This paper presents a lightweight and secure data communication protocol tailored for resource-constrained IoT environments. The proposed method integrates Challenge-Response Pair (CRP) Physically Unclonable Functions (PUFs) and a True Random Number Generator (TRNG) to eliminate the need for non-volatile key storage, thereby significantly enhancing resistance against physical attacks and key extraction threats. In contrast to conventional public key authentication methods such as those employed in Pretty Good Privacy (PGP), the protocol replaces asymmetric key operations with CRP-PUFs and hash-based message authentication codes (HMACs), effectively removing the need for key pair generation, key distribution, and private key encryption. To ensure stability in PUF responses under environmental variations, the protocol applies majority voting and BCH error correction codes. It further leverages a large CRP space and incorporates dynamic CRP updates to ensure backward secrecy. In addition, elliptic curve cryptography (ECC) point validation is used to defend against fault injection attacks, collectively offering strong resistance against cloning, brute-force, and implementation-level attacks. While preserving the core cryptographic functions of PGP—such as session key wrapping, ECDSA-based digital signatures, and AES encryption—the proposed protocol dynamically derives all secret keys from hardware-based entropy sources. As a result, it achieves comprehensive security guarantees including authentication, integrity, confidentiality, and non-repudiation, while significantly reducing computational complexity and authentication latency compared to conventional ECC-based schemes. The protocol’s correctness and security are formally verified using ProVerif and Mao-Boyd logic, and its practical feasibility is demonstrated through a compact single-chip implementation, making it highly suitable for real-world industrial IoT deployments.

This paper presents a novel reconfigurable SRAM CRP PUF that can achieve high reliability and randomness. In conventional reconfigurable SRAM CRP PUFs, imprecise timing control can produce a biased response output, which is typically attributed to mismatches in the connection of input control signals to the two inverter arrays in the layout floorplan. We propose a timing control scheme along with the addition of an adjunct NMOS transistor to address this issue. This eliminates the connection mismatches for the challenge and word-line inputs to the two inverter arrays. Furthermore, we employ symmetric layout techniques to achieve the randomness of response output. The symmetric arrangement of the two inverter arrays maximizes the inherent random output characteristics derived from process variation. The pre-charge input signal is symmetrically connected to each array to prevent delay mismatches. A 16 × 9-bit reconfigurable PUF array is fabricated by using a 180 nm CMOS process, with a PUF cell area of $1.2$ × ${10}^4$ F${}^2$/bit. The experimental results demonstrate an inter Hamming distance of 0.4949 across 40 chips and an intra Hamming distance of 0.0167 for a single chip in 5000 trials. The measured worst bit error rate (BER) is 4.86% at the nominal point (1.8 V, 25 °C). The proposed prototype exhibits good reliability and randomness, as well as a small silicon area when compared to the conventional SRAM CRP PUFs.

This article presents a novel lightweight authentication and secure communication protocol and its energy-efficient system-on-chip (SoC) implementation for resource-constrained industrial Internet of Things devices operating in unattended and physically exposed environments. The proposed protocol supports device-to-server verification, device-to-device mutual authentication, and session key establishment without storing long-term shared secret keys in nonvolatile memory (NVM), thereby mitigating physical key-extraction and cloning attacks common in exposed industrial deployments. Device-specific keying material is regenerated on demand from an on-chip challenge-response pairs (CRPs)-based physical unclonable function (PUF). Formal security analysis using Mao–Boyd logic and Scyther-based verification demonstrates resistance to replay, man in the middle, impersonation, side-channel, and physical cloning attacks, while protocol-level evaluation confirms low computational cost achieved through exclusive use of symmetric cryptography and a single PUF evaluation per session. Building on the proposed protocol, an energy-efficient SoC architecture is implemented and evaluated. The fabricated design in a 28-nm CMOS process occupies 191 kGE and operates at 25 MHz from a 0.9-V supply. Measurement results show that the complete authentication and key-establishment procedure consumes 11.48 $\mathrm{\mu }$J. The implemented protocol achieves a 1.4× increase in total energy efficiency compared to state-of-the-art cryptographic architecture implementing DTLS and the double ratchet protocol. The security and robustness of the hardware implementation are further assessed through circuit-level analysis of the CRPs-PUF. These analysis results demonstrate the suitability of the proposed protocol and hardware architecture for scalable and long-lifetime industrial IoT deployments.