[Paper Review] Modeling Attack Resilient Reconfigurable Latent Obfuscation Technique for PUF based Lightweight Authentication

Yansong Gao, Said F. Al-Sarawi+3 more|arXiv (Cornell University)|Jun 20, 2017

Physical Unclonable Functions (PUFs) and Hardware Security24 references10 citations

TL;DR

This paper proposes a reconfigurable latent obfuscation technique for PUF-based lightweight authentication, called OB-PUF, which enhances resistance to powerful CMA-ES modeling attacks by dynamically reconfiguring hidden pattern vectors that act as one-time pads. The method obscures both challenge and response relationships, enabling unbounded authentication rounds without compromising security, and demonstrates strong resilience against state-of-the-art modeling attacks through extensive evaluation.

ABSTRACT

Physical unclonable functions (PUFs), as hardware security primitives, exploit manufacturing randomness to extract hardware instance-specific secrets. One of most popular structures is time-delay based Arbiter PUF attributing to large number of challenge response pairs (CRPs) yielded and its compact realization. However, modeling building attacks threaten most variants of APUFs that are usually employed for strong PUF-oriented application---lightweight authentication---without reliance on the securely stored digital secrets based standard cryptographic protocols. In this paper, we investigate a reconfigurable latent obfuscation technique endowed PUF construction, coined as OB-PUF, to maintain the security of elementary PUF CRPs enabled authentication where a CRP is never used more than once. The obfuscation---determined by said random patterns---conceals and distorts the relationship between challenge-response pairs capable of thwarting a model building adversary needing to know the exact relationship between challenges and responses. A bit further, the obfuscation is hidden and reconfigured on demand, in other words, the patterns are not only invisible but also act as one-time pads that are only employed once per authentication around and then discarded. As a consequence, the OB-PUF demonstrates significant resistance to the recent revealed powerful Evaluation Strategy (ES) based modeling attacks where the direct relationship between challenge and response is even not a must. The OB-PUF's uniqueness and reliability metrics are also systematically studied followed by formal authentication capability evaluations.

Motivation & Objective

• To address the vulnerability of traditional PUFs to advanced modeling attacks, particularly CMA-ES, in lightweight authentication systems.
• To eliminate the need for limiting authentication rounds, as required in prior works like [12], while maintaining strong security.
• To design a PUF construction that hides the true challenge-response relationship through dynamic, one-time obfuscation patterns.
• To evaluate the resilience of the OB-PUF against the most powerful known modeling attacks, including those based on Hamming weight and response reliability.

Proposed method

• The OB-PUF uses randomly generated pattern vectors to obfuscate both challenges and responses, concealing the true relationship between them.
• Obfuscation patterns are reconfigured per authentication session and act as one-time pads, ensuring they are never reused.
• The challenge obfuscation is applied by XORing the input challenge with a selected pattern vector, while response obfuscation balances the Hamming weight to resist fitness-based attacks.
• A server-aided authentication protocol enables the trusted server to verify responses using its knowledge of the current obfuscation pattern, while the device discards the pattern after use.
• The system uses a reconfigurable block that selects from multiple APUF instances via pattern vectors, increasing complexity for model-building adversaries.
• The method is formally evaluated using CMA-ES attacks under various configurations, with security assessed via Hamming weight and reliability-based fitness functions.

Experimental results

Research questions

• RQ1 Can a PUF-based authentication system maintain strong security against CMA-ES modeling attacks without restricting the number of authentication rounds?
• RQ2 How effective is response obfuscation in neutralizing Hamming weight-based fitness functions used in CMA-ES attacks?
• RQ3 Can dynamic reconfiguration of obfuscation patterns prevent adversaries from learning the underlying challenge-response mapping through repeated observations?
• RQ4 What is the impact of increasing the number of APUFs within the pattern vector block on the model-building adversary’s success rate?
• RQ5 How does the OB-PUF’s reliability and uniqueness compare to standard APUFs under the same conditions?

Key findings

• The OB-PUF achieves significant resistance to CMA-ES attacks, even when the direct challenge-response relationship is not required, due to hidden and reconfigurable obfuscation patterns.
• The Hamming weight of obfuscated responses is balanced, effectively eliminating the possibility of Hamming weight-based fitness function attacks.
• Response obfuscation prevents reliability-based CMA-ES attacks, as the adversary cannot determine correct response reliability without knowing the full challenge feature.
• The system supports unbounded authentication rounds, unlike prior works that required rate limiting to prevent model building.
• Increasing the number of APUFs in the XOR block (e.g., p=4, m=18) exponentially reduces the adversary’s ability to predict all pattern vectors correctly.
• Formal evaluation confirms that the OB-PUF maintains high uniqueness and reliability, with low false acceptance and rejection rates in authentication scenarios.