Strong Physical Unclonable Functions (PUFs) are considered the most promising circuits for lightweight IoT authentication. However, current white-box attacks on PUF circuits through reverse engineering compromise the effectiveness of many anti-modeling attack techniques. To address this challenge, we propose a configurable four-state Hybrid PUF (CF PUF), which includes three strong PUFs and one weak PUF. The proposed structure uses the key stream generated in the weak PUF state to control the configuration state transition sequence of the CF PUF. This approach allows the PUF’s challenge-response mapping structure to be dynamically controlled by the unpredictable weak PUF, rather than relying on a fixed PUF structure, thereby providing enhanced resistance to white-box attacks through reverse engineering. To hide the weak PUF characteristics and prevent reverse analysis attackers from using divide-and-conquer methods to break the weak PUF, we employ LUT6_2 resources to embed the weak PUF structure into strong PUFs with minimal hardware overhead. The proposed CF PUF was implemented and evaluated on an Xilinx Artix-7 FPGA hardware platform. Experimental results demonstrate that the proposed solution achieves good prediction resistance, with the best modeling accuracy limited to 54.6% under 1M CRPs across Logistic Regression (LR), Support Vector Machine (SVM), Artificial Neural Network (ANN), and Covariance Matrix Adaptation Evolution Strategy (CMA-ES) attacks. Moreover, it maintains good reliability, averaging 98.02% under temperature variations from -20 °C to 80 °C.

As a lightweight hardware security primitive, physical unclonable functions (PUFs) can provide reliable identity authentication for the Internet of Things (IoT) devices with limited resources. Arbiter PUF (APUF) is one of the most well-known PUF circuits. However, its hardware implementation has poor reliability on field programmable gate arrays (FPGAs). This paper proposed a highly reliable APUF that uses a delay difference quantization strategy (DDQ-APUF). By adding multiple configurable delay units to the two symmetrical paths of the conventional APUF, the delay difference between the two symmetrical paths of APUF can be obtained by collecting the output of APUF under different delay configurations. Compared to conventional APUFs, DDQ-APUF does not use the arbitration result of signal transmission in two symmetric paths as its response, but rather uses the quantified delay difference between the two paths as its response. A tolerance threshold is adopted in the authentication to accommodate the variations in delay differences due to environmental changes. Moreover, the modeling attack resistance of DDQ-APUF is evaluated, and a strategy for improving this resistance by incorporating pseudo-XOR technique is proposed. The circuit was implemented on Xilinx Artix-7 FPGAs and the experimental results show that the reliability achieves 99.95% with non-CRP-discard.

Simple authentication protocols based on conventional physical unclonable functions (PUFs) are vulnerable to modeling attacks and other security threats. This article proposes an arbiter PUF based on a linear feedback shift register (LFSR-APUF). Different from the previously reported linear feedback shift register (LFSR) for challenge extension, the proposed scheme feeds the external random challenges into the LFSR module to obfuscate the linear mapping relationship between the challenge and response. It can prevent attackers from obtaining valid challenge–response pairs (CRPs), increasing its resistance to modeling attacks significantly. A 64-stage LFSR-APUF has been implemented on a field programmable gate array (FPGA) board. The experimental results reveal that the proposed design can effectively resist various modeling attacks, such as logistic regression (LR), evolutionary strategy (ES), artificial neuro network (ANN), and support vector machine (SVM) with a prediction rate of 51.79% and a slight effect on the randomness, reliability, and uniqueness. Further, a lightweight authentication protocol is established based on the proposed LFSR-APUF. The protocol incorporates a low-overhead, ultralightweight, novel private bit conversion Cover function that is uniquely bound to each device in the authentication network. The proposed authentication protocol not only resists spoofing attacks, physical attacks, and modeling attacks effectively but also ensures the security of the entire authentication network by transferring important information in encrypted form from the server to the database even when the attacker completely controls the server.

Strong PUF represented by arbiter PUF is suitable for the authentication of resource-constrained devices. However, conventional arbiter PUF is vulnerable to modeling attacks due to its linear structure. In this paper, we propose an arbiter PUF with time-variant obfuscation scheme (TVO-APUF), which feeds the external random challenges into the linear feedback shift register (LFSR) module to determine the real challenge of underlying arbiter PUF, thus obfuscating the linear mapping relationship between challenge and response, leading to significant resistance to modeling attacks. In addition, LFSR module with low hardware overhead can be updated at any time to prevent reply attack. We implement a 48-stage TVO-APUF on Xilinx Spartan-6 FPGA board. The experimental results show that the proposed TVO-APUF can effectively resist modeling attacks such as logistic regression (LR), support vector machine (SVM) and evolutionary strategy (ES) with a maximum prediction rate of 53 % and slight effects on uniformity, stability and uniqueness.

A wideband differential linear low-noise transconductance amplifier (LNTA) is proposed for SAW-less applications. An active combiner provides a dual-loop feedback for wideband matching with power efficiency. Operating as an auxiliary common source (CS) stage, complementary multi-gated transistor (MGTR) configurations are employed to compensate for the second- and third-order nonlinearity of the main CS stage, improving small-signal linearity. Large-signal linearity is also enhanced due to Class AB configurations. Additionally, the push-pull operation of the main CS stage and the auxiliary CS stage preserves good large-signal input matching performance. Implemented in a 0.18-μm CMOS process, the measured LNTA chip provides a minimum noise figure (NF) of 2.5 dB, and a maximum transconductance value of 76.7 mS from 0.1 to 3.1 GHz. On average, an input 1-dB compression point (IP1 dB) of 2.3 dBm and an input third-order intercept point (IIP3) of 17.8 dBm are obtained, respectively. The blocker NF is 4.0 dB under a 0 dBm blocker injection while the S11<; -10 dB is maintained even with the blocker input of -3.1 dBm. The LNTA core only draws 13.3 mA from a 1.8 V supply.

A low-voltage high-swing voltage-biased Colpitts voltage-controlled oscillator (VCO) is proposed for wireless applications. A small capacitive voltage divide factor is chosen to enhance the output swing and improve the phase noise performance. To further enhance the negative resistance, and thus decrease the start-up time, the bulk terminals of the gm-boosting transistors are dynamic-biased by the low-swing nodes provided by the inherent tapped capacitors in Colpitts VCOs. Due to the switching operation mode of the gm-boosting transistors and the absence of common-mode nodes for the switching transistors, the flicker noises up-conversion is largely suppressed. Designed in a 0.18-μm CMOS process, the postlayout simulation results show that it provides a phase noise of -127.66 dBc/Hz at 1 MHz offset centered at 3.76 GHz and a figure-of-merit (FoM) of 192.4 dBc/Hz while dissipating 4.71 mW from a 0.6 V supply. The tuning range is 17% (from 3.28 GHz to 3.89 GHz) and the 1/f3phase noise corner is only 60 kHz.

A one-step sneak-path free read scheme for resistive crossbar memory is proposed in this article. During read operation, it configures the crossbar array into a four-terminal resistance network, which is composed of the selected cell and three other resistors corresponding to unselected cells that contribute to the sneak-path. Two sensing voltages with equal potential are applied to three terminals of the network. One is for sensing the resistance of the selected cell; the other is for creating zero-voltage drop across one of the three resistors, which connects the sneak-path to the selected cell. This effectively suppresses the current injected by the sneak-path to the selected cell-sensing loop. This work also proposes a cost-effective data-encoding circuit that guarantees that at least half of the memory cells are in a high-resistance state, which further minimizes sneak-path current. The impact of key design parameters, such as sensing voltage, switch on-resistance, and the ratio of memory cell resistances in different states, as well as nonideal effects are investigated. Equations for estimating the maximum array size to share a single read circuit are derived. The effectiveness of the proposed design has been validated via circuit simulations. Impacts of the word-/bit-line resistance are also analyzed.

Voltage comparators have been widely used in low-power sensor wake-up circuits for extracting digital bits from the envelope of received RF signals. This paper presents an alternative circuit to such comparators. The proposed circuit extracts digital bits by detecting the falling edge of the envelope signal. Since it essentially compares the values of the same signal at different times, it is potentially more robust than the comparator based approach, which compares the peak voltage of the envelope signal with another reference voltage. The design issues for using the proposed edge detection circuit into different wake-up receiver architectures are discussed and simulation results are also presented to demonstrate the performance of the proposed circuit.