Publications

Abstract: The S-PUF and Sn-PUF designs (proposed in INDOCRYPT2019) are one of the contemporary composite strong PUF candidates of the Delay-PUF family that exhibit two distinguishing and notable attributes – (i) it is one of the few PUF constructions which is guided by theoretical analysis of the Strict Avalanche Criteria (SAC) property and not by ad-hoc choices; and (ii) though its construction is quite similar to XOR PUFs, it has very good reliability property unlike the former design due to the introduction of Maiorana-McFarland (MM) Bent Function. These make Sn-PUF to be a very good candidate for strong PUF proposals and an interesting target from the point of view of attackers. In this work, we testify that a novel reliability based machine learning attack can be launched in this architecture against the original authors’ claim. Though it is challenging to launch a classical or reliability based ML attack directly, we leverage the bias introduced by the AND operation in the M-M bent function due to its non-linearity property. Our proposed novel attack framework, SACReD, is able to break S8, S10 and S12-PUF designs, which were originally

Abstract: Physically Unclonable Functions (PUFs) are widely adopted in various lightweight authenticating devices due to their unique fingerprints – providing uniform, unpredictable and reliable nature of responses. However, with the growth of machine learning (ML) attacks in recent times, it is imperative that the PUFs need to be resilient to such modeling attacks as well. Consequently, analyzing the learnability of PUFs has initiated a new branch of study leading to establishing provable guarantees (and PAC-learnability) of various PUF designs. However, these derivations are often carried out manually while implementing the design and thereby cannot automatically adjust the changes in PUF designs or its various compositions. In this paper, for the first time, we present an automated framework, called PUF-G, to reason about the PAC-learnability of PUF designs from an architectural level. To enable this, we propose a formal PUF representation language by which any architectural PUF design and its compositions can be specified upfront. This PUF specification can be automatically analyzed through a CAD framework by translating the same to an interim model and then deriving the PAC-learnability bounds from the model. Such a tool will help the designer to explore various compositional architectures of PUFs and its resilience to ML attacks automatically before converging on a strong PUF design for implementation. We also show the efficacy of our proposed framework over a wide range of PUF architectures while automatically deriving their learnability guarantees. As a matter of independent interest, the framework presents the first reported proofs to show that Interpose-PUF (newly proposed), MUX-PUF, FF-APUF, FF-XOR APUF and DA-PUF, are all PAC-learnable.

Abstract: In this paper, we present a novel formal analysis scheme considering that the fabrication of a batch of N > 1 PUFs is equivalent to drawing random instances of Boolean mappings. We model PUFs as black-box Boolean functions of dimension m × 1 and show combinatorially that random designs of such m × 1 functions exhibit correlation-spectra which can be used to characterize random and thus good designs of PUFs. We first develop theoretical results to quantize the correlation values and subsequently find the expected number of pairs of such Boolean functions which should belong in different regions of the spectra. We extend the concept of correlation to PUFs and theoretically prove that a randomly chosen sample of PUFs and Boolean functions follow the same distribution. In addition to this, we show through extensive experimental results that a randomly chosen sample of such PUFs also resembles the correlation-spectra property of the overall PUF population. We finally propose a formal analysis tool for evaluation of PUFs by observing the correlation-spectra of the PUF instances under test. We show through experimental results on 50 FPGAs that when the PUFs are infected by faults the usual randomness tests for the PUF outputs such as uniformity, fail to detect any aberration. However, the spectral-pattern is clearly shown to get affected, which we demonstrate by standard statistical measure like KL Divergence.

Abstract: Data collection is one of the fundamental operations in Wireless Sensor Networks (WSNs). Sensor nodes can sense the data and forward the sensed data to the sink in multi hop communication. During the process of data collection, nodes consume a significant amount of energy by transmitting and receiving of data. Therefore, the key challenge is to minimize the energy dissipation of the nodes so as the network lifetime is maximized. In this paper, we propose a Switching Policy based Energy Aware Routing algorithm (SPEAR) for WSNs that aims to reduce energy usage of nodes and thus extends the network lifetime. In a data collection round, SPEAR constructs an energy balanced data collection tree considering the residual energy level of nodes. Furthermore, a switching policy is introduced to achieve energy balancing and longer lifetime. The proposed SPEAR directs some sensor nodes to switch to the new parents with higher energy when the energy level of the older parent is below some threshold value. The proposed method is loop less and dynamic in nature. Our algorithm is validated through simulation and compared with the existing routing protocol using some performance metrics. Simulation results demonstrate that SPEAR improves the network lifetime, alive nodes count and average residual energy significantly.

Abstract: Physically Unclonable Functions (PUFs) with large challenge space (also called Strong PUFs) are promoted for usage in authentications and various other cryptographic and security applications. In order to qualify for these cryptographic applications, the Boolean functions realized by PUFs need to possess a high nonlinearity (NL). However, with a large challenge space (usually ≥ 64 bits), measuring NL by classical techniques like the Walsh transformation is computationally infeasible. In this paper, we propose the usage of a heuristic-based measure called the non-homomorphicity test, which estimates the cryptographic NL of Boolean functions with high accuracy in spite of not needing access to the entire challenge-response set. We also combine our analysis with a technique used in linear cryptanalysis, called Piling-up lemma, to measure the NL of popular PUF compositions. As a demonstration to justify the soundness of the metric, we perform extensive experimentation by first estimating the NL of constituent Arbiter/Bistable Ring PUFs using the non-homomorphicity test, and then applying them to quantify the same for their XOR compositions namely XOR Arbiter PUFs, and XOR Bistable Ring PUF. Our findings show that the metric explains the impact of various parameter choices of these PUF compositions on the NL obtained and thus promises to be used as an important objective criterion for future efforts to evaluate PUF designs. While the framework is not representative of the machine learning robustness of PUFs, it can be a useful complementary tool to analyze the cryptanalytic strengths of PUF primitives.

Abstract: Remote attestation is a request-response based security service that permits a trusted entity (verifier) to check the current state of an untrusted remote device (prover). The verifier initiates the attestation process by sending an attestation challenge to the prover; the prover responds with its current state, which establishes its trustworthiness. Physically Unclonable Function (PUF) offers an attractive choice for hybrid attestation schemes owing to its low overhead security guarantees. However, this comes with the limitation of secure storage of the PUF model or large challenge-response database on the verifier end. To address these issues, in this work, we propose a hybrid attestation framework, named PReFeR, that leverages a new class of hardware primitive known as Physically Related Function (PReF) to remotely attest low-end devices without the requirement of secure storage or heavy cryptographic operations. It comprises a static attestation scheme that validates the memory state of the remote device prior to code execution, followed by a dynamic run-time attestation scheme that asserts the correct code execution by evaluating the content of special registers present in embedded systems, known as hardware performance counters (HPC). The use of HPCs in the dynamic attestation scheme mitigates the popular class of attack known as the time-of-check-time-of-use (TOCTOU) attack, which has broken several state-of-the-art hybrid attestation schemes. We demonstrate our protocol and present our experimental results using a prototype implementation on Digilent Cora Z7 board, a low-cost embedded platform, specially designed for IoT applications

Abstract: Besides enormous research efforts in the design of Physically Unclonable Functions (PUFs), its vulnerabilities are still being exploited using machine learning (ML) based model-building attacks. Due to inherent complicacy in exploring and manually converging to a strong PUF composition, the challenge of building ML-attack resistant PUFs continues. Hence, it becomes imperative to develop an automated framework that can formally assess the learnability of different PUF constructions and compositions to guide the designer to explore resilient PUFs. In this work, we present an automated analysis framework (PARLE-G), to formally represent and evaluate the Probably Approximately Correct (PAC) learnability of PUF constructions and their compositions. A high-level specification language PUF-G has been developed to structurally represent any PUF composition comprising a specified set of primitive components and composition operations. The tool takes a PUF design represented in PUF-G language as input and returns its PAC learnability result, identifying a suitable PAC learning algorithm and the PAC model parameters based on the input PUF design. PUF designs proven to be learnable by PARLE-G are segregated into different classes based on the asymptotic complexity of their learnability bounds. Such automated analysis helps a designer to make informed design choices, thereby strengthening a PUF construction from the architectural level.

Abstract: This paper initiates the study of ``Cryptophasia in Hardware'' -- a phenomenon that allows hardware circuits/devices with no pre-established secret keys to securely exchange secret information over insecure communication networks. The study of cryptophasia is motivated by the need to establish secure communication channels between lightweight resource-constrained devices incapable of \textit{securely} storing cryptographic keys and/or executing resource-intensive cryptographic protocols.

In this paper, we introduce a novel concept called \emph{Physically Related Functions}~({\em PReFs}) that can exchange secret information in a secure and authenticated manner over insecure networks. This function can be visualized as an abstraction of Strong Physically Unclonable Functions (PUFs). Strong PUFs have the limitation in communicating between two identical devices, an issue that we address in the definition of PReFs.

We describe a formal framework for analyzing the functional and security requirements of PReFs. In this framework, we present a lightweight~{(in terms of computation cost)} yet provably secure authenticated key-exchange protocol that relies only on PReFs and makes no additional assumptions~(such as secure storage of cryptographic keys). 

Finally, we present a proof-of-concept realization of PReFs in hardware over Digilent Cora Z7 -- a low-cost development platform~(consisting of an ARM Cortex processor and a Xilinx FPGA) that is particularly suitable for real-world IoT applications involving resource-constrained devices. We validate that our realization of PReFs satisfies all the properties warranted by our formal framework. We further demonstrate the efficacy of our proposed protocol by analyzing its performance (in terms of computational and communication latency) over the Digilent Cora Z7 platform.

Abstract: Hardware security circuits based on Physically Unclonable Functions (PUF) are finding widespread use due to increasing adoption of IoT devices. However, existing strong PUFs such as Arbiter-PUF (APUF) and its compositions are susceptible to machine learning (ML) attacks due to a linear relationship between the challenge and its response. In this paper, we present a Recurrence-based PUF (Rec-PUF) which uses feedback and XOR function together to significantly improve ML-attack resistance, without significant reduction in reliability. Our method is generic and works for both analog and digital PUF cores. As proof of the claim, we apply recurrence on an analog PUF using current mirror array validated on ASIC libraries, referred to as Rec-CMAPUF. At the other end, we also design and evaluate a digital PUF fortified with recurrence, called Rec-DAPUF, based on double arbiter logic and prototyped on FPGAs. Our result shows that ML resistance of Rec-CMAPUF is within 62% with 138, 000 CRPs, with reliability of 95%. Likewise, ML resistance of Rec-DAPUF is around 64%, with average reliability of 95.9%. The merit of recurrence wrt. ML attacks can be understood by the fact that without recurrence the CMAPUF/DAPUF can be modeled with 99%/80% accuracy, thus showing the efficacy and also applicability of the technique for various PUFs and platforms. In addition recurrence is suitably traded to ensure acceptable power consumption of 12.3μW with energy/bit of ≈ 0.16 pJ for Rec-CMAPUF, estimated through SPICE simulations, while an 165.4 pJ/bit consumption for Rec-DAPUF, based on FPGA results.

Abstract: In this paper, a community-based cooperative energy consumption scheme in smart grid, which alleviates energy consumption cost to customers, is proposed. The concept of community among customers in the smart grid is discussed. To form different communities among customers, a community-based game among customers is orchestrated, while considering the dynamic nature of the composition of the community. A practical scenario involving multiple customers forming a group and cooperating with one another is considered. The proposed dynamic community formation scheme always achieves an equilibrium state. Furthermore, the proposed scheme also helps to reduce peak-to-average ratio of the energy demands from the customers in different time periods. Simulation results show that the proposed cooperation-based scheme outperforms the existing schemes. It is also shown that customers can minimize their energy consumption cost by approximately 16% using the proposed scheme, compared to noncooperative approaches.

Abstract: Interpose PUF~(iPUF) is a strong PUF construction that was shown to be vulnerable against empirical machine learning as well as PAC learning attacks. In this work, we extend the PAC Learning results of Interpose PUF to prove that the variants of iPUF  are also learnable in the PAC model under the Linear Threshold Function representation class.

Abstract: In this work, we prove that Multiplexer PUF~(MPUF) and S_N-PUF are learnable in the PAC model. First, we show that both the designs can be represented as a function of Linear Threshold Functions. We show that the noise sensitivity of (n,k)-MPUF and S_N-PUF can be bounded by O(2^{k} \sqrt{\epsilon}) and O(N\sqrt{\epsilon}) respectively. Finally, we show that as a result of bounded noise sensitivity, both the designs can be accurately approximated using low degree algorithm. Also, the number of labelled examples~(challenge-response pairs) required by the algorithm is polynomial in the input length and PAC model parameters.

Abstract: We present a syntactical representation (grammar) to formally describe any PUF construction. We then use this grammar to represent several PUF designs.

Abstract: In recent years, the conventional power grid system has been streamlined towards Smart grid infrastructure that empowers two-way communication between the consumers and the utility providers. This however also makes the grid more susceptible towards faults as well as physical and cyber attacks. In this work, we propose a Physically Unclonable Function (PUF) and Blockchain based detection and prevention mechanism to secure the Smart grid system against such faults and adversarial threats. In this context, we discuss a recently proposed Manipulation of demand via IoT (MadIoT) attacks, False Data Injection Attacks (FDIA) via Smart meters and Electric Fault Attacks (EFA) on Smart grid which can lead to localized blackout, falsified load forecasting, imbalance in demand-response, generator tripping, frequency instability and loss of equipment. To detect these threats and to trace back to the source of such attacks, we inspect the potential of the promising blockchain technology which gives a mechanism to authenticate and ensure the integrity of real power consumption information. However, the blockchain needs to be augmented with a root-of-trust, to bind the Smart meter with a unique hardware fingerprint. This can be achieved through Physically Unclonable Functions (PUFs) which is considered to be an unconventional cryptographic primitive and used for keyless authentication. The proposed PUF based authentication scheme would further prevent the system from injection of any false data by an illegitimate Smart meter that aids to false power estimation. The novelty of the proposed work is to blend these two technologies in developing a robust and secure framework which detects and prevents all of the above mentioned security vulnerabilities and can be easily integrated with the Smart grid infrastructure. Finally an end-to-end demonstration of the attack has been presented using MATLAB and Power World simulator and the proposed framework has been prototyped using commercial off-the-shelf products such as Raspberry Pi and Artix 7 FPGA along with an in-house blockchain simulator.

Abstract: In this work, we prove that Interpose PUF is learnable in the PAC model. First, we show that Interpose PUF can be approximated by a Linear Threshold Function (LTF), assuming the interpose bit to be random. We translate the randomness in the interpose bit to classification noise of the hypothesis. Using classification noise model, we prove that the resultant LTF can be learned with number of labelled examples (challenge response pairs) polynomial in the number of stages and PAC model parameters.

Abstract: Testability of digital ICs rely on the principle of controllability and observability. Adopting conventional techniques like scan-chains open up avenues for attacks, and hence cannot be adopted in a straight-forward manner for security chips. Furthermore, testing becomes incredibly challenging for the promising class of hardware security primitives, called PUFs, which offer unique properties like unclonability, unpredictibility, uniformity, uniqueness, and yet easily computable. However, the definition of PUF itself poses a challenge on test engineers, simply because it has no golden response for a given input, often called challenge. In this paper, we develop a novel test strategy considering that the fabrication of a batch of N>1 PUFs is equivalent to drawing random instances of Boolean mappings. We hence model the PUFs as black-box Boolean functions of dimension m×1, and show combinatorially that random designs of such functions exhibit correlation-spectra which can be used to characterize random and thus {\em good} designs of PUFs. We first develop theoretical results to quantize the correlation values, and subsequently the expected number of pairs of such Boolean functions which should belong to a given spectra. In addition to this, we show through extensive experimental results that a randomly chosen sample of such PUFs also resemble the correlation-spectra property of the overall PUF population. Interestingly, we show through experimental results on 50 FPGAs that when the PUFs are infected by faults the usual randomness tests for the PUF outputs such as uniformity, fail to detect any aberration. However, the spectral-pattern is clearly shown to get affected, which we demonstrate by standard statistical tools. We finally propose a systematic testing framework for the evaluation of PUFs by observing the correlation-spectra of the PUF instances under test.