Physically unclonable functions (PUFs) are hardware security primitives with notable success in secure key generation applications, but have been faced with challenges in device authentication applications. This paper provides an FPGA implementation of the Shadow PUF design for generating reconfigurable PUFs to mitigate the dangers posed by modeling attacks. The proposed design is scalable with sampled randomness and uniqueness values averaging 48.88% and 48.05%, respectively. The selected design for the proof-of-concept implementation utilized 239 logic cells (LCs) and 256 bits of memory on an iCE40 HX1K FPGA—highlighting the proposed design as a viable security core for even the most resource-constrained devices.

Physically Unclonable Functions (PUFs) are hardware security primitives that can offer an alternative lightweight security solution for authenticating constrained Internet of Things (IoT) devices. However, PUFs are susceptible to modeling attacks, requiring the adoption of various design approaches to increase their resiliency. Many research efforts propose design approaches that offer better security against modeling attacks. This work investigates state-of-the-art modeling attacks performed on well-known Arbiter-based PUF architectures highlighting the best-fit modeling algorithm for different design approaches. Furthermore, the area efficiency of studied PUF designs is examined, and the optimal PUF design approaches for various area constraints are suggested. Such an assessment is required to evaluate PUF security accurately and guide the PUF community toward better practices. The findings revealed that some machine-learning algorithms performed better on a particular design. Additionally, when considering area overhead, we found that some PUF designs offer less security per area unit than their simpler counterparts. Accordingly, certain design elements are more efficient and add more security.

Physical Unclonable Functions (PUFs) are popular hardware security primitives that offer lightweight authentication for constrained devices. However, lightweight PUF-based authentication often limits the number of authentications provided or even throttle the device to prevent adversaries from collecting enough information that could compromise the device’s security. This work introduces a Shadow PUF design, a controlled Strong PUF, to secure challenge-response exchanges against attackers and allow for an unlimited generation of unique responses. The proposed Shadow PUF design ensures security by periodically reconfiguring its behavior. The reconfiguration bits are generated by a static PUF primitive and are never exposed, while all authentication exchanges are done using the reconfigurable Shadow PUF. An ASIC Synthesis of the Shadow PUF demonstrates its small implementation area requirements and low power consumption. The security of the proposed PUF design against modeling attacks has also been analyzed.

Challenges in securing the Internet of Things (IoT) has led to the development of novel technologies such as physically unclonable functions (PUFs). Having applications in both lightweight authentication and key generation protocols for IoT devices, PUFs have received a great deal of research. Despite their promise, delay-based PUFs such as Arbiter PUFs and 4-XOR PUFs are easily modeled with 600 and 50, 000 challenge-response pairs (CRPs), respectively. While it has been shown that delay-based PUFs can be further improved by XORing together an increasing number of PUF instances, it also tends to become area-inefficient. In this paper the authors propose a novel method that combats the effectiveness of machine learning algorithms for modeling PUF behaviors by randomly selecting responses from a pool of PUFs. Six variants to our Random Bit Selection (RBS) PUF are proposed and investigated. The yielded results show that specific variants of RBS PUF are machine learning resistant despite using a 5, 760, 000 CRP dataset for training. Furthermore, the results indicate no significant improvement in the modeling algorithm despite a 100 times increase in the number of CRPs used. Finally, the security of the proposed design is also evaluated through a brute-force analysis to show its resistance to brute-force attacks.