For the first kind of countermeasures, typical designs
use hash functions, XOR gates, and random bits to hide the
original responses. The controlled PUF [5] and the reverse
fuzzy extractor PUF [11] use hash functions. The original
response of the arbiter PUF is input to a hash function, and
then output to the outside. In this way, attackers cannot
directly obtain the original responses. However, in [15],
the unreliability of responses is utilized to successfully
attack such PUFs. This is based on the observation that, if
a response is very unreliable, the delays of two paths are
very likely to be similar.
The XOR PUF [6] and the lightweight PUF [7] adopt
multiple arbiter PUFs. A challenge is input directly or
through certain conversion to these arbiter PUFs, and then
their original responses are XORed to produce the output
response. Attackers can only obtain the XORed results
without knowing the original responses. Such PUFs can
still be attacked by Eq.1 with some modifications to
mathmatically express the XOR gates. But with more
arbiter PUFs adopted in one XOR PUF or lightweight PUF,
much longer time is needed for achieving high prediction
accuracy. However, the work in [16] shows that, by also
utilizing the unreliability of responses, such PUFs are still
easy to be broken. In [14], the correlation among multiple
response bits of lightweight PUF is further explored to
simplify the attack.
The slender PUF [12] uses random bits. If the original
m
-bit response of arbiter PUF is [
r
1
,
r
2
, ...,
r
m
], then the
output response is [
t
1
, ...,
t
k
,
r
0
,
r
1
, ...,
r
m
,
t
k
+1
, ...,
t
m
], where
k
,
t
1
~
t
m
are random values. In this way, when attackers
obtain 2×
m
response bits, they do not know which bits are
the original response bits. However, the work in [17] uses
the evolution strategy to successfully break the slender
PUF.
Therefore,
above
countermeasures
are
still
insufficient to resist modeling attacks.
For the second kind of countermeasures, to replace the
delay, the current and the voltage are used in current
mirror PUF [8] and voltage transfer PUF [9], respectively.
Due to the non-linear characteristic of current mirror and
voltage transfer, Eq.1 cannot be used anymore. However,
we proposed a compound heuristic algorithm of evolution
strategy,
simulated
annealing,
and
ant
colony
to
successfully break them [20].
3. RPUF
3.1 Design
As shown in Fig.1, the basic arbiter PUF has only 1-bit
response, but in practical application, multi-bit response is
needed. To realize it, there are mainly two ways [6][7].
One way is to implement multiple arbiter PUFs to produce
multiple
response
bits
respectively.
Obviously,
this
requires large hardware cost. The other way is to use a
Linear Feedback Shift Register
(LFSR)
or similar modules
to extend a challenge to multiple sub-challenges, and the
sub-challenges are input to the arbiter PUF one by one, so
each sub-challenge produces one response bit, and the
multi-bit response is composed. This paper adopts LFSR,
which requires small hardware cost.