Data Link Layer Network Access Control using Physically Unclonable Functions

Network access control is generally seen as the first line of defense in network security. Being capable of automatically detecting and actively preventing unauthorized intrusion attempts is therefore a desirable property of modern networks, especially in large-scale industrial scenarios. Using MAC address filters, a first security measure on OSI Layer 2 can be established. Though, by using MAC address spoofing, this protection can be circumvented trivially, whereas securing against this attack is a notable challenge. Therefore, this paper introduces a new Layer 2 MAC address spoofing detection and prevention system called ‘PUF-Access-Control-System (PUF-ACS)’, that utilizes Physically Unclonable Functions (PUFs) to derive and bind unique MAC addresses to each device. By using PUFs, nanoscale imperfections during chip manufacturing are exploited to derive a device-unique secret that can only be generated by the device possessing the PUF. To quantify the latency impact and the security implications of the proposed solution, this paper also provides a detailed evaluation of the concept in terms of additional latency, and scalability considerations.