and “1” else. A ring oscillator can be modeled in a straightfor-ward fashion by a tuple of frequencies. Its outputon inputis “0” if, and “1” else.D. Numeric CRP Generation, Prediction Error, and Numberof CRPsGiven a PUF-architecture that should be examined, the chal-lenge-response pairs (CRPs) that we used in our ML experi-ments were generated in the following fashion: (i) The delayvalues for this PUF architecture were chosen pseudo-randomlyaccording to a standard normal distribution. We sometimes referto this as choosing a certain PUF instance in the paper. (ii) If aresponse of this PUF instance to a given challenge is needed,the above delays of the two electrical signal paths are simplyadded up and compared. This methodology follows the well-es-tablished linear additive delay model for PUFs , , ,, , . In case of the RO PUF, the frequenciesweresimply chosen at random according to a normal distribution.We use the following definitions throughout the paper: Theprediction erroris the ratio of incorrect responses of the trainedML algorithm when evaluated on the test set. For all appli-cations of LR, the test set each time consisted of 10,000 ran-domly chosen CRPs. For all applications of ES (i.e., for theFeed-Forward Arbiter PUF), the test set each time consistedof 8,000 randomly chosen CRPs. The prediction rate is.(or simply “CRPs”) denotes the number of CRPs em-ployed by the attacker in his respective attack, for example inorder to achieve a certain prediction rate. This nomenclatureholds throughout the whole paper. Nevertheless, one subtle dif-ference should be made explicit: In all applications of LR (i.e.,in Sections III to V),is equal to the size of the training setof the ML algorithm, as one would usually expect. In the appli-cations of ES (i.e., in Section VI), however, the situation is moreinvolved. The attacker needs a test set himself in order to deter-mine which of his many random runs was the best. The valuegiven in the tables and formulas of Section VI hence re-flects the sum of the sizes of the training set and the test setemployed by the attacker.E. FPGA CRP CollectionTo obtain CRP data from FPGAs, ten independent instancesof Arb-PUFs have been implemented on Spartan-6 FPGAs. TheArb-PUFs were composed of 64 pairs of multiplexers (MUXs)and a Dflip-flop based arbiter, and were implemented in Verilog.In order to balance FPGA routing asymmetries, which wouldotherwise dominate the effect of manufacturing variations, alookup table (LUT) based Programmable Delay Line (PDL) hasbeen implemented, as suggested by Majzoobiet al., .We collected 200,000 CRPs from each of our ten FPGA Arb-PUFs instances, resulting in two million CRPs altogether. Foreach CRP, majority voting overfive repetitive measurements ofthe response to the same challenge was performed in order to
RÜHRMAIRet al.: PUF MODELING ATTACKS ON SIMULATED AND SILICON DATA1881determine thefinal response. For example, if thefive measure-ments resulted in three “0”s and two “1”s, thefinal response wasset to “0”. The challenges were generated by a 64-bit pseudo-
As a current student on this bumpy collegiate pathway, I stumbled upon Course Hero, where I can find study resources for nearly all my courses, get online help from tutors 24/7, and even share my old projects, papers, and lecture notes with other students.
Temple University Fox School of Business ‘17, Course Hero Intern
I cannot even describe how much Course Hero helped me this summer. It’s truly become something I can always rely on and help me. In the end, I was not only able to survive summer classes, but I was able to thrive thanks to Course Hero.
University of Pennsylvania ‘17, Course Hero Intern
The ability to access any university’s resources through Course Hero proved invaluable in my case. I was behind on Tulane coursework and actually used UCLA’s materials to help me move forward and get everything together on time.
Tulane University ‘16, Course Hero Intern
Stuck? We have tutors online 24/7 who can help you get unstuck.
Ask Expert Tutors
You can ask
You can ask
You can ask
(will expire )