XOR BR PUF using a simplified mathematical model and deep learning (DL) techniques. Obtained results show that DL modeling attacks could easily break the security of 4-input XOR BR PUFs and 4-input XOR TBR PUFs with modeling accuracy $\sim$ 99%. Similar attacks were executed using single-layer neural networks (NN) and support vector machines (SVM) with polynomial kernel and the obtained results showed that single NNs failed …
Lightweight and low latency security schemes at the physical layer that have recently attracted a lot of attention include: (i) physical unclonable functions (PUFs), (ii) localization based authentication, and, (iii) secret key generation (SKG) from wireless fading coefficients. In this paper, we focus on short blocklengths and propose a fast, privacy preserving, multi-factor authentication protocol that uniquely combines PUFs, proximity estimation and SKG. We focus on delay constrained applications and demonstrate the performance of the SKG scheme in the short blocklength by providing a numer…
In today's digital age, the ease of data collection, transfer, and storage continue to shape modern society and the ways we interact with our world. The advantages are numerous, but there is also an increased risk of information unintentionally falling into the wrong hands. Finding methods of protecting sensitive information at the hardware level is of utmost importance, and in this paper, we aim to provide a survey on recent developments in attacks on lightweight hardware-based security primitives (LHSPs) designed to do just that. Specifically, we provide an analysis of the attack resilience …
The omnipresent digitalization trend has enabled a number of related malicious activities, ranging from data theft to disruption of businesses, counterfeiting of devices, and identity fraud, among others. Hence, it is essential to implement security schemes and to ensure the reliability and trustworthiness of electronic circuits. Toward this end, the concept of physically unclonable functions (PUFs) has been established at the beginning of the 21st century. However, most PUFs have eventually, at least partially, fallen short of their promises, which are unpredictability, unclonability, uniquen…
Physical unclonable functions (PUFs), physical objects that are practically unclonable because of their andom and uncontrollable manufacturing variations, are becoming increasingly popular as security primitives and unique identifiers in a fully digitized world. One of the central PUF premises states that both friends and foes, both legitimate manufacturers and external attackers alike, cannot clone a PUF, producing two instances that are the same. Using the latest nanofabrication techniques, we show that this premise is not always met: We demonstrate the possibility of effective PUF duplicati…
Physically unclonable functions (PUFs) can be employed for device identification, authentication, secret key storage, and other security tasks. However, PUFs are susceptible to modeling attacks if a number of PUFs' challenge-response pairs (CRPs) are exposed to the adversary. Furthermore, many of the embedded devices requiring authentication have stringent resource constraints and thus require a lightweight authentication mechanism. We propose PUF-RLA, a PUF-based lightweight, highly reliable authentication scheme employing binary string shuffling. The proposed scheme enhances the reliability …
Strong physical unclonable functions (PUFs) provide a low-cost authentication primitive for resource constrained devices. However, most strong PUF architectures can be modeled through learning algorithms with a limited number of CRPs. In this paper, we introduce the concept of non-monotonic response quantization for strong PUFs. Responses depend not only on which path is faster, but also on the distance between the arriving signals. Our experiments show that the resulting PUF has increased security against learning attacks. To demonstrate, we designed and implemented a non-monotonically quanti…
Advances in technology have enabled tremendous progress in the development of a highly connected ecosystem of ubiquitous computing devices collectively called the Internet of Things (IoT). Ensuring the security of IoT devices is a high priority due to the sensitive nature of the collected data. Physically Unclonable Functions (PUFs) have emerged as critical hardware primitive for ensuring the security of IoT nodes. Malicious modeling of PUF architectures has proven to be difficult due to the inherently stochastic nature of PUF architectures. Extant approaches to malicious PUF modeling assume t…
The current chapter aims at establishing a relationship between artificial intelligence (AI) and hardware security. Such a connection between AI and software security has been confirmed and well-reviewed in the relevant literature. The main focus here is to explore the methods borrowed from AI to assess the security of a hardware primitive, namely physically unclonable functions (PUFs), which has found applications in cryptographic protocols, e.g., authentication and key generation. Metrics and procedures devised for this are further discussed. Moreover, By reviewing PUFs designed by applying …
As the demand for highly secure and dependable lightweight systems increases in the modern world, Physically Unclonable Functions (PUFs) continue to promise a lightweight alternative to high-cost encryption techniques and secure key storage. While the security features promised by PUFs are highly attractive for secure system designers, they have been shown to be vulnerable to various sophisticated attacks - most notably Machine Learning (ML) based modelling attacks (ML-MA) which attempt to digitally clone the PUF behaviour and thus undermine their security. More recent ML-MA have even exploite…
We design, implement, and assess the security of several variations of the PUF-on-PUF (POP) architecture. We perform extensive experiments with deep neural networks (DNNs), showing results that endorse its resilience to learning attacks when using APUFs with 6, or more, stages in the first layer. Compositions using APUFs with 2, and 4 stages are shown vulnerable to DNN attacks. We reflect on such results, extending previous techniques of influential bits to assess stage bias in APUF instances. Our data shows that compositions not always preserve security properties of PUFs, the size of PUFs us…
Hacking password databases is one of the most frequently reported cyber-attacks. Current password management systems are based on known and public algorithms. Also, many studies have shown that users select weak passwords. Thus, with the emergence of new powerful computing devices, the passwords based on known algorithms can be disclosed. Using physical unclonable functions (PUFs) for increasing the security level of password management systems is a quite recent method that is proposed to solve this problem. In this method, Addressable PUF Generator (APG) is added to the conventional password …
In many Industry Internet of Things (IIoT) applications, resources like CPU, memory, and battery power are limited and cannot afford the classic cryptographic security solutions. Silicon Physical Unclonable Function (PUF) is a lightweight security primitive that exploits manufacturing variations during the chip fabrication process for key generation and/or device authentication. However, traditional weak PUFs such as Ring Oscillator (RO) PUF generate chip-unique key for each device, which restricts their application in security protocols where the same key is required to be shared in resource-…
This article presents the first-ever blockchain which can simultaneously handle device and data security, which is important for the emerging Internet-of-Everything (IoE). This article presents a unique concept of blockchain that integrates hardware security primitives called Physical Unclonable Functions (PUFs) to solve scalability, latency, and energy requirement challenges and is called PUFchain. Data management and security (and privacy) of data, devices, and individuals, are some of the issues in the IoE architectures that need to be resolved. Integrating the blockchain into the IoE envir…
Due to their unmatched entropy, complexity, and security level, optical Physical Unclonable Functions (PUFs) currently receive a lot of interest in the literature. Despite the large body of existing works, however, one of their core features has never been quantified in detail, namely their physical unclonability. This paper tackles this fundamental and yet largely unaddressed issue. In simulations and/or experiments, the sensitivity of diffraction-based optical responses is investigated with respect to various small alterations such as variation in the position, size, and number of the scatte…
Physical Unclonable Functions (PUFs) have emerged as a promising solution to identify and authenticate Integrated Circuits (ICs). In this paper, we propose a novel NAND-based Set-Reset (SR) Flip-flop (FF) PUF design for security enclosures of the area- and power-constrained Internet-of-Things (IoT) edge node. Such SR-FF based PUF is constructed during a unique race condition that is (normally) avoided due to inconsistency. We have shown, when both inputs (S and R) are logic high ('1') and followed by logic zero ('0'), the outputs Q and Qbar can settle down to either 0 or 1 or vice-versa depend…
The characteristic novelty of what is generally meant by a "physical unclonable function" (PUF) is precisely defined, in order to supply a firm basis for security evaluations and the proposal of new security mechanisms. A PUF is defined as a hardware device which implements a physical function with an output value that changes with its argument. A PUF can be clonable, but a secure PUF must be unclonable. This proposed meaning of a PUF is cleanly delineated from the closely related concepts of "conventional unclonable function", "physically obfuscated key", "random-number generator", "controlle…
In order to protect devices from physical manipulations, protective security enclosures were developed. However, these battery-backed solutions come with a reduced lifetime, and have to be actively and continuously monitored. In order to overcome these drawbacks, batteryless capacitive enclosures based on Physical Unclonable Functions (PUFs) have been developed that generate a key-encryption-key (KEK) for decryption of the key chain. In order to reproduce the PUF-key reliably and to compensate the effect of noise and environmental influences, the key generation includes error correction codes.…
Many password alternatives for web authentication proposed over the years, despite having different designs and objectives, all predominantly rely on the knowledge of some secret. This motivates us, herein, to provide the first detailed exploration of the integration of a fundamentally different element of defense into the design of web authentication schemes: a mimicry-resistance dimension. We analyze web authentication mechanisms with respect to new usability and security properties related to mimicry-resistance (augmenting the UDS framework), and in particular evaluate invisible techniques …
Physical unclonable functions (PUFs), as hardware security primitives, exploit manufacturing randomness to extract hardware instance-specific secrets. One of most popular structures is time-delay based Arbiter PUF attributing to large number of challenge response pairs (CRPs) yielded and its compact realization. However, modeling building attacks threaten most variants of APUFs that are usually employed for strong PUF-oriented application---lightweight authentication---without reliance on the securely stored digital secrets based standard cryptographic protocols. In this paper, we investigate …
