The Internet of Things (IoT) has revolutionized connectivity by enabling a large number of devices to autonomously exchange real-time data over the Internet. However, IoT devices used in public spaces are vulnerable to physical and cloning attacks. To address this issue, researchers have introduced the concept of physical-unclonable functions (PUFs) to enhance security in IoT applications. While PUF-based security solutions typically rely on static challenge-response behavior, many practical applications require dynamic or reconfigurable PUFs. For instance, PUF-based key storage may require updating or revoking secrets, and protection against modeling attacks, where an attacker can derive a PUF model from a set of challenge-response pairs (CRPs) using learning capabilities. In this paper, we introduce LR-OPUF, a reconfigurable one-time PUF, and propose a lightweight and privacy-preserving authentication scheme based on this LR-OPUF foundation. One notable feature of our authentication scheme is that it enables a device to prove its legitimacy to a semi-honest verifier without disclosing the CRPs. Through security and performance analyses, we demonstrate that our approach not only ensures vital security aspects but also exhibits high computational efficiency.

Physically Unclonable Functions (PUFs) provide a streamlined solution for lightweight device authentication. Delay-based Arbiter PUFs, with their ease of implementation and vast challenge space, have received significant attention; however, they are not immune to modelling attacks that exploit correlations between their inputs and outputs. Research is therefore polarized between developing modelling-resistant PUFs and devising machine learning attacks against them. This dichotomy often results in exaggerated concerns and overconfidence in PUF security, primarily because there lacks a universal tool to gauge a PUF’s security. In many scenarios, attacks require additional information, such as PUF type or configuration parameters. Alarmingly, new PUFs are often branded ‘secure’ if they lack a specific attack model upon introduction. To impartially assess the security of delay-based PUFs, we present a generic framework featuring a Mixture-of-PUF-Experts (MoPE) structure for mounting attacks on various PUFs with minimal adversarial knowledge, which provides a way to compare their performance fairly and impartially. We demonstrate the capability of our model to attack different PUF types, including the first successful attack on Heterogeneous Feed-Forward PUFs using only a reasonable amount of challenges and responses. We propose an extension version of our model, a Multi-gate Mixture-of-PUF-Experts (MMoPE) structure, facilitating multi-task learning across diverse PUFs to recognise commonalities across PUF designs. This allows a streamlining of training periods for attacking multiple PUFs simultaneously. We conclude by showcasing the potent performance of MoPE and MMoPE across a spectrum of PUF types, employing simulated, real-world unbiased, and biased data sets for analysis.