In this work, a novel FPGA-based data-binding architecture incorporating PUFs and a user-specific encryption key to protect the confidentiality of data on external non-volatile memories is presented. By utilizing an intrinsic PUF derived from the same memory, the confidential data is additionally bound to the device. This feature proves valuable in cases where software is restricted to be executed exclusively on specific hardware or privacy-critical data is not allowed to be decrypted elsewhere. To improve the resistance against hardware attacks, a novel method to randomly select memory cells utilized for PUF measurements is presented. The FPGA-based design presented in this work allows for low latency as well as small area utilization, offers high adaptability to diverse hardware and software platforms, and is accessible from bare-metal programs to full Linux kernels. Moreover, a detailed performance and security evaluation is conducted on five boards. A single read or write operation can be executed in 0.58 μs when utilizing the lightweight PRINCE cipher on an AMD Zync 7000 MPSoC. Furthermore, the entire architecture occupies only about 10% of the FPGA's available space on a resource-constrained AMD PYNQ-Z2. Ultimately, the implementation is demonstrated by storing confidential user data on new generations of network base stations equipped with FPGAs.

In this work, we analyse Commercial Off-The-Shelf (COTS) Resistive Random Access Memory (ReRAM) modules for their suitability to implement a novel runtime-accessible True Random Number Generator (TRNG). For this purpose, modules from two different manufacturers (Adesto Technologies and Fujitsu) were tested, which exhibited distinct characteristics under different conditions. If suitable parameters are selected, the proposed TRNG can successfully pass all the tests of both the NIST SP800-22 Statistical Test Suite and the NIST SP800-90B Entropy Source Test Suite at a wide range of temperatures. At the same time, the TRNG achieves a throughput of at least 28 bits per second under adverse temperature conditions and approximately 51 bits per second at room temperature, in the worst case. Therefore, the performance of the TRNG is sufficient for many practical applications such as security protocols for the Internet of Things (IoT) and in-vehicle networks [1], [2].

Physical Unclonable Functions (PUFs) are increasingly used in the process of securing applications. For this purpose, it is crucial that the PUF satisfies all the required properties adequately, including Unpredictability. An important aspect of Unpredictability is Randomness, which includes being free of spatial correlation effects. However, most methods for assessing randomness are not capable of detecting correlation, such that this aspect is often ignored. This work summarises the current literature to shed more light on the topic of analysing spatial correlation in weak PUFs, and evaluates the various methods proposed in the literature for detecting such effects. Additionally, the spatial correlation of a Dynamic Random Access Memory (DRAM) decay-based PUF implemented on the DRAM of a Raspberry Pi board, as well as that of a Carbon-NanoTube-based PUF (CNT-PUF), are examined, using, for the first time in the context of PUFs, not only other well-known metrics proposed in the relevant literature, but also the Getis-Ord G metric. Finally, a mitigation technique against attacks based on spatial auto-correlation is proposed and its effective application to PUF responses is discussed.

The ubiquity and pervasiveness of modern Internet of Things (IoT) devices opens up vast possibilities for novel applications, but simultaneously also allows spying on, and collecting data from, unsuspecting users to a previously unseen extent. This paper details a new attack form in this vein, in which the decay properties of widespread, off-the-shelf DRAM modules are exploited to accurately spy on the temperature in the vicinity of the DRAM-carrying device. Among others, this enables adversaries to remotely and purely digitally spy on personal behavior in users’ private homes, or to collect security-critical data in server farms, cloud storage centers, or commercial production lines. We demonstrate that our attack can be performed by merely compromising the software of an IoT device and does not require hardware modifications or physical access at attack time. It can achieve temperature resolutions of up to 0.5°C over a range of 0°C to 70°C in practice. The presented attack works in devices that do not have a dedicated temperature sensor on board; as the DRAM modules already present in the device are abused to spy on the temperature. To complete the work, the paper discusses practical attack scenarios as well as possible countermeasures against the new temperature-spying attacks.