This study presents an innovative authentication scheme that integrates Physical Unclonable Functions (PUFs) and Zero-Knowledge Proofs (ZKP) to provide efficient and secure authentication for Internet of Things (IoT) devices. Traditional PUF-based protocols offer strong security but incur high resource costs and slow authentication. To address this, we propose a joint scheme. First, a unified architecture combining a PUF–True Random Number Generator (TRNG) is introduced. This architecture utilizes a feedback permutation obfuscation mechanism and an arbitration delay deviation with a metastable design from a ring oscillator, ensuring the PUF–TRNG system possesses both attack resistance and true random properties. The architecture provides synchronization for both PUF and TRNG in the protocol. Next, we integrate Schnorr’s ZKP with a PUF-based key encapsulation and reconstruction scheme to construct an end-to-end anonymous identity authentication protocol that does not require real-time participation of a trusted third party. The protocol requires only two handshakes, significantly reducing the number of protocol rounds compared to related protocols. Finally, the PUF–TRNG architecture has been implemented on the Xilinx XC7A100T development board. Experimental results show that the PUF circuit effectively resists various modeling attacks. Formal verification with ProVerif demonstrates confidentiality, mutual authentication, and robustness against mainstream attacks. The protocol reduces area overhead and computational time by 43.04% and 42.99%, respectively, compared to similar protocols.

Physical Unclonable Functions (PUFs) are lightweight hardware security primitives suitable for resource-constrained Internet of Things(IoT) devices. The Arbiter PUF (APUF), as a classic strong PUF structure, is well-suited for lightweight device authentication. Unfortunately, due to certain structural characteristics, the classic APUF can be successfully modeled by various machine learning (ML) models with only a small number of CRP (Challenge-Response Pair) samples. To address this security issue, In this paper, we build upon the classic APUF structure by introducing a Chain Block Obfuscation(CBO) mechanism and a Markov obfuscation mechanism at the input and output stages, respectively. This approach demonstrates strong resistance against four machine learning models—logistic regression (LR), support vector machine (SVM), covariance matrix adaptation evolutionary strategies (CMA-ES), and artificial neural networks (ANN)—while optimizing hardware resource usage by at least 53.4% compared to previous attack-resistant structures. Even with up to 2M CRPs for training, the prediction accuracy remains around 50%. Additionally, XOR, a widely adopted output obfuscation mechanism by many researchers, has limitations in output uniformity when the number of intra-chip parallel APUFs is small. Studies have shown that the uniqueness between intra-chip APUFs may not reach the ideal value of 50%. In such cases, especially when there are only two parallel APUFs in the circuit, the uniformity of the XOR output is affected by insufficient uniqueness. To address this issue, this paper proposes a MUX-based Markov output obfuscation mechanism. Experimental data on the Xilinx Artix-7 field-programmable gate array (FPGA) platform demonstrate that this mechanism exhibits strong robustness in uniformity compared to the traditional XOR output obfuscation, particularly when the number of intra-chip parallel APUFs is small.