Modern cloud-edge-device architectures pose significant challenges for dynamic and efficient security policy enforcement, especially in NIX-based virtualized systems. Existing frameworks are limited by centralized bottlenecks and static enforcement models that cannot adapt in real time. This paper presents POLYNIX, a hybrid policy enforcement framework that integrates Open Policy Agent (OPA) for centralized decision-making with Tetragon, an eBPF-based runtime enforcement engine, to deliver distributed, context-aware protection with minimal overhead. POLYNIX supports real-time policy updates, local enforcement fallback, and platform-independent deployment. Experiments across virtual machines show an average CPU overhead of 0.7%, memory usage of 4.3%, and policy propagation delays averaging 1.5 seconds. These results validate POLYNIX’s effectiveness in securing resource-constrained and latency-sensitive environments in alignment with zero-trust principles.

Physically unclonable functions (PUFs) which are robust to modeling attacks, usually have a complex, high-dimensional, nonlinear relationship between challenges and responses. Often, it is difficult to derive closed-form analytical expressions for these relationships. Consequently, it becomes difficult to compare PUF variants with regard to their robustness to modeling attacks. In this article, we apply a data-driven empirical metric termed the intrinsic dimension (ID), to estimate theinherent complexityof the relationship between the challenges and responses of a given PUF variant. This metric is computed from the linear projection layer of a deep neural network (DNN) aimed at modeling the PUF and has a unique advantage that it is independent of the architectural details and chosen hyperparameters of the DNN. It also does not require the knowledge of the structural and functional details of the PUF. The proposed approach is evaluated using two well-known ID estimation methods based on thenearest neighbor methodand the full correlation integral (FCI). Through detailed experimental results, we demonstrate that the numerical values of the FCI-based ID metric for different types of PUFs have consistently high positive correlation with the perceived difficulty of modeling several common PUF variants. We also show that the ID metric provides deep insight about various subtleties that affect the robustness of PUFs to modeling attack and provides a convenient mechanism to perform a systematic comparison between different PUF compositions.

Analysis of Physically Unclocnable Functions (PUFs) from a Boolean function perspective, and the efficient hardware implementation of such Boolean representations, can potentially lead to interesting insights about their behavior and robustness. Such a circuit implementation can also be a convenient substitute for the machine learning model of a PUF instance in PUF-based security protocols. In this paper, we present APUF-BN, a novel computer-aided design (CAD) framework to efficiently generate a combinational circuit representation of an Arbiter PUF (APUF) instance, which accurately mimics its input-output behavior. This representation is derived from an optimized fully-connected Binarized Neural Network (BNN) model of the APUF. Our fully-automated CAD framework takes challenge-response pairs (CRPs) of an APUF instance as input, and generates Verilog description corresponding to the optimized combinational circuit representation as output. The optimized Boolean logic representation achieves more than 24% reduction in area overhead compared to the unoptimized BNN representation, while achieving close to 98% modeling accuracy. We also validate the derived combinational circuit representation on Xilinx Artix-7 FPGA platform.

XOR arbiter PUF (XOR APUF), where the outputs of multiple arbiter PUF (APUFs) are XOR-ed, has proven to be more robust to machine learning-based modeling attacks. The reported successful modeling attacks for XOR APUF either employ auxiliary side-channel or reliability information, or require enormous computational effort. This robustness is primarily due to the difficulty in learning the unknown internal delay parameter terms in the mathematical model of a XOR APUF, and the robustness increases as the number of APUFs being XOR-ed increases. In this article, we employ a novel machine learning-based modeling technique called efficient CANDECOMP/PARAFAC-tensor regression network (CP-TRN), a variant of CP-decomposition-based tensor regression network, to reduce the computational resource requirement of model building attacks on XOR APUF. We theoretically prove the reduction in computational complexity, as well as give supporting experimental results. In addition, our proposed technique does not require any auxiliary information, and is robust to noisy training data. The proposed technique allowed us to successfully model 64-bit 8-XOR APUF and 128-bit 7-XOR APUF on a single desktop workstation, with high prediction accuracy. Further, we extend the proposed modeling attack technique to XOR APUF variants, e.g., lightweight secure PUF (LSPUF), which rely on input challenge transformation. The modeling accuracy results obtained by us for the LSPUF are comparable with those obtained by applying other state-of-the-art techniques, while requiring less training data.

Physically Unclonable Function (PUF) circuits are promising low-overhead hardware security primitives, but are often gravely susceptible to machine learning–based modeling attacks. Recently, chaotic PUF circuits have been proposed that show greater robustness to modeling attacks. However, they often suffer from unacceptable overhead, and their analog components are susceptible to low reliability. In this article, we propose the concept of a conditionally chaotic PUF that enhances the reliability of the analog components of a chaotic PUF circuit to a level at par with their digital counterparts. A conditionally chaotic PUF has two modes of operation: bistable and chaotic , and switching between these two modes is conveniently achieved by setting a mode-control bit (at a secret position) in an applied input challenge. We exemplify our PUF design framework for two different PUF variants—the CMOS Arbiter PUF and a previously proposed hybrid CMOS-memristor PUF, combined with a hardware realization of the Lorenz system as the chaotic component. Through detailed circuit simulation and modeling attack experiments, we demonstrate that the proposed PUF circuits are highly robust to modeling and cryptanalytic attacks, without degrading the reliability of the original PUF that was combined with the chaotic circuit, and incurs acceptable hardware footprint.

This work proposes a scheme to detect, isolate and mitigate malicious disruption of electro-mechanical processes in legacy PLCs where each PLC works as a finite state machine (FSM) and goes through predefined states depending on the control flow of the programs and input-output mechanism. The scheme generates a group-signature for a particular state combining the signature shares from each of these PLCs using (k,l)-threshold signature scheme. If some of them are affected by the malicious code, signature can be verified by k out of l uncorrupted PLCs and can be used to detect the corrupted PLCs and the compromised state. We use OpenPLC software to simulate Legacy PLC system on Raspberry Pi and show I/O pin configuration attack on digital and pulse width modulation (PWM) pins. We describe the protocol using a small prototype of five instances of legacy PLCs simultaneously running on OpenPLC software. We show that when our proposed protocol is deployed, the aforementioned attacks get successfully detected and the controller takes corrective measures. This work has been developed as a part of the problem statement given in the Cyber Security Awareness Week-2017 competition.