A Privacy-Preserving Protocol Level Approach to Prevent Machine Learning Modelling Attacks on PUFs in the Presence of Semi-Honest Verifiers

With the ubiquitous and distributed nature of the Internet-of-Things (IoT), various qualities of traditional communication methods for end devices and their verifiers prove insufficient in solving the challenges this new paradigm faces. Many new hardware and software technologies are proposed in an attempt to provide IoT systems with desired security properties while meeting performance requirements. Physically Unclonable Functions (PUFs) are one such technology receiving particular interest from the wider research community by promising to provide low-cost and highly secure key data to enable lightweight authentication protocols for devices operating over publicly accessible networks. PUFs have been the target of Machine Learning Modelling Attacks (ML-MA), which aim to clone the intrinsic behaviour of the PUF to undermine their security. While many PUF-based schemes have been proposed to defend against adversaries who are guaranteed to be dishonest, an area which has not seen significant consideration is one where a normal communication participant cannot always be assumed to act honestly. To the best of our knowledge, this work is the first to consider the concept of 'semi-honest verifier' for PUF-based authentication, taking initial steps to shed light on this prominent issue in IoT by proposing a privacy-preserving mutual authentication protocol which considers security against ML-MA in the presence of such verifiers. Furthermore, this work describes hardware-level considerations for PUF obfuscation by utilising a combination of strong PUF, configurable One-Way Function (OWF) and secure DRAM-PUF and is, therefore, one of the first to integrate PUF obfuscation comprehensively at the protocol level.