Physical unclonable functions (PUF) are emerging as a promising alternative to traditional cryptographic protocols for IoT authentication. XOR Arbiter PUFs (XPUFs), a group of well-studied PUFs, are found to be secure against machine learning (ML) attacks if the XOR gate is large enough, as both the number of CRPs and the computational time required for modeling n-XPUF increases fast with respect to n, the number of component arbiter PUFs. In this paper, we present a neural network-based method that can successfully attack XPUFs with significantly fewer CRPs and shorter learning time when compared with existing ML attack methods. Specifically, the experimental study in this paper shows that our new method can break the 64-bit 9-XPUF within ten minutes of learning time for all of the tested samples and runs, with magnitudes faster than the fastest existing ML attack method, which takes over 1.5 days of parallel computing time on 16 cores.

Physical unclonable functions (PUFs) are emerging as a promising class of hardware primitives for delivering security for IoT devices. Cryptographic key-based security mechanisms are heavyweight by demanding resources more than many resource-constraint IoT devices can provide, and are also vulnerable to side-channel invasive attacks. PUFs utilize integrated circuits' manufacturing variations to produce responses unique for individual devices, and hence cannot be reproduced. An important goal of security research is to discover all possible insecure risks, which can provide secure application developers useful information so that they can avoid the risk-containing components or mechanisms. While physically unclonable, some PUFs have been found to be mathematically clonable by machine learning methods. Large XOR arbiter PUFs is one group of PUFs that were shown to withstand existing attack methods unless long training time is used in the machine learning process. In this paper, we investigate the effectiveness of a neural network method in attacking large XOR PUFs, a neural network method modified to handle training datasets possibly larger than memory capacity. Our study shows that the modified neural network method attains high prediction accuracy while consuming substantially less time for large XOR PUFs than the fastest machine learning code used in all earlier studies known to us. Some of the large XOR PUFs that took existing machine learning codes several days of parallel computing time on high-performance computing servers have been broken by our method in less than two hours, indicating vulnerability of even large XOR PUFs. Discovery of all potential vulnerabilities of a PUF is important since secure application developers need such information for deciding which PUF to choose, and an unidentified vulnerability can lead to security risks for IoT devices.

Utilizing integrated circuits' manufacturing variations to produce responses unique for individual devises, physical unclonable functions (PUFs) are not reproducible even by PUF device manufacturers. However, many PUFs have been reported to be “mathematically reproducible” by machine learning-based modeling methods. The feed-forward arbiter PUFs are among the PUFs which have showed strength [1], [2] against machine learning modeling unless large computation time is used in machine learning process and the feed-forward loops are of a special type. In this paper, we develop a signal delay model for the feed-forward arbiter PUFs, through which efficient and accurate machine learning of the PUF's essential features is made possible. Experimental results show that the new model has led to high accuracy and high efficiency for the prediction of the responses of the PUFs with any type of feed-forward loops, and the high prediction accuracy was measured in terms of average prediction rate over all tested all cases. The high efficiency and high accuracy prediction of responses reported in this paper has revealed a weakness of the feed-forward arbiter PUFs that can be potentially utilized by response-prediction-based malicious software.