Search

This study focuses on designing enhanced Physically Unclonable Functions (PUFs) based on SRAM devices and improving the security of cryptographic systems. Most SRAM PUFs are limited in their number of CRPs, which makes them vulnerable to enrollment attacks. In this research, we present an SRAM-based PUF design that greatly increases the number of CRPs and the entropy of the generated bits by performing exclusive-or (XOR) on the responses of two SRAM devices. This was implemented using a readily available development board, SRAM devices, and a user-friendly custom circuit board for cryptographic key generation. The cryptographic protocol was implemented using both C++ and python3. The proposed SRAM PUF design was experimentally demonstrated and showed substantial improvements in the security of various cryptographic applications as a hardware authentication device. It also addresses the specific vulnerabilities of legacy designs.

In the proposed protocol, a trusted entity interacts with the terminal device of each user to verify the legitimacy of the public keys without having access to the private keys that are generated and kept totally secret by the user. The protocol introduces challenge–response–pair mechanisms enabling the generation, distribution, and verification of cryptographic public–private key pairs in a distributed network with multi-factor authentication, tokens, and template-less biometry. While protocols using generic digital signature algorithms are proposed, the focus of the experimental work was to implement a solution based on Crystals-Dilithium, a post-quantum cryptographic algorithm under standardization. Crystals-Dilithium generates public keys consisting of two interrelated parts, a matrix generating seed, and a vector computed from the matrix and two randomly picked vectors forming the secret key. We show how such a split of the public keys lends itself to a two-way authentication of both the trusted entity and the users.

Key exchange protocols are a crucial part of the internet-based communication between connected devices in IoT. In this regard, Physically Unclonable Function (PUF) has been an enabler to provide intrinsic highly randomized source for key generation without requiring extra storage components. PUF however, is an unstable source. In that sense, Fuzzy Extractor (FE) methods with Error Correction Code (ECC) are used to ensure reliability of the key value. FE methods incorporate publicly available helper data to recreate an originally enrolled encryption key from the PUF in mission mode. It is crucial to ensure that the publicly available helper data leaks no valuable information from the source key value to allow untrusted parties to recreate the key. Here the adversary’s work is to modify the helper data to decrease the entropy of the recovered codes by the ECC, and push the communicating parties in generating the key that is known to the adversary as well. In this work, we propose to protect helper data via a PUF-based masking mechanism with variable positioning. Masking with variable positioning adds a new fold of complexity for the adversary which is capable to considerably increase the guessing entropy. Our experimental results show that for 256-bit helper data, a 16-bit mask value can increase the guessing entropy by 5 folds against a Reed Muller majority logic vote decoder. Moreover, we show that an increased number of masking such as 4 times a 16-bit masking, can increase the guessing entropy against the same Reed Muller decoding function by 20 folds.

In this paper, we present the characterization of pre-formed resistive random access memories to design physical unclonable functions and experimentally validate inherent properties such as tamper sensitivity and a self-destroy mode. The physical unclonable functions were tested for repetitive use, temperature effects, and aging. The variations during successive response generation cycles and drift rates are quantized to explore their reliability. We define tamper-sensitivity as the ability to detect tampering attacks. To establish tamper sensitivity, the cells were characterized for higher current sweeps, and the injected current at which they break down is extracted and analyzed to determine suitable operating ranges. Our experimental results show that at least 91% of the cells can generate keys protected by the scheme, while 22% of the sensing elements are triggered. Finally, the cells were characterized for high Voltage sweeps to be able to destroy the physical unclonable functions on-demand when tampering activity is detected. A fixed Voltage of 1.9 V is enough to destroy the entire array.

The offline dictionary attacks on the database of passwords (PW) or even hashed PW are damaging as a single server break-in leads to many compromised PWs. In this regard, using Physical Unclonable Functions (PUFs) to increase the security of PW manager systems has been recently proposed. Using PUFs allows replacing the hashed PW with PUF responses, which provide an additional hardware layer of security. In this way, even with accessing the database, an adversary should have physical control of the PUF to find the PWs. However, such a scheme cannot operate without a backup in case of catastrophic failure of the PUFs. The likelihood of a failure is low unless the opponent finds a way to destroy the PUF. The scheme used in this article includes a mechanism to make the system works consistently if the PUF fails, with redundant elements. In this method, two PUF outputs are saved in the database to register a user. In authentication, the first PUF output in the database is just checked. The second PUF output in the database is only checked in the exceptional cases when the first PUF does not work correctly; therefore, both false reject rates and latencies are not degraded. A PW manager node is implemented using a low-cost microcontroller, SRAM PUF, and nonvolatile SRAM. The nonvolatile SRAM is embedded in the PWM node circuit as a local database. Statistical tests on the applied commercial SRAM in this article show better PUF quality than those used in previous research. Also, to handle the error in PUF responses, only the stable SRAM cells are used. This article presents the first prototype of a resilient PW manager node with an embedded local database to the best of our knowledge.

Using Physical Unclonable Functions (PUFs) within the server-side has been recently proposed to address security vulnerabilities of the password (PW) authentication mechanism, including attacks on the database (DB) of user credentials. Practicing this idea using available memory technologies and constrained hardware modules may offer an additional hardware security layer. Thus, finding the PWs would require the attacker to access both the hardware containing the PUF and the information stored in the DB. PUFs have been used with other cryptographic algorithms in previous studies to improve the system’s security further. However, these studies have overlooked the challenges of implementing these algorithms with constrained hardware devices. Therefore, the trade-off between the achieved security and desired efficiency is still a challenge. The presented hardware-software PUF-based solutions lead to faster computation in the server-side hardware. Also, the client-side protocol can cope with the resource limitations existing in essential applications, including constrained IoTs. Moreover, the scheme handles the instability and bit alias of the Static Random-Access Memory (SRAM) PUF. This paper’s reliable, low-cost, and efficient prototype shows the functionality of a hardware-dependent protocol that is resistant to insider, PW guessing, and man-in-the-middle attacks. The presented hardware-software can be easily integrated with the server-side. Statistical tests on the embedded SRAM show that this paper protocol improves PUF entropy responses stored in the DB. Besides, the experimental results of this work show the possibility of obtaining an SRAM with very low intra-PUF variation without using any extra hardware overhead.

The methods proposed in this paper are leveraging Challenge–Response–Pair (CRP) mechanisms that are directly using each digital file as a source of randomness. Two use cases are considered: the protection and verification of authenticity of the information distributed in storage nodes and the protection of the files kept in terminal devices operating in contested zero-trust environments comprised of weak signals in the presence of obfuscating electromagnetic noise. With the use of nonces, the message digests of hashed digital files can be unique and unclonable; they can act as Physical Unclonable Functions (PUF)s in challenge–response mechanisms. During enrollment, randomly selected “challenges” result in unique output data known as the “responses” which enable the generation and distribution of cryptographic keys. During verification cycles, the CRP mechanisms are repeated for proof of authenticity and deciphering. One of the main contributions of the paper is the development of mechanisms accommodating the injection of obfuscating noises to mitigate several vectors of attacks, disturbing the side channel analysis of the terminal devices. The method can distribute error-free cryptographic keys in noisy networks with light computing elements without relying on heavy Error Correcting Codes (ECC), fuzzy extractors, or data helpers.

Process variations in the manufacturing of digital circuits can be leveraged to design Physical Unclonable Functions (PUFs) that are extensively employed in hardware-based security. Different PUFs based on Magnetic Random-Access-Memory (MRAM) devices have been studied and proposed in the literature. However, most of these studies have been simulation-based, which do not fully capture the physical reality. We present experimental results on a PUF implemented on dies fabricated with a type of the MRAM technology namely Thermally-Assisted-Switching MRAM (TAS-MRAM). To the best of our knowledge, this is the first experimental validation of a TAS-MRAM-based PUF. We demonstrate how voltage values used for writing in the TAS-MRAM cells can make stochastic behaviors required for PUF design. The analysis of the obtained results provides some preliminary findings on the practical application of TAS-MRAM-based PUFs in authentication protocols. Besides, the results show that for key-generation protocols, one of the standard error correction methods should be employed if the proposed PUF is used.

This work details the theory and implementation of a multi-wavelength quantum key distribution (QKD) emulation system with a physical unclonable function (PUF). Multi-wavelength QKD can eliminate the need to share a subsection of the final key for eavesdropper detection and allow for ternary and quaternary data transmission. The inclusion of the PUF adds an additional layer of security. We provide preliminary error analysis of our emulation system. To support this work, we introduce a bitwise transform operator that enables binary output of the PUF to satisfy the ternary and quaternary input requirements of the QKD system.

Lattice and code cryptography can replace existing schemes such as elliptic curve cryptography because of their resistance to quantum computers. In support of public key infrastructures, the distribution, validation and storage of the cryptographic keys is then more complex for handling longer keys. This paper describes practical ways to generate keys from physical unclonable functions, for both lattice and code-based cryptography. Handshakes between client devices containing the physical unclonable functions (PUFs) and a server are used to select sets of addressable positions in the PUFs, from which streams of bits called seeds are generated on demand. The public and private cryptographic key pairs are computed from these seeds together with additional streams of random numbers. The method allows the server to independently validate the public key generated by the PUF, and act as a certificate authority in the network. Technologies such as high performance computing, and graphic processing units can further enhance security by preventing attackers from making this independent validation when only equipped with less powerful computers.

Schemes generating cryptographic keys from arrays of pre-formed Resistive Random Access (ReRAM) cells, called memristors, can also be used for the design of fast true random number generators (TRNG’s) of exceptional quality, while consuming low levels of electric power. Natural randomness is formed in the large stochastic cell-to-cell variations in resistance values at low injected currents in the pre-formed range. The proposed TRNG scheme can be designed with three interconnected blocks: (i) a pseudo-random number generator that acts as an extended output function to generate a stream of addresses pointing randomly at the array of ReRAM cells; (ii) a method to read the resistance values of these cells with a low injected current, and to convert the values into a stream of random bits; and, if needed, (iii) a method to further enhance the randomness of this stream such as mathematical, Boolean, and cryptographic algorithms. The natural stochastic properties of the ReRAM cells in the pre-forming range, at low currents, have been analyzed and demonstrated by measuring a statistically significant number of cells. Various implementations of the TRNGs with ReRAM arrays are presented in this paper.

Blockchain technology is a game-changing, enhancing security for the supply chain of smart additive manufacturing. Blockchain enables the tracking and recording of the history of each transaction in a ledger stored in the cloud that cannot be altered, and when blockchain is combined with digital signatures, it verifies the identity of the participants with its non-repudiation capabilities. One of the weaknesses of blockchain is the difficulty of preventing malicious participants from gaining access to public–private key pairs. Groups of opponents often interact freely with the network, and this is a security concern when cloud-based methods manage the key pairs. Therefore, we are proposing end-to-end security schemes by both inserting tamper-resistant devices in the hardware of the peripheral devices and using ternary cryptography. The tamper-resistant devices, which are designed with nanomaterials, act as Physical Unclonable Functions to generate secret cryptographic keys. One-time use public–private key pairs are generated for each transaction. In addition, the cryptographic scheme incorporates a third logic state to mitigate man-in-the-middle attacks. The generation of these public–private key pairs is compatible with post quantum cryptography. The third scheme we are proposing is the use of noise injection techniques used with high-performance computing to increase the security of the system. We present prototypes to demonstrate the feasibility of these schemes and to quantify the relevant parameters. We conclude by presenting the value of blockchains to secure the logistics of additive manufacturing operations.