Lightweight PUF-Based Authentication Protocol for IoT Devices

IEEE Access

A Physical Unclonable Function (PUF) provides a physical device a unique output for a given input, which can be regarded as the device's digital fingerprint. Thus, PUFs can provide unique identities for billions of connected devices in Internet of Things (IoT) architectures. Plenty of PUF based authenticated key exchange (AKE) protocols have been proposed. However, most of them are designed for the authentication between an IoT node and the specific server/verifier, whom the IoT node registered with. Only a few of them are designed for the authentication between IoT nodes, and all these protocols need verifiers or explicit Challenge-Response Pairs (CRPs). In this paper, we propose the first PUF based AKE protocol for IoT without verifiers and explicit CRPs, which IoT nodes can freely authenticate each other and create a session key on their own without the help of any server or verifier. We compare the proposed protocol with 27 relevant PUF based AKE protocols to show the superiority, and analyze the computational cost of each entity in the proposed protocol to show the efficiency. We define the adversarial model of a PUF based AKE protocol for IoT and formally prove the security of the proposed protocol in random oracle model. The security of the proposed protocol is based on the Elliptic Curve Discrete Logarithm (ECDL), Elliptic Curve Computational Diffie-Hellman (ECCDH), and Decisional Bilinear Diffie-Hellman (DBDH) assumptions. INDEX TERMS Device authentication, internet of things, key agreement, key management, physical unclonable function.

2019 Asian Hardware Oriented Security and Trust Symposium (AsianHOST), 2019

Due to practical constraints in preventing phishing through public network or insecure communication channels, simple physical unclonable function (PUF)-based authentication protocol with unrestricted queries and transparent responses is vulnerable to modeling and replay attacks. In this paper, we present a PUF-based authentication method to mitigate the practical limitations in applications where a resource-rich server authenticates a device with no strong restriction imposed on the type of PUF designs or any additional protection on the binary channel used for the authentication. Our scheme uses an active deception protocol to prevent machine learning (ML) attacks on a device. The monolithic system makes collection of challenge response pairs (CRPs) easy for model building during enrollment but prohibitively time consuming upon device deployment. A genuine server can perform a mutual authentication with the device at any time with a combined fresh challenge contributed by both the server and the device. The message exchanged in clear does not expose the authentic CRPs. The false PUF multiplexing is fortified against prediction of waiting time by doubling the time penalty for every unsuccessful authentication.

Proceedings of the 18th International Conference on Security and Cryptography, 2021

Internet-of-Things (IoT), an integral part of today's smart society, is facing tremendous challenges of different security and interoperability attacks. Also, IoT device works in resource-constrained environments with limited storage. Conventional cryptography is not suitable for low-cost IoTs, and also they are susceptible to physical attacks. This work proposes a lightweight authentication and key exchange protocol utilizing the physically unclonable function (PUF) as security primitive. A single PUF challenge-response pair (PUF-CRP) is utilised to overcomes the server's storage overhead in the proposed protocol. Also, this protocol ensures the secret message passing using the lightweight XOR function. The proposed protocol authenticates the end-user successfully as well as maintains the security of the shared secret. The two-pass approach of the proposed method builds confidence in communicating entities. Formal analysis by automated Proverif tool validates its security. Performance evaluation advocates the superiority of the proposed protocol over the existing methods upholding its strong security and lightweight feature.

IEEE Internet of Things Journal, 2021

Physical Unclonable Functions (PUFs) offer a promising solution for authentication of IoT devices as they provide unique fingerprints for the underlying devices through their challenge-response pairs. However, PUFs have been shown to be vulnerable to modeling attacks. In this paper, we propose a novel protocol to thwart such vulnerability by limiting the adversary’s ability to intercept the whole challenge bits exchanged with IoT nodes. We split the challenge bits over multiple messages and engage one or multiple helper nodes in the dissemination process. We further study the implications of various parts of the challenge patterns on the modeling attack and propose extensions of our protocol that exploit bits scrambling and padding to ameliorate the attack resiliency. The experimental results extracted from a 16-bit and a 64-bit arbiter-PUF implemented on FPGA demonstrate the effectiveness of the proposed methods in boosting the robustness of IoT authentication.

As we know the problems regarding data and system security are challenging and taking attraction of researchers. Although there are many techniques available which offers protection to systems there is no single Method which can provide full protection. As we know to provide security to system authentication in login system is main issue for developers. Response Computable Authentication is two way methods which are used by number of authentication system where an authentication system independently calculates the expected user response and authenticates a user if the actual user response matches the expected value. But such authentication system have been scare by malicious developer who can bypass normal authentication by covering logic in source code or using weak cryptography. This paper mainly focuses on RCA system to make sure that authentication system will not be influenced by backdoors. In this paper our main goal is to take review of different methods, approaches and techniques used for Response Computation Authentication.

Symmetry

Key agreement between two constrained Internet of Things (IoT) devices that have not met each other is an essential feature to provide in order to establish trust among its users. Physical Unclonable Functions (PUFs) on a device represent a low cost primitive exploiting the unique random patterns in the device and have been already applied in a multitude of applications for secure key generation and key agreement in order to avoid an attacker to take over the identity of a tampered device, whose key material has been extracted. This paper shows that the key agreement scheme of a recently proposed PUF based protocol, presented by Chatterjee et al., for Internet of Things (IoT) is vulnerable for man-in-the-middle, impersonation, and replay attacks in the Yao–Dolev security model. We propose an alternative scheme, which is able to solve these issues and can provide in addition a more efficient key agreement and subsequently a communication phase between two IoT devices connected to the...

IEEE Internet of Things Journal, 2021

With the development of the cloud-based Internet of Things (IoT), people and things can request services, access data, or control actuators located thousands of miles away. The entity authentication of the remotely accessed devices is an essential part of the security systems. In this vein, Physical Unclonable Functions (PUFs) are a hot research topic, especially for generating random, stable, and tamper-resistant fingerprints. This paper proposes a lightweight, robust SRAM-PUF based entity authentication scheme to guarantee that the accessed end devices are trustable. The proposed scheme uses Challenge-Response Pairs (CRPs) represented by reordered memory addresses as challenges and the corresponding SRAM cells' startup values as responses. The experimental results show that our scheme can efficiently authenticate resources-constrained IoT devices with a low computation overhead and small memory capacity. Furthermore, we analyze the SRAM-PUF by testing the PUF output under different environmental conditions, including temperature and magnetic field, in addition to exploring the effect of writing different values to the SRAM cells on the stability of their startup values.

IACR Cryptol. ePrint Arch., 2019

Internet of Things(IoT) consists of a large number of interconnected coexist heterogeneous entities, including Radio-frequency identification(RFIDs) based devices and other sensors to detect and transfer various information such as temperature, personal health data, brightness, etc. Security, in particular, authentication, is one of the most important parts of information security infrastructure in IoT systems. Given that an IoT system has many resource-constrained devices, a goal could be designing a proper authentication protocol that is lightweight and can resist against various common attacks, targeting such devices. Recently, using Physical Unclonable Functions (PUF) to design lightweight authentication protocols has received a lot of attention among researchers. In this paper, we analyze two recently proposed authentication protocols based on PUF chains called PHEMAP and Salted PHEMAP. We show that these protocols are vulnerable to impersonate, desynchronization and traceabili...

IEEE Transactions on Emerging Topics in Computing, 2021

A physical unclonable function (PUF) is a hardware security primitive, which can be used secure various hardware-based applications. As a type of PUFs, strong PUFs have a large number of challenge-response pairs (CRPs), which can be used for authentication. At present, most strong PUF structures follow a one-to-one input/output relationship, i.e. linear function. As such, strong PUF designs are vulnerable to machine learning (ML) based modeling attacks. To address the issue, a dynamically configurable PUF structure is proposed in this paper. A mathematical model of the proposed dynamic PUF is presented and the design is proposed against the effective ML based attacks, such as deep neural network (DNN), logistic regression (LR) and reliability-based covariance matrix adaptation evolution strategies (CMA-ES). Experimental results on field programmable gate arrays (FPGAs) show that the proposed dynamic structure has achived good uniqueness and reliability. It is also shown that the dynamic PUF has a strong resistance to the CMA-ES attack. Due to the dynamic nature of the proposed PUF structure, an authentication protocol is also designed to generate recognizable authentication bits string. The protocol shows strong resistance to classical machine learning attacks including the new variant of CMA-ES.

IEEE Access

The Internet of Things (IoT) acts as an umbrella for the Internet-enabled devices for various applications, such as smart home, smart city, smart grid and smart healthcare. The emergence of the immense economic potential necessitates a robust authentication mechanism that needs to be lightweight and suitable for real-time applications. Moreover, the physical integrity of these devices cannot be assumed as these are designed to be deployed in an unattended environment with minimum human supervision. A user authentication mechanism for IoT, in addition to guaranteeing user anonymity and un-traceability functionality requirements, must also be resistant to device physical capture and related misuses. In this paper, we present a novel lightweight anonymous user authentication protocol for IoT environment by utilizing "cryptographic one-way hash function", "Physically Unclonable Function (PUF)" and "bitwise exclusive-OR (XOR)" operations. The broadly accepted Real-Or-Random (ROR) modelbased formal security analysis, formal security verification using the automated software verification tool, namely "Automated Validation of Internet Security Protocols and Applications (AVISPA)" and also nonmathematical (informal) security analysis have been carried out on the proposed scheme. It is shown that the proposed scheme has the ability to resist various well-known attacks that are crucial for securing IoT environment. Through a detailed comparative study, we show that the proposed scheme outperforms other existing related schemes in terms of computation and communication costs, and also security & functionality features. Finally, a practical demonstration of the proposed scheme using the NS3 simulation has been provided for measuring various network performance parameters. INDEX TERMS Internet of Things (IoT), mutual authentication, key agreement, physically unclonable function, security, AVISPA.