Machine Learning Attacks on Low-Cost Reconfigurable XRRO and XRBR PUF Designs

Abstract

Physically unclonable functions (PUFs) can be seen as hardware circuits whose output does not only depend upon the inputs fed to it, but also on the random variation in the integrated circuits (ICs) during its manufacturing process. As a result of their unique hardware fingerprinting, these circuits can be used to authenticate devices among a population of identical silicon chips, much like a human being can be authenticated by their biometrics. In ACM TECS 2019, two low-cost reconfigurable Strong PUF designs namely XOR-based Reconfigurable Bistable Ring PUF (XRBR PUF) and XOR-based Reconfigurable Ring Oscillator PUF (XRRO PUF) have been proposed as a promising low-cost solution for IoT security. The two notable features of these architectures are: i) both of them exploit the logic reconfigurability which is efficient in terms of hardware cost, and ii) they exhibit good uniqueness and reliability properties. These make XRRO and XRBR PUFs good candidates for Strong PUF-based authentications and an interesting target for the machine learning (ML) adversaries as the machine learning resiliency was never discussed for both the cases in the proposal. In this paper, we develop a mathematical model for both of the designs by exploiting a common flaw of not having any non-linear component in the structure. Hence they are proven to be as vulnerable as their forerunner designs such as Configurable Ring Oscillator PUF and Bistable Ring PUFs. Finally, we show through experimental analysis that 128-bit XRBR PUFs can be broken with 10K CRPs with an accuracy of approximately $99\%$. On the other hand, for 127-stage XRRO PUFs having 8, 16, 32, 64 layers of XRROs can be broken with 200K, 1M, 3M, 8M CRPs with an accuracy of approximately 97%–99%.