Multi-Layer CRP Protection for Distributed PUF-Based Authentication and Recoverable Data Sharing

Abstract

The growing adoption of lightweight, scalable, and resistant to tampering security mechanisms in the face of broad use of Internet-of-Things (IoT) and edge computing devices requires such mechanisms to be not based on centralized trust or bulky cryptography. The promising answer to this is the concept of Physical Unclonable Functions (PUFs) which relies on naturally existing manufacturing differences to produce device-specific, unclonable responses. Nevertheless, existing PUF-based authentication systems have significant flaws, such as centralized Challenge-Response Pair (CRP) storage vulnerable to attacks, vulnerability to machine learning, and no support of secure data recovery and sharing in distributed settings. This paper suggests a distributed authentication and recoverable data sharing framework that reduces these drawbacks, PUF-as-a-Service (PUFaaS). PUFaaS presents a multi-dimensional space of CRP, spreading the domain of challenges with respect to various operational parameters to maximize security against modeling attacks. Helper data of fuzzy extractors are secured with Shamir's secret sharing over distributed nodes and without having single points of weakness. A mechanism based on fuzzy vaults provides recoverable data binding, whereby encryption keys or sensitive data can be re-assembled successfully on successful verification of stable PUF responses. Authentication is carried out by way of lightweight commitment protocol, message authentication protocol and optional zero-knowledge proof guarantees privacy. Experimental analysis shows that PUFaaS can be evaluated as having low false acceptance and rejection, high modeling attack resistance, and scale efficiently (appropriate to large-scale IoT and cloud-edge). PUFaaS will offer an effective, privacy-resilient, and scalable solution to distributed authentication and secure information exchange in a non-trusted environment by converting PUFs into a service-oriented architecture.