Lightweight and Anonymous Authentication based on PUF Without CRP leakage for Industrial Internet of Things

Abstract

Physical unclonable function (PUF) is a critical hardware primitive that provides unique identities for authenticating a large number of devices in the Industrial Internet of Things (IIoT). Most existing PUF-based schemes face challenge-response pair (CRP) leakage during machine-learning attack. Some studies that use hardware or time-consuming cryptographic operations to protect the PUF responses are expensive and unsuitable for existing IIoT devices. To address these issues, a lightweight and anonymous PUF-based authentication scheme is proposed for resource-constrained IIoTs. Using elliptic curve cryptography and zero-knowledge proof, a lightweight blinding mechanism is designed in the proposed scheme that prevents explicit CRP leakage and ensures anonymity. In addition, the authenticated keys are random with forward and backward secrecy. Moreover, the security of the proposed scheme is demonstrated using a random oracle model. Experimental results demonstrate that the proposed scheme is notably more efficient and practical for resource-constrained devices compared to other related schemes.