Hardware fingerprinting technologies are an integral part for security of interconnected devices, for which the Physical Unclonable Function (PUF) has attracted attention in industry and academia for over 20 years. PUFs exploit uncontrollable manufacturing variations to provide hardware-intrinsic fingerprints, which are hardware analogues to biometrics in humans. These fingerprints can be used as secrets that are highly sensitive to physical tampering. However, many questions remain on the applicability of PUFs given the prominent existence of modeling techniques that allow to predict or manipulate these secret fingerprints. In this survey, we analyze the trends and state-of-the-art in PUF modeling from 254 papers obtained from a systematic search and screening process. Our results provide an extensive list of PUF designs and protocols, which we classify based on three main perspectives: application, operational, and defensive. Similarly, we list and classify modeling techniques based on the defined PUF models and learning algorithms. Most of the surveyed papers consider modeling techniques purely as a vulnerability. However, we also include the perspective of modeling as an enabler for lightweight sharing of PUF secrets. Finally, we provide an exhaustive knowledge base and identify gaps and promising directions for future work in the field.

The rapid advances in quantum computing pressure the existing essential cryptographic algorithms. In this context, Quantum Key Distribution (QKD) has been proposed as a quantum safe solution for key distribution. However, current QKD systems require an authenticated classical channel which relies on pre-shared symmetric keys that are manually distributed and do not guarantee the identity of the hardware that hosts them. This paper proposes a novel scheme, the Physically Unclonable Quantum Key Distribution (PU-QKD) system, to intrinsically authenticate the communicating endpoints in QKD. The PU-QKD scheme leverages classical Physical Unclonable Functions (PUFs) to encode the data transmission in discrete variable QKD protocols (e.g., BB84). Our scheme maintains the information-theoretic security of QKD protocols by integrating the PUF as an additional layer. Authentication is bound to hardware, providing a robust fingerprint, while lower post-processing overhead increases key rates. Additionally, the proposed scheme is resilient against state-of-the-art PUF vulnerabilities, such as modeling attacks.

Resource-constrains are a significant challenge when designing secure IoT devices. To address this problem, the physical unclonable function (PUF) has been proposed as a lightweight security primitive capable of hardware fingerprinting. PUFs can provide device identification capabilities by exploiting random manufacturing variations, which can be used for authentication with a verifier that identifies a device through challenge-response interactions with its PUF. However, extensive research has shown that PUFs are inherently vulnerable to machine learning (ML) modeling attacks. Such attacks use challenge-response samples to train ML algorithms to learn the underlying parameters that define the physical PUF. In this article, we present a defensive technique to be used by the verifier called selective challenge-response pairs (CRPs). We propose generating challenges selectively, instead of randomly, to negatively affect the parameters of ML models trained by attackers. Specifically, we provide three methods: 1) binary-coded with padding (BP); 2) random shifted pattern (RSP); and 3) binary shifted pattern (BSP). We characterize them based on Hamming distance patterns, and evaluate their applicability based on their effect on the uniqueness, uniformity, and reliability of the underlying PUF implementation. Furthermore, we analyze and compare their resilience to ML modeling with the traditional random challenges on the well-studied XOR PUF, feed-forward PUF, and lightweight secure PUF, showing improved resilience of up to 2 times the number of CRPs. Finally, we suggest using our method on the interpose PUF to counter reliability-based attacks which can overcome selective CRPs and show that up to 4 times the number of CRPs can be exchanged securely.

The widespread adoption of Internet-of-Things (IoT) devices is elevating the security expectations of many application domains. Meanwhile, numerosity, hardware and software heterogeneity, and low cost of IoT devices makes meeting such expectations challenging. A key security function that IoT devices must possess is identity and the capability to authenticate themselves. However, traditional authentication mechanisms rely on hash-based cryptography, requiring complex hardware and computational resources. To mitigate this problem, the Physical Unclonable Function (PUF) has been proposed as a lightweight source of device-specific entropy that can be used for identifying IoT devices. However, a major challenge to this approach is protecting PUFs against Machine Learning (ML)-based modeling attacks, where an attacker can clone an authentic PUF after collecting enough training data from the communication protocol, e.g., as a passive eavesdropper. In this paper, we propose a Predictive Adversarial System (PAS) that aims to prevent ML modeling attacks by predicting the capabilities of an attacker in a PUF system. We analyze the best approaches to implement our system and evaluate their performance in terms of the modeling capacity that a passive attacker exhibits. Our experiments show that the proposed approach can increase the training data required for a successful modeling attack over one million samples, without increasing the security overhead of resource-constrained PUF-enabled IoT devices.

Modeling of Physical Unclonable Functions (PUFs) through Machine Learning (ML) algorithms has been widely applied to break their security. Currently, many different algorithms are capable of modeling a wide range of delay-based PUFs, preventing these primitives from being effectively applied to security applications such as authentication. To tackle this, other studies have developed PUF designs that prevent ML modeling attacks. However, these studies typically focus on defending against well-known Supervised Learning techniques, including Logistic Regression or Multi-Layer Perceptron. On the other hand, since ML is rapidly evolving, new techniques can be potentially applied to model the latest proposed PUFs. For this reason, in this paper, we study the applicability of a subfield of ML, namely Deep Reinforcement Learning (DRL), for PUF modeling and comparing it to the state-of-the-art. We find that DRL, specifically the Deep Q-Network (DQN) algorithm, can be as effective as state-of-the-art modeling attacks on XOR Arbiter PUF, making it a new threat to delay-based PUFs. Additionally, when considering PUFs with challenge obfuscation, such as the Interpose PUF, DQN outperforms the state-of-the-art, raising concerns about the long-term security of obfuscation techniques.