A Lightweight Mutual Authentication Protocol Based on Physical Unclonable Functions

The desire to connect more and more devices and to make them more intelligent and more reliable, is driving the needs for the Internet of Things more than ever. Such IoT edge systems require sound security measures against cyber-attacks, since they are interconnected, spatially distributed, and operational for an extended period of time. One of the most important requirements for the security in many industrial IoT applications is the authentication of the devices. In this paper, we present a mutual authentication protocol based on Physical Unclonable Functions, where challenge-response pairs are used for both device and server authentication. Moreover, a session key can be derived by the protocol in order to secure the communication channel. We show that our protocol is secure against machine learning, replay, man-in-the-middle, cloning, and physical attacks. Moreover, it is shown that the protocol benefits from a smaller computational, communication, storage, and hardware overhead, compared to similar works.

I. Introduction

The Internet of Things (IoT) has opened up its applications in various areas by interconnecting billions of lightweight devices, sensors, and actuators [1]. However, because of the distributed nature of IoT systems, they are prone to many types of attacks. Moreover, such systems usually consist of nodes with limited computational, power, and memory resources, for which suitable security mechanisms remain a significant challenge. Physical unclonable functions (PUFs) are one of the solutions to enhance the IoT security. PUF extracts the uncontrollable anomality introduced during the manufacturing of a hardware, which makes it unique comparing to the other seemingly similar hardwares. PUF -based authentication solutions are lightweight, secure and do not require secure storage on the device. Such features make these solutions suitable to be implemented in IoT systems. Hardware security primitives and more specially PUF is recommended in many studies to overcome IoT security challenges [2]. In our previous works on PUFs, we have proposed a method to maximize the entropy extracted from analog PUFs [4]. In this work, we present a PUF -based mutual authentication protocol, which employs PUF challenge-response pairs (CRPs) not only to authenticate the backend system, but also the IoT device. The proposed protocol uses a hash function to obfuscate the messages exchanged in the authentication process.